FSDB_UFS(1M) Maintenance Commands FSDB_UFS(1M) NNAAMMEE fsdb_ufs - ufs file system debugger SSYYNNOOPPSSIISS ffssddbb --FF ufs [_g_e_n_e_r_i_c___o_p_t_i_o_n_s] [_s_p_e_c_i_f_i_c___o_p_t_i_o_n_s] _s_p_e_c_i_a_l DDEESSCCRRIIPPTTIIOONN The ffssddbb__uuffss command is an interactive tool that can be used to patch up a damaged UUFFSS file system. It has conversions to translate block and i-numbers into their corresponding disk addresses. Also included are mnemonic offsets to access different parts of an inode. These greatly simplify the process of correcting control block entries or descending the file system tree. ffssddbb contains several error-checking routines to verify inode and block addresses. These can be disabled if necessary by invoking ffssddbb with the --oo option or by the use of the oo command. ffssddbb reads a block at a time and will therefore work with raw as well as block II//OO devices. A buffer management routine is used to retain commonly used blocks of data in order to reduce the number of read system calls. All assignment operations result in an immediate write- through of the corresponding block. Note that in order to modify any portion of the disk, ffssddbb must be invoked with the ww option. Wherever possible, aaddbb--like syntax was adopted to promote the use of ffssddbb through familiarity. OOPPTTIIOONNSS The following option is supported: --oo Specify UUFFSS file system specific options. These options can be any combination of the following separated by commas (with no intervening spaces). The options available are: ?? Display usage oo Override some error conditions pp==''ssttrriinngg'' set prompt to string ww open for write UUSSAAGGEE Numbers are considered hexadecimal by default. However, the user has control over how data is to be displayed or accepted. The bbaassee command will display or set the input/output base. Once set, all input will default to this base and all output will be shown in this base. The base can be overridden temporarily for input by preceding hexadecimal numbers with '00xx', preceding decimal numbers with '00tt', or octal numbers with '00'. Hexadecimal numbers beginning with aa--ff or AA--FF must be preceded with '00xx' to distinguish them from commands. Disk addressing by ffssddbb is at the byte level. However, ffssddbb offers many commands to convert a desired inode, directory entry, block, superblock and so forth to a byte address. Once the address has been calculated, ffssddbb will record the result in dot (..). Several global values are maintained by ffssddbb: o the current base (referred to as bbaassee), o the current address (referred to as ddoott), o the current inode (referred to as iinnooddee), o the current count (referred to as ccoouunntt), o and the current type (referred to as ttyyppee). Most commands use the preset value of ddoott in their execution. For example, >> 22::iinnooddee will first set the value of ddoott to 2, ':', will alert the start of a command, and the iinnooddee command will set iinnooddee to 2. A count is specified after a ','. Once set, ccoouunntt will remain at this value until a new command is encountered which will then reset the value back to 1 (the default). So, if >> 22000000,,440000//XX is typed, 400 hex longs are listed from 2000, and when completed, the value of ddoott will be 22000000 ++ 440000 ** ssiizzeeooff ((lloonngg)). If a RREETTUURRNN is then typed, the output routine will use the current values of ddoott, ccoouunntt, and ttyyppee and display 400 more hex longs. A '*' will cause the entire block to be displayed. End of fragment, block and file are maintained by ffssddbb. When displaying data as fragments or blocks, an error message will be displayed when the end of fragment or block is reached. When displaying data using the ddbb, iibb, ddiirreeccttoorryy, or ffiillee commands an error message is displayed if the end of file is reached. This is mainly needed to avoid passing the end of a directory or file and getting unknown and unwanted results. An example showing several commands and the use of RREETTUURRNN would be: >> 22::iinnoo;; 00::ddiirr??dd or >> 22::iinnoo;; 00::ddbb::bblloocckk??dd The two examples are synonymous for getting to the first directory entry of the root of the file system. Once there, any subsequent RREETTUURRNN (or +, -) will advance to subsequent entries. Note that >> 22::iinnooddee;; ::llss or >> ::llss // is again synonymous. EExxpprreessssiioonnss The symbols recognized by ffssddbb are: RREETTUURRNN update the value of ddoott by the current value of ttyyppee and display using the current value of ccoouunntt. ## numeric expressions may be composed of +, -, *, and % operators (evaluated left to right) and may use parentheses. Once evaluated, the value of ddoott is updated. ,, _c_o_u_n_t count indicator. The global value of ccoouunntt will be updated to ccoouunntt. The value of ccoouunntt will remain until a new command is run. A count specifier of '*' will attempt to show a _b_l_o_c_k_s_'_s worth of information. The default for ccoouunntt is 1. ?? _f display in structured style with format specifier _f. See FFoorrmmaatttteedd OOuuttppuutt. // _f display in unstructured style with format specifier _f. See FFoorrmmaatttteedd OOuuttppuutt. .. the value of ddoott. ++_e increment the value of ddoott by the expression _e_. The amount actually incremented is dependent on the size of ttyyppee: ddoott == ddoott ++ ee ** ssiizzeeooff ((ttyyppee)) The default for _e is 11. --_e decrement the value of ddoott by the expression _e. See ++. **_e multiply the value of ddoott by the expression _e_. Multiplication and division don't use ttyyppee. In the above calculation of ddoott, consider the ssiizzeeooff((ttyyppee)) to be 11. %%_e divide the value of ddoott by the expression _e. See **. << _n_a_m_e restore an address saved in register _n_a_m_e. _n_a_m_e must be a single letter or digit. >> _n_a_m_e save an address in register _n_a_m_e. _n_a_m_e must be a single letter or digit. == _f display indicator. If _f is a legitimate format specifier, then the value of ddoott is displayed using the format specifier _f. See FFoorrmmaatttteedd OOuuttppuutt. Otherwise, assignment is assumed. See ==. == [[_s]] [[_e]] assignment indicator. The address pointed to by ddoott has its contents changed to the value of the expression _e or to the AASSCCIIII representation of the quoted (") string _s. This may be useful for changing directory names or AASSCCIIII file information. ==++ _e incremental assignment. The address pointed to by ddoott has its contents incremented by expression _e. ==-- _e decremental assignment. The address pointed to by ddoott has its contents decremented by expression _e. CCoommmmaannddss A command must be prefixed by a ':' character. Only enough letters of the command to uniquely distinguish it are needed. Multiple commands may be entered on one line by separating them by a SSPPAACCEE,, TTAABB or ';'. In order to view a potentially unmounted disk in a reasonable manner, ffssddbb offers the ccdd, ppwwdd, llss and ffiinndd commands. The functionality of these commands substantially matches those of its UNIX counterparts. See individual commands for details. The '*', '?', and '[-]' wild card characters are available. bbaassee==bb display or set base. As stated above, all input and output is governed by the current bbaassee. If the ==bb is omitted, the current bbaassee is displayed. Otherwise, the current bbaassee is set to _b_. Note that this is interpreted using the old value of bbaassee, so to ensure correctness use the '0', '0t', or '0x' prefix when changing the bbaassee. The default for bbaassee is hexadecimal. bblloocckk convert the value of ddoott to a block address. ccdd _d_i_r change the current directory to directory _d_i_r. The current values of iinnooddee and ddoott are also updated. If no _d_i_r is specified, then change directories to inode 22 ("/"). ccgg convert the value of ddoott to a cylinder group. ddiirreeccttoorryy If the current iinnooddee is a directory, then the value of ddoott is converted to a directory slot offset in that directory and ddoott now points to this entry. ffiillee the value of ddoott is taken as a relative block count from the beginning of the file. The value of ddoott is updated to the first byte of this block. ffiinndd _d_i_r [ --nnaammee _n] [--iinnuumm _i] find files by name or i-number. ffiinndd recursively searches directory ddiirr and below for filenames whose i-number matches _i or whose name matches pattern _n. Note that only one of the two options (-name or -inum) may be used at one time. Also, the -print is not needed or accepted. ffiillll_=_p fill an area of disk with pattern _p. The area of disk is delimited by ddoott and ccoouunntt. ffrraaggmmeenntt convert the value of _d_o_t to a fragment address. The only difference between the ffrraaggmmeenntt command and the bblloocckk command is the amount that is able to be displayed. iinnooddee convert the value of _d_o_t to an inode address. If successful, the current value of iinnooddee will be updated as well as the value of _d_o_t. As a convenient shorthand, if ':inode' appears at the beginning of the line, the value of _d_o_t is set to the current iinnooddee and that inode is displayed in inode format. lloogg__cchhkk run through the valid log entries without printing any information and verify the layout. lloogg__ddeellttaa count the number of deltas into the log, using the value of dot as an offset into the log. No checking is done to make sure that offset is within the head/tail offsets. lloogg__hheeaadd display the header information about the file system logging. This shows the block allocation for the log and the data structures on the disk. lloogg__oottooddbb return the physical disk block number, using the value of dot as an offset into the log. lloogg__sshhooww display all deltas between the beginning of the log (BOL) and the end of the log (EOL). llss [ --RR ] [ --ll ] _p_a_t_1 _p_a_t_2... list directories or files. If no file is specified, the current directory is assumed. Either or both of the options may be used (but, if used, _m_u_s_t be specified before the filename specifiers). Also, as stated above, wild card characters are available and multiple arguments may be given. The long listing shows only the i-number and the name; use the iinnooddee command with '?i' to get more information. oovveerrrriiddee toggle the value of override. Some error conditions may be overridden if override is toggled on. pprroommpptt _p change the ffssddbb prompt to _p. _p must be surrounded by (")s. ppwwdd display the current working directory. qquuiitt quit ffssddbb. ssbb the value of _d_o_t is taken as a cylinder group number and then converted to the address of the superblock in that cylinder group. As a shorthand, ':sb' at the beginning of a line will set the value of _d_o_t to _t_h_e superblock and display it in superblock format. sshhaaddooww if the current inode is a shadow inode, then the value of _d_o_t is set to the beginning of the shadow inode data. !! escape to shell IInnooddee CCoommmmaannddss In addition to the above commands, there are several commands that deal with inode fields and operate directly on the current iinnooddee (they still require the ':'). They may be used to more easily display or change the particular fields. The value of _d_o_t is only used by the '::ddbb' and '::iibb' commands. Upon completion of the command, the value of _d_o_t is changed to point to that particular field. For example, >> ::llnn==++11 would increment the link count of the current iinnooddee and set the value of _d_o_t to the address of the link count field. aatt access time. bbss block size. cctt creation time. ddbb use the current value of _d_o_t as a direct block index, where direct blocks number from 0 - 11. In order to display the block itself, you need to 'pipe' this result into the bblloocckk or ffrraaggmmeenntt command. For example, >> 11::ddbb::bblloocckk,,2200//XX would get the contents of data block field 1 from the inode and convert it to a block address. 20 longs are then displayed in hexadecimal. See FFoorrmmaatttteedd OOuuttppuutt. ggiidd group id. iibb use the current value of _d_o_t as an indirect block index where indirect blocks number from 0 - 2. This will only get the indirect block itself (the block containing the pointers to the actual blocks). Use the ffiillee command and start at block 12 to get to the actual blocks. llnn link count. mmtt modification time. mmdd mode. mmaajj major device number. mmiinn minor device number. nnmm although listed here, this command actually operates on the directory name field. Once poised at the desired directory entry (using the _d_i_r_e_c_t_o_r_y command), this command will allow you to change or display the directory name. For example, >> 77::ddiirr::nnmm==""ffoooo"" will get the 77th directory entry of the current iinnooddee and change its name to foo. Note that names cannot be made larger than the field is set up for. If an attempt is made, the string is truncated to fit and a warning message to this effect is displayed. ssii shadow inode. sszz file size. uuiidd user id. FFoorrmmaatttteedd OOuuttppuutt There are two styles and many format types. The two styles are structured and unstructured. Structured output is used to display inodes, directories, superblocks and the like. Unstructured displays raw data. The following shows the different ways of displaying: ?? cc display as cylinder groups ii display as inodes dd display as directories ss display as superblocks SS display as shadow inode data // bb display as bytes cc display as characters oo OO display as octal shorts or longs dd DD display as decimal shorts or longs xx XX display as hexadecimal shorts or longs The format specifier immediately follows the '/' or '?' character. The values displayed by '/b' and all '?' formats are displayed in the current bbaassee. Also, ttyyppee is appropriately updated upon completion. EEXXAAMMPPLLEESS EExxaammppllee 11 Displaying in Decimal The following command displays 22001100 in decimal (use of ffssddbb as a calculator for complex arithmetic): > 2000+400%(20+20)=D EExxaammppllee 22 Displaying an i-number in Inode Format The following command displays i-number 338866 in an inode format. This now becomes the current iinnooddee: > 386:ino?i EExxaammppllee 33 Changing the Link Count The following command changes the link count for the current iinnooddee to 44: > :ln=4 EExxaammppllee 44 Incrementing the Link Count The following command increments the link count by 11: > :ln=+1 EExxaammppllee 55 Displaying the Creation Time The following command displays the creation time as a hexadecimal long: > :ct=X EExxaammppllee 66 Displaying the Modification Time The following command displays the modification time in time format: > :mt=t EExxaammppllee 77 Displaying in ASCII The following command displays in AASSCCIIII,, block zero of the file associated with the current iinnooddee: > 0:file/c EExxaammppllee 88 Displaying the First Block's Worth of Directorty Entries The following command displays the first block's worth of directory entries for the root inode of this file system. It will stop prematurely if the EEOOFF is reached: > 2:ino,*?d EExxaammppllee 99 Displaying Changes to the Current Inode The following command displays changes the current inode to that associated with the 55th directory entry (numbered from zero) of the current iinnooddee. The first logical block of the file is then displayed in AASSCCIIII: > 5:dir:inode; 0:file,*/c EExxaammppllee 1100 Displaying the Superblock The following command displays the superblock of this file system: > :sb EExxaammppllee 1111 Displaying the Cylinder Group The following command displays cylinder group information and summary for cylinder group 11: > 1:cg?c EExxaammppllee 1122 Changing the i-number The following command changes the i-number for the seventh directory slot in the root directory to 33: > 2:inode; 7:dir=3 EExxaammppllee 1133 Displaying as Directory Entries The following command displays the third block of the current iinnooddee as directory entries: > 2:db:block,*?d EExxaammppllee 1144 Changing the Name Field The following command changes the name field in the directory slot to _n_a_m_e: > 7:dir:nm="name" EExxaammppllee 1155 Getting and Filling Elements The following command gets fragment 33cc33 and fill 2200 ttyyppee elements with 00xx2200: > 3c3:fragment,20:fill=0x20 EExxaammppllee 1166 Setting the Contents of an Address The following command sets the contents of address 22005500 to 00xxffffffffffffffff. 00xxffffffffffffffff may be truncated depending on the current ttyyppee: > 2050=0xffff EExxaammppllee 1177 Placing ASCII The following command places the AASSCCIIII for the string at 11cc9922443344: > 1c92434="this is some text" EExxaammppllee 1188 Displaying Shadow Inode Data The following command displays all of the shadow inode data in the shadow inode associated with the root inode of this file system: > 2:ino:si:ino;0:shadow,*?S SSEEEE AALLSSOO ccllrrii(1M), ffsscckk__uuffss(1M), ddiirr__uuffss(4), aattttrriibbuutteess(5), uuffss(7FS) WWAARRNNIINNGGSS Since ffssddbb reads the disk raw, extreme caution is advised in determining its availability of ffssddbb on the system. Suggested permissions are 600 and owned by bin. NNOOTTEESS The old command line syntax for clearing i-nodes using the ufs-specific ''--zz ii--nnuummbbeerr'' option is still supported by the new debugger, though it is obsolete and will be removed in a future release. Use of this flag will result in correct operation, but an error message will be printed warning of the impending obsolesence of this option to the command. The equivalent functionality is available using the more flexible ccllrrii(1M) command. April 14, 2003 FSDB_UFS(1M)