geom_mirror silently upgrading metadata [Was: cvs commit: src UPDATING]

[Maxim Sobolev]

Remko Lodder wrote:
>   MFC r180345
>   
>     Add missing information for geom_mirror metadata.
>   
>     PR:             124434
>     Submitted by:   Philip M. Golluci <pgolluci at p6m7g8 dot com>
>     MFC after:      3 days

Not really relevant to the change in question, but I think that the 
whole idea of geom_mirror updating on-disk metadata automagically is not 
  very well thought out. For example one could try booting 7.x kernel on 
6.x system just to see how well it goes with the intention to revert 
back if it doesn't work out well. We have excellent tool called nextboot 
(8) that really helps doing it safely or semi-safely even remotely over 
ssh. In the worst case you just need to cycle the power to return to the 
previous configuration.

Automatic conversion makes it impossible to go back without some heavy 
manual intervention at console necessary to boot off the disk directly 
and re-creating/re-syncing the mirror after that. I've run into exactly 
this issue today, with the target machine stuck in unbootable state on 
another continent many thousand miles away.

Another possible common scenarios where automatic updates can do harm 
are: booting 7.0 recovery CD on 6.x system or multi-boot system with 
several FreeBSD versions installed on the same machine and sharing 
mirrored disk(s).

IMHO metadata update should be performed if and only if explicitly 
requested by the administrator. In all other cases the driver should do 
conversion from old format to the new one in memory when reading 
metadata and convert back when saving it. Printing big warning about the 
need to update metadata mentioning the fact that using mirror with old 
kernels won't be possible afterwards is OK, though.

At least this has to be done for the cases when the difference is 
reasonable, such as just one generation in my case. If the difference is 
beyond any reasonable limits (i.e. v3 on-disk metadata and v6 module), 
the driver should present console prompt and let admin make a decision 
explicitly.

-Maxim