blob: f948d5e952c9a8edaf2ba3554bee517ab9b4fb31 [file] [log] [blame]
= Metadata Integrity
Prior to version 5, most XFS metadata blocks contained a magic number that
could provide a minimal sanity check that a block read off the disk contained
the same type of data that the code thought it was reading off the disk.
However, this was insufficient -- given a correct type code, it was still
impossible to tell if the block was from a previous filesystem, or happened to
be owned by something else, or had been written to the wrong location on disk.
Furthermore, not all metadata blocks had magic numbers -- remote extended
attributes and extent symbolic links had no protection at all.
Therefore, the version 5 disk format introduced larger headers for all metadata
types, which enable the filesystem to check information being read from the
disk more rigorously. Metadata integrity fields now include:
* *Magic* numbers, to classify all types of metadata. This is unchanged from v4.
* A copy of the filesystem *UUID*, to confirm that a given disk block is connected to the superblock.
* The *owner*, to avoid accessing a piece of metadata which belongs to some other part of the filesystem.
* The filesystem *block number*, to detect misplaced writes.
* The *log serial number* of the last write to this block, to avoid replaying obsolete log entries.
* A CRC32c *checksum* of the entire block, to detect minor corruption.
Metadata integrity coverage has been extended to all metadata blocks in the
filesystem, with the following notes:
* Inodes can have multiple ``owners'' in the directory tree; therefore the record contains the inode number instead of an owner or a block number.
* Superblocks have no owners.
* The disk quota file has no owner or block numbers.
* Metadata owned by files list the inode number as the owner.
* Per-AG data and B+tree blocks list the AG number as the owner.
* Per-AG header sectors don't list owners or block numbers, since they have fixed locations.
* Remote attribute blocks are not logged and therefore the LSN must be -1.
This functionality enables XFS to decide that a block contents are so
unexpected that it should stop immediately. Unfortunately checksums do not
allow for automatic correction. Please keep regular backups, as always.