4

I recently had a lot of data destroyed from a ZFS bug when I updated my computer (may have been related to https://www.reddit.com/r/zfs/comments/ql0bro/ubuntu_2110_zfs_corruption_bug/ or some other bug).

I only use ZFS for the data integrity and the hard drive redundancy. Is it possible to replace ZFS with dm-raid (probably raid 6) on top of dm-integrity devices? I don't use encryption, compression, snapshots, or anything else from ZFS, it's literally just being used for the data corruption protection, and it doesn't seem like it's stable enough to actually use because they keep trying to add new features every version. It's also annoying to have to put it back into the kernel and rebuild it when I do a kernel update, so having something that comes with the kernel would be great.

My computer has ECC memory and 4 of the non-SSD hard drives in it.

temp
  • 141
  • 2
  • I'm not sure if this was supposed to go in the super user site or this one. – temp Nov 04 '21 at 20:07
  • it may be possible, but if a filesystem or application has a bug and decides to write corrupt data, it will still pass all integrity checks. mdadm also has a few modes that might introduce corruption without triggering integrity checks (with integrity under mdadm layer). in the end it is a very difficult problem. so far I only did one install with Ubuntu on dm-integrity just to see that it could be done without too much hassle, but it didn't seem practical to actually use this way. – frostschutz Nov 04 '21 at 20:45
  • @frostschutz I'm not really worried about stuff like ransomware or programs writing the wrong stuff, but more that if I write some data to my computer I want to make sure it's the same data when I try to read it later. – temp Nov 04 '21 at 21:01

1 Answers1

2

In theory you can just place a DM integrity device under every leg of the MD RAID array an it will just work, no extra configuration is needed, MD will use the checksum errors from the integrity layer and heal itself when/if needed. The problem with this is boot and activation of the integrity devices. Support for /etc/integritytab to activate integrity devices during boot (similar to crypttab for LUKS encrypted devices) and booting from integrity devices was added only very recently to systemd and is not released yet so you'd need to activate all the integrity devices manually using integritysetup and start the array after boot.

I'd recommend using LVM which also supports integrity in the LVM RAID layer (it uses dm-integrity and dm-raid), you can simply create a RAID LV with

lvcreate --type raidN --raidintegrity y

and LVM will take care of everything, check lvmraid man page for more information (you'll need LVM 2.03.10 or newer). This way you will also avoid working with DM integrity and integritysetup directly which is good, because these are not exactly user friendly. Also there are no problems with booting or autoactivation with LVM RAID with integrity, LVM takes care of that.

With integrity (both if you decide to use LVM RAID or manually setup integrity+MD RAID) the "healing" works automatically, when read from one of the RAID legs fails due to checksum error, system will read the data from the other leg and repair the corrupted copy.

Vojtech Trefny
  • 16,922
  • 6
  • 24
  • 48
  • I don't know about any of that stuff. I just set it up in my initramfs boot script to set up and mount the ZFS disks, so I would probably do the same for the integrity/raid stuff too. Can I make the integrity devices scan for errors like zpool scrub does? – temp Nov 04 '21 at 20:26
  • @temp According to [this](https://gist.github.com/MawKKe/caa2bbf7edcc072129d73b61ae7815fb), you can run a command similar to `echo check > /sys/block/md127/md/sync_action`, and then use dmesg to see if there has been any memory corruption detected. I'm assuming that it's telling the actual RAID device to run a check, but not sure about that one. – user Nov 04 '21 at 20:34
  • @user When it detects corruption does it just repair it like ZFS does, or is it just a notification that I need to copy the data or something? – temp Nov 04 '21 at 21:03
  • The repair works automatically, when it gets read error from one of the RAID legs it repairs it automatically from the second one (this would be example for RAID 1). This on the background with every read from the device, if you to "force" check entire device the check above will for MD, for LVM you' d need to use `lvchange --syncaction check|repair `. – Vojtech Trefny Nov 05 '21 at 05:07