[bug] fsck refuses to repair damaged UFS using backup superblock

[Kirk McKusick]

> From: Warner Losh <imp at bsdimp.com>
> Date: Sun, 25 Nov 2018 12:01:45 -0700
> Subject: Re: [bug] fsck refuses to repair damaged UFS using backup superblock
> To: Kirk McKusick <mckusick at mckusick.com>
> Cc: Rick Macklem <rmacklem at uoguelph.ca>, FreeBSD FS <freebsd-fs at freebsd.org>,
>         "Julian H. Stacey" <jhs at berklix.com>,
>         "soralx at cydem.org" <soralx at cydem.org>
> 
> On Sun, Nov 25, 2018, 11:35 AM Kirk McKusick <mckusick at mckusick.com wrote:
> 
>>> From: Rick Macklem <rmacklem at uoguelph.ca>
>>> To: "soralx at cydem.org" <soralx at cydem.org>,
>>>         Kirk McKusick <mckusick at mckusick.com>
>>> CC: "freebsd-fs at freebsd.org" <freebsd-fs at freebsd.org>,
>>>         "Julian H. Stacey"
>>>       <jhs at berklix.com>
>>> Subject: Re: [bug] fsck refuses to repair damaged UFS using backup
>> superblock
>>> Date: Sun, 25 Nov 2018 15:25:21 +0000
>>>
>>> It would be nice if there was a way to override the check and boot
>>> the system.  (Is a loader tunable reasonable for this?)
>>>
>>> rick
>>
>> Rather than adding a loader tunable to override the check (which people
>> would have to track down in the midst of a crisis), it might be better
>> to simply have the loader print a warning when there is a mismatch and
>> proceed to try using the filesystem. If successful, an fsck could then
>> be run to try and clean it up. Does this seem reasonable?
>>
>>	Kirk McKusick
> 
> Yes. You have a big chicken and egg issue otherwise.  And not booting
> seems like an extreme overreaction to a bad checksum. I can think
> of no use case where you'd want it. Let's let people ask for it
> with a decent use case before we do anything more than print a
> warning and soldier on...
> 
> Warner

My proposal is that when a filesystem is being mounted read-only
that superblock check-hash failures should be warnings only. This
is true not just at boot time, but always. We should probably set
the FS_NEEDSFSCK flag so that if it is updated to read-write a
warning will get printed. Since booting always starts up with
the filesystem in read-only mode, this should solve the booting
problem. Does this seem like a sensible solution?

	Kirk McKusick