/*++ Copyright (c) 1991 Microsoft Corporation Module Name: NtfsProc.h Abstract: This module defines all of the globally used procedures in the Ntfs file system. Author: Brian Andrew [BrianAn] 21-May-1991 David Goebel [DavidGoe] Gary Kimura [GaryKi] Tom Miller [TomM] Revision History: --*/ #ifndef _NTFSPROC_ #define _NTFSPROC_ #pragma warning(error:4100) // Unreferenced formal parameter #pragma warning(error:4101) // Unreferenced local variable #pragma warning(error:4705) // Statement has no effect #pragma warning(disable:4116) // unnamed type definition in parentheses #define RTL_USE_AVL_TABLES 0 #ifndef KDEXTMODE #include #else #include #include #include #include #endif #include #include #include #include #include #include "nodetype.h" #include "Ntfs.h" #ifndef INLINE // definition of inline #define INLINE __inline #endif #include #include "NtfsStru.h" #include "NtfsData.h" #include "NtfsLog.h" // // Tag all of our allocations if tagging is turned on // // // Default module pool tag // #define MODULE_POOL_TAG ('0ftN') #if 0 #define NtfsVerifySizes(s) (ASSERT( (s)->ValidDataLength.QuadPart <= (s)->FileSize.QuadPart && (s)->FileSize.QuadPart <= (s)->AllocationSize.QuadPart )) #define NtfsVerifySizesLongLong(s) (ASSERT( (s)->ValidDataLength <= (s)->FileSize && (s)->FileSize <= (s)->AllocationSize )) #else // !DBG #define NtfsVerifySizes(s) #define NtfsVerifySizesLongLong(s) #endif // !DBG #if !(DBG && i386 && defined (NTFSPOOLCHECK)) // // Non-debug allocate and free goes directly to the FsRtl routines // #define NtfsAllocatePoolWithTagNoRaise(a,b,c) ExAllocatePoolWithTag((a),(b),(c)) #define NtfsAllocatePoolWithTag(a,b,c) FsRtlAllocatePoolWithTag((a),(b),(c)) #define NtfsAllocatePoolNoRaise(a,b) ExAllocatePoolWithTag((a),(b),MODULE_POOL_TAG) #define NtfsAllocatePool(a,b) FsRtlAllocatePoolWithTag((a),(b),MODULE_POOL_TAG) #define NtfsFreePool(pv) ExFreePool(pv) #else // !DBG // // Debugging routines capture the stack backtrace for allocates and frees // #define NtfsAllocatePoolWithTagNoRaise(a,b,c) NtfsDebugAllocatePoolWithTagNoRaise((a),(b),(c)) #define NtfsAllocatePoolWithTag(a,b,c) NtfsDebugAllocatePoolWithTag((a),(b),(c)) #define NtfsAllocatePoolNoRaise(a,b) NtfsDebugAllocatePoolWithTagNoRaise((a),(b),MODULE_POOL_TAG) #define NtfsAllocatePool(a,b) NtfsDebugAllocatePoolWithTag((a),(b),MODULE_POOL_TAG) #define NtfsFreePool(pv) NtfsDebugFreePool(pv) PVOID NtfsDebugAllocatePoolWithTagNoRaise ( POOL_TYPE Pool, ULONG Length, ULONG Tag); PVOID NtfsDebugAllocatePoolWithTag ( POOL_TYPE Pool, ULONG Length, ULONG Tag); VOID NtfsDebugFreePool ( PVOID pv); VOID NtfsDebugHeapDump ( PUNICODE_STRING UnicodeString ); #endif // !DBG // // Local character comparison macros that we might want to later move to ntfsproc // #define IsCharZero(C) (((C) & 0x000000ff) == 0x00000000) #define IsCharMinus1(C) (((C) & 0x000000ff) == 0x000000ff) #define IsCharLtrZero(C) (((C) & 0x00000080) == 0x00000080) #define IsCharGtrZero(C) (!IsCharLtrZero(C) && !IsCharZero(C)) // // The following two macro are used to find the first byte to really store // in the mapping pairs. They take as input a pointer to the LargeInteger we are // trying to store and a pointer to a character pointer. The character pointer // on return points to the first byte that we need to output. That's we skip // over the high order 0x00 or 0xff bytes. // typedef struct _SHORT2 { USHORT LowPart; USHORT HighPart; } SHORT2, *PSHORT2; typedef struct _CHAR2 { UCHAR LowPart; UCHAR HighPart; } CHAR2, *PCHAR2; #define GetPositiveByte(LI,CP) { \ *(CP) = (PCHAR)(LI); \ if ((LI)->HighPart != 0) { *(CP) += 4; } \ if (((PSHORT2)(*(CP)))->HighPart != 0) { *(CP) += 2; } \ if (((PCHAR2)(*(CP)))->HighPart != 0) { *(CP) += 1; } \ if (IsCharLtrZero(*(*CP))) { *(CP) += 1; } \ } #define GetNegativeByte(LI,CP) { \ *(CP) = (PCHAR)(LI); \ if ((LI)->HighPart != 0xffffffff) { *(CP) += 4; } \ if (((PSHORT2)(*(CP)))->HighPart != 0xffff) { *(CP) += 2; } \ if (((PCHAR2)(*(CP)))->HighPart != 0xff) { *(CP) += 1; } \ if (!IsCharLtrZero(*(*CP))) { *(CP) += 1; } \ } // // Flag macros // // ULONG // FlagOn ( // IN ULONG Flags, // IN ULONG SingleFlag // ); // // BOOLEAN // BooleanFlagOn ( // IN ULONG Flags, // IN ULONG SingleFlag // ); // // VOID // SetFlag ( // IN ULONG Flags, // IN ULONG SingleFlag // ); // // VOID // ClearFlag ( // IN ULONG Flags, // IN ULONG SingleFlag // ); // #ifdef KDEXTMODE #ifndef FlagOn #define FlagOn(F,SF) ( \ (((F) & (SF))) \ ) #endif #endif //#ifndef BooleanFlagOn //#define BooleanFlagOn(F,SF) ( \ // (BOOLEAN)(((F) & (SF)) != 0) \ //) //#endif //#ifndef SetFlag //#define SetFlag(F,SF) { \ // (F) |= (SF); \ //} //#endif //#ifndef ClearFlag //#define ClearFlag(F,SF) { \ // (F) &= ~(SF); \ //} //#endif // // The following two macro are used by the Fsd/Fsp exception handlers to // process an exception. The first macro is the exception filter used in the // Fsd/Fsp to decide if an exception should be handled at this level. // The second macro decides if the exception is to be finished off by // completing the IRP, and cleaning up the Irp Context, or if we should // bugcheck. Exception values such as STATUS_FILE_INVALID (raised by // VerfySup.c) cause us to complete the Irp and cleanup, while exceptions // such as accvio cause us to bugcheck. // // The basic structure for fsd/fsp exception handling is as follows: // // NtfsFsdXxx(..) // { // try { // // .. // // } except(NtfsExceptionFilter( IrpContext, GetExceptionRecord() )) { // // Status = NtfsProcessException( IrpContext, Irp, GetExceptionCode() ); // } // // Return Status; // } // // To explicitly raise an exception that we expect, such as // STATUS_FILE_INVALID, use the below macro NtfsRaiseStatus). To raise a // status from an unknown origin (such as CcFlushCache()), use the macro // NtfsNormalizeAndRaiseStatus. This will raise the status if it is expected, // or raise STATUS_UNEXPECTED_IO_ERROR if it is not. // // Note that when using these two macros, the original status is placed in // IrpContext->ExceptionStatus, signaling NtfsExceptionFilter and // NtfsProcessException that the status we actually raise is by definition // expected. // LONG NtfsExceptionFilter ( IN PIRP_CONTEXT IrpContext, IN PEXCEPTION_POINTERS ExceptionPointer ); NTSTATUS NtfsProcessException ( IN PIRP_CONTEXT IrpContext, IN PIRP Irp OPTIONAL, IN NTSTATUS ExceptionCode ); VOID DECLSPEC_NORETURN NtfsRaiseStatus ( IN PIRP_CONTEXT IrpContext, IN NTSTATUS Status, IN PFILE_REFERENCE FileReference OPTIONAL, IN PFCB Fcb OPTIONAL ); ULONG NtfsRaiseStatusFunction ( IN PIRP_CONTEXT IrpContext, IN NTSTATUS Status ); // // VOID // NtfsNormalAndRaiseStatus ( // IN PRIP_CONTEXT IrpContext, // IN NT_STATUS Status // IN NT_STATUS NormalStatus // ); // #define NtfsNormalizeAndRaiseStatus(IC,STAT,NOR_STAT) { \ (IC)->ExceptionStatus = (STAT); \ ExRaiseStatus(FsRtlNormalizeNtstatus((STAT),NOR_STAT)); \ } // // Informational popup routine. // VOID NtfsRaiseInformationHardError ( IN PIRP_CONTEXT IrpContext, IN NTSTATUS Status, IN PFILE_REFERENCE FileReference OPTIONAL, IN PFCB Fcb OPTIONAL ); // // Allocation support routines, implemented in AllocSup.c // // These routines are for querying, allocating and truncating clusters // for individual data streams. // // // Syscache debugging support - Main current define these are triggered on is // SYSCACHE_DEBUG // #if (defined(NTFS_RWCMP_TRACE) || defined(SYSCACHE) || defined(NTFS_RWC_DEBUG) || defined(SYSCACHE_DEBUG)) BOOLEAN FsRtlIsSyscacheFile ( IN PFILE_OBJECT FileObject ); // // Depreciated verification routine leftover from tomm's original debugging code // VOID FsRtlVerifySyscacheData ( IN PFILE_OBJECT FileObject, IN PVOID Buffer, IN ULONG Length, IN ULONG Offset ); ULONG FsRtlLogSyscacheEvent ( IN PSCB Scb, IN ULONG Event, IN ULONG Flags, IN LONGLONG Start, IN LONGLONG Range, IN LONGLONG Result ); VOID FsRtlUpdateSyscacheEvent ( IN PSCB Scb, IN ULONG EntryNumber, IN LONGLONG Result, IN ULONG NewFlag ); #define ScbIsBeingLogged( S ) (((S)->SyscacheLogEntryCount != 0) && (NtfsSyscacheLogSet[(S)->LogSetNumber].Scb == (S))) #endif // // The following routine takes an Vbo and returns the lbo and size of // the run corresponding to the Vbo. It function result is TRUE if // the Vbo has a valid Lbo mapping and FALSE otherwise. // ULONG NtfsPreloadAllocation ( IN PIRP_CONTEXT IrpContext, IN OUT PSCB Scb, IN VCN StartingVcn, IN VCN EndingVcn ); BOOLEAN NtfsLookupAllocation ( IN PIRP_CONTEXT IrpContext, IN OUT PSCB Scb, IN VCN Vcn, OUT PLCN Lcn, OUT PLONGLONG ClusterCount, OUT PVOID *RangePtr OPTIONAL, OUT PULONG RunIndex OPTIONAL ); BOOLEAN NtfsIsRangeAllocated ( IN PSCB Scb, IN VCN StartVcn, IN VCN FinalCluster, IN BOOLEAN RoundToSparseUnit, OUT PLONGLONG ClusterCount ); // // The following two routines modify the allocation of a data stream // represented by an Scb. // BOOLEAN NtfsAllocateAttribute ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb, IN ATTRIBUTE_TYPE_CODE AttributeTypeCode, IN PUNICODE_STRING AttributeName OPTIONAL, IN USHORT AttributeFlags, IN BOOLEAN AllocateAll, IN BOOLEAN LogIt, IN LONGLONG Size, IN PATTRIBUTE_ENUMERATION_CONTEXT NewLocation OPTIONAL ); VOID NtfsAddAllocation ( IN PIRP_CONTEXT IrpContext, IN PFILE_OBJECT FileObject OPTIONAL, IN OUT PSCB Scb, IN VCN StartingVcn, IN LONGLONG ClusterCount, IN LOGICAL AskForMore, IN OUT PCCB CcbForWriteExtend OPTIONAL ); VOID NtfsAddSparseAllocation ( IN PIRP_CONTEXT IrpContext, IN PFILE_OBJECT FileObject OPTIONAL, IN OUT PSCB Scb, IN LONGLONG StartingOffset, IN LONGLONG ByteCount ); VOID NtfsDeleteAllocation ( IN PIRP_CONTEXT IrpContext, IN PFILE_OBJECT FileObject OPTIONAL, IN OUT PSCB Scb, IN VCN StartingVcn, IN VCN EndingVcn, IN BOOLEAN LogIt, IN BOOLEAN BreakupAllowed ); VOID NtfsReallocateRange ( IN PIRP_CONTEXT IrpContext, IN OUT PSCB Scb, IN VCN DeleteVcn, IN LONGLONG DeleteCount, IN VCN AllocateVcn, IN LONGLONG AllocateCount, IN PLCN TargetLcn OPTIONAL ); // // Routines for Mcb to Mapping Pairs operations // ULONG NtfsGetSizeForMappingPairs ( IN PNTFS_MCB Mcb, IN ULONG BytesAvailable, IN VCN LowestVcn, IN PVCN StopOnVcn OPTIONAL, OUT PVCN StoppedOnVcn ); BOOLEAN NtfsBuildMappingPairs ( IN PNTFS_MCB Mcb, IN VCN LowestVcn, IN OUT PVCN HighestVcn, OUT PCHAR MappingPairs ); VCN NtfsGetHighestVcn ( IN PIRP_CONTEXT IrpContext, IN VCN LowestVcn, IN PCHAR MappingPairs ); BOOLEAN NtfsReserveClusters ( IN PIRP_CONTEXT IrpContext OPTIONAL, IN PSCB Scb, IN LONGLONG FileOffset, IN ULONG ByteCount ); VOID NtfsFreeReservedClusters ( IN PSCB Scb, IN LONGLONG FileOffset, IN ULONG ByteCount ); BOOLEAN NtfsCheckForReservedClusters ( IN PSCB Scb, IN LONGLONG StartingVcn, IN OUT PLONGLONG ClusterCount ); VOID NtfsDeleteReservedBitmap ( IN PSCB Scb ); // // Attribute lookup routines, implemented in AttrSup.c // // // This macro detects if we are enumerating through base or external // attributes, and calls the appropriate function. // // BOOLEAN // LookupNextAttribute ( // IN PRIP_CONTEXT IrpContext, // IN PFCB Fcb, // IN ATTRIBUTE_TYPE_CODE Code, // IN PUNICODE_STRING Name OPTIONAL, // IN BOOLEAN IgnoreCase, // IN PVOID Value OPTIONAL, // IN ULONG ValueLength, // IN PVCN Vcn OPTIONAL, // IN PATTRIBUTE_ENUMERATION_CONTEXT Context // ); // #define LookupNextAttribute(IRPCTXT,FCB,CODE,NAME,IC,VALUE,LENGTH,V,CONTEXT) \ ( (CONTEXT)->AttributeList.Bcb == NULL \ ? NtfsLookupInFileRecord( (IRPCTXT), \ (FCB), \ NULL, \ (CODE), \ (NAME), \ (V), \ (IC), \ (VALUE), \ (LENGTH), \ (CONTEXT)) \ : NtfsLookupExternalAttribute((IRPCTXT), \ (FCB), \ (CODE), \ (NAME), \ (V), \ (IC), \ (VALUE), \ (LENGTH), \ (CONTEXT)) ) BOOLEAN NtfsLookupExternalAttribute ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN ATTRIBUTE_TYPE_CODE QueriedTypeCode, IN PCUNICODE_STRING QueriedName OPTIONAL, IN PVCN Vcn OPTIONAL, IN BOOLEAN IgnoreCase, IN PVOID QueriedValue OPTIONAL, IN ULONG QueriedValueLength, IN OUT PATTRIBUTE_ENUMERATION_CONTEXT Context ); // // The following two routines do lookups based on the attribute definitions. // ATTRIBUTE_TYPE_CODE NtfsGetAttributeTypeCode ( IN PVCB Vcb, IN PUNICODE_STRING AttributeTypeName ); // // PATTRIBUTE_DEFINITION_COLUMNS // NtfsGetAttributeDefinition ( // IN PVCB Vcb, // IN ATTRIBUTE_TYPE_CODE AttributeTypeCode // ) // #define NtfsGetAttributeDefinition(Vcb,AttributeTypeCode) \ (&Vcb->AttributeDefinitions[(AttributeTypeCode / 0x10) - 1]) // // This routine looks up the attribute uniquely-qualified by the specified // Attribute Code and case-sensitive name. The attribute may not be unique // if IgnoreCase is specified. // BOOLEAN NtfsLookupInFileRecord ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN PFILE_REFERENCE BaseFileReference OPTIONAL, IN ATTRIBUTE_TYPE_CODE QueriedTypeCode, IN PCUNICODE_STRING QueriedName OPTIONAL, IN PVCN Vcn OPTIONAL, IN BOOLEAN IgnoreCase, IN PVOID QueriedValue OPTIONAL, IN ULONG QueriedValueLength, IN OUT PATTRIBUTE_ENUMERATION_CONTEXT Context ); // // This routine attempts to find the fist occurrence of an attribute with // the specified AttributeTypeCode and the specified QueriedName in the // specified BaseFileReference. If we find one, its attribute record is // pinned and returned. // // BOOLEAN // NtfsLookupAttributeByName ( // IN PIRP_CONTEXT IrpContext, // IN PFCB Fcb, // IN PFILE_REFERENCE BaseFileReference, // IN ATTRIBUTE_TYPE_CODE QueriedTypeCode, // IN PUNICODE_STRING QueriedName OPTIONAL, // IN PVCN Vcn OPTIONAL, // IN BOOLEAN IgnoreCase, // OUT PATTRIBUTE_ENUMERATION_CONTEXT Context // ) // #define NtfsLookupAttributeByName(IrpContext,Fcb,BaseFileReference,QueriedTypeCode,QueriedName,Vcn,IgnoreCase,Context) \ NtfsLookupInFileRecord( IrpContext, \ Fcb, \ BaseFileReference, \ QueriedTypeCode, \ QueriedName, \ Vcn, \ IgnoreCase, \ NULL, \ 0, \ Context ) // // This function continues where the prior left off. // // BOOLEAN // NtfsLookupNextAttributeByName ( // IN PIRP_CONTEXT IrpContext, // IN PFCB Fcb, // IN ATTRIBUTE_TYPE_CODE QueriedTypeCode, // IN PUNICODE_STRING QueriedName OPTIONAL, // IN BOOLEAN IgnoreCase, // IN OUT PATTRIBUTE_ENUMERATION_CONTEXT Context // ) // #define NtfsLookupNextAttributeByName(IrpContext,Fcb,QueriedTypeCode,QueriedName,IgnoreCase,Context) \ LookupNextAttribute( IrpContext, \ Fcb, \ QueriedTypeCode, \ QueriedName, \ IgnoreCase, \ NULL, \ 0, \ NULL, \ Context ) // // The following does a search based on a VCN. // // // BOOLEAN // NtfsLookupNextAttributeByVcn ( // IN PIRP_CONTEXT IrpContext, // IN PFCB Fcb, // IN PVCN Vcn OPTIONAL, // OUT PATTRIBUTE_ENUMERATION_CONTEXT // ); // #define NtfsLookupNextAttributeByVcn(IC,F,V,C) \ LookupNextAttribute( (IC), \ (F), \ $UNUSED, \ NULL, \ FALSE, \ NULL, \ FALSE, \ (V), \ (C) ) // // The following routines find the attribute record for a given Scb. // And also update the scb from the attribute // // VOID // NtfsLookupAttributeForScb ( // IN PIRP_CONTEXT IrpContext, // IN PSCB Scb, // IN PVCN Vcn OPTIONAL, // IN OUT PATTRIBUTE_ENUMERATION_CONTEXT Context // ) // #define NtfsLookupAttributeForScb(IrpContext,Scb,Vcn,Context) \ if (!NtfsLookupAttributeByName( IrpContext, \ Scb->Fcb, \ &Scb->Fcb->FileReference, \ Scb->AttributeTypeCode, \ &Scb->AttributeName, \ Vcn, \ FALSE, \ Context ) && \ !FlagOn( Scb->ScbState, SCB_STATE_VIEW_INDEX )) { \ \ DebugTrace( 0, 0, ("Could not find attribute for Scb @ %08lx\n", Scb )); \ ASSERTMSG("Could not find attribute for Scb\n", FALSE); \ NtfsRaiseStatus( IrpContext, STATUS_FILE_CORRUPT_ERROR, NULL, Scb->Fcb ); \ } // // This routine looks up and returns the next attribute for a given Scb. // // BOOLEAN // NtfsLookupNextAttributeForScb ( // IN PIRP_CONTEXT IrpContext, // IN PSCB Scb, // IN OUT PATTRIBUTE_ENUMERATION_CONTEXT Context // ) // #define NtfsLookupNextAttributeForScb(IrpContext,Scb,Context) \ NtfsLookupNextAttributeByName( IrpContext, \ Scb->Fcb, \ Scb->AttributeTypeCode, \ &Scb->AttributeName, \ FALSE, \ Context ) VOID NtfsUpdateScbFromAttribute ( IN PIRP_CONTEXT IrpContext, IN OUT PSCB Scb, IN PATTRIBUTE_RECORD_HEADER AttrHeader OPTIONAL ); // // The following routines deal with the Fcb and the duplicated information field. // BOOLEAN NtfsUpdateFcbInfoFromDisk ( IN PIRP_CONTEXT IrpContext, IN BOOLEAN LoadSecurity, IN OUT PFCB Fcb, OUT POLD_SCB_SNAPSHOT UnnamedDataSizes OPTIONAL ); // // These routines looks up the first/next attribute, i.e., they may be used // to retrieve all atributes for a file record. // // If the Bcb in the Found Attribute structure changes in the Next call, then // the previous Bcb is autmatically unpinned and the new one pinned. // // // This routine attempts to find the fist occurrence of an attribute with // the specified AttributeTypeCode in the specified BaseFileReference. If we // find one, its attribute record is pinned and returned. // // BOOLEAN // NtfsLookupAttribute ( // IN PIRP_CONTEXT IrpContext, // IN PFCB Fcb, // IN PFILE_REFERENCE BaseFileReference, // OUT PATTRIBUTE_ENUMERATION_CONTEXT Context // ) // #define NtfsLookupAttribute(IrpContext,Fcb,BaseFileReference,Context) \ NtfsLookupInFileRecord( IrpContext, \ Fcb, \ BaseFileReference, \ $UNUSED, \ NULL, \ NULL, \ FALSE, \ NULL, \ 0, \ Context ) // // This function continues where the prior left off. // // BOOLEAN // NtfsLookupNextAttribute ( // IN PIRP_CONTEXT IrpContext, // IN PFCB Fcb, // IN OUT PATTRIBUTE_ENUMERATION_CONTEXT Context // ) // #define NtfsLookupNextAttribute(IrpContext,Fcb,Context) \ LookupNextAttribute( IrpContext, \ Fcb, \ $UNUSED, \ NULL, \ FALSE, \ NULL, \ 0, \ NULL, \ Context ) // // These routines looks up the first/next attribute of the given type code. // // If the Bcb in the Found Attribute structure changes in the Next call, then // the previous Bcb is autmatically unpinned and the new one pinned. // // // This routine attempts to find the fist occurrence of an attribute with // the specified AttributeTypeCode in the specified BaseFileReference. If we // find one, its attribute record is pinned and returned. // // BOOLEAN // NtfsLookupAttributeByCode ( // IN PIRP_CONTEXT IrpContext, // IN PFCB Fcb, // IN PFILE_REFERENCE BaseFileReference, // IN ATTRIBUTE_TYPE_CODE QueriedTypeCode, // OUT PATTRIBUTE_ENUMERATION_CONTEXT Context // ) // #define NtfsLookupAttributeByCode(IrpContext,Fcb,BaseFileReference,QueriedTypeCode,Context) \ NtfsLookupInFileRecord( IrpContext, \ Fcb, \ BaseFileReference, \ QueriedTypeCode, \ NULL, \ NULL, \ FALSE, \ NULL, \ 0, \ Context ) // // This function continues where the prior left off. // // BOOLEAN // NtfsLookupNextAttributeByCode ( // IN PIRP_CONTEXT IrpContext, // IN PFCB Fcb, // IN ATTRIBUTE_TYPE_CODE QueriedTypeCode, // IN OUT PATTRIBUTE_ENUMERATION_CONTEXT Context // ) // #define NtfsLookupNextAttributeByCode(IC,F,CODE,C) \ LookupNextAttribute( (IC), \ (F), \ (CODE), \ NULL, \ FALSE, \ NULL, \ 0, \ NULL, \ (C) ) // // These routines looks up the first/next occurrence of an attribute by its // Attribute Code and exact attribute value (consider using RtlCompareMemory). // The value contains everything outside of the standard attribute header, // so for example, to look up the File Name attribute by value, the caller // must form a record with not only the file name in it, but with the // ParentDirectory filled in as well. The length should be exact, and not // include any unused (such as in DOS_NAME) or reserved characters. // // If the Bcb changes in the Next call, then the previous Bcb is autmatically // unpinned and the new one pinned. // // // This routine attempts to find the fist occurrence of an attribute with // the specified AttributeTypeCode and the specified QueriedValue in the // specified BaseFileReference. If we find one, its attribute record is // pinned and returned. // // BOOLEAN // NtfsLookupAttributeByValue ( // IN PIRP_CONTEXT IrpContext, // IN PFCB Fcb, // IN PFILE_REFERENCE BaseFileReference, // IN ATTRIBUTE_TYPE_CODE QueriedTypeCode, // IN PVOID QueriedValue, // IN ULONG QueriedValueLength, // OUT PATTRIBUTE_ENUMERATION_CONTEXT Context // ) // #define NtfsLookupAttributeByValue(IrpContext,Fcb,BaseFileReference,QueriedTypeCode,QueriedValue,QueriedValueLength,Context) \ NtfsLookupInFileRecord( IrpContext, \ Fcb, \ BaseFileReference, \ QueriedTypeCode, \ NULL, \ NULL, \ FALSE, \ QueriedValue, \ QueriedValueLength, \ Context ) // // This function continues where the prior left off. // // BOOLEAN // NtfsLookupNextAttributeByValue ( // IN PIRP_CONTEXT IrpContext, // IN PFCB Fcb, // IN ATTRIBUTE_TYPE_CODE QueriedTypeCode, // IN PVOID QueriedValue, // IN ULONG QueriedValueLength, // IN OUT PATTRIBUTE_ENUMERATION_CONTEXT Context // ) // #define NtfsLookupNextAttributeByValue(IC,F,CODE,V,VL,C) \ LookupNextAttribute( (IC), \ (F), \ (CODE), \ NULL, \ FALSE, \ (V), \ (VL), \ (C) ) VOID NtfsCleanupAttributeContext( IN OUT PIRP_CONTEXT IrpContext, IN OUT PATTRIBUTE_ENUMERATION_CONTEXT AttributeContext ); // // // // Here are some routines/macros for dealing with Attribute Enumeration // Contexts. // // VOID // NtfsInitializeAttributeContext( // OUT PATTRIBUTE_ENUMERATION_CONTEXT AttributeContext // ); // // VOID // NtfsPinMappedAttribute( // IN PIRP_CONTEXT IrpContext, // IN PVCB Vcb, // IN OUT PATTRIBUTE_ENUMERATION_CONTEXT AttributeContext // ); // // PATTRIBUTE_RECORD_HEADER // NtfsFoundAttribute( // IN PATTRIBUTE_ENUMERATION_CONTEXT AttributeContext // ); // // PBCB // NtfsFoundBcb( // IN PATTRIBUTE_ENUMERATION_CONTEXT AttributeContext // ); // // PFILE_RECORD // NtfsContainingFileRecord ( // IN PATTRIBUTE_ENUMERATION_CONTEXT AttributeContext // ); // // LONGLONG // NtfsMftOffset ( // IN PATTRIBUTE_ENUMERATION_CONTEXT AttributeContext // ); // #define NtfsInitializeAttributeContext(CTX) { \ RtlZeroMemory( (CTX), sizeof(ATTRIBUTE_ENUMERATION_CONTEXT) ); \ } #define NtfsPinMappedAttribute(IC,V,CTX) { \ NtfsPinMappedData( (IC), \ (V)->MftScb, \ (CTX)->FoundAttribute.MftFileOffset, \ (V)->BytesPerFileRecordSegment, \ &(CTX)->FoundAttribute.Bcb ); \ } #define NtfsFoundAttribute(CTX) ( \ (CTX)->FoundAttribute.Attribute \ ) #define NtfsFoundBcb(CTX) ( \ (CTX)->FoundAttribute.Bcb \ ) #define NtfsContainingFileRecord(CTX) ( \ (CTX)->FoundAttribute.FileRecord \ ) #define NtfsMftOffset(CTX) ( \ (CTX)->FoundAttribute.MftFileOffset \ ) // // This routine returns whether an attribute is resident or not. // // BOOLEAN // NtfsIsAttributeResident ( // IN PATTRIBUTE_RECORD_HEADER Attribute // ); // // PVOID // NtfsAttributeValue ( // IN PATTRIBUTE_RECORD_HEADER Attribute // ); // #define NtfsIsAttributeResident(ATTR) ( \ ((ATTR)->FormCode == RESIDENT_FORM) \ ) #define NtfsAttributeValue(ATTR) ( \ ((PCHAR)(ATTR) + (ULONG)(ATTR)->Form.Resident.ValueOffset) \ ) // // This routine modifies the valid data length and file size on disk for // a given Scb. // BOOLEAN NtfsWriteFileSizes ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb, IN PLONGLONG ValidDataLength, IN BOOLEAN AdvanceOnly, IN BOOLEAN LogIt, IN BOOLEAN RollbackMemStructures ); // // This routine updates the standard information attribute from the // information in the Fcb. // VOID NtfsUpdateStandardInformation ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb ); // // This routine grows and updates the standard information attribute from // the information in the Fcb. // VOID NtfsGrowStandardInformation ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb ); // // Attribute FILE_NAME routines. These routines deal with filename attributes. // // VOID // NtfsBuildFileNameAttribute ( // IN PIRP_CONTEXT IrpContext, // IN PFILE_REFERENCE ParentDirectory, // IN UNICODE_STRING FileName, // IN UCHAR Flags, // OUT PFILE_NAME FileNameValue // ); // #define NtfsBuildFileNameAttribute(IC,PD,FN,FL,PFNA) { \ (PFNA)->ParentDirectory = *(PD); \ (PFNA)->FileNameLength = (UCHAR)((FN).Length >> 1); \ (PFNA)->Flags = FL; \ RtlMoveMemory( (PFNA)->FileName, (FN).Buffer, (ULONG)(FN).Length ); \ } BOOLEAN NtfsLookupEntry ( IN PIRP_CONTEXT IrpContext, IN PSCB ParentScb, IN BOOLEAN IgnoreCase, IN OUT PUNICODE_STRING Name, IN OUT PFILE_NAME *FileNameAttr, IN OUT PUSHORT FileNameAttrLength, OUT PQUICK_INDEX QuickIndex OPTIONAL, OUT PINDEX_ENTRY *IndexEntry, OUT PBCB *IndexEntryBcb, OUT PINDEX_CONTEXT IndexContext OPTIONAL ); // // Macro to decide when to create an attribute resident. // // BOOLEAN // NtfsShouldAttributeBeResident ( // IN PVCB Vcb, // IN PFILE_RECORD_SEGMENT_HEADER FileRecord, // IN ULONG Size // ); // #define RS(S) ((S) + SIZEOF_RESIDENT_ATTRIBUTE_HEADER) #define NtfsShouldAttributeBeResident(VC,FR,S) ( \ (BOOLEAN)((RS(S) <= ((FR)->BytesAvailable - (FR)->FirstFreeByte)) || \ (RS(S) < (VC)->BigEnoughToMove)) \ ) // // Attribute creation/modification routines // // These three routines do *not* presuppose either the Resident or Nonresident // form, with the single exception that if the attribute is indexed, then // it must be Resident. // // NtfsMapAttributeValue and NtfsChangeAttributeValue implement transparent // access to small to medium sized attributes (such as $ACL and $EA), and // work whether the attribute is resident or nonresident. The design target // is 0-64KB in size. Attributes larger than 256KB (or more accurrately, // whatever the virtual mapping granularity is in the Cache Manager) will not // work correctly. // VOID NtfsCreateAttributeWithValue ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN ATTRIBUTE_TYPE_CODE AttributeTypeCode, IN PUNICODE_STRING AttributeName OPTIONAL, IN PVOID Value OPTIONAL, IN ULONG ValueLength, IN USHORT AttributeFlags, IN PFILE_REFERENCE WhereIndexed OPTIONAL, IN BOOLEAN LogIt, OUT PATTRIBUTE_ENUMERATION_CONTEXT Context ); VOID NtfsMapAttributeValue ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, OUT PVOID *Buffer, OUT PULONG Length, OUT PBCB *Bcb, IN OUT PATTRIBUTE_ENUMERATION_CONTEXT Context ); VOID NtfsChangeAttributeValue ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN ULONG ValueOffset, IN PVOID Value OPTIONAL, IN ULONG ValueLength, IN BOOLEAN SetNewLength, IN BOOLEAN LogNonresidentToo, IN BOOLEAN CreateSectionUnderway, IN BOOLEAN PreserveContext, IN OUT PATTRIBUTE_ENUMERATION_CONTEXT Context ); VOID NtfsConvertToNonresident ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN OUT PATTRIBUTE_RECORD_HEADER Attribute, IN BOOLEAN CreateSectionUnderway, IN OUT PATTRIBUTE_ENUMERATION_CONTEXT Context OPTIONAL ); #define DELETE_LOG_OPERATION 0x00000001 #define DELETE_RELEASE_FILE_RECORD 0x00000002 #define DELETE_RELEASE_ALLOCATION 0x00000004 VOID NtfsDeleteAttributeRecord ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN ULONG Flags, IN OUT PATTRIBUTE_ENUMERATION_CONTEXT Context ); VOID NtfsDeleteAllocationFromRecord ( PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN PATTRIBUTE_ENUMERATION_CONTEXT Context, IN BOOLEAN BreakupAllowed, IN BOOLEAN LogIt ); BOOLEAN NtfsChangeAttributeSize ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN ULONG Length, IN OUT PATTRIBUTE_ENUMERATION_CONTEXT Context ); VOID NtfsAddToAttributeList ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN MFT_SEGMENT_REFERENCE SegmentReference, IN OUT PATTRIBUTE_ENUMERATION_CONTEXT Context ); VOID NtfsDeleteFromAttributeList ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN OUT PATTRIBUTE_ENUMERATION_CONTEXT Context ); BOOLEAN NtfsRewriteMftMapping ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb ); VOID NtfsSetTotalAllocatedField ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb, IN USHORT TotalAllocatedNeeded ); VOID NtfsSetSparseStream ( IN PIRP_CONTEXT IrpContext, IN PSCB ParentScb OPTIONAL, IN PSCB Scb ); NTSTATUS NtfsZeroRangeInStream ( IN PIRP_CONTEXT IrpContext, IN PFILE_OBJECT FileObject OPTIONAL, IN PSCB Scb, IN PLONGLONG StartingOffset, IN LONGLONG FinalZero ); BOOLEAN NtfsModifyAttributeFlags ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb, IN USHORT NewAttributeFlags ); PFCB NtfsInitializeFileInExtendDirectory ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN PCUNICODE_STRING FileName, IN BOOLEAN ViewIndex, IN ULONG CreateIfNotExist ); // // Use common routines to fill the common query buffers. // VOID NtfsFillBasicInfo ( OUT PFILE_BASIC_INFORMATION Buffer, IN PSCB Scb ); VOID NtfsFillStandardInfo ( OUT PFILE_STANDARD_INFORMATION Buffer, IN PSCB Scb, IN PCCB Ccb OPTIONAL ); VOID NtfsFillNetworkOpenInfo ( OUT PFILE_NETWORK_OPEN_INFORMATION Buffer, IN PSCB Scb ); // // The following three routines dealing with allocation are to be // called by allocsup.c only. Other software must call the routines // in allocsup.c // BOOLEAN NtfsCreateAttributeWithAllocation ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb, IN ATTRIBUTE_TYPE_CODE AttributeTypeCode, IN PUNICODE_STRING AttributeName OPTIONAL, IN USHORT AttributeFlags, IN BOOLEAN LogIt, IN BOOLEAN UseContext, IN OUT PATTRIBUTE_ENUMERATION_CONTEXT Context ); VOID NtfsAddAttributeAllocation ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb, IN OUT PATTRIBUTE_ENUMERATION_CONTEXT Context, IN PVCN StartingVcn OPTIONAL, IN PVCN ClusterCount OPTIONAL ); VOID NtfsDeleteAttributeAllocation ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb, IN BOOLEAN LogIt, IN PVCN StopOnVcn, IN OUT PATTRIBUTE_ENUMERATION_CONTEXT Context, IN BOOLEAN TruncateToVcn ); // // To delete a file, you must first ask if it is deleteable from the ParentScb // used to get there for your caller, and then you can delete it if it is. // // // BOOLEAN // NtfsIsLinkDeleteable ( // IN PIRP_CONTEXT IrpContext, // IN PFCB Fcb, // OUT PBOOLEAN NonEmptyIndex, // OUT PBOOLEAN LastLink // ); // #define NtfsIsLinkDeleteable(IC,FC,NEI,LL) ((BOOLEAN) \ (((*(LL) = ((BOOLEAN) (FC)->LinkCount == 1)), (FC)->LinkCount > 1) || \ (NtfsIsFileDeleteable( (IC), (FC), (NEI) ))) \ ) BOOLEAN NtfsIsFileDeleteable ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, OUT PBOOLEAN NonEmptyIndex ); VOID NtfsDeleteFile ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN PSCB ParentScb, IN OUT PBOOLEAN AcquiredParentScb, IN OUT PNAME_PAIR NamePair OPTIONAL, IN OUT PNTFS_TUNNELED_DATA TunneledData OPTIONAL ); VOID NtfsPrepareForUpdateDuplicate ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN OUT PLCB *Lcb, IN OUT PSCB *ParentScb, IN BOOLEAN AcquireShared ); VOID NtfsUpdateDuplicateInfo ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN PLCB Lcb OPTIONAL, IN PSCB ParentScb OPTIONAL ); VOID NtfsUpdateLcbDuplicateInfo ( IN PFCB Fcb, IN PLCB Lcb ); VOID NtfsUpdateFcb ( IN PFCB Fcb, IN ULONG ChangeFlags ); // // The following routines add and remove links. They also update the name // flags in particular links. // VOID NtfsAddLink ( IN PIRP_CONTEXT IrpContext, IN BOOLEAN CreatePrimaryLink, IN PSCB ParentScb, IN PFCB Fcb, IN PFILE_NAME FileNameAttr, IN PBOOLEAN LogIt OPTIONAL, OUT PUCHAR FileNameFlags, OUT PQUICK_INDEX QuickIndex OPTIONAL, IN PNAME_PAIR NamePair OPTIONAL, IN PINDEX_CONTEXT IndexContext OPTIONAL ); VOID NtfsRemoveLink ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN PSCB ParentScb, IN UNICODE_STRING LinkName, IN OUT PNAME_PAIR NamePair OPTIONAL, IN OUT PNTFS_TUNNELED_DATA TunneledData OPTIONAL ); VOID NtfsRemoveLinkViaFlags ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN PSCB Scb, IN UCHAR FileNameFlags, IN OUT PNAME_PAIR NamePair OPTIONAL, OUT PUNICODE_STRING FileName OPTIONAL ); VOID NtfsUpdateFileNameFlags ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN PSCB ParentScb, IN UCHAR FileNameFlags, IN PFILE_NAME FileNameLink ); // // These routines are intended for low-level attribute access, such as within // attrsup, or for applying update operations from the log during restart. // VOID NtfsRestartInsertAttribute ( IN PIRP_CONTEXT IrpContext, IN PFILE_RECORD_SEGMENT_HEADER FileRecord, IN ULONG RecordOffset, IN PATTRIBUTE_RECORD_HEADER Attribute, IN PUNICODE_STRING AttributeName OPTIONAL, IN PVOID ValueOrMappingPairs OPTIONAL, IN ULONG Length ); VOID NtfsRestartRemoveAttribute ( IN PIRP_CONTEXT IrpContext, IN PFILE_RECORD_SEGMENT_HEADER FileRecord, IN ULONG RecordOffset ); VOID NtfsRestartChangeAttributeSize ( IN PIRP_CONTEXT IrpContext, IN PFILE_RECORD_SEGMENT_HEADER FileRecord, IN PATTRIBUTE_RECORD_HEADER Attribute, IN ULONG NewRecordLength ); VOID NtfsRestartChangeValue ( IN PIRP_CONTEXT IrpContext, IN PFILE_RECORD_SEGMENT_HEADER FileRecord, IN ULONG RecordOffset, IN ULONG AttributeOffset, IN PVOID Data OPTIONAL, IN ULONG Length, IN BOOLEAN SetNewLength ); VOID NtfsRestartChangeMapping ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN PFILE_RECORD_SEGMENT_HEADER FileRecord, IN ULONG RecordOffset, IN ULONG AttributeOffset, IN PVOID Data, IN ULONG Length ); VOID NtfsRestartWriteEndOfFileRecord ( IN PFILE_RECORD_SEGMENT_HEADER FileRecord, IN PATTRIBUTE_RECORD_HEADER OldAttribute, IN PATTRIBUTE_RECORD_HEADER NewAttributes, IN ULONG SizeOfNewAttributes ); // // Bitmap support routines. Implemented in BitmpSup.c // // // The following routines are used for allocating and deallocating clusters // on the disk. The first routine initializes the allocation support // routines and must be called for each newly mounted/verified volume. // The next two routines allocate and deallocate clusters via Mcbs. // The last three routines are simple query routines. // VOID NtfsInitializeClusterAllocation ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb ); BOOLEAN NtfsAllocateClusters ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN OUT PSCB Scb, IN VCN StartingVcn, IN BOOLEAN AllocateAll, IN LONGLONG ClusterCount, IN PLCN TargetLcn OPTIONAL, IN OUT PLONGLONG DesiredClusterCount ); VOID NtfsAddBadCluster ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN LCN Lcn ); BOOLEAN NtfsDeallocateClusters ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN PSCB Scb, IN VCN StartingVcn, IN VCN EndingVcn, OUT PLONGLONG TotalAllocated OPTIONAL ); VOID NtfsPreAllocateClusters ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN LCN StartingLcn, IN LONGLONG ClusterCount, OUT PBOOLEAN AcquiredBitmap, OUT PBOOLEAN AcquiredMft ); VOID NtfsCleanupClusterAllocationHints ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN PNTFS_MCB Mcb ); VOID NtfsScanEntireBitmap ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN LOGICAL CachedRunsOnly ); VOID NtfsModifyBitsInBitmap ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN LONGLONG FirstBit, IN LONGLONG BeyondFinalBit, IN ULONG RedoOperation, IN ULONG UndoOperation ); typedef enum _NTFS_RUN_STATE { RunStateUnknown = 1, RunStateFree, RunStateAllocated } NTFS_RUN_STATE; typedef NTFS_RUN_STATE *PNTFS_RUN_STATE; BOOLEAN NtfsAddCachedRun ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN LCN StartingLcn, IN LONGLONG ClusterCount, IN NTFS_RUN_STATE RunState ); // // The following two routines are called at Restart to make bitmap // operations in the volume bitmap recoverable. // VOID NtfsRestartSetBitsInBitMap ( IN PIRP_CONTEXT IrpContext, IN PRTL_BITMAP Bitmap, IN ULONG BitMapOffset, IN ULONG NumberOfBits ); VOID NtfsRestartClearBitsInBitMap ( IN PIRP_CONTEXT IrpContext, IN PRTL_BITMAP Bitmap, IN ULONG BitMapOffset, IN ULONG NumberOfBits ); // // The following routines are for allocating and deallocating records // based on a bitmap attribute (e.g., allocating mft file records based on // the bitmap attribute of the mft). If necessary the routines will // also extend/truncate the data and bitmap attributes to satisfy the // operation. // VOID NtfsInitializeRecordAllocation ( IN PIRP_CONTEXT IrpContext, IN PSCB DataScb, IN PATTRIBUTE_ENUMERATION_CONTEXT BitmapAttribute, IN ULONG BytesPerRecord, IN ULONG ExtendGranularity, // In terms of records IN ULONG TruncateGranularity, // In terms of records IN OUT PRECORD_ALLOCATION_CONTEXT RecordAllocationContext ); VOID NtfsUninitializeRecordAllocation ( IN PIRP_CONTEXT IrpContext, IN OUT PRECORD_ALLOCATION_CONTEXT RecordAllocationContext ); ULONG NtfsAllocateRecord ( IN PIRP_CONTEXT IrpContext, IN PRECORD_ALLOCATION_CONTEXT RecordAllocationContext, IN PATTRIBUTE_ENUMERATION_CONTEXT BitmapAttribute ); VOID NtfsDeallocateRecord ( IN PIRP_CONTEXT IrpContext, IN PRECORD_ALLOCATION_CONTEXT RecordAllocationContext, IN ULONG Index, IN PATTRIBUTE_ENUMERATION_CONTEXT BitmapAttribute ); VOID NtfsReserveMftRecord ( IN PIRP_CONTEXT IrpContext, IN OUT PVCB Vcb, IN PATTRIBUTE_ENUMERATION_CONTEXT BitmapAttribute ); ULONG NtfsAllocateMftReservedRecord ( IN OUT PIRP_CONTEXT IrpContext, IN OUT PVCB Vcb, IN PATTRIBUTE_ENUMERATION_CONTEXT BitmapAttribute ); VOID NtfsDeallocateRecordsComplete ( IN PIRP_CONTEXT IrpContext ); BOOLEAN NtfsIsRecordAllocated ( IN PIRP_CONTEXT IrpContext, IN PRECORD_ALLOCATION_CONTEXT RecordAllocationContext, IN ULONG Index, IN PATTRIBUTE_ENUMERATION_CONTEXT BitmapAttribute ); VOID NtfsScanMftBitmap ( IN PIRP_CONTEXT IrpContext, IN OUT PVCB Vcb ); BOOLEAN NtfsCreateMftHole ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb ); BOOLEAN NtfsFindMftFreeTail ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, OUT PLONGLONG FileOffset ); // // Routines to handle the cached runs. // VOID NtfsInitializeCachedRuns ( IN PNTFS_CACHED_RUNS CachedRuns ); VOID NtfsReinitializeCachedRuns ( IN PNTFS_CACHED_RUNS CachedRuns ); VOID NtfsUninitializeCachedRuns ( IN PNTFS_CACHED_RUNS CachedRuns ); // // Buffer control routines for data caching using internal attribute // streams implemented in CacheSup.c // #define NtfsCreateInternalAttributeStream(IC,S,U,NM) { \ NtfsCreateInternalStreamCommon((IC),(S),(U),FALSE,(NM)); \ } #define NtfsCreateInternalCompressedStream(IC,S,U,NM) { \ NtfsCreateInternalStreamCommon((IC),(S),(U),TRUE,(NM)); \ } #define NtfsClearInternalFilename(_FileObject) { \ (_FileObject)->FileName.MaximumLength = 0; \ (_FileObject)->FileName.Length = 0; \ (_FileObject)->FileName.Buffer = NULL; \ } VOID NtfsCreateInternalStreamCommon ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb, IN BOOLEAN UpdateScb, IN BOOLEAN CompressedStream, IN UNICODE_STRING const *StreamName ); BOOLEAN NtfsDeleteInternalAttributeStream ( IN PSCB Scb, IN ULONG ForceClose, IN ULONG CompressedStreamOnly ); // // The following routines provide direct access to data in an attribute. // VOID NtfsMapStream ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb, IN LONGLONG FileOffset, IN ULONG Length, OUT PVOID *Bcb, OUT PVOID *Buffer ); VOID NtfsPinMappedData ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb, IN LONGLONG FileOffset, IN ULONG Length, IN OUT PVOID *Bcb ); VOID NtfsPinStream ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb, IN LONGLONG FileOffset, IN ULONG Length, OUT PVOID *Bcb, OUT PVOID *Buffer ); VOID NtfsPreparePinWriteStream ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb, IN LONGLONG FileOffset, IN ULONG Length, IN BOOLEAN Zero, OUT PVOID *Bcb, OUT PVOID *Buffer ); NTSTATUS NtfsCompleteMdl ( IN PIRP_CONTEXT IrpContext, IN PIRP Irp ); BOOLEAN NtfsZeroData ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb, IN PFILE_OBJECT FileObject, IN LONGLONG StartingZero, IN LONGLONG ByteCount, IN OUT PLONGLONG CommittedFileSize OPTIONAL ); // // The following is needed when biasing the SetFileSizes call for the Usn Journal. // // VOID // NtfsSetCcFileSizes ( // IN PFILE_OBJECT FileObject, // IN PSCB Scb, // IN PCC_FILE_SIZES CcSizes // ); // #define NtfsSetCcFileSizes(FO,S,CC) { \ if (FlagOn( (S)->ScbPersist, SCB_PERSIST_USN_JOURNAL )) { \ CC_FILE_SIZES _CcSizes; \ RtlCopyMemory( &_CcSizes, (CC), sizeof( CC_FILE_SIZES )); \ _CcSizes.AllocationSize.QuadPart -= (S)->Vcb->UsnCacheBias; \ _CcSizes.FileSize.QuadPart -= (S)->Vcb->UsnCacheBias; \ CcSetFileSizes( (FO), &_CcSizes ); \ } else { \ CcSetFileSizes( (FO), (CC) ); \ } \ } // // VOID // NtfsFreeBcb ( // IN PIRP_CONTEXT IrpContext, // IN OUT PBCB *Bcb // ); // // VOID // NtfsUnpinBcb ( // IN PIRP_CONTEXT IrpContext, // IN OUT PBCB *Bcb, // ); // #define NtfsFreeBcb(IC,BC) { \ ASSERT_IRP_CONTEXT(IC); \ if (*(BC) != NULL) \ { \ CcFreePinnedData(*(BC)); \ *(BC) = NULL; \ } \ } #ifdef MAPCOUNT_DBG #define NtfsUnpinBcb(IC,BC) { \ if (*(BC) != NULL) \ { \ CcUnpinData(*(BC)); \ (IC)->MapCount--; \ *(BC) = NULL; \ } \ } #else #define NtfsUnpinBcb(IC,BC) { \ if (*(BC) != NULL) \ { \ CcUnpinData(*(BC)); \ *(BC) = NULL; \ } \ } #endif #ifdef MAPCOUNT_DBG #define NtfsUnpinBcbForThread(IC,BC,T) { \ if (*(BC) != NULL) \ { \ CcUnpinDataForThread(*(BC), (T)); \ (IC)->MapCount--; \ *(BC) = NULL; \ } \ } #else #define NtfsUnpinBcbForThread(IC,BC,T) { \ if (*(BC) != NULL) \ { \ CcUnpinDataForThread(*(BC), (T)); \ *(BC) = NULL; \ } \ } #endif INLINE PBCB NtfsRemapBcb ( IN PIRP_CONTEXT IrpContext, IN PBCB Bcb ) { UNREFERENCED_PARAMETER( IrpContext ); #ifdef MAPCOUNT_DBG IrpContext->MapCount++; #endif return CcRemapBcb( Bcb ); } // // Ntfs structure check routines in CheckSup.c // BOOLEAN NtfsCheckFileRecord ( IN PVCB Vcb, IN PFILE_RECORD_SEGMENT_HEADER FileRecord, IN PFILE_REFERENCE FileReference OPTIONAL, OUT PULONG CorruptionHint ); BOOLEAN NtfsCheckAttributeRecord ( IN PVCB Vcb, IN PFILE_RECORD_SEGMENT_HEADER FileRecord, IN PATTRIBUTE_RECORD_HEADER Attribute, IN ULONG CheckHeaderOnly, OUT PULONG CorruptionHint ); BOOLEAN NtfsCheckIndexRoot ( IN PVCB Vcb, IN PINDEX_ROOT IndexRoot, IN ULONG AttributeSize ); BOOLEAN NtfsCheckIndexBuffer ( IN PSCB Scb, IN PINDEX_ALLOCATION_BUFFER IndexBuffer ); BOOLEAN NtfsCheckIndexHeader ( IN PINDEX_HEADER IndexHeader, IN ULONG BytesAvailable ); BOOLEAN NtfsCheckLogRecord ( IN PNTFS_LOG_RECORD_HEADER LogRecord, IN ULONG LogRecordLength, IN TRANSACTION_ID TransactionId, IN ULONG AttributeEntrySize ); BOOLEAN NtfsCheckRestartTable ( IN PRESTART_TABLE RestartTable, IN ULONG TableSize ); // // Collation routines, implemented in ColatSup.c // // These routines perform low-level collation operations, primarily // for IndexSup. All of these routines are dispatched to via dispatch // tables indexed by the collation rule. The dispatch tables are // defined here, and the actual implementations are in colatsup.c // typedef FSRTL_COMPARISON_RESULT (*PCOMPARE_VALUES) ( IN PWCH UnicodeTable, IN ULONG UnicodeTableSize, IN PVOID Value, IN PINDEX_ENTRY IndexEntry, IN FSRTL_COMPARISON_RESULT WildCardIs, IN BOOLEAN IgnoreCase ); typedef BOOLEAN (*PIS_IN_EXPRESSION) ( IN PWCH UnicodeTable, IN PVOID Value, IN PINDEX_ENTRY IndexEntry, IN BOOLEAN IgnoreCase ); typedef BOOLEAN (*PARE_EQUAL) ( IN PWCH UnicodeTable, IN PVOID Value, IN PINDEX_ENTRY IndexEntry, IN BOOLEAN IgnoreCase ); typedef BOOLEAN (*PCONTAINS_WILDCARD) ( IN PVOID Value ); typedef VOID (*PUPCASE_VALUE) ( IN PWCH UnicodeTable, IN ULONG UnicodeTableSize, IN OUT PVOID Value ); extern PCOMPARE_VALUES NtfsCompareValues[COLLATION_NUMBER_RULES]; extern PIS_IN_EXPRESSION NtfsIsInExpression[COLLATION_NUMBER_RULES]; extern PARE_EQUAL NtfsIsEqual[COLLATION_NUMBER_RULES]; extern PCONTAINS_WILDCARD NtfsContainsWildcards[COLLATION_NUMBER_RULES]; extern PUPCASE_VALUE NtfsUpcaseValue[COLLATION_NUMBER_RULES]; BOOLEAN NtfsFileNameIsInExpression ( IN PWCH UnicodeTable, IN PFILE_NAME ExpressionName, IN PFILE_NAME FileName, IN BOOLEAN IgnoreCase ); BOOLEAN NtfsFileNameIsEqual ( IN PWCH UnicodeTable, IN PFILE_NAME ExpressionName, IN PFILE_NAME FileName, IN BOOLEAN IgnoreCase ); // // Compression on the wire routines in CowSup.c // BOOLEAN NtfsCopyReadC ( IN PFILE_OBJECT FileObject, IN PLARGE_INTEGER FileOffset, IN ULONG Length, IN ULONG LockKey, OUT PVOID Buffer, OUT PMDL *MdlChain, OUT PIO_STATUS_BLOCK IoStatus, OUT PCOMPRESSED_DATA_INFO CompressedDataInfo, IN ULONG CompressedDataInfoLength, IN PDEVICE_OBJECT DeviceObject ); NTSTATUS NtfsCompressedCopyRead ( IN PFILE_OBJECT FileObject, IN PLARGE_INTEGER FileOffset, IN ULONG Length, OUT PVOID Buffer, OUT PMDL *MdlChain, OUT PCOMPRESSED_DATA_INFO CompressedDataInfo, IN ULONG CompressedDataInfoLength, IN PDEVICE_OBJECT DeviceObject, IN PNTFS_ADVANCED_FCB_HEADER Header, IN ULONG CompressionUnitSize, IN ULONG ChunkSize ); BOOLEAN NtfsMdlReadCompleteCompressed ( IN struct _FILE_OBJECT *FileObject, IN PMDL MdlChain, IN struct _DEVICE_OBJECT *DeviceObject ); BOOLEAN NtfsCopyWriteC ( IN PFILE_OBJECT FileObject, IN PLARGE_INTEGER FileOffset, IN ULONG Length, IN ULONG LockKey, IN PVOID Buffer, OUT PMDL *MdlChain, OUT PIO_STATUS_BLOCK IoStatus, IN PCOMPRESSED_DATA_INFO CompressedDataInfo, IN ULONG CompressedDataInfoLength, IN PDEVICE_OBJECT DeviceObject ); NTSTATUS NtfsCompressedCopyWrite ( IN PFILE_OBJECT FileObject, IN PLARGE_INTEGER FileOffset, IN ULONG Length, IN PVOID Buffer, OUT PMDL *MdlChain, IN PCOMPRESSED_DATA_INFO CompressedDataInfo, IN PDEVICE_OBJECT DeviceObject, IN PNTFS_ADVANCED_FCB_HEADER Header, IN ULONG CompressionUnitSize, IN ULONG ChunkSize, IN ULONG EngineMatches ); BOOLEAN NtfsMdlWriteCompleteCompressed ( IN struct _FILE_OBJECT *FileObject, IN PLARGE_INTEGER FileOffset, IN PMDL MdlChain, IN struct _DEVICE_OBJECT *DeviceObject ); NTSTATUS NtfsSynchronizeUncompressedIo ( IN PSCB Scb, IN PLONGLONG FileOffset OPTIONAL, IN ULONG Length, IN ULONG WriteAccess, IN OUT PCOMPRESSION_SYNC *CompressionSync ); NTSTATUS NtfsSynchronizeCompressedIo ( IN PSCB Scb, IN PLONGLONG FileOffset, IN ULONG Length, IN ULONG WriteAccess, IN OUT PCOMPRESSION_SYNC *CompressionSync ); PCOMPRESSION_SYNC NtfsAcquireCompressionSync ( IN LONGLONG FileOffset, IN PSCB Scb, IN ULONG WriteAccess ); VOID NtfsReleaseCompressionSync ( IN PCOMPRESSION_SYNC CompressionSync ); INLINE VOID NtfsSetBothCacheSizes ( IN PFILE_OBJECT FileObject, IN PCC_FILE_SIZES FileSizes, IN PSCB Scb ) { if (Scb->NonpagedScb->SegmentObject.SharedCacheMap != NULL) { NtfsSetCcFileSizes( FileObject, Scb, FileSizes ); } #ifdef COMPRESS_ON_WIRE if (Scb->Header.FileObjectC != NULL) { CcSetFileSizes( Scb->Header.FileObjectC, FileSizes ); } #endif } // // Device I/O routines, implemented in DevIoSup.c // // These routines perform the actual device read and writes. They only affect // the on disk structure and do not alter any other data structures. // VOID NtfsLockUserBuffer ( IN PIRP_CONTEXT IrpContext, IN OUT PIRP Irp, IN LOCK_OPERATION Operation, IN ULONG BufferLength ); PVOID NtfsMapUserBuffer ( IN OUT PIRP Irp ); NTSTATUS NtfsVolumeDasdIo ( IN PIRP_CONTEXT IrpContext, IN PIRP Irp, IN PVCB Vcb, IN VBO StartingVbo, IN ULONG ByteCount ); VOID NtfsPagingFileIo ( IN PIRP_CONTEXT IrpContext, IN PIRP Irp, IN PSCB Scb, IN VBO StartingVbo, IN ULONG ByteCount ); BOOLEAN NtfsIsReadAheadThread ( ); // // Values for StreamFlags passed to NtfsNonCachedIo, etc. // #define COMPRESSED_STREAM 0x00000001 #define ENCRYPTED_STREAM 0x00000002 NTSTATUS NtfsNonCachedIo ( IN PIRP_CONTEXT IrpContext, IN PIRP Irp, IN PSCB Scb, IN VBO StartingVbo, IN ULONG ByteCount, IN ULONG StreamFlags ); VOID NtfsNonCachedNonAlignedIo ( IN PIRP_CONTEXT IrpContext, IN PIRP Irp, IN PSCB Scb, IN VBO StartingVbo, IN ULONG ByteCount ); #ifdef EFSDBG NTSTATUS NtfsDummyEfsRead ( IN OUT PUCHAR InOutBuffer, IN PLARGE_INTEGER Offset, IN ULONG BufferSize, IN PVOID Context ); NTSTATUS NtfsDummyEfsWrite ( IN PUCHAR InBuffer, OUT PUCHAR OutBuffer, IN PLARGE_INTEGER Offset, IN ULONG BufferSize, IN PUCHAR Context ); #endif VOID NtfsTransformUsaBlock ( IN PSCB Scb, IN OUT PVOID SystemBuffer, IN OUT PVOID Buffer, IN ULONG Length ); VOID NtfsCreateMdlAndBuffer ( IN PIRP_CONTEXT IrpContext, IN PSCB ThisScb, IN UCHAR NeedTwoBuffers, IN OUT PULONG Length, OUT PMDL *Mdl OPTIONAL, OUT PVOID *Buffer ); VOID NtfsDeleteMdlAndBuffer ( IN PMDL Mdl OPTIONAL, IN PVOID Buffer OPTIONAL ); VOID NtfsWriteClusters ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN PSCB Scb, IN VBO StartingVbo, IN PVOID Buffer, IN ULONG ClusterCount ); BOOLEAN NtfsVerifyAndRevertUsaBlock ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb, IN OUT PVOID Buffer, IN ULONG Length, IN LONGLONG FileOffset ); NTSTATUS NtfsDefragFile ( IN PIRP_CONTEXT IrpContext, IN PIRP Irp ); NTSTATUS NtfsReadFromPlex( IN PIRP_CONTEXT IrpContext, IN PIRP Irp ); // // The following support routines are contained int Ea.c // PFILE_FULL_EA_INFORMATION NtfsMapExistingEas ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, OUT PBCB *EaBcb, OUT PULONG EaLength ); NTSTATUS NtfsBuildEaList ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN OUT PEA_LIST_HEADER EaListHeader, IN PFILE_FULL_EA_INFORMATION UserEaList, OUT PULONG_PTR ErrorOffset ); VOID NtfsReplaceFileEas ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN PEA_LIST_HEADER EaList ); // // The following routines are used to manipulate the fscontext fields // of the file object, implemented in FilObSup.c // typedef enum _TYPE_OF_OPEN { UnopenedFileObject = 1, UserFileOpen, UserDirectoryOpen, UserVolumeOpen, StreamFileOpen, UserViewIndexOpen } TYPE_OF_OPEN; VOID NtfsSetFileObject ( IN PFILE_OBJECT FileObject, IN TYPE_OF_OPEN TypeOfOpen, IN PSCB Scb, IN PCCB Ccb OPTIONAL ); // // TYPE_OF_OPEN // NtfsDecodeFileObject ( // IN PIRP_CONTEXT IrpContext, // IN PFILE_OBJECT FileObject, // OUT PVCB *Vcb, // OUT PFCB *Fcb, // OUT PSCB *Scb, // OUT PCCB *Ccb, // IN BOOLEAN RaiseOnError // ); // #ifdef _DECODE_MACRO_ #define NtfsDecodeFileObject(IC,FO,V,F,S,C,R) ( \ ( *(S) = (PSCB)(FO)->FsContext), \ ((*(S) != NULL) \ ? ((*(V) = (*(S))->Vcb), \ (*(C) = (PCCB)(FO)->FsContext2), \ (*(F) = (*(S))->Fcb), \ ((R) \ && !FlagOn((*(V))->VcbState, VCB_STATE_VOLUME_MOUNTED) \ && ((*(C) == NULL) \ || ((*(C))->TypeOfOpen != UserVolumeOpen) \ || !FlagOn((*(V))->VcbState, VCB_STATE_LOCKED)) \ && NtfsRaiseStatusFunction((IC), (STATUS_VOLUME_DISMOUNTED))), \ ((*(C) == NULL) \ ? StreamFileOpen \ : (*(C))->TypeOfOpen)) \ : (*(C) = NULL, \ UnopenedFileObject)) \ ) #else // _DECODE_MACRO_ INLINE TYPE_OF_OPEN NtfsDecodeFileObject ( IN PIRP_CONTEXT IrpContext, IN PFILE_OBJECT FileObject, OUT PVCB *Vcb, OUT PFCB *Fcb, OUT PSCB *Scb, OUT PCCB *Ccb, IN BOOLEAN RaiseOnError ) /*++ Routine Description: This routine decodes a file object into a Vcb, Fcb, Scb, and Ccb. Arguments: IrpContext - The Irp context to use for raising on an error. FileObject - The file object to decode. Vcb - Where to store the Vcb. Fcb - Where to store the Fcb. Scb - Where to store the Scb. Ccb - Where to store the Ccb. RaiseOnError - If FALSE, we do not raise if we encounter an error. Otherwise we do raise if we encounter an error. Return Value: Type of open --*/ { *Scb = (PSCB)FileObject->FsContext; if (*Scb != NULL) { *Vcb = (*Scb)->Vcb; *Ccb = (PCCB)FileObject->FsContext2; *Fcb = (*Scb)->Fcb; // // If the caller wants us to raise, let's see if there's anything // we should raise. // if (RaiseOnError && !FlagOn((*Vcb)->VcbState, VCB_STATE_VOLUME_MOUNTED) && ((*Ccb == NULL) || ((*Ccb)->TypeOfOpen != UserVolumeOpen) || !FlagOn((*Vcb)->VcbState, VCB_STATE_LOCKED))) { NtfsRaiseStatusFunction( IrpContext, STATUS_VOLUME_DISMOUNTED ); } // // Every open except a StreamFileOpen has a Ccb. // if (*Ccb == NULL) { return StreamFileOpen; } else { return (*Ccb)->TypeOfOpen; } } else { // // No Scb, we assume the file wasn't open. // *Ccb = NULL; return UnopenedFileObject; } } #endif // _DECODE_MACRO_ // // PSCB // NtfsFastDecodeUserFileOpen ( // IN PFILE_OBJECT FileObject // ); // #define NtfsFastDecodeUserFileOpen(FO) ( \ (((FO)->FsContext2 != NULL) && (((PCCB)(FO)->FsContext2)->TypeOfOpen == UserFileOpen)) ? \ (PSCB)(FO)->FsContext : NULL \ ) VOID NtfsUpdateScbFromFileObject ( IN PIRP_CONTEXT IrpContext, IN PFILE_OBJECT FileObject, IN PSCB Scb, IN BOOLEAN CheckTimeStamps ); // // Ntfs-private FastIo routines. // BOOLEAN NtfsCopyReadA ( IN PFILE_OBJECT FileObject, IN PLARGE_INTEGER FileOffset, IN ULONG Length, IN BOOLEAN Wait, IN ULONG LockKey, OUT PVOID Buffer, OUT PIO_STATUS_BLOCK IoStatus, IN PDEVICE_OBJECT DeviceObject ); BOOLEAN NtfsCopyWriteA ( IN PFILE_OBJECT FileObject, IN PLARGE_INTEGER FileOffset, IN ULONG Length, IN BOOLEAN Wait, IN ULONG LockKey, IN PVOID Buffer, OUT PIO_STATUS_BLOCK IoStatus, IN PDEVICE_OBJECT DeviceObject ); BOOLEAN NtfsMdlReadA ( IN PFILE_OBJECT FileObject, IN PLARGE_INTEGER FileOffset, IN ULONG Length, IN ULONG LockKey, OUT PMDL *MdlChain, OUT PIO_STATUS_BLOCK IoStatus, IN PDEVICE_OBJECT DeviceObject ); BOOLEAN NtfsPrepareMdlWriteA ( IN PFILE_OBJECT FileObject, IN PLARGE_INTEGER FileOffset, IN ULONG Length, IN ULONG LockKey, OUT PMDL *MdlChain, OUT PIO_STATUS_BLOCK IoStatus, IN PDEVICE_OBJECT DeviceObject ); BOOLEAN NtfsWaitForIoAtEof ( IN PNTFS_ADVANCED_FCB_HEADER Header, IN OUT PLARGE_INTEGER FileOffset, IN ULONG Length ); VOID NtfsFinishIoAtEof ( IN PNTFS_ADVANCED_FCB_HEADER Header ); // // VOID // FsRtlLockFsRtlHeader ( // IN PNTFS_ADVANCED_FCB_HEADER FsRtlHeader // ); // // VOID // FsRtlUnlockFsRtlHeader ( // IN PNTFS_ADVANCED_FCB_HEADER FsRtlHeader // ); // #define FsRtlLockFsRtlHeader(H) { \ ExAcquireFastMutex( (H)->FastMutex ); \ if (((H)->Flags & FSRTL_FLAG_EOF_ADVANCE_ACTIVE)) { \ NtfsWaitForIoAtEof( (H), &LiEof, 0 ); \ } \ (H)->Flags |= FSRTL_FLAG_EOF_ADVANCE_ACTIVE; \ ExReleaseFastMutex( (H)->FastMutex ); \ } #define FsRtlUnlockFsRtlHeader(H) { \ ExAcquireFastMutex( (H)->FastMutex ); \ NtfsFinishIoAtEof( (H) ); \ ExReleaseFastMutex( (H)->FastMutex ); \ } // // Volume locking/unlocking routines, implemented in FsCtrl.c. // NTSTATUS NtfsLockVolumeInternal ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN PFILE_OBJECT FileObjectWithVcbLocked, IN OUT PULONG Retrying ); NTSTATUS NtfsUnlockVolumeInternal ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb ); // // Indexing routine interfaces, implemented in IndexSup.c. // VOID NtfsCreateIndex ( IN PIRP_CONTEXT IrpContext, IN OUT PFCB Fcb, IN ATTRIBUTE_TYPE_CODE IndexedAttributeType, IN COLLATION_RULE CollationRule, IN ULONG BytesPerIndexBuffer, IN UCHAR BlocksPerIndexBuffer, IN PATTRIBUTE_ENUMERATION_CONTEXT Context OPTIONAL, IN USHORT AttributeFlags, IN BOOLEAN NewIndex, IN BOOLEAN LogIt ); VOID NtfsUpdateIndexScbFromAttribute ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb, IN PATTRIBUTE_RECORD_HEADER IndexRootAttr, IN ULONG MustBeFileName ); BOOLEAN NtfsFindIndexEntry ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb, IN PVOID Value, IN BOOLEAN IgnoreCase, OUT PQUICK_INDEX QuickIndex OPTIONAL, OUT PBCB *Bcb, OUT PINDEX_ENTRY *IndexEntry, OUT PINDEX_CONTEXT IndexContext OPTIONAL ); VOID NtfsUpdateFileNameInIndex ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb, IN PFILE_NAME FileName, IN PDUPLICATED_INFORMATION Info, IN OUT PQUICK_INDEX QuickIndex OPTIONAL ); VOID NtfsAddIndexEntry ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb, IN PVOID Value, IN ULONG ValueLength, IN PFILE_REFERENCE FileReference, IN PINDEX_CONTEXT IndexContext OPTIONAL, OUT PQUICK_INDEX QuickIndex OPTIONAL ); VOID NtfsDeleteIndexEntry ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb, IN PVOID Value, IN PFILE_REFERENCE FileReference ); VOID NtfsPushIndexRoot ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb ); BOOLEAN NtfsRestartIndexEnumeration ( IN PIRP_CONTEXT IrpContext, IN PCCB Ccb, IN PSCB Scb, IN PVOID Value, IN BOOLEAN IgnoreCase, IN BOOLEAN NextFlag, OUT PINDEX_ENTRY *IndexEntry, IN PFCB AcquiredFcb OPTIONAL ); BOOLEAN NtfsContinueIndexEnumeration ( IN PIRP_CONTEXT IrpContext, IN PCCB Ccb, IN PSCB Scb, IN BOOLEAN NextFlag, OUT PINDEX_ENTRY *IndexEntry ); PFILE_NAME NtfsRetrieveOtherFileName ( IN PIRP_CONTEXT IrpContext, IN PCCB Ccb, IN PSCB Scb, IN PINDEX_ENTRY IndexEntry, IN OUT PINDEX_CONTEXT OtherContext, IN PFCB AcquiredFcb OPTIONAL, OUT PBOOLEAN SynchronizationError ); VOID NtfsCleanupAfterEnumeration ( IN PIRP_CONTEXT IrpContext, IN PCCB Ccb ); BOOLEAN NtfsIsIndexEmpty ( IN PIRP_CONTEXT IrpContext, IN PATTRIBUTE_RECORD_HEADER Attribute ); VOID NtfsDeleteIndex ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN PUNICODE_STRING AttributeName ); VOID NtfsInitializeIndexContext ( OUT PINDEX_CONTEXT IndexContext ); VOID NtfsCleanupIndexContext ( IN PIRP_CONTEXT IrpContext, OUT PINDEX_CONTEXT IndexContext ); VOID NtfsReinitializeIndexContext ( IN PIRP_CONTEXT IrpContext, OUT PINDEX_CONTEXT IndexContext ); // // PVOID // NtfsFoundIndexEntry ( // IN PIRP_CONTEXT IrpContext, // IN PINDEX_ENTRY IndexEntry // ); // #define NtfsFoundIndexEntry(IE) ((PVOID) \ ((PUCHAR) (IE) + sizeof( INDEX_ENTRY )) \ ) // // Restart routines for IndexSup // VOID NtfsRestartInsertSimpleRoot ( IN PIRP_CONTEXT IrpContext, IN PINDEX_ENTRY InsertIndexEntry, IN PFILE_RECORD_SEGMENT_HEADER FileRecord, IN PATTRIBUTE_RECORD_HEADER Attribute, IN PINDEX_ENTRY BeforeIndexEntry ); VOID NtfsRestartInsertSimpleAllocation ( IN PINDEX_ENTRY InsertIndexEntry, IN PINDEX_ALLOCATION_BUFFER IndexBuffer, IN PINDEX_ENTRY BeforeIndexEntry ); VOID NtfsRestartWriteEndOfIndex ( IN PINDEX_HEADER IndexHeader, IN PINDEX_ENTRY OverwriteIndexEntry, IN PINDEX_ENTRY FirstNewIndexEntry, IN ULONG Length ); VOID NtfsRestartSetIndexBlock( IN PINDEX_ENTRY IndexEntry, IN LONGLONG IndexBlock ); VOID NtfsRestartUpdateFileName( IN PINDEX_ENTRY IndexEntry, IN PDUPLICATED_INFORMATION Info ); VOID NtfsRestartDeleteSimpleRoot ( IN PIRP_CONTEXT IrpContext, IN PINDEX_ENTRY IndexEntry, IN PFILE_RECORD_SEGMENT_HEADER FileRecord, IN PATTRIBUTE_RECORD_HEADER Attribute ); VOID NtfsRestartDeleteSimpleAllocation ( IN PINDEX_ENTRY IndexEntry, IN PINDEX_ALLOCATION_BUFFER IndexBuffer ); VOID NtOfsRestartUpdateDataInIndex( IN PINDEX_ENTRY IndexEntry, IN PVOID IndexData, IN ULONG Length ); // // Ntfs hashing routines, implemented in HashSup.c // VOID NtfsInitializeHashTable ( IN OUT PNTFS_HASH_TABLE Table ); VOID NtfsUninitializeHashTable ( IN OUT PNTFS_HASH_TABLE Table ); PLCB NtfsFindPrefixHashEntry ( IN PIRP_CONTEXT IrpContext, IN PNTFS_HASH_TABLE Table, IN PSCB ParentScb, IN OUT PULONG CreateFlags, IN OUT PFCB *CurrentFcb, OUT PULONG FileHashValue, OUT PULONG FileNameLength, OUT PULONG ParentHashValue, OUT PULONG ParentNameLength, IN OUT PUNICODE_STRING RemainingName ); VOID NtfsInsertHashEntry ( IN PNTFS_HASH_TABLE Table, IN PLCB HashLcb, IN ULONG NameLength, IN ULONG HashValue ); VOID NtfsRemoveHashEntry ( IN PNTFS_HASH_TABLE Table, IN PLCB HashLcb ); // // VOID // NtfsRemoveHashEntriesForLcb ( // IN PLCB Lcb // ); // #define NtfsRemoveHashEntriesForLcb(L) { \ if (FlagOn( (L)->LcbState, LCB_STATE_VALID_HASH_VALUE )) { \ NtfsRemoveHashEntry( &(L)->Fcb->Vcb->HashTable, \ (L) ); \ } \ } // // Ntfs Logging Routine interfaces in LogSup.c // LSN NtfsWriteLog ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb, IN PBCB Bcb OPTIONAL, IN NTFS_LOG_OPERATION RedoOperation, IN PVOID RedoBuffer OPTIONAL, IN ULONG RedoLength, IN NTFS_LOG_OPERATION UndoOperation, IN PVOID UndoBuffer OPTIONAL, IN ULONG UndoLength, IN LONGLONG StreamOffset, IN ULONG RecordOffset, IN ULONG AttributeOffset, IN ULONG StructureSize ); VOID NtfsCheckpointVolume ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN BOOLEAN OwnsCheckpoint, IN BOOLEAN CleanVolume, IN BOOLEAN FlushVolume, IN ULONG LfsFlags, IN LSN LastKnownLsn ); VOID NtfsCheckpointForLogFileFull ( IN PIRP_CONTEXT IrpContext ); NTSTATUS NtfsCheckpointForVolumeSnapshot ( IN PIRP_CONTEXT IrpContext ); VOID NtfsCleanCheckpoint ( IN PVCB Vcb ); VOID NtfsCommitCurrentTransaction ( IN PIRP_CONTEXT IrpContext ); VOID NtfsCheckpointCurrentTransaction ( IN PIRP_CONTEXT IrpContext ); VOID NtfsInitializeLogging ( ); VOID NtfsStartLogFile ( IN PSCB LogFileScb, IN PVCB Vcb ); VOID NtfsStopLogFile ( IN PVCB Vcb ); VOID NtfsInitializeRestartTable ( IN ULONG EntrySize, IN ULONG NumberEntries, OUT PRESTART_POINTERS TablePointer ); VOID InitializeNewTable ( IN ULONG EntrySize, IN ULONG NumberEntries, OUT PRESTART_POINTERS TablePointer ); VOID NtfsFreeRestartTable ( IN PRESTART_POINTERS TablePointer ); VOID NtfsExtendRestartTable ( IN PRESTART_POINTERS TablePointer, IN ULONG NumberNewEntries, IN ULONG FreeGoal ); ULONG NtfsAllocateRestartTableIndex ( IN PRESTART_POINTERS TablePointer, IN ULONG Exclusive ); PVOID NtfsAllocateRestartTableFromIndex ( IN PRESTART_POINTERS TablePointer, IN ULONG Index ); VOID NtfsFreeRestartTableIndex ( IN PRESTART_POINTERS TablePointer, IN ULONG Index ); PVOID NtfsGetFirstRestartTable ( IN PRESTART_POINTERS TablePointer ); PVOID NtfsGetNextRestartTable ( IN PRESTART_POINTERS TablePointer, IN PVOID Current ); VOID NtfsUpdateOatVersion ( IN PVCB Vcb, IN ULONG NewRestartVersion ); VOID NtfsFreeRecentlyDeallocated ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN PLSN BaseLsn, IN ULONG CleanVolume ); // // // VOID // NtfsFreeOpenAttributeData ( // IN POPEN_ATTRIBUTE_DATA Entry // ); // #define NtfsFreeOpenAttributeData(E) { \ RemoveEntryList( &(E)->Links ); \ NtfsFreePool( E ); \ } // // VOID // NtfsNormalizeAndCleanupTransaction ( // IN PIRP_CONTEXT IrpContext, // IN NTSTATUS *Status, // IN BOOLEAN AlwaysRaise, // IN NTSTATUS NormalizeStatus // ); // #define NtfsNormalizeAndCleanupTransaction(IC,PSTAT,RAISE,NORM_STAT) { \ if (!NT_SUCCESS( (IC)->TopLevelIrpContext->ExceptionStatus )) { \ NtfsRaiseStatus( (IC), (IC)->TopLevelIrpContext->ExceptionStatus, NULL, NULL ); \ } else if (!NT_SUCCESS( *(PSTAT) )) { \ *(PSTAT) = FsRtlNormalizeNtstatus( *(PSTAT), (NORM_STAT) ); \ if ((RAISE) || ((IC)->TopLevelIrpContext->TransactionId != 0)) { \ NtfsRaiseStatus( (IC), *(PSTAT), NULL, NULL ); \ } \ } \ } // // VOID // NtfsCleanupTransaction ( // IN PIRP_CONTEXT IrpContext, // IN NTSTATUS Status, // IN BOOLEAN AlwaysRaise // ); // #define NtfsCleanupTransaction(IC,STAT,RAISE) { \ if (!NT_SUCCESS( (IC)->TopLevelIrpContext->ExceptionStatus )) { \ NtfsRaiseStatus( (IC), (IC)->TopLevelIrpContext->ExceptionStatus, NULL, NULL ); \ } else if (!NT_SUCCESS( STAT ) && \ ((RAISE) || ((IC)->TopLevelIrpContext->TransactionId != 0))) { \ NtfsRaiseStatus( (IC), (STAT), NULL, NULL ); \ } else if (((IC)->Usn.NewReasons != 0) || ((IC)->Usn.RemovedSourceInfo != 0)) { \ NtfsWriteUsnJournalChanges( (IC) ); \ NtfsCommitCurrentTransaction( (IC) ); \ } \ } // // VOID // NtfsCleanupTransactionAndCommit ( // IN PIRP_CONTEXT IrpContext, // IN NTSTATUS Status, // IN BOOLEAN AlwaysRaise // ); // #define NtfsCleanupTransactionAndCommit(IC,STAT,RAISE) { \ if (!NT_SUCCESS( (IC)->TopLevelIrpContext->ExceptionStatus )) { \ NtfsRaiseStatus( (IC), (IC)->TopLevelIrpContext->ExceptionStatus, NULL, NULL ); \ } else if (!NT_SUCCESS( STAT ) && \ ((RAISE) || ((IC)->TopLevelIrpContext->TransactionId != 0))) { \ NtfsRaiseStatus( (IC), (STAT), NULL, NULL ); \ } else if (((IC)->Usn.NewReasons != 0) || ((IC)->Usn.RemovedSourceInfo != 0)) { \ NtfsWriteUsnJournalChanges( (IC) ); \ NtfsCommitCurrentTransaction( (IC) ); \ } else { \ NtfsCommitCurrentTransaction( (IC) ); \ } \ } VOID NtfsCleanupFailedTransaction ( IN PIRP_CONTEXT IrpContext ); // // NTFS MCB support routine, implemented in McbSup.c // // // An Ntfs Mcb is a superset of the regular mcb package. In // addition to the regular Mcb functions it will unload mapping // information to keep it overall memory usage down // VOID NtfsInitializeNtfsMcb ( IN PNTFS_MCB Mcb, IN PNTFS_ADVANCED_FCB_HEADER FcbHeader, IN PNTFS_MCB_INITIAL_STRUCTS McbStructs, IN POOL_TYPE PoolType ); VOID NtfsUninitializeNtfsMcb ( IN PNTFS_MCB Mcb ); VOID NtfsRemoveNtfsMcbEntry ( IN PNTFS_MCB Mcb, IN LONGLONG Vcn, IN LONGLONG Count ); VOID NtfsUnloadNtfsMcbRange ( IN PNTFS_MCB Mcb, IN LONGLONG StartingVcn, IN LONGLONG EndingVcn, IN BOOLEAN TruncateOnly, IN BOOLEAN AlreadySynchronized ); ULONG NtfsNumberOfRangesInNtfsMcb ( IN PNTFS_MCB Mcb ); BOOLEAN NtfsNumberOfRunsInRange( IN PNTFS_MCB Mcb, IN PVOID RangePtr, OUT PULONG NumberOfRuns ); BOOLEAN NtfsLookupLastNtfsMcbEntry ( IN PNTFS_MCB Mcb, OUT PLONGLONG Vcn, OUT PLONGLONG Lcn ); ULONG NtfsMcbLookupArrayIndex ( IN PNTFS_MCB Mcb, IN VCN Vcn ); BOOLEAN NtfsSplitNtfsMcb ( IN PNTFS_MCB Mcb, IN LONGLONG Vcn, IN LONGLONG Amount ); BOOLEAN NtfsAddNtfsMcbEntry ( IN PNTFS_MCB Mcb, IN LONGLONG Vcn, IN LONGLONG Lcn, IN LONGLONG RunCount, IN BOOLEAN AlreadySynchronized ); BOOLEAN NtfsLookupNtfsMcbEntry ( IN PNTFS_MCB Mcb, IN LONGLONG Vcn, OUT PLONGLONG Lcn OPTIONAL, OUT PLONGLONG CountFromLcn OPTIONAL, OUT PLONGLONG StartingLcn OPTIONAL, OUT PLONGLONG CountFromStartingLcn OPTIONAL, OUT PVOID *RangePtr OPTIONAL, OUT PULONG RunIndex OPTIONAL ); BOOLEAN NtfsGetNextNtfsMcbEntry ( IN PNTFS_MCB Mcb, IN PVOID *RangePtr, IN ULONG RunIndex, OUT PLONGLONG Vcn, OUT PLONGLONG Lcn, OUT PLONGLONG Count ); // // BOOLEAN // NtfsGetSequentialMcbEntry ( // IN PNTFS_MCB Mcb, // IN PVOID *RangePtr, // IN ULONG RunIndex, // OUT PLONGLONG Vcn, // OUT PLONGLONG Lcn, // OUT PLONGLONG Count // ); // #define NtfsGetSequentialMcbEntry(MC,RGI,RNI,V,L,C) ( \ NtfsGetNextNtfsMcbEntry(MC,RGI,RNI,V,L,C) || \ (RNI = 0) || \ NtfsGetNextNtfsMcbEntry(MC,RGI,MAXULONG,V,L,C) || \ ((RNI = MAXULONG) == 0) \ ) VOID NtfsDefineNtfsMcbRange ( IN PNTFS_MCB Mcb, IN LONGLONG StartingVcn, IN LONGLONG EndingVcn, IN BOOLEAN AlreadySynchronized ); VOID NtfsSwapMcbs ( IN PNTFS_MCB McbTarget, IN PNTFS_MCB McbSource ); // // VOID // NtfsAcquireNtfsMcbMutex ( // IN PNTFS_MCB Mcb // ); // // VOID // NtfsReleaseNtfsMcbMutex ( // IN PNTFS_MCB Mcb // ); // #define NtfsAcquireNtfsMcbMutex(M) { \ ExAcquireFastMutex((M)->FastMutex); \ } #define NtfsReleaseNtfsMcbMutex(M) { \ ExReleaseFastMutex((M)->FastMutex); \ } // // MFT access routines, implemented in MftSup.c // // // Mft map cache routines. We maintain a cache of active maps in the // IRP_CONTEXT and consult this if we need to map a file record. // INLINE PIRP_FILE_RECORD_CACHE_ENTRY NtfsFindFileRecordCacheEntry ( IN PIRP_CONTEXT IrpContext, IN ULONG UnsafeSegmentNumber ) { #if (IRP_FILE_RECORD_MAP_CACHE_SIZE <= 4) #define PROBECACHE(ic,sn,i) \ ASSERT((ic)->FileRecordCache[(i)].FileRecordBcb != NULL); \ if ((ic)->FileRecordCache[(i)].UnsafeSegmentNumber == (sn)) \ { \ return IrpContext->FileRecordCache + (i); \ } // DebugTrace( 0, 0, ("Context %08x finding %x\n", IrpContext, UnsafeSegmentNumber )); ASSERT(IrpContext->CacheCount <= 4); switch (IrpContext->CacheCount) { case 4: PROBECACHE( IrpContext, UnsafeSegmentNumber, 3 ); // Fallthru case 3: PROBECACHE( IrpContext, UnsafeSegmentNumber, 2 ); // Fallthru case 2: PROBECACHE( IrpContext, UnsafeSegmentNumber, 1 ); // Fallthru case 1: PROBECACHE( IrpContext, UnsafeSegmentNumber, 0 ); // Fallthru case 0: // // redundant default case (and matching assert above) added to quiet // warning 4715: // // "not all control paths return a value." // default: return NULL; } #else PIRP_FILE_RECORD_CACHE_ENTRY Entry; for (Entry = IrpContext->FileRecordCache; Entry < IrpContext->FileRecordCache + IrpContext->CacheCount; Entry++) { ASSERT( Entry->FileRecordBcb != NULL); if (Entry->UnsafeSegmentNumber == UnsafeSegmentNumber) { return Entry; } } return NULL; #endif } INLINE VOID NtfsRemoveFromFileRecordCache ( IN PIRP_CONTEXT IrpContext, IN ULONG UnsafeSegmentNumber ) { PIRP_FILE_RECORD_CACHE_ENTRY Entry = NtfsFindFileRecordCacheEntry( IrpContext, UnsafeSegmentNumber ); // DebugTrace( 0, 0, ("Context %08x removing %x\n", IrpContext, Entry )); if (Entry != NULL) { ASSERT( Entry->FileRecordBcb != NULL ); // // We delete the entry at position [i] by dereferencing the Bcb and // copying the entire structure from [IrpContext->CacheCount] // NtfsUnpinBcb( IrpContext, &Entry->FileRecordBcb ); // // Decrement the active count. If there are no more cache entries, // then we're done. // IrpContext->CacheCount--; if (IrpContext->FileRecordCache + IrpContext->CacheCount != Entry) { *Entry = IrpContext->FileRecordCache[IrpContext->CacheCount]; } } } #ifndef KDEXT INLINE VOID NtfsAddToFileRecordCache ( IN PIRP_CONTEXT IrpContext, IN ULONG UnsafeSegmentNumber, IN PBCB FileRecordBcb, IN PFILE_RECORD_SEGMENT_HEADER FileRecord ) { PAGED_CODE( ); if (IrpContext->CacheCount < IRP_FILE_RECORD_MAP_CACHE_SIZE) { // DebugTrace( 0, 0, ("Context %08x adding %x at %x\n", IrpContext, UnsafeSegmentNumber, // IrpContext->FileRecordCache + IrpContext->CacheCount )); IrpContext->FileRecordCache[IrpContext->CacheCount].UnsafeSegmentNumber = UnsafeSegmentNumber; IrpContext->FileRecordCache[IrpContext->CacheCount].FileRecordBcb = NtfsRemapBcb( IrpContext, FileRecordBcb ); IrpContext->FileRecordCache[IrpContext->CacheCount].FileRecord = FileRecord; IrpContext->CacheCount++; } } #endif INLINE VOID NtfsPurgeFileRecordCache ( IN PIRP_CONTEXT IrpContext ) { while (IrpContext->CacheCount) { IrpContext->CacheCount --; // DebugTrace( 0, 0, ("Context %08x purging %x\n", IrpContext, IrpContext->FileRecordCache + IrpContext->CacheCount )); NtfsUnpinBcb( IrpContext, &IrpContext->FileRecordCache[IrpContext->CacheCount].FileRecordBcb ); } } #if DBG extern ULONG FileRecordCacheHitArray[IRP_FILE_RECORD_MAP_CACHE_SIZE]; #endif // DBG INLINE BOOLEAN NtfsFindCachedFileRecord ( IN PIRP_CONTEXT IrpContext, IN ULONG UnsafeSegmentNumber, OUT PBCB *Bcb, OUT PFILE_RECORD_SEGMENT_HEADER *FileRecord ) { PIRP_FILE_RECORD_CACHE_ENTRY Entry = NtfsFindFileRecordCacheEntry( IrpContext, UnsafeSegmentNumber ); // DebugTrace( 0, 0, ("Context %x finding %x = %x\n", IrpContext, UnsafeSegmentNumber, Entry )); if (Entry == NULL) { return FALSE; } *Bcb = NtfsRemapBcb( IrpContext, Entry->FileRecordBcb ); *FileRecord = Entry->FileRecord; return TRUE; } // // This routine may only be used to read the Base file record segment, and // it checks that this is true. // VOID NtfsReadFileRecord ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN PFILE_REFERENCE FileReference, OUT PBCB *Bcb, OUT PFILE_RECORD_SEGMENT_HEADER *BaseFileRecord, OUT PATTRIBUTE_RECORD_HEADER *FirstAttribute, OUT PLONGLONG MftFileOffset OPTIONAL ); // // These routines can read/pin any record in the MFT. // VOID NtfsReadMftRecord ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN PMFT_SEGMENT_REFERENCE SegmentReference, IN BOOLEAN CheckRecord, OUT PBCB *Bcb, OUT PFILE_RECORD_SEGMENT_HEADER *FileRecord, OUT PLONGLONG MftFileOffset OPTIONAL ); VOID NtfsPinMftRecord ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN PMFT_SEGMENT_REFERENCE SegmentReference, IN BOOLEAN PreparingToWrite, OUT PBCB *Bcb, OUT PFILE_RECORD_SEGMENT_HEADER *FileRecord, OUT PLONGLONG MftFileOffset OPTIONAL ); // // The following routines are used to setup, allocate, and deallocate // file records in the Mft. // MFT_SEGMENT_REFERENCE NtfsAllocateMftRecord ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN BOOLEAN MftData ); VOID NtfsInitializeMftRecord ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN OUT PMFT_SEGMENT_REFERENCE MftSegment, IN OUT PFILE_RECORD_SEGMENT_HEADER FileRecord, IN PBCB Bcb, IN BOOLEAN Directory ); VOID NtfsDeallocateMftRecord ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN ULONG FileNumber ); BOOLEAN NtfsIsMftIndexInHole ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN ULONG Index, OUT PULONG HoleLength OPTIONAL ); VOID NtfsFillMftHole ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN ULONG Index ); VOID NtfsLogMftFileRecord ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN PFILE_RECORD_SEGMENT_HEADER FileRecord, IN LONGLONG MftOffset, IN PBCB FileRecordBcb, IN BOOLEAN RedoOperation ); BOOLEAN NtfsDefragMft ( IN PDEFRAG_MFT DefragMft ); VOID NtfsCheckForDefrag ( IN OUT PVCB Vcb ); VOID NtfsInitializeMftHoleRecords ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN ULONG FirstIndex, IN ULONG RecordCount ); // // Name support routines, implemented in NameSup.c // typedef enum _PARSE_TERMINATION_REASON { EndOfPathReached, NonSimpleName, IllegalCharacterInName, MalFormedName, AttributeOnly, VersionNumberPresent } PARSE_TERMINATION_REASON; #define NtfsDissectName(Path,FirstName,RemainingName) \ ( FsRtlDissectName( Path, FirstName, RemainingName ) ) BOOLEAN NtfsParseName ( IN const UNICODE_STRING Name, IN BOOLEAN WildCardsPermissible, OUT PBOOLEAN FoundIllegalCharacter, OUT PNTFS_NAME_DESCRIPTOR ParsedName ); PARSE_TERMINATION_REASON NtfsParsePath ( IN UNICODE_STRING Path, IN BOOLEAN WildCardsPermissible, OUT PUNICODE_STRING FirstPart, OUT PNTFS_NAME_DESCRIPTOR Name, OUT PUNICODE_STRING RemainingPart ); VOID NtfsPreprocessName ( IN UNICODE_STRING InputString, OUT PUNICODE_STRING FirstPart, OUT PUNICODE_STRING AttributeCode, OUT PUNICODE_STRING AttributeName, OUT PBOOLEAN TrailingBackslash ); VOID NtfsUpcaseName ( IN PWCH UpcaseTable, IN ULONG UpcaseTableSize, IN OUT PUNICODE_STRING InputString ); FSRTL_COMPARISON_RESULT NtfsCollateNames ( IN PCWCH UpcaseTable, IN ULONG UpcaseTableSize, IN PCUNICODE_STRING Expression, IN PCUNICODE_STRING Name, IN FSRTL_COMPARISON_RESULT WildIs, IN BOOLEAN IgnoreCase ); #define NtfsIsNameInExpression(UC,EX,NM,IC) \ FsRtlIsNameInExpression( (EX), (NM), (IC), (UC) ) BOOLEAN NtfsIsFileNameValid ( IN PUNICODE_STRING FileName, IN BOOLEAN WildCardsPermissible ); BOOLEAN NtfsIsFatNameValid ( IN PUNICODE_STRING FileName, IN BOOLEAN WildCardsPermissible ); // // Ntfs works very hard to make sure that all names are kept in upper case // so that most comparisons are done case SENSITIVE. Name testing for // case SENSITIVE can be very quick since RtlEqualMemory is an inline operation // on several processors. // // NtfsAreNamesEqual is used when the caller does not know for sure whether // or not case is important. In the case where IgnoreCase is a known value, // the compiler can easily optimize the relevant clause. // #define NtfsAreNamesEqual(UpcaseTable,Name1,Name2,IgnoreCase) \ ((IgnoreCase) ? FsRtlAreNamesEqual( (Name1), (Name2), (IgnoreCase), (UpcaseTable) ) \ : ((Name1)->Length == (Name2)->Length && \ RtlEqualMemory( (Name1)->Buffer, (Name2)->Buffer, (Name1)->Length ))) // // Object id support routines, implemented in ObjIdSup.c // VOID NtfsInitializeObjectIdIndex ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN PVCB Vcb ); NTSTATUS NtfsSetObjectId ( IN PIRP_CONTEXT IrpContext, IN PIRP Irp ); NTSTATUS NtfsSetObjectIdExtendedInfo ( IN PIRP_CONTEXT IrpContext, IN PIRP Irp ); NTSTATUS NtfsSetObjectIdInternal ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN PVCB Vcb, IN PFILE_OBJECTID_BUFFER ObjectIdBuffer ); NTSTATUS NtfsCreateOrGetObjectId ( IN PIRP_CONTEXT IrpContext, IN PIRP Irp ); NTSTATUS NtfsGetObjectId ( IN PIRP_CONTEXT IrpContext, IN PIRP Irp ); NTSTATUS NtfsGetObjectIdInternal ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN BOOLEAN GetExtendedInfo, OUT FILE_OBJECTID_BUFFER *OutputBuffer ); NTSTATUS NtfsGetObjectIdExtendedInfo ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN UCHAR *ObjectId, IN OUT UCHAR *ExtendedInfo ); NTSTATUS NtfsDeleteObjectId ( IN PIRP_CONTEXT IrpContext, IN PIRP Irp ); NTSTATUS NtfsDeleteObjectIdInternal ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN PVCB Vcb, IN BOOLEAN DeleteFileAttribute ); VOID NtfsRepairObjectId ( IN PIRP_CONTEXT IrpContext, IN PVOID Context ); // // Mount point support routines, implemented in MountSup.c // VOID NtfsInitializeReparsePointIndex ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN PVCB Vcb ); // // Largest matching prefix searching routines, implemented in PrefxSup.c // VOID NtfsInsertPrefix ( IN PLCB Lcb, IN ULONG CreateFlags ); VOID NtfsRemovePrefix ( IN PLCB Lcb ); PLCB NtfsFindPrefix ( IN PIRP_CONTEXT IrpContext, IN PSCB StartingScb, OUT PFCB *CurrentFcb, OUT PLCB *LcbForTeardown, IN OUT UNICODE_STRING FullFileName, IN OUT PULONG CreateFlags, OUT PUNICODE_STRING RemainingName ); BOOLEAN NtfsInsertNameLink ( IN PRTL_SPLAY_LINKS *RootNode, IN PNAME_LINK NameLink ); // // VOID // NtfsRemoveNameLink ( // IN PRTL_SPLAY_LINKS *RootNode, // IN PNAME_LINK NameLink // ); // #define NtfsRemoveNameLink(RN,NL) { \ *(RN) = RtlDelete( &(NL)->Links ); \ } PNAME_LINK NtfsFindNameLink ( IN PRTL_SPLAY_LINKS *RootNode, IN PUNICODE_STRING Name ); // // The following macro is useful for traversing the queue of Prefixes // attached to a given Lcb // // PPREFIX_ENTRY // NtfsGetNextPrefix ( // IN PIRP_CONTEXT IrpContext, // IN PLCB Lcb, // IN PPREFIX_ENTRY PreviousPrefixEntry // ); // #define NtfsGetNextPrefix(IC,LC,PPE) ((PPREFIX_ENTRY) \ ((PPE) == NULL ? \ (IsListEmpty(&(LC)->PrefixQueue) ? \ NULL \ : \ CONTAINING_RECORD((LC)->PrefixQueue.Flink, PREFIX_ENTRY, LcbLinks.Flink) \ ) \ : \ ((PVOID)((PPREFIX_ENTRY)(PPE))->LcbLinks.Flink == &(LC)->PrefixQueue.Flink ? \ NULL \ : \ CONTAINING_RECORD(((PPREFIX_ENTRY)(PPE))->LcbLinks.Flink, PREFIX_ENTRY, LcbLinks.Flink) \ ) \ ) \ ) // // Resources support routines/macros, implemented in ResrcSup.c // // // Flags used in the acquire routines // #define ACQUIRE_NO_DELETE_CHECK (0x00000001) #define ACQUIRE_DONT_WAIT (0x00000002) #define ACQUIRE_HOLD_BITMAP (0x00000004) #define ACQUIRE_WAIT (0x00000008) // // VOID // NtfsAcquireExclusiveGlobal ( // IN PIRP_CONTEXT IrpContext, // IN BOOLEAN Wait // ); // // BOOLEAN // NtfsAcquireSharedGlobal ( // IN PIRP_CONTEXT IrpContext, // IN BOOLEAN Wait // ); // #define NtfsAcquireSharedGlobal( I, W ) ExAcquireResourceSharedLite( &NtfsData.Resource, (W) ) #define NtfsAcquireExclusiveGlobal( I, W ) ExAcquireResourceExclusiveLite( &NtfsData.Resource, (W) ) VOID NtfsAcquireCheckpointSynchronization ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb ); VOID NtfsReleaseCheckpointSynchronization ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb ); // // VOID // NtfsLockNtfsData ( // ); // // VOID // NtfsUnlockNtfsData ( // ); // #define NtfsLockNtfsData() { \ ExAcquireFastMutex( &NtfsData.NtfsDataLock ); \ } #define NtfsUnlockNtfsData() { \ ExReleaseFastMutex( &NtfsData.NtfsDataLock ); \ } VOID NtfsAcquireAllFiles ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN ULONG Exclusive, IN ULONG AcquirePagingIo, IN ULONG AcquireAndDrop ); VOID NtfsReleaseAllFiles ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN BOOLEAN ReleasePagingIo ); BOOLEAN NtfsAcquireExclusiveVcb ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN BOOLEAN RaiseOnCantWait ); BOOLEAN NtfsAcquireSharedVcb ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN BOOLEAN RaiseOnCantWait ); #define NtfsAcquireExclusivePagingIo(IC,FCB) { \ ASSERT((IC)->CleanupStructure == NULL); \ ExAcquireResourceExclusiveLite(((PFCB)(FCB))->PagingIoResource, TRUE); \ (IC)->CleanupStructure = (FCB); \ } #define NtfsReleasePagingIo(IC,FCB) { \ ASSERT((IC)->CleanupStructure == (FCB)); \ ExReleaseResourceLite(((PFCB)(FCB))->PagingIoResource); \ (IC)->CleanupStructure = NULL; \ } BOOLEAN NtfsAcquireFcbWithPaging ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN ULONG AcquireFlags ); VOID NtfsReleaseFcbWithPaging ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb ); VOID NtfsReleaseScbWithPaging ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb ); BOOLEAN NtfsAcquireExclusiveFcb ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN PSCB Scb OPTIONAL, IN ULONG AcquireFlags ); VOID NtfsAcquireSharedFcb ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN PSCB Scb OPTIONAL, IN ULONG AcquireFlags ); BOOLEAN NtfsAcquireSharedFcbCheckWait ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN ULONG AcquireFlags ); VOID NtfsReleaseFcb ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb ); VOID NtfsAcquireExclusiveScb ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb ); #ifdef NTFSDBG BOOLEAN NtfsAcquireResourceExclusive ( IN PIRP_CONTEXT IrpContext OPTIONAL, IN PVOID FcbOrScb, IN BOOLEAN Wait ); #else INLINE BOOLEAN NtfsAcquireResourceExclusive ( IN PIRP_CONTEXT IrpContext OPTIONAL, IN PVOID FcbOrScb, IN BOOLEAN Wait ) { UNREFERENCED_PARAMETER( IrpContext ); if (NTFS_NTC_FCB == ((PFCB)FcbOrScb)->NodeTypeCode) { return ExAcquireResourceExclusiveLite( ((PFCB)FcbOrScb)->Resource, Wait ); } else { return ExAcquireResourceExclusiveLite( ((PSCB)(FcbOrScb))->Header.Resource, Wait ); } } #endif INLINE BOOLEAN NtfsAcquirePagingResourceSharedWaitForExclusive ( IN PIRP_CONTEXT IrpContext OPTIONAL, IN PVOID FcbOrScb, IN BOOLEAN Wait ) { BOOLEAN Result; UNREFERENCED_PARAMETER( IrpContext ); if (NTFS_NTC_FCB == ((PFCB)FcbOrScb)->NodeTypeCode) { Result = ExAcquireSharedWaitForExclusive( ((PFCB)FcbOrScb)->PagingIoResource, Wait ); } else { Result = ExAcquireSharedWaitForExclusive( ((PSCB)(FcbOrScb))->Header.PagingIoResource, Wait ); } return Result; } #ifdef NTFSDBG BOOLEAN NtfsAcquireResourceShared ( IN PIRP_CONTEXT IrpContext OPTIONAL, IN PVOID FcbOrScb, IN BOOLEAN Wait ); #else INLINE BOOLEAN NtfsAcquireResourceShared ( IN PIRP_CONTEXT IrpContext OPTIONAL, IN PVOID FcbOrScb, IN BOOLEAN Wait ) { BOOLEAN Result; UNREFERENCED_PARAMETER( IrpContext ); if (NTFS_NTC_FCB == ((PFCB)FcbOrScb)->NodeTypeCode) { Result = ExAcquireResourceSharedLite( ((PFCB)FcbOrScb)->Resource, Wait ); } else { ASSERT_SCB( FcbOrScb ); Result = ExAcquireResourceSharedLite( ((PSCB)(FcbOrScb))->Header.Resource, Wait ); } return Result; } #endif // // VOID // NtfsReleaseResource( // IN PIRP_CONTEXT IrpContext OPTIONAL, // IN PVOID FcbOrScb // }; // #ifdef NTFSDBG VOID NtfsReleaseResource( IN PIRP_CONTEXT IrpContext OPTIONAL, IN PVOID FcbOrScb ); #else #define NtfsReleaseResource( IC, F ) { \ if (NTFS_NTC_FCB == ((PFCB)(F))->NodeTypeCode) { \ ExReleaseResourceLite( ((PFCB)(F))->Resource ); \ } else { \ ExReleaseResourceLite( ((PSCB)(F))->Header.Resource ); \ } \ } #endif VOID NtfsAcquireSharedScbForTransaction ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb ); VOID NtfsReleaseSharedResources ( IN PIRP_CONTEXT IrpContext ); VOID NtfsReleaseAllResources ( IN PIRP_CONTEXT IrpContext ); VOID NtfsAcquireIndexCcb ( IN PSCB Scb, IN PCCB Ccb, IN PEOF_WAIT_BLOCK EofWaitBlock ); VOID NtfsReleaseIndexCcb ( IN PSCB Scb, IN PCCB Ccb ); // // VOID // NtfsAcquireSharedScb ( // IN PIRP_CONTEXT IrpContext, // IN PSCB Scb // ); // // VOID // NtfsReleaseScb ( // IN PIRP_CONTEXT IrpContext, // IN PSCB Scb // ); // // VOID // NtfsReleaseGlobal ( // IN PIRP_CONTEXT IrpContext // ); // // VOID // NtfsAcquireFcbTable ( // IN PIRP_CONTEXT IrpContext, // IN PVCB Vcb, // ); // // VOID // NtfsReleaseFcbTable ( // IN PIRP_CONTEXT IrpContext, // IN PVCB Vcb // ); // // VOID // NtfsLockVcb ( // IN PIRP_CONTEXT IrpContext, // IN PVCB Vcb // ); // // VOID // NtfsUnlockVcb ( // IN PIRP_CONTEXT IrpContext, // IN PVCB Vcb // ); // // VOID // NtfsLockFcb ( // IN PIRP_CONTEXT IrpContext, // IN PFCB Fcb // ); // // VOID // NtfsUnlockFcb ( // IN PIRP_CONTEXT IrpContext, // IN PFCB Fcb // ); // // VOID // NtfsAcquireFcbSecurity ( // IN PIRP_CONTEXT IrpContext, // IN PVCB Vcb, // ); // // VOID // NtfsReleaseFcbSecurity ( // IN PIRP_CONTEXT IrpContext, // IN PVCB Vcb // ); // // VOID // NtfsAcquireHashTable ( // IN PVCB Vcb // ); // // VOID // NtfsReleaseHashTable ( // IN PVCB Vcb // ); // // VOID // NtfsAcquireCheckpoint ( // IN PIRP_CONTEXT IrpContext, // IN PVCB Vcb, // ); // // VOID // NtfsReleaseCheckpoint ( // IN PIRP_CONTEXT IrpContext, // IN PVCB Vcb // ); // // VOID // NtfsWaitOnCheckpointNotify ( // IN PIRP_CONTEXT IrpContext, // IN PVCB Vcb // ); // // VOID // NtfsSetCheckpointNotify ( // IN PIRP_CONTEXT IrpContext, // IN PVCB Vcb // ); // // VOID // NtfsResetCheckpointNotify ( // IN PIRP_CONTEXT IrpContext, // IN PVCB Vcb // ); // // VOID // NtfsAcquireReservedClusters ( // IN PIRP_CONTEXT IrpContext, // IN PVCB Vcb // ); // // VOID // NtfsReleaseReservedClusters ( // IN PIRP_CONTEXT IrpContext, // IN PVCB Vcb // ); // // VOID // NtfsAcquireUsnNotify ( // IN PVCB Vcb // ); // // VOID // NtfsDeleteUsnNotify ( // IN PVCB Vcb // ); // // VOID NtfsAcquireFsrtlHeader ( // IN PSCB Scb // ); // // VOID NtfsReleaseFsrtlHeader ( // IN PSCB Scb // ); // // VOID // NtfsReleaseVcb ( // IN PIRP_CONTEXT IrpContext, // IN PVCB Vcb // ); // VOID NtfsReleaseVcbCheckDelete ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN UCHAR MajorCode, IN PFILE_OBJECT FileObject OPTIONAL ); #define NtfsAcquireSharedScb(IC,S) { \ NtfsAcquireSharedFcb((IC),(S)->Fcb, S, 0); \ } #define NtfsReleaseScb(IC,S) { \ NtfsReleaseFcb((IC),(S)->Fcb); \ } #define NtfsReleaseGlobal(IC) { \ ExReleaseResourceLite( &NtfsData.Resource ); \ } #define NtfsAcquireFcbTable(IC,V) { \ ExAcquireFastMutexUnsafe( &(V)->FcbTableMutex ); \ } #define NtfsReleaseFcbTable(IC,V) { \ ExReleaseFastMutexUnsafe( &(V)->FcbTableMutex ); \ } #define NtfsLockVcb(IC,V) { \ ExAcquireFastMutexUnsafe( &(V)->FcbSecurityMutex ); \ } #define NtfsUnlockVcb(IC,V) { \ ExReleaseFastMutexUnsafe( &(V)->FcbSecurityMutex ); \ } #define NtfsLockFcb(IC,F) { \ ExAcquireFastMutex( (F)->FcbMutex ); \ } #define NtfsUnlockFcb(IC,F) { \ ExReleaseFastMutex( (F)->FcbMutex ); \ } #define NtfsAcquireFcbSecurity(V) { \ ExAcquireFastMutexUnsafe( &(V)->FcbSecurityMutex ); \ } #define NtfsReleaseFcbSecurity(V) { \ ExReleaseFastMutexUnsafe( &(V)->FcbSecurityMutex ); \ } #define NtfsAcquireHashTable(V) { \ ExAcquireFastMutexUnsafe( &(V)->HashTableMutex ); \ } #define NtfsReleaseHashTable(V) { \ ExReleaseFastMutexUnsafe( &(V)->HashTableMutex ); \ } #define NtfsAcquireCheckpoint(IC,V) { \ ExAcquireFastMutexUnsafe( &(V)->CheckpointMutex ); \ } #define NtfsReleaseCheckpoint(IC,V) { \ ExReleaseFastMutexUnsafe( &(V)->CheckpointMutex ); \ } #define NtfsWaitOnCheckpointNotify(IC,V) { \ NTSTATUS _Status; \ _Status = KeWaitForSingleObject( &(V)->CheckpointNotifyEvent, \ Executive, \ KernelMode, \ FALSE, \ NULL ); \ if (!NT_SUCCESS( _Status )) { \ NtfsRaiseStatus( IrpContext, _Status, NULL, NULL ); \ } \ } #define NtfsSetCheckpointNotify(IC,V) { \ (V)->CheckpointOwnerThread = NULL; \ KeSetEvent( &(V)->CheckpointNotifyEvent, 0, FALSE ); \ } #define NtfsResetCheckpointNotify(IC,V) { \ (V)->CheckpointOwnerThread = (PVOID) PsGetCurrentThread(); \ KeClearEvent( &(V)->CheckpointNotifyEvent ); \ } #define NtfsAcquireUsnNotify(V) { \ ExAcquireFastMutex( &(V)->CheckpointMutex ); \ } #define NtfsReleaseUsnNotify(V) { \ ExReleaseFastMutex( &(V)->CheckpointMutex ); \ } #define NtfsAcquireReservedClusters(V) { \ ExAcquireFastMutexUnsafe( &(V)->ReservedClustersMutex );\ } #define NtfsReleaseReservedClusters(V) { \ ExReleaseFastMutexUnsafe( &(V)->ReservedClustersMutex );\ } #define NtfsAcquireFsrtlHeader(S) { \ ExAcquireFastMutex((S)->Header.FastMutex); \ } #define NtfsReleaseFsrtlHeader(S) { \ ExReleaseFastMutex((S)->Header.FastMutex); \ } #ifdef NTFSDBG VOID NtfsReleaseVcb( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb ); #else #define NtfsReleaseVcb(IC,V) { \ ExReleaseResourceLite( &(V)->Resource ); \ } #endif // // Macros to test resources for exclusivity. // #define NtfsIsExclusiveResource(R) ( \ ExIsResourceAcquiredExclusiveLite(R) \ ) #define NtfsIsExclusiveFcb(F) ( \ (NtfsIsExclusiveResource((F)->Resource)) \ ) #define NtfsIsExclusiveFcbPagingIo(F) ( \ (NtfsIsExclusiveResource((F)->PagingIoResource)) \ ) #define NtfsIsExclusiveScbPagingIo(S) ( \ (NtfsIsExclusiveFcbPagingIo((S)->Fcb)) \ ) #define NtfsIsExclusiveScb(S) ( \ (NtfsIsExclusiveFcb((S)->Fcb)) \ ) #define NtfsIsExclusiveVcb(V) ( \ (NtfsIsExclusiveResource(&(V)->Resource)) \ ) // // Macros to test resources for shared acquire // #define NtfsIsSharedResource(R) ( \ ExIsResourceAcquiredSharedLite(R) \ ) #define NtfsIsSharedFcb(F) ( \ (NtfsIsSharedResource((F)->Resource)) \ ) #define NtfsIsSharedFcbPagingIo(F) ( \ (NtfsIsSharedResource((F)->PagingIoResource)) \ ) #define NtfsIsSharedScbPagingIo(S) ( \ (NtfsIsSharedFcbPagingIo((S)->Fcb)) \ ) #define NtfsIsSharedScb(S) ( \ (NtfsIsSharedFcb((S)->Fcb)) \ ) #define NtfsIsSharedVcb(V) ( \ (NtfsIsSharedResource(&(V)->Resource)) \ ) __inline VOID NtfsReleaseExclusiveScbIfOwned( IN PIRP_CONTEXT IrpContext, IN PSCB Scb ) /*++ Routine Description: This routine is called release an Scb that may or may not be currently owned exclusive. Arguments: IrpContext - Context of call Scb - Scb to be released Return Value: None. --*/ { if (Scb->Fcb->ExclusiveFcbLinks.Flink != NULL && NtfsIsExclusiveScb( Scb )) { NtfsReleaseScb( IrpContext, Scb ); } } // // The following are cache manager call backs. They return FALSE // if the resource cannot be acquired with waiting and wait is false. // BOOLEAN NtfsAcquireScbForLazyWrite ( IN PVOID Null, IN BOOLEAN Wait ); VOID NtfsReleaseScbFromLazyWrite ( IN PVOID Null ); NTSTATUS NtfsAcquireFileForModWrite ( IN PFILE_OBJECT FileObject, IN PLARGE_INTEGER EndingOffset, OUT PERESOURCE *ResourceToRelease, IN PDEVICE_OBJECT DeviceObject ); NTSTATUS NtfsAcquireFileForCcFlush ( IN PFILE_OBJECT FileObject, IN PDEVICE_OBJECT DeviceObject ); NTSTATUS NtfsReleaseFileForCcFlush ( IN PFILE_OBJECT FileObject, IN PDEVICE_OBJECT DeviceObject ); VOID NtfsAcquireForCreateSection ( IN PFILE_OBJECT FileObject ); VOID NtfsReleaseForCreateSection ( IN PFILE_OBJECT FileObject ); BOOLEAN NtfsAcquireScbForReadAhead ( IN PVOID Null, IN BOOLEAN Wait ); VOID NtfsReleaseScbFromReadAhead ( IN PVOID Null ); BOOLEAN NtfsAcquireVolumeFileForLazyWrite ( IN PVOID Vcb, IN BOOLEAN Wait ); VOID NtfsReleaseVolumeFileFromLazyWrite ( IN PVOID Vcb ); // // Ntfs Logging Routine interfaces in RestrSup.c // BOOLEAN NtfsRestartVolume ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, OUT PBOOLEAN UnrecognizedRestart ); VOID NtfsAbortTransaction ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN PTRANSACTION_ENTRY Transaction OPTIONAL ); NTSTATUS NtfsCloseAttributesFromRestart ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb ); // // Security support routines, implemented in SecurSup.c // // // VOID // NtfsTraverseCheck ( // IN PIRP_CONTEXT IrpContext, // IN PFCB ParentFcb, // IN PIRP Irp // ); // // VOID // NtfsOpenCheck ( // IN PIRP_CONTEXT IrpContext, // IN PFCB Fcb, // IN PFCB ParentFcb OPTIONAL, // IN PIRP Irp // ); // // VOID // NtfsCreateCheck ( // IN PIRP_CONTEXT IrpContext, // IN PFCB ParentFcb, // IN PIRP Irp // ); // #define NtfsTraverseCheck(IC,F,IR) { \ NtfsAccessCheck( IC, \ F, \ NULL, \ IR, \ FILE_TRAVERSE, \ TRUE ); \ } #define NtfsOpenCheck(IC,F,PF,IR) { \ NtfsAccessCheck( IC, \ F, \ PF, \ IR, \ IoGetCurrentIrpStackLocation(IR)->Parameters.Create.SecurityContext->DesiredAccess, \ FALSE ); \ } #define NtfsCreateCheck(IC,PF,IR) { \ NtfsAccessCheck( IC, \ PF, \ NULL, \ IR, \ (FlagOn(IoGetCurrentIrpStackLocation(IR)->Parameters.Create.Options, FILE_DIRECTORY_FILE) ? \ FILE_ADD_SUBDIRECTORY : FILE_ADD_FILE), \ TRUE ); \ } VOID NtfsAssignSecurity ( IN PIRP_CONTEXT IrpContext, IN PFCB ParentFcb, IN PIRP Irp, IN PFCB NewFcb, IN PFILE_RECORD_SEGMENT_HEADER FileRecord, IN PBCB FileRecordBcb, IN LONGLONG FileOffset, IN OUT PBOOLEAN LogIt ); NTSTATUS NtfsModifySecurity ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN PSECURITY_INFORMATION SecurityInformation, OUT PSECURITY_DESCRIPTOR SecurityDescriptor ); NTSTATUS NtfsQuerySecurity ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN PSECURITY_INFORMATION SecurityInformation, OUT PSECURITY_DESCRIPTOR SecurityDescriptor, IN OUT PULONG SecurityDescriptorLength ); VOID NtfsAccessCheck ( PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN PFCB ParentFcb OPTIONAL, IN PIRP Irp, IN ACCESS_MASK DesiredAccess, IN BOOLEAN CheckOnly ); BOOLEAN NtfsCanAdministerVolume ( IN PIRP_CONTEXT IrpContext, IN PIRP Irp, IN PFCB Fcb, IN PSECURITY_DESCRIPTOR TestSecurityDescriptor OPTIONAL, IN PULONG TestDesiredAccess OPTIONAL ); NTSTATUS NtfsCheckFileForDelete ( IN PIRP_CONTEXT IrpContext, IN PSCB ParentScb, IN PFCB ThisFcb, IN BOOLEAN FcbExisted, IN PINDEX_ENTRY IndexEntry ); VOID NtfsCheckIndexForAddOrDelete ( IN PIRP_CONTEXT IrpContext, IN PFCB ParentFcb, IN ACCESS_MASK DesiredAccess, IN ULONG CreatePrivileges ); VOID NtfsSetFcbSecurityFromDescriptor ( IN PIRP_CONTEXT IrpContext, IN OUT PFCB Fcb, IN PSECURITY_DESCRIPTOR SecurityDescriptor, IN ULONG SecurityDescriptorLength, IN BOOLEAN RaiseIfInvalid ); INLINE VOID RemoveReferenceSharedSecurityUnsafe ( IN OUT PSHARED_SECURITY *SharedSecurity ) /*++ Routine Description: This routine is called to manage the reference count on a shared security descriptor. If the reference count goes to zero, the shared security is freed. Arguments: SharedSecurity - security that is being dereferenced. Return Value: None. --*/ { DebugTrace( 0, (DEBUG_TRACE_SECURSUP | DEBUG_TRACE_ACLINDEX), ( "RemoveReferenceSharedSecurityUnsafe( %08x )\n", *SharedSecurity )); // // Note that there will be one less reference shortly // ASSERT( (*SharedSecurity)->ReferenceCount != 0 ); (*SharedSecurity)->ReferenceCount--; if ((*SharedSecurity)->ReferenceCount == 0) { DebugTrace( 0, (DEBUG_TRACE_SECURSUP | DEBUG_TRACE_ACLINDEX), ( "RemoveReferenceSharedSecurityUnsafe freeing\n" )); NtfsFreePool( *SharedSecurity ); } *SharedSecurity = NULL; } BOOLEAN NtfsNotifyTraverseCheck ( IN PCCB Ccb, IN PFCB Fcb, IN PSECURITY_SUBJECT_CONTEXT SubjectContext ); VOID NtfsLoadSecurityDescriptor ( PIRP_CONTEXT IrpContext, IN PFCB Fcb ); VOID NtfsStoreSecurityDescriptor ( PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN BOOLEAN LogIt ); VOID NtfsInitializeSecurity ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN PFCB Fcb ); VOID NtOfsPurgeSecurityCache ( IN PVCB Vcb ); PSHARED_SECURITY NtfsCacheSharedSecurityBySecurityId ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN SECURITY_ID SecurityId ); PSHARED_SECURITY NtfsCacheSharedSecurityForCreate ( IN PIRP_CONTEXT IrpContext, IN PFCB ParentFcb ); SECURITY_ID GetSecurityIdFromSecurityDescriptorUnsafe ( PIRP_CONTEXT IrpContext, IN OUT PSHARED_SECURITY SharedSecurity ); FSRTL_COMPARISON_RESULT NtOfsCollateSecurityHash ( IN PINDEX_KEY Key1, IN PINDEX_KEY Key2, IN PVOID CollationData ); #ifdef NTFS_CACHE_RIGHTS VOID NtfsGetCachedRightsById ( IN PVCB Vcb, IN PLUID TokenId, IN PLUID ModifiedId, IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext, IN PSHARED_SECURITY SharedSecurity, OUT PBOOLEAN EntryCached OPTIONAL, OUT PACCESS_MASK Rights ); NTSTATUS NtfsGetCachedRights ( IN PVCB Vcb, IN PSECURITY_SUBJECT_CONTEXT SubjectSecurityContext, IN PSHARED_SECURITY SharedSecurity, OUT PACCESS_MASK Rights, OUT PBOOLEAN EntryCached OPTIONAL, OUT PLUID TokenId OPTIONAL, OUT PLUID ModifiedId OPTIONAL ); #endif // // In-memory structure support routine, implemented in StrucSup.c // // // Routines to create and destroy the Vcb // VOID NtfsInitializeVcb ( IN PIRP_CONTEXT IrpContext, IN OUT PVCB Vcb, IN PDEVICE_OBJECT TargetDeviceObject, IN PVPB Vpb ); BOOLEAN NtfsDeleteVcb ( IN PIRP_CONTEXT IrpContext, IN OUT PVCB *Vcb ); // // Routines to create and destroy the Fcb // PFCB NtfsCreateRootFcb ( // also creates the root lcb IN PIRP_CONTEXT IrpContext, IN PVCB Vcb ); PFCB NtfsCreateFcb ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN FILE_REFERENCE FileReference, IN BOOLEAN IsPagingFile, IN BOOLEAN LargeFcb, OUT PBOOLEAN ReturnedExistingFcb OPTIONAL ); VOID NtfsDeleteFcb ( IN PIRP_CONTEXT IrpContext, IN OUT PFCB *Fcb, OUT PBOOLEAN AcquiredFcbTable ); PFCB NtfsGetNextFcbTableEntry ( IN PVCB Vcb, IN PVOID *RestartKey ); // // Routines to create and destroy the Scb // PSCB NtfsCreateScb ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN ATTRIBUTE_TYPE_CODE AttributeTypeCode, IN PCUNICODE_STRING AttributeName, IN BOOLEAN ReturnExistingOnly, OUT PBOOLEAN ReturnedExistingScb OPTIONAL ); PSCB NtfsCreatePrerestartScb ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN PFILE_REFERENCE FileReference, IN ATTRIBUTE_TYPE_CODE AttributeTypeCode, IN PUNICODE_STRING AttributeName OPTIONAL, IN ULONG BytesPerIndexBuffer ); VOID NtfsFreeScbAttributeName ( IN PWSTR AttributeNameBuffer ); VOID NtfsDeleteScb ( IN PIRP_CONTEXT IrpContext, IN OUT PSCB *Scb ); BOOLEAN NtfsUpdateNormalizedName ( IN PIRP_CONTEXT IrpContext, IN PSCB ParentScb, IN PSCB Scb, IN PFILE_NAME FileName OPTIONAL, IN BOOLEAN CheckBufferSizeOnly ); VOID NtfsDeleteNormalizedName ( IN PSCB Scb ); typedef NTSTATUS (*NTFSWALKUPFUNCTION)( PIRP_CONTEXT IrpContext, PFCB Fcb, PSCB Scb, PFILE_NAME FileName, PVOID Context ); NTSTATUS NtfsWalkUpTree ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN NTFSWALKUPFUNCTION WalkUpFunction, IN OUT PVOID Context ); typedef struct { UNICODE_STRING Name; FILE_REFERENCE Scope; BOOLEAN IsRoot; #ifdef BENL_DBG PFCB StartFcb; #endif } SCOPE_CONTEXT, *PSCOPE_CONTEXT; NTSTATUS NtfsBuildRelativeName ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN PSCB Scb, IN PFILE_NAME FileName, IN OUT PVOID Context ); VOID NtfsBuildNormalizedName ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN PSCB IndexScb OPTIONAL, OUT PUNICODE_STRING FileName ); VOID NtfsSnapshotScb ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb ); VOID NtfsUpdateScbSnapshots ( IN PIRP_CONTEXT IrpContext ); VOID NtfsRestoreScbSnapshots ( IN PIRP_CONTEXT IrpContext, IN BOOLEAN Higher ); VOID NtfsMungeScbSnapshot ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb, IN LONGLONG FileSize ); VOID NtfsFreeSnapshotsForFcb ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb ); BOOLEAN NtfsCreateFileLock ( IN PSCB Scb, IN BOOLEAN RaiseOnError ); // // // A general purpose teardown routine that helps cleanup the // the Fcb/Scb structures // VOID NtfsTeardownStructures ( IN PIRP_CONTEXT IrpContext, IN PVOID FcbOrScb, IN PLCB Lcb OPTIONAL, IN BOOLEAN CheckForAttributeTable, IN ULONG AcquireFlags, OUT PBOOLEAN RemovedFcb OPTIONAL ); // // Routines to create, destroy and walk through the Lcbs // PLCB NtfsCreateLcb ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb, IN PFCB Fcb, IN UNICODE_STRING LastComponentFileName, IN UCHAR FileNameFlags, IN OUT PBOOLEAN ReturnedExistingLcb OPTIONAL ); VOID NtfsDeleteLcb ( IN PIRP_CONTEXT IrpContext, IN OUT PLCB *Lcb ); VOID NtfsMoveLcb ( // also munges the ccb and fileobjects filenames IN PIRP_CONTEXT IrpContext, IN PLCB Lcb, IN PSCB Scb, IN PFCB Fcb, IN PUNICODE_STRING TargetDirectoryName, IN PUNICODE_STRING LastComponentName, IN UCHAR FileNameFlags, IN BOOLEAN CheckBufferSizeOnly ); VOID NtfsRenameLcb ( // also munges the ccb and fileobjects filenames IN PIRP_CONTEXT IrpContext, IN PLCB Lcb, IN PUNICODE_STRING LastComponentFileName, IN UCHAR FileNameFlags, IN BOOLEAN CheckBufferSizeOnly ); VOID NtfsCombineLcbs ( IN PIRP_CONTEXT IrpContext, IN PLCB PrimaryLcb, IN PLCB AuxLcb ); PLCB NtfsLookupLcbByFlags ( IN PFCB Fcb, IN UCHAR FileNameFlags ); ULONG NtfsLookupNameLengthViaLcb ( IN PFCB Fcb, OUT PBOOLEAN LeadingBackslash ); VOID NtfsFileNameViaLcb ( IN PFCB Fcb, IN PWCHAR FileName, ULONG Length, ULONG BytesToCopy ); // // VOID // NtfsLinkCcbToLcb ( // IN PIRP_CONTEXT IrpContext, // IN PCCB Ccb, // IN PLCB Lcb // ); // #define NtfsLinkCcbToLcb(IC,C,L) { \ InsertTailList( &(L)->CcbQueue, &(C)->LcbLinks ); \ (C)->Lcb = (L); \ } // // VOID // NtfsUnlinkCcbFromLcb ( // IN PIRP_CONTEXT IrpContext, // IN PCCB Ccb // ); // #define NtfsUnlinkCcbFromLcb(IC,C) { \ if ((C)->Lcb != NULL) { \ RemoveEntryList( &(C)->LcbLinks ); \ (C)->Lcb = NULL; \ } \ } // // Routines to create and destroy the Ccb // PCCB NtfsCreateCcb ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN PSCB Scb, IN BOOLEAN Indexed, IN USHORT EaModificationCount, IN ULONG Flags, IN PFILE_OBJECT FileObject, IN ULONG LastFileNameOffset ); VOID NtfsDeleteCcb ( IN PFCB Fcb, IN OUT PCCB *Ccb ); // // Routines to create and destroy the IrpContext // VOID NtfsInitializeIrpContext ( IN PIRP Irp OPTIONAL, IN BOOLEAN Wait, IN OUT PIRP_CONTEXT *IrpContext ); VOID NtfsCleanupIrpContext ( IN OUT PIRP_CONTEXT IrpContext, IN ULONG Retry ); // // Routine for scanning the Fcbs within the graph hierarchy // PSCB NtfsGetNextScb ( IN PSCB Scb, IN PSCB TerminationScb ); // // The following macros are useful for traversing the queues interconnecting // fcbs, scb, and lcbs. // // PSCB // NtfsGetNextChildScb ( // IN PFCB Fcb, // IN PSCB PreviousChildScb // ); // // PLCB // NtfsGetNextParentLcb ( // IN PIRP_CONTEXT IrpContext, // IN PFCB Fcb, // IN PLCB PreviousParentLcb // ); // // PLCB // NtfsGetNextChildLcb ( // IN PIRP_CONTEXT IrpContext, // IN PSCB Scb, // IN PLCB PreviousChildLcb // ); // // PLCB // NtfsGetPrevChildLcb ( // IN PIRP_CONTEXT IrpContext, // IN PSCB Scb, // IN PLCB PreviousChildLcb // ); // // PLCB // NtfsGetNextParentLcb ( // IN PIRP_CONTEXT IrpContext, // IN PFCB Fcb, // IN PLCB PreviousChildLcb // ); // // PCCB // NtfsGetNextCcb ( // IN PIRP_CONTEXT IrpContext, // IN PLCB Lcb, // IN PCCB PreviousCcb // ); // #define NtfsGetNextChildScb(F,P) ((PSCB) \ ((P) == NULL ? \ (IsListEmpty(&(F)->ScbQueue) ? \ NULL \ : \ CONTAINING_RECORD((F)->ScbQueue.Flink, SCB, FcbLinks.Flink) \ ) \ : \ ((PVOID)((PSCB)(P))->FcbLinks.Flink == &(F)->ScbQueue.Flink ? \ NULL \ : \ CONTAINING_RECORD(((PSCB)(P))->FcbLinks.Flink, SCB, FcbLinks.Flink) \ ) \ ) \ ) #define NtfsGetNextParentLcb(F,P) ((PLCB) \ ((P) == NULL ? \ (IsListEmpty(&(F)->LcbQueue) ? \ NULL \ : \ CONTAINING_RECORD((F)->LcbQueue.Flink, LCB, FcbLinks.Flink) \ ) \ : \ ((PVOID)((PLCB)(P))->FcbLinks.Flink == &(F)->LcbQueue.Flink ? \ NULL \ : \ CONTAINING_RECORD(((PLCB)(P))->FcbLinks.Flink, LCB, FcbLinks.Flink) \ ) \ ) \ ) #define NtfsGetNextChildLcb(S,P) ((PLCB) \ ((P) == NULL ? \ ((((NodeType(S) == NTFS_NTC_SCB_DATA) || (NodeType(S) == NTFS_NTC_SCB_MFT)) \ || IsListEmpty(&(S)->ScbType.Index.LcbQueue)) ? \ NULL \ : \ CONTAINING_RECORD((S)->ScbType.Index.LcbQueue.Flink, LCB, ScbLinks.Flink) \ ) \ : \ ((PVOID)((PLCB)(P))->ScbLinks.Flink == &(S)->ScbType.Index.LcbQueue.Flink ? \ NULL \ : \ CONTAINING_RECORD(((PLCB)(P))->ScbLinks.Flink, LCB, ScbLinks.Flink) \ ) \ ) \ ) #define NtfsGetPrevChildLcb(S,P) ((PLCB) \ ((P) == NULL ? \ ((((NodeType(S) == NTFS_NTC_SCB_DATA) || (NodeType(S) == NTFS_NTC_SCB_MFT)) \ || IsListEmpty(&(S)->ScbType.Index.LcbQueue)) ? \ NULL \ : \ CONTAINING_RECORD((S)->ScbType.Index.LcbQueue.Blink, LCB, ScbLinks.Flink) \ ) \ : \ ((PVOID)((PLCB)(P))->ScbLinks.Blink == &(S)->ScbType.Index.LcbQueue.Flink ? \ NULL \ : \ CONTAINING_RECORD(((PLCB)(P))->ScbLinks.Blink, LCB, ScbLinks.Flink) \ ) \ ) \ ) #define NtfsGetNextParentLcb(F,P) ((PLCB) \ ((P) == NULL ? \ (IsListEmpty(&(F)->LcbQueue) ? \ NULL \ : \ CONTAINING_RECORD((F)->LcbQueue.Flink, LCB, FcbLinks.Flink) \ ) \ : \ ((PVOID)((PLCB)(P))->FcbLinks.Flink == &(F)->LcbQueue.Flink ? \ NULL \ : \ CONTAINING_RECORD(((PLCB)(P))->FcbLinks.Flink, LCB, FcbLinks.Flink) \ ) \ ) \ ) #define NtfsGetNextCcb(L,P) ((PCCB) \ ((P) == NULL ? \ (IsListEmpty(&(L)->CcbQueue) ? \ NULL \ : \ CONTAINING_RECORD((L)->CcbQueue.Flink, CCB, LcbLinks.Flink) \ ) \ : \ ((PVOID)((PCCB)(P))->LcbLinks.Flink == &(L)->CcbQueue.Flink ? \ NULL \ : \ CONTAINING_RECORD(((PCCB)(P))->LcbLinks.Flink, CCB, LcbLinks.Flink) \ ) \ ) \ ) #define NtfsGetFirstCcbEntry(S) \ (IsListEmpty( &(S)->CcbQueue ) \ ? NULL \ : CONTAINING_RECORD( (S)->CcbQueue.Flink, CCB, CcbLinks.Flink )) #define NtfsGetNextCcbEntry(S,C) \ ( (PVOID)&(S)->CcbQueue.Flink == (PVOID)(C)->CcbLinks.Flink \ ? NULL \ : CONTAINING_RECORD( (C)->CcbLinks.Flink, CCB, CcbLinks.Flink )) // // VOID // NtfsDeleteFcbTableEntry ( // IN PVCB Vcb, // IN FILE_REFERENCE FileReference // ); // #if (defined( NTFS_FREE_ASSERTS )) #define NtfsDeleteFcbTableEntry(V,FR) { \ FCB_TABLE_ELEMENT _Key; \ BOOLEAN _RemovedEntry; \ _Key.FileReference = FR; \ _RemovedEntry = RtlDeleteElementGenericTable( &(V)->FcbTable, &_Key ); \ ASSERT( _RemovedEntry ); \ } #else #define NtfsDeleteFcbTableEntry(V,FR) { \ FCB_TABLE_ELEMENT _Key; \ _Key.FileReference = FR; \ RtlDeleteElementGenericTable( &(V)->FcbTable, &_Key ); \ } #endif // // Routines for allocating and deallocating the compression synchronization structures. // PVOID NtfsAllocateCompressionSync ( IN POOL_TYPE PoolType, IN SIZE_T NumberOfBytes, IN ULONG Tag ); VOID NtfsDeallocateCompressionSync ( IN PVOID CompressionSync ); // // The following four routines are for incrementing and decrementing the cleanup // counts and the close counts. In all of the structures // VOID NtfsIncrementCleanupCounts ( IN PSCB Scb, IN PLCB Lcb OPTIONAL, IN BOOLEAN NonCachedHandle ); VOID NtfsIncrementCloseCounts ( IN PSCB Scb, IN BOOLEAN SystemFile, IN BOOLEAN ReadOnly ); VOID NtfsDecrementCleanupCounts ( IN PSCB Scb, IN PLCB Lcb OPTIONAL, IN BOOLEAN NonCachedHandle ); BOOLEAN NtfsDecrementCloseCounts ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb, IN PLCB Lcb OPTIONAL, IN BOOLEAN SystemFile, IN BOOLEAN ReadOnly, IN BOOLEAN DecrementCountsOnly ); PERESOURCE NtfsAllocateEresource ( ); VOID NtfsFreeEresource ( IN PERESOURCE Eresource ); PVOID NtfsAllocateFcbTableEntry ( IN PRTL_GENERIC_TABLE FcbTable, IN CLONG ByteSize ); VOID NtfsFreeFcbTableEntry ( IN PRTL_GENERIC_TABLE FcbTable, IN PVOID Buffer ); VOID NtfsPostToNewLengthQueue ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb ); VOID NtfsProcessNewLengthQueue ( IN PIRP_CONTEXT IrpContext, IN BOOLEAN CleanupOnly ); // // Useful debug routines // VOID NtfsTestStatusProc ( ); // // Usn Support routines in UsnSup.c // NTSTATUS NtfsReadUsnJournal ( IN PIRP_CONTEXT IrpContext, IN PIRP Irp, IN BOOLEAN ProbeInput ); ULONG NtfsPostUsnChange ( IN PIRP_CONTEXT IrpContext, IN PVOID ScborFcb, IN ULONG Reason ); VOID NtfsWriteUsnJournalChanges ( PIRP_CONTEXT IrpContext ); VOID NtfsSetupUsnJournal ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN PFCB Fcb, IN ULONG CreateIfNotExist, IN ULONG Restamp, IN PCREATE_USN_JOURNAL_DATA JournalData ); VOID NtfsTrimUsnJournal ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb ); NTSTATUS NtfsQueryUsnJournal ( IN PIRP_CONTEXT IrpContext, IN PIRP Irp ); NTSTATUS NtfsDeleteUsnJournal ( IN PIRP_CONTEXT IrpContext, IN PIRP Irp ); VOID NtfsDeleteUsnSpecial ( IN PIRP_CONTEXT IrpContext, IN PVOID Context ); // // NtOfs support routines in vattrsup.c // NTFSAPI NTSTATUS NtfsHoldIrpForNewLength ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb, IN PIRP Irp, IN LONGLONG Length, IN PDRIVER_CANCEL CancelRoutine, IN PVOID CapturedData OPTIONAL, OUT PVOID *CopyCapturedData OPTIONAL, IN ULONG CapturedDataLength ); // // Time conversion support routines, implemented as a macro // // VOID // NtfsGetCurrentTime ( // IN PIRP_CONTEXT IrpContext, // IN LONGLONG Time // ); // #define NtfsGetCurrentTime(_IC,_T) { \ ASSERT_IRP_CONTEXT(_IC); \ KeQuerySystemTime((PLARGE_INTEGER)&(_T)); \ } // // Time routine to check if last access should be updated. // // BOOLEAN // NtfsCheckLastAccess ( // IN PIRP_CONTEXT IrpContext, // IN OUT PFCB Fcb // ); // #define NtfsCheckLastAccess(_IC,_FCB) ( \ ((NtfsLastAccess + (_FCB)->Info.LastAccessTime) < (_FCB)->CurrentLastAccess) || \ ((_FCB)->CurrentLastAccess < (_FCB)->Info.LastAccessTime) \ ) // // Macro and #defines to decide whether a given feature is supported on a // given volume version. Currently, all features either work on all Ntfs // volumes, or work on all volumes with major version greater than 1. In // some future version, some features may require version 4.x volumes, etc. // // This macro is used to decide whether to fail a user request with // STATUS_VOLUME_NOT_UPGRADED, and also helps us set the FILE_SUPPORTS_xxx // flags correctly in NtfsQueryFsAttributeInfo. // #define NTFS_ENCRYPTION_VERSION 2 #define NTFS_OBJECT_ID_VERSION 2 #define NTFS_QUOTA_VERSION 2 #define NTFS_REPARSE_POINT_VERSION 2 #define NTFS_SPARSE_FILE_VERSION 2 #define NtfsVolumeVersionCheck(VCB,VERSION) ( \ ((VCB)->MajorVersion >= VERSION) \ ) // // Low level verification routines, implemented in VerfySup.c // BOOLEAN NtfsPerformVerifyOperation ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb ); VOID NtfsPerformDismountOnVcb ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN BOOLEAN DoCompleteDismount, OUT PVPB *NewVpbReturn OPTIONAL ); BOOLEAN NtfsPingVolume ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN OUT PBOOLEAN OwnsVcb OPTIONAL ); VOID NtfsVolumeCheckpointDpc ( IN PKDPC Dpc, IN PVOID DeferredContext, IN PVOID SystemArgument1, IN PVOID SystemArgument2 ); VOID NtfsCheckpointAllVolumes ( PVOID Parameter ); VOID NtfsUsnTimeOutDpc ( IN PKDPC Dpc, IN PVOID DeferredContext, IN PVOID SystemArgument1, IN PVOID SystemArgument2 ); VOID NtfsCheckUsnTimeOut ( PVOID Parameter ); NTSTATUS NtfsIoCallSelf ( IN PIRP_CONTEXT IrpContext, IN PFILE_OBJECT FileObject, IN UCHAR MajorFunction ); BOOLEAN NtfsLogEvent ( IN PIRP_CONTEXT IrpContext, IN PQUOTA_USER_DATA UserData OPTIONAL, IN NTSTATUS LogCode, IN NTSTATUS FinalStatus ); VOID NtfsMarkVolumeDirty ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN BOOLEAN UpdateWithinTransaction ); VOID NtfsSetVolumeInfoFlagState ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN ULONG FlagsToSet, IN BOOLEAN NewState, IN BOOLEAN UpdateWithinTransaction ); BOOLEAN NtfsUpdateVolumeInfo ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN UCHAR DiskMajorVersion, IN UCHAR DiskMinorVersion ); VOID NtfsPostVcbIsCorrupt ( IN PIRP_CONTEXT IrpContext, IN NTSTATUS Status OPTIONAL, IN PFILE_REFERENCE FileReference OPTIONAL, IN PFCB Fcb OPTIONAL ); VOID NtOfsCloseAttributeSafe ( IN PIRP_CONTEXT IrpContext, IN PSCB Scb ); NTSTATUS NtfsDeviceIoControlAsync ( IN PIRP_CONTEXT IrpContext, IN PDEVICE_OBJECT DeviceObject, IN ULONG IoCtl, IN OUT PVOID Buffer OPTIONAL, IN ULONG BufferSize ); // // Work queue routines for posting and retrieving an Irp, implemented in // workque.c // VOID NtfsOplockComplete ( IN PVOID Context, IN PIRP Irp ); VOID NtfsPrePostIrp ( IN PVOID Context, IN PIRP Irp OPTIONAL ); VOID NtfsAddToWorkque ( IN PIRP_CONTEXT IrpContext, IN PIRP Irp OPTIONAL ); NTSTATUS NtfsPostRequest ( IN PIRP_CONTEXT IrpContext, IN PIRP Irp OPTIONAL ); // // Miscellaneous support macros. // // ULONG_PTR // WordAlign ( // IN ULONG_PTR Pointer // ); // // ULONG_PTR // LongAlign ( // IN ULONG_PTR Pointer // ); // // ULONG_PTR // QuadAlign ( // IN ULONG_PTR Pointer // ); // // UCHAR // CopyUchar1 ( // IN PUCHAR Destination, // IN PUCHAR Source // ); // // UCHAR // CopyUchar2 ( // IN PUSHORT Destination, // IN PUCHAR Source // ); // // UCHAR // CopyUchar4 ( // IN PULONG Destination, // IN PUCHAR Source // ); // // PVOID // Add2Ptr ( // IN PVOID Pointer, // IN ULONG Increment // ); // // ULONG // PtrOffset ( // IN PVOID BasePtr, // IN PVOID OffsetPtr // ); // #define WordAlignPtr(P) ( \ (PVOID)((((ULONG_PTR)(P)) + 1) & (-2)) \ ) #define LongAlignPtr(P) ( \ (PVOID)((((ULONG_PTR)(P)) + 3) & (-4)) \ ) #define QuadAlignPtr(P) ( \ (PVOID)((((ULONG_PTR)(P)) + 7) & (-8)) \ ) #define WordAlign(P) ( \ ((((P)) + 1) & (-2)) \ ) #define LongAlign(P) ( \ ((((P)) + 3) & (-4)) \ ) #define QuadAlign(P) ( \ ((((P)) + 7) & (-8)) \ ) #define IsWordAligned(P) ((ULONG_PTR)(P) == WordAlign( (ULONG_PTR)(P) )) #define IsLongAligned(P) ((ULONG_PTR)(P) == LongAlign( (ULONG_PTR)(P) )) #define IsQuadAligned(P) ((ULONG_PTR)(P) == QuadAlign( (ULONG_PTR)(P) )) // // A note on structure alignment checking: // // In a perfect world, we would just use TYPE_ALIGNMENT straight out of the box // to check the alignment requirements for a given structure. // // On 32-bit platforms including Alpha, alignment faults are handled by the // OS. There are many places in the NTFS code where a structure requires // quadword alignment (on Alpha) but only dword alignment is enforced. To // change this on Alpha32 would introduce compatibility problems, so on 32-bit // platforms we do not want to use an alignment value greater than 4. // // In other places, enforcing ULONG alignment is more restrictive than // necessary. For example, a structure that contains nothing bigger than a // USHORT can get by with 16-bit alignment. However, there is no reason to // relax these alignment restrictions, so on all platforms we do not want to // use an alignment value of less than 4. // // This means that NTFS_TYPE_ALIGNMENT always resolves to 4 on 32-bit platforms, // and to at least four on 64-bit platforms. // #ifdef _WIN64 #define NTFS_TYPE_ALIGNMENT(T) \ ((TYPE_ALIGNMENT( T ) < TYPE_ALIGNMENT(ULONG)) ? TYPE_ALIGNMENT( ULONG ) : TYPE_ALIGNMENT( T )) #else #define NTFS_TYPE_ALIGNMENT(T) TYPE_ALIGNMENT( ULONG ) #endif // // BlockAlign(): Aligns P on the next V boundary. // BlockAlignTruncate(): Aligns P on the prev V boundary. // #define BlockAlign(P,V) (((P)) + (V-1) & (-(V))) #define BlockAlignTruncate(P,V) ((P) & (-(V))) // // BlockOffset(): Calculates offset within V of P // #define BlockOffset(P,V) ((P) & (V-1)) // // TypeAlign(): Aligns P according to the alignment requirements of type T // #define TypeAlign(P,T) BlockAlign( P, NTFS_TYPE_ALIGNMENT(T) ) // // IsTypeAligned(): Determines whether P is aligned according to the // requirements of type T // #define IsTypeAligned(P,T) \ ((ULONG_PTR)(P) == TypeAlign( (ULONG_PTR)(P), T )) // // Conversions between bytes and clusters. Typically we will round up to the // next cluster unless the macro specifies trucate. // #define ClusterAlign(V,P) ( \ ((((ULONG)(P)) + (V)->ClusterMask) & (V)->InverseClusterMask) \ ) #define ClusterOffset(V,P) ( \ (((ULONG)(P)) & (V)->ClusterMask) \ ) #define ClustersFromBytes(V,P) ( \ (((ULONG)(P)) + (V)->ClusterMask) >> (V)->ClusterShift \ ) #define ClustersFromBytesTruncate(V,P) ( \ ((ULONG)(P)) >> (V)->ClusterShift \ ) #define BytesFromClusters(V,P) ( \ ((ULONG)(P)) << (V)->ClusterShift \ ) #define LlClustersFromBytes(V,L) ( \ Int64ShraMod32(((L) + (LONGLONG) (V)->ClusterMask), (CCHAR)(V)->ClusterShift) \ ) #define LlClustersFromBytesTruncate(V,L) ( \ Int64ShraMod32((L), (CCHAR)(V)->ClusterShift) \ ) #define LlBytesFromClusters(V,C) ( \ Int64ShllMod32((C), (CCHAR)(V)->ClusterShift) \ ) // // Conversions between bytes and file records // #define BytesFromFileRecords(V,B) ( \ ((ULONG)(B)) << (V)->MftShift \ ) #define FileRecordsFromBytes(V,F) ( \ ((ULONG)(F)) >> (V)->MftShift \ ) #define LlBytesFromFileRecords(V,F) ( \ Int64ShllMod32((F), (CCHAR)(V)->MftShift) \ ) #define LlFileRecordsFromBytes(V,B) ( \ Int64ShraMod32((B), (CCHAR)(V)->MftShift) \ ) // // Conversions between bytes and index blocks // #define BytesFromIndexBlocks(B,S) ( \ ((ULONG)(B)) << (S) \ ) #define LlBytesFromIndexBlocks(B,S) ( \ Int64ShllMod32((B), (S)) \ ) // // Conversions between bytes and log blocks (512 byte blocks) // #define BytesFromLogBlocks(B) ( \ ((ULONG) (B)) << DEFAULT_INDEX_BLOCK_BYTE_SHIFT \ ) #define LogBlocksFromBytesTruncate(B) ( \ ((ULONG) (B)) >> DEFAULT_INDEX_BLOCK_BYTE_SHIFT \ ) #define Add2Ptr(P,I) ((PVOID)((PUCHAR)(P) + (I))) #define PtrOffset(B,O) ((ULONG)((ULONG_PTR)(O) - (ULONG_PTR)(B))) // // The following support macros deal with dir notify support. // // ULONG // NtfsBuildDirNotifyFilter ( // IN PIRP_CONTEXT IrpContext, // IN ULONG Flags // ); // // VOID // NtfsReportDirNotify ( // IN PIRP_CONTEXT IrpContext, // IN PVCB Vcb, // IN PUNICODE_STRING FullFileName, // IN USHORT TargetNameOffset, // IN PUNICODE_STRING StreamName OPTIONAL, // IN PUNICODE_STRING NormalizedParentName OPTIONAL, // IN ULONG Filter, // IN ULONG Action, // IN PFCB ParentFcb OPTIONAL // ); // // VOID // NtfsUnsafeReportDirNotify ( // IN PIRP_CONTEXT IrpContext, // IN PVCB Vcb, // IN PUNICODE_STRING FullFileName, // IN USHORT TargetNameOffset, // IN PUNICODE_STRING StreamName OPTIONAL, // IN PUNICODE_STRING NormalizedParentName OPTIONAL, // IN ULONG Filter, // IN ULONG Action, // IN PFCB ParentFcb OPTIONAL // ); // #define NtfsBuildDirNotifyFilter(IC,F) ( \ FlagOn( (F), FCB_INFO_CHANGED_ALLOC_SIZE ) ? \ (FlagOn( (F), FCB_INFO_VALID_NOTIFY_FLAGS ) | FILE_NOTIFY_CHANGE_SIZE) : \ FlagOn( (F), FCB_INFO_VALID_NOTIFY_FLAGS ) \ ) #define NtfsReportDirNotify(IC,V,FN,O,SN,NPN,F,A,PF) { \ try { \ FsRtlNotifyFilterReportChange( (V)->NotifySync, \ &(V)->DirNotifyList, \ (PSTRING) (FN), \ (USHORT) (O), \ (PSTRING) (SN), \ (PSTRING) (NPN), \ F, \ A, \ PF, \ NULL ); \ } except (FsRtlIsNtstatusExpected( GetExceptionCode() ) ? \ EXCEPTION_EXECUTE_HANDLER : \ EXCEPTION_CONTINUE_SEARCH) { \ NOTHING; \ } \ } #define NtfsUnsafeReportDirNotify(IC,V,FN,O,SN,NPN,F,A,PF) { \ FsRtlNotifyFilterReportChange( (V)->NotifySync, \ &(V)->DirNotifyList, \ (PSTRING) (FN), \ (USHORT) (O), \ (PSTRING) (SN), \ (PSTRING) (NPN), \ F, \ A, \ PF, \ NULL ); \ } // // The following types and macros are used to help unpack the packed and // misaligned fields found in the Bios parameter block // typedef union _UCHAR1 { UCHAR Uchar[1]; UCHAR ForceAlignment; } UCHAR1, *PUCHAR1; typedef union _UCHAR2 { UCHAR Uchar[2]; USHORT ForceAlignment; } UCHAR2, *PUCHAR2; typedef union _UCHAR4 { UCHAR Uchar[4]; ULONG ForceAlignment; } UCHAR4, *PUCHAR4; #define CopyUchar1(D,S) { \ *((UCHAR1 *)(D)) = *((UNALIGNED UCHAR1 *)(S)); \ } #define CopyUchar2(D,S) { \ *((UCHAR2 *)(D)) = *((UNALIGNED UCHAR2 *)(S)); \ } #define CopyUchar4(D,S) { \ *((UCHAR4 *)(D)) = *((UNALIGNED UCHAR4 *)(S)); \ } // // The following routines are used to set up and restore the top level // irp field in the local thread. They are contained in ntfsdata.c // PTOP_LEVEL_CONTEXT NtfsInitializeTopLevelIrp ( IN PTOP_LEVEL_CONTEXT TopLevelContext, IN BOOLEAN ForceTopLevel, IN BOOLEAN SetTopLevel ); // // BOOLEAN // NtfsIsTopLevelRequest ( // IN PIRP_CONTEXT IrpContext // ); // // BOOLEAN // NtfsIsTopLevelNtfs ( // IN PIRP_CONTEXT IrpContext // ); // // VOID // NtfsRestoreTopLevelIrp ( // ); // // PTOP_LEVEL_CONTEXT // NtfsGetTopLevelContext ( // ); // // PSCB // NtfsGetTopLevelHotFixScb ( // ); // // VCN // NtfsGetTopLevelHotFixVcn ( // ); // // BOOLEAN // NtfsIsTopLevelHotFixScb ( // IN PSCB Scb // ); // // VOID // NtfsUpdateIrpContextWithTopLevel ( // IN PIRP_CONTEXT IrpContext, // IN PTOP_LEVEL_CONTEXT TopLevelContext // ); // #define NtfsRestoreTopLevelIrp() { \ PTOP_LEVEL_CONTEXT TLC; \ TLC = (PTOP_LEVEL_CONTEXT) IoGetTopLevelIrp(); \ ASSERT( (TLC)->ThreadIrpContext != NULL ); \ (TLC)->Ntfs = 0; \ (TLC)->ThreadIrpContext = NULL; \ IoSetTopLevelIrp( (PIRP) (TLC)->SavedTopLevelIrp ); \ } #define NtfsGetTopLevelContext() ( \ (PTOP_LEVEL_CONTEXT) IoGetTopLevelIrp() \ ) #define NtfsIsTopLevelRequest(IC) ( \ ((IC) == (IC)->TopLevelIrpContext) && \ NtfsGetTopLevelContext()->TopLevelRequest \ ) #define NtfsIsTopLevelNtfs(IC) ( \ (IC) == (IC)->TopLevelIrpContext \ ) #define NtfsGetTopLevelHotFixScb() ( \ (NtfsGetTopLevelContext())->ScbBeingHotFixed \ ) #define NtfsGetTopLevelHotFixVcn() ( \ (NtfsGetTopLevelContext())->VboBeingHotFixed \ ) #define NtfsIsTopLevelHotFixScb(S) ( \ ((BOOLEAN) (NtfsGetTopLevelHotFixScb() == (S))) \ ) #define NtfsUpdateIrpContextWithTopLevel(IC,TLC) { \ if ((TLC)->ThreadIrpContext == NULL) { \ (TLC)->Ntfs = 0x5346544e; \ (TLC)->ThreadIrpContext = (IC); \ SetFlag( (IC)->State, IRP_CONTEXT_STATE_OWNS_TOP_LEVEL ); \ IoSetTopLevelIrp( (PIRP) (TLC) ); \ } \ (IC)->TopLevelIrpContext = (TLC)->ThreadIrpContext; \ } BOOLEAN NtfsSetCancelRoutine ( IN PIRP Irp, IN PDRIVER_CANCEL CancelRoutine, IN ULONG_PTR IrpInformation, IN ULONG Async ); BOOLEAN NtfsClearCancelRoutine ( IN PIRP Irp ); #ifdef NTFS_CHECK_BITMAP VOID NtfsBadBitmapCopy ( IN PIRP_CONTEXT IrpContext, IN ULONG BadBit, IN ULONG Length ); BOOLEAN NtfsCheckBitmap ( IN PVCB Vcb, IN ULONG Lcn, IN ULONG Count, IN BOOLEAN Set ); #endif // // The FSD Level dispatch routines. These routines are called by the // I/O system via the dispatch table in the Driver Object. // // They each accept as input a pointer to a device object (actually most // expect a volume device object, with the exception of the file system // control function which can also take a file system device object), and // a pointer to the IRP. They either perform the function at the FSD level // or post the request to the FSP work queue for FSP level processing. // NTSTATUS NtfsFsdDispatch ( // implemented in ntfsdata.c IN PVOLUME_DEVICE_OBJECT VolumeDeviceObject, IN PIRP Irp ); NTSTATUS NtfsFsdDispatchWait ( // implemented in ntfsdata.c IN PVOLUME_DEVICE_OBJECT VolumeDeviceObject, IN PIRP Irp ); NTSTATUS NtfsFsdCleanup ( // implemented in Cleanup.c IN PVOLUME_DEVICE_OBJECT VolumeDeviceObject, IN PIRP Irp ); NTSTATUS NtfsFsdClose ( // implemented in Close.c IN PVOLUME_DEVICE_OBJECT VolumeDeviceObject, IN PIRP Irp ); NTSTATUS NtfsFsdCreate ( // implemented in Create.c IN PVOLUME_DEVICE_OBJECT VolumeDeviceObject, IN PIRP Irp ); NTSTATUS NtfsDeviceIoControl ( // implemented in FsCtrl.c IN PIRP_CONTEXT IrpContext, IN PDEVICE_OBJECT DeviceObject, IN ULONG IoCtl, IN PVOID InputBuffer OPTIONAL, IN ULONG InputBufferLength, IN PVOID OutputBuffer OPTIONAL, IN ULONG OutputBufferLength, OUT PULONG_PTR IosbInformation OPTIONAL ); NTSTATUS NtfsFsdDirectoryControl ( // implemented in DirCtrl.c IN PVOLUME_DEVICE_OBJECT VolumeDeviceObject, IN PIRP Irp ); NTSTATUS NtfsFsdPnp ( // implemented in Pnp.c IN PVOLUME_DEVICE_OBJECT VolumeDeviceObject, IN PIRP Irp ); NTSTATUS NtfsFsdFlushBuffers ( // implemented in Flush.c IN PVOLUME_DEVICE_OBJECT VolumeDeviceObject, IN PIRP Irp ); NTSTATUS NtfsFlushUserStream ( // implemented in Flush.c IN PIRP_CONTEXT IrpContext, IN PSCB Scb, IN PLONGLONG FileOffset OPTIONAL, IN ULONG Length ); NTSTATUS NtfsFlushVolume ( // implemented in Flush.c IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN BOOLEAN FlushCache, IN BOOLEAN PurgeFromCache, IN BOOLEAN ReleaseAllFiles, IN BOOLEAN MarkFilesForDismount ); NTSTATUS NtfsFlushLsnStreams ( // implemented in Flush.c IN PVCB Vcb ); VOID NtfsFlushAndPurgeFcb ( // implemented in Flush.c IN PIRP_CONTEXT IrpContext, IN PFCB Fcb ); VOID NtfsFlushAndPurgeScb ( // implemented in Flush.c IN PIRP_CONTEXT IrpContext, IN PSCB Scb, IN PSCB ParentScb OPTIONAL ); NTSTATUS NtfsFsdFileSystemControl ( // implemented in FsCtrl.c IN PVOLUME_DEVICE_OBJECT VolumeDeviceObject, IN PIRP Irp ); NTSTATUS NtfsFsdLockControl ( // implemented in LockCtrl.c IN PVOLUME_DEVICE_OBJECT VolumeDeviceObject, IN PIRP Irp ); NTSTATUS NtfsFsdRead ( // implemented in Read.c IN PVOLUME_DEVICE_OBJECT VolumeDeviceObject, IN PIRP Irp ); NTSTATUS NtfsFsdSetInformation ( // implemented in FileInfo.c IN PVOLUME_DEVICE_OBJECT VolumeDeviceObject, IN PIRP Irp ); NTSTATUS NtfsFsdShutdown ( // implemented in Shutdown.c IN PVOLUME_DEVICE_OBJECT VolumeDeviceObject, IN PIRP Irp ); NTSTATUS NtfsFsdQueryVolumeInformation ( // implemented in VolInfo.c IN PVOLUME_DEVICE_OBJECT VolumeDeviceObject, IN PIRP Irp ); NTSTATUS NtfsFsdSetVolumeInformation ( // implemented in VolInfo.c IN PVOLUME_DEVICE_OBJECT VolumeDeviceObject, IN PIRP Irp ); NTSTATUS NtfsFsdWrite ( // implemented in Write.c IN PVOLUME_DEVICE_OBJECT VolumeDeviceObject, IN PIRP Irp ); // // The following macro is used to determine if an FSD thread can block // for I/O or wait for a resource. It returns TRUE if the thread can // block and FALSE otherwise. This attribute can then be used to call // the FSD & FSP common work routine with the proper wait value. // // // BOOLEAN // CanFsdWait ( // IN PIRP Irp // ); // #define CanFsdWait(I) IoIsOperationSynchronous(I) // // The FSP level dispatch/main routine. This is the routine that takes // IRP's off of the work queue and calls the appropriate FSP level // work routine. // VOID NtfsFspDispatch ( // implemented in FspDisp.c IN PVOID Context ); // // The following routines are the FSP work routines that are called // by the preceding NtfsFspDispath routine. Each takes as input a pointer // to the IRP, perform the function, and return a pointer to the volume // device object that they just finished servicing (if any). The return // pointer is then used by the main Fsp dispatch routine to check for // additional IRPs in the volume's overflow queue. // // Each of the following routines is also responsible for completing the IRP. // We moved this responsibility from the main loop to the individual routines // to allow them the ability to complete the IRP and continue post processing // actions. // NTSTATUS NtfsCommonCleanup ( // implemented in Cleanup.c IN PIRP_CONTEXT IrpContext, IN PIRP Irp ); LONG NtfsCleanupExceptionFilter ( // implemented in Cleanup.c IN PIRP_CONTEXT IrpContext, IN PEXCEPTION_POINTERS ExceptionPointer, OUT PNTSTATUS Status ); VOID NtfsFspClose ( // implemented in Close.c IN PVCB ThisVcb OPTIONAL ); BOOLEAN NtfsAddScbToFspClose ( // implemented in Close.c IN PIRP_CONTEXT IrpContext, IN PSCB Scb, IN BOOLEAN DelayClose ); BOOLEAN NtfsNetworkOpenCreate ( // implemented in Create.c IN PIRP Irp, OUT PFILE_NETWORK_OPEN_INFORMATION Buffer, IN PDEVICE_OBJECT VolumeDeviceObject ); NTSTATUS NtfsCommonCreate ( // implemented in Create.c IN PIRP_CONTEXT IrpContext, IN PIRP Irp, IN IN POPLOCK_CLEANUP OplockCleanup, OUT PFILE_NETWORK_OPEN_INFORMATION NetworkInfo OPTIONAL ); VOID NtfsInitializeFcbAndStdInfo ( IN PIRP_CONTEXT IrpContext, IN PFCB ThisFcb, IN BOOLEAN Directory, IN BOOLEAN ViewIndex, IN BOOLEAN Compressed, IN ULONG FileAttributes, IN PNTFS_TUNNELED_DATA SetTunnelData OPTIONAL ); NTSTATUS NtfsCommonVolumeOpen ( // implemented in Create.c IN PIRP_CONTEXT IrpContext, IN PIRP Irp ); NTSTATUS NtfsCommonDeviceControl ( // implemented in DevCtrl.c IN PIRP_CONTEXT IrpContext, IN PIRP Irp ); NTSTATUS NtfsCommonDirectoryControl ( // implemented in DirCtrl.c IN PIRP_CONTEXT IrpContext, IN PIRP Irp ); VOID NtfsReportViewIndexNotify ( // implemented in DirCtrl.c IN PVCB Vcb, IN PFCB Fcb, IN ULONG FilterMatch, IN ULONG Action, IN PVOID ChangeInfoBuffer, IN USHORT ChangeInfoBufferLength ); NTSTATUS NtfsCommonQueryEa ( // implemented in Ea.c IN PIRP_CONTEXT IrpContext, IN PIRP Irp ); NTSTATUS NtfsCommonSetEa ( // implemented in Ea.c IN PIRP_CONTEXT IrpContext, IN PIRP Irp ); NTSTATUS NtfsCommonQueryInformation ( // implemented in FileInfo.c IN PIRP_CONTEXT IrpContext, IN PIRP Irp ); NTSTATUS NtfsCommonSetInformation ( // implemented in FileInfo.c IN PIRP_CONTEXT IrpContext, IN PIRP Irp ); NTSTATUS // implemented in FsCtrl.c NtfsGetTunneledData ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN OUT PNTFS_TUNNELED_DATA TunneledData ); NTSTATUS // implemented in FsCtrl.c NtfsSetTunneledData ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN PNTFS_TUNNELED_DATA TunneledData ); NTSTATUS NtfsCommonQueryQuota ( // implemented in Quota.c IN PIRP_CONTEXT IrpContext, IN PIRP Irp ); NTSTATUS NtfsCommonSetQuota ( // implemented in Quota.c IN PIRP_CONTEXT IrpContext, IN PIRP Irp ); NTSTATUS NtfsCommonFlushBuffers ( // implemented in Flush.c IN PIRP_CONTEXT IrpContext, IN PIRP Irp ); NTSTATUS NtfsCommonFileSystemControl ( // implemented in FsCtrl.c IN PIRP_CONTEXT IrpContext, IN PIRP Irp ); NTSTATUS NtfsCommonLockControl ( // implemented in LockCtrl.c IN PIRP_CONTEXT IrpContext, IN PIRP Irp ); NTSTATUS NtfsCommonRead ( // implemented in Read.c IN PIRP_CONTEXT IrpContext, IN PIRP Irp, IN BOOLEAN AcquireScb ); NTSTATUS NtfsCommonQuerySecurityInfo ( // implemented in SeInfo.c IN PIRP_CONTEXT IrpContext, IN PIRP Irp ); NTSTATUS NtfsCommonSetSecurityInfo ( // implemented in SeInfo.c IN PIRP_CONTEXT IrpContext, IN PIRP Irp ); NTSTATUS NtfsQueryViewIndex ( // implemented in ViewSup.c IN PIRP_CONTEXT IrpContext, IN PIRP Irp, IN PVCB Vcb, IN PSCB Scb, IN PCCB Ccb ); NTSTATUS NtfsCommonQueryVolumeInfo ( // implemented in VolInfo.c IN PIRP_CONTEXT IrpContext, IN PIRP Irp ); NTSTATUS NtfsCommonSetVolumeInfo ( // implemented in VolInfo.c IN PIRP_CONTEXT IrpContext, IN PIRP Irp ); NTSTATUS NtfsCommonWrite ( // implemented in Write.c IN PIRP_CONTEXT IrpContext, IN PIRP Irp ); // // The following procedure is used by the FSP and FSD routines to complete // an IRP. Either the Irp or IrpContext may be NULL depending on whether // this is being done for a user or for a FS service. // // This would typically be done in order to pass a "naked" IrpContext off to // the Fsp for post processing, such as read ahead. // VOID NtfsCompleteRequest ( IN OUT PIRP_CONTEXT IrpContext OPTIONAL, IN OUT PIRP Irp OPTIONAL, IN NTSTATUS Status ); // // Here are the callbacks used by the I/O system for checking for fast I/O or // doing a fast query info call, or doing fast lock calls. // BOOLEAN NtfsFastIoCheckIfPossible ( IN PFILE_OBJECT FileObject, IN PLARGE_INTEGER FileOffset, IN ULONG Length, IN BOOLEAN Wait, IN ULONG LockKey, IN BOOLEAN CheckForReadOperation, OUT PIO_STATUS_BLOCK IoStatus, IN PDEVICE_OBJECT DeviceObject ); BOOLEAN NtfsFastQueryBasicInfo ( IN PFILE_OBJECT FileObject, IN BOOLEAN Wait, IN OUT PFILE_BASIC_INFORMATION Buffer, OUT PIO_STATUS_BLOCK IoStatus, IN PDEVICE_OBJECT DeviceObject ); BOOLEAN NtfsFastQueryStdInfo ( IN PFILE_OBJECT FileObject, IN BOOLEAN Wait, IN OUT PFILE_STANDARD_INFORMATION Buffer, OUT PIO_STATUS_BLOCK IoStatus, IN PDEVICE_OBJECT DeviceObject ); BOOLEAN NtfsFastLock ( IN PFILE_OBJECT FileObject, IN PLARGE_INTEGER FileOffset, IN PLARGE_INTEGER Length, PEPROCESS ProcessId, ULONG Key, BOOLEAN FailImmediately, BOOLEAN ExclusiveLock, OUT PIO_STATUS_BLOCK IoStatus, IN PDEVICE_OBJECT DeviceObject ); BOOLEAN NtfsFastUnlockSingle ( IN PFILE_OBJECT FileObject, IN PLARGE_INTEGER FileOffset, IN PLARGE_INTEGER Length, PEPROCESS ProcessId, ULONG Key, OUT PIO_STATUS_BLOCK IoStatus, IN PDEVICE_OBJECT DeviceObject ); BOOLEAN NtfsFastUnlockAll ( IN PFILE_OBJECT FileObject, PEPROCESS ProcessId, OUT PIO_STATUS_BLOCK IoStatus, IN PDEVICE_OBJECT DeviceObject ); BOOLEAN NtfsFastUnlockAllByKey ( IN PFILE_OBJECT FileObject, PVOID ProcessId, ULONG Key, OUT PIO_STATUS_BLOCK IoStatus, IN PDEVICE_OBJECT DeviceObject ); BOOLEAN NtfsFastQueryNetworkOpenInfo ( IN struct _FILE_OBJECT *FileObject, IN BOOLEAN Wait, OUT struct _FILE_NETWORK_OPEN_INFORMATION *Buffer, OUT struct _IO_STATUS_BLOCK *IoStatus, IN struct _DEVICE_OBJECT *DeviceObject ); VOID NtfsFastIoQueryCompressionInfo ( IN PFILE_OBJECT FileObject, OUT PFILE_COMPRESSION_INFORMATION Buffer, OUT PIO_STATUS_BLOCK IoStatus ); VOID NtfsFastIoQueryCompressedSize ( IN PFILE_OBJECT FileObject, IN PLARGE_INTEGER FileOffset, OUT PULONG CompressedSize ); // // The following macro is used by the dispatch routines to determine if // an operation is to be done with or without WriteThrough. // // BOOLEAN // IsFileWriteThrough ( // IN PFILE_OBJECT FileObject, // IN PVCB Vcb // ); // #define IsFileWriteThrough(FO,V) ( \ FlagOn((FO)->Flags, FO_WRITE_THROUGH) \ ) // // The following macro is used to set the is fast i/o possible field in // the common part of the non paged fcb // // NotPossible - Volume not mounted // - Oplock state prevents it // // Possible - Not compressed or sparse // - No file locks // - Not a read only volume // - No Usn journal for this volume // // Questionable - All other cases // // // BOOLEAN // NtfsIsFastIoPossible ( // IN PSCB Scb // ); // #define NtfsIsFastIoPossible(S) (BOOLEAN) ( \ (!FlagOn((S)->Vcb->VcbState, VCB_STATE_VOLUME_MOUNTED) || \ !FsRtlOplockIsFastIoPossible( &(S)->ScbType.Data.Oplock )) ? \ \ FastIoIsNotPossible : \ \ ((((S)->CompressionUnit == 0) && \ (((S)->ScbType.Data.FileLock == NULL) || \ !FsRtlAreThereCurrentFileLocks( (S)->ScbType.Data.FileLock )) && \ !NtfsIsVolumeReadOnly( (S)->Vcb ) && \ ((S)->Vcb->UsnJournal == NULL)) ? \ \ FastIoIsPossible : \ \ FastIoIsQuestionable) \ ) // // The following macro is used to detemine if the file object is opened // for read only access (i.e., it is not also opened for write access or // delete access). // // BOOLEAN // IsFileObjectReadOnly ( // IN PFILE_OBJECT FileObject // ); // #define IsFileObjectReadOnly(FO) (!((FO)->WriteAccess | (FO)->DeleteAccess)) // // The following macros are used to establish the semantics needed // to do a return from within a try-finally clause. As a rule every // try clause must end with a label call try_exit. For example, // // try { // : // : // // try_exit: NOTHING; // } finally { // // : // : // } // // Every return statement executed inside of a try clause should use the // try_return macro. If the compiler fully supports the try-finally construct // then the macro should be // // #define try_return(S) { return(S); } // // If the compiler does not support the try-finally construct then the macro // should be // // #define try_return(S) { S; goto try_exit; } // #define try_return(S) { S; goto try_exit; } // // Simple initialization for a name pair // // VOID // NtfsInitializeNamePair(PNAME_PAIR PNp); // #define NtfsInitializeNamePair(PNp) { \ (PNp)->Short.Buffer = (PNp)->ShortBuffer; \ (PNp)->Long.Buffer = (PNp)->LongBuffer; \ (PNp)->Short.Length = 0; \ (PNp)->Long.Length = 0; \ (PNp)->Short.MaximumLength = sizeof((PNp)->ShortBuffer); \ (PNp)->Long.MaximumLength = sizeof((PNp)->LongBuffer); \ } // // Copy a length of WCHARs into a side of a name pair. Only copy the first name // that fits to avoid useless work if more than three links are encountered (per // BrianAn), very rare case. We use the filename flags to figure out what kind of // name we have. // // VOID // NtfsCopyNameToNamePair( // PNAME_PAIR PNp, // WCHAR Source, // ULONG SourceLen, // UCHAR NameFlags); // #define NtfsCopyNameToNamePair(PNp, Source, SourceLen, NameFlags) { \ if (!FlagOn((NameFlags), FILE_NAME_DOS)) { \ if ((PNp)->Long.Length == 0) { \ if ((PNp)->Long.MaximumLength < ((SourceLen)*sizeof(WCHAR))) { \ if ((PNp)->Long.Buffer != (PNp)->LongBuffer) { \ NtfsFreePool((PNp)->Long.Buffer); \ (PNp)->Long.Buffer = (PNp)->LongBuffer; \ (PNp)->Long.MaximumLength = sizeof((PNp)->LongBuffer); \ } \ (PNp)->Long.Buffer = NtfsAllocatePool(PagedPool,(SourceLen)*sizeof(WCHAR)); \ (PNp)->Long.MaximumLength = (SourceLen)*sizeof(WCHAR); \ } \ RtlCopyMemory((PNp)->Long.Buffer, (Source), (SourceLen)*sizeof(WCHAR)); \ (PNp)->Long.Length = (SourceLen)*sizeof(WCHAR); \ } \ } else { \ ASSERT((PNp)->Short.Buffer == (PNp)->ShortBuffer); \ if ((PNp)->Short.Length == 0) { \ RtlCopyMemory((PNp)->Short.Buffer, (Source), (SourceLen)*sizeof(WCHAR)); \ (PNp)->Short.Length = (SourceLen)*sizeof(WCHAR); \ } \ } \ } // // Set up a previously used name pair for reuse. // // VOID // NtfsResetNamePair(PNAME_PAIR PNp); // #define NtfsResetNamePair(PNp) { \ if ((PNp)->Long.Buffer != (PNp)->LongBuffer) { \ NtfsFreePool((PNp)->Long.Buffer); \ } \ NtfsInitializeNamePair(PNp); \ } // // Cairo support stuff. // typedef NTSTATUS (*FILE_RECORD_WALK) ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN OUT PVOID Context ); NTSTATUS NtfsIterateMft ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN OUT PFILE_REFERENCE FileReference, IN FILE_RECORD_WALK FileRecordFunction, IN PVOID Context ); VOID NtfsPostSpecial ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN POST_SPECIAL_CALLOUT PostSpecialCallout, IN PVOID Context ); VOID NtfsSpecialDispatch ( PVOID Context ); VOID NtfsLoadAddOns ( IN struct _DRIVER_OBJECT *DriverObject, IN PVOID Context, IN ULONG Count ); NTSTATUS NtfsTryOpenFcb ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, OUT PFCB *CurrentFcb, IN FILE_REFERENCE FileReference ); // // The following define controls whether quota operations are done // on this FCB. // #define NtfsPerformQuotaOperation(FCB) ((FCB)->QuotaControl != NULL) VOID NtfsAcquireQuotaControl ( IN PIRP_CONTEXT IrpContext, IN PQUOTA_CONTROL_BLOCK QuotaControl ); VOID NtfsCalculateQuotaAdjustment ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, OUT PLONGLONG Delta ); VOID NtfsDereferenceQuotaControlBlock ( IN PVCB Vcb, IN PQUOTA_CONTROL_BLOCK *QuotaControl ); VOID NtfsFixupQuota ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb ); NTSTATUS NtfsFsQuotaQueryInfo ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN ULONG StartingId, IN BOOLEAN ReturnSingleEntry, IN PFILE_QUOTA_INFORMATION *FileQuotaInfo, IN OUT PULONG Length, IN OUT PCCB Ccb OPTIONAL ); NTSTATUS NtfsFsQuotaSetInfo ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN PFILE_QUOTA_INFORMATION FileQuotaInfo, IN ULONG Length ); VOID NtfsGetRemainingQuota ( IN PIRP_CONTEXT IrpContext, IN ULONG OwnerId, OUT PULONGLONG RemainingQuota, OUT PULONGLONG TotalQuota, IN OUT PQUICK_INDEX_HINT QuickIndexHint OPTIONAL ); ULONG NtfsGetCallersUserId ( IN PIRP_CONTEXT IrpContext ); ULONG NtfsGetOwnerId ( IN PIRP_CONTEXT IrpContext, IN PSID Sid, IN BOOLEAN CreateNew, IN PFILE_QUOTA_INFORMATION FileQuotaInfo OPTIONAL ); PQUOTA_CONTROL_BLOCK NtfsInitializeQuotaControlBlock ( IN PVCB Vcb, IN ULONG OwnerId ); VOID NtfsInitializeQuotaIndex ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN PVCB Vcb ); VOID NtfsMarkQuotaCorrupt ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb ); VOID NtfsRepairQuotaIndex ( IN PIRP_CONTEXT IrpContext, IN PVOID Context ); VOID NtfsMoveQuotaOwner ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN PSECURITY_DESCRIPTOR Security ); VOID NtfsPostRepairQuotaIndex ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb ); NTSTATUS NtfsQueryQuotaUserSidList ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN PFILE_GET_QUOTA_INFORMATION SidList, OUT PFILE_QUOTA_INFORMATION QuotaBuffer, IN OUT PULONG BufferLength, IN BOOLEAN ReturnSingleEntry ); VOID NtfsReleaseQuotaControl ( IN PIRP_CONTEXT IrpContext, IN PQUOTA_CONTROL_BLOCK QuotaControl ); VOID NtfsUpdateFileQuota ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN PLONGLONG Delta, IN LOGICAL LogIt, IN LOGICAL CheckQuota ); VOID NtfsUpdateQuotaDefaults ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN PFILE_FS_CONTROL_INFORMATION FileQuotaInfo ); INLINE VOID NtfsConditionallyFixupQuota ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb ) { if (FlagOn( Fcb->Vcb->QuotaFlags, QUOTA_FLAG_TRACKING_ENABLED )) { NtfsFixupQuota ( IrpContext, Fcb ); } } INLINE VOID NtfsConditionallyUpdateQuota ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN PLONGLONG Delta, IN LOGICAL LogIt, IN LOGICAL CheckQuota ) { if (NtfsPerformQuotaOperation( Fcb ) && !FlagOn( IrpContext->State, IRP_CONTEXT_STATE_QUOTA_DISABLE )) { NtfsUpdateFileQuota( IrpContext, Fcb, Delta, LogIt, CheckQuota ); } } extern BOOLEAN NtfsAllowFixups; INLINE VOID NtfsReleaseQuotaIndex ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb, IN BOOLEAN Acquired ) { if (Acquired) { NtfsReleaseScb( IrpContext, Vcb->QuotaTableScb ); } } // // Define the quota charge for resident streams. // #define NtfsResidentStreamQuota( Vcb ) ((LONG) Vcb->BytesPerFileRecordSegment) // // The following macro tests to see if it is ok for an internal routine to // write to the volume. // #define NtfsIsVcbAvailable( Vcb ) (FlagOn( Vcb->VcbState, \ VCB_STATE_VOLUME_MOUNTED | \ VCB_STATE_FLAG_SHUTDOWN | \ VCB_STATE_PERFORMED_DISMOUNT | \ VCB_STATE_LOCKED) == VCB_STATE_VOLUME_MOUNTED) // // Test to see if the volume is mounted read only. // #define NtfsIsVolumeReadOnly( Vcb ) (FlagOn( (Vcb)->VcbState, VCB_STATE_MOUNT_READ_ONLY )) // // Processing required so reg. exception filter works if another one is being used // to handle an exception that could be raise via NtfsRaiseStatus. If its always // rethrown this is not necc. // #define NtfsMinimumExceptionProcessing(I) { \ if((I) != NULL) { \ ClearFlag( (I)->Flags, IRP_CONTEXT_FLAG_RAISED_STATUS ); \ } \ } #ifdef NTFSDBG BOOLEAN NtfsChangeResourceOrderState( IN PIRP_CONTEXT IrpContext, IN NTFS_RESOURCE_NAME NewResource, IN BOOLEAN Release, IN ULONG UnsafeTransition ); NTFS_RESOURCE_NAME NtfsIdentifyFcb ( IN PVCB Vcb, IN PFCB Fcb ); #endif // // Size of a normalized name which is long enough to be freed at cleanup // #define LONGNAME_THRESHOLD 0x200 VOID NtfsTrimNormalizedNames ( IN PIRP_CONTEXT IrpContext, IN PFCB Fcb, IN PSCB ParentScb ); #define NtfsSnapshotFileSizesTest( I, S ) (FlagOn( (S)->ScbState, SCB_STATE_MODIFIED_NO_WRITE | SCB_STATE_CONVERT_UNDERWAY ) || \ ((S) == (I)->CleanupStructure) || \ ((S)->Fcb == (I)->CleanupStructure)) // // Reservation needed = AllocationSize // largest transfer size - this is because in a single transfer we cannot reuse clusters we freed from the totalallocated piece of the calculation // metadata charge for new clusters // minus the already allocated space // // // One problem with the reservation strategy, is that we cannot precisely reserve // for metadata. If we reserve too much, we will return premature disk full, if // we reserve too little, the Lazy Writer can get an error. As we add compression // units to a file, large files will eventually require additional File Records. // If each compression unit required 0x20 bytes of run information (fairly pessimistic) // then a 0x400 size file record would fill up with less than 0x20 runs requiring // (worst case) two additional clusters for another file record. So each 0x20 // compression units require 0x200 reserved clusters, and a separate 2 cluster // file record. 0x200/2 = 0x100. So the calculations below tack a 1/0x100 (about // .4% "surcharge" on the amount reserved both in the Scb and the Vcb, to solve // the Lazy Writer popups like the ones Alan Morris gets in the print lab. // #define NtfsCalculateNeededReservedSpace( S ) \ ((S)->Header.AllocationSize.QuadPart + \ MM_MAXIMUM_DISK_IO_SIZE + \ (S)->CompressionUnit - \ (FlagOn( (S)->Vcb->VcbState, VCB_STATE_RESTART_IN_PROGRESS ) ? \ (S)->Header.AllocationSize.QuadPart : \ (S)->TotalAllocated) + \ (Int64ShraMod32( (S)->ScbType.Data.TotalReserved, 8 ))) PDEALLOCATED_CLUSTERS NtfsGetDeallocatedClusters ( IN PIRP_CONTEXT IrpContext, IN PVCB Vcb ); // // Dynamically allocate stack space for local variables. // #define NtfsAllocateFromStack(S) _alloca(S) // // Common Create Flag definitions // #define CREATE_FLAG_DOS_ONLY_COMPONENT (0x00000001) #define CREATE_FLAG_CREATE_FILE_CASE (0x00000002) #define CREATE_FLAG_DELETE_ON_CLOSE (0x00000004) #define CREATE_FLAG_TRAILING_BACKSLASH (0x00000008) #define CREATE_FLAG_TRAVERSE_CHECK (0x00000010) #define CREATE_FLAG_IGNORE_CASE (0x00000020) #define CREATE_FLAG_OPEN_BY_ID (0x00000040) #define CREATE_FLAG_ACQUIRED_OBJECT_ID_INDEX (0x00000080) #define CREATE_FLAG_BACKOUT_FAILED_OPENS (0x00000100) #define CREATE_FLAG_INSPECT_NAME_FOR_REPARSE (0x00000200) #define CREATE_FLAG_SHARED_PARENT_FCB (0x00000400) #define CREATE_FLAG_ACQUIRED_VCB (0x00000800) #define CREATE_FLAG_CHECK_FOR_VALID_NAME (0x00001000) #define CREATE_FLAG_FIRST_PASS (0x00002000) #define CREATE_FLAG_FOUND_ENTRY (0x00004000) #endif // _NTFSPROC_