[PATCH 0/4] Better btrfsck tree corruption report and automatic csum tree rebuild.

[PATCH 0/4] Better btrfsck tree corruption report and automatic csum tree rebuild.

[Qu Wenruo]

Although btrfsck can rebuild the csum tree, but has the following
problems for end users or sysadmins who is not familiar with btrfs.
1) No brief info on which tree is corrupted.
   In fact, after extent and chunk tree check, we iterate all the
   extents and should have a brief view about which tree is corrupted.
   We can info user the fact to give them a clear view about what to do
   next

2) No automatically csum tree rebuild.
   If btrfsck can rebuild csum tree when needed and possible, why not
   rebuild it?

This patchset handles this 2 problems:
Patch 1 will handle problem 1) and patch 2~3) to handle problem 2).
Now csum tree will be automatically rebuilt if and only if csum tree is
broken but all other tree is OK.

Qu Wenruo (4):
  btrfs-progs: Report corrupted trees after check_chunks_and_extents()
  btrfs-progs: Continue repair even some extent reference can't be    
    repaired and report result to user.
  btrfs-progs: Automatically rebuild csum/extent tree if no other tree
    has     corrupted/missing extent.
  btrfs-progs: Remove all csum extents for init_csum

 cmds-check.c  | 172 +++++++++++++++++++++++++++++++++++++++++++++++++++-------
 ctree.h       |   4 ++
 extent-tree.c | 108 ++++++++++++++++++++++++++++++++++++
 3 files changed, 263 insertions(+), 21 deletions(-)

-- 
2.2.1

[PATCH 1/4] btrfs-progs: Report corrupted trees after check_chunks_and_extents()

[Qu Wenruo]

The function check_chunks_and_extents() will iterate all the extents, so
we should have a brief view on which tree is corrupted according to the
backref of extents we iterated.

This patch will mark root corrupted if we find extents whose backref
can't be verified.
And after check_chunks_and_extents() report it to user.
This will helps a lot for users to determine later recovery strategy,
e.g. if user find only csum tree is corrupted, --init-csum will be the
best choice (and in fact, current btrfsck only gives tons of unfriendly
error and no advice or what tree is corrupted).

This patch also provides the basis for later automatic csum/extent tree
rebuild.

Signed-off-by: Qu Wenruo <quwenruo@cn.fujitsu.com>
---
 cmds-check.c | 96 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 ctree.h      |  2 ++
 2 files changed, 98 insertions(+)

diff --git a/cmds-check.c b/cmds-check.c
index ddc0ded..500207e 100644
--- a/cmds-check.c
+++ b/cmds-check.c
@@ -7221,6 +7221,53 @@ static void reset_cached_block_groups(struct btrfs_fs_info *fs_info)
 	}
 }
 
+/*
+ * Mark corresponding btrfs_root corrupted according to the extent_record.
+ * NOTE: For subvolume/fs tree, it will all be marked to fs tree since
+ * we can't determine which exact tree.
+ */
+static int mark_root_corrupted(struct btrfs_fs_info *fs_info,
+			       struct extent_record *rec)
+{
+	struct extent_backref *back;
+	struct tree_backref *tback;
+	struct btrfs_key key;
+	struct btrfs_root *root;
+
+	/* For data, it must be fs/subvolue tree */
+	if (!rec->metadata) {
+data:
+		fs_info->have_corrupted_root = 1;
+		fs_info->fs_root->corrupted = 1;
+		return 0;
+	}
+
+	if (list_empty(&rec->backrefs))
+		return -EINVAL;
+	back = list_entry(rec->backrefs.next, struct extent_backref, list);
+	/* Impossible, but still consider it as data */
+	if (back->is_data)
+		goto data;
+
+	tback = (struct tree_backref *)back;
+	if (is_fstree(tback->root))
+		key.objectid = BTRFS_FS_TREE_OBJECTID;
+	else
+		key.objectid = tback->root;
+	key.type = BTRFS_ROOT_ITEM_KEY;
+	key.offset = (u64)-1;
+
+	root = btrfs_read_fs_root(fs_info, &key);
+	if (PTR_ERR(root) == -ENOENT)
+		root = NULL;
+	if (IS_ERR(root))
+		return PTR_ERR(root);
+	fs_info->have_corrupted_root = 1;
+	if (root)
+		root->corrupted = 1;
+	return 0;
+}
+
 static int check_extent_refs(struct btrfs_trans_handle *trans,
 			     struct btrfs_root *root,
 			     struct cache_tree *extent_cache)
@@ -7362,6 +7409,8 @@ static int check_extent_refs(struct btrfs_trans_handle *trans,
 			}
 			err = 1;
 		}
+		if (err && !fixed)
+			mark_root_corrupted(root->fs_info, rec);
 
 		remove_cache_extent(extent_cache, cache);
 		free_all_extent_backrefs(rec);
@@ -8885,6 +8934,48 @@ out:
 	return bad_roots;
 }
 
+#define CORRUPTED_ROOT		(1<<0)
+#define CORRUPTED_CHUNK		(1<<1)
+#define CORRUPTED_EXTENT	(1<<2)
+#define CORRUPTED_DEVICE	(1<<3)
+#define CORRUPTED_FS		(1<<4)
+#define CORRUPTED_CSUM		(1<<5)
+static u16 report_root_corrupted(struct btrfs_fs_info *fs_info,
+				  const char *prefix)
+{
+	int ret = 0;
+
+	if (!fs_info->have_corrupted_root)
+		return ret;
+	fprintf(stderr,
+		"The following tree(s) may have corrupted/missing extent references:\n");
+	if (!fs_info->tree_root || fs_info->tree_root->corrupted) {
+		fprintf(stderr, "%sroot tree\n", prefix);
+		ret |= CORRUPTED_ROOT;
+	}
+	if (!fs_info->chunk_root || fs_info->chunk_root->corrupted) {
+		fprintf(stderr, "%schunk tree\n", prefix);
+		ret |= CORRUPTED_CHUNK;
+	}
+	if (!fs_info->extent_root || fs_info->extent_root->corrupted) {
+		fprintf(stderr, "%sextent tree\n", prefix);
+		ret |= CORRUPTED_EXTENT;
+	}
+	if (!fs_info->dev_root || fs_info->dev_root->corrupted) {
+		fprintf(stderr, "%sdevice tree\n", prefix);
+		ret |= CORRUPTED_DEVICE;
+	}
+	if (!fs_info->fs_root || fs_info->fs_root->corrupted) {
+		fprintf(stderr, "%sfs/file tree\n", prefix);
+		ret |= CORRUPTED_FS;
+	}
+	if (!fs_info->csum_root || fs_info->csum_root->corrupted) {
+		fprintf(stderr, "%schecksum tree\n", prefix);
+		ret |= CORRUPTED_CSUM;
+	}
+	return ret;
+}
+
 static struct option long_options[] = {
 	{ "super", 1, NULL, 's' },
 	{ "repair", 0, NULL, 0 },
@@ -9113,6 +9204,11 @@ int cmd_check(int argc, char **argv)
 	if (ret)
 		fprintf(stderr, "Errors found in extent allocation tree or chunk allocation\n");
 
+	/*
+	 * chunk and extent tree check has iterates all the extents,
+	 * so know we have a brief view on which trees are damaged.
+	 */
+	report_root_corrupted(info, "\t");
 	ret = repair_root_items(info);
 	if (ret < 0)
 		goto close_out;
diff --git a/ctree.h b/ctree.h
index 5dbc767..48fa492 100644
--- a/ctree.h
+++ b/ctree.h
@@ -1004,6 +1004,7 @@ struct btrfs_fs_info {
 				int refs_to_drop);
 	struct cache_tree *fsck_extent_cache;
 	struct cache_tree *corrupt_blocks;
+	unsigned int have_corrupted_root:1;
 };
 
 /*
@@ -1052,6 +1053,7 @@ struct btrfs_root {
 	/* the dirty list is only used by non-reference counted roots */
 	struct list_head dirty_list;
 	struct rb_node rb_node;
+	unsigned int corrupted:1;
 };
 
 /*
-- 
2.2.1

[PATCH 2/4] btrfs-progs: Continue repair even some extent reference can't be repaired and report result to user.

[Qu Wenruo]

Before this patch, btrfsck will exit repairing if some extent reference
can't be repaired.
This is somewhat overkilled.

This patch will report number of all errors and fixed/recorded one, and
continue in repair mode.

Signed-off-by: Qu Wenruo <quwenruo@cn.fujitsu.com>
---
 cmds-check.c | 56 +++++++++++++++++++++++++++++++++-----------------------
 1 file changed, 33 insertions(+), 23 deletions(-)

diff --git a/cmds-check.c b/cmds-check.c
index 500207e..b275b39 100644
--- a/cmds-check.c
+++ b/cmds-check.c
@@ -7279,6 +7279,9 @@ static int check_extent_refs(struct btrfs_trans_handle *trans,
 	int fixed = 0;
 	int had_dups = 0;
 	int recorded = 0;
+	u64 nr_fixed = 0;
+	u64 nr_recorded = 0;
+	u64 nr_err = 0;
 
 	if (repair) {
 		/*
@@ -7340,12 +7343,12 @@ static int check_extent_refs(struct btrfs_trans_handle *trans,
 	if (had_dups)
 		return -EAGAIN;
 
-	while(1) {
+	cache = first_cache_extent(extent_cache);
+	while(cache) {
+		err = 0;
 		fixed = 0;
 		recorded = 0;
-		cache = search_cache_extent(extent_cache, 0);
-		if (!cache)
-			break;
+
 		rec = container_of(cache, struct extent_record, cache);
 		if (rec->num_duplicates) {
 			fprintf(stderr, "extent item %llu has multiple extent "
@@ -7360,9 +7363,10 @@ static int check_extent_refs(struct btrfs_trans_handle *trans,
 			fprintf(stderr, "extent item %llu, found %llu\n",
 				(unsigned long long)rec->extent_item_refs,
 				(unsigned long long)rec->refs);
+			err = 1;
 			ret = record_orphan_data_extents(root->fs_info, rec);
 			if (ret < 0)
-				goto repair_abort;
+				goto next;
 			if (ret == 0) {
 				recorded = 1;
 			} else {
@@ -7375,11 +7379,10 @@ static int check_extent_refs(struct btrfs_trans_handle *trans,
 							root->fs_info,
 							extent_cache, rec);
 					if (ret)
-						goto repair_abort;
+						goto next;
 					fixed = 1;
 				}
 			}
-			err = 1;
 
 		}
 		if (all_backpointers_checked(rec, 1)) {
@@ -7387,48 +7390,55 @@ static int check_extent_refs(struct btrfs_trans_handle *trans,
 				(unsigned long long)rec->start,
 				(unsigned long long)rec->nr);
 
+			err = 1;
 			if (!fixed && !recorded && repair) {
 				ret = fixup_extent_refs(trans, root->fs_info,
 							extent_cache, rec);
 				if (ret)
-					goto repair_abort;
+					goto next;
 				fixed = 1;
 			}
-			err = 1;
 		}
 		if (!rec->owner_ref_checked) {
 			fprintf(stderr, "owner ref check failed [%llu %llu]\n",
 				(unsigned long long)rec->start,
 				(unsigned long long)rec->nr);
+			err = 1;
 			if (!fixed && !recorded && repair) {
 				ret = fixup_extent_refs(trans, root->fs_info,
 							extent_cache, rec);
 				if (ret)
-					goto repair_abort;
+					goto next;
 				fixed = 1;
 			}
-			err = 1;
 		}
-		if (err && !fixed)
-			mark_root_corrupted(root->fs_info, rec);
-
 		remove_cache_extent(extent_cache, cache);
 		free_all_extent_backrefs(rec);
 		free(rec);
+next:
+		if (err && !fixed)
+			mark_root_corrupted(root->fs_info, rec);
+
+		nr_err += err;
+		nr_fixed += fixed;
+		nr_recorded += recorded;
+		cache = next_cache_extent(cache);
 	}
-repair_abort:
+
 	if (repair) {
-		if (ret && ret != -EAGAIN) {
-			fprintf(stderr, "failed to repair damaged filesystem, aborting\n");
-			exit(1);
-		} else if (!ret) {
+		if (!ret)
 			btrfs_fix_block_accounting(trans, root);
-		}
-		if (err)
-			fprintf(stderr, "repaired damaged extent references\n");
+		printf("Found %llu errors, fixed %llu, recorded %llu\n",
+		       nr_err, nr_fixed, nr_recorded);
+		if (nr_fixed == nr_err)
+			printf("repaired all damaged extent references\n");
+		else if (nr_fixed + nr_recorded == nr_err)
+			printf("all damaged extent references repaired or recorded for later repair\n");
+		else
+			printf("some extent referenced can't be repaired\n");
 		return ret;
 	}
-	return err;
+	return nr_err;
 }
 
 u64 calc_stripe_length(u64 type, u64 length, int num_stripes)
-- 
2.2.1

[PATCH 3/4] btrfs-progs: Automatically rebuild csum/extent tree if no other tree has corrupted/missing extent.

[Qu Wenruo]

If we find other tree has no corrupted/missing extent, we should be
safely to rebuild csum/extent tree.

This patch will automatically do it using the report_root_corrtuped()
result.

Signed-off-by: Qu Wenruo <quwenruo@cn.fujitsu.com>
---
 cmds-check.c | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/cmds-check.c b/cmds-check.c
index b275b39..7d8d9d1 100644
--- a/cmds-check.c
+++ b/cmds-check.c
@@ -9030,6 +9030,8 @@ int cmd_check(int argc, char **argv)
 	int init_csum_tree = 0;
 	int qgroup_report = 0;
 	enum btrfs_open_ctree_flags ctree_flags = OPEN_CTREE_EXCLUSIVE;
+	u16 root_corrupted = 0;
+	int in_recheck = 0;
 
 	while(1) {
 		int c;
@@ -9075,12 +9077,14 @@ int cmd_check(int argc, char **argv)
 			printf("Creating a new CRC tree\n");
 			init_csum_tree = 1;
 			repair = 1;
+			in_recheck = 1;
 			ctree_flags |= OPEN_CTREE_WRITES;
 		} else if (option_index == 3) {
 			init_extent_tree = 1;
 			ctree_flags |= (OPEN_CTREE_WRITES |
 					OPEN_CTREE_NO_BLOCK_GROUPS);
 			repair = 1;
+			in_recheck = 1;
 		} else if (option_index == 4) {
 			check_data_csum = 1;
 		}
@@ -9106,6 +9110,7 @@ int cmd_check(int argc, char **argv)
 	if (repair)
 		ctree_flags |= OPEN_CTREE_PARTIAL;
 
+again:
 	info = open_ctree_fs_info(argv[optind], bytenr, tree_root_bytenr,
 				  ctree_flags);
 	if (!info) {
@@ -9218,7 +9223,21 @@ int cmd_check(int argc, char **argv)
 	 * chunk and extent tree check has iterates all the extents,
 	 * so know we have a brief view on which trees are damaged.
 	 */
-	report_root_corrupted(info, "\t");
+	root_corrupted = report_root_corrupted(info, "\t");
+	if (repair && !in_recheck && (root_corrupted == CORRUPTED_CSUM ||
+	    root_corrupted == CORRUPTED_EXTENT)) {
+		in_recheck = 1;
+		if (root_corrupted == CORRUPTED_CSUM) {
+			init_csum_tree = 1;
+			printf("Only csum tree is corrupted, rebuild it\n");
+		}
+		if (root_corrupted == CORRUPTED_EXTENT) {
+			init_extent_tree = 1;
+			printf("Only extent tree is corrupted, rebuild it\n");
+		}
+		close_ctree(root);
+		goto again;
+	}
 	ret = repair_root_items(info);
 	if (ret < 0)
 		goto close_out;
-- 
2.2.1

[PATCH 4/4] btrfs-progs: Remove all csum extents for init_csum

[Qu Wenruo]

The original csum tree init codes will only rebuild the csum tree, but
don't remove the tree block extents in extent tree, and let extent tree
repair to repair all the mismatch extents.
This is OK if calling --init-csum manually, but it's confusing if
csum tree build it executed automatically, and csum tree corruption will
be reported twice.

This patch removes the csum extents in csum tree rebuild routine, which
will make the check result clean after automatically csum tree rebuild.

Signed-off-by: Qu Wenruo <quwenruo@cn.fujitsu.com>
---
 cmds-check.c  |   5 +++
 ctree.h       |   2 ++
 extent-tree.c | 108 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 115 insertions(+)

diff --git a/cmds-check.c b/cmds-check.c
index 7d8d9d1..45d3468 100644
--- a/cmds-check.c
+++ b/cmds-check.c
@@ -9182,6 +9182,11 @@ again:
 
 		if (init_csum_tree) {
 			fprintf(stderr, "Reinit crc root\n");
+			ret = remove_csum_extents(trans, info->extent_root);
+			if (ret < 0) {
+				fprintf(stderr, "crc extents removing failed\n");
+				goto close_out;
+			}
 			ret = btrfs_fsck_reinit_root(trans, info->csum_root, 0);
 			if (ret) {
 				fprintf(stderr, "crc root initialization failed\n");
diff --git a/ctree.h b/ctree.h
index 48fa492..a088554 100644
--- a/ctree.h
+++ b/ctree.h
@@ -2249,6 +2249,8 @@ int btrfs_record_file_extent(struct btrfs_trans_handle *trans,
 			      struct btrfs_inode_item *inode,
 			      u64 file_pos, u64 disk_bytenr,
 			      u64 num_bytes);
+int remove_csum_extents(struct btrfs_trans_handle *trans,
+			struct btrfs_root *root);
 /* ctree.c */
 int btrfs_comp_cpu_keys(struct btrfs_key *k1, struct btrfs_key *k2);
 int btrfs_del_ptr(struct btrfs_trans_handle *trans, struct btrfs_root *root,
diff --git a/extent-tree.c b/extent-tree.c
index 080f30d..d614e7e 100644
--- a/extent-tree.c
+++ b/extent-tree.c
@@ -3555,3 +3555,111 @@ fail:
 	btrfs_release_path(&path);
 	return ret;
 }
+
+/*
+ * Remove all the extents belong to csum tree and update blockgroup info
+ *
+ * Only used in csum tree rebuilding. Since the whole csum tree root
+ * will be a new one, no backref needs to be updated
+ */
+int remove_csum_extents(struct btrfs_trans_handle *trans,
+			struct btrfs_root *root)
+{
+	struct btrfs_key key;
+	struct btrfs_path *path;
+	struct btrfs_extent_item *ei;
+	int skinny_metadata = btrfs_fs_incompat(root->fs_info,
+			BTRFS_FEATURE_INCOMPAT_SKINNY_METADATA);
+	int ret = 0;
+
+	/* Extent tree root not exists, no need to remove csum extents */
+	if (!root)
+		return 0;
+	path = btrfs_alloc_path();
+	if (!path)
+		return -ENOMEM;
+
+	key.objectid = 0;
+	key.type = 0;
+	key.offset = 0;
+
+	ret = btrfs_search_slot(trans, root, &key, path, -1, 1);
+	if (ret < 0)
+		goto out;
+	while (1) {
+		struct extent_buffer *node;
+		int slot;
+
+		slot = path->slots[0];
+		node = path->nodes[0];
+		
+		btrfs_item_key_to_cpu(node, &key, slot);
+		if (key.type != BTRFS_METADATA_ITEM_KEY &&
+		    key.type != BTRFS_EXTENT_ITEM_KEY)
+			goto next;
+		ei = btrfs_item_ptr(node, slot,
+				    struct btrfs_extent_item);
+		/*
+		 * refs to csum tree extent must be 1
+		 * if not 1, it must be a fs tree extent.
+		 */
+		if (btrfs_extent_refs(node, ei) != 1)
+			goto next;
+
+		if (skinny_metadata) {
+			struct btrfs_extent_inline_ref *iref;
+
+			if (key.type != BTRFS_METADATA_ITEM_KEY)
+				goto next;
+
+			iref = (struct btrfs_extent_inline_ref *)(ei + 1);
+
+			if (btrfs_extent_inline_ref_offset(node, iref) !=
+			    BTRFS_CSUM_TREE_OBJECTID)
+				goto next;
+		} else {
+			struct btrfs_tree_block_info *tref;
+			struct btrfs_disk_key disk_key;
+			struct btrfs_key tree_key;
+
+			if (!(btrfs_extent_flags(node, ei) &
+			      BTRFS_EXTENT_FLAG_TREE_BLOCK))
+				goto next;
+			tref = (struct btrfs_tree_block_info *)(ei + 1);
+			btrfs_tree_block_key(node, tref, &disk_key);
+			btrfs_disk_key_to_cpu(&tree_key, &disk_key);
+			if (tree_key.type != BTRFS_EXTENT_CSUM_KEY)
+				goto next;
+		}
+		/* Now we are sure it's a extent of csum tree */
+		ret = btrfs_del_item(trans, root, path);
+		if (ret < 0)
+			goto out;
+
+		ret = update_block_group(trans, root, key.objectid,
+					 root->leafsize, 0, 1);
+		if (ret < 0)
+			goto out;
+
+		/* We are at the next block, check slot and continue */
+		if (path->slots[0] >= btrfs_header_nritems(path->nodes[0])) {
+			ret = btrfs_next_leaf(root, path);
+			if (ret > 0) {
+				ret = 0;
+				goto out;
+			}
+		}
+		continue;
+next:
+		ret = btrfs_next_item(root, path);
+		if (ret < 0)
+			goto out;
+		if (ret > 0) {
+			ret = 0;
+			goto out;
+		}
+	}
+out:
+	btrfs_free_path(path);
+	return ret;
+}
-- 
2.2.1

Re: [PATCH 0/4] Better btrfsck tree corruption report and automatic csum tree rebuild.

[David Sterba]

On Tue, Jan 13, 2015 at 10:04:43AM +0800, Qu Wenruo wrote:
> Although btrfsck can rebuild the csum tree, but has the following
> problems for end users or sysadmins who is not familiar with btrfs.
> 1) No brief info on which tree is corrupted.
>    In fact, after extent and chunk tree check, we iterate all the
>    extents and should have a brief view about which tree is corrupted.
>    We can info user the fact to give them a clear view about what to do
>    next
> 
> 2) No automatically csum tree rebuild.
>    If btrfsck can rebuild csum tree when needed and possible, why not
>    rebuild it?

> This patchset handles this 2 problems:
> Patch 1 will handle problem 1) and patch 2~3) to handle problem 2).
> Now csum tree will be automatically rebuilt if and only if csum tree is
> broken but all other tree is OK.

I don't agree here, rebuilding the csum tree should be user's decision.
Point 1) is good, giving more information to the user certainly helps to
make that decision.

Re: [PATCH 0/4] Better btrfsck tree corruption report and automatic csum tree rebuild.

[Qu Wenruo]

-------- Original Message --------
Subject: Re: [PATCH 0/4] Better btrfsck tree corruption report and 
automatic csum tree rebuild.
From: David Sterba <dsterba@suse.cz>
To: Qu Wenruo <quwenruo@cn.fujitsu.com>
Date: 2015年01月29日 02:27
> On Tue, Jan 13, 2015 at 10:04:43AM +0800, Qu Wenruo wrote:
>> Although btrfsck can rebuild the csum tree, but has the following
>> problems for end users or sysadmins who is not familiar with btrfs.
>> 1) No brief info on which tree is corrupted.
>>     In fact, after extent and chunk tree check, we iterate all the
>>     extents and should have a brief view about which tree is corrupted.
>>     We can info user the fact to give them a clear view about what to do
>>     next
>>
>> 2) No automatically csum tree rebuild.
>>     If btrfsck can rebuild csum tree when needed and possible, why not
>>     rebuild it?
>> This patchset handles this 2 problems:
>> Patch 1 will handle problem 1) and patch 2~3) to handle problem 2).
>> Now csum tree will be automatically rebuilt if and only if csum tree is
>> broken but all other tree is OK.
> I don't agree here, rebuilding the csum tree should be user's decision.
> Point 1) is good, giving more information to the user certainly helps to
> make that decision.
If 1) is merged, I'm OK with not merging 2).
Since before this patchset, even csum tree is corrupted, we don't even 
know csum tree is corrupted.

So if 1) is merged, user will be more clear to reset the csum tree.

Thanks,
Qu