drivers/filesystems/ntfs/mft.c

   1 /*
   2  *  ReactOS kernel
   3  *  Copyright (C) 2002, 2014 ReactOS Team
   4  *
   5  *  This program is free software; you can redistribute it and/or modify
   6  *  it under the terms of the GNU General Public License as published by
   7  *  the Free Software Foundation; either version 2 of the License, or
   8  *  (at your option) any later version.
   9  *
  10  *  This program is distributed in the hope that it will be useful,
  11  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  *  GNU General Public License for more details.
  14  *
  15  *  You should have received a copy of the GNU General Public License
  16  *  along with this program; if not, write to the Free Software
  17  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.
  18  *
  19  * COPYRIGHT:        See COPYING in the top level directory
  20  * PROJECT:          ReactOS kernel
  21  * FILE:             drivers/filesystem/ntfs/mft.c
  22  * PURPOSE:          NTFS filesystem driver
  23  * PROGRAMMERS:      Eric Kohl
  24  *                   Valentin Verkhovsky
  25  *                   Pierre Schweitzer (pierre@reactos.org)
  26  *                   Hervé Poussineau (hpoussin@reactos.org)
  27  */
  28
  29 /* INCLUDES *****************************************************************/
  30
  31 #include "ntfs.h"
  32
  33 #define NDEBUG
  34 #include <debug.h>
  35
  36 /* FUNCTIONS ****************************************************************/
  37
  38 PNTFS_ATTR_CONTEXT
  39 PrepareAttributeContext(PNTFS_ATTR_RECORD AttrRecord)
  40 {
  41     PNTFS_ATTR_CONTEXT Context;
  42
  43     Context = ExAllocatePoolWithTag(NonPagedPool,
  44                                     FIELD_OFFSET(NTFS_ATTR_CONTEXT, Record) + AttrRecord->Length,
  45                                     TAG_NTFS);
  46     RtlCopyMemory(&Context->Record, AttrRecord, AttrRecord->Length);
  47     if (AttrRecord->IsNonResident)
  48     {
  49         LONGLONG DataRunOffset;
  50         ULONGLONG DataRunLength;
  51
  52         Context->CacheRun = (PUCHAR)&Context->Record + Context->Record.NonResident.MappingPairsOffset;
  53         Context->CacheRunOffset = 0;
  54         Context->CacheRun = DecodeRun(Context->CacheRun, &DataRunOffset, &DataRunLength);
  55         Context->CacheRunLength = DataRunLength;
  56         if (DataRunOffset != -1)
  57         {
  58             /* Normal run. */
  59             Context->CacheRunStartLCN =
  60             Context->CacheRunLastLCN = DataRunOffset;
  61         }
  62         else
  63         {
  64             /* Sparse run. */
  65             Context->CacheRunStartLCN = -1;
  66             Context->CacheRunLastLCN = 0;
  67         }
  68         Context->CacheRunCurrentOffset = 0;
  69     }
  70
  71     return Context;
  72 }
  73
  74
  75 VOID
  76 ReleaseAttributeContext(PNTFS_ATTR_CONTEXT Context)
  77 {
  78     ExFreePoolWithTag(Context, TAG_NTFS);
  79 }
  80
  81
  82 PNTFS_ATTR_CONTEXT
  83 FindAttributeHelper(PDEVICE_EXTENSION Vcb,
  84                     PNTFS_ATTR_RECORD AttrRecord,
  85                     PNTFS_ATTR_RECORD AttrRecordEnd,
  86                     ULONG Type,
  87                     PCWSTR Name,
  88                     ULONG NameLength)
  89 {
  90     DPRINT("FindAttributeHelper(%p, %p, %p, 0x%x, %S, %u)\n", Vcb, AttrRecord, AttrRecordEnd, Type, Name, NameLength);
  91
  92     while (AttrRecord < AttrRecordEnd)
  93     {
  94         DPRINT("AttrRecord->Type = 0x%x\n", AttrRecord->Type);
  95
  96         if (AttrRecord->Type == AttributeEnd)
  97             break;
  98
  99         if (AttrRecord->Type == AttributeAttributeList)
 100         {
 101             PNTFS_ATTR_CONTEXT Context;
 102             PNTFS_ATTR_CONTEXT ListContext;
 103             PVOID ListBuffer;
 104             ULONGLONG ListSize;
 105             PNTFS_ATTR_RECORD ListAttrRecord;
 106             PNTFS_ATTR_RECORD ListAttrRecordEnd;
 107
 108             ListContext = PrepareAttributeContext(AttrRecord);
 109
 110             ListSize = AttributeDataLength(&ListContext->Record);
 111             if(ListSize <= 0xFFFFFFFF)
 112                 ListBuffer = ExAllocatePoolWithTag(NonPagedPool, (ULONG)ListSize, TAG_NTFS);
 113             else
 114                 ListBuffer = NULL;
 115
 116             if(!ListBuffer)
 117             {
 118                 DPRINT("Failed to allocate memory: %x\n", (ULONG)ListSize);
 119                 continue;
 120             }
 121
 122             ListAttrRecord = (PNTFS_ATTR_RECORD)ListBuffer;
 123             ListAttrRecordEnd = (PNTFS_ATTR_RECORD)((PCHAR)ListBuffer + ListSize);
 124
 125             if (ReadAttribute(Vcb, ListContext, 0, ListBuffer, (ULONG)ListSize) == ListSize)
 126             {
 127                 Context = FindAttributeHelper(Vcb, ListAttrRecord, ListAttrRecordEnd,
 128                                               Type, Name, NameLength);
 129
 130                 ReleaseAttributeContext(ListContext);
 131                 ExFreePoolWithTag(ListBuffer, TAG_NTFS);
 132
 133                 if (Context != NULL)
 134                 {
 135                     if (AttrRecord->IsNonResident) DPRINT("Found context = %p\n", Context);
 136                     return Context;
 137                 }
 138             }
 139         }
 140
 141         if (AttrRecord->Type == Type)
 142         {
 143             if (AttrRecord->NameLength == NameLength)
 144             {
 145                 PWCHAR AttrName;
 146
 147                 AttrName = (PWCHAR)((PCHAR)AttrRecord + AttrRecord->NameOffset);
 148                 DPRINT("%.*S, %.*S\n", AttrRecord->NameLength, AttrName, NameLength, Name);
 149                 if (RtlCompareMemory(AttrName, Name, NameLength << 1) == (NameLength << 1))
 150                 {
 151                     /* Found it, fill up the context and return. */
 152                     DPRINT("Found context\n");
 153                     return PrepareAttributeContext(AttrRecord);
 154                 }
 155             }
 156         }
 157
 158         if (AttrRecord->Length == 0)
 159         {
 160             DPRINT("Null length attribute record\n");
 161             return NULL;
 162         }
 163         AttrRecord = (PNTFS_ATTR_RECORD)((PCHAR)AttrRecord + AttrRecord->Length);
 164     }
 165
 166     DPRINT("Ended\n");
 167     return NULL;
 168 }
 169
 170
 171 NTSTATUS
 172 FindAttribute(PDEVICE_EXTENSION Vcb,
 173               PFILE_RECORD_HEADER MftRecord,
 174               ULONG Type,
 175               PCWSTR Name,
 176               ULONG NameLength,
 177               PNTFS_ATTR_CONTEXT * AttrCtx)
 178 {
 179     PNTFS_ATTR_RECORD AttrRecord;
 180     PNTFS_ATTR_RECORD AttrRecordEnd;
 181
 182     DPRINT("FindAttribute(%p, %p, 0x%x, %S, %u, %p)\n", Vcb, MftRecord, Type, Name, NameLength, AttrCtx);
 183
 184     AttrRecord = (PNTFS_ATTR_RECORD)((PCHAR)MftRecord + MftRecord->AttributeOffset);
 185     AttrRecordEnd = (PNTFS_ATTR_RECORD)((PCHAR)MftRecord + Vcb->NtfsInfo.BytesPerFileRecord);
 186
 187     *AttrCtx = FindAttributeHelper(Vcb, AttrRecord, AttrRecordEnd, Type, Name, NameLength);
 188     if (*AttrCtx == NULL)
 189     {
 190         return STATUS_OBJECT_NAME_NOT_FOUND;
 191     }
 192
 193     return STATUS_SUCCESS;
 194 }
 195
 196
 197 ULONG
 198 AttributeAllocatedLength(PNTFS_ATTR_RECORD AttrRecord)
 199 {
 200     if (AttrRecord->IsNonResident)
 201         return AttrRecord->NonResident.AllocatedSize;
 202     else
 203         return AttrRecord->Resident.ValueLength;
 204 }
 205
 206
 207 ULONGLONG
 208 AttributeDataLength(PNTFS_ATTR_RECORD AttrRecord)
 209 {
 210     if (AttrRecord->IsNonResident)
 211         return AttrRecord->NonResident.DataSize;
 212     else
 213         return AttrRecord->Resident.ValueLength;
 214 }
 215
 216
 217 ULONG
 218 ReadAttribute(PDEVICE_EXTENSION Vcb,
 219               PNTFS_ATTR_CONTEXT Context,
 220               ULONGLONG Offset,
 221               PCHAR Buffer,
 222               ULONG Length)
 223 {
 224     ULONGLONG LastLCN;
 225     PUCHAR DataRun;
 226     LONGLONG DataRunOffset;
 227     ULONGLONG DataRunLength;
 228     LONGLONG DataRunStartLCN;
 229     ULONGLONG CurrentOffset;
 230     ULONG ReadLength;
 231     ULONG AlreadyRead;
 232     NTSTATUS Status;
 233
 234     if (!Context->Record.IsNonResident)
 235     {
 236         if (Offset > Context->Record.Resident.ValueLength)
 237             return 0;
 238         if (Offset + Length > Context->Record.Resident.ValueLength)
 239             Length = (ULONG)(Context->Record.Resident.ValueLength - Offset);
 240         RtlCopyMemory(Buffer, (PCHAR)&Context->Record + Context->Record.Resident.ValueOffset + Offset, Length);
 241         return Length;
 242     }
 243
 244     /*
 245      * Non-resident attribute
 246      */
 247
 248     /*
 249      * I. Find the corresponding start data run.
 250      */
 251
 252     AlreadyRead = 0;
 253
 254     // FIXME: Cache seems to be non-working. Disable it for now
 255     //if(Context->CacheRunOffset <= Offset && Offset < Context->CacheRunOffset + Context->CacheRunLength * Volume->ClusterSize)
 256     if (0)
 257     {
 258         DataRun = Context->CacheRun;
 259         LastLCN = Context->CacheRunLastLCN;
 260         DataRunStartLCN = Context->CacheRunStartLCN;
 261         DataRunLength = Context->CacheRunLength;
 262         CurrentOffset = Context->CacheRunCurrentOffset;
 263     }
 264     else
 265     {
 266         LastLCN = 0;
 267         DataRun = (PUCHAR)&Context->Record + Context->Record.NonResident.MappingPairsOffset;
 268         CurrentOffset = 0;
 269
 270         while (1)
 271         {
 272             DataRun = DecodeRun(DataRun, &DataRunOffset, &DataRunLength);
 273             if (DataRunOffset != -1)
 274             {
 275                 /* Normal data run. */
 276                 DataRunStartLCN = LastLCN + DataRunOffset;
 277                 LastLCN = DataRunStartLCN;
 278             }
 279             else
 280             {
 281                 /* Sparse data run. */
 282                 DataRunStartLCN = -1;
 283             }
 284
 285             if (Offset >= CurrentOffset &&
 286                 Offset < CurrentOffset + (DataRunLength * Vcb->NtfsInfo.BytesPerCluster))
 287             {
 288                 break;
 289             }
 290
 291             if (*DataRun == 0)
 292             {
 293                 return AlreadyRead;
 294             }
 295
 296             CurrentOffset += DataRunLength * Vcb->NtfsInfo.BytesPerCluster;
 297         }
 298     }
 299
 300     /*
 301      * II. Go through the run list and read the data
 302      */
 303
 304     ReadLength = (ULONG)min(DataRunLength * Vcb->NtfsInfo.BytesPerCluster - (Offset - CurrentOffset), Length);
 305     if (DataRunStartLCN == -1)
 306         RtlZeroMemory(Buffer, ReadLength);
 307     Status = NtfsReadDisk(Vcb->StorageDevice,
 308                           DataRunStartLCN * Vcb->NtfsInfo.BytesPerCluster + Offset - CurrentOffset,
 309                           ReadLength,
 310                           Vcb->NtfsInfo.BytesPerSector,
 311                           (PVOID)Buffer,
 312                           FALSE);
 313     if (NT_SUCCESS(Status))
 314     {
 315         Length -= ReadLength;
 316         Buffer += ReadLength;
 317         AlreadyRead += ReadLength;
 318
 319         if (ReadLength == DataRunLength * Vcb->NtfsInfo.BytesPerCluster - (Offset - CurrentOffset))
 320         {
 321             CurrentOffset += DataRunLength * Vcb->NtfsInfo.BytesPerCluster;
 322             DataRun = DecodeRun(DataRun, &DataRunOffset, &DataRunLength);
 323             if (DataRunLength != (ULONGLONG)-1)
 324             {
 325                 DataRunStartLCN = LastLCN + DataRunOffset;
 326                 LastLCN = DataRunStartLCN;
 327             }
 328             else
 329                 DataRunStartLCN = -1;
 330
 331             if (*DataRun == 0)
 332                 return AlreadyRead;
 333         }
 334
 335         while (Length > 0)
 336         {
 337             ReadLength = (ULONG)min(DataRunLength * Vcb->NtfsInfo.BytesPerCluster, Length);
 338             if (DataRunStartLCN == -1)
 339                 RtlZeroMemory(Buffer, ReadLength);
 340             else
 341             {
 342                 Status = NtfsReadDisk(Vcb->StorageDevice,
 343                                       DataRunStartLCN * Vcb->NtfsInfo.BytesPerCluster,
 344                                       ReadLength,
 345                                       Vcb->NtfsInfo.BytesPerSector,
 346                                       (PVOID)Buffer,
 347                                       FALSE);
 348                 if (!NT_SUCCESS(Status))
 349                     break;
 350             }
 351
 352             Length -= ReadLength;
 353             Buffer += ReadLength;
 354             AlreadyRead += ReadLength;
 355
 356             /* We finished this request, but there still data in this data run. */
 357             if (Length == 0 && ReadLength != DataRunLength * Vcb->NtfsInfo.BytesPerCluster)
 358                 break;
 359
 360             /*
 361              * Go to next run in the list.
 362              */
 363
 364             if (*DataRun == 0)
 365                 break;
 366             CurrentOffset += DataRunLength * Vcb->NtfsInfo.BytesPerCluster;
 367             DataRun = DecodeRun(DataRun, &DataRunOffset, &DataRunLength);
 368             if (DataRunOffset != -1)
 369             {
 370                 /* Normal data run. */
 371                 DataRunStartLCN = LastLCN + DataRunOffset;
 372                 LastLCN = DataRunStartLCN;
 373             }
 374             else
 375             {
 376                 /* Sparse data run. */
 377                 DataRunStartLCN = -1;
 378             }
 379         } /* while */
 380
 381     } /* if Disk */
 382
 383     Context->CacheRun = DataRun;
 384     Context->CacheRunOffset = Offset + AlreadyRead;
 385     Context->CacheRunStartLCN = DataRunStartLCN;
 386     Context->CacheRunLength = DataRunLength;
 387     Context->CacheRunLastLCN = LastLCN;
 388     Context->CacheRunCurrentOffset = CurrentOffset;
 389
 390     return AlreadyRead;
 391 }
 392
 393
 394 NTSTATUS
 395 ReadFileRecord(PDEVICE_EXTENSION Vcb,
 396                ULONGLONG index,
 397                PFILE_RECORD_HEADER file)
 398 {
 399     ULONGLONG BytesRead;
 400
 401     DPRINT("ReadFileRecord(%p, %I64x, %p)\n", Vcb, index, file);
 402
 403     BytesRead = ReadAttribute(Vcb, Vcb->MFTContext, index * Vcb->NtfsInfo.BytesPerFileRecord, (PCHAR)file, Vcb->NtfsInfo.BytesPerFileRecord);
 404     if (BytesRead != Vcb->NtfsInfo.BytesPerFileRecord)
 405     {
 406         DPRINT1("ReadFileRecord failed: %I64u read, %u expected\n", BytesRead, Vcb->NtfsInfo.BytesPerFileRecord);
 407         return STATUS_PARTIAL_COPY;
 408     }
 409
 410     /* Apply update sequence array fixups. */
 411     return FixupUpdateSequenceArray(Vcb, &file->Ntfs);
 412 }
 413
 414
 415 NTSTATUS
 416 FixupUpdateSequenceArray(PDEVICE_EXTENSION Vcb,
 417                          PNTFS_RECORD_HEADER Record)
 418 {
 419     USHORT *USA;
 420     USHORT USANumber;
 421     USHORT USACount;
 422     USHORT *Block;
 423
 424     USA = (USHORT*)((PCHAR)Record + Record->UsaOffset);
 425     USANumber = *(USA++);
 426     USACount = Record->UsaCount - 1; /* Exclude the USA Number. */
 427     Block = (USHORT*)((PCHAR)Record + Vcb->NtfsInfo.BytesPerSector - 2);
 428
 429     while (USACount)
 430     {
 431         if (*Block != USANumber)
 432         {
 433             DPRINT1("Mismatch with USA: %u read, %u expected\n" , *Block, USANumber);
 434             return STATUS_UNSUCCESSFUL;
 435         }
 436         *Block = *(USA++);
 437         Block = (USHORT*)((PCHAR)Block + Vcb->NtfsInfo.BytesPerSector);
 438         USACount--;
 439     }
 440
 441     return STATUS_SUCCESS;
 442 }
 443
 444
 445 NTSTATUS
 446 ReadLCN(PDEVICE_EXTENSION Vcb,
 447         ULONGLONG lcn,
 448         ULONG count,
 449         PVOID buffer)
 450 {
 451     LARGE_INTEGER DiskSector;
 452
 453     DiskSector.QuadPart = lcn;
 454
 455     return NtfsReadSectors(Vcb->StorageDevice,
 456                            DiskSector.u.LowPart * Vcb->NtfsInfo.SectorsPerCluster,
 457                            count * Vcb->NtfsInfo.SectorsPerCluster,
 458                            Vcb->NtfsInfo.BytesPerSector,
 459                            buffer,
 460                            FALSE);
 461 }
 462
 463
 464 BOOLEAN
 465 CompareFileName(PUNICODE_STRING FileName,
 466                 PINDEX_ENTRY_ATTRIBUTE IndexEntry,
 467                 BOOLEAN DirSearch)
 468 {
 469     UNICODE_STRING EntryName;
 470
 471     EntryName.Buffer = IndexEntry->FileName.Name;
 472     EntryName.Length =
 473     EntryName.MaximumLength = IndexEntry->FileName.NameLength * sizeof(WCHAR);
 474
 475     if (DirSearch)
 476     {
 477         return FsRtlIsNameInExpression(FileName, &EntryName, (IndexEntry->FileName.NameType != NTFS_FILE_NAME_POSIX), NULL);
 478     }
 479     else
 480     {
 481         return (RtlCompareUnicodeString(FileName, &EntryName, (IndexEntry->FileName.NameType != NTFS_FILE_NAME_POSIX)) == 0);
 482     }
 483 }
 484
 485
 486 NTSTATUS
 487 NtfsFindMftRecord(PDEVICE_EXTENSION Vcb,
 488                   ULONGLONG MFTIndex,
 489                   PUNICODE_STRING FileName,
 490                   PULONG FirstEntry,
 491                   BOOLEAN DirSearch,
 492                   ULONGLONG *OutMFTIndex)
 493 {
 494     PFILE_RECORD_HEADER MftRecord;
 495     PNTFS_ATTR_CONTEXT IndexRootCtx;
 496     PNTFS_ATTR_CONTEXT IndexBitmapCtx;
 497     PNTFS_ATTR_CONTEXT IndexAllocationCtx;
 498     PINDEX_ROOT_ATTRIBUTE IndexRoot;
 499     PINDEX_BUFFER IndexBuffer;
 500     ULONGLONG BitmapDataSize;
 501     ULONGLONG IndexAllocationSize;
 502     PCHAR BitmapData;
 503     PCHAR IndexRecord;
 504     PINDEX_ENTRY_ATTRIBUTE IndexEntry, IndexEntryEnd;
 505     ULONG RecordOffset;
 506     ULONG IndexBlockSize;
 507     NTSTATUS Status;
 508     ULONG CurrentEntry = 0;
 509
 510     DPRINT("NtfsFindMftRecord(%p, %I64d, %wZ, %p, %u, %p)\n", Vcb, MFTIndex, FileName, FirstEntry, DirSearch, OutMFTIndex);
 511
 512     MftRecord = ExAllocatePoolWithTag(NonPagedPool,
 513                                       Vcb->NtfsInfo.BytesPerFileRecord,
 514                                       TAG_NTFS);
 515     if (MftRecord == NULL)
 516     {
 517         return STATUS_INSUFFICIENT_RESOURCES;
 518     }
 519
 520     if (NT_SUCCESS(ReadFileRecord(Vcb, MFTIndex, MftRecord)))
 521     {
 522         ASSERT(MftRecord->Ntfs.Type == NRH_FILE_TYPE);
 523
 524         Status = FindAttribute(Vcb, MftRecord, AttributeIndexRoot, L"$I30", 4, &IndexRootCtx);
 525         if (!NT_SUCCESS(Status))
 526         {
 527             ExFreePoolWithTag(MftRecord, TAG_NTFS);
 528             return Status;
 529         }
 530
 531         IndexRecord = ExAllocatePoolWithTag(NonPagedPool, Vcb->NtfsInfo.BytesPerIndexRecord, TAG_NTFS);
 532         if (IndexRecord == NULL)
 533         {
 534             ExFreePoolWithTag(MftRecord, TAG_NTFS);
 535             return STATUS_INSUFFICIENT_RESOURCES;
 536         }
 537
 538         ReadAttribute(Vcb, IndexRootCtx, 0, IndexRecord, Vcb->NtfsInfo.BytesPerIndexRecord);
 539         IndexRoot = (PINDEX_ROOT_ATTRIBUTE)IndexRecord;
 540         IndexEntry = (PINDEX_ENTRY_ATTRIBUTE)((PCHAR)&IndexRoot->Header + IndexRoot->Header.FirstEntryOffset);
 541         /* Index root is always resident. */
 542         IndexEntryEnd = (PINDEX_ENTRY_ATTRIBUTE)(IndexRecord + IndexRootCtx->Record.Resident.ValueLength);
 543         ReleaseAttributeContext(IndexRootCtx);
 544
 545         DPRINT("IndexRecordSize: %x IndexBlockSize: %x\n", Vcb->NtfsInfo.BytesPerIndexRecord, IndexRoot->SizeOfEntry);
 546
 547         while (IndexEntry < IndexEntryEnd &&
 548                !(IndexEntry->Flags & NTFS_INDEX_ENTRY_END))
 549         {
 550             if ((IndexEntry->Data.Directory.IndexedFile & NTFS_MFT_MASK) > 0x10 &&
 551                 CurrentEntry >= *FirstEntry &&
 552                 CompareFileName(FileName, IndexEntry, DirSearch))
 553             {
 554                 *OutMFTIndex = (IndexEntry->Data.Directory.IndexedFile & NTFS_MFT_MASK);
 555                 *FirstEntry = CurrentEntry;
 556                 ExFreePoolWithTag(IndexRecord, TAG_NTFS);
 557                 ExFreePoolWithTag(MftRecord, TAG_NTFS);
 558                 return STATUS_SUCCESS;
 559             }
 560
 561             ++CurrentEntry;
 562             IndexEntry = (PINDEX_ENTRY_ATTRIBUTE)((PCHAR)IndexEntry + IndexEntry->Length);
 563         }
 564
 565         if (IndexRoot->Header.Flags & INDEX_ROOT_LARGE)
 566         {
 567             DPRINT("Large Index!\n");
 568
 569             IndexBlockSize = IndexRoot->SizeOfEntry;
 570
 571             Status = FindAttribute(Vcb, MftRecord, AttributeBitmap, L"$I30", 4, &IndexBitmapCtx);
 572             if (!NT_SUCCESS(Status))
 573             {
 574                 DPRINT1("Corrupted filesystem!\n");
 575                 ExFreePoolWithTag(MftRecord, TAG_NTFS);
 576                 return Status;
 577             }
 578             BitmapDataSize = AttributeDataLength(&IndexBitmapCtx->Record);
 579             DPRINT("BitmapDataSize: %x\n", (ULONG)BitmapDataSize);
 580             if(BitmapDataSize <= 0xFFFFFFFF)
 581                 BitmapData = ExAllocatePoolWithTag(NonPagedPool, (ULONG)BitmapDataSize, TAG_NTFS);
 582             else
 583                 BitmapData = NULL;
 584
 585             if (BitmapData == NULL)
 586             {
 587                 ExFreePoolWithTag(IndexRecord, TAG_NTFS);
 588                 ExFreePoolWithTag(MftRecord, TAG_NTFS);
 589                 return STATUS_INSUFFICIENT_RESOURCES;
 590             }
 591             ReadAttribute(Vcb, IndexBitmapCtx, 0, BitmapData, (ULONG)BitmapDataSize);
 592             ReleaseAttributeContext(IndexBitmapCtx);
 593
 594             Status = FindAttribute(Vcb, MftRecord, AttributeIndexAllocation, L"$I30", 4, &IndexAllocationCtx);
 595             if (!NT_SUCCESS(Status))
 596             {
 597                 DPRINT("Corrupted filesystem!\n");
 598                 ExFreePoolWithTag(BitmapData, TAG_NTFS);
 599                 ExFreePoolWithTag(IndexRecord, TAG_NTFS);
 600                 ExFreePoolWithTag(MftRecord, TAG_NTFS);
 601                 return Status;
 602             }
 603             IndexAllocationSize = AttributeDataLength(&IndexAllocationCtx->Record);
 604
 605             RecordOffset = 0;
 606
 607             for (;;)
 608             {
 609                 DPRINT("RecordOffset: %x IndexAllocationSize: %x\n", RecordOffset, IndexAllocationSize);
 610                 for (; RecordOffset < IndexAllocationSize;)
 611                 {
 612                     UCHAR Bit = 1 << ((RecordOffset / IndexBlockSize) & 7);
 613                     ULONG Byte = (RecordOffset / IndexBlockSize) >> 3;
 614                     if ((BitmapData[Byte] & Bit))
 615                         break;
 616                     RecordOffset += IndexBlockSize;
 617                 }
 618
 619                 if (RecordOffset >= IndexAllocationSize)
 620                 {
 621                     break;
 622                 }
 623
 624                 ReadAttribute(Vcb, IndexAllocationCtx, RecordOffset, IndexRecord, IndexBlockSize);
 625
 626                 if (!NT_SUCCESS(FixupUpdateSequenceArray(Vcb, &((PFILE_RECORD_HEADER)IndexRecord)->Ntfs)))
 627                 {
 628                     break;
 629                 }
 630
 631                 IndexBuffer = (PINDEX_BUFFER)IndexRecord;
 632                 ASSERT(IndexBuffer->Ntfs.Type == NRH_INDX_TYPE);
 633                 ASSERT(IndexBuffer->Header.AllocatedSize + 0x18 == IndexBlockSize);
 634                 IndexEntry = (PINDEX_ENTRY_ATTRIBUTE)((ULONG_PTR)&IndexBuffer->Header + IndexBuffer->Header.FirstEntryOffset);
 635                 IndexEntryEnd = (PINDEX_ENTRY_ATTRIBUTE)((ULONG_PTR)&IndexBuffer->Header + IndexBuffer->Header.TotalSizeOfEntries);
 636                 ASSERT(IndexEntryEnd <= (PINDEX_ENTRY_ATTRIBUTE)((ULONG_PTR)IndexBuffer + IndexBlockSize));
 637
 638                 while (IndexEntry < IndexEntryEnd &&
 639                        !(IndexEntry->Flags & NTFS_INDEX_ENTRY_END))
 640                 {
 641                     if ((IndexEntry->Data.Directory.IndexedFile & NTFS_MFT_MASK) > 0x10 &&
 642                         CurrentEntry >= *FirstEntry &&
 643                         CompareFileName(FileName, IndexEntry, DirSearch))
 644                     {
 645                         DPRINT("File found\n");
 646                         *OutMFTIndex = (IndexEntry->Data.Directory.IndexedFile & NTFS_MFT_MASK);
 647                         *FirstEntry = CurrentEntry;
 648                         ExFreePoolWithTag(BitmapData, TAG_NTFS);
 649                         ExFreePoolWithTag(IndexRecord, TAG_NTFS);
 650                         ExFreePoolWithTag(MftRecord, TAG_NTFS);
 651                         ReleaseAttributeContext(IndexAllocationCtx);
 652                         return STATUS_SUCCESS;
 653                     }
 654
 655                     ++CurrentEntry;
 656                     ASSERT(IndexEntry->Length >= sizeof(INDEX_ENTRY_ATTRIBUTE));
 657                     IndexEntry = (PINDEX_ENTRY_ATTRIBUTE)((PCHAR)IndexEntry + IndexEntry->Length);
 658                 }
 659
 660                 RecordOffset += IndexBlockSize;
 661             }
 662
 663             ReleaseAttributeContext(IndexAllocationCtx);
 664             ExFreePoolWithTag(BitmapData, TAG_NTFS);
 665         }
 666
 667         ExFreePoolWithTag(IndexRecord, TAG_NTFS);
 668     }
 669     else
 670     {
 671         DPRINT("Can't read MFT record\n");
 672     }
 673     ExFreePoolWithTag(MftRecord, TAG_NTFS);
 674
 675     return STATUS_OBJECT_PATH_NOT_FOUND;
 676 }
 677
 678 NTSTATUS
 679 NtfsLookupFileAt(PDEVICE_EXTENSION Vcb,
 680                  PUNICODE_STRING PathName,
 681                  PFILE_RECORD_HEADER *FileRecord,
 682                  PNTFS_ATTR_CONTEXT *DataContext,
 683                  PULONGLONG MFTIndex,
 684                  ULONGLONG CurrentMFTIndex)
 685 {
 686     UNICODE_STRING Current, Remaining;
 687     NTSTATUS Status;
 688     ULONG FirstEntry = 0;
 689
 690     DPRINT("NtfsLookupFileAt(%p, %wZ, %p, %p, %I64x)\n", Vcb, PathName, FileRecord, DataContext, CurrentMFTIndex);
 691
 692     FsRtlDissectName(*PathName, &Current, &Remaining);
 693
 694     while (Current.Length != 0)
 695     {
 696         DPRINT("Current: %wZ\n", &Current);
 697
 698         Status = NtfsFindMftRecord(Vcb, CurrentMFTIndex, &Current, &FirstEntry, FALSE, &CurrentMFTIndex);
 699         if (!NT_SUCCESS(Status))
 700         {
 701             return Status;
 702         }
 703
 704         if (Remaining.Length == 0)
 705             break;
 706
 707         FsRtlDissectName(Current, &Current, &Remaining);
 708     }
 709
 710     *FileRecord = ExAllocatePoolWithTag(NonPagedPool, Vcb->NtfsInfo.BytesPerFileRecord, TAG_NTFS);
 711     if (*FileRecord == NULL)
 712     {
 713         DPRINT("NtfsLookupFileAt: Can't allocate MFT record\n");
 714         return STATUS_INSUFFICIENT_RESOURCES;
 715     }
 716
 717     Status = ReadFileRecord(Vcb, CurrentMFTIndex, *FileRecord);
 718     if (!NT_SUCCESS(Status))
 719     {
 720         DPRINT("NtfsLookupFileAt: Can't read MFT record\n");
 721         ExFreePoolWithTag(*FileRecord, TAG_NTFS);
 722         return Status;
 723     }
 724
 725     if (!((*FileRecord)->Flags & FRH_DIRECTORY))
 726     {
 727         Status = FindAttribute(Vcb, *FileRecord, AttributeData, L"", 0, DataContext);
 728         if (!NT_SUCCESS(Status))
 729         {
 730             DPRINT("NtfsLookupFileAt: Can't find data attribute\n");
 731             ExFreePoolWithTag(*FileRecord, TAG_NTFS);
 732             return Status;
 733         }
 734     }
 735     else
 736     {
 737         *DataContext = NULL;
 738     }
 739
 740     *MFTIndex = CurrentMFTIndex;
 741
 742     return STATUS_SUCCESS;
 743 }
 744
 745 NTSTATUS
 746 NtfsLookupFile(PDEVICE_EXTENSION Vcb,
 747                PUNICODE_STRING PathName,
 748                PFILE_RECORD_HEADER *FileRecord,
 749                PNTFS_ATTR_CONTEXT *DataContext,
 750                PULONGLONG MFTIndex)
 751 {
 752     return NtfsLookupFileAt(Vcb, PathName, FileRecord, DataContext, MFTIndex, NTFS_FILE_ROOT);
 753 }
 754
 755 NTSTATUS
 756 NtfsFindFileAt(PDEVICE_EXTENSION Vcb,
 757                PUNICODE_STRING SearchPattern,
 758                PULONG FirstEntry,
 759                PFILE_RECORD_HEADER *FileRecord,
 760                PNTFS_ATTR_CONTEXT *DataContext,
 761                PULONGLONG MFTIndex,
 762                ULONGLONG CurrentMFTIndex)
 763 {
 764     NTSTATUS Status;
 765
 766     DPRINT("NtfsFindFileAt(%p, %wZ, %p, %p, %p, %p, %I64x)\n", Vcb, SearchPattern, FirstEntry, FileRecord, DataContext, MFTIndex, CurrentMFTIndex);
 767
 768     Status = NtfsFindMftRecord(Vcb, CurrentMFTIndex, SearchPattern, FirstEntry, TRUE, &CurrentMFTIndex);
 769     if (!NT_SUCCESS(Status))
 770     {
 771         DPRINT("NtfsFindFileAt: NtfsFindMftRecord() failed with status 0x%08lx\n", Status);
 772         return Status;
 773     }
 774
 775     *FileRecord = ExAllocatePoolWithTag(NonPagedPool, Vcb->NtfsInfo.BytesPerFileRecord, TAG_NTFS);
 776     if (*FileRecord == NULL)
 777     {
 778         DPRINT("NtfsFindFileAt: Can't allocate MFT record\n");
 779         return STATUS_INSUFFICIENT_RESOURCES;
 780     }
 781
 782     Status = ReadFileRecord(Vcb, CurrentMFTIndex, *FileRecord);
 783     if (!NT_SUCCESS(Status))
 784     {
 785         DPRINT("NtfsFindFileAt: Can't read MFT record\n");
 786         ExFreePoolWithTag(*FileRecord, TAG_NTFS);
 787         return Status;
 788     }
 789
 790     if (!((*FileRecord)->Flags & FRH_DIRECTORY))
 791     {
 792         Status = FindAttribute(Vcb, *FileRecord, AttributeData, L"", 0, DataContext);
 793         if (!NT_SUCCESS(Status))
 794         {
 795             DPRINT("NtfsFindFileAt: Can't find data attribute\n");
 796             ExFreePoolWithTag(*FileRecord, TAG_NTFS);
 797             return Status;
 798         }
 799     }
 800     else
 801     {
 802         *DataContext = NULL;
 803     }
 804
 805     *MFTIndex = CurrentMFTIndex;
 806
 807     return STATUS_SUCCESS;
 808 }
 809
 810 /* EOF */