2 .\" Copyright (c) 2002 Poul-Henning Kamp
3 .\" Copyright (c) 2002 Networks Associates Technology, Inc.
4 .\" All rights reserved.
6 .\" This software was developed for the FreeBSD Project by Poul-Henning Kamp
7 .\" and NAI Labs, the Security Research Division of Network Associates, Inc.
8 .\" under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
9 .\" DARPA CHATS research program.
11 .\" Redistribution and use in source and binary forms, with or without
12 .\" modification, are permitted provided that the following conditions
14 .\" 1. Redistributions of source code must retain the above copyright
15 .\" notice, this list of conditions and the following disclaimer.
16 .\" 2. Redistributions in binary form must reproduce the above copyright
17 .\" notice, this list of conditions and the following disclaimer in the
18 .\" documentation and/or other materials provided with the distribution.
19 .\" 3. The names of the authors may not be used to endorse or promote
20 .\" products derived from this software without specific prior written
23 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
24 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
27 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
37 .Dd September 10, 2013
42 .Nd "modular disk I/O request transformation framework"
47 .Cd options GEOM_CACHE
48 .Cd options GEOM_CONCAT
52 .Cd options GEOM_JOURNAL
53 .Cd options GEOM_LABEL
54 .Cd options GEOM_LINUX_LVM
56 .Cd options GEOM_MIRROR
57 .Cd options GEOM_MULTIPATH
59 .Cd options GEOM_PART_APM
60 .Cd options GEOM_PART_BSD
61 .Cd options GEOM_PART_EBR
62 .Cd options GEOM_PART_EBR_COMPAT
63 .Cd options GEOM_PART_GPT
64 .Cd options GEOM_PART_LDM
65 .Cd options GEOM_PART_MBR
66 .Cd options GEOM_PART_PC98
67 .Cd options GEOM_PART_VTOC8
70 .Cd options GEOM_RAID3
71 .Cd options GEOM_SHSEC
72 .Cd options GEOM_STRIPE
73 .Cd options GEOM_SUNLABEL
75 .Cd options GEOM_VIRSTOR
81 framework provides an infrastructure in which
83 can perform transformations on disk I/O requests on their path from
84 the upper kernel to the device drivers and back.
88 context range from the simple geometric
89 displacement performed in typical disk partitioning modules over RAID
90 algorithms and device multipath resolution to full blown cryptographic
91 protection of the stored data.
93 Compared to traditional
94 .Dq "volume management" ,
97 and in some cases all previous implementations in the following ways:
102 It is trivially simple to write a new class
103 of transformation and it will not be given stepchild treatment.
105 someone for some reason wanted to mount IBM MVS diskpacks, a class
106 recognizing and configuring their VTOC information would be a trivial
110 is topologically agnostic.
111 Most volume management implementations
112 have very strict notions of how classes can fit together, very often
113 one fixed hierarchy is provided, for instance, subdisk - plex -
117 Being extensible means that new transformations are treated no differently
118 than existing transformations.
120 Fixed hierarchies are bad because they make it impossible to express
121 the intent efficiently.
122 In the fixed hierarchy above, it is not possible to mirror two
123 physical disks and then partition the mirror into subdisks, instead
124 one is forced to make subdisks on the physical volumes and to mirror
125 these two and two, resulting in a much more complex configuration.
127 on the other hand does not care in which order things are done,
128 the only restriction is that cycles in the graph will not be allowed.
129 .Sh "TERMINOLOGY AND TOPOLOGY"
131 is quite object oriented and consequently the terminology
132 borrows a lot of context and semantics from the OO vocabulary:
136 represented by the data structure
139 particular kind of transformation.
140 Typical examples are MBR disk
141 partition, BSD disklabel, and RAID5 classes.
143 An instance of a class is called a
145 and represented by the data structure
150 will be one geom of class MBR for each disk.
154 represented by the data structure
156 is the front gate at which a geom offers service.
159 a disk-like thing which appears in
163 All providers have three main properties:
171 is the backdoor through which a geom connects to another
172 geom provider and through which I/O requests are sent.
174 The topological relationship between these entities are as follows:
177 A class has zero or more geom instances.
179 A geom has exactly one class it is derived from.
181 A geom has zero or more consumers.
183 A geom has zero or more providers.
185 A consumer can be attached to zero or one providers.
187 A provider can have zero or more consumers attached.
190 All geoms have a rank-number assigned, which is used to detect and
191 prevent loops in the acyclic directed graph.
196 A geom with no attached consumers has rank=1.
198 A geom with attached consumers has a rank one higher than the
199 highest rank of the geoms of the providers its consumers are
202 .Sh "SPECIAL TOPOLOGICAL MANEUVERS"
203 In addition to the straightforward attach, which attaches a consumer
204 to a provider, and detach, which breaks the bond, a number of special
205 topological maneuvers exists to facilitate configuration and to
206 improve the overall flexibility.
209 is a process that happens whenever a new class or new provider
210 is created, and it provides the class a chance to automatically configure an
211 instance on providers which it recognizes as its own.
212 A typical example is the MBR disk-partition class which will look for
213 the MBR table in the first sector and, if found and validated, will
214 instantiate a geom to multiplex according to the contents of the MBR.
216 A new class will be offered to all existing providers in turn and a new
217 provider will be offered to all classes in turn.
219 Exactly what a class does to recognize if it should accept the offered
220 provider is not defined by
222 but the sensible set of options are:
225 Examine specific data structures on the disk.
227 Examine properties like
233 Examine the rank number of the provider's geom.
235 Examine the method name of the provider's geom.
238 is the process by which a provider is removed while
239 it potentially is still being used.
241 When a geom orphans a provider, all future I/O requests will
243 on the provider with an error code set by the geom.
245 consumers attached to the provider will receive notification about
246 the orphanization when the event loop gets around to it, and they
247 can take appropriate action at that time.
249 A geom which came into being as a result of a normal taste operation
250 should self-destruct unless it has a way to keep functioning whilst
251 lacking the orphaned provider.
252 Geoms like disk slicers should therefore self-destruct whereas
253 RAID5 or mirror geoms will be able to continue as long as they do
256 When a provider is orphaned, this does not necessarily result in any
257 immediate change in the topology: any attached consumers are still
258 attached, any opened paths are still open, any outstanding I/O
259 requests are still outstanding.
261 The typical scenario is:
263 .Bl -bullet -offset indent -compact
265 A device driver detects a disk has departed and orphans the provider for it.
267 The geoms on top of the disk receive the orphanization event and
268 orphan all their providers in turn.
269 Providers which are not attached to will typically self-destruct
271 This process continues in a quasi-recursive fashion until all
272 relevant pieces of the tree have heard the bad news.
274 Eventually the buck stops when it reaches geom_dev at the top
279 to stop any more requests from
281 It will sleep until any and all outstanding I/O requests have
283 It will explicitly close (i.e.: zero the access counts), a change
284 which will propagate all the way down through the mesh.
285 It will then detach and destroy its geom.
287 The geom whose provider is now detached will destroy the provider,
288 detach and destroy its consumer and destroy its geom.
290 This process percolates all the way down through the mesh, until
291 the cleanup is complete.
294 While this approach seems byzantine, it does provide the maximum
295 flexibility and robustness in handling disappearing devices.
297 The one absolutely crucial detail to be aware of is that if the
298 device driver does not return all I/O requests, the tree will
301 is a special case of orphanization used to protect
302 against stale metadata.
303 It is probably easiest to understand spoiling by going through
308 on top of which an MBR geom provides
318 and that both the MBR and BSD geoms have
319 autoconfigured based on data structures on the disk media.
320 Now imagine the case where
322 is opened for writing and those
323 data structures are modified or overwritten: now the geoms would
324 be operating on stale metadata unless some notification system
325 can inform them otherwise.
327 To avoid this situation, when the open of
330 all attached consumers are told about this and geoms like
331 MBR and BSD will self-destruct as a result.
334 is closed, it will be offered for tasting again
335 and, if the data structures for MBR and BSD are still there, new
336 geoms will instantiate themselves anew.
338 Now for the fine print:
340 If any of the paths through the MBR or BSD module were open, they
341 would have opened downwards with an exclusive bit thus rendering it
344 for writing in that case.
346 the requested exclusive bit would render it impossible to open a
347 path through the MBR geom while
351 From this it also follows that changing the size of open geoms can
352 only be done with their cooperation.
354 Finally: the spoiling only happens when the write count goes from
355 zero to non-zero and the retasting happens only when the write count goes
356 from non-zero to zero.
358 is the process where the administrator issues instructions
359 for a particular class to instantiate itself.
361 ways to express intent in this case - a particular provider may be
362 specified with a level of override forcing, for instance, a BSD
363 disklabel module to attach to a provider which was not found palatable
364 during the TASTE operation.
366 Finally, I/O is the reason we even do this: it concerns itself with
367 sending I/O requests through the graph.
368 .It Em "I/O REQUESTS" ,
371 originate at a consumer,
372 are scheduled on its attached provider and, when processed, are returned
374 It is important to realize that the
376 which enters through the provider of a particular geom does not
378 come out on the other side
380 Even simple transformations like MBR and BSD will clone the
382 modify the clone, and schedule the clone on their
384 Note that cloning the
386 does not involve cloning the
387 actual data area specified in the I/O request.
389 In total, four different I/O requests exist in
391 read, write, delete, and
394 Read and write are self explanatory.
396 Delete indicates that a certain range of data is no longer used
397 and that it can be erased or freed as the underlying technology
399 Technologies like flash adaptation layers can arrange to erase
400 the relevant blocks before they will become reassigned and
401 cryptographic devices may want to fill random bits into the
402 range to reduce the amount of data available for attack.
404 It is important to recognize that a delete indication is not a
405 request and consequently there is no guarantee that the data actually
406 will be erased or made unavailable unless guaranteed by specific
410 semantics are required, a
411 geom should be pushed which converts delete indications into (a
412 sequence of) write requests.
415 supports inspection and manipulation
416 of out-of-band attributes on a particular provider or path.
417 Attributes are named by
419 strings and they will be discussed in
420 a separate section below.
423 (Stay tuned while the author rests his brain and fingers: more to come.)
425 Several flags are provided for tracing
427 operations and unlocking
428 protection mechanisms via the
429 .Va kern.geom.debugflags
431 All of these flags are off by default, and great care should be taken in
433 .Bl -tag -width indent
434 .It 0x01 Pq Dv G_T_TOPOLOGY
435 Provide tracing of topology change events.
436 .It 0x02 Pq Dv G_T_BIO
437 Provide tracing of buffer I/O requests.
438 .It 0x04 Pq Dv G_T_ACCESS
439 Provide tracing of access check controls.
441 .It 0x10 (allow foot shooting)
442 Allow writing to Rank 1 providers.
443 This would, for example, allow the super-user to overwrite the MBR on the root
444 disk or write random sectors elsewhere to a mounted disk.
445 The implications are obvious.
446 .It 0x40 Pq Dv G_F_DISKIOCTL
447 This is unused at this time.
448 .It 0x80 Pq Dv G_F_CTLDUMP
449 Dump contents of gctl requests.
454 .Xr DECLARE_GEOM_CLASS 9 ,
463 .Xr g_provider_by_name 9
465 This software was developed for the
468 .An Poul-Henning Kamp
469 and NAI Labs, the Security Research Division of Network Associates, Inc.\&
470 under DARPA/SPAWAR contract N66001-01-C-8035
473 DARPA CHATS research program.
475 The first precursor for
477 was a gruesome hack to Minix 1.2 and was
479 An earlier attempt to implement a less general scheme
484 .An "Poul-Henning Kamp" Aq phk@FreeBSD.org