2 * Copyright (C) 2009 Oracle. All rights reserved.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public
6 * License v2 as published by the Free Software Foundation.
8 * This program is distributed in the hope that it will be useful,
9 * but WITHOUT ANY WARRANTY; without even the implied warranty of
10 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
11 * General Public License for more details.
13 * You should have received a copy of the GNU General Public
14 * License along with this program; if not, write to the
15 * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
16 * Boston, MA 021110-1307, USA.
19 #define _XOPEN_SOURCE 500
26 #include "kerncompat.h"
30 #include "print-tree.h"
31 #include "transaction.h"
36 #define FIELD_BUF_LEN 80
38 struct extent_buffer
*debug_corrupt_block(struct btrfs_root
*root
, u64 bytenr
,
39 u32 blocksize
, int copy
)
42 struct extent_buffer
*eb
;
44 struct btrfs_multi_bio
*multi
= NULL
;
45 struct btrfs_device
*device
;
49 eb
= btrfs_find_create_tree_block(root
, bytenr
, blocksize
);
55 ret
= btrfs_map_block(&root
->fs_info
->mapping_tree
, READ
,
56 eb
->start
, &length
, &multi
,
59 device
= multi
->stripes
[0].dev
;
62 eb
->dev_bytenr
= multi
->stripes
[0].physical
;
65 "mirror %d logical %llu physical %llu device %s\n",
66 mirror_num
, (unsigned long long)bytenr
,
67 (unsigned long long)eb
->dev_bytenr
, device
->name
);
70 if (!copy
|| mirror_num
== copy
) {
71 ret
= read_extent_from_disk(eb
, 0, eb
->len
);
72 printf("corrupting %llu copy %d\n", eb
->start
,
74 memset(eb
->data
, 0, eb
->len
);
75 write_extent_to_disk(eb
);
79 num_copies
= btrfs_num_copies(&root
->fs_info
->mapping_tree
,
85 if (mirror_num
> num_copies
)
91 static void print_usage(void)
93 fprintf(stderr
, "usage: btrfs-corrupt-block [options] device\n");
94 fprintf(stderr
, "\t-l Logical extent to be corrupted\n");
95 fprintf(stderr
, "\t-c Copy of the extent to be corrupted"
96 " (usually 1 or 2, default: 0)\n");
97 fprintf(stderr
, "\t-b Number of bytes to be corrupted\n");
98 fprintf(stderr
, "\t-e Extent to be corrupted\n");
99 fprintf(stderr
, "\t-E The whole extent tree to be corrupted\n");
100 fprintf(stderr
, "\t-u Given chunk item to be corrupted\n");
101 fprintf(stderr
, "\t-U The whole chunk tree to be corrupted\n");
102 fprintf(stderr
, "\t-i The inode item to corrupt (must also specify "
103 "the field to corrupt)\n");
104 fprintf(stderr
, "\t-x The file extent item to corrupt (must also "
105 "specify -i for the inode and -f for the field to corrupt)\n");
106 fprintf(stderr
, "\t-m The metadata block to corrupt (must also "
107 "specify -f for the field to corrupt)\n");
108 fprintf(stderr
, "\t-f The field in the item to corrupt\n");
112 static void corrupt_keys(struct btrfs_trans_handle
*trans
,
113 struct btrfs_root
*root
,
114 struct extent_buffer
*eb
)
119 struct btrfs_disk_key bad_key
;;
121 nr
= btrfs_header_nritems(eb
);
126 bad_slot
= rand() % nr
;
128 if (bad_slot
== slot
)
132 "corrupting keys in block %llu slot %d swapping with %d\n",
133 (unsigned long long)eb
->start
, slot
, bad_slot
);
135 if (btrfs_header_level(eb
) == 0) {
136 btrfs_item_key(eb
, &bad_key
, bad_slot
);
137 btrfs_set_item_key(eb
, &bad_key
, slot
);
139 btrfs_node_key(eb
, &bad_key
, bad_slot
);
140 btrfs_set_node_key(eb
, &bad_key
, slot
);
142 btrfs_mark_buffer_dirty(eb
);
145 btrfs_super_csum_size(root
->fs_info
->super_copy
);
146 csum_tree_block_size(eb
, csum_size
, 0);
147 write_extent_to_disk(eb
);
152 static int corrupt_keys_in_block(struct btrfs_root
*root
, u64 bytenr
)
154 struct extent_buffer
*eb
;
156 eb
= read_tree_block(root
, bytenr
, root
->leafsize
, 0);
160 corrupt_keys(NULL
, root
, eb
);
161 free_extent_buffer(eb
);
165 static int corrupt_extent(struct btrfs_trans_handle
*trans
,
166 struct btrfs_root
*root
, u64 bytenr
, int copy
)
168 struct btrfs_key key
;
169 struct extent_buffer
*leaf
;
172 struct btrfs_path
*path
;
175 int should_del
= rand() % 3;
177 path
= btrfs_alloc_path();
181 key
.objectid
= bytenr
;
183 key
.offset
= (u64
)-1;
186 ret
= btrfs_search_slot(trans
, root
->fs_info
->extent_root
,
192 if (path
->slots
[0] == 0)
197 leaf
= path
->nodes
[0];
198 slot
= path
->slots
[0];
199 btrfs_item_key_to_cpu(leaf
, &key
, slot
);
200 if (key
.objectid
!= bytenr
)
203 if (key
.type
!= BTRFS_EXTENT_ITEM_KEY
&&
204 key
.type
!= BTRFS_TREE_BLOCK_REF_KEY
&&
205 key
.type
!= BTRFS_EXTENT_DATA_REF_KEY
&&
206 key
.type
!= BTRFS_EXTENT_REF_V0_KEY
&&
207 key
.type
!= BTRFS_SHARED_BLOCK_REF_KEY
&&
208 key
.type
!= BTRFS_SHARED_DATA_REF_KEY
)
213 "deleting extent record: key %llu %u %llu\n",
214 key
.objectid
, key
.type
, key
.offset
);
216 if (key
.type
== BTRFS_EXTENT_ITEM_KEY
) {
217 /* make sure this extent doesn't get
218 * reused for other purposes */
219 btrfs_pin_extent(root
->fs_info
,
220 key
.objectid
, key
.offset
);
223 btrfs_del_item(trans
, root
, path
);
226 "corrupting extent record: key %llu %u %llu\n",
227 key
.objectid
, key
.type
, key
.offset
);
228 ptr
= btrfs_item_ptr_offset(leaf
, slot
);
229 item_size
= btrfs_item_size_nr(leaf
, slot
);
230 memset_extent_buffer(leaf
, 0, ptr
, item_size
);
231 btrfs_mark_buffer_dirty(leaf
);
234 btrfs_release_path(path
);
242 btrfs_free_path(path
);
246 static void btrfs_corrupt_extent_leaf(struct btrfs_trans_handle
*trans
,
247 struct btrfs_root
*root
,
248 struct extent_buffer
*eb
)
250 u32 nr
= btrfs_header_nritems(eb
);
251 u32 victim
= rand() % nr
;
253 struct btrfs_key key
;
255 btrfs_item_key_to_cpu(eb
, &key
, victim
);
256 objectid
= key
.objectid
;
257 corrupt_extent(trans
, root
, objectid
, 1);
260 static void btrfs_corrupt_extent_tree(struct btrfs_trans_handle
*trans
,
261 struct btrfs_root
*root
,
262 struct extent_buffer
*eb
)
270 nr
= btrfs_header_nritems(eb
);
271 if (btrfs_is_leaf(eb
)) {
272 btrfs_corrupt_extent_leaf(trans
, root
, eb
);
276 if (btrfs_header_level(eb
) == 1 && eb
!= root
->node
) {
281 for (i
= 0; i
< nr
; i
++) {
282 struct extent_buffer
*next
;
284 next
= read_tree_block(root
, btrfs_node_blockptr(eb
, i
),
286 btrfs_node_ptr_generation(eb
, i
));
289 btrfs_corrupt_extent_tree(trans
, root
, next
);
290 free_extent_buffer(next
);
294 enum btrfs_inode_field
{
295 BTRFS_INODE_FIELD_ISIZE
,
296 BTRFS_INODE_FIELD_BAD
,
299 enum btrfs_file_extent_field
{
300 BTRFS_FILE_EXTENT_DISK_BYTENR
,
301 BTRFS_FILE_EXTENT_BAD
,
304 enum btrfs_metadata_block_field
{
305 BTRFS_METADATA_BLOCK_GENERATION
,
306 BTRFS_METADATA_BLOCK_BAD
,
309 static enum btrfs_inode_field
convert_inode_field(char *field
)
311 if (!strncmp(field
, "isize", FIELD_BUF_LEN
))
312 return BTRFS_INODE_FIELD_ISIZE
;
313 return BTRFS_INODE_FIELD_BAD
;
316 static enum btrfs_file_extent_field
convert_file_extent_field(char *field
)
318 if (!strncmp(field
, "disk_bytenr", FIELD_BUF_LEN
))
319 return BTRFS_FILE_EXTENT_DISK_BYTENR
;
320 return BTRFS_FILE_EXTENT_BAD
;
323 static enum btrfs_metadata_block_field
324 convert_metadata_block_field(char *field
)
326 if (!strncmp(field
, "generation", FIELD_BUF_LEN
))
327 return BTRFS_METADATA_BLOCK_GENERATION
;
328 return BTRFS_METADATA_BLOCK_BAD
;
331 static u64
generate_u64(u64 orig
)
336 } while (ret
== orig
);
340 static int corrupt_inode(struct btrfs_trans_handle
*trans
,
341 struct btrfs_root
*root
, u64 inode
, char *field
)
343 struct btrfs_inode_item
*ei
;
344 struct btrfs_path
*path
;
345 struct btrfs_key key
;
346 enum btrfs_inode_field corrupt_field
= convert_inode_field(field
);
351 if (corrupt_field
== BTRFS_INODE_FIELD_BAD
) {
352 fprintf(stderr
, "Invalid field %s\n", field
);
356 key
.objectid
= inode
;
357 key
.type
= BTRFS_INODE_ITEM_KEY
;
358 key
.offset
= (u64
)-1;
360 path
= btrfs_alloc_path();
364 ret
= btrfs_search_slot(trans
, root
, &key
, path
, 0, 1);
368 if (!path
->slots
[0]) {
369 fprintf(stderr
, "Couldn't find inode %Lu\n", inode
);
377 btrfs_item_key_to_cpu(path
->nodes
[0], &key
, path
->slots
[0]);
378 if (key
.objectid
!= inode
) {
379 fprintf(stderr
, "Couldn't find inode %Lu\n", inode
);
384 ei
= btrfs_item_ptr(path
->nodes
[0], path
->slots
[0],
385 struct btrfs_inode_item
);
386 switch (corrupt_field
) {
387 case BTRFS_INODE_FIELD_ISIZE
:
388 orig
= btrfs_inode_size(path
->nodes
[0], ei
);
389 bogus
= generate_u64(orig
);
390 btrfs_set_inode_size(path
->nodes
[0], ei
, bogus
);
396 btrfs_mark_buffer_dirty(path
->nodes
[0]);
398 btrfs_free_path(path
);
402 static int corrupt_file_extent(struct btrfs_trans_handle
*trans
,
403 struct btrfs_root
*root
, u64 inode
, u64 extent
,
406 struct btrfs_file_extent_item
*fi
;
407 struct btrfs_path
*path
;
408 struct btrfs_key key
;
409 enum btrfs_file_extent_field corrupt_field
;
414 corrupt_field
= convert_file_extent_field(field
);
415 if (corrupt_field
== BTRFS_FILE_EXTENT_BAD
) {
416 fprintf(stderr
, "Invalid field %s\n", field
);
420 key
.objectid
= inode
;
421 key
.type
= BTRFS_EXTENT_DATA_KEY
;
424 path
= btrfs_alloc_path();
428 ret
= btrfs_search_slot(trans
, root
, &key
, path
, 0, 1);
432 fprintf(stderr
, "Couldn't find extent %llu for inode %llu\n",
438 fi
= btrfs_item_ptr(path
->nodes
[0], path
->slots
[0],
439 struct btrfs_file_extent_item
);
440 switch (corrupt_field
) {
441 case BTRFS_FILE_EXTENT_DISK_BYTENR
:
442 orig
= btrfs_file_extent_disk_bytenr(path
->nodes
[0], fi
);
443 bogus
= generate_u64(orig
);
444 btrfs_set_file_extent_disk_bytenr(path
->nodes
[0], fi
, bogus
);
450 btrfs_mark_buffer_dirty(path
->nodes
[0]);
452 btrfs_free_path(path
);
456 static int corrupt_metadata_block(struct btrfs_root
*root
, u64 block
,
459 struct btrfs_trans_handle
*trans
;
460 struct btrfs_path
*path
;
461 struct extent_buffer
*eb
;
462 struct btrfs_key key
, root_key
;
463 enum btrfs_metadata_block_field corrupt_field
;
469 corrupt_field
= convert_metadata_block_field(field
);
470 if (corrupt_field
== BTRFS_METADATA_BLOCK_BAD
) {
471 fprintf(stderr
, "Invalid field %s\n", field
);
475 eb
= read_tree_block(root
, block
, root
->leafsize
, 0);
477 fprintf(stderr
, "Couldn't read in tree block %s\n", field
);
480 root_objectid
= btrfs_header_owner(eb
);
481 level
= btrfs_header_level(eb
);
483 btrfs_node_key_to_cpu(eb
, &key
, 0);
485 btrfs_item_key_to_cpu(eb
, &key
, 0);
486 free_extent_buffer(eb
);
488 root_key
.objectid
= root_objectid
;
489 root_key
.type
= BTRFS_ROOT_ITEM_KEY
;
490 root_key
.offset
= (u64
)-1;
492 root
= btrfs_read_fs_root(root
->fs_info
, &root_key
);
494 fprintf(stderr
, "Couldn't finde owner root %llu\n",
496 return PTR_ERR(root
);
499 path
= btrfs_alloc_path();
503 trans
= btrfs_start_transaction(root
, 1);
505 btrfs_free_path(path
);
506 fprintf(stderr
, "Couldn't start transaction %ld\n",
508 return PTR_ERR(trans
);
511 path
->lowest_level
= level
;
512 ret
= btrfs_search_slot(trans
, root
, &key
, path
, 0, 1);
514 fprintf(stderr
, "Error searching to node %d\n", ret
);
517 eb
= path
->nodes
[level
];
520 switch (corrupt_field
) {
521 case BTRFS_METADATA_BLOCK_GENERATION
:
522 orig
= btrfs_header_generation(eb
);
523 bogus
= generate_u64(orig
);
524 btrfs_set_header_generation(eb
, bogus
);
530 btrfs_mark_buffer_dirty(path
->nodes
[level
]);
532 btrfs_commit_transaction(trans
, root
);
533 btrfs_free_path(path
);
537 static struct option long_options
[] = {
538 /* { "byte-count", 1, NULL, 'b' }, */
539 { "logical", 1, NULL
, 'l' },
540 { "copy", 1, NULL
, 'c' },
541 { "bytes", 1, NULL
, 'b' },
542 { "extent-record", 0, NULL
, 'e' },
543 { "extent-tree", 0, NULL
, 'E' },
544 { "keys", 0, NULL
, 'k' },
545 { "chunk-record", 0, NULL
, 'u' },
546 { "chunk-tree", 0, NULL
, 'U' },
547 { "inode", 1, NULL
, 'i'},
548 { "file-extent", 1, NULL
, 'x'},
549 { "metadata-block", 1, NULL
, 'm'},
550 { "field", 1, NULL
, 'f'},
554 /* corrupt item using NO cow.
555 * Because chunk recover will recover based on whole partition scaning,
556 * If using COW, chunk recover will use the old item to recover,
557 * which is still OK but we want to check the ability to rebuild chunk
558 * not only restore the old ones */
559 int corrupt_item_nocow(struct btrfs_trans_handle
*trans
,
560 struct btrfs_root
*root
, struct btrfs_path
*path
,
564 struct btrfs_key key
;
565 struct extent_buffer
*leaf
;
570 leaf
= path
->nodes
[0];
571 slot
= path
->slots
[0];
572 /* Not deleting the first item of a leaf to keep leaf structure */
575 /* Only accept valid eb */
576 BUG_ON(!leaf
->data
|| slot
>= btrfs_header_nritems(leaf
));
577 btrfs_item_key_to_cpu(leaf
, &key
, slot
);
579 fprintf(stdout
, "Deleting key and data [%llu, %u, %llu].\n",
580 key
.objectid
, key
.type
, key
.offset
);
581 btrfs_del_item(trans
, root
, path
);
583 fprintf(stdout
, "Corrupting key and data [%llu, %u, %llu].\n",
584 key
.objectid
, key
.type
, key
.offset
);
585 ptr
= btrfs_item_ptr_offset(leaf
, slot
);
586 item_size
= btrfs_item_size_nr(leaf
, slot
);
587 memset_extent_buffer(leaf
, 0, ptr
, item_size
);
588 btrfs_mark_buffer_dirty(leaf
);
592 int corrupt_chunk_tree(struct btrfs_trans_handle
*trans
,
593 struct btrfs_root
*root
)
598 struct btrfs_path
*path
;
599 struct btrfs_key key
;
600 struct btrfs_key found_key
;
601 struct extent_buffer
*leaf
;
603 path
= btrfs_alloc_path();
607 key
.objectid
= (u64
)-1;
608 key
.offset
= (u64
)-1;
611 /* Here, cow and ins_len must equals 0 for the following reasons:
612 * 1) chunk recover is based on disk scanning, so COW should be
613 * disabled in case the original chunk being scanned and
614 * recovered using the old chunk.
615 * 2) if cow = 0, ins_len must also be set to 0, or BUG_ON will be
618 ret
= btrfs_search_slot(trans
, root
, &key
, path
, 0, 0);
621 fprintf(stderr
, "Error searching tree\n");
624 /* corrupt/del dev_item first */
625 while (!btrfs_previous_item(root
, path
, 0, BTRFS_DEV_ITEM_KEY
)) {
626 slot
= path
->slots
[0];
627 leaf
= path
->nodes
[0];
629 /* Never delete the first item to keep the leaf structure */
630 if (path
->slots
[0] == 0)
632 ret
= corrupt_item_nocow(trans
, root
, path
, del
);
636 btrfs_release_path(path
);
638 /* Here, cow and ins_len must equals 0 for the following reasons:
639 * 1) chunk recover is based on disk scanning, so COW should be
640 * disabled in case the original chunk being scanned and
641 * recovered using the old chunk.
642 * 2) if cow = 0, ins_len must also be set to 0, or BUG_ON will be
645 ret
= btrfs_search_slot(trans
, root
, &key
, path
, 0, 0);
648 fprintf(stderr
, "Error searching tree\n");
651 /* corrupt/del chunk then*/
652 while (!btrfs_previous_item(root
, path
, 0, BTRFS_CHUNK_ITEM_KEY
)) {
653 slot
= path
->slots
[0];
654 leaf
= path
->nodes
[0];
656 btrfs_item_key_to_cpu(leaf
, &found_key
, slot
);
657 ret
= corrupt_item_nocow(trans
, root
, path
, del
);
662 btrfs_free_path(path
);
665 int find_chunk_offset(struct btrfs_root
*root
,
666 struct btrfs_path
*path
, u64 offset
)
668 struct btrfs_key key
;
671 key
.objectid
= BTRFS_FIRST_CHUNK_TREE_OBJECTID
;
672 key
.type
= BTRFS_CHUNK_ITEM_KEY
;
675 /* Here, cow and ins_len must equals 0 for following reasons:
676 * 1) chunk recover is based on disk scanning, so COW should
677 * be disabled in case the original chunk being scanned
678 * and recovered using the old chunk.
679 * 2) if cow = 0, ins_len must also be set to 0, or BUG_ON
682 ret
= btrfs_search_slot(NULL
, root
, &key
, path
, 0, 0);
684 fprintf(stderr
, "Can't find chunk with given offset %llu\n",
689 fprintf(stderr
, "Error searching chunk");
696 int main(int ac
, char **av
)
698 struct cache_tree root_cache
;
699 struct btrfs_root
*root
;
700 struct extent_buffer
*eb
;
702 /* chunk offset can be 0,so change to (u64)-1 */
703 u64 logical
= (u64
)-1;
705 int option_index
= 0;
710 int corrupt_block_keys
= 0;
713 u64 metadata_block
= 0;
715 u64 file_extent
= (u64
)-1;
716 char field
[FIELD_BUF_LEN
];
723 c
= getopt_long(ac
, av
, "l:c:b:eEkuUi:f:x:m:", long_options
,
729 logical
= atoll(optarg
);
735 "invalid copy number\n");
740 bytes
= atoll(optarg
);
743 "invalid byte count\n");
754 corrupt_block_keys
= 1;
762 inode
= atoll(optarg
);
765 "invalid inode number\n");
770 strncpy(field
, optarg
, FIELD_BUF_LEN
);
774 file_extent
= atoll(optarg
);
776 fprintf(stderr
, "error converting "
783 metadata_block
= atoll(optarg
);
785 fprintf(stderr
, "error converting "
800 cache_tree_init(&root_cache
);
802 root
= open_ctree(dev
, 0, OPEN_CTREE_WRITES
);
804 fprintf(stderr
, "Open ctree failed\n");
808 struct btrfs_trans_handle
*trans
;
810 if (logical
== (u64
)-1)
812 trans
= btrfs_start_transaction(root
, 1);
813 ret
= corrupt_extent (trans
, root
, logical
, 0);
814 btrfs_commit_transaction(trans
, root
);
818 struct btrfs_trans_handle
*trans
;
819 trans
= btrfs_start_transaction(root
, 1);
820 btrfs_corrupt_extent_tree(trans
, root
->fs_info
->extent_root
,
821 root
->fs_info
->extent_root
->node
);
822 btrfs_commit_transaction(trans
, root
);
826 struct btrfs_trans_handle
*trans
;
827 struct btrfs_path
*path
;
830 if (logical
== (u64
)-1)
833 path
= btrfs_alloc_path();
835 fprintf(stderr
, "path allocation failed\n");
839 if (find_chunk_offset(root
->fs_info
->chunk_root
, path
,
841 btrfs_free_path(path
);
844 trans
= btrfs_start_transaction(root
, 1);
845 ret
= corrupt_item_nocow(trans
, root
->fs_info
->chunk_root
,
848 fprintf(stderr
, "Failed to corrupt chunk record\n");
849 btrfs_commit_transaction(trans
, root
);
853 struct btrfs_trans_handle
*trans
;
854 trans
= btrfs_start_transaction(root
, 1);
855 ret
= corrupt_chunk_tree(trans
, root
->fs_info
->chunk_root
);
857 fprintf(stderr
, "Failed to corrupt chunk tree\n");
858 btrfs_commit_transaction(trans
, root
);
862 struct btrfs_trans_handle
*trans
;
867 trans
= btrfs_start_transaction(root
, 1);
868 if (file_extent
== (u64
)-1) {
869 printf("corrupting inode\n");
870 ret
= corrupt_inode(trans
, root
, inode
, field
);
872 printf("corrupting file extent\n");
873 ret
= corrupt_file_extent(trans
, root
, inode
,
876 btrfs_commit_transaction(trans
, root
);
879 if (metadata_block
) {
882 ret
= corrupt_metadata_block(root
, metadata_block
, field
);
886 * If we made it here and we have extent set then we didn't specify
887 * inode and we're screwed.
889 if (file_extent
!= (u64
)-1)
892 if (logical
== (u64
)-1)
896 bytes
= root
->sectorsize
;
898 bytes
= (bytes
+ root
->sectorsize
- 1) / root
->sectorsize
;
899 bytes
*= root
->sectorsize
;
902 if (corrupt_block_keys
) {
903 corrupt_keys_in_block(root
, logical
);
905 eb
= debug_corrupt_block(root
, logical
,
906 root
->sectorsize
, copy
);
907 free_extent_buffer(eb
);
909 logical
+= root
->sectorsize
;
910 bytes
-= root
->sectorsize
;