On Fri, 27 Mar 2009 16:28:41 +0000
Matthew Garrett <mjg59@srcf.ucam.org> wrote:
The fsync if you need to see all errors on close case has been true since
before V7 unix. Its the normal default behaviour on these systems so
anyone who assumes otherwise is just broken. There is a limit to the
extent the OS can clean up after completely broken user apps.
Besides which a properly designed desktop clearly has a single interface
of the form
happened = write_file_reliably(filename|NULL, buffer, len, flags)
happened = replace_file_reliably(filename|NULL, buffer, len,
flags (eg KEEP_BACKUP));
which internally does all the error handling, reporting to user, offering
to save elsewhere, ensuring that the user can switch app and make space
and checking for media errors. It probably also has an asynchronous
version you can bind event handlers to for completion, error, etc so that
you can override the default handling but can't fail to provide something
by default. That would be designing failure out of the system.
IMHO the real solution to a lot of this actually got proposed earlier in
the thread. Adding "fbarrier()" allows the expression of ordering without
blocking and provides something new apps can use to get best performance.
Old properly written apps continue to work and can be improved, and sloppy
garbage continues to mostly work.
The file system behaviour is constrained heavily by the hardware, which
at this point is constrained by the laws of physics and the limits
of materials.
Alan
--
