XFS Hex Offset Map/Values

[Peter McManus]

Hi,

I'm fairly new to XFS and am preparing a report (for both my own and my
team's education) on the low-level partition structure of an XFS primary
superblock. This is from a computer forensic perspective.

I'm currently trying to determine the actual hexidecimal offset structure
for all the fields within a primary superblock of an XFS partition.

For example, I know that the value for the field XFS_SB_MAGIC is 0x58465342
as this is readily available in XFS documentation, however I need to know
the hex offsets, byte lengths, and method of interpretation for all of the
following fields as defined within xfs_sb:

__uint32_t          sb_magicnum;         /* magic number == XFS_SB_MAGIC */
__uint32_t          sb_blocksize;           /* logical block size, bytes */
xfs_drfsbno_t      sb_dblocks;            /* number of data blocks */
xfs_drfsbno_t      sb_rblocks;             /* number of realtime blocks */
xfs_drtbno_t        sb_rextents;           /* number of realtime extents */
uuid_t                  sb_uuid;                 /* file system unique id */
xfs_dfsbno_t       sb_logstart;            /* starting block of log if
internal */
xfs_ino_t             sb_rootino;             /* root inode number */
xfs_ino_t             sb_rbmino;             /* bitmap inode for realtime
extents */
xfs_ino_t             sb_rsumino;           /* summary inode for rt bitmap
*/
xfs_agblock_t      sb_rextsize;           /* realtime extent size, blocks */
xfs_agblock_t       sb_agblocks;        /* size of an allocation group */
xfs_agnumber_t   sb_agcount;         /* number of allocation groups */
xfs_extlen_t         sb_rbmblocks;      /* number of rt bitmap blocks */
xfs_extlen_t        sb_logblocks;        /* number of log blocks */
__uint16_t           sb_versionnum;    /* header version == XFS_SB_VERSION
*/
__uint16_t           sb_sectsize;         /* volume sector size, bytes */
__uint16_t           sb_inodesize;       /* inode size, bytes */
__uint16_t           sb_inopblock;      /* inodes per block */
char                     sb_fname[12];     /* file system name */
__uint8_t             sb_blocklog;        /* log2 of sb_blocksize */
__uint8_t             sb_sectlog;          /* log2 of sb_sectsize */
__uint8_t             sb_inodelog;        /* log2 of sb_inodesize */
__uint8_t             sb_inopblog;        /* log2 of sb_inopblock */
__uint8_t             sb_agblklog;        /* log2 of sb_agblocks (rounded
up) */
__uint8_t             sb_rextslog;         /* log2 of sb_rextents */
__uint8_t             sb_inprogress;     /* mkfs is in progress, don't mount
*/
__uint8_t             sb_imax_pct;       /* max % of fs for inode space */

At http://kerneldox.net/dir_73a2d815072069310dd9b6b9499ac462.html I was able
to look through the code of the "alloc" files for further info however was
not able to find a full or definitive list. I understand that it may be
possible that the field values are contiguous but I still require a byte
length description for each field.

Can someone please let me know if/where I can find documentation for this
kind of very low level partition structure analysis?

Also, can you please tell me if the values are all in little or big endian?
Some file systems, particularly those of mobile phones, use both little and
big though I can't see a reason for the use of alternating values within XFS
(but then again I'm relatively novice to this).

Thank you for your time.

P. McManus
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://oss.sgi.com/pipermail/xfs/attachments/20111012/4b9c2787/attachment.htm>