zfs/module/zfs/zio_checksum.c

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
  23  * Copyright (c) 2013 by Delphix. All rights reserved.
  24  * Copyright 2013 Saso Kiselkov. All rights reserved.
  25  */
  26
  27 #include <sys/zfs_context.h>
  28 #include <sys/spa.h>
  29 #include <sys/spa_impl.h>
  30 #include <sys/zio.h>
  31 #include <sys/zio_checksum.h>
  32 #include <sys/zil.h>
  33 #include <zfs_fletcher.h>
  34
  35 /*
  36  * Checksum vectors.
  37  *
  38  * In the SPA, everything is checksummed.  We support checksum vectors
  39  * for three distinct reasons:
  40  *
  41  *   1. Different kinds of data need different levels of protection.
  42  *      For SPA metadata, we always want a very strong checksum.
  43  *      For user data, we let users make the trade-off between speed
  44  *      and checksum strength.
  45  *
  46  *   2. Cryptographic hash and MAC algorithms are an area of active research.
  47  *      It is likely that in future hash functions will be at least as strong
  48  *      as current best-of-breed, and may be substantially faster as well.
  49  *      We want the ability to take advantage of these new hashes as soon as
  50  *      they become available.
  51  *
  52  *   3. If someone develops hardware that can compute a strong hash quickly,
  53  *      we want the ability to take advantage of that hardware.
  54  *
  55  * Of course, we don't want a checksum upgrade to invalidate existing
  56  * data, so we store the checksum *function* in eight bits of the bp.
  57  * This gives us room for up to 256 different checksum functions.
  58  *
  59  * When writing a block, we always checksum it with the latest-and-greatest
  60  * checksum function of the appropriate strength.  When reading a block,
  61  * we compare the expected checksum against the actual checksum, which we
  62  * compute via the checksum function specified by BP_GET_CHECKSUM(bp).
  63  *
  64  * SALTED CHECKSUMS
  65  *
  66  * To enable the use of less secure hash algorithms with dedup, we
  67  * introduce the notion of salted checksums (MACs, really).  A salted
  68  * checksum is fed both a random 256-bit value (the salt) and the data
  69  * to be checksummed.  This salt is kept secret (stored on the pool, but
  70  * never shown to the user).  Thus even if an attacker knew of collision
  71  * weaknesses in the hash algorithm, they won't be able to mount a known
  72  * plaintext attack on the DDT, since the actual hash value cannot be
  73  * known ahead of time.  How the salt is used is algorithm-specific
  74  * (some might simply prefix it to the data block, others might need to
  75  * utilize a full-blown HMAC).  On disk the salt is stored in a ZAP
  76  * object in the MOS (DMU_POOL_CHECKSUM_SALT).
  77  *
  78  * CONTEXT TEMPLATES
  79  *
  80  * Some hashing algorithms need to perform a substantial amount of
  81  * initialization work (e.g. salted checksums above may need to pre-hash
  82  * the salt) before being able to process data.  Performing this
  83  * redundant work for each block would be wasteful, so we instead allow
  84  * a checksum algorithm to do the work once (the first time it's used)
  85  * and then keep this pre-initialized context as a template inside the
  86  * spa_t (spa_cksum_tmpls).  If the zio_checksum_info_t contains
  87  * non-NULL ci_tmpl_init and ci_tmpl_free callbacks, they are used to
  88  * construct and destruct the pre-initialized checksum context.  The
  89  * pre-initialized context is then reused during each checksum
  90  * invocation and passed to the checksum function.
  91  */
  92
  93 /*ARGSUSED*/
  94 static void
  95 zio_checksum_off(const void *buf, uint64_t size,
  96     const void *ctx_template, zio_cksum_t *zcp)
  97 {
  98         ZIO_SET_CHECKSUM(zcp, 0, 0, 0, 0);
  99 }
 100
 101 zio_checksum_info_t zio_checksum_table[ZIO_CHECKSUM_FUNCTIONS] = {
 102         {{NULL, NULL}, NULL, NULL, 0, "inherit"},
 103         {{NULL, NULL}, NULL, NULL, 0, "on"},
 104         {{zio_checksum_off,             zio_checksum_off},
 105             NULL, NULL, 0, "off"},
 106         {{zio_checksum_SHA256,          zio_checksum_SHA256},
 107             NULL, NULL, ZCHECKSUM_FLAG_METADATA | ZCHECKSUM_FLAG_EMBEDDED,
 108             "label"},
 109         {{zio_checksum_SHA256,          zio_checksum_SHA256},
 110             NULL, NULL, ZCHECKSUM_FLAG_METADATA | ZCHECKSUM_FLAG_EMBEDDED,
 111             "gang_header"},
 112         {{fletcher_2_native,            fletcher_2_byteswap},
 113             NULL, NULL, ZCHECKSUM_FLAG_EMBEDDED, "zilog"},
 114         {{fletcher_2_native,            fletcher_2_byteswap},
 115             NULL, NULL, 0, "fletcher2"},
 116         {{fletcher_4_native,            fletcher_4_byteswap},
 117             NULL, NULL, ZCHECKSUM_FLAG_METADATA, "fletcher4"},
 118         {{zio_checksum_SHA256,          zio_checksum_SHA256},
 119             NULL, NULL, ZCHECKSUM_FLAG_METADATA | ZCHECKSUM_FLAG_DEDUP |
 120             ZCHECKSUM_FLAG_NOPWRITE, "sha256"},
 121         {{fletcher_4_native,            fletcher_4_byteswap},
 122             NULL, NULL, ZCHECKSUM_FLAG_EMBEDDED, "zilog2"},
 123         {{zio_checksum_off,             zio_checksum_off},
 124             NULL, NULL, 0, "noparity"},
 125         {{zio_checksum_SHA512_native,   zio_checksum_SHA512_byteswap},
 126             NULL, NULL, ZCHECKSUM_FLAG_METADATA | ZCHECKSUM_FLAG_DEDUP |
 127             ZCHECKSUM_FLAG_NOPWRITE, "sha512"},
 128         {{zio_checksum_skein_native,    zio_checksum_skein_byteswap},
 129             zio_checksum_skein_tmpl_init, zio_checksum_skein_tmpl_free,
 130             ZCHECKSUM_FLAG_METADATA | ZCHECKSUM_FLAG_DEDUP |
 131             ZCHECKSUM_FLAG_SALTED | ZCHECKSUM_FLAG_NOPWRITE, "skein"},
 132         {{zio_checksum_edonr_native,    zio_checksum_edonr_byteswap},
 133             zio_checksum_edonr_tmpl_init, zio_checksum_edonr_tmpl_free,
 134             ZCHECKSUM_FLAG_METADATA | ZCHECKSUM_FLAG_SALTED |
 135             ZCHECKSUM_FLAG_NOPWRITE, "edonr"},
 136 };
 137
 138 /*
 139  * The flag corresponding to the "verify" in dedup=[checksum,]verify
 140  * must be cleared first, so callers should use ZIO_CHECKSUM_MASK.
 141  */
 142 spa_feature_t
 143 zio_checksum_to_feature(enum zio_checksum cksum)
 144 {
 145         VERIFY((cksum & ~ZIO_CHECKSUM_MASK) == 0);
 146
 147         switch (cksum) {
 148         case ZIO_CHECKSUM_SHA512:
 149                 return (SPA_FEATURE_SHA512);
 150         case ZIO_CHECKSUM_SKEIN:
 151                 return (SPA_FEATURE_SKEIN);
 152         case ZIO_CHECKSUM_EDONR:
 153                 return (SPA_FEATURE_EDONR);
 154         default:
 155                 return (SPA_FEATURE_NONE);
 156         }
 157 }
 158
 159 enum zio_checksum
 160 zio_checksum_select(enum zio_checksum child, enum zio_checksum parent)
 161 {
 162         ASSERT(child < ZIO_CHECKSUM_FUNCTIONS);
 163         ASSERT(parent < ZIO_CHECKSUM_FUNCTIONS);
 164         ASSERT(parent != ZIO_CHECKSUM_INHERIT && parent != ZIO_CHECKSUM_ON);
 165
 166         if (child == ZIO_CHECKSUM_INHERIT)
 167                 return (parent);
 168
 169         if (child == ZIO_CHECKSUM_ON)
 170                 return (ZIO_CHECKSUM_ON_VALUE);
 171
 172         return (child);
 173 }
 174
 175 enum zio_checksum
 176 zio_checksum_dedup_select(spa_t *spa, enum zio_checksum child,
 177     enum zio_checksum parent)
 178 {
 179         ASSERT((child & ZIO_CHECKSUM_MASK) < ZIO_CHECKSUM_FUNCTIONS);
 180         ASSERT((parent & ZIO_CHECKSUM_MASK) < ZIO_CHECKSUM_FUNCTIONS);
 181         ASSERT(parent != ZIO_CHECKSUM_INHERIT && parent != ZIO_CHECKSUM_ON);
 182
 183         if (child == ZIO_CHECKSUM_INHERIT)
 184                 return (parent);
 185
 186         if (child == ZIO_CHECKSUM_ON)
 187                 return (spa_dedup_checksum(spa));
 188
 189         if (child == (ZIO_CHECKSUM_ON | ZIO_CHECKSUM_VERIFY))
 190                 return (spa_dedup_checksum(spa) | ZIO_CHECKSUM_VERIFY);
 191
 192         ASSERT((zio_checksum_table[child & ZIO_CHECKSUM_MASK].ci_flags &
 193             ZCHECKSUM_FLAG_DEDUP) ||
 194             (child & ZIO_CHECKSUM_VERIFY) || child == ZIO_CHECKSUM_OFF);
 195
 196         return (child);
 197 }
 198
 199 /*
 200  * Set the external verifier for a gang block based on <vdev, offset, txg>,
 201  * a tuple which is guaranteed to be unique for the life of the pool.
 202  */
 203 static void
 204 zio_checksum_gang_verifier(zio_cksum_t *zcp, blkptr_t *bp)
 205 {
 206         const dva_t *dva = BP_IDENTITY(bp);
 207         uint64_t txg = BP_PHYSICAL_BIRTH(bp);
 208
 209         ASSERT(BP_IS_GANG(bp));
 210
 211         ZIO_SET_CHECKSUM(zcp, DVA_GET_VDEV(dva), DVA_GET_OFFSET(dva), txg, 0);
 212 }
 213
 214 /*
 215  * Set the external verifier for a label block based on its offset.
 216  * The vdev is implicit, and the txg is unknowable at pool open time --
 217  * hence the logic in vdev_uberblock_load() to find the most recent copy.
 218  */
 219 static void
 220 zio_checksum_label_verifier(zio_cksum_t *zcp, uint64_t offset)
 221 {
 222         ZIO_SET_CHECKSUM(zcp, offset, 0, 0, 0);
 223 }
 224
 225 /*
 226  * Calls the template init function of a checksum which supports context
 227  * templates and installs the template into the spa_t.
 228  */
 229 static void
 230 zio_checksum_template_init(enum zio_checksum checksum, spa_t *spa)
 231 {
 232         zio_checksum_info_t *ci = &zio_checksum_table[checksum];
 233
 234         if (ci->ci_tmpl_init == NULL)
 235                 return;
 236         if (spa->spa_cksum_tmpls[checksum] != NULL)
 237                 return;
 238
 239         VERIFY(ci->ci_tmpl_free != NULL);
 240         mutex_enter(&spa->spa_cksum_tmpls_lock);
 241         if (spa->spa_cksum_tmpls[checksum] == NULL) {
 242                 spa->spa_cksum_tmpls[checksum] =
 243                     ci->ci_tmpl_init(&spa->spa_cksum_salt);
 244                 VERIFY(spa->spa_cksum_tmpls[checksum] != NULL);
 245         }
 246         mutex_exit(&spa->spa_cksum_tmpls_lock);
 247 }
 248
 249 /*
 250  * Generate the checksum.
 251  */
 252 void
 253 zio_checksum_compute(zio_t *zio, enum zio_checksum checksum,
 254         void *data, uint64_t size)
 255 {
 256         blkptr_t *bp = zio->io_bp;
 257         uint64_t offset = zio->io_offset;
 258         zio_checksum_info_t *ci = &zio_checksum_table[checksum];
 259         zio_cksum_t cksum;
 260         spa_t *spa = zio->io_spa;
 261
 262         ASSERT((uint_t)checksum < ZIO_CHECKSUM_FUNCTIONS);
 263         ASSERT(ci->ci_func[0] != NULL);
 264
 265         zio_checksum_template_init(checksum, spa);
 266
 267         if (ci->ci_flags & ZCHECKSUM_FLAG_EMBEDDED) {
 268                 zio_eck_t *eck;
 269
 270                 if (checksum == ZIO_CHECKSUM_ZILOG2) {
 271                         zil_chain_t *zilc = data;
 272
 273                         size = P2ROUNDUP_TYPED(zilc->zc_nused, ZIL_MIN_BLKSZ,
 274                             uint64_t);
 275                         eck = &zilc->zc_eck;
 276                 } else {
 277                         eck = (zio_eck_t *)((char *)data + size) - 1;
 278                 }
 279                 if (checksum == ZIO_CHECKSUM_GANG_HEADER)
 280                         zio_checksum_gang_verifier(&eck->zec_cksum, bp);
 281                 else if (checksum == ZIO_CHECKSUM_LABEL)
 282                         zio_checksum_label_verifier(&eck->zec_cksum, offset);
 283                 else
 284                         bp->blk_cksum = eck->zec_cksum;
 285                 eck->zec_magic = ZEC_MAGIC;
 286                 ci->ci_func[0](data, size, spa->spa_cksum_tmpls[checksum],
 287                     &cksum);
 288                 eck->zec_cksum = cksum;
 289         } else {
 290                 ci->ci_func[0](data, size, spa->spa_cksum_tmpls[checksum],
 291                     &bp->blk_cksum);
 292         }
 293 }
 294
 295 int
 296 zio_checksum_error_impl(spa_t *spa, blkptr_t *bp, enum zio_checksum checksum,
 297     void *data, uint64_t size, uint64_t offset, zio_bad_cksum_t *info)
 298 {
 299         zio_checksum_info_t *ci = &zio_checksum_table[checksum];
 300         int byteswap;
 301         zio_cksum_t actual_cksum, expected_cksum;
 302
 303         if (checksum >= ZIO_CHECKSUM_FUNCTIONS || ci->ci_func[0] == NULL)
 304                 return (SET_ERROR(EINVAL));
 305
 306         zio_checksum_template_init(checksum, spa);
 307
 308         if (ci->ci_flags & ZCHECKSUM_FLAG_EMBEDDED) {
 309                 zio_eck_t *eck;
 310                 zio_cksum_t verifier;
 311
 312                 if (checksum == ZIO_CHECKSUM_ZILOG2) {
 313                         zil_chain_t *zilc = data;
 314                         uint64_t nused;
 315
 316                         eck = &zilc->zc_eck;
 317                         if (eck->zec_magic == ZEC_MAGIC)
 318                                 nused = zilc->zc_nused;
 319                         else if (eck->zec_magic == BSWAP_64(ZEC_MAGIC))
 320                                 nused = BSWAP_64(zilc->zc_nused);
 321                         else
 322                                 return (SET_ERROR(ECKSUM));
 323
 324                         if (nused > size)
 325                                 return (SET_ERROR(ECKSUM));
 326
 327                         size = P2ROUNDUP_TYPED(nused, ZIL_MIN_BLKSZ, uint64_t);
 328                 } else {
 329                         eck = (zio_eck_t *)((char *)data + size) - 1;
 330                 }
 331
 332                 if (checksum == ZIO_CHECKSUM_GANG_HEADER)
 333                         zio_checksum_gang_verifier(&verifier, bp);
 334                 else if (checksum == ZIO_CHECKSUM_LABEL)
 335                         zio_checksum_label_verifier(&verifier, offset);
 336                 else
 337                         verifier = bp->blk_cksum;
 338
 339                 byteswap = (eck->zec_magic == BSWAP_64(ZEC_MAGIC));
 340
 341                 if (byteswap)
 342                         byteswap_uint64_array(&verifier, sizeof (zio_cksum_t));
 343
 344                 expected_cksum = eck->zec_cksum;
 345                 eck->zec_cksum = verifier;
 346                 ci->ci_func[byteswap](data, size,
 347                     spa->spa_cksum_tmpls[checksum], &actual_cksum);
 348                 eck->zec_cksum = expected_cksum;
 349
 350                 if (byteswap) {
 351                         byteswap_uint64_array(&expected_cksum,
 352                             sizeof (zio_cksum_t));
 353                 }
 354         } else {
 355                 byteswap = BP_SHOULD_BYTESWAP(bp);
 356                 expected_cksum = bp->blk_cksum;
 357                 ci->ci_func[byteswap](data, size,
 358                     spa->spa_cksum_tmpls[checksum], &actual_cksum);
 359         }
 360
 361         if (info != NULL) {
 362                 info->zbc_expected = expected_cksum;
 363                 info->zbc_actual = actual_cksum;
 364                 info->zbc_checksum_name = ci->ci_name;
 365                 info->zbc_byteswapped = byteswap;
 366                 info->zbc_injected = 0;
 367                 info->zbc_has_cksum = 1;
 368         }
 369
 370         if (!ZIO_CHECKSUM_EQUAL(actual_cksum, expected_cksum))
 371                 return (SET_ERROR(ECKSUM));
 372
 373         return (0);
 374 }
 375
 376 int
 377 zio_checksum_error(zio_t *zio, zio_bad_cksum_t *info)
 378 {
 379         blkptr_t *bp = zio->io_bp;
 380         uint_t checksum = (bp == NULL ? zio->io_prop.zp_checksum :
 381             (BP_IS_GANG(bp) ? ZIO_CHECKSUM_GANG_HEADER : BP_GET_CHECKSUM(bp)));
 382         int error;
 383         uint64_t size = (bp == NULL ? zio->io_size :
 384             (BP_IS_GANG(bp) ? SPA_GANGBLOCKSIZE : BP_GET_PSIZE(bp)));
 385         uint64_t offset = zio->io_offset;
 386         void *data = zio->io_data;
 387         spa_t *spa = zio->io_spa;
 388
 389         error = zio_checksum_error_impl(spa, bp, checksum, data, size,
 390             offset, info);
 391         if (error != 0 && zio_injection_enabled && !zio->io_error &&
 392             (error = zio_handle_fault_injection(zio, ECKSUM)) != 0) {
 393
 394                 info->zbc_injected = 1;
 395                 return (error);
 396         }
 397         return (error);
 398 }
 399
 400 /*
 401  * Called by a spa_t that's about to be deallocated. This steps through
 402  * all of the checksum context templates and deallocates any that were
 403  * initialized using the algorithm-specific template init function.
 404  */
 405 void
 406 zio_checksum_templates_free(spa_t *spa)
 407 {
 408         enum zio_checksum checksum;
 409         for (checksum = 0; checksum < ZIO_CHECKSUM_FUNCTIONS;
 410             checksum++) {
 411                 if (spa->spa_cksum_tmpls[checksum] != NULL) {
 412                         zio_checksum_info_t *ci = &zio_checksum_table[checksum];
 413
 414                         VERIFY(ci->ci_tmpl_free != NULL);
 415                         ci->ci_tmpl_free(spa->spa_cksum_tmpls[checksum]);
 416                         spa->spa_cksum_tmpls[checksum] = NULL;
 417                 }
 418         }
 419 }