hesela.devCrash-consistent filesystem repair
Crash-consistent filesystem repair preserves a recoverable repair state when a failure interrupts the checker's own metadata updates.
The repair path has its own persistence obligations. FAST 2018's rfsck-lib records repair updates in a redo log, makes them durable, then applies them to the image. Ordered safe transactions allow completed groups to be replayed after interruption. [1]
An undo file is a different promise. The e2fsprogs v1.47.3 e2fsck manual explicitly excludes recovery from power or system crashes using its -z undo file. The presence of saved old blocks therefore does not establish crash-safe repair. [2]
Recovery also requires the correct target. e2undo normally refuses a log whose saved superblock does not match the target filesystem. Its -n mode performs a dry run; -f disables the identity safeguard. Neither option adds a durability guarantee. [3]
Relations
Advantages
- A repair protocol can retain completed work across interruptions instead of restarting every check. [1]
Limitations
- The rfsck prototype was evaluated under a clean power-fault model and limited test images, not all possible corruptions. [1]
- A repair log does not by itself prove that repaired contents are the application's intended data. [1]
Citations
- Gatla et al. Towards Robust File System Checkers. FAST 2018, pp. 105-122; sections 3-7.
- e2fsprogs v1.47.3: e2fsck(8), mounted filesystems and -z undo_file.
- e2fsprogs v1.47.3: e2undo(8), matching the log to the filesystem and dry-run mode.
Sources & caveats
- Source synthesis; no new device measurement or reproduction of the checker experiments.
- FAST 2018 sections 3.2, 5.3 and 7; version-pinned upstream e2fsprogs manuals.