filesystems/xfs/xfs-self-describing-metadata.rst

1 .. SPDX-License-Identifier: GPL-2.0
13 structures and indexes on disk and the algorithms for iterating them are
55 each other or written to disk after the fact.
70 Luckily, almost all XFS metadata has magic numbers embedded already - only the
72 magic numbers. Hence we can change the on-disk format of all these objects to
73 add more identifying information and detect this simply by changing the magic
87 hence a 32 bit CRC is more than sufficient to detect multi-bit errors in
92 does really provide any extra value over CRC32c, but it does add a lot of
100 mis-directed writes - a write might be misdirected to the wrong LUN and so be
129 present that the run-time verification is not detecting.
144 the first and last instance of corrupt metadata on disk and, further, how much
151 Validation of self-describing metadata takes place at runtime in two places:
153 	- immediately after a successful read from disk
154 	- immediately prior to write IO submission
156 The verification is completely stateless - it is done independently of the
163 body, but in general most of the per-field validation is handled by the
182 Write verification is the opposite of the read verification - first the object
192 A typical on-disk structure needs to contain the following information::
199 	    __be64  blkno;		/* location on disk */
211 	- short btree blocks have a 32 bit owner (ag number) and a 32 bit block
214 	  bytes less space on disk.
216 	- directory/attribute node blocks have a 16 bit magic number, and the
229 	struct xfs_mount *mp = bp->b_mount;
231 	    if ((xfs_sb_version_hascrc(&mp->m_sb) &&
232 		!xfs_verify_cksum(bp->b_addr, BBTOB(bp->b_length),
235 		    XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp, bp->b_addr);
252 	    struct xfs_mount	*mp = bp->b_mount;
253 	    struct xfs_ondisk_hdr	*hdr = bp->b_addr;
255 	    if (hdr->magic != cpu_to_be32(XFS_FOO_MAGIC))
258 	    if (!xfs_sb_version_hascrc(&mp->m_sb)) {
259 		    if (!uuid_equal(&hdr->uuid, &mp->m_sb.sb_uuid))
261 		    if (bp->b_bn != be64_to_cpu(hdr->blkno))
263 		    if (hdr->owner == 0)
279 	    struct xfs_mount	*mp = bp->b_mount;
280 	    struct xfs_ondisk_hdr	*hdr = bp->b_addr;
282 	    if (hdr->magic == cpu_to_be32(XFS_FOO_CRC_MAGIC)) {
283 		    if (!uuid_equal(&hdr->uuid, &mp->m_sb.sb_uuid))
285 		    if (bp->b_bn != be64_to_cpu(hdr->blkno))
287 		    if (hdr->owner == 0)
289 	    } else if (hdr->magic != cpu_to_be32(XFS_FOO_MAGIC))
304 	    struct xfs_mount	*mp = bp->b_mount;
305 	    struct xfs_buf_log_item	*bip = bp->b_fspriv;
308 		    XFS_CORRUPTION_ERROR(__func__, XFS_ERRLEVEL_LOW, mp, bp->b_addr);
313 	    if (!xfs_sb_version_hascrc(&mp->m_sb))
318 		    struct xfs_ondisk_hdr	*hdr = bp->b_addr;
319 		    hdr->lsn = cpu_to_be64(bip->bli_item.li_lsn);
321 	    xfs_update_cksum(bp->b_addr, BBTOB(bp->b_length), XFS_FOO_CRC_OFF);
333 Inodes and dquots are special snowflakes. They have per-object CRC and
334 self-identifiers, but they are packed so that there are multiple objects per
335 buffer. Hence we do not use per-buffer verifiers to do the work of per-object
336 verification and CRC calculations. The per-buffer verifiers simply perform basic
337 identification of the buffer - that they contain inodes or dquots, and that
347 only addition here is to add the LSN and CRC to the inode as it is copied back
352 log recovery. So, it's gone unnoticed until now. This won't matter immediately -
353 repair will probably complain about it - but it needs to be fixed.