[File] Rework detection of Linux swap files

[Christoph Biedl]

Hello,

Currently, file(1) identifies Linux swap files as "Linux/i386",
"Linux/ia64", or "Linux/ppc". While not completely wrong, it is
misleading for other architectures since the first is as well reported
for e.g. "amd64", "armhf", or "powerpc" (aka "ppc32").

Reason for this: The implementation actually probes the page size of the
swap file. Which happens to match the description - but it does so for
other architectures as well. For example, even ppc64 swap files with an
according page size configuration (PPC_4K_PAGES) will be reported as
"i386".

So let's fix this. And while on it, provide full information for all
page sizes, support all combinations of page size and hibernate file
type, and mark the old and long-gone format that way.

Besides the Linux kernel, the util-linux sources provided some
information for suspend file magic and page sizes - I never encountered
page sizes of 8k or 32k but it's better to be in sync.

The rules are limited to swap format v1. Given the fact this has been
around for more then twenty years, it's sane to assume there will not be
a v2 format any time soon.

Gotchas:

* While the offset of the magic is relative (at the end of the first
  page size), the other information is absolute at 0x400. The kernel
  sources mention this and suggest a change in 2.5 :-)  [1]

* Version number, page size and bad pages count are stored in the host's
  native endianess. So this patch also fixes a bug here for swap files
  created on BE machines.

Tests were done with a bunch of swap files, taken from production and
hand-crafted[2], on both big- end little-endian machines:

< swap-04k.be: Linux/i386 swap file (new style), version 16777216 (4K pages), size -16580608 pages, LABEL=swap-04k, UUID=1f9c3545-ba55-4671-9265-313852bd3ebd
> swap-04k.be: Linux swap file, 4k page size, big endian, version 1, size 1023 pages, 0 bad pages, LABEL=swap-04k, UUID=1f9c3545-ba55-4671-9265-313852bd3ebd

< swap-04k.le: Linux/i386 swap file (new style), version 1 (4K pages), size 1023 pages, LABEL=swap-04k, UUID=1411ded3-5511-48b9-aa3a-ce9ddd980ca1
> swap-04k.le: Linux swap file, 4k page size, little endian, version 1, size 1023 pages, 0 bad pages, LABEL=swap-04k, UUID=1411ded3-5511-48b9-aa3a-ce9ddd980ca1

< swap-04k-hibernate: Linux/i386 swap file (new style) with SWSUSP1 image
> swap-04k-hibernate: Linux swap file, 4k page size, little endian, version 1, size 1023 pages, 0 bad pages, no label, UUID=a182dcb0-545a-4390-a8e3-f99dd70fc3dd, with SWSUSP1 image

< swap-08k.be: data
> swap-08k.be: Linux swap file, 8k page size, big endian, version 1, size 511 pages, 0 bad pages, LABEL=swap-08k, UUID=5c1ca23d-eade-406e-b374-8e45dfedfa6b

< swap-08k.le: data
> swap-08k.le: Linux swap file, 8k page size, little endian, version 1, size 511 pages, 0 bad pages, LABEL=swap-08k, UUID=908bb488-c659-4ce6-8c40-ceaa2db60353

< swap-16k.be: Linux/ia64 swap file
> swap-16k.be: Linux swap file, 16k page size, big endian, version 1, size 255 pages, 0 bad pages, LABEL=swap-16k, UUID=e77317df-19d1-4d1f-9180-833e97ee18d5

< swap-16k.le: Linux/ia64 swap file
> swap-16k.le: Linux swap file, 16k page size, little endian, version 1, size 255 pages, 0 bad pages, LABEL=swap-16k, UUID=ef09b166-f92f-4ab0-970d-5b1e319e3d30

< swap-32k.be: data
> swap-32k.be: Linux swap file, 32k page size, big endian, version 1, size 127 pages, 0 bad pages, LABEL=swap-32k, UUID=03a96585-4d2e-4349-b7c6-2ebafc40610d

< swap-32k.le: data
> swap-32k.le: Linux swap file, 32k page size, little endian, version 1, size 127 pages, 0 bad pages, LABEL=swap-32k, UUID=f72f0246-9344-40c6-ade8-a249ceec73bf

< swap-64k.be: Linux/ppc swap file version 16777216, size 1056964608 pages, LABEL=swap-64k, UUID=187cabb6-6478-493c-9f02-e5858b38c3c6
> swap-64k.be: Linux swap file, 64k page size, big endian, version 1, size 63 pages, 0 bad pages, LABEL=swap-64k, UUID=187cabb6-6478-493c-9f02-e5858b38c3c6

< swap-64k.le: Linux/ppc swap file version 1, size 63 pages, LABEL=swap-64k, UUID=63caa820-b8f1-4e6b-abe5-a5902dc20424
> swap-64k.le: Linux swap file, 64k page size, little endian, version 1, size 63 pages, 0 bad pages, LABEL=swap-64k, UUID=63caa820-b8f1-4e6b-abe5-a5902dc20424

< swap-i386-suspend: Linux/i386 swap file (new style) with SWSUSP1 image
> swap-i386-suspend: Linux swap file, 4k page size, little endian, version 1, size 262143 pages, 0 bad pages, no label, UUID=3feffb71-ec0b-4723-9e2c-d6c872144d15, with SWSUSP1 image

< swap-ppc64: Linux/i386 swap file (new style), version 16777216 (4K pages), size -16318464 pages, LABEL=swap-ppc64, UUID=5b94af95-2c8e-451c-9bb3-a0e890184540
> swap-ppc64: Linux swap file, 4k page size, big endian, version 1, size 2047 pages, 0 bad pages, LABEL=swap-ppc64, UUID=5b94af95-2c8e-451c-9bb3-a0e890184540


Cheers,

    Christoph

[1] Kernel 2.6 was release in December 2003.
[2] "mkswap --pagesize" allows creation of swap files with page sizes differing from the system value.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Rework-detection-of-Linux-swap-files.patch
Type: text/x-diff
Size: 4019 bytes
Desc: not available
URL: <https://mailman.astron.com/pipermail/file/attachments/20191221/d4c86bcc/attachment.bin>