100 lines
4.4 KiB
Plaintext
100 lines
4.4 KiB
Plaintext
|
dm_bow (backup on write)
|
|||
|
|
========================
|
|||
|
|
|
|||
|
|
dm_bow is a device mapper driver that uses the free space on a device to back up
|
|||
|
|
data that is overwritten. The changes can then be committed by a simple state
|
|||
|
|
change, or rolled back by removing the dm_bow device and running a command line
|
|||
|
|
utility over the underlying device.
|
|||
|
|
|
|||
|
|
dm_bow has three states, set by writing ‘1’ or ‘2’ to /sys/block/dm-?/bow/state.
|
|||
|
|
It is only possible to go from state 0 (initial state) to state 1, and then from
|
|||
|
|
state 1 to state 2.
|
|||
|
|
|
|||
|
|
State 0: dm_bow collects all trims to the device and assumes that these mark
|
|||
|
|
free space on the overlying file system that can be safely used. Typically the
|
|||
|
|
mount code would create the dm_bow device, mount the file system, call the
|
|||
|
|
FITRIM ioctl on the file system then switch to state 1. These trims are not
|
|||
|
|
propagated to the underlying device.
|
|||
|
|
|
|||
|
|
State 1: All writes to the device cause the underlying data to be backed up to
|
|||
|
|
the free (trimmed) area as needed in such a way as they can be restored.
|
|||
|
|
However, the writes, with one exception, then happen exactly as they would
|
|||
|
|
without dm_bow, so the device is always in a good final state. The exception is
|
|||
|
|
that sector 0 is used to keep a log of the latest changes, both to indicate that
|
|||
|
|
we are in this state and to allow rollback. See below for all details. If there
|
|||
|
|
isn't enough free space, writes are failed with -ENOSPC.
|
|||
|
|
|
|||
|
|
State 2: The transition to state 2 triggers replacing the special sector 0 with
|
|||
|
|
the normal sector 0, and the freeing of all state information. dm_bow then
|
|||
|
|
becomes a pass-through driver, allowing the device to continue to be used with
|
|||
|
|
minimal performance impact.
|
|||
|
|
|
|||
|
|
Usage
|
|||
|
|
=====
|
|||
|
|
dm-bow takes one command line parameter, the name of the underlying device.
|
|||
|
|
|
|||
|
|
dm-bow will typically be used in the following way. dm-bow will be loaded with a
|
|||
|
|
suitable underlying device and the resultant device will be mounted. A file
|
|||
|
|
system trim will be issued via the FITRIM ioctl, then the device will be
|
|||
|
|
switched to state 1. The file system will now be used as normal. At some point,
|
|||
|
|
the changes can either be committed by switching to state 2, or rolled back by
|
|||
|
|
unmounting the file system, removing the dm-bow device and running the command
|
|||
|
|
line utility. Note that rebooting the device will be equivalent to unmounting
|
|||
|
|
and removing, but the command line utility must still be run
|
|||
|
|
|
|||
|
|
Details of operation in state 1
|
|||
|
|
===============================
|
|||
|
|
|
|||
|
|
dm_bow maintains a type for all sectors. A sector can be any of:
|
|||
|
|
|
|||
|
|
SECTOR0
|
|||
|
|
SECTOR0_CURRENT
|
|||
|
|
UNCHANGED
|
|||
|
|
FREE
|
|||
|
|
CHANGED
|
|||
|
|
BACKUP
|
|||
|
|
|
|||
|
|
SECTOR0 is the first sector on the device, and is used to hold the log of
|
|||
|
|
changes. This is the one exception.
|
|||
|
|
|
|||
|
|
SECTOR0_CURRENT is a sector picked from the FREE sectors, and is where reads and
|
|||
|
|
writes from the true sector zero are redirected to. Note that like any backup
|
|||
|
|
sector, if the sector is written to directly, it must be moved again.
|
|||
|
|
|
|||
|
|
UNCHANGED means that the sector has not been changed since we entered state 1.
|
|||
|
|
Thus if it is written to or trimmed, the contents must first be backed up.
|
|||
|
|
|
|||
|
|
FREE means that the sector was trimmed in state 0 and has not yet been written
|
|||
|
|
to or used for backup. On being written to, a FREE sector is changed to CHANGED.
|
|||
|
|
|
|||
|
|
CHANGED means that the sector has been modified, and can be further modified
|
|||
|
|
without further backup.
|
|||
|
|
|
|||
|
|
BACKUP means that this is a free sector being used as a backup. On being written
|
|||
|
|
to, the contents must first be backed up again.
|
|||
|
|
|
|||
|
|
All backup operations are logged to the first sector. The log sector has the
|
|||
|
|
format:
|
|||
|
|
--------------------------------------------------------
|
|||
|
|
| Magic | Count | Sequence | Log entry | Log entry | …
|
|||
|
|
--------------------------------------------------------
|
|||
|
|
|
|||
|
|
Magic is a magic number. Count is the number of log entries. Sequence is 0
|
|||
|
|
initially. A log entry is
|
|||
|
|
|
|||
|
|
-----------------------------------
|
|||
|
|
| Source | Dest | Size | Checksum |
|
|||
|
|
-----------------------------------
|
|||
|
|
|
|||
|
|
When SECTOR0 is full, the log sector is backed up and another empty log sector
|
|||
|
|
created with sequence number one higher. The first entry in any log entry with
|
|||
|
|
sequence > 0 therefore must be the log of the backing up of the previous log
|
|||
|
|
sector. Note that sequence is not strictly needed, but is a useful sanity check
|
|||
|
|
and potentially limits the time spent trying to restore a corrupted snapshot.
|
|||
|
|
|
|||
|
|
On entering state 1, dm_bow has a list of free sectors. All other sectors are
|
|||
|
|
unchanged. Sector0_current is selected from the free sectors and the contents of
|
|||
|
|
sector 0 are copied there. The sector 0 is backed up, which triggers the first
|
|||
|
|
log entry to be written.
|
|||
|
|
|