Preparation

• Read Chapter 3 in the text.

Contents

Topics

• Disk Architecture
• Partition Tables and Master Boot Records
• Linux Disk Layout
• Inodes and Directories
• Common Operations
• Creating File Systems
• File Permissions
• The Linux File Layout
• Debugging and Analyzing File Systems
• Backup and Recovery

Assignment

Disk Architecture

A cylinder is a single track on a hard drive through all of the platters. Often the two terms are used interchangeably.

For example, a Maxtor 91303D6 13 gigabyte drive has 16383 cylinders 16 heads and 63 sectors for a total of 16,514,064 sectors. These are ostensibly 1024 byte sectors, but some space is wasted. Also, drives can be addressed differently due to onboard translation.

IDE (Integrated Device Electronics) drives can show a variety of different structures by interpreting the addresses.

The addressing for these drives can be determined arbitrarily, but we will assume that when addressing a particular sector, counting will begin with C(ylinder) 0, H(ead) 0, and S(ector) 1, or CHS = 0,0,1. Then, succeeding sectors will be CHS = 0,0,2, then 0,0,3, ... 0,1,1, 0,1,2, ... 1,0,1 and so on.

Partition Tables and Master Boot Records

When a machine is started, the firmware bios know where to find this information. It loads it into memory, and executes the master boot program. The layout of the MBR is:

The LILO boot program is an example of a program that might be found here.

The partition table has a maximum of four 16-byte entries of the form:

• Byte 1, Status = active (bootable) or not
• Bytes 2-4, Starting HSC information, Head = 8 bits, cylinder = 10 bits, sector = 5 bits
• Byte 5, Type = 12-bit FAT, 16-bit FAT, NTFS, Linux ext2, etc.
• Bytes 6-8, ending HSC information
• Bytes 9-16, LBA (Logical Block Addressing) start and length as 32 bit numbers.

LBA is important because it removed the 1024 cylinder limit for the location of a partition. ATA-2 incorporated LBA and rid the industry of a significant limitation. When you are partitioning a hard drive and see a warning about a partition that exceeds the 1024 cylinder limit, you only need to worry if it is using ATA-1 or earlier hard drive technology.

A simple boot program looks through the partition table for the active partition (there can only be one) and boots that partition. More sophisticated boot managers (LILO, GRUB, NT Boot Manager) can handle multiple boots by reading disk files that contain additional information concerning bootable partitions.

After the boot sector, the remainder of the the first cylinder CHS = 0,0,2 through 0,0,n is unused and the first sector on the second cylinder, CHS = 0,1,1, begins the operating system portion of the disk. Depending on the operating system this can vary, but in general, it contans a boot sector for the operating system itself, information about the file system, and finally, data.

The Linux Disk Layout

ext2 has a particular disk layout that it uses as does every operating system and/or file format within an operating system. While there is some variation, a Linux file system looks basically like this:

• Boot sector - The LILO program can go here as well.
• Superblock for ext2
  • blocksize
  • blocks per group
  • # inodes and free inodes in the block
  • # blocks and free blocks in the block
  • # reserved blocks
  • Timestamps for mount, last write, last check
  • first inode
  • first data block
  • mount count
  • one copy is stored in each block group
  • block groups are intended to keep blocks and their inodes close together

  A superblock is actually quite complex and this is only an overview. You can look at the various C structures for the superblock and other ext2 filesystem entities in /usr/include/linux/ext2_fs.h.

In modern systems, it is much to inefficient to keep all of the inodes at the beginning of a partition, so block groups are created which organize smaller parts of a partition so that the inodes related to groups of blocks are kept locally. A block group structure is:

• Copy of superblock
• File System Descriptors
  • block # of block bitmap
  • block # of inode bitmap
  • block # where inodes start
  • free block count
  • free inode count
  • directory count
• All blocks are 1024 bytes.

Inodes and Directories

The basic unit of structure for an ext2 filesystem is an inode which has the following format:

• 128 bytes each
• mode = (type - file, directory, device)
• UID = user id - the uid of the owner
• GID = group id - the gid of the owner
• Size = file size in bytes
• time stamps for access, creation modification and deletion
• 12 direct blocks - 12 x 1024 = 12,288 bytes
• Single indirect block (assuming 1024 byte blocks)
  • 256 x 1024 = 262,144 bytes
• Double indirect block
  • 256 x 256 x 1024 = 67,108,864 bytes
• Triple indirect block
  • 256 x 256 x 256 x 1024 = 1,717,986,918 bytes
• Since block sizes can be varied, the size of the file system is up to 16 terabytes.

There is actually quite a bit of additional information stored in the inodes of an ext2 file system which is more relevant to a course in operating systems.

Directory Structures

A directory in an ext2 file system is simply a file with the directory mode bit set. So when you create a directory, it allocates everything just like a regular file. When you add files to the directory, each file is provided an entry in the directory file with this format:

• Names are up to 255 characters and are stored in a variable length format.
• Each entry takes 8 bytes plus the characters in the name.
• When a directory is created, it is required to contain the "." and ".." entries.

Consider the following directory tree, where the partition is mounted on /test.

Assuming that nothing else is going on with the disk, and that the files were created in a breadth-first order that the first data block is block 1000, the inodes will be:

Inode	Type	Size	Direct Pointers	Indirect
1	dir	1024	1000
2	dir	1024	1001
3	dir	1024	1002
4	file	20	1003
5	file	15,814	1004-1015	1016
6	dir	1024	1021

Block 1000 is the top level directory pointed to by inode 1. Note that inode 0 indicates that a reference is beyond the top of the partition mount point. Abbreviating the inode entries, the block contents are:

Block 1000 Layout

Inode	Name
0	..
1	.
2	dirone
3	stuff
4	junk

Similarly block 1001 is the dirone directory:

Block 1001 Layout

Inode	Name
1	..
2	.

Block 1002 is the stuff directory:

Block 1002 Layout

Inode	Name
1	..
3	.
4	file1
5	morestuff

Block 1003 is the file junk data block. Junk only contains 20 bytesk so 1003 has 20 bytes of data and nothing else.

Block 1003 Layout

Data
12345678900987654321

Blocks 1004 through 1015 are the first 12 data blocks for the file named file1. Since it is longer than 12 times 1024 bytes, it also has an indirect block, 1016, which has pointer to the first set of indirect blocks. Since it will take an additional four blocks to store the 15,814 - 12,288 = 3526 bytes, it will have four addresses in it:

Block 1016 Layout

Contents
1017 1018 1019 1020

Each of the blocks (1017 - 1019) will have 1024 bytes of data, and 1020 will have the remaining bytes.

Finally, block 1021 contains the directory for morestuff:

Block 1021 Layout

Inode	Name
3	..
6	.

Normally, directory trees don't get built sequentially like this, and files have a tendancy to grow and shrink, so the block assignments for a file are not usually in order.

Questions:

1. Show the changes needed for the following sequence of changes:
   1. A file named newfile is added to the directory stuff with a size of 1200 bytes.
   2. The file junk is reduced to 13,500 bytes.
   3. Newfile is increased in size to 6400 bytes.
   4. The directory dirone is removed.
   5. A directory evenmorestuff is added to morestuff

Common Operations

Mounting a File System

File systems aren't available until they are mounted at a mount point in the file system. By default, the root file system is mounted at boot time, and everything else starts there. Normally, the file systems you want are automatically mounted (more on this later). When they aren't, or you need to add something, like a zip, floppy or CD, you have to do a mount manually.

mount - the linux mount program

Syntax: mount [option] [device] [dir]

The options on mount are many and can be confusing, but normally you don't need much. A typical mount looks like this:

mount -t type device dir

For example,

mount -t ext2 /dev/fd0 /mnt/floppy		mount a floppy disk. The floppy drive should contain a floppy disk that has been formatted for the Linux ext2 file system and /mnt/floppy must exist.
mount -t msdos /dev/hdc4 /mnt/zip		The zip disk is the third IDE device. The zip driver assumes that the zip disk is the fourth partition. (I can't explain). The zip disk has been formatted for MSDOS/Windows and it should be mounted at /mnt/zip.
mount -t iso9660 /dev/cdrom /mnt/cd		Mount the file system on the cdrom at /mnt/cd. iso9660 is the standard cd file system format.
mount -t msdos /dev/hda1 /Windows		Mount partition 1 on /dev/hda at /Windows, and it should be formatted as an msdos file system of some sort.
mount -a		Mount everything in in /etc/fstab that has the automount flag set

mount will complain if the file system isn't the correct type, or if you don't get the mount point correct. There can't already be something there. Look at the man page for mount to see a list of all the possible file system types.

There are many file systems that Linux mount will handle, but the ones of most interest are:

adfs		Advanced File System
autofs		Automount
coda		The Coda file system
ext		Old Linux format
ext2		New Linux format
iso9660		CD format
msdos		DOS/Windows format
nfs		Network File System
ntfs		NT File System
smbfs		Samba File System
ufs		Unix File System

Some other options that you may use from time to time:

-a		mount everything. Typically only used if your are troubleshooting and are running by virtue of a floppy boot up or some other strange occurrence. If you aren't root, or /etc is read only, use mount -an.
-r		mount the file system readonly; also -o ro.
-o rw		mount the file system read-write; also -w.
-fv		Output what the mount command would do, but don't actually perform any operations.
-o sync		Do I/O synchronously so that writes are performed immediately rather than cached.
-o noauto		Must be mounted explicitly, no automount.
-o user		Allow ordinary user to mount

Labels

A new trick in the 2.4 and later Linux kernels is the use of volume labels. Instead of mounting /dev/hda4, you can give /dev/hda4 a volume label and then mount using the label. For example, mount /usr instead of mount /dev/hda5. These labels are set using the e2label command or when building with mke2fs. By default, Red Hat 8.0 uses labels in the fstab file as well, so if you need to see the actual devices, enter mount without any parameters.

NFS mounts

mount -t nfs [options] host:dir dir

mount -t nfs -r boffo.clowns.org:/home/bozo /bozo

To export a file system so that it can be NFS mounted, you edit the file /etc/exports and enter a record of the form:

directory [options]

For example,

/home/bozo		Allow anyone to NFS mount this directory.
/home/bozo clowns (ro)		Allow the host named clowns on the local network to mount the directory read-only.
/home/bozo clowns (ro) lab*.clownnet.org (rw)		As before, but also allow any host matching lab*.clownnet.org to mount it read-write.
/home/bozo 168.1.128.0/255.255.252.0 (ro)		As before, but opened to a subnet.
/home/bozo (anonuid=1000,anongid=150)		Allow anyone to mount this, but map all requests to uid 1000 and gid 150, so that they all appear to come from the same user. This is handy and possibly necessary if users have different uid's and gid's on different systems.
/home/bozo clowns(rw, all_squash)		Mount read-write for clowns and make all uid's and gid's the same as the user named anonymous (which must exist)
/home/bozo (sync, insecure)		Normally writes are done asynchronously but this changes it to synchronous and insecure allows clients using ports above 1024 to mount this directory, which is dangerous.

Unmounting a File System

Unmounting is very simple. You can specify either the device or the mount point, if the mount point is listed in /etc/fstab.

umount /dev/hdc4

umount /mnt/floppy

Remember that under Linux, data written to a removable device may not be written unless you unmount it properly or mount it with the sync option. So, mount the device, write to it and then umount it before removing it. If you remove it without unmounting, plan on doing the process again, and possibly with a reboot because it thinks the device is busy. The eject command will unmount and then eject the device for most removable devices.

automounting systems may help here, but only if the system is able to control the actions associated with the mechanical eject.

Miscellaneous

• df [options] [filesystem] - Show the allocation of the device or all devices.
• fdformat device - Low level format a floppy disk
• mpartition/mformat - Parition/Format an MSDOS device.
• du [options] filesys - summarize the disk usage of each file in filesys.

fstab

1. Device specification
2. Mount point
3. File system type
4. Options
   • defaults = rw, suid, dev, exec, auto, nouser, asynch
   • rw = read-write
   • suid = allow set user and set group operations
   • dev = interpret as character or block as necessary
   • exec = allow execution of binaries
   • auto = can be mounted with -a option
   • nouser = ordinary schmuck CAN'T mount this device
   • user = ordinary schmuck CAN mount this device
   • asynch = perform all I/O asynchronously
   • owner = set uid, gid to user that mounts
   • and many others
5. Dump flag - should this device be backed up
6. Check order - what order should they be checked at start up

Device		Mount Point		Type		Options		Dump		Order
/dev/hda1		/		ext2		defaults		1		1
/dev/hda6		/home		ext2		defaults		1		2
/dev/cdrom		/mnt/cdrom		iso9660		noauto,owner,ro,user,exe c,dev,suid		0		0
/dev/hda5		/usr		ext2		defaults		1		2
/dev/hda7		swap		swap		defaults		0		0
/dev/fd0		/mnt/floppy		ext2		noauto,owner,user,exec,d ev,suid		0		0
/dev/fd0		/mnt/dosfloppy		vfat		noauto,owner,user,exec,d ev,suid		0		0
none		/proc		proc		defaults		0		0
none		/dev/pts		devpts		gid=5,mode=620		0		0
/dev/hdd4		/mnt/doszip		vfat		noauto,owner,rw,user,exe c,dev,suid		0		0
/dev/hdd4		/mnt/zip		ext2		noauto,owner,rw,user,exe c,dev,suid		0		0
clowns:/home/bozo		/home/bozo/nfs		nfs		defaults		0		0

User Mounts

If you want to allow ordinary users to mount devices, you can put that information in fstab, even if the devices are not always mounted. For example, if you wanted a user to be able to do an NFS mount when needed, you could put the following in your fstab:

clownserver:/home/bozo /users/bozo/csfiles nfs noauto,user,rw

Any user with permission to access /users/bozo/csfiles can perform the mount by entering:

mount /users/bozo/csfiles

Automounting

If you want to automount removable storage devices like zip disks and CD-ROMS, you need to run the autofs daemon at system startup. It will read /etc/auto.master which describes mount points that are to be automounted. If an access is attempted on one of those mount points, it will attempt to mount the device. If the device is not used for a certain period of time, it will unmount it.

auto.master sets up the mountpoints for autofs. Each line describes a mountpoint and the file that describes the specific file systems for the mountpoint. For example,

   /vol        /etc/auto.vol         --timeout=10
   

Describes the /vol mountpoint which is further described in /etc/auto.vol. The timeout value is the wait time until an attempt to automount is aborted. For example, if you put a CD in your reader and attempt to read it, after 60 seconds the automounter will give up. The automounter also unmounts devices after a period of inactivity (typically 600 seconds). If it auto-unmounted and then the device is accessed again, autofs will try to remount it.

auto.vol describes the things that will be mounted on /vol. For example,

   cdrom       -fstype=iso9660,ro,nosuid,nodev   :/dev/cdrom  #dvd
   cdrom1      -fstype=iso9660,rw,nosuid,nodev   :/dev/cdrom1 #cdrw
   zip         -fstype=auto,rw,sync,umask=002    :/dev/hdd4   #zip
   floppy      -fstype=auto,rw,sync,umask=002    :/dev/floppy #floppy
   

describes the mount properties for a dvd, cd-rw, zip and floppy disk. Why not simply use /mnt. There isn't a specific reason, but /mnt is used for other things and in order to prevent conflicts, its not a bad idea to put the auto mountpoints somewhere else.

Other Files

Two other files of interest are /etc/mtab and /proc/mounts. Both of these files contain the information about the currently mounted file systems and are very similar. It appears that at some point in time the traditional /etc/mtab file will be completely replaced by /proc/mounts.

The root of your filesystem tree is /proc/mounts that has a list of all of the mounts. Any absolute pathname (starting with a /) begins by finding the correct filesystem to use.

Creating File Systems

• Installing hard disks and removable media devices (tape, zip, etc)
• Partitioning hard disks
• Creating file systems
• Managing file systems - space usage, quotas, file system repair, failure recovery, backup and some other good stuff.
• Mounting hard drives and other mountable devices, including NFS disks, alien file systems (DOS, NTFS, Solaris, etc)

Partitioning

• Caution: Messing with the partition programs can result in major trauma to your file system, and hence, your sanity - BACK IT UP, BE CAREFUL AND BE PREPARED TO REINSTALL IF YOU MESS UP.

  fdisk - the traditional linux paritioning program

  Syntax: fdisk [option] device
  • fdisk device open fdisk in interactive mode. The important interactive commands are:
    • m - list the commands (no really, it is m)
    • p - print the partition table

         Disk /dev/hda: 255 heads, 63 sectors, 1021 cylinders
         Units = cylinders of 16065 * 512 bytes
         
            Device Boot    Start       End    Blocks   Id  System
         /dev/hda1   *         1       128   1028128+  83  Linux
         /dev/hda2           129      1021   7173022+   5  Extended
         /dev/hda5           129       575   3590496   83  Linux
         /dev/hda6           576       958   3076416   83  Linux
         /dev/hda7           959      1021    506016   82  Linux swap
      
         Command (m for help):
                  

    • d - delete a partition - "d 1" deletes /dev/hda1
    • n - add a partition - you will be asked to specify a new partition number, then the starting cylinder and either the ending cylinder or the size in bytes (+size) kilobytes (+sizeK) or megabytes (+sizeM).
    • a - toggle the bootable flag - "a 3" makes /dev/hdx3 bootable.
    • q - quit without writing the new partition table
    • w - write the partition table to the disk
  • fdisk -l /dev/hda - list the partition table of hard disk a
  • fdisk -ul /dev/hdc - list the partition table of hard disk c and list the output in sectors instead of cylinders

sfdisk - a more sophisticated partition program based on DRDOS, a popular MSDOS product. More options, and basically the same results. However, it requires that you unmount the drive before starting.

cfdisk - a curses based (sort of graphical) partitioning tool. Easier to use and easier to screw up if you aren't careful. It displays a list of partitions and their parameters and then provides commands to:

Bootable   -   Make a partition bootable

Delete   -   Delete a partition

Maximize   -   Maximize the size of a partition

Print   -   Print to screen or file

Type   -   Set the partition type

Units   -   Change the display units

Write   -   Write partition table

The interface looks like this:

parted

People familiar with the Windows partitioning program Partition Magic will appreciate parted, which does the same functions for free. Theoretically partitions are not operating system dependent, so its really a matter of what the software runs on.

parted comes from the fine folks at GNU and will allow you to create, destroy, resize, move and copy ext2, FAT and FAT32 partitions without the loss of data (obviously not if you destroy something). They always warn you to backup your data and since they wrote the software, that's probably good advice. parted is easy to use and very fast. Like Partition Magic, it saves a bunch of operations and then updates all at once. Unlike PM, parted does not have a graphical interface, and in fact, is the backend processor for DiskDruid which you used to partition your hard drive during installation.

If you use Partition Magic (probably from a DOS boot floppy) be a little careful. PM saves a list of operations and performs them all when you apply the changes (although it appears that the are being done in real-time in the interface). If you are going to do quite a few things, it is best to do a couple, let PM perform the operations and then do a couple more things and so on, rather than building up a backlog of operations. Experience says that this will prevent potential problems resulting in data loss, heartbreak, unemployment, depression and/or someone tatooing moron on your forehead.

Creating a File System

A file system is created with mkfs command, which has the format:

mkfs [-t fstype] [options] filesys [block]

There are a number of specific commands to make this easier, such as:

• mke2fs, mkfs.ext2 - make an ext2 filesystem
• mkdosfs, mkfs.msdos - make a dos file system

These commands have a wide variety of specific options for the file system type. Normally, the defaults are reasonable.

Some examples are:

mkfs -t ext2 /dev/hda6
mke2fs /dev/hda6


Both create a default ext2 file system on the 6th partition on /dev/hda. Anything on this disk is history, so be careful.

mkfs -t msdos -F32 -nWindows -r1024 -s64 /dev/hdb1
mkdosfs -F32 -nWindows -r1024 -s64 /dev/hdb1


Both create a dos file system with volume name Windows, 32-bit fat tables, 1024 root directory entries and 64 sectors per cluster.

mke2fs /dev/hdc4
Create a zip disk (probably) on the fourth IDE device with an ext2 file system.

Once the file system is created, it is ready to be mounted and used.

ext2 and ext3

/sbin/tune2fs -j /dev/hda5

File Permissions

File permissions are the mechanism used by Unix in general and Linux to control file access. The file permissions are organized by types of user and types of access.

• User types = owner(o), group(g), user(u)
• Permissions = read(r), write(w), execute(x), set-uid (s), set-gid (s), sticky bit (t).

These permissions represent a 12-bit value that is organized in the following way:

Bit		Permission
0		Set-uid bit
1		Set-gid bit
2		Sticky bit
0		Owner read
0		Owner write
0		Owner execute
0		Group read
0		Group write
0		Group execute
0		User read
0		User write
0		User execute