[BUG] two raid consistency bugs

Hello btrfs devs,

I found two raid-related bugs in btrfs. Two test cases are provided.


BUG 1. fstests: btrfs/348: test ambiguous generation handling on raid1 profile

This test simulates a ambiguous generation which can be caused by, for
example, two successive power failures. Please note this is not related
to degraded mounts or nodatacow.

This bug may affect several raid levels, take raid1 (say disk A and B)
as an example:

At first power failure during transaction N, metadata trees of
generation N are written to disk A, but super is not committed. Nothing
is written to disk B.

At second power failure during a different transaction N, nothing is
written to disk A, but metadata trees and super is committed to disk B.

This creates a ambiguous generation N in two disks. Currently btrfs
can't detect this, and can lead to severe damages. 

I'd like to discuss possible solutions:

1) Turn btrfs metadata trees into merkle trees

This is the most CoW flavor solution. With a strong checksum algorithm,
merkle tree can gurantee ambiguous is detected and fixed.  However it is
difficult to implement because metadata checksumming is done at bio time
(not at tree manipulation time), also on-disk format is changed. 

2) A write-intent bitmap

This is the traditional solution to raid consistency problem. This can
also helps resync nodatacow data. However it seems there is an anandoned
series of write-intent patches in btrfs mailing list.

3) Generation redzone

Introduce a generation redzone value to superblock, which is updated at
mount time, for example:

1st mount: generation=N redzone=N   -> next generation id is N+1
2nd mount: generation=N redzone=N+1 -> next generation id is N+2
3rd mount: generation=N redzone=N+2 -> next generation id is N+3

However it seems there can be infinte TRANS_STATE_UNBLOCKED
transactions, so it's hard to decide how may delta should we add to
redzone value to get next generation id. 

Also, this redzone value is not applicable to tree-log, so BUG 2 (see
below) can't be solved.

4) Dirty workaround

Pin metadata to a dedicated device (which can be LVM raid1) and ask user
to run single metadata profile. This is too dirty and should not used.


BUG 2. fstests: btrfs/349: test if latest tree-log is choosen at mount time on raid1 profile

This test simulate a scenario that tree-log only exists in secondary
device, and test if latest tree-log is choosen at mount time. Currently,
the tree-log in the device with lowest devid is choosen. So fsync'ed
data may loss if tree-log only exists in secondary device.

A proposed draft fix is available at:

https://lore.kernel.org/linux-btrfs/[email protected]/

However, this draft fix also suffers from the above ambiguous generation
problem.


Zhang Boyang