1 /* SPDX-License-Identifier: GPL-2.0 */
2 #ifndef _BCACHEFS_FORMAT_H
3 #define _BCACHEFS_FORMAT_H
6 * bcachefs on disk data structures
10 * There are three main types of on disk data structures in bcachefs (this is
11 * reduced from 5 in bcache)
17 * The btree is the primary structure; most metadata exists as keys in the
18 * various btrees. There are only a small number of btrees, they're not
19 * sharded - we have one btree for extents, another for inodes, et cetera.
23 * The superblock contains the location of the journal, the list of devices in
24 * the filesystem, and in general any metadata we need in order to decide
25 * whether we can start a filesystem or prior to reading the journal/btree
28 * The superblock is extensible, and most of the contents of the superblock are
29 * in variable length, type tagged fields; see struct bch_sb_field.
31 * Backup superblocks do not reside in a fixed location; also, superblocks do
32 * not have a fixed size. To locate backup superblocks we have struct
33 * bch_sb_layout; we store a copy of this inside every superblock, and also
34 * before the first superblock.
38 * The journal primarily records btree updates in the order they occurred;
39 * journal replay consists of just iterating over all the keys in the open
40 * journal entries and re-inserting them into the btrees.
42 * The journal also contains entry types for the btree roots, and blacklisted
43 * journal sequence numbers (see journal_seq_blacklist.c).
47 * bcachefs btrees are copy on write b+ trees, where nodes are big (typically
48 * 128k-256k) and log structured. We use struct btree_node for writing the first
49 * entry in a given node (offset 0), and struct btree_node_entry for all
52 * After the header, btree node entries contain a list of keys in sorted order.
53 * Values are stored inline with the keys; since values are variable length (and
54 * keys effectively are variable length too, due to packing) we can't do random
55 * access without building up additional in memory tables in the btree node read
58 * BTREE KEYS (struct bkey):
60 * The various btrees share a common format for the key - so as to avoid
61 * switching in fastpath lookup/comparison code - but define their own
62 * structures for the key values.
64 * The size of a key/value pair is stored as a u8 in units of u64s, so the max
65 * size is just under 2k. The common part also contains a type tag for the
66 * value, and a format field indicating whether the key is packed or not (and
67 * also meant to allow adding new key fields in the future, if desired).
69 * bkeys, when stored within a btree node, may also be packed. In that case, the
70 * bkey_format in that node is used to unpack it. Packed bkeys mean that we can
71 * be generous with field sizes in the common part of the key format (64 bit
72 * inode number, 64 bit offset, 96 bit version field, etc.) for negligible cost.
75 #include <asm/types.h>
76 #include <asm/byteorder.h>
77 #include <linux/kernel.h>
78 #include <linux/uuid.h>
80 #define LE_BITMASK(_bits, name, type, field, offset, end) \
81 static const unsigned name##_OFFSET = offset; \
82 static const unsigned name##_BITS = (end - offset); \
83 static const __u##_bits name##_MAX = (1ULL << (end - offset)) - 1; \
85 static inline __u64 name(const type *k) \
87 return (__le##_bits##_to_cpu(k->field) >> offset) & \
88 ~(~0ULL << (end - offset)); \
91 static inline void SET_##name(type *k, __u64 v) \
93 __u##_bits new = __le##_bits##_to_cpu(k->field); \
95 new &= ~(~(~0ULL << (end - offset)) << offset); \
96 new |= (v & ~(~0ULL << (end - offset))) << offset; \
97 k->field = __cpu_to_le##_bits(new); \
100 #define LE16_BITMASK(n, t, f, o, e) LE_BITMASK(16, n, t, f, o, e)
101 #define LE32_BITMASK(n, t, f, o, e) LE_BITMASK(32, n, t, f, o, e)
102 #define LE64_BITMASK(n, t, f, o, e) LE_BITMASK(64, n, t, f, o, e)
107 /* One unused slot for now: */
108 __u8 bits_per_field[6];
109 __le64 field_offset[6];
112 /* Btree keys - all units are in sectors */
116 * Word order matches machine byte order - btree code treats a bpos as a
117 * single large integer, for search/comparison purposes
119 * Note that wherever a bpos is embedded in another on disk data
120 * structure, it has to be byte swabbed when reading in metadata that
121 * wasn't written in native endian order:
123 #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
127 #elif __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
129 __u64 offset; /* Points to end of extent - sectors */
132 #error edit for your odd byteorder.
134 } __attribute__((packed, aligned(4)));
136 #define KEY_INODE_MAX ((__u64)~0ULL)
137 #define KEY_OFFSET_MAX ((__u64)~0ULL)
138 #define KEY_SNAPSHOT_MAX ((__u32)~0U)
139 #define KEY_SIZE_MAX ((__u32)~0U)
141 static inline struct bpos SPOS(__u64 inode, __u64 offset, __u32 snapshot)
143 return (struct bpos) {
146 .snapshot = snapshot,
150 #define POS_MIN SPOS(0, 0, 0)
151 #define POS_MAX SPOS(KEY_INODE_MAX, KEY_OFFSET_MAX, 0)
152 #define SPOS_MAX SPOS(KEY_INODE_MAX, KEY_OFFSET_MAX, KEY_SNAPSHOT_MAX)
153 #define POS(_inode, _offset) SPOS(_inode, _offset, 0)
155 /* Empty placeholder struct, for container_of() */
161 #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
164 #elif __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
168 } __attribute__((packed, aligned(4)));
171 /* Size of combined key and value, in u64s */
174 /* Format of key (0 for format local to btree node) */
175 #if defined(__LITTLE_ENDIAN_BITFIELD)
178 #elif defined (__BIG_ENDIAN_BITFIELD)
179 __u8 needs_whiteout:1,
182 #error edit for your odd byteorder.
185 /* Type of the value */
188 #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
191 struct bversion version;
192 __u32 size; /* extent size, in sectors */
194 #elif __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
196 __u32 size; /* extent size, in sectors */
197 struct bversion version;
201 } __attribute__((packed, aligned(8)));
206 /* Size of combined key and value, in u64s */
209 /* Format of key (0 for format local to btree node) */
212 * XXX: next incompat on disk format change, switch format and
213 * needs_whiteout - bkey_packed() will be cheaper if format is the high
214 * bits of the bitfield
216 #if defined(__LITTLE_ENDIAN_BITFIELD)
219 #elif defined (__BIG_ENDIAN_BITFIELD)
220 __u8 needs_whiteout:1,
224 /* Type of the value */
229 * We copy bkeys with struct assignment in various places, and while
230 * that shouldn't be done with packed bkeys we can't disallow it in C,
231 * and it's legal to cast a bkey to a bkey_packed - so padding it out
232 * to the same size as struct bkey should hopefully be safest.
234 __u8 pad[sizeof(struct bkey) - 3];
235 } __attribute__((packed, aligned(8)));
237 #define BKEY_U64s (sizeof(struct bkey) / sizeof(__u64))
238 #define BKEY_U64s_MAX U8_MAX
239 #define BKEY_VAL_U64s_MAX (BKEY_U64s_MAX - BKEY_U64s)
241 #define KEY_PACKED_BITS_START 24
243 #define KEY_FORMAT_LOCAL_BTREE 0
244 #define KEY_FORMAT_CURRENT 1
246 enum bch_bkey_fields {
251 BKEY_FIELD_VERSION_HI,
252 BKEY_FIELD_VERSION_LO,
256 #define bkey_format_field(name, field) \
257 [BKEY_FIELD_##name] = (sizeof(((struct bkey *) NULL)->field) * 8)
259 #define BKEY_FORMAT_CURRENT \
260 ((struct bkey_format) { \
261 .key_u64s = BKEY_U64s, \
262 .nr_fields = BKEY_NR_FIELDS, \
263 .bits_per_field = { \
264 bkey_format_field(INODE, p.inode), \
265 bkey_format_field(OFFSET, p.offset), \
266 bkey_format_field(SNAPSHOT, p.snapshot), \
267 bkey_format_field(SIZE, size), \
268 bkey_format_field(VERSION_HI, version.hi), \
269 bkey_format_field(VERSION_LO, version.lo), \
273 /* bkey with inline value */
279 /* Size of combined key and value, in u64s */
289 #define KEY(_inode, _offset, _size) \
292 .format = KEY_FORMAT_CURRENT, \
293 .p = POS(_inode, _offset), \
297 static inline void bkey_init(struct bkey *k)
302 #define bkey_bytes(_k) ((_k)->u64s * sizeof(__u64))
304 #define __BKEY_PADDED(key, pad) \
305 struct { struct bkey_i key; __u64 key ## _pad[pad]; }
308 * - DELETED keys are used internally to mark keys that should be ignored but
309 * override keys in composition order. Their version number is ignored.
311 * - DISCARDED keys indicate that the data is all 0s because it has been
312 * discarded. DISCARDs may have a version; if the version is nonzero the key
313 * will be persistent, otherwise the key will be dropped whenever the btree
314 * node is rewritten (like DELETED keys).
316 * - ERROR: any read of the data returns a read error, as the data was lost due
317 * to a failing device. Like DISCARDED keys, they can be removed (overridden)
318 * by new writes or cluster-wide GC. Node repair can also overwrite them with
319 * the same or a more recent version number, but not with an older version
322 * - WHITEOUT: for hash table btrees
324 #define BCH_BKEY_TYPES() \
329 x(hash_whiteout, 4) \
334 x(inode_generation, 9) \
343 x(btree_ptr_v2, 18) \
344 x(indirect_inline_data, 19) \
350 #define x(name, nr) KEY_TYPE_##name = nr,
360 struct bch_whiteout {
373 struct bch_hash_whiteout {
380 * In extent bkeys, the value is a list of pointers (bch_extent_ptr), optionally
381 * preceded by checksum/compression information (bch_extent_crc32 or
384 * One major determining factor in the format of extents is how we handle and
385 * represent extents that have been partially overwritten and thus trimmed:
387 * If an extent is not checksummed or compressed, when the extent is trimmed we
388 * don't have to remember the extent we originally allocated and wrote: we can
389 * merely adjust ptr->offset to point to the start of the data that is currently
390 * live. The size field in struct bkey records the current (live) size of the
391 * extent, and is also used to mean "size of region on disk that we point to" in
394 * Thus an extent that is not checksummed or compressed will consist only of a
395 * list of bch_extent_ptrs, with none of the fields in
396 * bch_extent_crc32/bch_extent_crc64.
398 * When an extent is checksummed or compressed, it's not possible to read only
399 * the data that is currently live: we have to read the entire extent that was
400 * originally written, and then return only the part of the extent that is
403 * Thus, in addition to the current size of the extent in struct bkey, we need
404 * to store the size of the originally allocated space - this is the
405 * compressed_size and uncompressed_size fields in bch_extent_crc32/64. Also,
406 * when the extent is trimmed, instead of modifying the offset field of the
407 * pointer, we keep a second smaller offset field - "offset into the original
408 * extent of the currently live region".
410 * The other major determining factor is replication and data migration:
412 * Each pointer may have its own bch_extent_crc32/64. When doing a replicated
413 * write, we will initially write all the replicas in the same format, with the
414 * same checksum type and compression format - however, when copygc runs later (or
415 * tiering/cache promotion, anything that moves data), it is not in general
416 * going to rewrite all the pointers at once - one of the replicas may be in a
417 * bucket on one device that has very little fragmentation while another lives
418 * in a bucket that has become heavily fragmented, and thus is being rewritten
419 * sooner than the rest.
421 * Thus it will only move a subset of the pointers (or in the case of
422 * tiering/cache promotion perhaps add a single pointer without dropping any
423 * current pointers), and if the extent has been partially overwritten it must
424 * write only the currently live portion (or copygc would not be able to reduce
425 * fragmentation!) - which necessitates a different bch_extent_crc format for
428 * But in the interests of space efficiency, we don't want to store one
429 * bch_extent_crc for each pointer if we don't have to.
431 * Thus, a bch_extent consists of bch_extent_crc32s, bch_extent_crc64s, and
432 * bch_extent_ptrs appended arbitrarily one after the other. We determine the
433 * type of a given entry with a scheme similar to utf8 (except we're encoding a
434 * type, not a size), encoding the type in the position of the first set bit:
436 * bch_extent_crc32 - 0b1
437 * bch_extent_ptr - 0b10
438 * bch_extent_crc64 - 0b100
440 * We do it this way because bch_extent_crc32 is _very_ constrained on bits (and
441 * bch_extent_crc64 is the least constrained).
443 * Then, each bch_extent_crc32/64 applies to the pointers that follow after it,
444 * until the next bch_extent_crc32/64.
446 * If there are no bch_extent_crcs preceding a bch_extent_ptr, then that pointer
447 * is neither checksummed nor compressed.
450 /* 128 bits, sufficient for cryptographic MACs: */
454 } __attribute__((packed, aligned(8)));
456 #define BCH_EXTENT_ENTRY_TYPES() \
462 #define BCH_EXTENT_ENTRY_MAX 5
464 enum bch_extent_entry_type {
465 #define x(f, n) BCH_EXTENT_ENTRY_##f = n,
466 BCH_EXTENT_ENTRY_TYPES()
470 /* Compressed/uncompressed size are stored biased by 1: */
471 struct bch_extent_crc32 {
472 #if defined(__LITTLE_ENDIAN_BITFIELD)
475 _uncompressed_size:7,
481 #elif defined (__BIG_ENDIAN_BITFIELD)
483 __u32 compression_type:4,
487 _uncompressed_size:7,
491 } __attribute__((packed, aligned(8)));
493 #define CRC32_SIZE_MAX (1U << 7)
494 #define CRC32_NONCE_MAX 0
496 struct bch_extent_crc64 {
497 #if defined(__LITTLE_ENDIAN_BITFIELD)
500 _uncompressed_size:9,
506 #elif defined (__BIG_ENDIAN_BITFIELD)
512 _uncompressed_size:9,
517 } __attribute__((packed, aligned(8)));
519 #define CRC64_SIZE_MAX (1U << 9)
520 #define CRC64_NONCE_MAX ((1U << 10) - 1)
522 struct bch_extent_crc128 {
523 #if defined(__LITTLE_ENDIAN_BITFIELD)
526 _uncompressed_size:13,
531 #elif defined (__BIG_ENDIAN_BITFIELD)
532 __u64 compression_type:4,
536 _uncompressed_size:13,
540 struct bch_csum csum;
541 } __attribute__((packed, aligned(8)));
543 #define CRC128_SIZE_MAX (1U << 13)
544 #define CRC128_NONCE_MAX ((1U << 13) - 1)
547 * @reservation - pointer hasn't been written to, just reserved
549 struct bch_extent_ptr {
550 #if defined(__LITTLE_ENDIAN_BITFIELD)
555 offset:44, /* 8 petabytes */
558 #elif defined (__BIG_ENDIAN_BITFIELD)
567 } __attribute__((packed, aligned(8)));
569 struct bch_extent_stripe_ptr {
570 #if defined(__LITTLE_ENDIAN_BITFIELD)
575 #elif defined (__BIG_ENDIAN_BITFIELD)
583 struct bch_extent_reservation {
584 #if defined(__LITTLE_ENDIAN_BITFIELD)
589 #elif defined (__BIG_ENDIAN_BITFIELD)
597 union bch_extent_entry {
598 #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ || __BITS_PER_LONG == 64
600 #elif __BITS_PER_LONG == 32
606 #error edit for your odd byteorder.
609 #define x(f, n) struct bch_extent_##f f;
610 BCH_EXTENT_ENTRY_TYPES()
614 struct bch_btree_ptr {
617 struct bch_extent_ptr start[0];
619 } __attribute__((packed, aligned(8)));
621 struct bch_btree_ptr_v2 {
626 __le16 sectors_written;
629 struct bch_extent_ptr start[0];
631 } __attribute__((packed, aligned(8)));
633 LE16_BITMASK(BTREE_PTR_RANGE_UPDATED, struct bch_btree_ptr_v2, flags, 0, 1);
638 union bch_extent_entry start[0];
640 } __attribute__((packed, aligned(8)));
642 struct bch_reservation {
648 } __attribute__((packed, aligned(8)));
650 /* Maximum size (in u64s) a single pointer could be: */
651 #define BKEY_EXTENT_PTR_U64s_MAX\
652 ((sizeof(struct bch_extent_crc128) + \
653 sizeof(struct bch_extent_ptr)) / sizeof(u64))
655 /* Maximum possible size of an entire extent value: */
656 #define BKEY_EXTENT_VAL_U64s_MAX \
657 (1 + BKEY_EXTENT_PTR_U64s_MAX * (BCH_REPLICAS_MAX + 1))
659 /* * Maximum possible size of an entire extent, key + value: */
660 #define BKEY_EXTENT_U64s_MAX (BKEY_U64s + BKEY_EXTENT_VAL_U64s_MAX)
662 /* Btree pointers don't carry around checksums: */
663 #define BKEY_BTREE_PTR_VAL_U64s_MAX \
664 ((sizeof(struct bch_btree_ptr_v2) + \
665 sizeof(struct bch_extent_ptr) * BCH_REPLICAS_MAX) / sizeof(u64))
666 #define BKEY_BTREE_PTR_U64s_MAX \
667 (BKEY_U64s + BKEY_BTREE_PTR_VAL_U64s_MAX)
671 #define BLOCKDEV_INODE_MAX 4096
673 #define BCACHEFS_ROOT_INO 4096
682 } __attribute__((packed, aligned(8)));
684 struct bch_inode_generation {
687 __le32 bi_generation;
689 } __attribute__((packed, aligned(8)));
692 * bi_subvol and bi_parent_subvol are only set for subvolume roots:
695 #define BCH_INODE_FIELDS() \
705 x(bi_generation, 32) \
707 x(bi_data_checksum, 8) \
708 x(bi_compression, 8) \
710 x(bi_background_compression, 8) \
711 x(bi_data_replicas, 8) \
712 x(bi_promote_target, 16) \
713 x(bi_foreground_target, 16) \
714 x(bi_background_target, 16) \
715 x(bi_erasure_code, 16) \
716 x(bi_fields_set, 16) \
718 x(bi_dir_offset, 64) \
720 x(bi_parent_subvol, 32)
722 /* subset of BCH_INODE_FIELDS */
723 #define BCH_INODE_OPTS() \
724 x(data_checksum, 8) \
727 x(background_compression, 8) \
728 x(data_replicas, 8) \
729 x(promote_target, 16) \
730 x(foreground_target, 16) \
731 x(background_target, 16) \
735 #define x(name, ...) \
744 * User flags (get/settable with FS_IOC_*FLAGS, correspond to FS_*_FL
747 __BCH_INODE_SYNC = 0,
748 __BCH_INODE_IMMUTABLE = 1,
749 __BCH_INODE_APPEND = 2,
750 __BCH_INODE_NODUMP = 3,
751 __BCH_INODE_NOATIME = 4,
753 __BCH_INODE_I_SIZE_DIRTY= 5,
754 __BCH_INODE_I_SECTORS_DIRTY= 6,
755 __BCH_INODE_UNLINKED = 7,
756 __BCH_INODE_BACKPTR_UNTRUSTED = 8,
758 /* bits 20+ reserved for packed fields below: */
761 #define BCH_INODE_SYNC (1 << __BCH_INODE_SYNC)
762 #define BCH_INODE_IMMUTABLE (1 << __BCH_INODE_IMMUTABLE)
763 #define BCH_INODE_APPEND (1 << __BCH_INODE_APPEND)
764 #define BCH_INODE_NODUMP (1 << __BCH_INODE_NODUMP)
765 #define BCH_INODE_NOATIME (1 << __BCH_INODE_NOATIME)
766 #define BCH_INODE_I_SIZE_DIRTY (1 << __BCH_INODE_I_SIZE_DIRTY)
767 #define BCH_INODE_I_SECTORS_DIRTY (1 << __BCH_INODE_I_SECTORS_DIRTY)
768 #define BCH_INODE_UNLINKED (1 << __BCH_INODE_UNLINKED)
769 #define BCH_INODE_BACKPTR_UNTRUSTED (1 << __BCH_INODE_BACKPTR_UNTRUSTED)
771 LE32_BITMASK(INODE_STR_HASH, struct bch_inode, bi_flags, 20, 24);
772 LE32_BITMASK(INODE_NR_FIELDS, struct bch_inode, bi_flags, 24, 31);
773 LE32_BITMASK(INODE_NEW_VARINT, struct bch_inode, bi_flags, 31, 32);
778 * Dirents (and xattrs) have to implement string lookups; since our b-tree
779 * doesn't support arbitrary length strings for the key, we instead index by a
780 * 64 bit hash (currently truncated sha1) of the string, stored in the offset
781 * field of the key - using linear probing to resolve hash collisions. This also
782 * provides us with the readdir cookie posix requires.
784 * Linear probing requires us to use whiteouts for deletions, in the event of a
791 /* Target inode number: */
795 * Copy of mode bits 12-15 from the target inode - so userspace can get
796 * the filetype without having to do a stat()
801 } __attribute__((packed, aligned(8)));
804 #define BCH_DT_MAX 17
806 #define BCH_NAME_MAX (U8_MAX * sizeof(u64) - \
807 sizeof(struct bkey) - \
808 offsetof(struct bch_dirent, d_name))
813 #define KEY_TYPE_XATTR_INDEX_USER 0
814 #define KEY_TYPE_XATTR_INDEX_POSIX_ACL_ACCESS 1
815 #define KEY_TYPE_XATTR_INDEX_POSIX_ACL_DEFAULT 2
816 #define KEY_TYPE_XATTR_INDEX_TRUSTED 3
817 #define KEY_TYPE_XATTR_INDEX_SECURITY 4
825 } __attribute__((packed, aligned(8)));
827 /* Bucket/allocation information: */
834 } __attribute__((packed, aligned(8)));
836 #define BCH_ALLOC_FIELDS_V1() \
840 x(dirty_sectors, 16) \
841 x(cached_sectors, 16) \
844 x(stripe_redundancy, 8)
846 struct bch_alloc_v2 {
853 } __attribute__((packed, aligned(8)));
855 #define BCH_ALLOC_FIELDS_V2() \
858 x(dirty_sectors, 16) \
859 x(cached_sectors, 16) \
861 x(stripe_redundancy, 8)
864 #define x(name, _bits) BCH_ALLOC_FIELD_V1_##name,
865 BCH_ALLOC_FIELDS_V1()
879 enum quota_counters {
885 struct bch_quota_counter {
892 struct bch_quota_counter c[Q_COUNTERS];
893 } __attribute__((packed, aligned(8)));
904 __u8 csum_granularity_bits;
908 struct bch_extent_ptr ptrs[0];
909 } __attribute__((packed, aligned(8)));
913 struct bch_reflink_p {
917 * A reflink pointer might point to an indirect extent which is then
918 * later split (by copygc or rebalance). If we only pointed to part of
919 * the original indirect extent, and then one of the fragments is
920 * outside the range we point to, we'd leak a refcount: so when creating
921 * reflink pointers, we need to store pad values to remember the full
922 * range we were taking a reference on.
926 } __attribute__((packed, aligned(8)));
928 struct bch_reflink_v {
931 union bch_extent_entry start[0];
933 } __attribute__((packed, aligned(8)));
935 struct bch_indirect_inline_data {
943 struct bch_inline_data {
950 #define SUBVOL_POS_MIN POS(0, 1)
951 #define SUBVOL_POS_MAX POS(0, S32_MAX)
952 #define BCACHEFS_ROOT_SUBVOL 1
954 struct bch_subvolume {
961 LE32_BITMASK(BCH_SUBVOLUME_RO, struct bch_subvolume, flags, 0, 1)
963 * We need to know whether a subvolume is a snapshot so we can know whether we
964 * can delete it (or whether it should just be rm -rf'd)
966 LE32_BITMASK(BCH_SUBVOLUME_SNAP, struct bch_subvolume, flags, 1, 2)
970 struct bch_snapshot {
979 LE32_BITMASK(BCH_SNAPSHOT_DELETED, struct bch_snapshot, flags, 0, 1)
981 /* True if a subvolume points to this snapshot node: */
982 LE32_BITMASK(BCH_SNAPSHOT_SUBVOL, struct bch_snapshot, flags, 1, 2)
984 /* Optional/variable size superblock sections: */
986 struct bch_sb_field {
992 #define BCH_SB_FIELDS() \
1001 x(journal_seq_blacklist, 8)
1003 enum bch_sb_field_type {
1004 #define x(f, nr) BCH_SB_FIELD_##f = nr,
1010 /* BCH_SB_FIELD_journal: */
1012 struct bch_sb_field_journal {
1013 struct bch_sb_field field;
1017 /* BCH_SB_FIELD_members: */
1019 #define BCH_MIN_NR_NBUCKETS (1 << 6)
1023 __le64 nbuckets; /* device size */
1024 __le16 first_bucket; /* index of first bucket used */
1025 __le16 bucket_size; /* sectors */
1027 __le64 last_mount; /* time_t */
1032 LE64_BITMASK(BCH_MEMBER_STATE, struct bch_member, flags[0], 0, 4)
1033 /* 4-10 unused, was TIER, HAS_(META)DATA */
1034 LE64_BITMASK(BCH_MEMBER_REPLACEMENT, struct bch_member, flags[0], 10, 14)
1035 LE64_BITMASK(BCH_MEMBER_DISCARD, struct bch_member, flags[0], 14, 15)
1036 LE64_BITMASK(BCH_MEMBER_DATA_ALLOWED, struct bch_member, flags[0], 15, 20)
1037 LE64_BITMASK(BCH_MEMBER_GROUP, struct bch_member, flags[0], 20, 28)
1038 LE64_BITMASK(BCH_MEMBER_DURABILITY, struct bch_member, flags[0], 28, 30)
1041 LE64_BITMASK(BCH_MEMBER_NR_READ_ERRORS, struct bch_member, flags[1], 0, 20);
1042 LE64_BITMASK(BCH_MEMBER_NR_WRITE_ERRORS,struct bch_member, flags[1], 20, 40);
1045 #define BCH_MEMBER_STATES() \
1051 enum bch_member_state {
1052 #define x(t, n) BCH_MEMBER_STATE_##t = n,
1058 #define BCH_CACHE_REPLACEMENT_POLICIES() \
1063 enum bch_cache_replacement_policies {
1064 #define x(t, n) BCH_CACHE_REPLACEMENT_##t = n,
1065 BCH_CACHE_REPLACEMENT_POLICIES()
1067 BCH_CACHE_REPLACEMENT_NR
1070 struct bch_sb_field_members {
1071 struct bch_sb_field field;
1072 struct bch_member members[0];
1075 /* BCH_SB_FIELD_crypt: */
1085 #define BCH_KEY_MAGIC \
1086 (((u64) 'b' << 0)|((u64) 'c' << 8)| \
1087 ((u64) 'h' << 16)|((u64) '*' << 24)| \
1088 ((u64) '*' << 32)|((u64) 'k' << 40)| \
1089 ((u64) 'e' << 48)|((u64) 'y' << 56))
1091 struct bch_encrypted_key {
1097 * If this field is present in the superblock, it stores an encryption key which
1098 * is used encrypt all other data/metadata. The key will normally be encrypted
1099 * with the key userspace provides, but if encryption has been turned off we'll
1100 * just store the master key unencrypted in the superblock so we can access the
1101 * previously encrypted data.
1103 struct bch_sb_field_crypt {
1104 struct bch_sb_field field;
1108 struct bch_encrypted_key key;
1111 LE64_BITMASK(BCH_CRYPT_KDF_TYPE, struct bch_sb_field_crypt, flags, 0, 4);
1113 enum bch_kdf_types {
1118 /* stored as base 2 log of scrypt params: */
1119 LE64_BITMASK(BCH_KDF_SCRYPT_N, struct bch_sb_field_crypt, kdf_flags, 0, 16);
1120 LE64_BITMASK(BCH_KDF_SCRYPT_R, struct bch_sb_field_crypt, kdf_flags, 16, 32);
1121 LE64_BITMASK(BCH_KDF_SCRYPT_P, struct bch_sb_field_crypt, kdf_flags, 32, 48);
1123 /* BCH_SB_FIELD_replicas: */
1125 #define BCH_DATA_TYPES() \
1134 enum bch_data_type {
1135 #define x(t, n) BCH_DATA_##t,
1141 struct bch_replicas_entry_v0 {
1145 } __attribute__((packed));
1147 struct bch_sb_field_replicas_v0 {
1148 struct bch_sb_field field;
1149 struct bch_replicas_entry_v0 entries[0];
1150 } __attribute__((packed, aligned(8)));
1152 struct bch_replicas_entry {
1157 } __attribute__((packed));
1159 #define replicas_entry_bytes(_i) \
1160 (offsetof(typeof(*(_i)), devs) + (_i)->nr_devs)
1162 struct bch_sb_field_replicas {
1163 struct bch_sb_field field;
1164 struct bch_replicas_entry entries[0];
1165 } __attribute__((packed, aligned(8)));
1167 /* BCH_SB_FIELD_quota: */
1169 struct bch_sb_quota_counter {
1174 struct bch_sb_quota_type {
1176 struct bch_sb_quota_counter c[Q_COUNTERS];
1179 struct bch_sb_field_quota {
1180 struct bch_sb_field field;
1181 struct bch_sb_quota_type q[QTYP_NR];
1182 } __attribute__((packed, aligned(8)));
1184 /* BCH_SB_FIELD_disk_groups: */
1186 #define BCH_SB_LABEL_SIZE 32
1188 struct bch_disk_group {
1189 __u8 label[BCH_SB_LABEL_SIZE];
1191 } __attribute__((packed, aligned(8)));
1193 LE64_BITMASK(BCH_GROUP_DELETED, struct bch_disk_group, flags[0], 0, 1)
1194 LE64_BITMASK(BCH_GROUP_DATA_ALLOWED, struct bch_disk_group, flags[0], 1, 6)
1195 LE64_BITMASK(BCH_GROUP_PARENT, struct bch_disk_group, flags[0], 6, 24)
1197 struct bch_sb_field_disk_groups {
1198 struct bch_sb_field field;
1199 struct bch_disk_group entries[0];
1200 } __attribute__((packed, aligned(8)));
1203 * On clean shutdown, store btree roots and current journal sequence number in
1210 __u8 type; /* designates what this jset holds */
1214 struct bkey_i start[0];
1219 struct bch_sb_field_clean {
1220 struct bch_sb_field field;
1223 __le16 _read_clock; /* no longer used */
1224 __le16 _write_clock;
1228 struct jset_entry start[0];
1233 struct journal_seq_blacklist_entry {
1238 struct bch_sb_field_journal_seq_blacklist {
1239 struct bch_sb_field field;
1242 struct journal_seq_blacklist_entry start[0];
1250 * New versioning scheme:
1251 * One common version number for all on disk data structures - superblock, btree
1252 * nodes, journal entries
1254 #define BCH_JSET_VERSION_OLD 2
1255 #define BCH_BSET_VERSION_OLD 3
1257 enum bcachefs_metadata_version {
1258 bcachefs_metadata_version_min = 9,
1259 bcachefs_metadata_version_new_versioning = 10,
1260 bcachefs_metadata_version_bkey_renumber = 10,
1261 bcachefs_metadata_version_inode_btree_change = 11,
1262 bcachefs_metadata_version_snapshot = 12,
1263 bcachefs_metadata_version_inode_backpointers = 13,
1264 bcachefs_metadata_version_btree_ptr_sectors_written = 14,
1265 bcachefs_metadata_version_snapshot_2 = 15,
1266 bcachefs_metadata_version_reflink_p_fix = 16,
1267 bcachefs_metadata_version_max = 17,
1270 #define bcachefs_metadata_version_current (bcachefs_metadata_version_max - 1)
1272 #define BCH_SB_SECTOR 8
1273 #define BCH_SB_MEMBERS_MAX 64 /* XXX kill */
1275 struct bch_sb_layout {
1276 uuid_le magic; /* bcachefs superblock UUID */
1278 __u8 sb_max_size_bits; /* base 2 of 512 byte sectors */
1279 __u8 nr_superblocks;
1281 __le64 sb_offset[61];
1282 } __attribute__((packed, aligned(8)));
1284 #define BCH_SB_LAYOUT_SECTOR 7
1287 * @offset - sector where this sb was written
1288 * @version - on disk format version
1289 * @version_min - Oldest metadata version this filesystem contains; so we can
1290 * safely drop compatibility code and refuse to mount filesystems
1292 * @magic - identifies as a bcachefs superblock (BCACHE_MAGIC)
1293 * @seq - incremented each time superblock is written
1294 * @uuid - used for generating various magic numbers and identifying
1295 * member devices, never changes
1296 * @user_uuid - user visible UUID, may be changed
1297 * @label - filesystem label
1298 * @seq - identifies most recent superblock, incremented each time
1299 * superblock is written
1300 * @features - enabled incompatible features
1303 struct bch_csum csum;
1310 __u8 label[BCH_SB_LABEL_SIZE];
1319 __le64 time_base_lo;
1320 __le32 time_base_hi;
1321 __le32 time_precision;
1327 struct bch_sb_layout layout;
1330 struct bch_sb_field start[0];
1333 } __attribute__((packed, aligned(8)));
1337 * BCH_SB_INITALIZED - set on first mount
1338 * BCH_SB_CLEAN - did we shut down cleanly? Just a hint, doesn't affect
1339 * behaviour of mount/recovery path:
1340 * BCH_SB_INODE_32BIT - limit inode numbers to 32 bits
1341 * BCH_SB_128_BIT_MACS - 128 bit macs instead of 80
1342 * BCH_SB_ENCRYPTION_TYPE - if nonzero encryption is enabled; overrides
1343 * DATA/META_CSUM_TYPE. Also indicates encryption
1344 * algorithm in use, if/when we get more than one
1347 LE16_BITMASK(BCH_SB_BLOCK_SIZE, struct bch_sb, block_size, 0, 16);
1349 LE64_BITMASK(BCH_SB_INITIALIZED, struct bch_sb, flags[0], 0, 1);
1350 LE64_BITMASK(BCH_SB_CLEAN, struct bch_sb, flags[0], 1, 2);
1351 LE64_BITMASK(BCH_SB_CSUM_TYPE, struct bch_sb, flags[0], 2, 8);
1352 LE64_BITMASK(BCH_SB_ERROR_ACTION, struct bch_sb, flags[0], 8, 12);
1354 LE64_BITMASK(BCH_SB_BTREE_NODE_SIZE, struct bch_sb, flags[0], 12, 28);
1356 LE64_BITMASK(BCH_SB_GC_RESERVE, struct bch_sb, flags[0], 28, 33);
1357 LE64_BITMASK(BCH_SB_ROOT_RESERVE, struct bch_sb, flags[0], 33, 40);
1359 LE64_BITMASK(BCH_SB_META_CSUM_TYPE, struct bch_sb, flags[0], 40, 44);
1360 LE64_BITMASK(BCH_SB_DATA_CSUM_TYPE, struct bch_sb, flags[0], 44, 48);
1362 LE64_BITMASK(BCH_SB_META_REPLICAS_WANT, struct bch_sb, flags[0], 48, 52);
1363 LE64_BITMASK(BCH_SB_DATA_REPLICAS_WANT, struct bch_sb, flags[0], 52, 56);
1365 LE64_BITMASK(BCH_SB_POSIX_ACL, struct bch_sb, flags[0], 56, 57);
1366 LE64_BITMASK(BCH_SB_USRQUOTA, struct bch_sb, flags[0], 57, 58);
1367 LE64_BITMASK(BCH_SB_GRPQUOTA, struct bch_sb, flags[0], 58, 59);
1368 LE64_BITMASK(BCH_SB_PRJQUOTA, struct bch_sb, flags[0], 59, 60);
1370 LE64_BITMASK(BCH_SB_HAS_ERRORS, struct bch_sb, flags[0], 60, 61);
1371 LE64_BITMASK(BCH_SB_HAS_TOPOLOGY_ERRORS,struct bch_sb, flags[0], 61, 62);
1373 LE64_BITMASK(BCH_SB_BIG_ENDIAN, struct bch_sb, flags[0], 62, 63);
1375 LE64_BITMASK(BCH_SB_STR_HASH_TYPE, struct bch_sb, flags[1], 0, 4);
1376 LE64_BITMASK(BCH_SB_COMPRESSION_TYPE, struct bch_sb, flags[1], 4, 8);
1377 LE64_BITMASK(BCH_SB_INODE_32BIT, struct bch_sb, flags[1], 8, 9);
1379 LE64_BITMASK(BCH_SB_128_BIT_MACS, struct bch_sb, flags[1], 9, 10);
1380 LE64_BITMASK(BCH_SB_ENCRYPTION_TYPE, struct bch_sb, flags[1], 10, 14);
1383 * Max size of an extent that may require bouncing to read or write
1384 * (checksummed, compressed): 64k
1386 LE64_BITMASK(BCH_SB_ENCODED_EXTENT_MAX_BITS,
1387 struct bch_sb, flags[1], 14, 20);
1389 LE64_BITMASK(BCH_SB_META_REPLICAS_REQ, struct bch_sb, flags[1], 20, 24);
1390 LE64_BITMASK(BCH_SB_DATA_REPLICAS_REQ, struct bch_sb, flags[1], 24, 28);
1392 LE64_BITMASK(BCH_SB_PROMOTE_TARGET, struct bch_sb, flags[1], 28, 40);
1393 LE64_BITMASK(BCH_SB_FOREGROUND_TARGET, struct bch_sb, flags[1], 40, 52);
1394 LE64_BITMASK(BCH_SB_BACKGROUND_TARGET, struct bch_sb, flags[1], 52, 64);
1396 LE64_BITMASK(BCH_SB_BACKGROUND_COMPRESSION_TYPE,
1397 struct bch_sb, flags[2], 0, 4);
1398 LE64_BITMASK(BCH_SB_GC_RESERVE_BYTES, struct bch_sb, flags[2], 4, 64);
1400 LE64_BITMASK(BCH_SB_ERASURE_CODE, struct bch_sb, flags[3], 0, 16);
1401 LE64_BITMASK(BCH_SB_METADATA_TARGET, struct bch_sb, flags[3], 16, 28);
1402 LE64_BITMASK(BCH_SB_SHARD_INUMS, struct bch_sb, flags[3], 28, 29);
1403 LE64_BITMASK(BCH_SB_INODES_USE_KEY_CACHE,struct bch_sb, flags[3], 29, 30);
1408 * journal_seq_blacklist_v3: gates BCH_SB_FIELD_journal_seq_blacklist
1409 * reflink: gates KEY_TYPE_reflink
1410 * inline_data: gates KEY_TYPE_inline_data
1411 * new_siphash: gates BCH_STR_HASH_SIPHASH
1412 * new_extent_overwrite: gates BTREE_NODE_NEW_EXTENT_OVERWRITE
1414 #define BCH_SB_FEATURES() \
1418 x(atomic_nlink, 3) \
1420 x(journal_seq_blacklist_v3, 5) \
1424 x(new_extent_overwrite, 9) \
1425 x(incompressible, 10) \
1426 x(btree_ptr_v2, 11) \
1427 x(extents_above_btree_updates, 12) \
1428 x(btree_updates_journalled, 13) \
1429 x(reflink_inline_data, 14) \
1431 x(journal_no_flush, 16) \
1433 x(extents_across_btree_nodes, 18)
1435 #define BCH_SB_FEATURES_ALWAYS \
1436 ((1ULL << BCH_FEATURE_new_extent_overwrite)| \
1437 (1ULL << BCH_FEATURE_extents_above_btree_updates)|\
1438 (1ULL << BCH_FEATURE_btree_updates_journalled)|\
1439 (1ULL << BCH_FEATURE_alloc_v2)|\
1440 (1ULL << BCH_FEATURE_extents_across_btree_nodes))
1442 #define BCH_SB_FEATURES_ALL \
1443 (BCH_SB_FEATURES_ALWAYS| \
1444 (1ULL << BCH_FEATURE_new_siphash)| \
1445 (1ULL << BCH_FEATURE_btree_ptr_v2)| \
1446 (1ULL << BCH_FEATURE_new_varint)| \
1447 (1ULL << BCH_FEATURE_journal_no_flush))
1449 enum bch_sb_feature {
1450 #define x(f, n) BCH_FEATURE_##f,
1456 #define BCH_SB_COMPAT() \
1458 x(alloc_metadata, 1) \
1459 x(extents_above_btree_updates_done, 2) \
1460 x(bformat_overflow_done, 3)
1462 enum bch_sb_compat {
1463 #define x(f, n) BCH_COMPAT_##f,
1471 #define BCH_REPLICAS_MAX 4U
1473 #define BCH_BKEY_PTRS_MAX 16U
1475 #define BCH_ERROR_ACTIONS() \
1480 enum bch_error_actions {
1481 #define x(t, n) BCH_ON_ERROR_##t = n,
1487 enum bch_str_hash_type {
1488 BCH_STR_HASH_CRC32C = 0,
1489 BCH_STR_HASH_CRC64 = 1,
1490 BCH_STR_HASH_SIPHASH_OLD = 2,
1491 BCH_STR_HASH_SIPHASH = 3,
1492 BCH_STR_HASH_NR = 4,
1495 #define BCH_STR_HASH_OPTS() \
1500 enum bch_str_hash_opts {
1501 #define x(t, n) BCH_STR_HASH_OPT_##t = n,
1507 enum bch_csum_type {
1509 BCH_CSUM_CRC32C_NONZERO = 1,
1510 BCH_CSUM_CRC64_NONZERO = 2,
1511 BCH_CSUM_CHACHA20_POLY1305_80 = 3,
1512 BCH_CSUM_CHACHA20_POLY1305_128 = 4,
1513 BCH_CSUM_CRC32C = 5,
1515 BCH_CSUM_XXHASH = 7,
1519 static const unsigned bch_crc_bytes[] = {
1520 [BCH_CSUM_NONE] = 0,
1521 [BCH_CSUM_CRC32C_NONZERO] = 4,
1522 [BCH_CSUM_CRC32C] = 4,
1523 [BCH_CSUM_CRC64_NONZERO] = 8,
1524 [BCH_CSUM_CRC64] = 8,
1525 [BCH_CSUM_XXHASH] = 8,
1526 [BCH_CSUM_CHACHA20_POLY1305_80] = 10,
1527 [BCH_CSUM_CHACHA20_POLY1305_128] = 16,
1530 static inline _Bool bch2_csum_type_is_encryption(enum bch_csum_type type)
1533 case BCH_CSUM_CHACHA20_POLY1305_80:
1534 case BCH_CSUM_CHACHA20_POLY1305_128:
1541 #define BCH_CSUM_OPTS() \
1547 enum bch_csum_opts {
1548 #define x(t, n) BCH_CSUM_OPT_##t = n,
1554 #define BCH_COMPRESSION_TYPES() \
1560 x(incompressible, 5)
1562 enum bch_compression_type {
1563 #define x(t, n) BCH_COMPRESSION_TYPE_##t = n,
1564 BCH_COMPRESSION_TYPES()
1566 BCH_COMPRESSION_TYPE_NR
1569 #define BCH_COMPRESSION_OPTS() \
1575 enum bch_compression_opts {
1576 #define x(t, n) BCH_COMPRESSION_OPT_##t = n,
1577 BCH_COMPRESSION_OPTS()
1579 BCH_COMPRESSION_OPT_NR
1585 * The various other data structures have their own magic numbers, which are
1586 * xored with the first part of the cache set's UUID
1589 #define BCACHE_MAGIC \
1590 UUID_LE(0xf67385c6, 0x1a4e, 0xca45, \
1591 0x82, 0x65, 0xf5, 0x7f, 0x48, 0xba, 0x6d, 0x81)
1593 #define BCACHEFS_STATFS_MAGIC 0xca451a4e
1595 #define JSET_MAGIC __cpu_to_le64(0x245235c1a3625032ULL)
1596 #define BSET_MAGIC __cpu_to_le64(0x90135c78b99e07f5ULL)
1598 static inline __le64 __bch2_sb_magic(struct bch_sb *sb)
1601 memcpy(&ret, &sb->uuid, sizeof(ret));
1605 static inline __u64 __jset_magic(struct bch_sb *sb)
1607 return __le64_to_cpu(__bch2_sb_magic(sb) ^ JSET_MAGIC);
1610 static inline __u64 __bset_magic(struct bch_sb *sb)
1612 return __le64_to_cpu(__bch2_sb_magic(sb) ^ BSET_MAGIC);
1617 #define JSET_KEYS_U64s (sizeof(struct jset_entry) / sizeof(__u64))
1619 #define BCH_JSET_ENTRY_TYPES() \
1624 x(blacklist_v2, 4) \
1631 #define x(f, nr) BCH_JSET_ENTRY_##f = nr,
1632 BCH_JSET_ENTRY_TYPES()
1638 * Journal sequence numbers can be blacklisted: bsets record the max sequence
1639 * number of all the journal entries they contain updates for, so that on
1640 * recovery we can ignore those bsets that contain index updates newer that what
1641 * made it into the journal.
1643 * This means that we can't reuse that journal_seq - we have to skip it, and
1644 * then record that we skipped it so that the next time we crash and recover we
1645 * don't think there was a missing journal entry.
1647 struct jset_entry_blacklist {
1648 struct jset_entry entry;
1652 struct jset_entry_blacklist_v2 {
1653 struct jset_entry entry;
1659 FS_USAGE_RESERVED = 0,
1660 FS_USAGE_INODES = 1,
1661 FS_USAGE_KEY_VERSION = 2,
1665 struct jset_entry_usage {
1666 struct jset_entry entry;
1668 } __attribute__((packed));
1670 struct jset_entry_data_usage {
1671 struct jset_entry entry;
1673 struct bch_replicas_entry r;
1674 } __attribute__((packed));
1676 struct jset_entry_clock {
1677 struct jset_entry entry;
1681 } __attribute__((packed));
1683 struct jset_entry_dev_usage_type {
1687 } __attribute__((packed));
1689 struct jset_entry_dev_usage {
1690 struct jset_entry entry;
1695 __le64 buckets_unavailable;
1697 struct jset_entry_dev_usage_type d[];
1698 } __attribute__((packed));
1701 * On disk format for a journal entry:
1702 * seq is monotonically increasing; every journal entry has its own unique
1705 * last_seq is the oldest journal entry that still has keys the btree hasn't
1706 * flushed to disk yet.
1708 * version is for on disk format changes.
1711 struct bch_csum csum;
1718 __le32 u64s; /* size of d[] in u64s */
1720 __u8 encrypted_start[0];
1722 __le16 _read_clock; /* no longer used */
1723 __le16 _write_clock;
1725 /* Sequence number of oldest dirty journal entry */
1730 struct jset_entry start[0];
1733 } __attribute__((packed, aligned(8)));
1735 LE32_BITMASK(JSET_CSUM_TYPE, struct jset, flags, 0, 4);
1736 LE32_BITMASK(JSET_BIG_ENDIAN, struct jset, flags, 4, 5);
1737 LE32_BITMASK(JSET_NO_FLUSH, struct jset, flags, 5, 6);
1739 #define BCH_JOURNAL_BUCKETS_MIN 8
1743 #define BCH_BTREE_IDS() \
1756 #define x(kwd, val) BTREE_ID_##kwd = val,
1762 #define BTREE_MAX_DEPTH 4U
1769 * On disk a btree node is a list/log of these; within each set the keys are
1776 * Highest journal entry this bset contains keys for.
1777 * If on recovery we don't see that journal entry, this bset is ignored:
1778 * this allows us to preserve the order of all index updates after a
1779 * crash, since the journal records a total order of all index updates
1780 * and anything that didn't make it to the journal doesn't get used.
1786 __le16 u64s; /* count of d[] in u64s */
1789 struct bkey_packed start[0];
1792 } __attribute__((packed, aligned(8)));
1794 LE32_BITMASK(BSET_CSUM_TYPE, struct bset, flags, 0, 4);
1796 LE32_BITMASK(BSET_BIG_ENDIAN, struct bset, flags, 4, 5);
1797 LE32_BITMASK(BSET_SEPARATE_WHITEOUTS,
1798 struct bset, flags, 5, 6);
1800 /* Sector offset within the btree node: */
1801 LE32_BITMASK(BSET_OFFSET, struct bset, flags, 16, 32);
1804 struct bch_csum csum;
1807 /* this flags field is encrypted, unlike bset->flags: */
1810 /* Closed interval: */
1811 struct bpos min_key;
1812 struct bpos max_key;
1813 struct bch_extent_ptr _ptr; /* not used anymore */
1814 struct bkey_format format;
1825 } __attribute__((packed, aligned(8)));
1827 LE64_BITMASK(BTREE_NODE_ID, struct btree_node, flags, 0, 4);
1828 LE64_BITMASK(BTREE_NODE_LEVEL, struct btree_node, flags, 4, 8);
1829 LE64_BITMASK(BTREE_NODE_NEW_EXTENT_OVERWRITE,
1830 struct btree_node, flags, 8, 9);
1832 LE64_BITMASK(BTREE_NODE_SEQ, struct btree_node, flags, 32, 64);
1834 struct btree_node_entry {
1835 struct bch_csum csum;
1846 } __attribute__((packed, aligned(8)));
1848 #endif /* _BCACHEFS_FORMAT_H */