Tom Lane wrote:
> Still, I agree that the whole thing looks too Rube Goldbergian to count
> as a reliability enhancer, which is what the point is after all.
Agreed.
> I think the argument is about whether we increase our vulnerability to
> torn-page problems if we just add a CRC and don't do anything else to
> the overall writing process. Right now, a partial write on a
> hint-bit-only update merely results in some hint bits getting lost
> (as long as you discount the scenario where the disk fails to read a
> partially-written sector at all --- maybe we're fooling ourselves to
> ignore that?). With a CRC added, that suddenly becomes a corrupted-page
> situation, and it's not easy to tell that no real harm was done.
The first idea that comes to mind is skipping hint bits in the CRC too.
That does away with a lot of the trouble (PD_UNLOGGED_CHANGE, the
necessity of WAL-logging hint bits, etc). The problem, again, is that
the checksumming process becomes page type-specific; but then maybe
that's the only workable approach.
--
Alvaro Herrera http://www.CommandPrompt.com/
The PostgreSQL Company - Command Prompt, Inc.