[NTFS] Use LookasideList allocations for FILE_RECORD_HEADER.
[reactos.git] / drivers / filesystems / ntfs / mft.c
1 /*
2 * ReactOS kernel
3 * Copyright (C) 2002, 2014 ReactOS Team
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; either version 2 of the License, or
8 * (at your option) any later version.
9 *
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
14 *
15 * You should have received a copy of the GNU General Public License
16 * along with this program; if not, write to the Free Software
17 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.
18 *
19 * COPYRIGHT: See COPYING in the top level directory
20 * PROJECT: ReactOS kernel
21 * FILE: drivers/filesystem/ntfs/mft.c
22 * PURPOSE: NTFS filesystem driver
23 * PROGRAMMERS: Eric Kohl
24 * Valentin Verkhovsky
25 * Pierre Schweitzer (pierre@reactos.org)
26 * Hervé Poussineau (hpoussin@reactos.org)
27 * Trevor Thompson
28 */
29
30 /* INCLUDES *****************************************************************/
31
32 #include "ntfs.h"
33 #include <ntintsafe.h>
34
35 #define NDEBUG
36 #include <debug.h>
37
38 /* FUNCTIONS ****************************************************************/
39
40 PNTFS_ATTR_CONTEXT
41 PrepareAttributeContext(PNTFS_ATTR_RECORD AttrRecord)
42 {
43 PNTFS_ATTR_CONTEXT Context;
44
45 Context = ExAllocateFromNPagedLookasideList(&NtfsGlobalData->AttrCtxtLookasideList);
46 if(!Context)
47 {
48 DPRINT1("Error: Unable to allocate memory for context!\n");
49 return NULL;
50 }
51
52 // Allocate memory for a copy of the attribute
53 Context->pRecord = ExAllocatePoolWithTag(NonPagedPool, AttrRecord->Length, TAG_NTFS);
54 if(!Context->pRecord)
55 {
56 DPRINT1("Error: Unable to allocate memory for attribute record!\n");
57 ExFreeToNPagedLookasideList(&NtfsGlobalData->AttrCtxtLookasideList, Context);
58 return NULL;
59 }
60
61 // Copy the attribute
62 RtlCopyMemory(Context->pRecord, AttrRecord, AttrRecord->Length);
63
64 if (AttrRecord->IsNonResident)
65 {
66 LONGLONG DataRunOffset;
67 ULONGLONG DataRunLength;
68 ULONGLONG NextVBN = 0;
69 PUCHAR DataRun = (PUCHAR)((ULONG_PTR)Context->pRecord + Context->pRecord->NonResident.MappingPairsOffset);
70
71 Context->CacheRun = DataRun;
72 Context->CacheRunOffset = 0;
73 Context->CacheRun = DecodeRun(Context->CacheRun, &DataRunOffset, &DataRunLength);
74 Context->CacheRunLength = DataRunLength;
75 if (DataRunOffset != -1)
76 {
77 /* Normal run. */
78 Context->CacheRunStartLCN =
79 Context->CacheRunLastLCN = DataRunOffset;
80 }
81 else
82 {
83 /* Sparse run. */
84 Context->CacheRunStartLCN = -1;
85 Context->CacheRunLastLCN = 0;
86 }
87 Context->CacheRunCurrentOffset = 0;
88
89 // Convert the data runs to a map control block
90 if (!NT_SUCCESS(ConvertDataRunsToLargeMCB(DataRun, &Context->DataRunsMCB, &NextVBN)))
91 {
92 DPRINT1("Unable to convert data runs to MCB!\n");
93 ExFreePoolWithTag(Context->pRecord, TAG_NTFS);
94 ExFreeToNPagedLookasideList(&NtfsGlobalData->AttrCtxtLookasideList, Context);
95 return NULL;
96 }
97 }
98
99 return Context;
100 }
101
102
103 VOID
104 ReleaseAttributeContext(PNTFS_ATTR_CONTEXT Context)
105 {
106 if (Context->pRecord)
107 {
108 if (Context->pRecord->IsNonResident)
109 {
110 FsRtlUninitializeLargeMcb(&Context->DataRunsMCB);
111 }
112
113 ExFreePoolWithTag(Context->pRecord, TAG_NTFS);
114 }
115
116 ExFreeToNPagedLookasideList(&NtfsGlobalData->AttrCtxtLookasideList, Context);
117 }
118
119
120 /**
121 * @name FindAttribute
122 * @implemented
123 *
124 * Searches a file record for an attribute matching the given type and name.
125 *
126 * @param Offset
127 * Optional pointer to a ULONG that will receive the offset of the found attribute
128 * from the beginning of the record. Can be set to NULL.
129 */
130 NTSTATUS
131 FindAttribute(PDEVICE_EXTENSION Vcb,
132 PFILE_RECORD_HEADER MftRecord,
133 ULONG Type,
134 PCWSTR Name,
135 ULONG NameLength,
136 PNTFS_ATTR_CONTEXT * AttrCtx,
137 PULONG Offset)
138 {
139 BOOLEAN Found;
140 NTSTATUS Status;
141 FIND_ATTR_CONTXT Context;
142 PNTFS_ATTR_RECORD Attribute;
143
144 DPRINT("FindAttribute(%p, %p, 0x%x, %S, %lu, %p, %p)\n", Vcb, MftRecord, Type, Name, NameLength, AttrCtx, Offset);
145
146 Found = FALSE;
147 Status = FindFirstAttribute(&Context, Vcb, MftRecord, FALSE, &Attribute);
148 while (NT_SUCCESS(Status))
149 {
150 if (Attribute->Type == Type && Attribute->NameLength == NameLength)
151 {
152 if (NameLength != 0)
153 {
154 PWCHAR AttrName;
155
156 AttrName = (PWCHAR)((PCHAR)Attribute + Attribute->NameOffset);
157 DPRINT("%.*S, %.*S\n", Attribute->NameLength, AttrName, NameLength, Name);
158 if (RtlCompareMemory(AttrName, Name, NameLength * sizeof(WCHAR)) == (NameLength * sizeof(WCHAR)))
159 {
160 Found = TRUE;
161 }
162 }
163 else
164 {
165 Found = TRUE;
166 }
167
168 if (Found)
169 {
170 /* Found it, fill up the context and return. */
171 DPRINT("Found context\n");
172 *AttrCtx = PrepareAttributeContext(Attribute);
173
174 (*AttrCtx)->FileMFTIndex = MftRecord->MFTRecordNumber;
175
176 if (Offset != NULL)
177 *Offset = Context.Offset;
178
179 FindCloseAttribute(&Context);
180 return STATUS_SUCCESS;
181 }
182 }
183
184 Status = FindNextAttribute(&Context, &Attribute);
185 }
186
187 FindCloseAttribute(&Context);
188 return STATUS_OBJECT_NAME_NOT_FOUND;
189 }
190
191
192 ULONGLONG
193 AttributeAllocatedLength(PNTFS_ATTR_RECORD AttrRecord)
194 {
195 if (AttrRecord->IsNonResident)
196 return AttrRecord->NonResident.AllocatedSize;
197 else
198 return ALIGN_UP_BY(AttrRecord->Resident.ValueLength, ATTR_RECORD_ALIGNMENT);
199 }
200
201
202 ULONGLONG
203 AttributeDataLength(PNTFS_ATTR_RECORD AttrRecord)
204 {
205 if (AttrRecord->IsNonResident)
206 return AttrRecord->NonResident.DataSize;
207 else
208 return AttrRecord->Resident.ValueLength;
209 }
210
211 /**
212 * @name IncreaseMftSize
213 * @implemented
214 *
215 * Increases the size of the master file table on a volume, increasing the space available for file records.
216 *
217 * @param Vcb
218 * Pointer to the VCB (DEVICE_EXTENSION) of the target volume.
219 *
220 *
221 * @param CanWait
222 * Boolean indicating if the function is allowed to wait for exclusive access to the master file table.
223 * This will only be relevant if the MFT doesn't have any free file records and needs to be enlarged.
224 *
225 * @return
226 * STATUS_SUCCESS on success.
227 * STATUS_INSUFFICIENT_RESOURCES if an allocation fails.
228 * STATUS_INVALID_PARAMETER if there was an error reading the Mft's bitmap.
229 * STATUS_CANT_WAIT if CanWait was FALSE and the function could not get immediate, exclusive access to the MFT.
230 *
231 * @remarks
232 * Increases the size of the Master File Table by 64 records. Bitmap entries for the new records are cleared,
233 * and the bitmap is also enlarged if needed. Mimicking Windows' behavior when enlarging the mft is still TODO.
234 * This function will wait for exlusive access to the volume fcb.
235 */
236 NTSTATUS
237 IncreaseMftSize(PDEVICE_EXTENSION Vcb, BOOLEAN CanWait)
238 {
239 PNTFS_ATTR_CONTEXT BitmapContext;
240 LARGE_INTEGER BitmapSize;
241 LARGE_INTEGER DataSize;
242 LONGLONG BitmapSizeDifference;
243 ULONG NewRecords = ATTR_RECORD_ALIGNMENT * 8; // Allocate one new record for every bit of every byte we'll be adding to the bitmap
244 ULONG DataSizeDifference = Vcb->NtfsInfo.BytesPerFileRecord * NewRecords;
245 ULONG BitmapOffset;
246 PUCHAR BitmapBuffer;
247 ULONGLONG BitmapBytes;
248 ULONGLONG NewBitmapSize;
249 ULONGLONG FirstNewMftIndex;
250 ULONG BytesRead;
251 ULONG LengthWritten;
252 PFILE_RECORD_HEADER BlankFileRecord;
253 ULONG i;
254 NTSTATUS Status;
255
256 DPRINT1("IncreaseMftSize(%p, %s)\n", Vcb, CanWait ? "TRUE" : "FALSE");
257
258 // We need exclusive access to the mft while we change its size
259 if (!ExAcquireResourceExclusiveLite(&(Vcb->DirResource), CanWait))
260 {
261 return STATUS_CANT_WAIT;
262 }
263
264 // Create a blank file record that will be used later
265 BlankFileRecord = NtfsCreateEmptyFileRecord(Vcb);
266 if (!BlankFileRecord)
267 {
268 DPRINT1("Error: Unable to create empty file record!\n");
269 return STATUS_INSUFFICIENT_RESOURCES;
270 }
271
272 // Clear the flags (file record is not in use)
273 BlankFileRecord->Flags = 0;
274
275 // Find the bitmap attribute of master file table
276 Status = FindAttribute(Vcb, Vcb->MasterFileTable, AttributeBitmap, L"", 0, &BitmapContext, NULL);
277 if (!NT_SUCCESS(Status))
278 {
279 DPRINT1("ERROR: Couldn't find $BITMAP attribute of Mft!\n");
280 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, BlankFileRecord);
281 ExReleaseResourceLite(&(Vcb->DirResource));
282 return Status;
283 }
284
285 // Get size of Bitmap Attribute
286 BitmapSize.QuadPart = AttributeDataLength(BitmapContext->pRecord);
287
288 // Calculate the new mft size
289 DataSize.QuadPart = AttributeDataLength(Vcb->MFTContext->pRecord) + DataSizeDifference;
290
291 // Find the index of the first Mft entry that will be created
292 FirstNewMftIndex = AttributeDataLength(Vcb->MFTContext->pRecord) / Vcb->NtfsInfo.BytesPerFileRecord;
293
294 // Determine how many bytes will make up the bitmap
295 BitmapBytes = DataSize.QuadPart / Vcb->NtfsInfo.BytesPerFileRecord / 8;
296 if ((DataSize.QuadPart / Vcb->NtfsInfo.BytesPerFileRecord) % 8 != 0)
297 BitmapBytes++;
298
299 // Windows will always keep the number of bytes in a bitmap as a multiple of 8, so no bytes are wasted on slack
300 BitmapBytes = ALIGN_UP_BY(BitmapBytes, ATTR_RECORD_ALIGNMENT);
301
302 // Determine how much we need to adjust the bitmap size (it's possible we don't)
303 BitmapSizeDifference = BitmapBytes - BitmapSize.QuadPart;
304 NewBitmapSize = max(BitmapSize.QuadPart + BitmapSizeDifference, BitmapSize.QuadPart);
305
306 // Allocate memory for the bitmap
307 BitmapBuffer = ExAllocatePoolWithTag(NonPagedPool, NewBitmapSize, TAG_NTFS);
308 if (!BitmapBuffer)
309 {
310 DPRINT1("ERROR: Unable to allocate memory for bitmap attribute!\n");
311 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, BlankFileRecord);
312 ExReleaseResourceLite(&(Vcb->DirResource));
313 ReleaseAttributeContext(BitmapContext);
314 return STATUS_INSUFFICIENT_RESOURCES;
315 }
316
317 // Zero the bytes we'll be adding
318 RtlZeroMemory(BitmapBuffer, NewBitmapSize);
319
320 // Read the bitmap attribute
321 BytesRead = ReadAttribute(Vcb,
322 BitmapContext,
323 0,
324 (PCHAR)BitmapBuffer,
325 BitmapSize.LowPart);
326 if (BytesRead != BitmapSize.LowPart)
327 {
328 DPRINT1("ERROR: Bytes read != Bitmap size!\n");
329 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, BlankFileRecord);
330 ExReleaseResourceLite(&(Vcb->DirResource));
331 ExFreePoolWithTag(BitmapBuffer, TAG_NTFS);
332 ReleaseAttributeContext(BitmapContext);
333 return STATUS_INVALID_PARAMETER;
334 }
335
336 // Increase the mft size
337 Status = SetNonResidentAttributeDataLength(Vcb, Vcb->MFTContext, Vcb->MftDataOffset, Vcb->MasterFileTable, &DataSize);
338 if (!NT_SUCCESS(Status))
339 {
340 DPRINT1("ERROR: Failed to set size of $MFT data attribute!\n");
341 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, BlankFileRecord);
342 ExReleaseResourceLite(&(Vcb->DirResource));
343 ExFreePoolWithTag(BitmapBuffer, TAG_NTFS);
344 ReleaseAttributeContext(BitmapContext);
345 return Status;
346 }
347
348 // We'll need to find the bitmap again, because its offset will have changed after resizing the data attribute
349 ReleaseAttributeContext(BitmapContext);
350 Status = FindAttribute(Vcb, Vcb->MasterFileTable, AttributeBitmap, L"", 0, &BitmapContext, &BitmapOffset);
351 if (!NT_SUCCESS(Status))
352 {
353 DPRINT1("ERROR: Couldn't find $BITMAP attribute of Mft!\n");
354 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, BlankFileRecord);
355 ExReleaseResourceLite(&(Vcb->DirResource));
356 return Status;
357 }
358
359 // If the bitmap grew
360 if (BitmapSizeDifference > 0)
361 {
362 // Set the new bitmap size
363 BitmapSize.QuadPart = NewBitmapSize;
364 if (BitmapContext->pRecord->IsNonResident)
365 Status = SetNonResidentAttributeDataLength(Vcb, BitmapContext, BitmapOffset, Vcb->MasterFileTable, &BitmapSize);
366 else
367 Status = SetResidentAttributeDataLength(Vcb, BitmapContext, BitmapOffset, Vcb->MasterFileTable, &BitmapSize);
368
369 if (!NT_SUCCESS(Status))
370 {
371 DPRINT1("ERROR: Failed to set size of bitmap attribute!\n");
372 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, BlankFileRecord);
373 ExReleaseResourceLite(&(Vcb->DirResource));
374 ExFreePoolWithTag(BitmapBuffer, TAG_NTFS);
375 ReleaseAttributeContext(BitmapContext);
376 return Status;
377 }
378 }
379
380 NtfsDumpFileAttributes(Vcb, Vcb->MasterFileTable);
381
382 // Update the file record with the new attribute sizes
383 Status = UpdateFileRecord(Vcb, Vcb->VolumeFcb->MFTIndex, Vcb->MasterFileTable);
384 if (!NT_SUCCESS(Status))
385 {
386 DPRINT1("ERROR: Failed to update $MFT file record!\n");
387 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, BlankFileRecord);
388 ExReleaseResourceLite(&(Vcb->DirResource));
389 ExFreePoolWithTag(BitmapBuffer, TAG_NTFS);
390 ReleaseAttributeContext(BitmapContext);
391 return Status;
392 }
393
394 // Write out the new bitmap
395 Status = WriteAttribute(Vcb, BitmapContext, 0, BitmapBuffer, NewBitmapSize, &LengthWritten, Vcb->MasterFileTable);
396 if (!NT_SUCCESS(Status))
397 {
398 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, BlankFileRecord);
399 ExReleaseResourceLite(&(Vcb->DirResource));
400 ExFreePoolWithTag(BitmapBuffer, TAG_NTFS);
401 ReleaseAttributeContext(BitmapContext);
402 DPRINT1("ERROR: Couldn't write to bitmap attribute of $MFT!\n");
403 return Status;
404 }
405
406 // Create blank records for the new file record entries.
407 for (i = 0; i < NewRecords; i++)
408 {
409 Status = UpdateFileRecord(Vcb, FirstNewMftIndex + i, BlankFileRecord);
410 if (!NT_SUCCESS(Status))
411 {
412 DPRINT1("ERROR: Failed to write blank file record!\n");
413 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, BlankFileRecord);
414 ExReleaseResourceLite(&(Vcb->DirResource));
415 ExFreePoolWithTag(BitmapBuffer, TAG_NTFS);
416 ReleaseAttributeContext(BitmapContext);
417 return Status;
418 }
419 }
420
421 // Update the mft mirror
422 Status = UpdateMftMirror(Vcb);
423
424 // Cleanup
425 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, BlankFileRecord);
426 ExReleaseResourceLite(&(Vcb->DirResource));
427 ExFreePoolWithTag(BitmapBuffer, TAG_NTFS);
428 ReleaseAttributeContext(BitmapContext);
429
430 return Status;
431 }
432
433 /**
434 * @name MoveAttributes
435 * @implemented
436 *
437 * Moves a block of attributes to a new location in the file Record. The attribute at FirstAttributeToMove
438 * and every attribute after that will be moved to MoveTo.
439 *
440 * @param DeviceExt
441 * Pointer to the DEVICE_EXTENSION (VCB) of the target volume.
442 *
443 * @param FirstAttributeToMove
444 * Pointer to the first NTFS_ATTR_RECORD that needs to be moved. This pointer must reside within a file record.
445 *
446 * @param FirstAttributeOffset
447 * Offset of FirstAttributeToMove relative to the beginning of the file record.
448 *
449 * @param MoveTo
450 * ULONG_PTR with the memory location that will be the new location of the first attribute being moved.
451 *
452 * @return
453 * The new location of the final attribute (i.e. AttributeEnd marker).
454 */
455 PNTFS_ATTR_RECORD
456 MoveAttributes(PDEVICE_EXTENSION DeviceExt,
457 PNTFS_ATTR_RECORD FirstAttributeToMove,
458 ULONG FirstAttributeOffset,
459 ULONG_PTR MoveTo)
460 {
461 // Get the size of all attributes after this one
462 ULONG MemBlockSize = 0;
463 PNTFS_ATTR_RECORD CurrentAttribute = FirstAttributeToMove;
464 ULONG CurrentOffset = FirstAttributeOffset;
465 PNTFS_ATTR_RECORD FinalAttribute;
466
467 while (CurrentAttribute->Type != AttributeEnd && CurrentOffset < DeviceExt->NtfsInfo.BytesPerFileRecord)
468 {
469 CurrentOffset += CurrentAttribute->Length;
470 MemBlockSize += CurrentAttribute->Length;
471 CurrentAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)CurrentAttribute + CurrentAttribute->Length);
472 }
473
474 FinalAttribute = (PNTFS_ATTR_RECORD)(MoveTo + MemBlockSize);
475 MemBlockSize += sizeof(ULONG) * 2; // Add the AttributeEnd and file record end
476
477 ASSERT(MemBlockSize % ATTR_RECORD_ALIGNMENT == 0);
478
479 // Move the attributes after this one
480 RtlMoveMemory((PCHAR)MoveTo, FirstAttributeToMove, MemBlockSize);
481
482 return FinalAttribute;
483 }
484
485 NTSTATUS
486 InternalSetResidentAttributeLength(PDEVICE_EXTENSION DeviceExt,
487 PNTFS_ATTR_CONTEXT AttrContext,
488 PFILE_RECORD_HEADER FileRecord,
489 ULONG AttrOffset,
490 ULONG DataSize)
491 {
492 PNTFS_ATTR_RECORD Destination = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + AttrOffset);
493 PNTFS_ATTR_RECORD NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)Destination + Destination->Length);
494 PNTFS_ATTR_RECORD FinalAttribute;
495 ULONG OldAttributeLength = Destination->Length;
496 ULONG NextAttributeOffset;
497
498 DPRINT1("InternalSetResidentAttributeLength( %p, %p, %p, %lu, %lu )\n", DeviceExt, AttrContext, FileRecord, AttrOffset, DataSize);
499
500 ASSERT(!AttrContext->pRecord->IsNonResident);
501
502 // Update ValueLength Field
503 Destination->Resident.ValueLength = DataSize;
504
505 // Calculate the record length and end marker offset
506 Destination->Length = ALIGN_UP_BY(DataSize + AttrContext->pRecord->Resident.ValueOffset, ATTR_RECORD_ALIGNMENT);
507 NextAttributeOffset = AttrOffset + Destination->Length;
508
509 // Ensure NextAttributeOffset is aligned to an 8-byte boundary
510 ASSERT(NextAttributeOffset % ATTR_RECORD_ALIGNMENT == 0);
511
512 // Will the new attribute be larger than the old one?
513 if (Destination->Length > OldAttributeLength)
514 {
515 // Free the old copy of the attribute in the context, as it will be the wrong length
516 ExFreePoolWithTag(AttrContext->pRecord, TAG_NTFS);
517
518 // Create a new copy of the attribute record for the context
519 AttrContext->pRecord = ExAllocatePoolWithTag(NonPagedPool, Destination->Length, TAG_NTFS);
520 if (!AttrContext->pRecord)
521 {
522 DPRINT1("Unable to allocate memory for attribute!\n");
523 return STATUS_INSUFFICIENT_RESOURCES;
524 }
525 RtlZeroMemory((PVOID)((ULONG_PTR)AttrContext->pRecord + OldAttributeLength), Destination->Length - OldAttributeLength);
526 RtlCopyMemory(AttrContext->pRecord, Destination, OldAttributeLength);
527 }
528
529 // Are there attributes after this one that need to be moved?
530 if (NextAttribute->Type != AttributeEnd)
531 {
532 // Move the attributes after this one
533 FinalAttribute = MoveAttributes(DeviceExt, NextAttribute, NextAttributeOffset, (ULONG_PTR)Destination + Destination->Length);
534 }
535 else
536 {
537 // advance to the final "attribute," adjust for the changed length of the attribute we're resizing
538 FinalAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)NextAttribute - OldAttributeLength + Destination->Length);
539 }
540
541 // Update pRecord's length
542 AttrContext->pRecord->Length = Destination->Length;
543 AttrContext->pRecord->Resident.ValueLength = DataSize;
544
545 // set the file record end
546 SetFileRecordEnd(FileRecord, FinalAttribute, FILE_RECORD_END);
547
548 //NtfsDumpFileRecord(DeviceExt, FileRecord);
549
550 return STATUS_SUCCESS;
551 }
552
553 /**
554 * @parameter FileRecord
555 * Pointer to a file record. Must be a full record at least
556 * Fcb->Vcb->NtfsInfo.BytesPerFileRecord bytes large, not just the header.
557 */
558 NTSTATUS
559 SetAttributeDataLength(PFILE_OBJECT FileObject,
560 PNTFS_FCB Fcb,
561 PNTFS_ATTR_CONTEXT AttrContext,
562 ULONG AttrOffset,
563 PFILE_RECORD_HEADER FileRecord,
564 PLARGE_INTEGER DataSize)
565 {
566 NTSTATUS Status = STATUS_SUCCESS;
567
568 DPRINT1("SetAttributeDataLength(%p, %p, %p, %lu, %p, %I64u)\n",
569 FileObject,
570 Fcb,
571 AttrContext,
572 AttrOffset,
573 FileRecord,
574 DataSize->QuadPart);
575
576 // are we truncating the file?
577 if (DataSize->QuadPart < AttributeDataLength(AttrContext->pRecord))
578 {
579 if (!MmCanFileBeTruncated(FileObject->SectionObjectPointer, DataSize))
580 {
581 DPRINT1("Can't truncate a memory-mapped file!\n");
582 return STATUS_USER_MAPPED_FILE;
583 }
584 }
585
586 if (AttrContext->pRecord->IsNonResident)
587 {
588 Status = SetNonResidentAttributeDataLength(Fcb->Vcb,
589 AttrContext,
590 AttrOffset,
591 FileRecord,
592 DataSize);
593 }
594 else
595 {
596 // resident attribute
597 Status = SetResidentAttributeDataLength(Fcb->Vcb,
598 AttrContext,
599 AttrOffset,
600 FileRecord,
601 DataSize);
602 }
603
604 if (!NT_SUCCESS(Status))
605 {
606 DPRINT1("ERROR: Failed to set size of attribute!\n");
607 return Status;
608 }
609
610 //NtfsDumpFileAttributes(Fcb->Vcb, FileRecord);
611
612 // write the updated file record back to disk
613 Status = UpdateFileRecord(Fcb->Vcb, Fcb->MFTIndex, FileRecord);
614
615 if (NT_SUCCESS(Status))
616 {
617 if (AttrContext->pRecord->IsNonResident)
618 Fcb->RFCB.AllocationSize.QuadPart = AttrContext->pRecord->NonResident.AllocatedSize;
619 else
620 Fcb->RFCB.AllocationSize = *DataSize;
621 Fcb->RFCB.FileSize = *DataSize;
622 Fcb->RFCB.ValidDataLength = *DataSize;
623 CcSetFileSizes(FileObject, (PCC_FILE_SIZES)&Fcb->RFCB.AllocationSize);
624 }
625
626 return STATUS_SUCCESS;
627 }
628
629 /**
630 * @name SetFileRecordEnd
631 * @implemented
632 *
633 * This small function sets a new endpoint for the file record. It set's the final
634 * AttrEnd->Type to AttributeEnd and recalculates the bytes used by the file record.
635 *
636 * @param FileRecord
637 * Pointer to the file record whose endpoint (length) will be set.
638 *
639 * @param AttrEnd
640 * Pointer to section of memory that will receive the AttributeEnd marker. This must point
641 * to memory allocated for the FileRecord. Must be aligned to an 8-byte boundary (relative to FileRecord).
642 *
643 * @param EndMarker
644 * This value will be written after AttributeEnd but isn't critical at all. When Windows resizes
645 * a file record, it preserves the final ULONG that previously ended the record, even though this
646 * value is (to my knowledge) never used. We emulate this behavior.
647 *
648 */
649 VOID
650 SetFileRecordEnd(PFILE_RECORD_HEADER FileRecord,
651 PNTFS_ATTR_RECORD AttrEnd,
652 ULONG EndMarker)
653 {
654 // Ensure AttrEnd is aligned on an 8-byte boundary, relative to FileRecord
655 ASSERT(((ULONG_PTR)AttrEnd - (ULONG_PTR)FileRecord) % ATTR_RECORD_ALIGNMENT == 0);
656
657 // mark the end of attributes
658 AttrEnd->Type = AttributeEnd;
659
660 // Restore the "file-record-end marker." The value is never checked but this behavior is consistent with Win2k3.
661 AttrEnd->Length = EndMarker;
662
663 // recalculate bytes in use
664 FileRecord->BytesInUse = (ULONG_PTR)AttrEnd - (ULONG_PTR)FileRecord + sizeof(ULONG) * 2;
665 }
666
667 /**
668 * @name SetNonResidentAttributeDataLength
669 * @implemented
670 *
671 * Called by SetAttributeDataLength() to set the size of a non-resident attribute. Doesn't update the file record.
672 *
673 * @param Vcb
674 * Pointer to a DEVICE_EXTENSION describing the target disk.
675 *
676 * @param AttrContext
677 * PNTFS_ATTR_CONTEXT describing the location of the attribute whose size is being set.
678 *
679 * @param AttrOffset
680 * Offset, from the beginning of the record, of the attribute being sized.
681 *
682 * @param FileRecord
683 * Pointer to a file record containing the attribute to be resized. Must be a complete file record,
684 * not just the header.
685 *
686 * @param DataSize
687 * Pointer to a LARGE_INTEGER describing the new size of the attribute's data.
688 *
689 * @return
690 * STATUS_SUCCESS on success;
691 * STATUS_INSUFFICIENT_RESOURCES if an allocation fails.
692 * STATUS_INVALID_PARAMETER if we can't find the last cluster in the data run.
693 *
694 * @remarks
695 * Called by SetAttributeDataLength() and IncreaseMftSize(). Use SetAttributeDataLength() unless you have a good
696 * reason to use this. Doesn't update the file record on disk. Doesn't inform the cache controller of changes with
697 * any associated files. Synchronization is the callers responsibility.
698 */
699 NTSTATUS
700 SetNonResidentAttributeDataLength(PDEVICE_EXTENSION Vcb,
701 PNTFS_ATTR_CONTEXT AttrContext,
702 ULONG AttrOffset,
703 PFILE_RECORD_HEADER FileRecord,
704 PLARGE_INTEGER DataSize)
705 {
706 NTSTATUS Status = STATUS_SUCCESS;
707 ULONG BytesPerCluster = Vcb->NtfsInfo.BytesPerCluster;
708 ULONGLONG AllocationSize = ROUND_UP(DataSize->QuadPart, BytesPerCluster);
709 PNTFS_ATTR_RECORD DestinationAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + AttrOffset);
710 ULONG ExistingClusters = AttrContext->pRecord->NonResident.AllocatedSize / BytesPerCluster;
711
712 ASSERT(AttrContext->pRecord->IsNonResident);
713
714 // do we need to increase the allocation size?
715 if (AttrContext->pRecord->NonResident.AllocatedSize < AllocationSize)
716 {
717 ULONG ClustersNeeded = (AllocationSize / BytesPerCluster) - ExistingClusters;
718 LARGE_INTEGER LastClusterInDataRun;
719 ULONG NextAssignedCluster;
720 ULONG AssignedClusters;
721
722 if (ExistingClusters == 0)
723 {
724 LastClusterInDataRun.QuadPart = 0;
725 }
726 else
727 {
728 if (!FsRtlLookupLargeMcbEntry(&AttrContext->DataRunsMCB,
729 (LONGLONG)AttrContext->pRecord->NonResident.HighestVCN,
730 (PLONGLONG)&LastClusterInDataRun.QuadPart,
731 NULL,
732 NULL,
733 NULL,
734 NULL))
735 {
736 DPRINT1("Error looking up final large MCB entry!\n");
737
738 // Most likely, HighestVCN went above the largest mapping
739 DPRINT1("Highest VCN of record: %I64u\n", AttrContext->pRecord->NonResident.HighestVCN);
740 return STATUS_INVALID_PARAMETER;
741 }
742 }
743
744 DPRINT("LastClusterInDataRun: %I64u\n", LastClusterInDataRun.QuadPart);
745 DPRINT("Highest VCN of record: %I64u\n", AttrContext->pRecord->NonResident.HighestVCN);
746
747 while (ClustersNeeded > 0)
748 {
749 Status = NtfsAllocateClusters(Vcb,
750 LastClusterInDataRun.LowPart + 1,
751 ClustersNeeded,
752 &NextAssignedCluster,
753 &AssignedClusters);
754
755 if (!NT_SUCCESS(Status))
756 {
757 DPRINT1("Error: Unable to allocate requested clusters!\n");
758 return Status;
759 }
760
761 // now we need to add the clusters we allocated to the data run
762 Status = AddRun(Vcb, AttrContext, AttrOffset, FileRecord, NextAssignedCluster, AssignedClusters);
763 if (!NT_SUCCESS(Status))
764 {
765 DPRINT1("Error: Unable to add data run!\n");
766 return Status;
767 }
768
769 ClustersNeeded -= AssignedClusters;
770 LastClusterInDataRun.LowPart = NextAssignedCluster + AssignedClusters - 1;
771 }
772 }
773 else if (AttrContext->pRecord->NonResident.AllocatedSize > AllocationSize)
774 {
775 // shrink allocation size
776 ULONG ClustersToFree = ExistingClusters - (AllocationSize / BytesPerCluster);
777 Status = FreeClusters(Vcb, AttrContext, AttrOffset, FileRecord, ClustersToFree);
778 }
779
780 // TODO: is the file compressed, encrypted, or sparse?
781
782 AttrContext->pRecord->NonResident.AllocatedSize = AllocationSize;
783 AttrContext->pRecord->NonResident.DataSize = DataSize->QuadPart;
784 AttrContext->pRecord->NonResident.InitializedSize = DataSize->QuadPart;
785
786 DestinationAttribute->NonResident.AllocatedSize = AllocationSize;
787 DestinationAttribute->NonResident.DataSize = DataSize->QuadPart;
788 DestinationAttribute->NonResident.InitializedSize = DataSize->QuadPart;
789
790 // HighestVCN seems to be set incorrectly somewhere. Apply a hack-fix to reset it.
791 // HACKHACK FIXME: Fix for sparse files; this math won't work in that case.
792 AttrContext->pRecord->NonResident.HighestVCN = ((ULONGLONG)AllocationSize / Vcb->NtfsInfo.BytesPerCluster) - 1;
793 DestinationAttribute->NonResident.HighestVCN = AttrContext->pRecord->NonResident.HighestVCN;
794
795 DPRINT("Allocated Size: %I64u\n", DestinationAttribute->NonResident.AllocatedSize);
796
797 return Status;
798 }
799
800 /**
801 * @name SetResidentAttributeDataLength
802 * @implemented
803 *
804 * Called by SetAttributeDataLength() to set the size of a non-resident attribute. Doesn't update the file record.
805 *
806 * @param Vcb
807 * Pointer to a DEVICE_EXTENSION describing the target disk.
808 *
809 * @param AttrContext
810 * PNTFS_ATTR_CONTEXT describing the location of the attribute whose size is being set.
811 *
812 * @param AttrOffset
813 * Offset, from the beginning of the record, of the attribute being sized.
814 *
815 * @param FileRecord
816 * Pointer to a file record containing the attribute to be resized. Must be a complete file record,
817 * not just the header.
818 *
819 * @param DataSize
820 * Pointer to a LARGE_INTEGER describing the new size of the attribute's data.
821 *
822 * @return
823 * STATUS_SUCCESS on success;
824 * STATUS_INSUFFICIENT_RESOURCES if an allocation fails.
825 * STATUS_INVALID_PARAMETER if AttrContext describes a non-resident attribute.
826 * STATUS_NOT_IMPLEMENTED if requested to decrease the size of an attribute that isn't the
827 * last attribute listed in the file record.
828 *
829 * @remarks
830 * Called by SetAttributeDataLength() and IncreaseMftSize(). Use SetAttributeDataLength() unless you have a good
831 * reason to use this. Doesn't update the file record on disk. Doesn't inform the cache controller of changes with
832 * any associated files. Synchronization is the callers responsibility.
833 */
834 NTSTATUS
835 SetResidentAttributeDataLength(PDEVICE_EXTENSION Vcb,
836 PNTFS_ATTR_CONTEXT AttrContext,
837 ULONG AttrOffset,
838 PFILE_RECORD_HEADER FileRecord,
839 PLARGE_INTEGER DataSize)
840 {
841 NTSTATUS Status;
842
843 // find the next attribute
844 ULONG NextAttributeOffset = AttrOffset + AttrContext->pRecord->Length;
845 PNTFS_ATTR_RECORD NextAttribute = (PNTFS_ATTR_RECORD)((PCHAR)FileRecord + NextAttributeOffset);
846
847 ASSERT(!AttrContext->pRecord->IsNonResident);
848
849 //NtfsDumpFileAttributes(Vcb, FileRecord);
850
851 // Do we need to increase the data length?
852 if (DataSize->QuadPart > AttrContext->pRecord->Resident.ValueLength)
853 {
854 // There's usually padding at the end of a record. Do we need to extend past it?
855 ULONG MaxValueLength = AttrContext->pRecord->Length - AttrContext->pRecord->Resident.ValueOffset;
856 if (MaxValueLength < DataSize->LowPart)
857 {
858 // If this is the last attribute, we could move the end marker to the very end of the file record
859 MaxValueLength += Vcb->NtfsInfo.BytesPerFileRecord - NextAttributeOffset - (sizeof(ULONG) * 2);
860
861 if (MaxValueLength < DataSize->LowPart || NextAttribute->Type != AttributeEnd)
862 {
863 // convert attribute to non-resident
864 PNTFS_ATTR_RECORD Destination = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + AttrOffset);
865 PNTFS_ATTR_RECORD NewRecord;
866 LARGE_INTEGER AttribDataSize;
867 PVOID AttribData;
868 ULONG NewRecordLength;
869 ULONG EndAttributeOffset;
870 ULONG LengthWritten;
871
872 DPRINT1("Converting attribute to non-resident.\n");
873
874 AttribDataSize.QuadPart = AttrContext->pRecord->Resident.ValueLength;
875
876 // Is there existing data we need to back-up?
877 if (AttribDataSize.QuadPart > 0)
878 {
879 AttribData = ExAllocatePoolWithTag(NonPagedPool, AttribDataSize.QuadPart, TAG_NTFS);
880 if (AttribData == NULL)
881 {
882 DPRINT1("ERROR: Couldn't allocate memory for attribute data. Can't migrate to non-resident!\n");
883 return STATUS_INSUFFICIENT_RESOURCES;
884 }
885
886 // read data to temp buffer
887 Status = ReadAttribute(Vcb, AttrContext, 0, AttribData, AttribDataSize.QuadPart);
888 if (!NT_SUCCESS(Status))
889 {
890 DPRINT1("ERROR: Unable to read attribute before migrating!\n");
891 ExFreePoolWithTag(AttribData, TAG_NTFS);
892 return Status;
893 }
894 }
895
896 // Start by turning this attribute into a 0-length, non-resident attribute, then enlarge it.
897
898 // The size of a 0-length, non-resident attribute will be 0x41 + the size of the attribute name, aligned to an 8-byte boundary
899 NewRecordLength = ALIGN_UP_BY(0x41 + (AttrContext->pRecord->NameLength * sizeof(WCHAR)), ATTR_RECORD_ALIGNMENT);
900
901 // Create a new attribute record that will store the 0-length, non-resident attribute
902 NewRecord = ExAllocatePoolWithTag(NonPagedPool, NewRecordLength, TAG_NTFS);
903
904 // Zero out the NonResident structure
905 RtlZeroMemory(NewRecord, NewRecordLength);
906
907 // Copy the data that's common to both non-resident and resident attributes
908 RtlCopyMemory(NewRecord, AttrContext->pRecord, FIELD_OFFSET(NTFS_ATTR_RECORD, Resident.ValueLength));
909
910 // if there's a name
911 if (AttrContext->pRecord->NameLength != 0)
912 {
913 // copy the name
914 // An attribute name will be located at offset 0x18 for a resident attribute, 0x40 for non-resident
915 RtlCopyMemory((PCHAR)((ULONG_PTR)NewRecord + 0x40),
916 (PCHAR)((ULONG_PTR)AttrContext->pRecord + 0x18),
917 AttrContext->pRecord->NameLength * sizeof(WCHAR));
918 }
919
920 // update the mapping pairs offset, which will be 0x40 (size of a non-resident header) + length in bytes of the name
921 NewRecord->NonResident.MappingPairsOffset = 0x40 + (AttrContext->pRecord->NameLength * sizeof(WCHAR));
922
923 // update the end of the file record
924 // calculate position of end markers (1 byte for empty data run)
925 EndAttributeOffset = AttrOffset + NewRecord->NonResident.MappingPairsOffset + 1;
926 EndAttributeOffset = ALIGN_UP_BY(EndAttributeOffset, ATTR_RECORD_ALIGNMENT);
927
928 // Update the length
929 NewRecord->Length = EndAttributeOffset - AttrOffset;
930
931 ASSERT(NewRecord->Length == NewRecordLength);
932
933 // Copy the new attribute record into the file record
934 RtlCopyMemory(Destination, NewRecord, NewRecord->Length);
935
936 // Update the file record end
937 SetFileRecordEnd(FileRecord,
938 (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + EndAttributeOffset),
939 FILE_RECORD_END);
940
941 // Initialize the MCB, potentially catch an exception
942 _SEH2_TRY
943 {
944 FsRtlInitializeLargeMcb(&AttrContext->DataRunsMCB, NonPagedPool);
945 }
946 _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
947 {
948 DPRINT1("Unable to create LargeMcb!\n");
949 if (AttribDataSize.QuadPart > 0)
950 ExFreePoolWithTag(AttribData, TAG_NTFS);
951 _SEH2_YIELD(return _SEH2_GetExceptionCode());
952 } _SEH2_END;
953
954 // Mark the attribute as non-resident (we wait until after we know the LargeMcb was initialized)
955 NewRecord->IsNonResident = Destination->IsNonResident = 1;
956
957 // Update file record on disk
958 Status = UpdateFileRecord(Vcb, AttrContext->FileMFTIndex, FileRecord);
959 if (!NT_SUCCESS(Status))
960 {
961 DPRINT1("ERROR: Couldn't update file record to continue migration!\n");
962 if (AttribDataSize.QuadPart > 0)
963 ExFreePoolWithTag(AttribData, TAG_NTFS);
964 return Status;
965 }
966
967 // Now we need to free the old copy of the attribute record in the context and replace it with the new one
968 ExFreePoolWithTag(AttrContext->pRecord, TAG_NTFS);
969 AttrContext->pRecord = NewRecord;
970
971 // Now we can treat the attribute as non-resident and enlarge it normally
972 Status = SetNonResidentAttributeDataLength(Vcb, AttrContext, AttrOffset, FileRecord, DataSize);
973 if (!NT_SUCCESS(Status))
974 {
975 DPRINT1("ERROR: Unable to migrate resident attribute!\n");
976 if (AttribDataSize.QuadPart > 0)
977 ExFreePoolWithTag(AttribData, TAG_NTFS);
978 return Status;
979 }
980
981 // restore the back-up attribute, if we made one
982 if (AttribDataSize.QuadPart > 0)
983 {
984 Status = WriteAttribute(Vcb, AttrContext, 0, AttribData, AttribDataSize.QuadPart, &LengthWritten, FileRecord);
985 if (!NT_SUCCESS(Status))
986 {
987 DPRINT1("ERROR: Unable to write attribute data to non-resident clusters during migration!\n");
988 // TODO: Reverse migration so no data is lost
989 ExFreePoolWithTag(AttribData, TAG_NTFS);
990 return Status;
991 }
992
993 ExFreePoolWithTag(AttribData, TAG_NTFS);
994 }
995 }
996 }
997 }
998
999 // set the new length of the resident attribute (if we didn't migrate it)
1000 if (!AttrContext->pRecord->IsNonResident)
1001 return InternalSetResidentAttributeLength(Vcb, AttrContext, FileRecord, AttrOffset, DataSize->LowPart);
1002
1003 return STATUS_SUCCESS;
1004 }
1005
1006 ULONG
1007 ReadAttribute(PDEVICE_EXTENSION Vcb,
1008 PNTFS_ATTR_CONTEXT Context,
1009 ULONGLONG Offset,
1010 PCHAR Buffer,
1011 ULONG Length)
1012 {
1013 ULONGLONG LastLCN;
1014 PUCHAR DataRun;
1015 LONGLONG DataRunOffset;
1016 ULONGLONG DataRunLength;
1017 LONGLONG DataRunStartLCN;
1018 ULONGLONG CurrentOffset;
1019 ULONG ReadLength;
1020 ULONG AlreadyRead;
1021 NTSTATUS Status;
1022
1023 //TEMPTEMP
1024 PUCHAR TempBuffer;
1025
1026 if (!Context->pRecord->IsNonResident)
1027 {
1028 // We need to truncate Offset to a ULONG for pointer arithmetic
1029 // The check below should ensure that Offset is well within the range of 32 bits
1030 ULONG LittleOffset = (ULONG)Offset;
1031
1032 // Ensure that offset isn't beyond the end of the attribute
1033 if (Offset > Context->pRecord->Resident.ValueLength)
1034 return 0;
1035 if (Offset + Length > Context->pRecord->Resident.ValueLength)
1036 Length = (ULONG)(Context->pRecord->Resident.ValueLength - Offset);
1037
1038 RtlCopyMemory(Buffer, (PVOID)((ULONG_PTR)Context->pRecord + Context->pRecord->Resident.ValueOffset + LittleOffset), Length);
1039 return Length;
1040 }
1041
1042 /*
1043 * Non-resident attribute
1044 */
1045
1046 /*
1047 * I. Find the corresponding start data run.
1048 */
1049
1050 AlreadyRead = 0;
1051
1052 // FIXME: Cache seems to be non-working. Disable it for now
1053 //if(Context->CacheRunOffset <= Offset && Offset < Context->CacheRunOffset + Context->CacheRunLength * Volume->ClusterSize)
1054 if (0)
1055 {
1056 DataRun = Context->CacheRun;
1057 LastLCN = Context->CacheRunLastLCN;
1058 DataRunStartLCN = Context->CacheRunStartLCN;
1059 DataRunLength = Context->CacheRunLength;
1060 CurrentOffset = Context->CacheRunCurrentOffset;
1061 }
1062 else
1063 {
1064 //TEMPTEMP
1065 ULONG UsedBufferSize;
1066 TempBuffer = ExAllocatePoolWithTag(NonPagedPool, Vcb->NtfsInfo.BytesPerFileRecord, TAG_NTFS);
1067 if (TempBuffer == NULL)
1068 {
1069 return STATUS_INSUFFICIENT_RESOURCES;
1070 }
1071
1072 LastLCN = 0;
1073 CurrentOffset = 0;
1074
1075 // This will be rewritten in the next iteration to just use the DataRuns MCB directly
1076 ConvertLargeMCBToDataRuns(&Context->DataRunsMCB,
1077 TempBuffer,
1078 Vcb->NtfsInfo.BytesPerFileRecord,
1079 &UsedBufferSize);
1080
1081 DataRun = TempBuffer;
1082
1083 while (1)
1084 {
1085 DataRun = DecodeRun(DataRun, &DataRunOffset, &DataRunLength);
1086 if (DataRunOffset != -1)
1087 {
1088 /* Normal data run. */
1089 DataRunStartLCN = LastLCN + DataRunOffset;
1090 LastLCN = DataRunStartLCN;
1091 }
1092 else
1093 {
1094 /* Sparse data run. */
1095 DataRunStartLCN = -1;
1096 }
1097
1098 if (Offset >= CurrentOffset &&
1099 Offset < CurrentOffset + (DataRunLength * Vcb->NtfsInfo.BytesPerCluster))
1100 {
1101 break;
1102 }
1103
1104 if (*DataRun == 0)
1105 {
1106 ExFreePoolWithTag(TempBuffer, TAG_NTFS);
1107 return AlreadyRead;
1108 }
1109
1110 CurrentOffset += DataRunLength * Vcb->NtfsInfo.BytesPerCluster;
1111 }
1112 }
1113
1114 /*
1115 * II. Go through the run list and read the data
1116 */
1117
1118 ReadLength = (ULONG)min(DataRunLength * Vcb->NtfsInfo.BytesPerCluster - (Offset - CurrentOffset), Length);
1119 if (DataRunStartLCN == -1)
1120 {
1121 RtlZeroMemory(Buffer, ReadLength);
1122 Status = STATUS_SUCCESS;
1123 }
1124 else
1125 {
1126 Status = NtfsReadDisk(Vcb->StorageDevice,
1127 DataRunStartLCN * Vcb->NtfsInfo.BytesPerCluster + Offset - CurrentOffset,
1128 ReadLength,
1129 Vcb->NtfsInfo.BytesPerSector,
1130 (PVOID)Buffer,
1131 FALSE);
1132 }
1133 if (NT_SUCCESS(Status))
1134 {
1135 Length -= ReadLength;
1136 Buffer += ReadLength;
1137 AlreadyRead += ReadLength;
1138
1139 if (ReadLength == DataRunLength * Vcb->NtfsInfo.BytesPerCluster - (Offset - CurrentOffset))
1140 {
1141 CurrentOffset += DataRunLength * Vcb->NtfsInfo.BytesPerCluster;
1142 DataRun = DecodeRun(DataRun, &DataRunOffset, &DataRunLength);
1143 if (DataRunOffset != (ULONGLONG)-1)
1144 {
1145 DataRunStartLCN = LastLCN + DataRunOffset;
1146 LastLCN = DataRunStartLCN;
1147 }
1148 else
1149 DataRunStartLCN = -1;
1150 }
1151
1152 while (Length > 0)
1153 {
1154 ReadLength = (ULONG)min(DataRunLength * Vcb->NtfsInfo.BytesPerCluster, Length);
1155 if (DataRunStartLCN == -1)
1156 RtlZeroMemory(Buffer, ReadLength);
1157 else
1158 {
1159 Status = NtfsReadDisk(Vcb->StorageDevice,
1160 DataRunStartLCN * Vcb->NtfsInfo.BytesPerCluster,
1161 ReadLength,
1162 Vcb->NtfsInfo.BytesPerSector,
1163 (PVOID)Buffer,
1164 FALSE);
1165 if (!NT_SUCCESS(Status))
1166 break;
1167 }
1168
1169 Length -= ReadLength;
1170 Buffer += ReadLength;
1171 AlreadyRead += ReadLength;
1172
1173 /* We finished this request, but there still data in this data run. */
1174 if (Length == 0 && ReadLength != DataRunLength * Vcb->NtfsInfo.BytesPerCluster)
1175 break;
1176
1177 /*
1178 * Go to next run in the list.
1179 */
1180
1181 if (*DataRun == 0)
1182 break;
1183 CurrentOffset += DataRunLength * Vcb->NtfsInfo.BytesPerCluster;
1184 DataRun = DecodeRun(DataRun, &DataRunOffset, &DataRunLength);
1185 if (DataRunOffset != -1)
1186 {
1187 /* Normal data run. */
1188 DataRunStartLCN = LastLCN + DataRunOffset;
1189 LastLCN = DataRunStartLCN;
1190 }
1191 else
1192 {
1193 /* Sparse data run. */
1194 DataRunStartLCN = -1;
1195 }
1196 } /* while */
1197
1198 } /* if Disk */
1199
1200 // TEMPTEMP
1201 if (Context->pRecord->IsNonResident)
1202 ExFreePoolWithTag(TempBuffer, TAG_NTFS);
1203
1204 Context->CacheRun = DataRun;
1205 Context->CacheRunOffset = Offset + AlreadyRead;
1206 Context->CacheRunStartLCN = DataRunStartLCN;
1207 Context->CacheRunLength = DataRunLength;
1208 Context->CacheRunLastLCN = LastLCN;
1209 Context->CacheRunCurrentOffset = CurrentOffset;
1210
1211 return AlreadyRead;
1212 }
1213
1214
1215 /**
1216 * @name WriteAttribute
1217 * @implemented
1218 *
1219 * Writes an NTFS attribute to the disk. It presently borrows a lot of code from ReadAttribute(),
1220 * and it still needs more documentation / cleaning up.
1221 *
1222 * @param Vcb
1223 * Volume Control Block indicating which volume to write the attribute to
1224 *
1225 * @param Context
1226 * Pointer to an NTFS_ATTR_CONTEXT that has information about the attribute
1227 *
1228 * @param Offset
1229 * Offset, in bytes, from the beginning of the attribute indicating where to start
1230 * writing data
1231 *
1232 * @param Buffer
1233 * The data that's being written to the device
1234 *
1235 * @param Length
1236 * How much data will be written, in bytes
1237 *
1238 * @param RealLengthWritten
1239 * Pointer to a ULONG which will receive how much data was written, in bytes
1240 *
1241 * @param FileRecord
1242 * Optional pointer to a FILE_RECORD_HEADER that contains a copy of the file record
1243 * being written to. Can be NULL, in which case the file record will be read from disk.
1244 * If not-null, WriteAttribute() will skip reading from disk, and FileRecord
1245 * will be updated with the newly-written attribute before the function returns.
1246 *
1247 * @return
1248 * STATUS_SUCCESS if successful, an error code otherwise. STATUS_NOT_IMPLEMENTED if
1249 * writing to a sparse file.
1250 *
1251 * @remarks Note that in this context the word "attribute" isn't referring read-only, hidden,
1252 * etc. - the file's data is actually stored in an attribute in NTFS parlance.
1253 *
1254 */
1255
1256 NTSTATUS
1257 WriteAttribute(PDEVICE_EXTENSION Vcb,
1258 PNTFS_ATTR_CONTEXT Context,
1259 ULONGLONG Offset,
1260 const PUCHAR Buffer,
1261 ULONG Length,
1262 PULONG RealLengthWritten,
1263 PFILE_RECORD_HEADER FileRecord)
1264 {
1265 ULONGLONG LastLCN;
1266 PUCHAR DataRun;
1267 LONGLONG DataRunOffset;
1268 ULONGLONG DataRunLength;
1269 LONGLONG DataRunStartLCN;
1270 ULONGLONG CurrentOffset;
1271 ULONG WriteLength;
1272 NTSTATUS Status;
1273 PUCHAR SourceBuffer = Buffer;
1274 LONGLONG StartingOffset;
1275 BOOLEAN FileRecordAllocated = FALSE;
1276
1277 //TEMPTEMP
1278 PUCHAR TempBuffer;
1279
1280
1281 DPRINT("WriteAttribute(%p, %p, %I64u, %p, %lu, %p, %p)\n", Vcb, Context, Offset, Buffer, Length, RealLengthWritten, FileRecord);
1282
1283 *RealLengthWritten = 0;
1284
1285 // is this a resident attribute?
1286 if (!Context->pRecord->IsNonResident)
1287 {
1288 ULONG AttributeOffset;
1289 PNTFS_ATTR_CONTEXT FoundContext;
1290 PNTFS_ATTR_RECORD Destination;
1291
1292 // Ensure requested data is within the bounds of the attribute
1293 ASSERT(Offset + Length <= Context->pRecord->Resident.ValueLength);
1294
1295 if (Offset + Length > Context->pRecord->Resident.ValueLength)
1296 {
1297 DPRINT1("DRIVER ERROR: Attribute is too small!\n");
1298 return STATUS_INVALID_PARAMETER;
1299 }
1300
1301 // Do we need to read the file record?
1302 if (FileRecord == NULL)
1303 {
1304 FileRecord = ExAllocateFromNPagedLookasideList(&Vcb->FileRecLookasideList);
1305 if (!FileRecord)
1306 {
1307 DPRINT1("Error: Couldn't allocate file record!\n");
1308 return STATUS_NO_MEMORY;
1309 }
1310
1311 FileRecordAllocated = TRUE;
1312
1313 // read the file record
1314 ReadFileRecord(Vcb, Context->FileMFTIndex, FileRecord);
1315 }
1316
1317 // find where to write the attribute data to
1318 Status = FindAttribute(Vcb, FileRecord,
1319 Context->pRecord->Type,
1320 (PCWSTR)((ULONG_PTR)Context->pRecord + Context->pRecord->NameOffset),
1321 Context->pRecord->NameLength,
1322 &FoundContext,
1323 &AttributeOffset);
1324
1325 if (!NT_SUCCESS(Status))
1326 {
1327 DPRINT1("ERROR: Couldn't find matching attribute!\n");
1328 if(FileRecordAllocated)
1329 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, FileRecord);
1330 return Status;
1331 }
1332
1333 Destination = (PNTFS_ATTR_RECORD)((ULONG_PTR)FileRecord + AttributeOffset);
1334
1335 DPRINT("Offset: %I64u, AttributeOffset: %u, ValueOffset: %u\n", Offset, AttributeOffset, Context->pRecord->Resident.ValueLength);
1336
1337 // Will we be writing past the end of the allocated file record?
1338 if (Offset + Length + AttributeOffset + Context->pRecord->Resident.ValueOffset > Vcb->NtfsInfo.BytesPerFileRecord)
1339 {
1340 DPRINT1("DRIVER ERROR: Data being written extends past end of file record!\n");
1341 ReleaseAttributeContext(FoundContext);
1342 if (FileRecordAllocated)
1343 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, FileRecord);
1344 return STATUS_INVALID_PARAMETER;
1345 }
1346
1347 // copy the data being written into the file record. We cast Offset to ULONG, which is safe because it's range has been verified.
1348 RtlCopyMemory((PCHAR)((ULONG_PTR)Destination + Context->pRecord->Resident.ValueOffset + (ULONG)Offset), Buffer, Length);
1349
1350 Status = UpdateFileRecord(Vcb, Context->FileMFTIndex, FileRecord);
1351
1352 // Update the context's copy of the resident attribute
1353 ASSERT(Context->pRecord->Length == Destination->Length);
1354 RtlCopyMemory((PVOID)Context->pRecord, Destination, Context->pRecord->Length);
1355
1356 ReleaseAttributeContext(FoundContext);
1357 if (FileRecordAllocated)
1358 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, FileRecord);
1359
1360 if (NT_SUCCESS(Status))
1361 *RealLengthWritten = Length;
1362
1363 return Status;
1364 }
1365
1366 // This is a non-resident attribute.
1367
1368 // I. Find the corresponding start data run.
1369
1370 // FIXME: Cache seems to be non-working. Disable it for now
1371 //if(Context->CacheRunOffset <= Offset && Offset < Context->CacheRunOffset + Context->CacheRunLength * Volume->ClusterSize)
1372 /*if (0)
1373 {
1374 DataRun = Context->CacheRun;
1375 LastLCN = Context->CacheRunLastLCN;
1376 DataRunStartLCN = Context->CacheRunStartLCN;
1377 DataRunLength = Context->CacheRunLength;
1378 CurrentOffset = Context->CacheRunCurrentOffset;
1379 }
1380 else*/
1381 {
1382 ULONG UsedBufferSize;
1383 LastLCN = 0;
1384 CurrentOffset = 0;
1385
1386 // This will be rewritten in the next iteration to just use the DataRuns MCB directly
1387 TempBuffer = ExAllocatePoolWithTag(NonPagedPool, Vcb->NtfsInfo.BytesPerFileRecord, TAG_NTFS);
1388 if (TempBuffer == NULL)
1389 {
1390 return STATUS_INSUFFICIENT_RESOURCES;
1391 }
1392
1393 ConvertLargeMCBToDataRuns(&Context->DataRunsMCB,
1394 TempBuffer,
1395 Vcb->NtfsInfo.BytesPerFileRecord,
1396 &UsedBufferSize);
1397
1398 DataRun = TempBuffer;
1399
1400 while (1)
1401 {
1402 DataRun = DecodeRun(DataRun, &DataRunOffset, &DataRunLength);
1403 if (DataRunOffset != -1)
1404 {
1405 // Normal data run.
1406 // DPRINT1("Writing to normal data run, LastLCN %I64u DataRunOffset %I64d\n", LastLCN, DataRunOffset);
1407 DataRunStartLCN = LastLCN + DataRunOffset;
1408 LastLCN = DataRunStartLCN;
1409 }
1410 else
1411 {
1412 // Sparse data run. We can't support writing to sparse files yet
1413 // (it may require increasing the allocation size).
1414 DataRunStartLCN = -1;
1415 DPRINT1("FIXME: Writing to sparse files is not supported yet!\n");
1416 Status = STATUS_NOT_IMPLEMENTED;
1417 goto Cleanup;
1418 }
1419
1420 // Have we reached the data run we're trying to write to?
1421 if (Offset >= CurrentOffset &&
1422 Offset < CurrentOffset + (DataRunLength * Vcb->NtfsInfo.BytesPerCluster))
1423 {
1424 break;
1425 }
1426
1427 if (*DataRun == 0)
1428 {
1429 // We reached the last assigned cluster
1430 // TODO: assign new clusters to the end of the file.
1431 // (Presently, this code will rarely be reached, the write will usually have already failed by now)
1432 // [We can reach here by creating a new file record when the MFT isn't large enough]
1433 DPRINT1("FIXME: Master File Table needs to be enlarged.\n");
1434 Status = STATUS_END_OF_FILE;
1435 goto Cleanup;
1436 }
1437
1438 CurrentOffset += DataRunLength * Vcb->NtfsInfo.BytesPerCluster;
1439 }
1440 }
1441
1442 // II. Go through the run list and write the data
1443
1444 /* REVIEWME -- As adapted from NtfsReadAttribute():
1445 We seem to be making a special case for the first applicable data run, but I'm not sure why.
1446 Does it have something to do with (not) caching? Is this strategy equally applicable to writing? */
1447
1448 WriteLength = (ULONG)min(DataRunLength * Vcb->NtfsInfo.BytesPerCluster - (Offset - CurrentOffset), Length);
1449
1450 StartingOffset = DataRunStartLCN * Vcb->NtfsInfo.BytesPerCluster + Offset - CurrentOffset;
1451
1452 // Write the data to the disk
1453 Status = NtfsWriteDisk(Vcb->StorageDevice,
1454 StartingOffset,
1455 WriteLength,
1456 Vcb->NtfsInfo.BytesPerSector,
1457 (PVOID)SourceBuffer);
1458
1459 // Did the write fail?
1460 if (!NT_SUCCESS(Status))
1461 {
1462 Context->CacheRun = DataRun;
1463 Context->CacheRunOffset = Offset;
1464 Context->CacheRunStartLCN = DataRunStartLCN;
1465 Context->CacheRunLength = DataRunLength;
1466 Context->CacheRunLastLCN = LastLCN;
1467 Context->CacheRunCurrentOffset = CurrentOffset;
1468
1469 goto Cleanup;
1470 }
1471
1472 Length -= WriteLength;
1473 SourceBuffer += WriteLength;
1474 *RealLengthWritten += WriteLength;
1475
1476 // Did we write to the end of the data run?
1477 if (WriteLength == DataRunLength * Vcb->NtfsInfo.BytesPerCluster - (Offset - CurrentOffset))
1478 {
1479 // Advance to the next data run
1480 CurrentOffset += DataRunLength * Vcb->NtfsInfo.BytesPerCluster;
1481 DataRun = DecodeRun(DataRun, &DataRunOffset, &DataRunLength);
1482
1483 if (DataRunOffset != (ULONGLONG)-1)
1484 {
1485 DataRunStartLCN = LastLCN + DataRunOffset;
1486 LastLCN = DataRunStartLCN;
1487 }
1488 else
1489 DataRunStartLCN = -1;
1490 }
1491
1492 // Do we have more data to write?
1493 while (Length > 0)
1494 {
1495 // Make sure we don't write past the end of the current data run
1496 WriteLength = (ULONG)min(DataRunLength * Vcb->NtfsInfo.BytesPerCluster, Length);
1497
1498 // Are we dealing with a sparse data run?
1499 if (DataRunStartLCN == -1)
1500 {
1501 DPRINT1("FIXME: Don't know how to write to sparse files yet! (DataRunStartLCN == -1)\n");
1502 Status = STATUS_NOT_IMPLEMENTED;
1503 goto Cleanup;
1504 }
1505 else
1506 {
1507 // write the data to the disk
1508 Status = NtfsWriteDisk(Vcb->StorageDevice,
1509 DataRunStartLCN * Vcb->NtfsInfo.BytesPerCluster,
1510 WriteLength,
1511 Vcb->NtfsInfo.BytesPerSector,
1512 (PVOID)SourceBuffer);
1513 if (!NT_SUCCESS(Status))
1514 break;
1515 }
1516
1517 Length -= WriteLength;
1518 SourceBuffer += WriteLength;
1519 *RealLengthWritten += WriteLength;
1520
1521 // We finished this request, but there's still data in this data run.
1522 if (Length == 0 && WriteLength != DataRunLength * Vcb->NtfsInfo.BytesPerCluster)
1523 break;
1524
1525 // Go to next run in the list.
1526
1527 if (*DataRun == 0)
1528 {
1529 // that was the last run
1530 if (Length > 0)
1531 {
1532 // Failed sanity check.
1533 DPRINT1("Encountered EOF before expected!\n");
1534 Status = STATUS_END_OF_FILE;
1535 goto Cleanup;
1536 }
1537
1538 break;
1539 }
1540
1541 // Advance to the next data run
1542 CurrentOffset += DataRunLength * Vcb->NtfsInfo.BytesPerCluster;
1543 DataRun = DecodeRun(DataRun, &DataRunOffset, &DataRunLength);
1544 if (DataRunOffset != -1)
1545 {
1546 // Normal data run.
1547 DataRunStartLCN = LastLCN + DataRunOffset;
1548 LastLCN = DataRunStartLCN;
1549 }
1550 else
1551 {
1552 // Sparse data run.
1553 DataRunStartLCN = -1;
1554 }
1555 } // end while (Length > 0) [more data to write]
1556
1557 Context->CacheRun = DataRun;
1558 Context->CacheRunOffset = Offset + *RealLengthWritten;
1559 Context->CacheRunStartLCN = DataRunStartLCN;
1560 Context->CacheRunLength = DataRunLength;
1561 Context->CacheRunLastLCN = LastLCN;
1562 Context->CacheRunCurrentOffset = CurrentOffset;
1563
1564 Cleanup:
1565 // TEMPTEMP
1566 if (Context->pRecord->IsNonResident)
1567 ExFreePoolWithTag(TempBuffer, TAG_NTFS);
1568
1569 return Status;
1570 }
1571
1572 NTSTATUS
1573 ReadFileRecord(PDEVICE_EXTENSION Vcb,
1574 ULONGLONG index,
1575 PFILE_RECORD_HEADER file)
1576 {
1577 ULONGLONG BytesRead;
1578
1579 DPRINT("ReadFileRecord(%p, %I64x, %p)\n", Vcb, index, file);
1580
1581 BytesRead = ReadAttribute(Vcb, Vcb->MFTContext, index * Vcb->NtfsInfo.BytesPerFileRecord, (PCHAR)file, Vcb->NtfsInfo.BytesPerFileRecord);
1582 if (BytesRead != Vcb->NtfsInfo.BytesPerFileRecord)
1583 {
1584 DPRINT1("ReadFileRecord failed: %I64u read, %lu expected\n", BytesRead, Vcb->NtfsInfo.BytesPerFileRecord);
1585 return STATUS_PARTIAL_COPY;
1586 }
1587
1588 /* Apply update sequence array fixups. */
1589 DPRINT("Sequence number: %u\n", file->SequenceNumber);
1590 return FixupUpdateSequenceArray(Vcb, &file->Ntfs);
1591 }
1592
1593
1594 /**
1595 * Searches a file's parent directory (given the parent's index in the mft)
1596 * for the given file. Upon finding an index entry for that file, updates
1597 * Data Size and Allocated Size values in the $FILE_NAME attribute of that entry.
1598 *
1599 * (Most of this code was copied from NtfsFindMftRecord)
1600 */
1601 NTSTATUS
1602 UpdateFileNameRecord(PDEVICE_EXTENSION Vcb,
1603 ULONGLONG ParentMFTIndex,
1604 PUNICODE_STRING FileName,
1605 BOOLEAN DirSearch,
1606 ULONGLONG NewDataSize,
1607 ULONGLONG NewAllocationSize,
1608 BOOLEAN CaseSensitive)
1609 {
1610 PFILE_RECORD_HEADER MftRecord;
1611 PNTFS_ATTR_CONTEXT IndexRootCtx;
1612 PINDEX_ROOT_ATTRIBUTE IndexRoot;
1613 PCHAR IndexRecord;
1614 PINDEX_ENTRY_ATTRIBUTE IndexEntry, IndexEntryEnd;
1615 NTSTATUS Status;
1616 ULONG CurrentEntry = 0;
1617
1618 DPRINT("UpdateFileNameRecord(%p, %I64d, %wZ, %s, %I64u, %I64u, %s)\n",
1619 Vcb,
1620 ParentMFTIndex,
1621 FileName,
1622 DirSearch ? "TRUE" : "FALSE",
1623 NewDataSize,
1624 NewAllocationSize,
1625 CaseSensitive ? "TRUE" : "FALSE");
1626
1627 MftRecord = ExAllocateFromNPagedLookasideList(&Vcb->FileRecLookasideList);
1628 if (MftRecord == NULL)
1629 {
1630 return STATUS_INSUFFICIENT_RESOURCES;
1631 }
1632
1633 Status = ReadFileRecord(Vcb, ParentMFTIndex, MftRecord);
1634 if (!NT_SUCCESS(Status))
1635 {
1636 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, MftRecord);
1637 return Status;
1638 }
1639
1640 ASSERT(MftRecord->Ntfs.Type == NRH_FILE_TYPE);
1641 Status = FindAttribute(Vcb, MftRecord, AttributeIndexRoot, L"$I30", 4, &IndexRootCtx, NULL);
1642 if (!NT_SUCCESS(Status))
1643 {
1644 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, MftRecord);
1645 return Status;
1646 }
1647
1648 IndexRecord = ExAllocatePoolWithTag(NonPagedPool, Vcb->NtfsInfo.BytesPerIndexRecord, TAG_NTFS);
1649 if (IndexRecord == NULL)
1650 {
1651 ReleaseAttributeContext(IndexRootCtx);
1652 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, MftRecord);
1653 return STATUS_INSUFFICIENT_RESOURCES;
1654 }
1655
1656 Status = ReadAttribute(Vcb, IndexRootCtx, 0, IndexRecord, AttributeDataLength(IndexRootCtx->pRecord));
1657 if (!NT_SUCCESS(Status))
1658 {
1659 DPRINT1("ERROR: Failed to read Index Root!\n");
1660 ExFreePoolWithTag(IndexRecord, TAG_NTFS);
1661 ReleaseAttributeContext(IndexRootCtx);
1662 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, MftRecord);
1663 }
1664
1665 IndexRoot = (PINDEX_ROOT_ATTRIBUTE)IndexRecord;
1666 IndexEntry = (PINDEX_ENTRY_ATTRIBUTE)((PCHAR)&IndexRoot->Header + IndexRoot->Header.FirstEntryOffset);
1667 // Index root is always resident.
1668 IndexEntryEnd = (PINDEX_ENTRY_ATTRIBUTE)(IndexRecord + IndexRoot->Header.TotalSizeOfEntries);
1669
1670 DPRINT("IndexRecordSize: %x IndexBlockSize: %x\n", Vcb->NtfsInfo.BytesPerIndexRecord, IndexRoot->SizeOfEntry);
1671
1672 Status = UpdateIndexEntryFileNameSize(Vcb,
1673 MftRecord,
1674 IndexRecord,
1675 IndexRoot->SizeOfEntry,
1676 IndexEntry,
1677 IndexEntryEnd,
1678 FileName,
1679 &CurrentEntry,
1680 &CurrentEntry,
1681 DirSearch,
1682 NewDataSize,
1683 NewAllocationSize,
1684 CaseSensitive);
1685
1686 if (Status == STATUS_PENDING)
1687 {
1688 // we need to write the index root attribute back to disk
1689 ULONG LengthWritten;
1690 Status = WriteAttribute(Vcb, IndexRootCtx, 0, (PUCHAR)IndexRecord, AttributeDataLength(IndexRootCtx->pRecord), &LengthWritten, MftRecord);
1691 if (!NT_SUCCESS(Status))
1692 {
1693 DPRINT1("ERROR: Couldn't update Index Root!\n");
1694 }
1695
1696 }
1697
1698 ReleaseAttributeContext(IndexRootCtx);
1699 ExFreePoolWithTag(IndexRecord, TAG_NTFS);
1700 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, MftRecord);
1701
1702 return Status;
1703 }
1704
1705 /**
1706 * Recursively searches directory index and applies the size update to the $FILE_NAME attribute of the
1707 * proper index entry.
1708 * (Heavily based on BrowseIndexEntries)
1709 */
1710 NTSTATUS
1711 UpdateIndexEntryFileNameSize(PDEVICE_EXTENSION Vcb,
1712 PFILE_RECORD_HEADER MftRecord,
1713 PCHAR IndexRecord,
1714 ULONG IndexBlockSize,
1715 PINDEX_ENTRY_ATTRIBUTE FirstEntry,
1716 PINDEX_ENTRY_ATTRIBUTE LastEntry,
1717 PUNICODE_STRING FileName,
1718 PULONG StartEntry,
1719 PULONG CurrentEntry,
1720 BOOLEAN DirSearch,
1721 ULONGLONG NewDataSize,
1722 ULONGLONG NewAllocatedSize,
1723 BOOLEAN CaseSensitive)
1724 {
1725 NTSTATUS Status;
1726 ULONG RecordOffset;
1727 PINDEX_ENTRY_ATTRIBUTE IndexEntry;
1728 PNTFS_ATTR_CONTEXT IndexAllocationCtx;
1729 ULONGLONG IndexAllocationSize;
1730 PINDEX_BUFFER IndexBuffer;
1731
1732 DPRINT("UpdateIndexEntrySize(%p, %p, %p, %lu, %p, %p, %wZ, %lu, %lu, %s, %I64u, %I64u, %s)\n",
1733 Vcb,
1734 MftRecord,
1735 IndexRecord,
1736 IndexBlockSize,
1737 FirstEntry,
1738 LastEntry,
1739 FileName,
1740 *StartEntry,
1741 *CurrentEntry,
1742 DirSearch ? "TRUE" : "FALSE",
1743 NewDataSize,
1744 NewAllocatedSize,
1745 CaseSensitive ? "TRUE" : "FALSE");
1746
1747 // find the index entry responsible for the file we're trying to update
1748 IndexEntry = FirstEntry;
1749 while (IndexEntry < LastEntry &&
1750 !(IndexEntry->Flags & NTFS_INDEX_ENTRY_END))
1751 {
1752 if ((IndexEntry->Data.Directory.IndexedFile & NTFS_MFT_MASK) > NTFS_FILE_FIRST_USER_FILE &&
1753 *CurrentEntry >= *StartEntry &&
1754 IndexEntry->FileName.NameType != NTFS_FILE_NAME_DOS &&
1755 CompareFileName(FileName, IndexEntry, DirSearch, CaseSensitive))
1756 {
1757 *StartEntry = *CurrentEntry;
1758 IndexEntry->FileName.DataSize = NewDataSize;
1759 IndexEntry->FileName.AllocatedSize = NewAllocatedSize;
1760 // indicate that the caller will still need to write the structure to the disk
1761 return STATUS_PENDING;
1762 }
1763
1764 (*CurrentEntry) += 1;
1765 ASSERT(IndexEntry->Length >= sizeof(INDEX_ENTRY_ATTRIBUTE));
1766 IndexEntry = (PINDEX_ENTRY_ATTRIBUTE)((PCHAR)IndexEntry + IndexEntry->Length);
1767 }
1768
1769 /* If we're already browsing a subnode */
1770 if (IndexRecord == NULL)
1771 {
1772 return STATUS_OBJECT_PATH_NOT_FOUND;
1773 }
1774
1775 /* If there's no subnode */
1776 if (!(IndexEntry->Flags & NTFS_INDEX_ENTRY_NODE))
1777 {
1778 return STATUS_OBJECT_PATH_NOT_FOUND;
1779 }
1780
1781 Status = FindAttribute(Vcb, MftRecord, AttributeIndexAllocation, L"$I30", 4, &IndexAllocationCtx, NULL);
1782 if (!NT_SUCCESS(Status))
1783 {
1784 DPRINT("Corrupted filesystem!\n");
1785 return Status;
1786 }
1787
1788 IndexAllocationSize = AttributeDataLength(IndexAllocationCtx->pRecord);
1789 Status = STATUS_OBJECT_PATH_NOT_FOUND;
1790 for (RecordOffset = 0; RecordOffset < IndexAllocationSize; RecordOffset += IndexBlockSize)
1791 {
1792 ReadAttribute(Vcb, IndexAllocationCtx, RecordOffset, IndexRecord, IndexBlockSize);
1793 Status = FixupUpdateSequenceArray(Vcb, &((PFILE_RECORD_HEADER)IndexRecord)->Ntfs);
1794 if (!NT_SUCCESS(Status))
1795 {
1796 break;
1797 }
1798
1799 IndexBuffer = (PINDEX_BUFFER)IndexRecord;
1800 ASSERT(IndexBuffer->Ntfs.Type == NRH_INDX_TYPE);
1801 ASSERT(IndexBuffer->Header.AllocatedSize + FIELD_OFFSET(INDEX_BUFFER, Header) == IndexBlockSize);
1802 FirstEntry = (PINDEX_ENTRY_ATTRIBUTE)((ULONG_PTR)&IndexBuffer->Header + IndexBuffer->Header.FirstEntryOffset);
1803 LastEntry = (PINDEX_ENTRY_ATTRIBUTE)((ULONG_PTR)&IndexBuffer->Header + IndexBuffer->Header.TotalSizeOfEntries);
1804 ASSERT(LastEntry <= (PINDEX_ENTRY_ATTRIBUTE)((ULONG_PTR)IndexBuffer + IndexBlockSize));
1805
1806 Status = UpdateIndexEntryFileNameSize(NULL,
1807 NULL,
1808 NULL,
1809 0,
1810 FirstEntry,
1811 LastEntry,
1812 FileName,
1813 StartEntry,
1814 CurrentEntry,
1815 DirSearch,
1816 NewDataSize,
1817 NewAllocatedSize,
1818 CaseSensitive);
1819 if (Status == STATUS_PENDING)
1820 {
1821 // write the index record back to disk
1822 ULONG Written;
1823
1824 // first we need to update the fixup values for the index block
1825 Status = AddFixupArray(Vcb, &((PFILE_RECORD_HEADER)IndexRecord)->Ntfs);
1826 if (!NT_SUCCESS(Status))
1827 {
1828 DPRINT1("Error: Failed to update fixup sequence array!\n");
1829 break;
1830 }
1831
1832 Status = WriteAttribute(Vcb, IndexAllocationCtx, RecordOffset, (const PUCHAR)IndexRecord, IndexBlockSize, &Written, MftRecord);
1833 if (!NT_SUCCESS(Status))
1834 {
1835 DPRINT1("ERROR Performing write!\n");
1836 break;
1837 }
1838
1839 Status = STATUS_SUCCESS;
1840 break;
1841 }
1842 if (NT_SUCCESS(Status))
1843 {
1844 break;
1845 }
1846 }
1847
1848 ReleaseAttributeContext(IndexAllocationCtx);
1849 return Status;
1850 }
1851
1852 /**
1853 * @name UpdateFileRecord
1854 * @implemented
1855 *
1856 * Writes a file record to the master file table, at a given index.
1857 *
1858 * @param Vcb
1859 * Pointer to the DEVICE_EXTENSION of the target drive being written to.
1860 *
1861 * @param MftIndex
1862 * Target index in the master file table to store the file record.
1863 *
1864 * @param FileRecord
1865 * Pointer to the complete file record which will be written to the master file table.
1866 *
1867 * @return
1868 * STATUS_SUCCESSFUL on success. An error passed from WriteAttribute() otherwise.
1869 *
1870 */
1871 NTSTATUS
1872 UpdateFileRecord(PDEVICE_EXTENSION Vcb,
1873 ULONGLONG MftIndex,
1874 PFILE_RECORD_HEADER FileRecord)
1875 {
1876 ULONG BytesWritten;
1877 NTSTATUS Status = STATUS_SUCCESS;
1878
1879 DPRINT("UpdateFileRecord(%p, 0x%I64x, %p)\n", Vcb, MftIndex, FileRecord);
1880
1881 // Add the fixup array to prepare the data for writing to disk
1882 AddFixupArray(Vcb, &FileRecord->Ntfs);
1883
1884 // write the file record to the master file table
1885 Status = WriteAttribute(Vcb,
1886 Vcb->MFTContext,
1887 MftIndex * Vcb->NtfsInfo.BytesPerFileRecord,
1888 (const PUCHAR)FileRecord,
1889 Vcb->NtfsInfo.BytesPerFileRecord,
1890 &BytesWritten,
1891 FileRecord);
1892
1893 if (!NT_SUCCESS(Status))
1894 {
1895 DPRINT1("UpdateFileRecord failed: %lu written, %lu expected\n", BytesWritten, Vcb->NtfsInfo.BytesPerFileRecord);
1896 }
1897
1898 // remove the fixup array (so the file record pointer can still be used)
1899 FixupUpdateSequenceArray(Vcb, &FileRecord->Ntfs);
1900
1901 return Status;
1902 }
1903
1904
1905 NTSTATUS
1906 FixupUpdateSequenceArray(PDEVICE_EXTENSION Vcb,
1907 PNTFS_RECORD_HEADER Record)
1908 {
1909 USHORT *USA;
1910 USHORT USANumber;
1911 USHORT USACount;
1912 USHORT *Block;
1913
1914 USA = (USHORT*)((PCHAR)Record + Record->UsaOffset);
1915 USANumber = *(USA++);
1916 USACount = Record->UsaCount - 1; /* Exclude the USA Number. */
1917 Block = (USHORT*)((PCHAR)Record + Vcb->NtfsInfo.BytesPerSector - 2);
1918
1919 DPRINT("FixupUpdateSequenceArray(%p, %p)\nUSANumber: %u\tUSACount: %u\n", Vcb, Record, USANumber, USACount);
1920
1921 while (USACount)
1922 {
1923 if (*Block != USANumber)
1924 {
1925 DPRINT1("Mismatch with USA: %u read, %u expected\n" , *Block, USANumber);
1926 return STATUS_UNSUCCESSFUL;
1927 }
1928 *Block = *(USA++);
1929 Block = (USHORT*)((PCHAR)Block + Vcb->NtfsInfo.BytesPerSector);
1930 USACount--;
1931 }
1932
1933 return STATUS_SUCCESS;
1934 }
1935
1936 /**
1937 * @name AddNewMftEntry
1938 * @implemented
1939 *
1940 * Adds a file record to the master file table of a given device.
1941 *
1942 * @param FileRecord
1943 * Pointer to a complete file record which will be saved to disk.
1944 *
1945 * @param DeviceExt
1946 * Pointer to the DEVICE_EXTENSION of the target drive.
1947 *
1948 * @param DestinationIndex
1949 * Pointer to a ULONGLONG which will receive the MFT index where the file record was stored.
1950 *
1951 * @param CanWait
1952 * Boolean indicating if the function is allowed to wait for exclusive access to the master file table.
1953 * This will only be relevant if the MFT doesn't have any free file records and needs to be enlarged.
1954 *
1955 * @return
1956 * STATUS_SUCCESS on success.
1957 * STATUS_OBJECT_NAME_NOT_FOUND if we can't find the MFT's $Bitmap or if we weren't able
1958 * to read the attribute.
1959 * STATUS_INSUFFICIENT_RESOURCES if we can't allocate enough memory for a copy of $Bitmap.
1960 * STATUS_CANT_WAIT if CanWait was FALSE and the function could not get immediate, exclusive access to the MFT.
1961 */
1962 NTSTATUS
1963 AddNewMftEntry(PFILE_RECORD_HEADER FileRecord,
1964 PDEVICE_EXTENSION DeviceExt,
1965 PULONGLONG DestinationIndex,
1966 BOOLEAN CanWait)
1967 {
1968 NTSTATUS Status = STATUS_SUCCESS;
1969 ULONGLONG MftIndex;
1970 RTL_BITMAP Bitmap;
1971 ULONGLONG BitmapDataSize;
1972 ULONGLONG AttrBytesRead;
1973 PUCHAR BitmapData;
1974 PUCHAR BitmapBuffer;
1975 ULONG LengthWritten;
1976 PNTFS_ATTR_CONTEXT BitmapContext;
1977 LARGE_INTEGER BitmapBits;
1978 UCHAR SystemReservedBits;
1979
1980 DPRINT1("AddNewMftEntry(%p, %p, %p, %s)\n", FileRecord, DeviceExt, DestinationIndex, CanWait ? "TRUE" : "FALSE");
1981
1982 // First, we have to read the mft's $Bitmap attribute
1983
1984 // Find the attribute
1985 Status = FindAttribute(DeviceExt, DeviceExt->MasterFileTable, AttributeBitmap, L"", 0, &BitmapContext, NULL);
1986 if (!NT_SUCCESS(Status))
1987 {
1988 DPRINT1("ERROR: Couldn't find $Bitmap attribute of master file table!\n");
1989 return Status;
1990 }
1991
1992 // Get size of bitmap
1993 BitmapDataSize = AttributeDataLength(BitmapContext->pRecord);
1994
1995 // RtlInitializeBitmap wants a ULONG-aligned pointer, and wants the memory passed to it to be a ULONG-multiple
1996 // Allocate a buffer for the $Bitmap attribute plus enough to ensure we can get a ULONG-aligned pointer
1997 BitmapBuffer = ExAllocatePoolWithTag(NonPagedPool, BitmapDataSize + sizeof(ULONG), TAG_NTFS);
1998 if (!BitmapBuffer)
1999 {
2000 ReleaseAttributeContext(BitmapContext);
2001 return STATUS_INSUFFICIENT_RESOURCES;
2002 }
2003 RtlZeroMemory(BitmapBuffer, BitmapDataSize + sizeof(ULONG));
2004
2005 // Get a ULONG-aligned pointer for the bitmap itself
2006 BitmapData = (PUCHAR)ALIGN_UP_BY((ULONG_PTR)BitmapBuffer, sizeof(ULONG));
2007
2008 // read $Bitmap attribute
2009 AttrBytesRead = ReadAttribute(DeviceExt, BitmapContext, 0, (PCHAR)BitmapData, BitmapDataSize);
2010
2011 if (AttrBytesRead != BitmapDataSize)
2012 {
2013 DPRINT1("ERROR: Unable to read $Bitmap attribute of master file table!\n");
2014 ExFreePoolWithTag(BitmapBuffer, TAG_NTFS);
2015 ReleaseAttributeContext(BitmapContext);
2016 return STATUS_OBJECT_NAME_NOT_FOUND;
2017 }
2018
2019 // We need to backup the bits for records 0x10 - 0x17 (3rd byte of bitmap) and mark these records
2020 // as in-use so we don't assign files to those indices. They're reserved for the system (e.g. ChkDsk).
2021 SystemReservedBits = BitmapData[2];
2022 BitmapData[2] = 0xff;
2023
2024 // Calculate bit count
2025 BitmapBits.QuadPart = AttributeDataLength(DeviceExt->MFTContext->pRecord) /
2026 DeviceExt->NtfsInfo.BytesPerFileRecord;
2027 if (BitmapBits.HighPart != 0)
2028 {
2029 DPRINT1("\tFIXME: bitmap sizes beyond 32bits are not yet supported! (Your NTFS volume is too large)\n");
2030 NtfsGlobalData->EnableWriteSupport = FALSE;
2031 ExFreePoolWithTag(BitmapBuffer, TAG_NTFS);
2032 ReleaseAttributeContext(BitmapContext);
2033 return STATUS_NOT_IMPLEMENTED;
2034 }
2035
2036 // convert buffer into bitmap
2037 RtlInitializeBitMap(&Bitmap, (PULONG)BitmapData, BitmapBits.LowPart);
2038
2039 // set next available bit, preferrably after 23rd bit
2040 MftIndex = RtlFindClearBitsAndSet(&Bitmap, 1, 24);
2041 if ((LONG)MftIndex == -1)
2042 {
2043 DPRINT1("Couldn't find free space in MFT for file record, increasing MFT size.\n");
2044
2045 ExFreePoolWithTag(BitmapBuffer, TAG_NTFS);
2046 ReleaseAttributeContext(BitmapContext);
2047
2048 // Couldn't find a free record in the MFT, add some blank records and try again
2049 Status = IncreaseMftSize(DeviceExt, CanWait);
2050 if (!NT_SUCCESS(Status))
2051 {
2052 DPRINT1("ERROR: Couldn't find space in MFT for file or increase MFT size!\n");
2053 return Status;
2054 }
2055
2056 return AddNewMftEntry(FileRecord, DeviceExt, DestinationIndex, CanWait);
2057 }
2058
2059 DPRINT1("Creating file record at MFT index: %I64u\n", MftIndex);
2060
2061 // update file record with index
2062 FileRecord->MFTRecordNumber = MftIndex;
2063
2064 // [BitmapData should have been updated via RtlFindClearBitsAndSet()]
2065
2066 // Restore the system reserved bits
2067 BitmapData[2] = SystemReservedBits;
2068
2069 // write the bitmap back to the MFT's $Bitmap attribute
2070 Status = WriteAttribute(DeviceExt, BitmapContext, 0, BitmapData, BitmapDataSize, &LengthWritten, FileRecord);
2071 if (!NT_SUCCESS(Status))
2072 {
2073 DPRINT1("ERROR encountered when writing $Bitmap attribute!\n");
2074 ExFreePoolWithTag(BitmapBuffer, TAG_NTFS);
2075 ReleaseAttributeContext(BitmapContext);
2076 return Status;
2077 }
2078
2079 // update the file record (write it to disk)
2080 Status = UpdateFileRecord(DeviceExt, MftIndex, FileRecord);
2081
2082 if (!NT_SUCCESS(Status))
2083 {
2084 DPRINT1("ERROR: Unable to write file record!\n");
2085 ExFreePoolWithTag(BitmapBuffer, TAG_NTFS);
2086 ReleaseAttributeContext(BitmapContext);
2087 return Status;
2088 }
2089
2090 *DestinationIndex = MftIndex;
2091
2092 ExFreePoolWithTag(BitmapBuffer, TAG_NTFS);
2093 ReleaseAttributeContext(BitmapContext);
2094
2095 return Status;
2096 }
2097
2098 /**
2099 * @name NtfsAddFilenameToDirectory
2100 * @implemented
2101 *
2102 * Adds a $FILE_NAME attribute to a given directory index.
2103 *
2104 * @param DeviceExt
2105 * Points to the target disk's DEVICE_EXTENSION.
2106 *
2107 * @param DirectoryMftIndex
2108 * Mft index of the parent directory which will receive the file.
2109 *
2110 * @param FileReferenceNumber
2111 * File reference of the file to be added to the directory. This is a combination of the
2112 * Mft index and sequence number.
2113 *
2114 * @param FilenameAttribute
2115 * Pointer to the FILENAME_ATTRIBUTE of the file being added to the directory.
2116 *
2117 * @param CaseSensitive
2118 * Boolean indicating if the function should operate in case-sensitive mode. This will be TRUE
2119 * if an application created the file with the FILE_FLAG_POSIX_SEMANTICS flag.
2120 *
2121 * @return
2122 * STATUS_SUCCESS on success.
2123 * STATUS_INSUFFICIENT_RESOURCES if an allocation fails.
2124 * STATUS_NOT_IMPLEMENTED if target address isn't at the end of the given file record.
2125 *
2126 * @remarks
2127 * WIP - Can only support a few files in a directory.
2128 * One FILENAME_ATTRIBUTE is added to the directory's index for each link to that file. So, each
2129 * file which contains one FILENAME_ATTRIBUTE for a long name and another for the 8.3 name, will
2130 * get both attributes added to its parent directory.
2131 */
2132 NTSTATUS
2133 NtfsAddFilenameToDirectory(PDEVICE_EXTENSION DeviceExt,
2134 ULONGLONG DirectoryMftIndex,
2135 ULONGLONG FileReferenceNumber,
2136 PFILENAME_ATTRIBUTE FilenameAttribute,
2137 BOOLEAN CaseSensitive)
2138 {
2139 NTSTATUS Status = STATUS_SUCCESS;
2140 PFILE_RECORD_HEADER ParentFileRecord;
2141 PNTFS_ATTR_CONTEXT IndexRootContext;
2142 PINDEX_ROOT_ATTRIBUTE I30IndexRoot;
2143 ULONG IndexRootOffset;
2144 ULONGLONG I30IndexRootLength;
2145 ULONG LengthWritten;
2146 PINDEX_ROOT_ATTRIBUTE NewIndexRoot;
2147 ULONG AttributeLength;
2148 PNTFS_ATTR_RECORD NextAttribute;
2149 PB_TREE NewTree;
2150 ULONG BtreeIndexLength;
2151 ULONG MaxIndexRootSize;
2152 PB_TREE_KEY NewLeftKey;
2153 PB_TREE_FILENAME_NODE NewRightHandNode;
2154 LARGE_INTEGER MinIndexRootSize;
2155 ULONG NewMaxIndexRootSize;
2156 ULONG NodeSize;
2157
2158 // Allocate memory for the parent directory
2159 ParentFileRecord = ExAllocateFromNPagedLookasideList(&DeviceExt->FileRecLookasideList);
2160 if (!ParentFileRecord)
2161 {
2162 DPRINT1("ERROR: Couldn't allocate memory for file record!\n");
2163 return STATUS_INSUFFICIENT_RESOURCES;
2164 }
2165
2166 // Open the parent directory
2167 Status = ReadFileRecord(DeviceExt, DirectoryMftIndex, ParentFileRecord);
2168 if (!NT_SUCCESS(Status))
2169 {
2170 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, ParentFileRecord);
2171 DPRINT1("ERROR: Couldn't read parent directory with index %I64u\n",
2172 DirectoryMftIndex);
2173 return Status;
2174 }
2175
2176 #ifndef NDEBUG
2177 DPRINT1("Dumping old parent file record:\n");
2178 NtfsDumpFileRecord(DeviceExt, ParentFileRecord);
2179 #endif
2180
2181 // Find the index root attribute for the directory
2182 Status = FindAttribute(DeviceExt,
2183 ParentFileRecord,
2184 AttributeIndexRoot,
2185 L"$I30",
2186 4,
2187 &IndexRootContext,
2188 &IndexRootOffset);
2189 if (!NT_SUCCESS(Status))
2190 {
2191 DPRINT1("ERROR: Couldn't find $I30 $INDEX_ROOT attribute for parent directory with MFT #: %I64u!\n",
2192 DirectoryMftIndex);
2193 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, ParentFileRecord);
2194 return Status;
2195 }
2196
2197 // Find the maximum index size given what the file record can hold
2198 // First, find the max index size assuming index root is the last attribute
2199 MaxIndexRootSize = DeviceExt->NtfsInfo.BytesPerFileRecord // Start with the size of a file record
2200 - IndexRootOffset // Subtract the length of everything that comes before index root
2201 - IndexRootContext->pRecord->Resident.ValueOffset // Subtract the length of the attribute header for index root
2202 - sizeof(INDEX_ROOT_ATTRIBUTE) // Subtract the length of the index root header
2203 - (sizeof(ULONG) * 2); // Subtract the length of the file record end marker and padding
2204
2205 // Are there attributes after this one?
2206 NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)ParentFileRecord + IndexRootOffset + IndexRootContext->pRecord->Length);
2207 if (NextAttribute->Type != AttributeEnd)
2208 {
2209 // Find the length of all attributes after this one, not counting the end marker
2210 ULONG LengthOfAttributes = 0;
2211 PNTFS_ATTR_RECORD CurrentAttribute = NextAttribute;
2212 while (CurrentAttribute->Type != AttributeEnd)
2213 {
2214 LengthOfAttributes += CurrentAttribute->Length;
2215 CurrentAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)CurrentAttribute + CurrentAttribute->Length);
2216 }
2217
2218 // Leave room for the existing attributes
2219 MaxIndexRootSize -= LengthOfAttributes;
2220 }
2221
2222 // Allocate memory for the index root data
2223 I30IndexRootLength = AttributeDataLength(IndexRootContext->pRecord);
2224 I30IndexRoot = ExAllocatePoolWithTag(NonPagedPool, I30IndexRootLength, TAG_NTFS);
2225 if (!I30IndexRoot)
2226 {
2227 DPRINT1("ERROR: Couldn't allocate memory for index root attribute!\n");
2228 ReleaseAttributeContext(IndexRootContext);
2229 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, ParentFileRecord);
2230 return STATUS_INSUFFICIENT_RESOURCES;
2231 }
2232
2233 // Read the Index Root
2234 Status = ReadAttribute(DeviceExt, IndexRootContext, 0, (PCHAR)I30IndexRoot, I30IndexRootLength);
2235 if (!NT_SUCCESS(Status))
2236 {
2237 DPRINT1("ERROR: Couln't read index root attribute for Mft index #%I64u\n", DirectoryMftIndex);
2238 ReleaseAttributeContext(IndexRootContext);
2239 ExFreePoolWithTag(I30IndexRoot, TAG_NTFS);
2240 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, ParentFileRecord);
2241 return Status;
2242 }
2243
2244 // Convert the index to a B*Tree
2245 Status = CreateBTreeFromIndex(DeviceExt,
2246 ParentFileRecord,
2247 IndexRootContext,
2248 I30IndexRoot,
2249 &NewTree);
2250 if (!NT_SUCCESS(Status))
2251 {
2252 DPRINT1("ERROR: Failed to create B-Tree from Index!\n");
2253 ReleaseAttributeContext(IndexRootContext);
2254 ExFreePoolWithTag(I30IndexRoot, TAG_NTFS);
2255 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, ParentFileRecord);
2256 return Status;
2257 }
2258
2259 #ifndef NDEBUG
2260 DumpBTree(NewTree);
2261 #endif
2262
2263 // Insert the key for the file we're adding
2264 Status = NtfsInsertKey(NewTree,
2265 FileReferenceNumber,
2266 FilenameAttribute,
2267 NewTree->RootNode,
2268 CaseSensitive,
2269 MaxIndexRootSize,
2270 I30IndexRoot->SizeOfEntry,
2271 &NewLeftKey,
2272 &NewRightHandNode);
2273 if (!NT_SUCCESS(Status))
2274 {
2275 DPRINT1("ERROR: Failed to insert key into B-Tree!\n");
2276 DestroyBTree(NewTree);
2277 ReleaseAttributeContext(IndexRootContext);
2278 ExFreePoolWithTag(I30IndexRoot, TAG_NTFS);
2279 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, ParentFileRecord);
2280 return Status;
2281 }
2282
2283 #ifndef NDEBUG
2284 DumpBTree(NewTree);
2285 #endif
2286
2287 // The root node can't be split
2288 ASSERT(NewLeftKey == NULL);
2289 ASSERT(NewRightHandNode == NULL);
2290
2291 // Convert B*Tree back to Index
2292
2293 // Updating the index allocation can change the size available for the index root,
2294 // And if the index root is demoted, the index allocation will need to be updated again,
2295 // which may change the size available for index root... etc.
2296 // My solution is to decrease index root to the size it would be if it was demoted,
2297 // then UpdateIndexAllocation will have an accurate representation of the maximum space
2298 // it can use in the file record. There's still a chance that the act of allocating an
2299 // index node after demoting the index root will increase the size of the file record beyond
2300 // it's limit, but if that happens, an attribute-list will most definitely be needed.
2301 // This a bit hacky, but it seems to be functional.
2302
2303 // Calculate the minimum size of the index root attribute, considering one dummy key and one VCN
2304 MinIndexRootSize.QuadPart = sizeof(INDEX_ROOT_ATTRIBUTE) // size of the index root headers
2305 + 0x18; // Size of dummy key with a VCN for a subnode
2306 ASSERT(MinIndexRootSize.QuadPart % ATTR_RECORD_ALIGNMENT == 0);
2307
2308 // Temporarily shrink the index root to it's minimal size
2309 AttributeLength = MinIndexRootSize.LowPart;
2310 AttributeLength += sizeof(INDEX_ROOT_ATTRIBUTE);
2311
2312
2313 // FIXME: IndexRoot will probably be invalid until we're finished. If we fail before we finish, the directory will probably be toast.
2314 // The potential for catastrophic data-loss exists!!! :)
2315
2316 // Update the length of the attribute in the file record of the parent directory
2317 Status = InternalSetResidentAttributeLength(DeviceExt,
2318 IndexRootContext,
2319 ParentFileRecord,
2320 IndexRootOffset,
2321 AttributeLength);
2322 if (!NT_SUCCESS(Status))
2323 {
2324 DPRINT1("ERROR: Unable to set length of index root!\n");
2325 DestroyBTree(NewTree);
2326 ReleaseAttributeContext(IndexRootContext);
2327 ExFreePoolWithTag(I30IndexRoot, TAG_NTFS);
2328 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, ParentFileRecord);
2329 return Status;
2330 }
2331
2332 // Update the index allocation
2333 Status = UpdateIndexAllocation(DeviceExt, NewTree, I30IndexRoot->SizeOfEntry, ParentFileRecord);
2334 if (!NT_SUCCESS(Status))
2335 {
2336 DPRINT1("ERROR: Failed to update index allocation from B-Tree!\n");
2337 DestroyBTree(NewTree);
2338 ReleaseAttributeContext(IndexRootContext);
2339 ExFreePoolWithTag(I30IndexRoot, TAG_NTFS);
2340 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, ParentFileRecord);
2341 return Status;
2342 }
2343
2344 #ifndef NDEBUG
2345 DPRINT1("Index Allocation updated\n");
2346 DumpBTree(NewTree);
2347 #endif
2348
2349 // Find the maximum index root size given what the file record can hold
2350 // First, find the max index size assuming index root is the last attribute
2351 NewMaxIndexRootSize =
2352 DeviceExt->NtfsInfo.BytesPerFileRecord // Start with the size of a file record
2353 - IndexRootOffset // Subtract the length of everything that comes before index root
2354 - IndexRootContext->pRecord->Resident.ValueOffset // Subtract the length of the attribute header for index root
2355 - sizeof(INDEX_ROOT_ATTRIBUTE) // Subtract the length of the index root header
2356 - (sizeof(ULONG) * 2); // Subtract the length of the file record end marker and padding
2357
2358 // Are there attributes after this one?
2359 NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)ParentFileRecord + IndexRootOffset + IndexRootContext->pRecord->Length);
2360 if (NextAttribute->Type != AttributeEnd)
2361 {
2362 // Find the length of all attributes after this one, not counting the end marker
2363 ULONG LengthOfAttributes = 0;
2364 PNTFS_ATTR_RECORD CurrentAttribute = NextAttribute;
2365 while (CurrentAttribute->Type != AttributeEnd)
2366 {
2367 LengthOfAttributes += CurrentAttribute->Length;
2368 CurrentAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)CurrentAttribute + CurrentAttribute->Length);
2369 }
2370
2371 // Leave room for the existing attributes
2372 NewMaxIndexRootSize -= LengthOfAttributes;
2373 }
2374
2375 // The index allocation and index bitmap may have grown, leaving less room for the index root,
2376 // so now we need to double-check that index root isn't too large
2377 NodeSize = GetSizeOfIndexEntries(NewTree->RootNode);
2378 if (NodeSize > NewMaxIndexRootSize)
2379 {
2380 DPRINT1("Demoting index root.\nNodeSize: 0x%lx\nNewMaxIndexRootSize: 0x%lx\n", NodeSize, NewMaxIndexRootSize);
2381
2382 Status = DemoteBTreeRoot(NewTree);
2383 if (!NT_SUCCESS(Status))
2384 {
2385 DPRINT1("ERROR: Failed to demote index root!\n");
2386 DestroyBTree(NewTree);
2387 ReleaseAttributeContext(IndexRootContext);
2388 ExFreePoolWithTag(I30IndexRoot, TAG_NTFS);
2389 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, ParentFileRecord);
2390 return Status;
2391 }
2392
2393 // We need to update the index allocation once more
2394 Status = UpdateIndexAllocation(DeviceExt, NewTree, I30IndexRoot->SizeOfEntry, ParentFileRecord);
2395 if (!NT_SUCCESS(Status))
2396 {
2397 DPRINT1("ERROR: Failed to update index allocation from B-Tree!\n");
2398 DestroyBTree(NewTree);
2399 ReleaseAttributeContext(IndexRootContext);
2400 ExFreePoolWithTag(I30IndexRoot, TAG_NTFS);
2401 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, ParentFileRecord);
2402 return Status;
2403 }
2404
2405 // re-recalculate max size of index root
2406 NewMaxIndexRootSize =
2407 // Find the maximum index size given what the file record can hold
2408 // First, find the max index size assuming index root is the last attribute
2409 DeviceExt->NtfsInfo.BytesPerFileRecord // Start with the size of a file record
2410 - IndexRootOffset // Subtract the length of everything that comes before index root
2411 - IndexRootContext->pRecord->Resident.ValueOffset // Subtract the length of the attribute header for index root
2412 - sizeof(INDEX_ROOT_ATTRIBUTE) // Subtract the length of the index root header
2413 - (sizeof(ULONG) * 2); // Subtract the length of the file record end marker and padding
2414
2415 // Are there attributes after this one?
2416 NextAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)ParentFileRecord + IndexRootOffset + IndexRootContext->pRecord->Length);
2417 if (NextAttribute->Type != AttributeEnd)
2418 {
2419 // Find the length of all attributes after this one, not counting the end marker
2420 ULONG LengthOfAttributes = 0;
2421 PNTFS_ATTR_RECORD CurrentAttribute = NextAttribute;
2422 while (CurrentAttribute->Type != AttributeEnd)
2423 {
2424 LengthOfAttributes += CurrentAttribute->Length;
2425 CurrentAttribute = (PNTFS_ATTR_RECORD)((ULONG_PTR)CurrentAttribute + CurrentAttribute->Length);
2426 }
2427
2428 // Leave room for the existing attributes
2429 NewMaxIndexRootSize -= LengthOfAttributes;
2430 }
2431
2432
2433 }
2434
2435 // Create the Index Root from the B*Tree
2436 Status = CreateIndexRootFromBTree(DeviceExt, NewTree, NewMaxIndexRootSize, &NewIndexRoot, &BtreeIndexLength);
2437 if (!NT_SUCCESS(Status))
2438 {
2439 DPRINT1("ERROR: Failed to create Index root from B-Tree!\n");
2440 DestroyBTree(NewTree);
2441 ReleaseAttributeContext(IndexRootContext);
2442 ExFreePoolWithTag(I30IndexRoot, TAG_NTFS);
2443 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, ParentFileRecord);
2444 return Status;
2445 }
2446
2447 // We're done with the B-Tree now
2448 DestroyBTree(NewTree);
2449
2450 // Write back the new index root attribute to the parent directory file record
2451
2452 // First, we need to resize the attribute.
2453 // CreateIndexRootFromBTree() should have verified that the index root fits within MaxIndexSize.
2454 // We can't set the size as we normally would, because $INDEX_ROOT must always be resident.
2455 AttributeLength = NewIndexRoot->Header.AllocatedSize + FIELD_OFFSET(INDEX_ROOT_ATTRIBUTE, Header);
2456
2457 if (AttributeLength != IndexRootContext->pRecord->Resident.ValueLength)
2458 {
2459 // Update the length of the attribute in the file record of the parent directory
2460 Status = InternalSetResidentAttributeLength(DeviceExt,
2461 IndexRootContext,
2462 ParentFileRecord,
2463 IndexRootOffset,
2464 AttributeLength);
2465 if (!NT_SUCCESS(Status))
2466 {
2467 ExFreePoolWithTag(NewIndexRoot, TAG_NTFS);
2468 ReleaseAttributeContext(IndexRootContext);
2469 ExFreePoolWithTag(I30IndexRoot, TAG_NTFS);
2470 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, ParentFileRecord);
2471 DPRINT1("ERROR: Unable to set resident attribute length!\n");
2472 return Status;
2473 }
2474
2475 }
2476
2477 NT_ASSERT(ParentFileRecord->BytesInUse <= DeviceExt->NtfsInfo.BytesPerFileRecord);
2478
2479 Status = UpdateFileRecord(DeviceExt, DirectoryMftIndex, ParentFileRecord);
2480 if (!NT_SUCCESS(Status))
2481 {
2482 DPRINT1("ERROR: Failed to update file record of directory with index: %llx\n", DirectoryMftIndex);
2483 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, ParentFileRecord);
2484 ExFreePoolWithTag(NewIndexRoot, TAG_NTFS);
2485 ReleaseAttributeContext(IndexRootContext);
2486 ExFreePoolWithTag(I30IndexRoot, TAG_NTFS);
2487 return Status;
2488 }
2489
2490 // Write the new index root to disk
2491 Status = WriteAttribute(DeviceExt,
2492 IndexRootContext,
2493 0,
2494 (PUCHAR)NewIndexRoot,
2495 AttributeLength,
2496 &LengthWritten,
2497 ParentFileRecord);
2498 if (!NT_SUCCESS(Status) || LengthWritten != AttributeLength)
2499 {
2500 DPRINT1("ERROR: Unable to write new index root attribute to parent directory!\n");
2501 ExFreePoolWithTag(NewIndexRoot, TAG_NTFS);
2502 ReleaseAttributeContext(IndexRootContext);
2503 ExFreePoolWithTag(I30IndexRoot, TAG_NTFS);
2504 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, ParentFileRecord);
2505 return Status;
2506 }
2507
2508 // re-read the parent file record, so we can dump it
2509 Status = ReadFileRecord(DeviceExt, DirectoryMftIndex, ParentFileRecord);
2510 if (!NT_SUCCESS(Status))
2511 {
2512 DPRINT1("ERROR: Couldn't read parent directory after messing with it!\n");
2513 }
2514 else
2515 {
2516 #ifndef NDEBUG
2517 DPRINT1("Dumping new B-Tree:\n");
2518
2519 Status = CreateBTreeFromIndex(DeviceExt, ParentFileRecord, IndexRootContext, NewIndexRoot, &NewTree);
2520 if (!NT_SUCCESS(Status))
2521 {
2522 DPRINT1("ERROR: Couldn't re-create b-tree\n");
2523 return Status;
2524 }
2525
2526 DumpBTree(NewTree);
2527
2528 DestroyBTree(NewTree);
2529
2530 NtfsDumpFileRecord(DeviceExt, ParentFileRecord);
2531 #endif
2532 }
2533
2534 // Cleanup
2535 ExFreePoolWithTag(NewIndexRoot, TAG_NTFS);
2536 ReleaseAttributeContext(IndexRootContext);
2537 ExFreePoolWithTag(I30IndexRoot, TAG_NTFS);
2538 ExFreeToNPagedLookasideList(&DeviceExt->FileRecLookasideList, ParentFileRecord);
2539
2540 return Status;
2541 }
2542
2543 NTSTATUS
2544 AddFixupArray(PDEVICE_EXTENSION Vcb,
2545 PNTFS_RECORD_HEADER Record)
2546 {
2547 USHORT *pShortToFixUp;
2548 ULONG ArrayEntryCount = Record->UsaCount - 1;
2549 ULONG Offset = Vcb->NtfsInfo.BytesPerSector - 2;
2550 ULONG i;
2551
2552 PFIXUP_ARRAY fixupArray = (PFIXUP_ARRAY)((UCHAR*)Record + Record->UsaOffset);
2553
2554 DPRINT("AddFixupArray(%p, %p)\n fixupArray->USN: %u, ArrayEntryCount: %u\n", Vcb, Record, fixupArray->USN, ArrayEntryCount);
2555
2556 fixupArray->USN++;
2557
2558 for (i = 0; i < ArrayEntryCount; i++)
2559 {
2560 DPRINT("USN: %u\tOffset: %u\n", fixupArray->USN, Offset);
2561
2562 pShortToFixUp = (USHORT*)((PCHAR)Record + Offset);
2563 fixupArray->Array[i] = *pShortToFixUp;
2564 *pShortToFixUp = fixupArray->USN;
2565 Offset += Vcb->NtfsInfo.BytesPerSector;
2566 }
2567
2568 return STATUS_SUCCESS;
2569 }
2570
2571 NTSTATUS
2572 ReadLCN(PDEVICE_EXTENSION Vcb,
2573 ULONGLONG lcn,
2574 ULONG count,
2575 PVOID buffer)
2576 {
2577 LARGE_INTEGER DiskSector;
2578
2579 DiskSector.QuadPart = lcn;
2580
2581 return NtfsReadSectors(Vcb->StorageDevice,
2582 DiskSector.u.LowPart * Vcb->NtfsInfo.SectorsPerCluster,
2583 count * Vcb->NtfsInfo.SectorsPerCluster,
2584 Vcb->NtfsInfo.BytesPerSector,
2585 buffer,
2586 FALSE);
2587 }
2588
2589
2590 BOOLEAN
2591 CompareFileName(PUNICODE_STRING FileName,
2592 PINDEX_ENTRY_ATTRIBUTE IndexEntry,
2593 BOOLEAN DirSearch,
2594 BOOLEAN CaseSensitive)
2595 {
2596 BOOLEAN Ret, Alloc = FALSE;
2597 UNICODE_STRING EntryName;
2598
2599 EntryName.Buffer = IndexEntry->FileName.Name;
2600 EntryName.Length =
2601 EntryName.MaximumLength = IndexEntry->FileName.NameLength * sizeof(WCHAR);
2602
2603 if (DirSearch)
2604 {
2605 UNICODE_STRING IntFileName;
2606 if (!CaseSensitive)
2607 {
2608 NT_VERIFY(NT_SUCCESS(RtlUpcaseUnicodeString(&IntFileName, FileName, TRUE)));
2609 Alloc = TRUE;
2610 }
2611 else
2612 {
2613 IntFileName = *FileName;
2614 }
2615
2616 Ret = FsRtlIsNameInExpression(&IntFileName, &EntryName, !CaseSensitive, NULL);
2617
2618 if (Alloc)
2619 {
2620 RtlFreeUnicodeString(&IntFileName);
2621 }
2622
2623 return Ret;
2624 }
2625 else
2626 {
2627 return (RtlCompareUnicodeString(FileName, &EntryName, !CaseSensitive) == 0);
2628 }
2629 }
2630
2631 /**
2632 * @name UpdateMftMirror
2633 * @implemented
2634 *
2635 * Backs-up the first ~4 master file table entries to the $MFTMirr file.
2636 *
2637 * @param Vcb
2638 * Pointer to an NTFS_VCB for the volume whose Mft mirror is being updated.
2639 *
2640 * @return
2641
2642 * STATUS_SUCCESS on success.
2643 * STATUS_INSUFFICIENT_RESOURCES if an allocation failed.
2644 * STATUS_UNSUCCESSFUL if we couldn't read the master file table.
2645 *
2646 * @remarks
2647 * NTFS maintains up-to-date copies of the first several mft entries in the $MFTMirr file. Usually, the first 4 file
2648 * records from the mft are stored. The exact number of entries is determined by the size of $MFTMirr's $DATA.
2649 * If $MFTMirr is not up-to-date, chkdsk will reject every change it can find prior to when $MFTMirr was last updated.
2650 * Therefore, it's recommended to call this function if the volume changes considerably. For instance, IncreaseMftSize()
2651 * relies on this function to keep chkdsk from deleting the mft entries it creates. Note that under most instances, creating
2652 * or deleting a file will not affect the first ~four mft entries, and so will not require updating the mft mirror.
2653 */
2654 NTSTATUS
2655 UpdateMftMirror(PNTFS_VCB Vcb)
2656 {
2657 PFILE_RECORD_HEADER MirrorFileRecord;
2658 PNTFS_ATTR_CONTEXT MirrDataContext;
2659 PNTFS_ATTR_CONTEXT MftDataContext;
2660 PCHAR DataBuffer;
2661 ULONGLONG DataLength;
2662 NTSTATUS Status;
2663 ULONG BytesRead;
2664 ULONG LengthWritten;
2665
2666 // Allocate memory for the Mft mirror file record
2667 MirrorFileRecord = ExAllocateFromNPagedLookasideList(&Vcb->FileRecLookasideList);
2668 if (!MirrorFileRecord)
2669 {
2670 DPRINT1("Error: Failed to allocate memory for $MFTMirr!\n");
2671 return STATUS_INSUFFICIENT_RESOURCES;
2672 }
2673
2674 // Read the Mft Mirror file record
2675 Status = ReadFileRecord(Vcb, NTFS_FILE_MFTMIRR, MirrorFileRecord);
2676 if (!NT_SUCCESS(Status))
2677 {
2678 DPRINT1("ERROR: Failed to read $MFTMirr!\n");
2679 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, MirrorFileRecord);
2680 return Status;
2681 }
2682
2683 // Find the $DATA attribute of $MFTMirr
2684 Status = FindAttribute(Vcb, MirrorFileRecord, AttributeData, L"", 0, &MirrDataContext, NULL);
2685 if (!NT_SUCCESS(Status))
2686 {
2687 DPRINT1("ERROR: Couldn't find $DATA attribute!\n");
2688 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, MirrorFileRecord);
2689 return Status;
2690 }
2691
2692 // Find the $DATA attribute of $MFT
2693 Status = FindAttribute(Vcb, Vcb->MasterFileTable, AttributeData, L"", 0, &MftDataContext, NULL);
2694 if (!NT_SUCCESS(Status))
2695 {
2696 DPRINT1("ERROR: Couldn't find $DATA attribute!\n");
2697 ReleaseAttributeContext(MirrDataContext);
2698 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, MirrorFileRecord);
2699 return Status;
2700 }
2701
2702 // Get the size of the mirror's $DATA attribute
2703 DataLength = AttributeDataLength(MirrDataContext->pRecord);
2704
2705 ASSERT(DataLength % Vcb->NtfsInfo.BytesPerFileRecord == 0);
2706
2707 // Create buffer for the mirror's $DATA attribute
2708 DataBuffer = ExAllocatePoolWithTag(NonPagedPool, DataLength, TAG_NTFS);
2709 if (!DataBuffer)
2710 {
2711 DPRINT1("Error: Couldn't allocate memory for $DATA buffer!\n");
2712 ReleaseAttributeContext(MftDataContext);
2713 ReleaseAttributeContext(MirrDataContext);
2714 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, MirrorFileRecord);
2715 return STATUS_INSUFFICIENT_RESOURCES;
2716 }
2717
2718 ASSERT(DataLength < ULONG_MAX);
2719
2720 // Back up the first several entries of the Mft's $DATA Attribute
2721 BytesRead = ReadAttribute(Vcb, MftDataContext, 0, DataBuffer, (ULONG)DataLength);
2722 if (BytesRead != (ULONG)DataLength)
2723 {
2724 DPRINT1("Error: Failed to read $DATA for $MFTMirr!\n");
2725 ReleaseAttributeContext(MftDataContext);
2726 ReleaseAttributeContext(MirrDataContext);
2727 ExFreePoolWithTag(DataBuffer, TAG_NTFS);
2728 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, MirrorFileRecord);
2729 return STATUS_UNSUCCESSFUL;
2730 }
2731
2732 // Write the mirror's $DATA attribute
2733 Status = WriteAttribute(Vcb,
2734 MirrDataContext,
2735 0,
2736 (PUCHAR)DataBuffer,
2737 DataLength,
2738 &LengthWritten,
2739 MirrorFileRecord);
2740 if (!NT_SUCCESS(Status))
2741 {
2742 DPRINT1("ERROR: Failed to write $DATA attribute of $MFTMirr!\n");
2743 }
2744
2745 // Cleanup
2746 ReleaseAttributeContext(MftDataContext);
2747 ReleaseAttributeContext(MirrDataContext);
2748 ExFreePoolWithTag(DataBuffer, TAG_NTFS);
2749 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, MirrorFileRecord);
2750
2751 return Status;
2752 }
2753
2754 #if 0
2755 static
2756 VOID
2757 DumpIndexEntry(PINDEX_ENTRY_ATTRIBUTE IndexEntry)
2758 {
2759 DPRINT1("Entry: %p\n", IndexEntry);
2760 DPRINT1("\tData.Directory.IndexedFile: %I64x\n", IndexEntry->Data.Directory.IndexedFile);
2761 DPRINT1("\tLength: %u\n", IndexEntry->Length);
2762 DPRINT1("\tKeyLength: %u\n", IndexEntry->KeyLength);
2763 DPRINT1("\tFlags: %x\n", IndexEntry->Flags);
2764 DPRINT1("\tReserved: %x\n", IndexEntry->Reserved);
2765 DPRINT1("\t\tDirectoryFileReferenceNumber: %I64x\n", IndexEntry->FileName.DirectoryFileReferenceNumber);
2766 DPRINT1("\t\tCreationTime: %I64u\n", IndexEntry->FileName.CreationTime);
2767 DPRINT1("\t\tChangeTime: %I64u\n", IndexEntry->FileName.ChangeTime);
2768 DPRINT1("\t\tLastWriteTime: %I64u\n", IndexEntry->FileName.LastWriteTime);
2769 DPRINT1("\t\tLastAccessTime: %I64u\n", IndexEntry->FileName.LastAccessTime);
2770 DPRINT1("\t\tAllocatedSize: %I64u\n", IndexEntry->FileName.AllocatedSize);
2771 DPRINT1("\t\tDataSize: %I64u\n", IndexEntry->FileName.DataSize);
2772 DPRINT1("\t\tFileAttributes: %x\n", IndexEntry->FileName.FileAttributes);
2773 DPRINT1("\t\tNameLength: %u\n", IndexEntry->FileName.NameLength);
2774 DPRINT1("\t\tNameType: %x\n", IndexEntry->FileName.NameType);
2775 DPRINT1("\t\tName: %.*S\n", IndexEntry->FileName.NameLength, IndexEntry->FileName.Name);
2776 }
2777 #endif
2778
2779 NTSTATUS
2780 BrowseSubNodeIndexEntries(PNTFS_VCB Vcb,
2781 PFILE_RECORD_HEADER MftRecord,
2782 ULONG IndexBlockSize,
2783 PUNICODE_STRING FileName,
2784 PNTFS_ATTR_CONTEXT IndexAllocationContext,
2785 PRTL_BITMAP Bitmap,
2786 ULONGLONG VCN,
2787 PULONG StartEntry,
2788 PULONG CurrentEntry,
2789 BOOLEAN DirSearch,
2790 BOOLEAN CaseSensitive,
2791 ULONGLONG *OutMFTIndex)
2792 {
2793 PINDEX_BUFFER IndexRecord;
2794 ULONGLONG Offset;
2795 ULONG BytesRead;
2796 PINDEX_ENTRY_ATTRIBUTE FirstEntry;
2797 PINDEX_ENTRY_ATTRIBUTE LastEntry;
2798 PINDEX_ENTRY_ATTRIBUTE IndexEntry;
2799 ULONG NodeNumber;
2800 NTSTATUS Status;
2801
2802 DPRINT("BrowseSubNodeIndexEntries(%p, %p, %lu, %wZ, %p, %p, %I64d, %lu, %lu, %s, %s, %p)\n",
2803 Vcb,
2804 MftRecord,
2805 IndexBlockSize,
2806 FileName,
2807 IndexAllocationContext,
2808 Bitmap,
2809 VCN,
2810 *StartEntry,
2811 *CurrentEntry,
2812 "FALSE",
2813 DirSearch ? "TRUE" : "FALSE",
2814 CaseSensitive ? "TRUE" : "FALSE",
2815 OutMFTIndex);
2816
2817 // Calculate node number as VCN / Clusters per index record
2818 NodeNumber = VCN / (Vcb->NtfsInfo.BytesPerIndexRecord / Vcb->NtfsInfo.BytesPerCluster);
2819
2820 // Is the bit for this node clear in the bitmap?
2821 if (!RtlCheckBit(Bitmap, NodeNumber))
2822 {
2823 DPRINT1("File system corruption detected, node with VCN %I64u is being reused or is marked as deleted.\n", VCN);
2824 return STATUS_DATA_ERROR;
2825 }
2826
2827 // Clear the bit for this node so it can't be recursively referenced
2828 RtlClearBits(Bitmap, NodeNumber, 1);
2829
2830 // Allocate memory for the index record
2831 IndexRecord = ExAllocatePoolWithTag(NonPagedPool, IndexBlockSize, TAG_NTFS);
2832 if (!IndexRecord)
2833 {
2834 DPRINT1("Unable to allocate memory for index record!\n");
2835 return STATUS_INSUFFICIENT_RESOURCES;
2836 }
2837
2838 // Calculate offset of index record
2839 Offset = VCN * Vcb->NtfsInfo.BytesPerCluster;
2840
2841 // Read the index record
2842 BytesRead = ReadAttribute(Vcb, IndexAllocationContext, Offset, (PCHAR)IndexRecord, IndexBlockSize);
2843 if (BytesRead != IndexBlockSize)
2844 {
2845 DPRINT1("Unable to read index record!\n");
2846 ExFreePoolWithTag(IndexRecord, TAG_NTFS);
2847 return STATUS_UNSUCCESSFUL;
2848 }
2849
2850 // Assert that we're dealing with an index record here
2851 ASSERT(IndexRecord->Ntfs.Type == NRH_INDX_TYPE);
2852
2853 // Apply the fixup array to the index record
2854 Status = FixupUpdateSequenceArray(Vcb, &((PFILE_RECORD_HEADER)IndexRecord)->Ntfs);
2855 if (!NT_SUCCESS(Status))
2856 {
2857 ExFreePoolWithTag(IndexRecord, TAG_NTFS);
2858 DPRINT1("Failed to apply fixup array!\n");
2859 return Status;
2860 }
2861
2862 ASSERT(IndexRecord->Header.AllocatedSize + FIELD_OFFSET(INDEX_BUFFER, Header) == IndexBlockSize);
2863 FirstEntry = (PINDEX_ENTRY_ATTRIBUTE)((ULONG_PTR)&IndexRecord->Header + IndexRecord->Header.FirstEntryOffset);
2864 LastEntry = (PINDEX_ENTRY_ATTRIBUTE)((ULONG_PTR)&IndexRecord->Header + IndexRecord->Header.TotalSizeOfEntries);
2865 ASSERT(LastEntry <= (PINDEX_ENTRY_ATTRIBUTE)((ULONG_PTR)IndexRecord + IndexBlockSize));
2866
2867 // Loop through all Index Entries of index, starting with FirstEntry
2868 IndexEntry = FirstEntry;
2869 while (IndexEntry <= LastEntry)
2870 {
2871 // Does IndexEntry have a sub-node?
2872 if (IndexEntry->Flags & NTFS_INDEX_ENTRY_NODE)
2873 {
2874 if (!(IndexRecord->Header.Flags & INDEX_NODE_LARGE) || !IndexAllocationContext)
2875 {
2876 DPRINT1("Filesystem corruption detected!\n");
2877 }
2878 else
2879 {
2880 Status = BrowseSubNodeIndexEntries(Vcb,
2881 MftRecord,
2882 IndexBlockSize,
2883 FileName,
2884 IndexAllocationContext,
2885 Bitmap,
2886 GetIndexEntryVCN(IndexEntry),
2887 StartEntry,
2888 CurrentEntry,
2889 DirSearch,
2890 CaseSensitive,
2891 OutMFTIndex);
2892 if (NT_SUCCESS(Status))
2893 {
2894 ExFreePoolWithTag(IndexRecord, TAG_NTFS);
2895 return Status;
2896 }
2897 }
2898 }
2899
2900 // Are we done?
2901 if (IndexEntry->Flags & NTFS_INDEX_ENTRY_END)
2902 break;
2903
2904 // If we've found a file whose index is greater than or equal to StartEntry that matches the search criteria
2905 if ((IndexEntry->Data.Directory.IndexedFile & NTFS_MFT_MASK) >= NTFS_FILE_FIRST_USER_FILE &&
2906 *CurrentEntry >= *StartEntry &&
2907 IndexEntry->FileName.NameType != NTFS_FILE_NAME_DOS &&
2908 CompareFileName(FileName, IndexEntry, DirSearch, CaseSensitive))
2909 {
2910 *StartEntry = *CurrentEntry;
2911 *OutMFTIndex = (IndexEntry->Data.Directory.IndexedFile & NTFS_MFT_MASK);
2912 ExFreePoolWithTag(IndexRecord, TAG_NTFS);
2913 return STATUS_SUCCESS;
2914 }
2915
2916 // Advance to the next index entry
2917 (*CurrentEntry) += 1;
2918 ASSERT(IndexEntry->Length >= sizeof(INDEX_ENTRY_ATTRIBUTE));
2919 IndexEntry = (PINDEX_ENTRY_ATTRIBUTE)((PCHAR)IndexEntry + IndexEntry->Length);
2920 }
2921
2922 ExFreePoolWithTag(IndexRecord, TAG_NTFS);
2923
2924 return STATUS_OBJECT_PATH_NOT_FOUND;
2925 }
2926
2927 NTSTATUS
2928 BrowseIndexEntries(PDEVICE_EXTENSION Vcb,
2929 PFILE_RECORD_HEADER MftRecord,
2930 PINDEX_ROOT_ATTRIBUTE IndexRecord,
2931 ULONG IndexBlockSize,
2932 PINDEX_ENTRY_ATTRIBUTE FirstEntry,
2933 PINDEX_ENTRY_ATTRIBUTE LastEntry,
2934 PUNICODE_STRING FileName,
2935 PULONG StartEntry,
2936 PULONG CurrentEntry,
2937 BOOLEAN DirSearch,
2938 BOOLEAN CaseSensitive,
2939 ULONGLONG *OutMFTIndex)
2940 {
2941 NTSTATUS Status;
2942 PINDEX_ENTRY_ATTRIBUTE IndexEntry;
2943 PNTFS_ATTR_CONTEXT IndexAllocationContext;
2944 PNTFS_ATTR_CONTEXT BitmapContext;
2945 PCHAR *BitmapMem;
2946 ULONG *BitmapPtr;
2947 RTL_BITMAP Bitmap;
2948
2949 DPRINT("BrowseIndexEntries(%p, %p, %p, %lu, %p, %p, %wZ, %lu, %lu, %s, %s, %p)\n",
2950 Vcb,
2951 MftRecord,
2952 IndexRecord,
2953 IndexBlockSize,
2954 FirstEntry,
2955 LastEntry,
2956 FileName,
2957 *StartEntry,
2958 *CurrentEntry,
2959 DirSearch ? "TRUE" : "FALSE",
2960 CaseSensitive ? "TRUE" : "FALSE",
2961 OutMFTIndex);
2962
2963 // Find the $I30 index allocation, if there is one
2964 Status = FindAttribute(Vcb, MftRecord, AttributeIndexAllocation, L"$I30", 4, &IndexAllocationContext, NULL);
2965 if (NT_SUCCESS(Status))
2966 {
2967 ULONGLONG BitmapLength;
2968 // Find the bitmap attribute for the index
2969 Status = FindAttribute(Vcb, MftRecord, AttributeBitmap, L"$I30", 4, &BitmapContext, NULL);
2970 if (!NT_SUCCESS(Status))
2971 {
2972 DPRINT1("Potential file system corruption detected!\n");
2973 ReleaseAttributeContext(IndexAllocationContext);
2974 return Status;
2975 }
2976
2977 // Get the length of the bitmap attribute
2978 BitmapLength = AttributeDataLength(BitmapContext->pRecord);
2979
2980 // Allocate memory for the bitmap, including some padding; RtlInitializeBitmap() wants a pointer
2981 // that's ULONG-aligned, and it wants the size of the memory allocated for it to be a ULONG-multiple.
2982 BitmapMem = ExAllocatePoolWithTag(NonPagedPool, BitmapLength + sizeof(ULONG), TAG_NTFS);
2983 if (!BitmapMem)
2984 {
2985 DPRINT1("Error: failed to allocate bitmap!");
2986 ReleaseAttributeContext(BitmapContext);
2987 ReleaseAttributeContext(IndexAllocationContext);
2988 return STATUS_INSUFFICIENT_RESOURCES;
2989 }
2990
2991 RtlZeroMemory(BitmapMem, BitmapLength + sizeof(ULONG));
2992
2993 // RtlInitializeBitmap() wants a pointer that's ULONG-aligned.
2994 BitmapPtr = (PULONG)ALIGN_UP_BY((ULONG_PTR)BitmapMem, sizeof(ULONG));
2995
2996 // Read the existing bitmap data
2997 Status = ReadAttribute(Vcb, BitmapContext, 0, (PCHAR)BitmapPtr, BitmapLength);
2998 if (!NT_SUCCESS(Status))
2999 {
3000 DPRINT1("ERROR: Failed to read bitmap attribute!\n");
3001 ExFreePoolWithTag(BitmapMem, TAG_NTFS);
3002 ReleaseAttributeContext(BitmapContext);
3003 ReleaseAttributeContext(IndexAllocationContext);
3004 return Status;
3005 }
3006
3007 // Initialize bitmap
3008 RtlInitializeBitMap(&Bitmap, BitmapPtr, BitmapLength * 8);
3009 }
3010 else
3011 {
3012 // Couldn't find an index allocation
3013 IndexAllocationContext = NULL;
3014 }
3015
3016
3017 // Loop through all Index Entries of index, starting with FirstEntry
3018 IndexEntry = FirstEntry;
3019 while (IndexEntry <= LastEntry)
3020 {
3021 // Does IndexEntry have a sub-node?
3022 if (IndexEntry->Flags & NTFS_INDEX_ENTRY_NODE)
3023 {
3024 if (!(IndexRecord->Header.Flags & INDEX_ROOT_LARGE) || !IndexAllocationContext)
3025 {
3026 DPRINT1("Filesystem corruption detected!\n");
3027 }
3028 else
3029 {
3030 Status = BrowseSubNodeIndexEntries(Vcb,
3031 MftRecord,
3032 IndexBlockSize,
3033 FileName,
3034 IndexAllocationContext,
3035 &Bitmap,
3036 GetIndexEntryVCN(IndexEntry),
3037 StartEntry,
3038 CurrentEntry,
3039 DirSearch,
3040 CaseSensitive,
3041 OutMFTIndex);
3042 if (NT_SUCCESS(Status))
3043 {
3044 ExFreePoolWithTag(BitmapMem, TAG_NTFS);
3045 ReleaseAttributeContext(BitmapContext);
3046 ReleaseAttributeContext(IndexAllocationContext);
3047 return Status;
3048 }
3049 }
3050 }
3051
3052 // Are we done?
3053 if (IndexEntry->Flags & NTFS_INDEX_ENTRY_END)
3054 break;
3055
3056 // If we've found a file whose index is greater than or equal to StartEntry that matches the search criteria
3057 if ((IndexEntry->Data.Directory.IndexedFile & NTFS_MFT_MASK) >= NTFS_FILE_FIRST_USER_FILE &&
3058 *CurrentEntry >= *StartEntry &&
3059 IndexEntry->FileName.NameType != NTFS_FILE_NAME_DOS &&
3060 CompareFileName(FileName, IndexEntry, DirSearch, CaseSensitive))
3061 {
3062 *StartEntry = *CurrentEntry;
3063 *OutMFTIndex = (IndexEntry->Data.Directory.IndexedFile & NTFS_MFT_MASK);
3064 if (IndexAllocationContext)
3065 {
3066 ExFreePoolWithTag(BitmapMem, TAG_NTFS);
3067 ReleaseAttributeContext(BitmapContext);
3068 ReleaseAttributeContext(IndexAllocationContext);
3069 }
3070 return STATUS_SUCCESS;
3071 }
3072
3073 // Advance to the next index entry
3074 (*CurrentEntry) += 1;
3075 ASSERT(IndexEntry->Length >= sizeof(INDEX_ENTRY_ATTRIBUTE));
3076 IndexEntry = (PINDEX_ENTRY_ATTRIBUTE)((PCHAR)IndexEntry + IndexEntry->Length);
3077 }
3078
3079 if (IndexAllocationContext)
3080 {
3081 ExFreePoolWithTag(BitmapMem, TAG_NTFS);
3082 ReleaseAttributeContext(BitmapContext);
3083 ReleaseAttributeContext(IndexAllocationContext);
3084 }
3085
3086 return STATUS_OBJECT_PATH_NOT_FOUND;
3087 }
3088
3089 NTSTATUS
3090 NtfsFindMftRecord(PDEVICE_EXTENSION Vcb,
3091 ULONGLONG MFTIndex,
3092 PUNICODE_STRING FileName,
3093 PULONG FirstEntry,
3094 BOOLEAN DirSearch,
3095 BOOLEAN CaseSensitive,
3096 ULONGLONG *OutMFTIndex)
3097 {
3098 PFILE_RECORD_HEADER MftRecord;
3099 PNTFS_ATTR_CONTEXT IndexRootCtx;
3100 PINDEX_ROOT_ATTRIBUTE IndexRoot;
3101 PCHAR IndexRecord;
3102 PINDEX_ENTRY_ATTRIBUTE IndexEntry, IndexEntryEnd;
3103 NTSTATUS Status;
3104 ULONG CurrentEntry = 0;
3105
3106 DPRINT("NtfsFindMftRecord(%p, %I64d, %wZ, %lu, %s, %s, %p)\n",
3107 Vcb,
3108 MFTIndex,
3109 FileName,
3110 *FirstEntry,
3111 DirSearch ? "TRUE" : "FALSE",
3112 CaseSensitive ? "TRUE" : "FALSE",
3113 OutMFTIndex);
3114
3115 MftRecord = ExAllocateFromNPagedLookasideList(&Vcb->FileRecLookasideList);
3116 if (MftRecord == NULL)
3117 {
3118 return STATUS_INSUFFICIENT_RESOURCES;
3119 }
3120
3121 Status = ReadFileRecord(Vcb, MFTIndex, MftRecord);
3122 if (!NT_SUCCESS(Status))
3123 {
3124 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, MftRecord);
3125 return Status;
3126 }
3127
3128 ASSERT(MftRecord->Ntfs.Type == NRH_FILE_TYPE);
3129 Status = FindAttribute(Vcb, MftRecord, AttributeIndexRoot, L"$I30", 4, &IndexRootCtx, NULL);
3130 if (!NT_SUCCESS(Status))
3131 {
3132 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, MftRecord);
3133 return Status;
3134 }
3135
3136 IndexRecord = ExAllocatePoolWithTag(NonPagedPool, Vcb->NtfsInfo.BytesPerIndexRecord, TAG_NTFS);
3137 if (IndexRecord == NULL)
3138 {
3139 ReleaseAttributeContext(IndexRootCtx);
3140 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, MftRecord);
3141 return STATUS_INSUFFICIENT_RESOURCES;
3142 }
3143
3144 ReadAttribute(Vcb, IndexRootCtx, 0, IndexRecord, Vcb->NtfsInfo.BytesPerIndexRecord);
3145 IndexRoot = (PINDEX_ROOT_ATTRIBUTE)IndexRecord;
3146 IndexEntry = (PINDEX_ENTRY_ATTRIBUTE)((PCHAR)&IndexRoot->Header + IndexRoot->Header.FirstEntryOffset);
3147 /* Index root is always resident. */
3148 IndexEntryEnd = (PINDEX_ENTRY_ATTRIBUTE)(IndexRecord + IndexRoot->Header.TotalSizeOfEntries);
3149 ReleaseAttributeContext(IndexRootCtx);
3150
3151 DPRINT("IndexRecordSize: %x IndexBlockSize: %x\n", Vcb->NtfsInfo.BytesPerIndexRecord, IndexRoot->SizeOfEntry);
3152
3153 Status = BrowseIndexEntries(Vcb,
3154 MftRecord,
3155 (PINDEX_ROOT_ATTRIBUTE)IndexRecord,
3156 IndexRoot->SizeOfEntry,
3157 IndexEntry,
3158 IndexEntryEnd,
3159 FileName,
3160 FirstEntry,
3161 &CurrentEntry,
3162 DirSearch,
3163 CaseSensitive,
3164 OutMFTIndex);
3165
3166 ExFreePoolWithTag(IndexRecord, TAG_NTFS);
3167 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, MftRecord);
3168
3169 return Status;
3170 }
3171
3172 NTSTATUS
3173 NtfsLookupFileAt(PDEVICE_EXTENSION Vcb,
3174 PUNICODE_STRING PathName,
3175 BOOLEAN CaseSensitive,
3176 PFILE_RECORD_HEADER *FileRecord,
3177 PULONGLONG MFTIndex,
3178 ULONGLONG CurrentMFTIndex)
3179 {
3180 UNICODE_STRING Current, Remaining;
3181 NTSTATUS Status;
3182 ULONG FirstEntry = 0;
3183
3184 DPRINT("NtfsLookupFileAt(%p, %wZ, %s, %p, %p, %I64x)\n",
3185 Vcb,
3186 PathName,
3187 CaseSensitive ? "TRUE" : "FALSE",
3188 FileRecord,
3189 MFTIndex,
3190 CurrentMFTIndex);
3191
3192 FsRtlDissectName(*PathName, &Current, &Remaining);
3193
3194 while (Current.Length != 0)
3195 {
3196 DPRINT("Current: %wZ\n", &Current);
3197
3198 Status = NtfsFindMftRecord(Vcb, CurrentMFTIndex, &Current, &FirstEntry, FALSE, CaseSensitive, &CurrentMFTIndex);
3199 if (!NT_SUCCESS(Status))
3200 {
3201 return Status;
3202 }
3203
3204 if (Remaining.Length == 0)
3205 break;
3206
3207 FsRtlDissectName(Current, &Current, &Remaining);
3208 }
3209
3210 *FileRecord = ExAllocateFromNPagedLookasideList(&Vcb->FileRecLookasideList);
3211 if (*FileRecord == NULL)
3212 {
3213 DPRINT("NtfsLookupFileAt: Can't allocate MFT record\n");
3214 return STATUS_INSUFFICIENT_RESOURCES;
3215 }
3216
3217 Status = ReadFileRecord(Vcb, CurrentMFTIndex, *FileRecord);
3218 if (!NT_SUCCESS(Status))
3219 {
3220 DPRINT("NtfsLookupFileAt: Can't read MFT record\n");
3221 ExFreeToNPagedLookasideList(&Vcb->FileRecLookasideList, *FileRecord);
3222 return Status;
3223 }
3224
3225 *MFTIndex = CurrentMFTIndex;
3226
3227 return STATUS_SUCCESS;
3228 }
3229
3230 NTSTATUS
3231 NtfsLookupFile(PDEVICE_EXTENSION Vcb,
3232 PUNICODE_STRING PathName,
3233 BOOLEAN CaseSensitive,
3234 PFILE_RECORD_HEADER *FileRecord,
3235 PULONGLONG MFTIndex)
3236 {
3237 return NtfsLookupFileAt(Vcb, PathName, CaseSensitive, FileRecord, MFTIndex, NTFS_FILE_ROOT);
3238 }
3239
3240 void
3241 NtfsDumpData(ULONG_PTR Buffer, ULONG Length)
3242 {
3243 ULONG i, j;
3244
3245 // dump binary data, 8 bytes at a time
3246 for (i = 0; i < Length; i += 8)
3247 {
3248 // display current offset, in hex
3249 DbgPrint("\t%03x\t", i);
3250
3251 // display hex value of each of the next 8 bytes
3252 for (j = 0; j < 8; j++)
3253 DbgPrint("%02x ", *(PUCHAR)(Buffer + i