drivers/filesystems/ntfs/ntfs.h

   1 #ifndef NTFS_H
   2 #define NTFS_H
   3
   4 #include <ntifs.h>
   5 #include <pseh/pseh2.h>
   6
   7 #ifdef __GNUC__
   8 #define INIT_SECTION __attribute__((section ("INIT")))
   9 #else
  10 #define INIT_SECTION /* Done via alloc_text for MSC */
  11 #endif
  12
  13 #define CACHEPAGESIZE(pDeviceExt) \
  14         ((pDeviceExt)->NtfsInfo.UCHARsPerCluster > PAGE_SIZE ? \
  15          (pDeviceExt)->NtfsInfo.UCHARsPerCluster : PAGE_SIZE)
  16
  17 #define TAG_NTFS 'SFTN'
  18
  19 #define ROUND_UP(N, S) ((((N) + (S) - 1) / (S)) * (S))
  20 #define ROUND_DOWN(N, S) ((N) - ((N) % (S)))
  21
  22 #define DEVICE_NAME L"\\Ntfs"
  23
  24 #include <pshpack1.h>
  25 typedef struct _BIOS_PARAMETERS_BLOCK
  26 {
  27     USHORT    BytesPerSector;                   // 0x0B
  28     UCHAR     SectorsPerCluster;                // 0x0D
  29     UCHAR     Unused0[7];                               // 0x0E, checked when volume is mounted
  30     UCHAR     MediaId;                          // 0x15
  31     UCHAR     Unused1[2];                               // 0x16
  32     USHORT    SectorsPerTrack;          // 0x18
  33     USHORT    Heads;                                    // 0x1A
  34     UCHAR     Unused2[4];                               // 0x1C
  35     UCHAR     Unused3[4];                               // 0x20, checked when volume is mounted
  36 } BIOS_PARAMETERS_BLOCK, *PBIOS_PARAMETERS_BLOCK;
  37
  38 typedef struct _EXTENDED_BIOS_PARAMETERS_BLOCK
  39 {
  40     USHORT    Unknown[2];                               // 0x24, always 80 00 80 00
  41     ULONGLONG SectorCount;                      // 0x28
  42     ULONGLONG MftLocation;                      // 0x30
  43     ULONGLONG MftMirrLocation;          // 0x38
  44     CHAR      ClustersPerMftRecord;     // 0x40
  45     UCHAR     Unused4[3];                               // 0x41
  46     CHAR      ClustersPerIndexRecord; // 0x44
  47     UCHAR     Unused5[3];                               // 0x45
  48     ULONGLONG SerialNumber;                     // 0x48
  49     UCHAR     Checksum[4];                      // 0x50
  50 } EXTENDED_BIOS_PARAMETERS_BLOCK, *PEXTENDED_BIOS_PARAMETERS_BLOCK;
  51
  52 typedef struct _BOOT_SECTOR
  53 {
  54     UCHAR     Jump[3];                          // 0x00
  55     UCHAR     OEMID[8];                         // 0x03
  56     BIOS_PARAMETERS_BLOCK BPB;
  57     EXTENDED_BIOS_PARAMETERS_BLOCK EBPB;
  58     UCHAR     BootStrap[426];                   // 0x54
  59     USHORT    EndSector;                                // 0x1FE
  60 } BOOT_SECTOR, *PBOOT_SECTOR;
  61 #include <poppack.h>
  62
  63 //typedef struct _BootSector BootSector;
  64
  65 typedef struct _NTFS_INFO
  66 {
  67     ULONG BytesPerSector;
  68     ULONG SectorsPerCluster;
  69     ULONG BytesPerCluster;
  70     ULONGLONG SectorCount;
  71     ULONGLONG ClusterCount;
  72     ULARGE_INTEGER MftStart;
  73     ULARGE_INTEGER MftMirrStart;
  74     ULONG BytesPerFileRecord;
  75     ULONG BytesPerIndexRecord;
  76
  77     ULONGLONG SerialNumber;
  78     USHORT VolumeLabelLength;
  79     WCHAR VolumeLabel[MAXIMUM_VOLUME_LABEL_LENGTH];
  80     UCHAR MajorVersion;
  81     UCHAR MinorVersion;
  82     USHORT Flags;
  83
  84     ULONG MftZoneReservation;
  85 } NTFS_INFO, *PNTFS_INFO;
  86
  87 #define NTFS_TYPE_CCB         '20SF'
  88 #define NTFS_TYPE_FCB         '30SF'
  89 #define NTFS_TYPE_VCB         '50SF'
  90 #define NTFS_TYPE_IRP_CONTEXT '60SF'
  91 #define NTFS_TYPE_GLOBAL_DATA '70SF'
  92
  93 typedef struct
  94 {
  95     ULONG Type;
  96     ULONG Size;
  97 } NTFSIDENTIFIER, *PNTFSIDENTIFIER;
  98
  99 typedef struct
 100 {
 101     NTFSIDENTIFIER Identifier;
 102
 103     ERESOURCE DirResource;
 104 //    ERESOURCE FatResource;
 105
 106     KSPIN_LOCK FcbListLock;
 107     LIST_ENTRY FcbListHead;
 108
 109     PVPB Vpb;
 110     PDEVICE_OBJECT StorageDevice;
 111     PFILE_OBJECT StreamFileObject;
 112
 113     struct _NTFS_ATTR_CONTEXT* MFTContext;
 114     struct _FILE_RECORD_HEADER* MasterFileTable;
 115     struct _FCB *VolumeFcb;
 116
 117     NTFS_INFO NtfsInfo;
 118
 119     ULONG MftDataOffset;
 120     ULONG Flags;
 121     ULONG OpenHandleCount;
 122
 123 } DEVICE_EXTENSION, *PDEVICE_EXTENSION, NTFS_VCB, *PNTFS_VCB;
 124
 125 #define VCB_VOLUME_LOCKED       0x0001
 126
 127 typedef struct
 128 {
 129     NTFSIDENTIFIER Identifier;
 130     LIST_ENTRY     NextCCB;
 131     PFILE_OBJECT   PtrFileObject;
 132     LARGE_INTEGER  CurrentByteOffset;
 133     /* for DirectoryControl */
 134     ULONG Entry;
 135     /* for DirectoryControl */
 136     PWCHAR DirectorySearchPattern;
 137     ULONG LastCluster;
 138     ULONG LastOffset;
 139 } NTFS_CCB, *PNTFS_CCB;
 140
 141 #define TAG_CCB 'BCCI'
 142 #define TAG_FCB 'BCFI'
 143
 144 typedef struct
 145 {
 146     NTFSIDENTIFIER Identifier;
 147     ERESOURCE Resource;
 148     PDRIVER_OBJECT DriverObject;
 149     PDEVICE_OBJECT DeviceObject;
 150     CACHE_MANAGER_CALLBACKS CacheMgrCallbacks;
 151     ULONG Flags;
 152     FAST_IO_DISPATCH FastIoDispatch;
 153     NPAGED_LOOKASIDE_LIST IrpContextLookasideList;
 154     NPAGED_LOOKASIDE_LIST FcbLookasideList;
 155     BOOLEAN EnableWriteSupport;
 156 } NTFS_GLOBAL_DATA, *PNTFS_GLOBAL_DATA;
 157
 158
 159 typedef enum
 160 {
 161     AttributeStandardInformation = 0x10,
 162     AttributeAttributeList = 0x20,
 163     AttributeFileName = 0x30,
 164     AttributeObjectId = 0x40,
 165     AttributeSecurityDescriptor = 0x50,
 166     AttributeVolumeName = 0x60,
 167     AttributeVolumeInformation = 0x70,
 168     AttributeData = 0x80,
 169     AttributeIndexRoot = 0x90,
 170     AttributeIndexAllocation = 0xA0,
 171     AttributeBitmap = 0xB0,
 172     AttributeReparsePoint = 0xC0,
 173     AttributeEAInformation = 0xD0,
 174     AttributeEA = 0xE0,
 175     AttributePropertySet = 0xF0,
 176     AttributeLoggedUtilityStream = 0x100,
 177     AttributeEnd = 0xFFFFFFFF
 178 } ATTRIBUTE_TYPE, *PATTRIBUTE_TYPE;
 179
 180 // FILE_RECORD_END seems to follow AttributeEnd in every file record starting with $Quota.
 181 // No clue what data is being represented here.
 182 #define FILE_RECORD_END              0x11477982
 183
 184 #define NTFS_FILE_MFT                0
 185 #define NTFS_FILE_MFTMIRR            1
 186 #define NTFS_FILE_LOGFILE            2
 187 #define NTFS_FILE_VOLUME            3
 188 #define NTFS_FILE_ATTRDEF            4
 189 #define NTFS_FILE_ROOT                5
 190 #define NTFS_FILE_BITMAP            6
 191 #define NTFS_FILE_BOOT                7
 192 #define NTFS_FILE_BADCLUS            8
 193 #define NTFS_FILE_QUOTA                9
 194 #define NTFS_FILE_UPCASE            10
 195 #define NTFS_FILE_EXTEND            11
 196 #define NTFS_FILE_FIRST_USER_FILE   16
 197
 198 #define NTFS_MFT_MASK 0x0000FFFFFFFFFFFFULL
 199
 200 #define COLLATION_BINARY              0x00
 201 #define COLLATION_FILE_NAME           0x01
 202 #define COLLATION_UNICODE_STRING      0x02
 203 #define COLLATION_NTOFS_ULONG         0x10
 204 #define COLLATION_NTOFS_SID           0x11
 205 #define COLLATION_NTOFS_SECURITY_HASH 0x12
 206 #define COLLATION_NTOFS_ULONGS        0x13
 207
 208 #define INDEX_ROOT_SMALL 0x0
 209 #define INDEX_ROOT_LARGE 0x1
 210
 211 #define INDEX_NODE_SMALL 0x0
 212 #define INDEX_NODE_LARGE 0x1
 213
 214 #define NTFS_INDEX_ENTRY_NODE            1
 215 #define NTFS_INDEX_ENTRY_END            2
 216
 217 #define NTFS_FILE_NAME_POSIX            0
 218 #define NTFS_FILE_NAME_WIN32            1
 219 #define NTFS_FILE_NAME_DOS            2
 220 #define NTFS_FILE_NAME_WIN32_AND_DOS        3
 221
 222 #define NTFS_FILE_TYPE_READ_ONLY  0x1
 223 #define NTFS_FILE_TYPE_HIDDEN     0x2
 224 #define NTFS_FILE_TYPE_SYSTEM     0x4
 225 #define NTFS_FILE_TYPE_ARCHIVE    0x20
 226 #define NTFS_FILE_TYPE_REPARSE    0x400
 227 #define NTFS_FILE_TYPE_COMPRESSED 0x800
 228 #define NTFS_FILE_TYPE_DIRECTORY  0x10000000
 229
 230 /* Indexed Flag in Resident attributes - still somewhat speculative */
 231 #define RA_INDEXED    0x01
 232
 233 typedef struct
 234 {
 235     ULONG Type;             /* Magic number 'FILE' */
 236     USHORT UsaOffset;       /* Offset to the update sequence */
 237     USHORT UsaCount;        /* Size in words of Update Sequence Number & Array (S) */
 238     ULONGLONG Lsn;          /* $LogFile Sequence Number (LSN) */
 239 } NTFS_RECORD_HEADER, *PNTFS_RECORD_HEADER;
 240
 241 /* NTFS_RECORD_HEADER.Type */
 242 #define NRH_FILE_TYPE  0x454C4946  /* 'FILE' */
 243 #define NRH_INDX_TYPE  0x58444E49  /* 'INDX' */
 244
 245
 246 typedef struct _FILE_RECORD_HEADER
 247 {
 248     NTFS_RECORD_HEADER Ntfs;
 249     USHORT SequenceNumber;        /* Sequence number */
 250     USHORT LinkCount;             /* Hard link count */
 251     USHORT AttributeOffset;       /* Offset to the first Attribute */
 252     USHORT Flags;                 /* Flags */
 253     ULONG BytesInUse;             /* Real size of the FILE record */
 254     ULONG BytesAllocated;         /* Allocated size of the FILE record */
 255     ULONGLONG BaseFileRecord;     /* File reference to the base FILE record */
 256     USHORT NextAttributeNumber;   /* Next Attribute Id */
 257     USHORT Padding;               /* Align to 4 UCHAR boundary (XP) */
 258     ULONG MFTRecordNumber;        /* Number of this MFT Record (XP) */
 259 } FILE_RECORD_HEADER, *PFILE_RECORD_HEADER;
 260
 261 /* Flags in FILE_RECORD_HEADER */
 262
 263 #define FRH_IN_USE    0x0001    /* Record is in use */
 264 #define FRH_DIRECTORY 0x0002    /* Record is a directory */
 265 #define FRH_UNKNOWN1  0x0004    /* Don't know */
 266 #define FRH_UNKNOWN2  0x0008    /* Don't know */
 267
 268 typedef struct
 269 {
 270     ULONG        Type;
 271     ULONG        Length;
 272     UCHAR        IsNonResident;
 273     UCHAR        NameLength;
 274     USHORT        NameOffset;
 275     USHORT        Flags;
 276     USHORT        Instance;
 277     union
 278     {
 279         // Resident attributes
 280         struct
 281         {
 282             ULONG        ValueLength;
 283             USHORT        ValueOffset;
 284             UCHAR        Flags;
 285             UCHAR        Reserved;
 286         } Resident;
 287         // Non-resident attributes
 288         struct
 289         {
 290             ULONGLONG        LowestVCN;
 291             ULONGLONG        HighestVCN;
 292             USHORT        MappingPairsOffset;
 293             USHORT        CompressionUnit;
 294             UCHAR        Reserved[4];
 295             LONGLONG        AllocatedSize;
 296             LONGLONG        DataSize;
 297             LONGLONG        InitializedSize;
 298             LONGLONG        CompressedSize;
 299         } NonResident;
 300     };
 301 } NTFS_ATTR_RECORD, *PNTFS_ATTR_RECORD;
 302
 303 // The beginning and length of an attribute record are always aligned to an 8-byte boundary,
 304 // relative to the beginning of the file record.
 305 #define ATTR_RECORD_ALIGNMENT 8
 306
 307 typedef struct
 308 {
 309     ULONGLONG CreationTime;
 310     ULONGLONG ChangeTime;
 311     ULONGLONG LastWriteTime;
 312     ULONGLONG LastAccessTime;
 313     ULONG FileAttribute;
 314     ULONG AlignmentOrReserved[3];
 315 #if 0
 316     ULONG QuotaId;
 317     ULONG SecurityId;
 318     ULONGLONG QuotaCharge;
 319     USN Usn;
 320 #endif
 321 } STANDARD_INFORMATION, *PSTANDARD_INFORMATION;
 322
 323
 324 typedef struct
 325 {
 326     ATTRIBUTE_TYPE AttributeType;
 327     USHORT Length;
 328     UCHAR NameLength;
 329     UCHAR NameOffset;
 330     ULONGLONG StartVcn; // LowVcn
 331     ULONGLONG FileReferenceNumber;
 332     USHORT AttributeNumber;
 333     USHORT AlignmentOrReserved[3];
 334 } ATTRIBUTE_LIST, *PATTRIBUTE_LIST;
 335
 336
 337 typedef struct
 338 {
 339     ULONGLONG DirectoryFileReferenceNumber;
 340     ULONGLONG CreationTime;
 341     ULONGLONG ChangeTime;
 342     ULONGLONG LastWriteTime;
 343     ULONGLONG LastAccessTime;
 344     ULONGLONG AllocatedSize;
 345     ULONGLONG DataSize;
 346     ULONG FileAttributes;
 347     union
 348     {
 349         struct
 350         {
 351             USHORT PackedEaSize;
 352             USHORT AlignmentOrReserved;
 353         } EaInfo;
 354         ULONG ReparseTag;
 355     } Extended;
 356     UCHAR NameLength;
 357     UCHAR NameType;
 358     WCHAR Name[1];
 359 } FILENAME_ATTRIBUTE, *PFILENAME_ATTRIBUTE;
 360
 361 typedef struct
 362 {
 363     ULONG FirstEntryOffset;
 364     ULONG TotalSizeOfEntries;
 365     ULONG AllocatedSize;
 366     UCHAR Flags;
 367     UCHAR Padding[3];
 368 } INDEX_HEADER_ATTRIBUTE, *PINDEX_HEADER_ATTRIBUTE;
 369
 370 typedef struct
 371 {
 372     ULONG AttributeType;
 373     ULONG CollationRule;
 374     ULONG SizeOfEntry;
 375     UCHAR ClustersPerIndexRecord;
 376     UCHAR Padding[3];
 377     INDEX_HEADER_ATTRIBUTE Header;
 378 } INDEX_ROOT_ATTRIBUTE, *PINDEX_ROOT_ATTRIBUTE;
 379
 380 typedef struct
 381 {
 382     NTFS_RECORD_HEADER Ntfs;
 383     ULONGLONG VCN;
 384     INDEX_HEADER_ATTRIBUTE Header;
 385 } INDEX_BUFFER, *PINDEX_BUFFER;
 386
 387 typedef struct
 388 {
 389     union
 390     {
 391         struct
 392         {
 393             ULONGLONG    IndexedFile;
 394         } Directory;
 395         struct
 396         {
 397             USHORT    DataOffset;
 398             USHORT    DataLength;
 399             ULONG    Reserved;
 400         } ViewIndex;
 401     } Data;
 402     USHORT            Length;
 403     USHORT            KeyLength;
 404     USHORT            Flags;
 405     USHORT            Reserved;
 406     FILENAME_ATTRIBUTE    FileName;
 407 } INDEX_ENTRY_ATTRIBUTE, *PINDEX_ENTRY_ATTRIBUTE;
 408
 409 struct _B_TREE_FILENAME_NODE;
 410 typedef struct _B_TREE_FILENAME_NODE B_TREE_FILENAME_NODE;
 411
 412 // Keys are arranged in nodes as an ordered, linked list
 413 typedef struct _B_TREE_KEY
 414 {
 415     struct _B_TREE_KEY *NextKey;
 416     B_TREE_FILENAME_NODE *LesserChild;  // Child-Node. All the keys in this node will be sorted before IndexEntry
 417     PINDEX_ENTRY_ATTRIBUTE IndexEntry;  // must be last member for FIELD_OFFSET
 418 }B_TREE_KEY, *PB_TREE_KEY;
 419
 420 // Every Node is just an ordered list of keys.
 421 // Sub-nodes can be found attached to a key (if they exist).
 422 // A key's sub-node precedes that key in the ordered list.
 423 typedef struct _B_TREE_FILENAME_NODE
 424 {
 425     ULONG KeyCount;
 426     BOOLEAN ExistsOnDisk;
 427     BOOLEAN DiskNeedsUpdating;
 428     ULONGLONG NodeNumber;
 429     PB_TREE_KEY FirstKey;
 430 } B_TREE_FILENAME_NODE, *PB_TREE_FILENAME_NODE;
 431
 432 typedef struct
 433 {
 434     PB_TREE_FILENAME_NODE RootNode;
 435 } B_TREE, *PB_TREE;
 436
 437 typedef struct
 438 {
 439     ULONGLONG Unknown1;
 440     UCHAR MajorVersion;
 441     UCHAR MinorVersion;
 442     USHORT Flags;
 443     ULONG Unknown2;
 444 } VOLINFO_ATTRIBUTE, *PVOLINFO_ATTRIBUTE;
 445
 446 typedef struct {
 447     ULONG ReparseTag;
 448     USHORT DataLength;
 449     USHORT Reserved;
 450     UCHAR Data[1];
 451 } REPARSE_POINT_ATTRIBUTE, *PREPARSE_POINT_ATTRIBUTE;
 452
 453 #define IRPCONTEXT_CANWAIT 0x1
 454 #define IRPCONTEXT_COMPLETE 0x2
 455 #define IRPCONTEXT_QUEUE 0x4
 456
 457 typedef struct
 458 {
 459     NTFSIDENTIFIER Identifier;
 460     ULONG Flags;
 461     PIO_STACK_LOCATION Stack;
 462     UCHAR MajorFunction;
 463     UCHAR MinorFunction;
 464     WORK_QUEUE_ITEM WorkQueueItem;
 465     PIRP Irp;
 466     BOOLEAN IsTopLevel;
 467     PDEVICE_OBJECT DeviceObject;
 468     PFILE_OBJECT FileObject;
 469     NTSTATUS SavedExceptionCode;
 470     CCHAR PriorityBoost;
 471 } NTFS_IRP_CONTEXT, *PNTFS_IRP_CONTEXT;
 472
 473 typedef struct _NTFS_ATTR_CONTEXT
 474 {
 475     PUCHAR            CacheRun;
 476     ULONGLONG            CacheRunOffset;
 477     LONGLONG            CacheRunStartLCN;
 478     ULONGLONG            CacheRunLength;
 479     LONGLONG            CacheRunLastLCN;
 480     ULONGLONG            CacheRunCurrentOffset;
 481     LARGE_MCB           DataRunsMCB;
 482     ULONGLONG           FileMFTIndex;
 483     PNTFS_ATTR_RECORD    pRecord;
 484 } NTFS_ATTR_CONTEXT, *PNTFS_ATTR_CONTEXT;
 485
 486 #define FCB_CACHE_INITIALIZED   0x0001
 487 #define FCB_IS_VOLUME_STREAM    0x0002
 488 #define FCB_IS_VOLUME           0x0004
 489 #define MAX_PATH                260
 490
 491 typedef struct _FCB
 492 {
 493     NTFSIDENTIFIER Identifier;
 494
 495     FSRTL_COMMON_FCB_HEADER RFCB;
 496     SECTION_OBJECT_POINTERS SectionObjectPointers;
 497
 498     PFILE_OBJECT FileObject;
 499     PNTFS_VCB Vcb;
 500
 501     WCHAR Stream[MAX_PATH];
 502     WCHAR *ObjectName;          /* point on filename (250 chars max) in PathName */
 503     WCHAR PathName[MAX_PATH];   /* path+filename 260 max */
 504
 505     ERESOURCE PagingIoResource;
 506     ERESOURCE MainResource;
 507
 508     LIST_ENTRY FcbListEntry;
 509     struct _FCB* ParentFcb;
 510
 511     ULONG DirIndex;
 512
 513     LONG RefCount;
 514     ULONG Flags;
 515     ULONG OpenHandleCount;
 516
 517     ULONGLONG MFTIndex;
 518     USHORT LinkCount;
 519
 520     FILENAME_ATTRIBUTE Entry;
 521
 522 } NTFS_FCB, *PNTFS_FCB;
 523
 524 typedef struct _FIND_ATTR_CONTXT
 525 {
 526     PDEVICE_EXTENSION Vcb;
 527     BOOLEAN OnlyResident;
 528     PNTFS_ATTR_RECORD FirstAttr;
 529     PNTFS_ATTR_RECORD CurrAttr;
 530     PNTFS_ATTR_RECORD LastAttr;
 531     PNTFS_ATTR_RECORD NonResidentStart;
 532     PNTFS_ATTR_RECORD NonResidentEnd;
 533     ULONG Offset;
 534 } FIND_ATTR_CONTXT, *PFIND_ATTR_CONTXT;
 535
 536 typedef struct
 537 {
 538     USHORT USN;
 539     USHORT Array[];
 540 } FIXUP_ARRAY, *PFIXUP_ARRAY;
 541
 542 extern PNTFS_GLOBAL_DATA NtfsGlobalData;
 543
 544 FORCEINLINE
 545 NTSTATUS
 546 NtfsMarkIrpContextForQueue(PNTFS_IRP_CONTEXT IrpContext)
 547 {
 548     PULONG Flags = &IrpContext->Flags;
 549
 550     *Flags &= ~IRPCONTEXT_COMPLETE;
 551     *Flags |= IRPCONTEXT_QUEUE;
 552
 553     return STATUS_PENDING;
 554 }
 555
 556 /* attrib.c */
 557
 558 //VOID
 559 //NtfsDumpAttribute(PATTRIBUTE Attribute);
 560
 561 NTSTATUS
 562 AddData(PFILE_RECORD_HEADER FileRecord,
 563         PNTFS_ATTR_RECORD AttributeAddress);
 564
 565 NTSTATUS
 566 AddRun(PNTFS_VCB Vcb,
 567        PNTFS_ATTR_CONTEXT AttrContext,
 568        ULONG AttrOffset,
 569        PFILE_RECORD_HEADER FileRecord,
 570        ULONGLONG NextAssignedCluster,
 571        ULONG RunLength);
 572
 573 NTSTATUS
 574 AddFileName(PFILE_RECORD_HEADER FileRecord,
 575             PNTFS_ATTR_RECORD AttributeAddress,
 576             PDEVICE_EXTENSION DeviceExt,
 577             PFILE_OBJECT FileObject,
 578             BOOLEAN CaseSensitive,
 579             PULONGLONG ParentMftIndex);
 580
 581 NTSTATUS
 582 AddStandardInformation(PFILE_RECORD_HEADER FileRecord,
 583                        PNTFS_ATTR_RECORD AttributeAddress);
 584
 585 NTSTATUS
 586 ConvertDataRunsToLargeMCB(PUCHAR DataRun,
 587                           PLARGE_MCB DataRunsMCB,
 588                           PULONGLONG pNextVBN);
 589
 590 NTSTATUS
 591 ConvertLargeMCBToDataRuns(PLARGE_MCB DataRunsMCB,
 592                           PUCHAR RunBuffer,
 593                           ULONG MaxBufferSize,
 594                           PULONG UsedBufferSize);
 595
 596 PUCHAR
 597 DecodeRun(PUCHAR DataRun,
 598           LONGLONG *DataRunOffset,
 599           ULONGLONG *DataRunLength);
 600
 601 ULONG GetFileNameAttributeLength(PFILENAME_ATTRIBUTE FileNameAttribute);
 602
 603 VOID
 604 NtfsDumpDataRuns(PVOID StartOfRun,
 605                  ULONGLONG CurrentLCN);
 606
 607 VOID
 608 NtfsDumpFileAttributes(PDEVICE_EXTENSION Vcb,
 609                        PFILE_RECORD_HEADER FileRecord);
 610
 611 PSTANDARD_INFORMATION
 612 GetStandardInformationFromRecord(PDEVICE_EXTENSION Vcb,
 613                                  PFILE_RECORD_HEADER FileRecord);
 614
 615 PFILENAME_ATTRIBUTE
 616 GetFileNameFromRecord(PDEVICE_EXTENSION Vcb,
 617                       PFILE_RECORD_HEADER FileRecord,
 618                       UCHAR NameType);
 619
 620 UCHAR
 621 GetPackedByteCount(LONGLONG NumberToPack,
 622                    BOOLEAN IsSigned);
 623
 624 NTSTATUS
 625 GetLastClusterInDataRun(PDEVICE_EXTENSION Vcb,
 626                         PNTFS_ATTR_RECORD Attribute,
 627                         PULONGLONG LastCluster);
 628
 629 PFILENAME_ATTRIBUTE
 630 GetBestFileNameFromRecord(PDEVICE_EXTENSION Vcb,
 631                           PFILE_RECORD_HEADER FileRecord);
 632
 633 NTSTATUS
 634 FindFirstAttribute(PFIND_ATTR_CONTXT Context,
 635                    PDEVICE_EXTENSION Vcb,
 636                    PFILE_RECORD_HEADER FileRecord,
 637                    BOOLEAN OnlyResident,
 638                    PNTFS_ATTR_RECORD * Attribute);
 639
 640 NTSTATUS
 641 FindNextAttribute(PFIND_ATTR_CONTXT Context,
 642                   PNTFS_ATTR_RECORD * Attribute);
 643
 644 VOID
 645 FindCloseAttribute(PFIND_ATTR_CONTXT Context);
 646
 647 NTSTATUS
 648 FreeClusters(PNTFS_VCB Vcb,
 649              PNTFS_ATTR_CONTEXT AttrContext,
 650              ULONG AttrOffset,
 651              PFILE_RECORD_HEADER FileRecord,
 652              ULONG ClustersToFree);
 653
 654 /* blockdev.c */
 655
 656 NTSTATUS
 657 NtfsReadDisk(IN PDEVICE_OBJECT DeviceObject,
 658              IN LONGLONG StartingOffset,
 659              IN ULONG Length,
 660              IN ULONG SectorSize,
 661              IN OUT PUCHAR Buffer,
 662              IN BOOLEAN Override);
 663
 664 NTSTATUS
 665 NtfsWriteDisk(IN PDEVICE_OBJECT DeviceObject,
 666               IN LONGLONG StartingOffset,
 667               IN ULONG Length,
 668               IN ULONG SectorSize,
 669               IN const PUCHAR Buffer);
 670
 671 NTSTATUS
 672 NtfsReadSectors(IN PDEVICE_OBJECT DeviceObject,
 673                 IN ULONG DiskSector,
 674                 IN ULONG SectorCount,
 675                 IN ULONG SectorSize,
 676                 IN OUT PUCHAR Buffer,
 677                 IN BOOLEAN Override);
 678
 679 NTSTATUS
 680 NtfsDeviceIoControl(IN PDEVICE_OBJECT DeviceObject,
 681                     IN ULONG ControlCode,
 682                     IN PVOID InputBuffer,
 683                     IN ULONG InputBufferSize,
 684                     IN OUT PVOID OutputBuffer,
 685                     IN OUT PULONG OutputBufferSize,
 686                     IN BOOLEAN Override);
 687
 688
 689 /* btree.c */
 690
 691 LONG
 692 CompareTreeKeys(PB_TREE_KEY Key1,
 693                 PB_TREE_KEY Key2,
 694                 BOOLEAN CaseSensitive);
 695
 696 NTSTATUS
 697 CreateBTreeFromIndex(PDEVICE_EXTENSION Vcb,
 698                      PFILE_RECORD_HEADER FileRecordWithIndex,
 699                      /*PCWSTR IndexName,*/
 700                      PNTFS_ATTR_CONTEXT IndexRootContext,
 701                      PINDEX_ROOT_ATTRIBUTE IndexRoot,
 702                      PB_TREE *NewTree);
 703
 704 NTSTATUS
 705 CreateIndexRootFromBTree(PDEVICE_EXTENSION DeviceExt,
 706                          PB_TREE Tree,
 707                          ULONG MaxIndexSize,
 708                          PINDEX_ROOT_ATTRIBUTE *IndexRoot,
 709                          ULONG *Length);
 710
 711 VOID
 712 DestroyBTree(PB_TREE Tree);
 713
 714 VOID
 715 DestroyBTreeNode(PB_TREE_FILENAME_NODE Node);
 716
 717 VOID
 718 DumpBTree(PB_TREE Tree);
 719
 720 VOID
 721 DumpBTreeNode(PB_TREE_FILENAME_NODE Node,
 722               ULONG Number,
 723               ULONG Depth);
 724
 725 ULONGLONG
 726 GetAllocationOffsetFromVCN(PDEVICE_EXTENSION DeviceExt,
 727                            ULONG IndexBufferSize,
 728                            ULONGLONG Vcn);
 729
 730 NTSTATUS
 731 NtfsInsertKey(ULONGLONG FileReference,
 732               PFILENAME_ATTRIBUTE FileNameAttribute,
 733               PB_TREE_FILENAME_NODE Node,
 734               BOOLEAN CaseSensitive);
 735
 736 NTSTATUS
 737 UpdateIndexAllocation(PDEVICE_EXTENSION DeviceExt,
 738                       PB_TREE Tree,
 739                       ULONG IndexBufferSize,
 740                       PFILE_RECORD_HEADER FileRecord);
 741
 742 NTSTATUS
 743 UpdateIndexNode(PDEVICE_EXTENSION DeviceExt,
 744                 PB_TREE_FILENAME_NODE Node,
 745                 ULONG IndexBufferSize,
 746                 PNTFS_ATTR_CONTEXT IndexAllocationContext,
 747                 PNTFS_ATTR_CONTEXT BitmapContext);
 748
 749 /* close.c */
 750
 751 NTSTATUS
 752 NtfsCleanup(PNTFS_IRP_CONTEXT IrpContext);
 753
 754
 755 /* close.c */
 756
 757 NTSTATUS
 758 NtfsCloseFile(PDEVICE_EXTENSION DeviceExt,
 759               PFILE_OBJECT FileObject);
 760
 761 NTSTATUS
 762 NtfsClose(PNTFS_IRP_CONTEXT IrpContext);
 763
 764
 765 /* create.c */
 766
 767 NTSTATUS
 768 NtfsCreate(PNTFS_IRP_CONTEXT IrpContext);
 769
 770 NTSTATUS
 771 NtfsCreateFileRecord(PDEVICE_EXTENSION DeviceExt,
 772                      PFILE_OBJECT FileObject,
 773                      BOOLEAN CaseSensitive,
 774                      BOOLEAN CanWait);
 775
 776 /* devctl.c */
 777
 778 NTSTATUS
 779 NtfsDeviceControl(PNTFS_IRP_CONTEXT IrpContext);
 780
 781
 782 /* dirctl.c */
 783
 784 ULONGLONG
 785 NtfsGetFileSize(PDEVICE_EXTENSION DeviceExt,
 786                 PFILE_RECORD_HEADER FileRecord,
 787                 PCWSTR Stream,
 788                 ULONG StreamLength,
 789                 PULONGLONG AllocatedSize);
 790
 791 NTSTATUS
 792 NtfsDirectoryControl(PNTFS_IRP_CONTEXT IrpContext);
 793
 794
 795 /* dispatch.c */
 796
 797 DRIVER_DISPATCH NtfsFsdDispatch;
 798 NTSTATUS NTAPI
 799 NtfsFsdDispatch(PDEVICE_OBJECT DeviceObject,
 800                 PIRP Irp);
 801
 802
 803 /* fastio.c */
 804
 805 BOOLEAN NTAPI
 806 NtfsAcqLazyWrite(PVOID Context,
 807                  BOOLEAN Wait);
 808
 809 VOID NTAPI
 810 NtfsRelLazyWrite(PVOID Context);
 811
 812 BOOLEAN NTAPI
 813 NtfsAcqReadAhead(PVOID Context,
 814                  BOOLEAN Wait);
 815
 816 VOID NTAPI
 817 NtfsRelReadAhead(PVOID Context);
 818
 819 FAST_IO_CHECK_IF_POSSIBLE NtfsFastIoCheckIfPossible;
 820 FAST_IO_READ NtfsFastIoRead;
 821 FAST_IO_WRITE NtfsFastIoWrite;
 822
 823
 824 /* fcb.c */
 825
 826 PNTFS_FCB
 827 NtfsCreateFCB(PCWSTR FileName,
 828               PCWSTR Stream,
 829               PNTFS_VCB Vcb);
 830
 831 VOID
 832 NtfsDestroyFCB(PNTFS_FCB Fcb);
 833
 834 BOOLEAN
 835 NtfsFCBIsDirectory(PNTFS_FCB Fcb);
 836
 837 BOOLEAN
 838 NtfsFCBIsReparsePoint(PNTFS_FCB Fcb);
 839
 840 BOOLEAN
 841 NtfsFCBIsCompressed(PNTFS_FCB Fcb);
 842
 843 BOOLEAN
 844 NtfsFCBIsRoot(PNTFS_FCB Fcb);
 845
 846 VOID
 847 NtfsGrabFCB(PNTFS_VCB Vcb,
 848             PNTFS_FCB Fcb);
 849
 850 VOID
 851 NtfsReleaseFCB(PNTFS_VCB Vcb,
 852                PNTFS_FCB Fcb);
 853
 854 VOID
 855 NtfsAddFCBToTable(PNTFS_VCB Vcb,
 856                   PNTFS_FCB Fcb);
 857
 858 PNTFS_FCB
 859 NtfsGrabFCBFromTable(PNTFS_VCB Vcb,
 860                      PCWSTR FileName);
 861
 862 NTSTATUS
 863 NtfsFCBInitializeCache(PNTFS_VCB Vcb,
 864                        PNTFS_FCB Fcb);
 865
 866 PNTFS_FCB
 867 NtfsMakeRootFCB(PNTFS_VCB Vcb);
 868
 869 PNTFS_FCB
 870 NtfsOpenRootFCB(PNTFS_VCB Vcb);
 871
 872 NTSTATUS
 873 NtfsAttachFCBToFileObject(PNTFS_VCB Vcb,
 874                           PNTFS_FCB Fcb,
 875                           PFILE_OBJECT FileObject);
 876
 877 NTSTATUS
 878 NtfsGetFCBForFile(PNTFS_VCB Vcb,
 879                   PNTFS_FCB *pParentFCB,
 880                   PNTFS_FCB *pFCB,
 881                   PCWSTR pFileName,
 882                   BOOLEAN CaseSensitive);
 883
 884 NTSTATUS
 885 NtfsReadFCBAttribute(PNTFS_VCB Vcb,
 886                      PNTFS_FCB pFCB,
 887                      ULONG Type,
 888                      PCWSTR Name,
 889                      ULONG NameLength,
 890                      PVOID * Data);
 891
 892 NTSTATUS
 893 NtfsMakeFCBFromDirEntry(PNTFS_VCB Vcb,
 894                         PNTFS_FCB DirectoryFCB,
 895                         PUNICODE_STRING Name,
 896                         PCWSTR Stream,
 897                         PFILE_RECORD_HEADER Record,
 898                         ULONGLONG MFTIndex,
 899                         PNTFS_FCB * fileFCB);
 900
 901
 902 /* finfo.c */
 903
 904 NTSTATUS
 905 NtfsQueryInformation(PNTFS_IRP_CONTEXT IrpContext);
 906
 907 NTSTATUS
 908 NtfsSetEndOfFile(PNTFS_FCB Fcb,
 909                  PFILE_OBJECT FileObject,
 910                  PDEVICE_EXTENSION DeviceExt,
 911                  ULONG IrpFlags,
 912                  BOOLEAN CaseSensitive,
 913                  PLARGE_INTEGER NewFileSize);
 914
 915 NTSTATUS
 916 NtfsSetInformation(PNTFS_IRP_CONTEXT IrpContext);
 917
 918 /* fsctl.c */
 919
 920 NTSTATUS
 921 NtfsFileSystemControl(PNTFS_IRP_CONTEXT IrpContext);
 922
 923
 924 /* mft.c */
 925 NTSTATUS
 926 NtfsAddFilenameToDirectory(PDEVICE_EXTENSION DeviceExt,
 927                            ULONGLONG DirectoryMftIndex,
 928                            ULONGLONG FileReferenceNumber,
 929                            PFILENAME_ATTRIBUTE FilenameAttribute,
 930                            BOOLEAN CaseSensitive);
 931
 932 NTSTATUS
 933 AddNewMftEntry(PFILE_RECORD_HEADER FileRecord,
 934                PDEVICE_EXTENSION DeviceExt,
 935                PULONGLONG DestinationIndex,
 936                BOOLEAN CanWait);
 937
 938 PNTFS_ATTR_CONTEXT
 939 PrepareAttributeContext(PNTFS_ATTR_RECORD AttrRecord);
 940
 941 VOID
 942 ReleaseAttributeContext(PNTFS_ATTR_CONTEXT Context);
 943
 944 ULONG
 945 ReadAttribute(PDEVICE_EXTENSION Vcb,
 946               PNTFS_ATTR_CONTEXT Context,
 947               ULONGLONG Offset,
 948               PCHAR Buffer,
 949               ULONG Length);
 950
 951 NTSTATUS
 952 WriteAttribute(PDEVICE_EXTENSION Vcb,
 953                PNTFS_ATTR_CONTEXT Context,
 954                ULONGLONG Offset,
 955                const PUCHAR Buffer,
 956                ULONG Length,
 957                PULONG LengthWritten);
 958
 959 ULONGLONG
 960 AttributeDataLength(PNTFS_ATTR_RECORD AttrRecord);
 961
 962 NTSTATUS
 963 InternalSetResidentAttributeLength(PNTFS_ATTR_CONTEXT AttrContext,
 964                                    PFILE_RECORD_HEADER FileRecord,
 965                                    ULONG AttrOffset,
 966                                    ULONG DataSize);
 967
 968 NTSTATUS
 969 SetAttributeDataLength(PFILE_OBJECT FileObject,
 970                        PNTFS_FCB Fcb,
 971                        PNTFS_ATTR_CONTEXT AttrContext,
 972                        ULONG AttrOffset,
 973                        PFILE_RECORD_HEADER FileRecord,
 974                        PLARGE_INTEGER DataSize);
 975
 976 VOID
 977 SetFileRecordEnd(PFILE_RECORD_HEADER FileRecord,
 978                  PNTFS_ATTR_RECORD AttrEnd,
 979                  ULONG EndMarker);
 980
 981 NTSTATUS
 982 SetNonResidentAttributeDataLength(PDEVICE_EXTENSION Vcb,
 983                                   PNTFS_ATTR_CONTEXT AttrContext,
 984                                   ULONG AttrOffset,
 985                                   PFILE_RECORD_HEADER FileRecord,
 986                                   PLARGE_INTEGER DataSize);
 987
 988 NTSTATUS
 989 SetResidentAttributeDataLength(PDEVICE_EXTENSION Vcb,
 990                                PNTFS_ATTR_CONTEXT AttrContext,
 991                                ULONG AttrOffset,
 992                                PFILE_RECORD_HEADER FileRecord,
 993                                PLARGE_INTEGER DataSize);
 994
 995 ULONGLONG
 996 AttributeAllocatedLength(PNTFS_ATTR_RECORD AttrRecord);
 997
 998 BOOLEAN
 999 CompareFileName(PUNICODE_STRING FileName,
1000                 PINDEX_ENTRY_ATTRIBUTE IndexEntry,
1001                 BOOLEAN DirSearch,
1002                 BOOLEAN CaseSensitive);
1003
1004 NTSTATUS
1005 ReadFileRecord(PDEVICE_EXTENSION Vcb,
1006                ULONGLONG index,
1007                PFILE_RECORD_HEADER file);
1008
1009 NTSTATUS
1010 UpdateIndexEntryFileNameSize(PDEVICE_EXTENSION Vcb,
1011                              PFILE_RECORD_HEADER MftRecord,
1012                              PCHAR IndexRecord,
1013                              ULONG IndexBlockSize,
1014                              PINDEX_ENTRY_ATTRIBUTE FirstEntry,
1015                              PINDEX_ENTRY_ATTRIBUTE LastEntry,
1016                              PUNICODE_STRING FileName,
1017                              PULONG StartEntry,
1018                              PULONG CurrentEntry,
1019                              BOOLEAN DirSearch,
1020                              ULONGLONG NewDataSize,
1021                              ULONGLONG NewAllocatedSize,
1022                              BOOLEAN CaseSensitive);
1023
1024 NTSTATUS
1025 UpdateFileNameRecord(PDEVICE_EXTENSION Vcb,
1026                      ULONGLONG ParentMFTIndex,
1027                      PUNICODE_STRING FileName,
1028                      BOOLEAN DirSearch,
1029                      ULONGLONG NewDataSize,
1030                      ULONGLONG NewAllocationSize,
1031                      BOOLEAN CaseSensitive);
1032
1033 NTSTATUS
1034 UpdateFileRecord(PDEVICE_EXTENSION Vcb,
1035                  ULONGLONG MftIndex,
1036                  PFILE_RECORD_HEADER FileRecord);
1037
1038 NTSTATUS
1039 FindAttribute(PDEVICE_EXTENSION Vcb,
1040               PFILE_RECORD_HEADER MftRecord,
1041               ULONG Type,
1042               PCWSTR Name,
1043               ULONG NameLength,
1044               PNTFS_ATTR_CONTEXT * AttrCtx,
1045               PULONG Offset);
1046
1047 VOID
1048 ReadVCN(PDEVICE_EXTENSION Vcb,
1049         PFILE_RECORD_HEADER file,
1050         ATTRIBUTE_TYPE type,
1051         ULONGLONG vcn,
1052         ULONG count,
1053         PVOID buffer);
1054
1055 NTSTATUS
1056 FixupUpdateSequenceArray(PDEVICE_EXTENSION Vcb,
1057                          PNTFS_RECORD_HEADER Record);
1058
1059 NTSTATUS
1060 AddFixupArray(PDEVICE_EXTENSION Vcb,
1061               PNTFS_RECORD_HEADER Record);
1062
1063 NTSTATUS
1064 ReadLCN(PDEVICE_EXTENSION Vcb,
1065         ULONGLONG lcn,
1066         ULONG count,
1067         PVOID buffer);
1068
1069 VOID
1070 EnumerAttribute(PFILE_RECORD_HEADER file,
1071                 PDEVICE_EXTENSION Vcb,
1072                 PDEVICE_OBJECT DeviceObject);
1073
1074 NTSTATUS
1075 NtfsLookupFile(PDEVICE_EXTENSION Vcb,
1076                PUNICODE_STRING PathName,
1077                BOOLEAN CaseSensitive,
1078                PFILE_RECORD_HEADER *FileRecord,
1079                PULONGLONG MFTIndex);
1080
1081 NTSTATUS
1082 NtfsLookupFileAt(PDEVICE_EXTENSION Vcb,
1083                  PUNICODE_STRING PathName,
1084                  BOOLEAN CaseSensitive,
1085                  PFILE_RECORD_HEADER *FileRecord,
1086                  PULONGLONG MFTIndex,
1087                  ULONGLONG CurrentMFTIndex);
1088
1089 VOID
1090 NtfsDumpFileRecord(PDEVICE_EXTENSION Vcb,
1091                    PFILE_RECORD_HEADER FileRecord);
1092
1093 NTSTATUS
1094 NtfsFindFileAt(PDEVICE_EXTENSION Vcb,
1095                PUNICODE_STRING SearchPattern,
1096                PULONG FirstEntry,
1097                PFILE_RECORD_HEADER *FileRecord,
1098                PULONGLONG MFTIndex,
1099                ULONGLONG CurrentMFTIndex,
1100                BOOLEAN CaseSensitive);
1101
1102 NTSTATUS
1103 NtfsFindMftRecord(PDEVICE_EXTENSION Vcb,
1104                   ULONGLONG MFTIndex,
1105                   PUNICODE_STRING FileName,
1106                   PULONG FirstEntry,
1107                   BOOLEAN DirSearch,
1108                   BOOLEAN CaseSensitive,
1109                   ULONGLONG *OutMFTIndex);
1110
1111 /* misc.c */
1112
1113 BOOLEAN
1114 NtfsIsIrpTopLevel(PIRP Irp);
1115
1116 PNTFS_IRP_CONTEXT
1117 NtfsAllocateIrpContext(PDEVICE_OBJECT DeviceObject,
1118                        PIRP Irp);
1119
1120 PVOID
1121 NtfsGetUserBuffer(PIRP Irp,
1122                   BOOLEAN Paging);
1123
1124 NTSTATUS
1125 NtfsLockUserBuffer(IN PIRP Irp,
1126                    IN ULONG Length,
1127                    IN LOCK_OPERATION Operation);
1128
1129 #if 0
1130 BOOLEAN
1131 wstrcmpjoki(PWSTR s1, PWSTR s2);
1132
1133 VOID
1134 CdfsSwapString(PWCHAR Out,
1135                PUCHAR In,
1136                ULONG Count);
1137 #endif
1138
1139 VOID
1140 NtfsFileFlagsToAttributes(ULONG NtfsAttributes,
1141                           PULONG FileAttributes);
1142
1143
1144 /* rw.c */
1145
1146 NTSTATUS
1147 NtfsRead(PNTFS_IRP_CONTEXT IrpContext);
1148
1149 NTSTATUS
1150 NtfsWrite(PNTFS_IRP_CONTEXT IrpContext);
1151
1152
1153 /* volinfo.c */
1154
1155 NTSTATUS
1156 NtfsAllocateClusters(PDEVICE_EXTENSION DeviceExt,
1157                      ULONG FirstDesiredCluster,
1158                      ULONG DesiredClusters,
1159                      PULONG FirstAssignedCluster,
1160                      PULONG AssignedClusters);
1161
1162 ULONGLONG
1163 NtfsGetFreeClusters(PDEVICE_EXTENSION DeviceExt);
1164
1165 NTSTATUS
1166 NtfsQueryVolumeInformation(PNTFS_IRP_CONTEXT IrpContext);
1167
1168 NTSTATUS
1169 NtfsSetVolumeInformation(PNTFS_IRP_CONTEXT IrpContext);
1170
1171
1172 /* ntfs.c */
1173
1174 DRIVER_INITIALIZE DriverEntry;
1175
1176 VOID
1177 NTAPI
1178 NtfsInitializeFunctionPointers(PDRIVER_OBJECT DriverObject);
1179
1180 #endif /* NTFS_H */