Enum ProbeFailure 

pub enum ProbeFailure {
    Setup(Error),
    ReadOp(Error),
}

Why the probe refused to start the io_uring driver.

Mirrors the P2 degradation contract (backlog#894): a restricted environment must be recognized and answered with a silent fallback to the std backend, never surfaced to callers.

Variants

Setup(Error)

io_uring_setup itself failed (seccomp/gVisor/old kernel).

ReadOp(Error)

The ring was created but a real IORING_OP_READ did not complete correctly (gVisor accepts setup but fails ops; also covers silent data corruption, which we treat as “unusable”).

Implementations

impl ProbeFailure

pub fn is_expected_restriction(&self) -> bool

True when the probe-time errno belongs to the “expected restriction” class that P2 maps to permanent per-disk fallback: EACCES/EPERM/ENOSYS/EINVAL/EOPNOTSUPP. Anything else is a genuine bug worth surfacing.

IMPORTANT (C7, rustfs/backlog#1059): this classification is valid ONLY for a one-shot startup probe, where these errnos unambiguously mean “io_uring is unusable here” (gVisor/seccomp/old kernel). Runtime per-op errnos have different semantics and MUST NOT reuse this class. In particular EINVAL is triple-meaning at runtime — offset > i64::MAX (signed loff_t), O_DIRECT buffer/offset/len misalignment (P2 will use O_DIRECT), and setup entries over the cap — none of which imply the disk should be permanently degraded off io_uring. P2’s degradation contract must split errnos into three classes:

• probe-time restriction -> degrade this disk to the std backend;
• runtime parameter error -> return the error to the caller (and, for a suspected bug, re-verify once via std pread) — never latch;
• transient (EINTR/EAGAIN) -> retry, never surface.

See submit for the offset guard that keeps a caller arithmetic bug from ever reaching the kernel as a runtime EINVAL.

Trait Implementations

impl Debug for ProbeFailure

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.