fsdb(1M) fsdb(1M)NAME fsdb - debug the file system SYNOPSIS /etc/fsdb [-T4.2] [-?] [-o] [-pstring] [-w] special /etc/fsdb [-T5.2] special [-] DESCRIPTION fsdb can be used to patch up a damaged file system after a crash. It has conversions to translate block and inumbers into their corresponding disk addresses. Also included are mnemonic offsets to access different parts of an inode. These greatly simplify the process of correcting control- block entries or descending the file-system tree. Since fsdb reads the disk raw, it is able to circumvent nor- mal file-system security. Extreme caution is advised in determining its availability on the system. Suggested per- missions are 600 and owned by bin. fsdb has different formats depending on the type of file system you are debugging. fsdb can be used for either a Berkeley 4.2 file system (UFS) or a System V file system (SVFS). fsdb contains several error-checking routines to verify inode and block addresses. These routines can be disabled, if necessary, by invoking fsdb with the -o option for a UFS file system or by using the - option for a SVFS file system. The o command works for both file systems. fsdb reads a block at a time and therefore works with raw as well as block I/O. A buffer management routine is used to retain commonly used blocks of data in order to reduce the number of read system calls. All assignment operations result in an immediate write-through of the corresponding block. Note that in order to modify any portion of the disk for a UFS file system, fsdb must be invoked with the -w op- tion. Wherever possible, syntax similar to adb syntax was adopted to promote the use of fsdb through familiarity. fsdb considers numbers in UFS as hexadecimal by default and considers numbers in SVFS as decimal by default. However, the user has control over how data is to be displayed or ac- cepted. The base command displays or sets the input/output base. Once set, all input defaults to this base, and all output is shown in this base. The base can be overriden temporarily for input by preceding hexadecimal numbers with 0x, preceding decimal numbers with 0t, or preceding octal April, 1990 1
fsdb(1M) fsdb(1M)numbers with 0. Hexadecimal numbers beginning with a-f or A-F must be preceded with 0x to distinguish them from com- mands. Disk addressing by fsdb is at the byte level. However, fsdb offers many commands to convert a desired inode, directory entry, block, superblock, and so on, to a byte address. Once the address is calculated, fsdb records the result in the current address, or dot. Several global values are maintained by fsdb: the current base (referred to as base), the current address (referred to as dot), the current inode (referred to as inode), the current count (referred to as count), and the current type (referred to as type). Most commands use the preset value of dot in their execution. For example, > 2:inode first sets the value of dot to 2, The : (colon) alerts the start of a command, and the inode command sets inode to 2. A count is specified after a , (comma). Once set, count remains at this value until a new command is encountered, which then resets the value back to 1 (the default). So, if > 2000,400/X is typed, 400 hex longs are listed from 2000, and when com- pleted, the value of dot is 2000 + 400 * sizeof (long). If a RETURN is then typed, the output routine uses the current values of dot, count, and type and displays 400 more hex longs. A * causes the entire block to be displayed. End of fragment, block, and file are maintained by fsdb. When displaying data as fragments or blocks, an error mes- sage is displayed when the end of fragment or block is reached. When displaying data using the db, ib, directory, or file commands, an error message is displayed if the end- of-file is reached. This is mainly needed to avoid passing the end of a directory or file and getting unknown and unwanted results. Two examples showing several commands and the use of RETURN are: > 2:ino; 0:dir?d > 2:ino; 0:db:block?d These two examples are synonymous for getting to the first directory entry of the root of the file system. Once there, subsequent use of RETURN (or +, -) will advance to subse- quent entries. Note that these two examples > 2:inode; :ls > :ls / are also synonymous. 2 April, 1990
fsdb(1M) fsdb(1M)FLAG OPTIONS The flag options available to fsdb for a UFS file system are: -? Display usage. -o Override some error-conditions. -pstring Set prompt to string. -w Open for write. The flag option available for a SVFS file system is: - Disable error checking routines to verify inode and block addresses. EXPRESSIONS UFS The symbols recognized by fsdb for a UFS file system are: RETURN Update the value of dot by the current value of type and display using the current value of count. # Indicate numeric expressions that may be composed of +, -, *, and % operators (evaluated left to right) and may use parentheses. Once evaluated, the value of dot is updated. , count Indicate count. The global value of count is updated to count. The value of count remains until a new command is run. A count specifier of * attempts to show a block of information. The default for count is 1. ? f Display in structured style with format specifier f (see the section ``Formatted Output''). / f Display in unstructured style with format specifier f (see the section ``Formatted Output''). . Indicate the value of dot. +e Increment the value of dot by the expression e. The amount actually incremented is dependent on the size of type: dot = dot + e * sizeof (type) The default for e is 1. -e Decrement the value of dot by the expression e (see +). *e Multiply the value of dot by the expression e. Mul- tiplication and division don't use type. In the above calculation of dot, consider the sizeof (type) to be 1. %e Divide the value of dot by the expression e (see *). < name Restore an address saved in register name, which must be a single letter or digit. > name Save an address in register name, which must be a single letter or digit. = f Display indicator. If f is a legitimate format specifier (see the section ``Formatted Output''), then the value of dot is displayed using format specifier f. Otherwise, assignment is assumed (see the next item). April, 1990 3
fsdb(1M) fsdb(1M)= [s] [e] Indicate assignment. The address pointed to by dot has its contents changed to the value of the expres- sion e or to the ASCII representation of the quoted (") string s. This may be useful for changing direc- tory names or ASCII file information. =+ e Increment assignment. The address pointed to by dot has its contents incremented by expression e. =- e Decrement assignment. The address pointed to by dot has its contents decremented by expression e. SVFS The symbols recognized by fsdb for a SVFS file system are # Indicate an absolute address. i Convert from an inumber to an inode ad- dress. b Convert to a block address. d Indicate directory slot offset. +,- Address arithmetic. q Quit. >,< Save and restore an address. = Indicate numerical assignment. =+ Increment assignment. =- Decrement assignment. =" " " " " " Indicate character-string assignment. O Indicate error-checking flip-flop. p Indicate general print facilities. f Indicate file print facility. B Indicate byte mode. W Indicate word mode. D Indicate double-word mode. ! Escape to the shell. The print facilities generate a formatted output in various styles. The current address is normalized to an appropriate boundary before printing begins. It advances with the printing and is left at the address of the last item print- ed. The output can be terminated at any time by typing the interrupt character. If a number follows the p symbol, that many entries are printed. A check is made to detect block boundary overflows because logically sequential blocks are generally not physically sequential. If a count of 0 is used, all entries to the end of the current block are print- ed. The print options available are: i Print as inodes. d Print as directories. o Print as octal words. e Print as decimal words. c Print as characters. b Print as octal bytes. 4 April, 1990
fsdb(1M) fsdb(1M)The f symbol is used to print data blocks associated with the current inode. If followed by a number, that block of the file is printed. (Blocks are numbered from 0.) The desired print option letter follows the block number, if present, or the f symbol. This print facility works for small as well as large files. It checks for special devices and checks that the block pointers used to find the data are not 0. Dots, tabs, and spaces may be used as function delimiters but are not necessary. A line with just a newline character increments the current address by the size of the data type last printed; that is, the address is set to the next byte, word, double word, directory entry, or inode, allowing the user to step through a region of a file system. Information is printed in a format appropriate to the data type. Bytes, words, and double words are displayed with the octal address followed by the value in octal and decimal. A .B or .D is appended to the address for byte and double-word values, respectively. Directories are printed as a directory slot offset followed by the decimal inumber and the character representation of the entry name. Inodes are printed with labeled fields describing each element. UFS COMMANDS A command must be prefixed by a : (colon) character. Only enough letters of the command to uniquely distinguish it are needed. Multiple commands may be entered on one line by separating them by a space, tab, or ; (semicolon). In order to view a potentially unmounted disk in a reason- able manner, fsdb offers the cd, pwd, ls, and find commands. The functionality of these commands substantially matches that of their UNIX(Reg.) counterparts (see individual com- mands for details). The '*', '?', and '[-]' wildcard char- acters are available. base=b Display or set base. As stated above, all input and output is governed by the current base. If the =b is left off, the current base is displayed. Otherwise, the current base is set to b. Note that b is inter- preted using the old value of base, so to ensure correctness, use the 0, 0t, or 0x prefix when chang- ing base. The default for base is hexadecimal. block Convert the value of dot to a block address. cd dir Change the current directory to directory dir. The current values of inode and dot are also updated. If no dir is specified, then change directories to inode 2 ("/"). April, 1990 5
fsdb(1M) fsdb(1M)cg Convert the value of dot to a cylinder group. directory If the current inode is a directory, then convert the value of dot to a directory slot offset in that directory so that dot now points to this entry. file Take the value of dot as a relative block count from the beginning of the file. The value of dot is up- dated to the first byte of this block. find dir [-name n] [-inum i] Find files by name or inumber. find recursively searches directory dir and below for filenames whose inumber matches i or whose name matches pattern n. Note that only one of the two options (-name or - inum) may be used at one time. Also, -print is not needed or accepted. fill=p Fill an area of disk with pattern p. The area of disk is delimited by dot and count. fragment Convert the value of dot to a fragment address. The only difference between the fragment command and the block command is the amount that is able to be displayed. inode Convert the value of dot to an inode address. If successful, the current value of inode is updated as well as the value of dot. As a convenient shorthand, if :inode appears at the beginning of the line, the value of dot is set to the current inode and that inode is displayed in inode format. ls [-R] [-l] pat1 pat2 ... List directories or files. If no file is specified, the current directory is assumed. Either or both of the options may be used, but if used, must be speci- fied before the filename specifiers. Also, as stated above, wildcard characters are available, and multi- ple arguments may be given. The long listing shows only the inumber and the name. Use the inode command with '?i' to get more information. override Toggle the value of override. Some error conditions may be overridden if override is toggled on. prompt p Change the fsdb prompt to p, which must be surrounded by (" "). 6 April, 1990
fsdb(1M) fsdb(1M)pwd Display the current working directory. quit Quit fsdb. sb Take the value of dot as a cylinder group number and then convert it to the address of the superblock in that cylinder group. As a shorthand, :sb at the be- ginning of a line sets the value of dot to the super- block and displays it in superblock format. ! Escape to the shell. UFS Inode Commands In addition to the previous commands, several commands deal with inode fields and operate directly on the current inode (they still require the ':'). They may be used to display or change the particular fields more easily. The value of dot is only used by the ':db' and ':ib' commands. On com- pletion of the command, the value of dot is changed to point to that particular field. For example, > :ln=+1 increments the link count of the current inode and sets the value of dot to the address of the link-count field. at Access time. bs Block size. ct Creation time. db Use the current value of dot as a direct block index, where direct blocks number from 0-11. In order to display the block itself, you need to pipe this result into the block or fragment command. For exam- ple, > 1:db:block,20/X would get the contents of data block field 1 from the inode and convert it to a block address. Then 20 longs are displayed in hexadecimal (see the section ``Formatted Output''). gid Group ID. ib Use the current value of dot as an indirect block in- dex where indirect blocks number from 0-2. This only gets the indirect block itself (the block containing the pointers to the actual blocks). Use the file command and start at block 12 to get to the actual blocks. ln Link count. April, 1990 7
fsdb(1M) fsdb(1M)mt Modification time. md Mode. maj Major device number. min Minor device number. nm Although listed here, this command actually operates on the directory-name field. Once poised at the desired directory entry (using the directory com- mand), this command allows you to change or display the directory name. For example, > 7:dir:nm="foo" gets the seventh directory entry of the current inode and change its name to foo. Note that names cannot be made larger than the field is set up for. If an attempt is made, the string is truncated to fit and a warning message to this effect is displayed. sz File size. uid User ID. SVFS Inode Commands The following mnemonics are used for inode examination and refer to the current working inode: md Mode ln Link count uid User ID Number gid Group ID number sz File size a# Data block numbers (0-12) at Access time mt Modification time maj Major device number min Minor device number gen Generation number FORMATTED OUTPUT There are two styles and many format types. The two styles are structured and unstructured. Structured output is used to display inodes, directories, superblocks and the like. Unstructured output just displays raw data. The following table shows the different ways of displaying: ? c Display as cylinder groups. i Display as inodes. d Display as directories. s Display as superblocks. 8 April, 1990
fsdb(1M) fsdb(1M)/ b Display as bytes. c Display as characters. o O Display as octal shorts or longs. d D Display as decimal shorts or longs. x X Display as hexadecimal shorts or longs. The format specifier immediately follows the '/' or '?' character. The values displayed by '/b' and all '?' for- mats are displayed in the current base. Also, type is ap- propriately updated on completion. EXAMPLES The following two sections list examples of the fsdb com- mand. Examples in the UFS file system are listed first, followed by examples in the SVFS file system. UFS Examples (2000+400%(20+20))=D Display 2010 in decimal (use of fsdb as a calculator for complex arithmetic). 386:ino?i Display inumber 386 in an inode format. This now becomes the current inode. :ln=4 Change the link count for the current inode to 4. :ln=+1 Increment the link count by 1. :ct=X Display the creation time as a hexadecimal long. :mt=t Display the modification time in time format. 0:file/c Display, in ASCII, block 0 of the file asso- ciated with the current inode. 2:ino,*?d Display the directory entries of the first blocks for the root inode of this file sys- tem. It stops prematurely if the end-of-file is reached. 5:dir:inode; 0:file,*/c Change the current inode to that associated with the fifth directory entry (numbered from 0) of the current inode. The first logical block of the file is then displayed in ASCII. :sb Display the superblock of this file system. 1:cg?c Display the cylinder-group information and April, 1990 9
fsdb(1M) fsdb(1M)summary for cylinder group 1. 2:inode; 7:dir=3 Change the inumber for the seventh directory slot in the root directory to 3. 7:dir:nm= name"" Change the name field in the directory slot to name. 2:db:block,*?d Display the third block of the current inode as directory entries. 3c3:fragment,20:fill=0x20 Get fragment 3c3 and fills 20 type elements with 0x20. 2050=0xffff Set the contents of address 2050 to 0xffffffff. 0xffffffff may be truncated depending on the current type. 1c92434= this" is some text" " " Places the ASCII for the string at 1c92434. SVFS Examples 386i Print inumber 386 in an inode format. This now becomes the current working inode. ln=4 Change the link count for the working inode to 4. ln=+1 Increment the link count by 1. fc Print, in ASCII, block 0 of the file associ- ated with the working inode. 2i.fd Print the first 32 directory entries for the root inode of this file system. d5i.fc Change the current inode to that associated with the fifth directory entry (numbered from 0) found from the above command. The first logical block of the file is then printed in ASCII. 512B.p0o Print the superblock of this file system in octal. 2i.a0b.d7=3 Change the inumber for the seventh directory slot in the root directory to 3. This exam- ple also shows how several operations can be combined on one command line. 10 April, 1990
fsdb(1M) fsdb(1M)d7.nm= name"" Change the name field in the directory slot to the given string. Quotes are optional when used with nm if the first character is alphabetic. C2b.p0d Print the third block of the current inode as directory entries. WARNINGS Extreme caution is advised in determining the availability of fsdb on the system. Suggested permissions are 600 and owned by bin. SEE ALSO fsck(1M), dir(4), fs(4). April, 1990 11