Subject: Re: [bug#74273] [PATCH v2] Improve bcachefs support

From: Maxim Cournoyer <[email-masked]>
Date: Sun, 24 Nov 2024 23:58:21 +0900

Hi,

Massimo Zaniboni <[email-masked]> writes:

> Improve bcachefs support: 
> - recognize multi-device setup;
> - mount degraded file-system with missing devices; 
> - use the built-in kernel fscheck instead of user-space bcachefs-tools;

Sounds good, although you'll want to check how other commits are
formatted; the standard we follow is that of the GNU ChangeLog, as
explained here [0] (or 'info "(standards) Change Logs"' if you have
info-reader and autoconf installed).

[0]  https://www.gnu.org/prep/standards/standards.html#Change-Logs

> Change-Id: Ic741b70a7bce930da02c821c83c0a060875f4771
> ---
>
>  doc/guix.texi               |  22 ++++++++
>  gnu/build/file-systems.scm  | 105 ++++++++++++++++++++++++++++++------
>  gnu/build/linux-boot.scm    |   3 +-
>  gnu/machine/ssh.scm         |  23 +++++++-
>  gnu/system/file-systems.scm |  15 ++++++
>  guix/scripts/system.scm     |  25 ++++++++-
>  6 files changed, 175 insertions(+), 18 deletions(-)
>
> diff --git a/doc/guix.texi b/doc/guix.texi
> index 2ab78d6..d962536 100644
> --- a/doc/guix.texi
> +++ b/doc/guix.texi
> @@ -18152,6 +18152,28 @@ Btrfs file system
>  compress-force=zstd,space_cache=v2"))
>  @end lisp
>  
> +@menu
> +* Bcachefs file system::
> +@end menu
> +
> +@node Bcachefs file system
> +@subsection Bcachefs file system
> +
> +Bcachefs supports RAID1/10-style redundancy, replicating data across multiple devices.
> +To mount a file system with potentially missing devices but all data intact,
> +the @code{degraded} option is required. This is an example of a multi-device setup:

Please use double-spaces between sentences; that's a Texinfo/GNU
convention that makes navigating between sentences unambiguous.

> +
> +@lisp
> +(file-system
> +  (mount-point "/home")
> +    (device "/dev/sdb:/dev/sdc:/dev/sdd")
> +    (type "bcachefs")
> +    (options "degraded")
> +@end lisp
> +
> +Currently, bcachefs cannot be used as the root file-system in Guix,
> +nor can it contain the Guix store.
> +
>  @node Mapped Devices
>  @section Mapped Devices
>  
> diff --git a/gnu/build/file-systems.scm b/gnu/build/file-systems.scm
> index 6fd9f95..89ef18c 100644
> --- a/gnu/build/file-systems.scm
> +++ b/gnu/build/file-systems.scm
> @@ -10,6 +10,7 @@
>  ;;; Copyright © 2024 Nicolas Graves <[email-masked]>
>  ;;; Copyright © 2024 Richard Sent <[email-masked]>
>  ;;; Copyright © 2024 Janneke Nieuwenhuizen <[email-masked]>
> +;;; Copyright © 2024 Massimo Zaniboni <[email-masked]>
>  ;;;
>  ;;; This file is part of GNU Guix.
>  ;;;
> @@ -348,6 +349,8 @@ (define-syntax %bcachefs-endianness
>    ;; Endianness of bcachefs file systems.
>    (identifier-syntax (endianness little)))
>  
> +;; FIXME at least since Linux kernel 6.11, the superblock is not
> +;; recognized anymore.
>  (define (bcachefs-superblock? sblock)
>    "Return #t when SBLOCK is an bcachefs superblock."
>    (bytevector=? (sub-bytevector sblock 24 16)
> @@ -1143,10 +1146,10 @@ (define find-partition-by-luks-uuid
>    (find-partition luks-partition-uuid-predicate))

I think this should be investigated and fixed before this gets merged,
as that's a serious problem, right?

>  
> -(define (canonicalize-device-spec spec)
> -  "Return the device name corresponding to SPEC, which can be a <uuid>, a
> -<file-system-label>, the string 'none' or another string (typically a /dev
> -file name or an nfs-root containing ':/')."
> +(define* (canonicalize-device-spec spec #:optional file-system-type)
> +  "Return, usually at boot-time, the device name corresponding to SPEC,
> +which can be a <uuid>, a <file-system-label>, the string 'none'
> +or another string like a device, a multi-device, file name, nfs-root."
>    (define max-trials
>      ;; Number of times we retry partition label resolution, 1 second per
>      ;; trial.  Note: somebody reported a delay of 16 seconds (!) before their
> @@ -1154,6 +1157,11 @@ (define (canonicalize-device-spec spec)
>      ;; this long.
>      20)
>  
> +  (define file-system-type-str
> +    (if (string? file-system-type)
> +          file-system-type
> +          "unknown"))
> +
>    (define (resolve find-partition spec fmt)
>      (let loop ((count 0))
>        (let ((device (find-partition spec)))
> @@ -1168,20 +1176,73 @@ (define (canonicalize-device-spec spec)
>                    (sleep 1)
>                    (loop (+ 1 count))))))))
>  
> +  (define (stat-device device)
> +    (stat device #f))
> +
> +  (define (check-bcachefs-superblock dev)
> +    (= 0 (system*/tty "bcachefs" "show-super" "--field-only" "disk_groups" dev)))

nitpick: Please pay attention to the maximum 80 chars line width.

> +
> +  (define (resolve-bcachefs-multi-device multi-device)
> +    (let ((devices (string-split multi-device #\:)))
> +      ;; Some devices take a bit of time to appear, most notably USB
> +      ;; storage devices. Thus, wait for the device to appear.
> +      ;; NOTE: it will wait MAX-TRIALS for all the devices,
> +      ;; and not for any device.
> +      (let loop
> +       ((count 0))
> +       (let ((missing-dev (find (lambda (d) (not (stat-device d))) devices)))
> +         (when (and missing-dev (<= count max-trials))
> +           (format #t "waiting for device '~a' to appear...~%" missing-dev)
> +           (sleep 1)
> +           (loop (+ 1 count)))))
> +
> +      ;; bcachefs can work in degraded mode using only few of the devices.
> +      ;; As of Linux kernel 6.11.6, it requires that the missing/fault
> +      ;; devices are removed from the multi-device specification,
> +      ;; and that it is mounted with the "degraded" option.

nitpick: [here and elsewhere, you'll want to ensure your sentences
ending use double spaces.

> +      (let ((valid-specs
> +               (filter
> +                 (lambda (d) (and (stat-device d)
> +                                  (check-bcachefs-superblock d)))
> +                 devices)))
> +        (if (null? valid-specs)
> +            (error "failed to resolve multi-device " multi-device))
> +            (string-join valid-specs ":"))))
> +
>    (match spec
>      ((? string?)
> -     (if (or (string-contains spec ":/") ;nfs
> -             (and (>= (string-length spec) 2)
> -                  (equal? (string-take spec 2) "//")) ;cifs
> -             (string=? spec "none"))
> -         spec                  ; do not resolve NFS / CIFS / tmpfs devices
> -         ;; Nothing to do, but wait until SPEC shows up.
> -         (resolve identity spec identity)))
> +     (cond
> +       ((multi-device-spec? spec)
> +        (cond
> +         ((string=? file-system-type-str "bcachefs")
> +            (resolve-bcachefs-multi-device spec))
> +         (else (error
> +                (string-append
> +                   "unsupported multi-device specification "
> +                   spec
> +                   " for file-system type "
> +                   file-system-type-str)))))
> +       ((string-contains spec ":/")
> +         ;NFS, something like 'server:/some/path'

nitpick: Prefix stand-alone comments like the above with two ';'
followed by a space (inline comments with single ; and no following
space are fine).

> +        spec)
> +       ((and (>= (string-length spec) 2)
> +             (equal? (string-take spec 2) "//"))
> +         ;CIFS
> +        spec)
> +       ((string=? spec "none")
> +         ;tmpfs
>
I'd perhaps move the above comments inline, to the right of the first
line of the cond clause.

> +        spec)
> +       (else
> +        ;; Nothing to do, but wait until SPEC shows up.
> +        ; TODO it should use STAT on some devices instead of IDENTITY.
> +        ; But using STAT on all DEVICES, the boot process will block.
> +        ; At least, all other devices specified using labels and UUID are
> +        ; processed using the more robust STAT function.
> +        (resolve identity spec identity))))
>      ((? file-system-label?)
>       ;; Resolve the label.
>       (resolve find-partition-by-label
> -              (file-system-label->string spec)
> -              identity))
> +              (file-system-label->string spec) identity))
>      ((? uuid?)
>       (resolve find-partition-by-uuid
>                (uuid-bytevector spec)
> @@ -1194,10 +1255,24 @@ (define (check-file-system device type force? repair)
>  found.  Otherwise, fix only those considered safe to repair automatically.  Not
>  all TYPEs support all values or combinations of FORCE? and REPAIR.  Don't throw
>  an exception in such cases but perform the nearest sane action."
> +
> +  (define (built-in-file-system-check device force? repair)
> +    'pass)
> +
>    (define check-procedure
>      (cond
>       ((string-prefix? "ext" type) check-ext2-file-system)
> -     ((string-prefix? "bcachefs" type) check-bcachefs-file-system)
> +     ((string-prefix? "bcachefs" type)
> +       ;; According bcachefs manual: "No special handling is needed for recovering
> +       ;; from unclean shutdown. Journal replay happens automatically,
> +       ;; and diagnostic messages in the dmesg log will indicate whether recovery
> +       ;; was from clean or unclean shutdown."
> +       ;; Moreover, at least until Linux kernel 6.11, the bcachefs-tools package
> +       ;; does not try to respect the bcachefs format supported by the kernel.
> +       ;; So, the fsck of bcachefs-tools is called only if explicitely stated.
> +        (if force?
> +          check-bcachefs-file-system
> +          built-in-file-system-check))
>       ((string-prefix? "btrfs" type) check-btrfs-file-system)
>       ((string-suffix? "exfat" type) check-exfat-file-system)
>       ((string-suffix? "fat" type) check-fat-file-system)
> @@ -1385,7 +1460,7 @@ (define* (mount-file-system fs #:key (root "/root")
>                                  "")))))
>  
>    (let* ((type    (file-system-type fs))
> -         (source  (canonicalize-device-spec (file-system-device fs)))
> +         (source  (canonicalize-device-spec (file-system-device fs) type))
>           (target  (string-append root "/"
>                                   (file-system-mount-point fs)))
>           (flags   (logior (mount-flags->bit-mask (file-system-flags fs))
> diff --git a/gnu/build/linux-boot.scm b/gnu/build/linux-boot.scm
> index 548e28a..d184fcd 100644
> --- a/gnu/build/linux-boot.scm
> +++ b/gnu/build/linux-boot.scm
> @@ -635,7 +635,8 @@ (define* (boot-system #:key
>  
>          ;; Mount the root file system.
>          (mount-root-file-system (canonicalize-device-spec
> -                                 (file-system-device root-fs))
> +                                 (file-system-device root-fs)
> +                                 (file-system-type root-fs))
>                                  (file-system-type root-fs)
>                                  #:volatile-root? volatile-root?
>                                  #:flags (mount-flags->bit-mask
> diff --git a/gnu/machine/ssh.scm b/gnu/machine/ssh.scm
> index 3e10d98..0054adf 100644
> --- a/gnu/machine/ssh.scm
> +++ b/gnu/machine/ssh.scm
> @@ -2,6 +2,7 @@
>  ;;; Copyright © 2019 Jakob L. Kreuze <[email-masked]>
>  ;;; Copyright © 2020-2023 Ludovic Courtès <[email-masked]>
>  ;;; Copyright © 2024 Ricardo <[email-masked]>
> +;;; Copyright © 2024 Massimo Zaniboni <[email-masked]>
>  ;;;
>  ;;; This file is part of GNU Guix.
>  ;;;
> @@ -241,6 +242,22 @@ (define (machine-check-file-system-availability machine)
>                                    (file-system-device fs)
>                                    (strerror errno))))))
>  
> +  (define (check-multi-device-file-system fs)
> +    (define multi-device (file-system-device fs))
> +    (define devices (string-split multi-device #\:))
> +    (define (check-device device)
> +      (remote-let ((errno #~(catch 'system-error
> +                              (lambda ()
> +                                (stat #$device)
> +                              #t)
> +                            (lambda args
> +                              (system-error-errno args)))))
> +        (when (number? errno)
> +          (raise (formatted-message (G_ "device '~a' not found: ~a")
> +                                    device
> +                                    (strerror errno))))))
> +    (map check-device devices))
> +
>    (define (check-labeled-file-system fs)
>      (define remote-exp
>        (with-imported-modules (source-module-closure
> @@ -278,8 +295,12 @@ (define (machine-check-file-system-availability machine)
>         (machine-configuration machine))
>        (append (map check-literal-file-system
>                     (filter (lambda (fs)
> -                             (string? (file-system-device fs)))
> +                             (single-device-spec? (file-system-device fs)))
>                             file-systems))
> +              (append-map check-multi-device-file-system
> +                          (filter (lambda (fs)
> +                                    (multi-device-spec? (file-system-device fs)))
> +                                  file-systems))
>                (map check-labeled-file-system
>                     (filter (lambda (fs)
>                               (file-system-label? (file-system-device fs)))
> diff --git a/gnu/system/file-systems.scm b/gnu/system/file-systems.scm
> index 4ea8237..9f91bd7 100644
> --- a/gnu/system/file-systems.scm
> +++ b/gnu/system/file-systems.scm
> @@ -5,6 +5,7 @@
>  ;;; Copyright © 2020, 2021 Maxim Cournoyer <[email-masked]>
>  ;;; Copyright © 2021 Tobias Geerinckx-Rice <[email-masked]>
>  ;;; Copyright © 2022 Oleg Pykhalov <[email-masked]>
> +;;; Copyright © 2024 Massimo Zaniboni <[email-masked]>
>  ;;;
>  ;;; This file is part of GNU Guix.
>  ;;;
> @@ -73,6 +74,9 @@ (define-module (gnu system file-systems)
>              spec->file-system
>              specification->file-system-mapping
>  
> +            multi-device-spec?
> +            single-device-spec?
> +
>              %pseudo-file-system-types
>              %fuse-control-file-system
>              %binary-format-file-system
> @@ -309,6 +313,17 @@ (define (file-system-needed-for-boot? fs)
>        (and (file-prefix? (file-system-mount-point fs) (%store-prefix))
>             (not (memq 'bind-mount (file-system-flags fs))))))
>  
> +(define (multi-device-spec? spec)
> +  "Return #t if the specification is like '/dev/sda:/dev/sdb'."
> +  (and (string? spec)
> +       (string-contains spec ":/")
> +       (string-prefix? "/dev/" spec)))
> +
> +(define (single-device-spec? spec)
> +  "Return #t if the specification is a string, but not a multi-device."
> +  (and (string? spec)
> +       (not (multi-device-spec? spec))))

At first, I wrote/thought:

--8<---------------cut here---------------start------------->8---
I'm not convinced we should check for the type (string?).  We don't
typically do this, and it hurts functional composition here:

Without checking for string?, you have a single condition
(multi-device-spec? x), and you could easily and correctly simply negate
that to get the 'single-device-spec' API.  The addition of the string?
check muddies that.  I'd just document that spec is expected to be a
string, unless there's a good reason to guard against other potential
types currently in use.
--8<---------------cut here---------------end--------------->8---

But reviewing (gnu build file-systems), more specifically
canonicalize-device-spec, the spec indeed can be multiple things, such
as a <uuid> or <file-system-label> object or a string.  So OK!  I think
we can have single-device-spec? in the API.

>  (define (file-system->spec fs)
>    "Return a list corresponding to file-system FS that can be passed to the
>  initrd code."
> diff --git a/guix/scripts/system.scm b/guix/scripts/system.scm
> index 7989b18..4e9c581 100644
> --- a/guix/scripts/system.scm
> +++ b/guix/scripts/system.scm
> @@ -11,6 +11,7 @@
>  ;;; Copyright © 2021 Brice Waegeneire <[email-masked]>
>  ;;; Copyright © 2021 Simon Tournier <[email-masked]>
>  ;;; Copyright © 2022 Tobias Geerinckx-Rice <[email-masked]>
> +;;; Copyright © 2024 Massimo Zaniboni <[email-masked]>
>  ;;;
>  ;;; This file is part of GNU Guix.
>  ;;;
> @@ -605,9 +606,16 @@ (define (check-file-system-availability file-systems)
>                (file-system-label? (file-system-device fs)))
>              relevant))
>  
> +  (define multi-device
> +    (filter (lambda (fs)
> +              (and (string? (file-system-device fs))
> +                   (multi-device-spec? (file-system-device fs))))
> +            relevant))
> +
>    (define literal
>      (filter (lambda (fs)
> -              (string? (file-system-device fs)))
> +              (and (string? (file-system-device fs))
> +                   (single-device-spec? (file-system-device fs))))
>              relevant))
>  
>    (define uuid
> @@ -641,6 +649,21 @@ (define (check-file-system-availability file-systems)
>  label, write @code{(file-system-label ~s)} in your @code{device} field.")
>                                        device device))))))
>                literal)
> +    (for-each
> +       (lambda (fs)
> +         (let* ((devices-str (file-system-device fs))
> +                (devices (string-split devices-str #\:)))
> +            (for-each
> +              (lambda (device)
> +                (catch 'system-error
> +                  (lambda () (stat device))
> +                  (lambda args
> +                    (let ((errno  (system-error-errno args)))
> +                          (error (file-system-location* fs)
> +                                 (G_ " #8605 device '~a' not found in multi-device '~a': ~a~%")
> +                                 device devices-str (strerror errno))))))
> +            devices)))
> +       multi-device)
>      (for-each (lambda (fs)
>                  (let ((label (file-system-label->string
>                                (file-system-device fs))))
>

I've only read the diff, not applied nor run the code, but from this
simple review, it looks sane to me.  I think in a v2 you could rewrite
the commit message to match the GNU Change-Log convention, add double
spacing to new comments/text, and ensure the line width stays in check
at max 80 columns.

Hopefully a Bcachefs afficionado (Tobias?) gets interested enough to
actually try it; it'd be nice to know if this works as there doesn't
seem to be any specific system test coverage for it (and given the
warning that it cannot be used as the root file system or /gnu/store yet
(why?), that would be a bit difficult or at least different that the
other tests we have for file systems).

Thank you for distilling this well crafted change.

-- 
Maxim