1 Prevent an ext4 filesystem from being mounted multiple times.
2 A sequence number is stored on disk and is periodically updated (every 5
3 seconds by default) by a mounted filesystem.
4 At mount time, we now wait for s_mmp_update_interval seconds to make sure
5 that the MMP sequence does not change.
6 In case of failure, the nodename, bdevname and the time at which the MMP
7 block was last updated is displayed.
8 Move all mmp code to a dedicated file (mmp.c).
10 Signed-off-by: Andreas Dilger <adilger <at> whamcloud.com>
11 Signed-off-by: Johann Lombardi <johann <at> whamcloud.com>
13 fs/ext4/Makefile | 3 +-
14 fs/ext4/ext4.h | 76 ++++++++++++-
15 fs/ext4/mmp.c | 354 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
16 fs/ext4/super.c | 18 +++-
17 4 files changed, 447 insertions(+), 4 deletions(-)
18 create mode 100644 fs/ext4/mmp.c
20 Index: linux-stage/fs/ext4/Makefile
21 ===================================================================
22 --- linux-stage.orig/fs/ext4/Makefile
23 +++ linux-stage/fs/ext4/Makefile
24 @@ -6,7 +6,8 @@ obj-$(CONFIG_EXT4_FS) += ext4.o
26 ext4-y := balloc.o bitmap.o dir.o file.o fsync.o ialloc.o inode.o \
27 ioctl.o namei.o super.o symlink.o hash.o resize.o extents.o \
28 - ext4_jbd2.o migrate.o mballoc.o block_validity.o move_extent.o
29 + ext4_jbd2.o migrate.o mballoc.o block_validity.o move_extent.o \
32 ext4-$(CONFIG_EXT4_FS_XATTR) += xattr.o xattr_user.o xattr_trusted.o
33 ext4-$(CONFIG_EXT4_FS_POSIX_ACL) += acl.o
34 Index: linux-stage/fs/ext4/ext4.h
35 ===================================================================
36 --- linux-stage.orig/fs/ext4/ext4.h
37 +++ linux-stage/fs/ext4/ext4.h
38 @@ -893,7 +893,7 @@ struct ext4_super_block {
39 __le16 s_want_extra_isize; /* New inodes should reserve # bytes */
40 __le32 s_flags; /* Miscellaneous flags */
41 __le16 s_raid_stride; /* RAID stride */
42 - __le16 s_mmp_interval; /* # seconds to wait in MMP checking */
43 + __le16 s_mmp_update_interval; /* # seconds to wait in MMP checking */
44 __le64 s_mmp_block; /* Block for multi-mount protection */
45 __le32 s_raid_stripe_width; /* blocks on all data disks (N*stride)*/
46 __u8 s_log_groups_per_flex; /* FLEX_BG group size */
47 @@ -1040,6 +1040,9 @@ struct ext4_sb_info {
49 /* workqueue for dio unwritten */
50 struct workqueue_struct *dio_unwritten_wq;
52 + /* Kernel thread for multiple mount protection */
53 + struct task_struct *s_mmp_tsk;
55 /* Lazy inode table initialization info */
56 struct ext4_li_request *s_li_request;
57 @@ -1176,7 +1179,8 @@ static inline void ext4_clear_inode_stat
58 EXT4_FEATURE_INCOMPAT_META_BG| \
59 EXT4_FEATURE_INCOMPAT_EXTENTS| \
60 EXT4_FEATURE_INCOMPAT_64BIT| \
61 - EXT4_FEATURE_INCOMPAT_FLEX_BG)
62 + EXT4_FEATURE_INCOMPAT_FLEX_BG| \
63 + EXT4_FEATURE_INCOMPAT_MMP)
64 #define EXT4_FEATURE_RO_COMPAT_SUPP (EXT4_FEATURE_RO_COMPAT_SPARSE_SUPER| \
65 EXT4_FEATURE_RO_COMPAT_LARGE_FILE| \
66 EXT4_FEATURE_RO_COMPAT_GDT_CSUM| \
67 @@ -1383,6 +1387,67 @@ void ext4_get_group_no_and_offset(struct
68 extern struct proc_dir_entry *ext4_proc_root;
71 + * This structure will be used for multiple mount protection. It will be
72 + * written into the block number saved in the s_mmp_block field in the
73 + * superblock. Programs that check MMP should assume that if
74 + * SEQ_FSCK (or any unknown code above SEQ_MAX) is present then it is NOT safe
75 + * to use the filesystem, regardless of how old the timestamp is.
77 +#define EXT4_MMP_MAGIC 0x004D4D50U /* ASCII for MMP */
78 +#define EXT4_MMP_SEQ_CLEAN 0xFF4D4D50U /* mmp_seq value for clean unmount */
79 +#define EXT4_MMP_SEQ_FSCK 0xE24D4D50U /* mmp_seq value when being fscked */
80 +#define EXT4_MMP_SEQ_MAX 0xE24D4D4FU /* maximum valid mmp_seq value */
83 + __le32 mmp_magic; /* Magic number for MMP */
84 + __le32 mmp_seq; /* Sequence no. updated periodically */
87 + * mmp_time, mmp_nodename & mmp_bdevname are only used for information
88 + * purposes and do not affect the correctness of the algorithm
90 + __le64 mmp_time; /* Time last updated */
91 + char mmp_nodename[64]; /* Node which last updated MMP block */
92 + char mmp_bdevname[32]; /* Bdev which last updated MMP block */
95 + * mmp_check_interval is used to verify if the MMP block has been
96 + * updated on the block device. The value is updated based on the
97 + * maximum time to write the MMP block during an update cycle.
99 + __le16 mmp_check_interval;
102 + __le32 mmp_pad2[227];
105 +/* arguments passed to the mmp thread */
107 + struct buffer_head *bh; /* bh from initial read_mmp_block() */
108 + struct super_block *sb; /* super block of the fs */
112 + * Check interval multiplier
113 + * The MMP block is written every update interval and initially checked every
114 + * update interval x the multiplier (the value is then adapted based on the
115 + * write latency). The reason is that writes can be delayed under load and we
116 + * don't want readers to incorrectly assume that the filesystem is no longer
119 +#define EXT4_MMP_CHECK_MULT 2UL
122 + * Minimum interval for MMP checking in seconds.
124 +#define EXT4_MMP_MIN_CHECK_INTERVAL 5UL
127 + * Maximum interval for MMP checking in seconds.
129 +#define EXT4_MMP_MAX_CHECK_INTERVAL 300UL
132 * Function prototypes
135 @@ -1552,6 +1617,10 @@ extern void __ext4_warning(struct super_
136 #define ext4_warning(sb, message...) __ext4_warning(sb, __func__, ## message)
137 extern void ext4_msg(struct super_block *, const char *, const char *, ...)
138 __attribute__ ((format (printf, 3, 4)));
139 +extern void __dump_mmp_msg(struct super_block *, struct mmp_struct *mmp,
140 + const char *, const char *);
141 +#define dump_mmp_msg(sb, mmp, msg) __dump_mmp_msg(sb, mmp, __func__, \
143 extern void ext4_grp_locked_error(struct super_block *, ext4_group_t,
144 const char *, const char *, ...)
145 __attribute__ ((format (printf, 4, 5)));
146 @@ -1833,6 +1902,8 @@ extern int ext4_move_extents(struct file
147 __u64 start_orig, __u64 start_donor,
148 __u64 len, __u64 *moved_len);
151 +extern int ext4_multi_mount_protect(struct super_block *, ext4_fsblk_t);
154 * Add new method to test wether block and inode bitmaps are properly
155 Index: linux-stage/fs/ext4/mmp.c
156 ===================================================================
158 +++ linux-stage/fs/ext4/mmp.c
160 +#include <linux/fs.h>
161 +#include <linux/random.h>
162 +#include <linux/buffer_head.h>
163 +#include <linux/utsname.h>
164 +#include <linux/kthread.h>
169 + * Write the MMP block using WRITE_SYNC to try to get the block on-disk
172 +static int write_mmp_block(struct buffer_head *bh)
174 + mark_buffer_dirty(bh);
176 + bh->b_end_io = end_buffer_write_sync;
178 + submit_bh(WRITE_SYNC, bh);
179 + wait_on_buffer(bh);
180 + if (unlikely(!buffer_uptodate(bh)))
187 + * Read the MMP block. It _must_ be read from disk and hence we clear the
188 + * uptodate flag on the buffer.
190 +static int read_mmp_block(struct super_block *sb, struct buffer_head **bh,
191 + ext4_fsblk_t mmp_block)
193 + struct mmp_struct *mmp;
196 + clear_buffer_uptodate(*bh);
198 + /* This would be sb_bread(sb, mmp_block), except we need to be sure
199 + * that the MD RAID device cache has been bypassed, and that the read
200 + * is not blocked in the elevator. */
202 + *bh = sb_getblk(sb, mmp_block);
206 + (*bh)->b_end_io = end_buffer_read_sync;
207 + submit_bh(READ_SYNC, *bh);
208 + wait_on_buffer(*bh);
209 + if (!buffer_uptodate(*bh)) {
215 + ext4_warning(sb, "Error while reading MMP block %llu",
220 + mmp = (struct mmp_struct *)((*bh)->b_data);
221 + if (le32_to_cpu(mmp->mmp_magic) != EXT4_MMP_MAGIC)
228 + * Dump as much information as possible to help the admin.
230 +void __dump_mmp_msg(struct super_block *sb, struct mmp_struct *mmp,
231 + const char *function, const char *msg)
233 + __ext4_warning(sb, function, msg);
234 + __ext4_warning(sb, function,
235 + "MMP failure info: last update time: %llu, last update "
236 + "node: %s, last update device: %s\n",
237 + (long long unsigned int) le64_to_cpu(mmp->mmp_time),
238 + mmp->mmp_nodename, mmp->mmp_bdevname);
242 + * kmmpd will update the MMP sequence every s_mmp_update_interval seconds
244 +static int kmmpd(void *data)
246 + struct super_block *sb = ((struct mmpd_data *) data)->sb;
247 + struct buffer_head *bh = ((struct mmpd_data *) data)->bh;
248 + struct ext4_super_block *es = EXT4_SB(sb)->s_es;
249 + struct mmp_struct *mmp;
250 + ext4_fsblk_t mmp_block;
252 + unsigned long failed_writes = 0;
253 + int mmp_update_interval = le16_to_cpu(es->s_mmp_update_interval);
254 + unsigned mmp_check_interval;
255 + unsigned long last_update_time;
256 + unsigned long diff;
259 + mmp_block = le64_to_cpu(es->s_mmp_block);
260 + mmp = (struct mmp_struct *)(bh->b_data);
261 + mmp->mmp_time = cpu_to_le64(get_seconds());
263 + * Start with the higher mmp_check_interval and reduce it if
264 + * the MMP block is being updated on time.
266 + mmp_check_interval = max(EXT4_MMP_CHECK_MULT * mmp_update_interval,
267 + EXT4_MMP_MIN_CHECK_INTERVAL);
268 + mmp->mmp_check_interval = cpu_to_le16(mmp_check_interval);
269 + bdevname(bh->b_bdev, mmp->mmp_bdevname);
271 + memcpy(mmp->mmp_nodename, init_utsname()->nodename,
272 + sizeof(mmp->mmp_nodename));
274 + while (!kthread_should_stop()) {
275 + if (++seq > EXT4_MMP_SEQ_MAX)
278 + mmp->mmp_seq = cpu_to_le32(seq);
279 + mmp->mmp_time = cpu_to_le64(get_seconds());
280 + last_update_time = jiffies;
282 + retval = write_mmp_block(bh);
284 + * Don't spew too many error messages. Print one every
285 + * (s_mmp_update_interval * 60) seconds.
288 + if ((failed_writes % 60) == 0)
289 + ext4_error(sb, "Error writing to MMP block");
293 + if (!(le32_to_cpu(es->s_feature_incompat) &
294 + EXT4_FEATURE_INCOMPAT_MMP)) {
295 + ext4_warning(sb, "kmmpd being stopped since MMP feature"
296 + " has been disabled.");
297 + EXT4_SB(sb)->s_mmp_tsk = NULL;
301 + if (sb->s_flags & MS_RDONLY) {
302 + ext4_warning(sb, "kmmpd being stopped since filesystem "
303 + "has been remounted as readonly.");
304 + EXT4_SB(sb)->s_mmp_tsk = NULL;
308 + diff = jiffies - last_update_time;
309 + if (diff < mmp_update_interval * msecs_to_jiffies(MSEC_PER_SEC))
310 + schedule_timeout_interruptible(mmp_update_interval *
311 + msecs_to_jiffies(MSEC_PER_SEC) - diff);
314 + * We need to make sure that more than mmp_check_interval
315 + * seconds have not passed since writing. If that has happened
316 + * we need to check if the MMP block is as we left it.
318 + diff = jiffies - last_update_time;
319 + if (diff > mmp_check_interval * msecs_to_jiffies(MSEC_PER_SEC)) {
320 + struct buffer_head *bh_check = NULL;
321 + struct mmp_struct *mmp_check;
323 + retval = read_mmp_block(sb, &bh_check, mmp_block);
325 + ext4_error(sb, "error reading MMP data: %d",
328 + EXT4_SB(sb)->s_mmp_tsk = NULL;
332 + mmp_check = (struct mmp_struct *)(bh_check->b_data);
333 + if (mmp->mmp_seq != mmp_check->mmp_seq ||
334 + memcmp(mmp->mmp_nodename, mmp_check->mmp_nodename,
335 + sizeof(mmp->mmp_nodename))) {
336 + dump_mmp_msg(sb, mmp_check,
337 + "Error while updating MMP info. "
338 + "The filesystem seems to have been"
339 + " multiply mounted.");
340 + ext4_error(sb, "abort");
347 + * Adjust the mmp_check_interval depending on how much time
348 + * it took for the MMP block to be written.
350 + mmp_check_interval = max(min(EXT4_MMP_CHECK_MULT * diff /
351 + msecs_to_jiffies(MSEC_PER_SEC),
352 + EXT4_MMP_MAX_CHECK_INTERVAL),
353 + EXT4_MMP_MIN_CHECK_INTERVAL);
354 + mmp->mmp_check_interval = cpu_to_le16(mmp_check_interval);
358 + * Unmount seems to be clean.
360 + mmp->mmp_seq = cpu_to_le32(EXT4_MMP_SEQ_CLEAN);
361 + mmp->mmp_time = cpu_to_le64(get_seconds());
363 + retval = write_mmp_block(bh);
372 + * Get a random new sequence number but make sure it is not greater than
373 + * EXT4_MMP_SEQ_MAX.
375 +static unsigned int mmp_new_seq(void)
380 + get_random_bytes(&new_seq, sizeof(u32));
381 + } while (new_seq > EXT4_MMP_SEQ_MAX);
387 + * Protect the filesystem from being mounted more than once.
389 +int ext4_multi_mount_protect(struct super_block *sb,
390 + ext4_fsblk_t mmp_block)
392 + struct ext4_super_block *es = EXT4_SB(sb)->s_es;
393 + struct buffer_head *bh = NULL;
394 + struct mmp_struct *mmp = NULL;
395 + struct mmpd_data *mmpd_data;
397 + unsigned int mmp_check_interval = le16_to_cpu(es->s_mmp_update_interval);
398 + unsigned int wait_time = 0;
401 + if (mmp_block < le32_to_cpu(es->s_first_data_block) ||
402 + mmp_block >= ext4_blocks_count(es)) {
403 + ext4_warning(sb, "Invalid MMP block in superblock");
407 + retval = read_mmp_block(sb, &bh, mmp_block);
411 + mmp = (struct mmp_struct *)(bh->b_data);
413 + if (mmp_check_interval < EXT4_MMP_MIN_CHECK_INTERVAL)
414 + mmp_check_interval = EXT4_MMP_MIN_CHECK_INTERVAL;
417 + * If check_interval in MMP block is larger, use that instead of
418 + * update_interval from the superblock.
420 + if (mmp->mmp_check_interval > mmp_check_interval)
421 + mmp_check_interval = mmp->mmp_check_interval;
423 + seq = le32_to_cpu(mmp->mmp_seq);
424 + if (seq == EXT4_MMP_SEQ_CLEAN)
427 + if (seq == EXT4_MMP_SEQ_FSCK) {
428 + dump_mmp_msg(sb, mmp, "fsck is running on the filesystem");
432 + wait_time = min(mmp_check_interval * 2 + 1,
433 + mmp_check_interval + 60);
435 + /* Print MMP interval if more than 20 secs. */
436 + if (wait_time > EXT4_MMP_MIN_CHECK_INTERVAL * 4)
437 + ext4_warning(sb, "MMP interval %u higher than expected, please"
438 + " wait.\n", wait_time * 2);
440 + if (schedule_timeout_interruptible(msecs_to_jiffies(MSEC_PER_SEC) *
442 + ext4_warning(sb, "MMP startup interrupted, failing mount\n");
446 + retval = read_mmp_block(sb, &bh, mmp_block);
449 + mmp = (struct mmp_struct *)(bh->b_data);
450 + if (seq != le32_to_cpu(mmp->mmp_seq)) {
451 + dump_mmp_msg(sb, mmp,
452 + "Device is already active on another node.");
458 + * write a new random sequence number.
460 + mmp->mmp_seq = seq = cpu_to_le32(mmp_new_seq());
462 + retval = write_mmp_block(bh);
467 + * wait for MMP interval and check mmp_seq.
469 + if (schedule_timeout_interruptible(msecs_to_jiffies(MSEC_PER_SEC) *
471 + ext4_warning(sb, "MMP startup interrupted, failing mount\n");
475 + retval = read_mmp_block(sb, &bh, mmp_block);
478 + mmp = (struct mmp_struct *)(bh->b_data);
479 + if (seq != le32_to_cpu(mmp->mmp_seq)) {
480 + dump_mmp_msg(sb, mmp,
481 + "Device is already active on another node.");
485 + mmpd_data = kmalloc(sizeof(struct mmpd_data), GFP_KERNEL);
487 + ext4_warning(sb, "not enough memory for mmpd_data");
490 + mmpd_data->sb = sb;
491 + mmpd_data->bh = bh;
494 + * Start a kernel thread to update the MMP block periodically.
496 + EXT4_SB(sb)->s_mmp_tsk = kthread_run(kmmpd, mmpd_data, "kmmpd-%s",
497 + bdevname(bh->b_bdev,
498 + mmp->mmp_bdevname));
499 + if (IS_ERR(EXT4_SB(sb)->s_mmp_tsk)) {
500 + EXT4_SB(sb)->s_mmp_tsk = NULL;
502 + ext4_warning(sb, "Unable to create kmmpd thread for %s.",
515 Index: linux-stage/fs/ext4/super.c
516 ===================================================================
517 --- linux-stage.orig/fs/ext4/super.c
518 +++ linux-stage/fs/ext4/super.c
520 #include <linux/log2.h>
521 #include <linux/crc16.h>
522 #include <asm/uaccess.h>
523 +#include <linux/kthread.h>
524 +#include <linux/utsname.h>
527 #include "ext4_jbd2.h"
528 @@ -700,6 +702,8 @@ static void ext4_put_super(struct super_
529 invalidate_bdev(sbi->journal_bdev);
530 ext4_blkdev_remove(sbi);
532 + if (sbi->s_mmp_tsk)
533 + kthread_stop(sbi->s_mmp_tsk);
534 sb->s_fs_info = NULL;
536 * Now that we are completely done shutting down the
537 @@ -2799,6 +2803,10 @@ static int ext4_fill_super(struct super_
538 needs_recovery = (es->s_last_orphan != 0 ||
539 EXT4_HAS_INCOMPAT_FEATURE(sb,
540 EXT4_FEATURE_INCOMPAT_RECOVER));
541 + if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_MMP) &&
542 + !(sb->s_flags & MS_RDONLY))
543 + if (ext4_multi_mount_protect(sb, le64_to_cpu(es->s_mmp_block)))
544 + goto failed_mount3;
547 * The first inode we look at is the journal inode. Don't try
548 @@ -3036,6 +3044,8 @@ failed_mount3:
549 percpu_counter_destroy(&sbi->s_freeinodes_counter);
550 percpu_counter_destroy(&sbi->s_dirs_counter);
551 percpu_counter_destroy(&sbi->s_dirtyblocks_counter);
552 + if (sbi->s_mmp_tsk)
553 + kthread_stop(sbi->s_mmp_tsk);
555 for (i = 0; i < db_count; i++)
556 brelse(sbi->s_group_desc[i]);
557 @@ -3544,7 +3554,7 @@ static int ext4_remount(struct super_blo
558 struct ext4_mount_options old_opts;
560 unsigned int journal_ioprio = DEFAULT_JOURNAL_IOPRIO;
566 @@ -3666,6 +3676,13 @@ static int ext4_remount(struct super_blo
568 if (!ext4_setup_super(sb, es, 0))
569 sb->s_flags &= ~MS_RDONLY;
570 + if (EXT4_HAS_INCOMPAT_FEATURE(sb,
571 + EXT4_FEATURE_INCOMPAT_MMP))
572 + if (ext4_multi_mount_protect(sb,
573 + le64_to_cpu(es->s_mmp_block))) {
579 ext4_setup_system_zone(sb);