drivers/filesystems/ntfs/ntfs.h

   1 #ifndef NTFS_H
   2 #define NTFS_H
   3
   4 #include <ntifs.h>
   5 #include <pseh/pseh2.h>
   6
   7 #ifdef __GNUC__
   8 #define INIT_SECTION __attribute__((section ("INIT")))
   9 #else
  10 #define INIT_SECTION /* Done via alloc_text for MSC */
  11 #endif
  12
  13 #define CACHEPAGESIZE(pDeviceExt) \
  14         ((pDeviceExt)->NtfsInfo.UCHARsPerCluster > PAGE_SIZE ? \
  15          (pDeviceExt)->NtfsInfo.UCHARsPerCluster : PAGE_SIZE)
  16
  17 #define TAG_NTFS 'SFTN'
  18
  19 #define ROUND_UP(N, S) ((((N) + (S) - 1) / (S)) * (S))
  20 #define ROUND_DOWN(N, S) ((N) - ((N) % (S)))
  21
  22 #define DEVICE_NAME L"\\Ntfs"
  23
  24 #include <pshpack1.h>
  25 typedef struct _BIOS_PARAMETERS_BLOCK
  26 {
  27     USHORT    BytesPerSector;                   // 0x0B
  28     UCHAR     SectorsPerCluster;                // 0x0D
  29     UCHAR     Unused0[7];                               // 0x0E, checked when volume is mounted
  30     UCHAR     MediaId;                          // 0x15
  31     UCHAR     Unused1[2];                               // 0x16
  32     USHORT    SectorsPerTrack;          // 0x18
  33     USHORT    Heads;                                    // 0x1A
  34     UCHAR     Unused2[4];                               // 0x1C
  35     UCHAR     Unused3[4];                               // 0x20, checked when volume is mounted
  36 } BIOS_PARAMETERS_BLOCK, *PBIOS_PARAMETERS_BLOCK;
  37
  38 typedef struct _EXTENDED_BIOS_PARAMETERS_BLOCK
  39 {
  40     USHORT    Unknown[2];                               // 0x24, always 80 00 80 00
  41     ULONGLONG SectorCount;                      // 0x28
  42     ULONGLONG MftLocation;                      // 0x30
  43     ULONGLONG MftMirrLocation;          // 0x38
  44     CHAR      ClustersPerMftRecord;     // 0x40
  45     UCHAR     Unused4[3];                               // 0x41
  46     CHAR      ClustersPerIndexRecord; // 0x44
  47     UCHAR     Unused5[3];                               // 0x45
  48     ULONGLONG SerialNumber;                     // 0x48
  49     UCHAR     Checksum[4];                      // 0x50
  50 } EXTENDED_BIOS_PARAMETERS_BLOCK, *PEXTENDED_BIOS_PARAMETERS_BLOCK;
  51
  52 typedef struct _BOOT_SECTOR
  53 {
  54     UCHAR     Jump[3];                          // 0x00
  55     UCHAR     OEMID[8];                         // 0x03
  56     BIOS_PARAMETERS_BLOCK BPB;
  57     EXTENDED_BIOS_PARAMETERS_BLOCK EBPB;
  58     UCHAR     BootStrap[426];                   // 0x54
  59     USHORT    EndSector;                                // 0x1FE
  60 } BOOT_SECTOR, *PBOOT_SECTOR;
  61 #include <poppack.h>
  62
  63 //typedef struct _BootSector BootSector;
  64
  65 typedef struct _NTFS_INFO
  66 {
  67     ULONG BytesPerSector;
  68     ULONG SectorsPerCluster;
  69     ULONG BytesPerCluster;
  70     ULONGLONG SectorCount;
  71     ULONGLONG ClusterCount;
  72     ULARGE_INTEGER MftStart;
  73     ULARGE_INTEGER MftMirrStart;
  74     ULONG BytesPerFileRecord;
  75     ULONG BytesPerIndexRecord;
  76
  77     ULONGLONG SerialNumber;
  78     USHORT VolumeLabelLength;
  79     WCHAR VolumeLabel[MAXIMUM_VOLUME_LABEL_LENGTH];
  80     UCHAR MajorVersion;
  81     UCHAR MinorVersion;
  82     USHORT Flags;
  83
  84     ULONG MftZoneReservation;
  85 } NTFS_INFO, *PNTFS_INFO;
  86
  87 #define NTFS_TYPE_CCB         '20SF'
  88 #define NTFS_TYPE_FCB         '30SF'
  89 #define NTFS_TYPE_VCB         '50SF'
  90 #define NTFS_TYPE_IRP_CONTEXT '60SF'
  91 #define NTFS_TYPE_GLOBAL_DATA '70SF'
  92
  93 typedef struct
  94 {
  95     ULONG Type;
  96     ULONG Size;
  97 } NTFSIDENTIFIER, *PNTFSIDENTIFIER;
  98
  99 typedef struct
 100 {
 101     NTFSIDENTIFIER Identifier;
 102
 103     ERESOURCE DirResource;
 104 //    ERESOURCE FatResource;
 105
 106     KSPIN_LOCK FcbListLock;
 107     LIST_ENTRY FcbListHead;
 108
 109     PVPB Vpb;
 110     PDEVICE_OBJECT StorageDevice;
 111     PFILE_OBJECT StreamFileObject;
 112
 113     struct _NTFS_ATTR_CONTEXT* MFTContext;
 114     struct _FILE_RECORD_HEADER* MasterFileTable;
 115     struct _FCB *VolumeFcb;
 116
 117     NTFS_INFO NtfsInfo;
 118
 119     ULONG MftDataOffset;
 120     ULONG Flags;
 121     ULONG OpenHandleCount;
 122
 123 } DEVICE_EXTENSION, *PDEVICE_EXTENSION, NTFS_VCB, *PNTFS_VCB;
 124
 125 #define VCB_VOLUME_LOCKED       0x0001
 126
 127 typedef struct
 128 {
 129     NTFSIDENTIFIER Identifier;
 130     LIST_ENTRY     NextCCB;
 131     PFILE_OBJECT   PtrFileObject;
 132     LARGE_INTEGER  CurrentByteOffset;
 133     /* for DirectoryControl */
 134     ULONG Entry;
 135     /* for DirectoryControl */
 136     PWCHAR DirectorySearchPattern;
 137     ULONG LastCluster;
 138     ULONG LastOffset;
 139 } NTFS_CCB, *PNTFS_CCB;
 140
 141 #define TAG_CCB 'BCCI'
 142 #define TAG_FCB 'BCFI'
 143
 144 typedef struct
 145 {
 146     NTFSIDENTIFIER Identifier;
 147     ERESOURCE Resource;
 148     PDRIVER_OBJECT DriverObject;
 149     PDEVICE_OBJECT DeviceObject;
 150     CACHE_MANAGER_CALLBACKS CacheMgrCallbacks;
 151     ULONG Flags;
 152     FAST_IO_DISPATCH FastIoDispatch;
 153     NPAGED_LOOKASIDE_LIST IrpContextLookasideList;
 154     NPAGED_LOOKASIDE_LIST FcbLookasideList;
 155     BOOLEAN EnableWriteSupport;
 156 } NTFS_GLOBAL_DATA, *PNTFS_GLOBAL_DATA;
 157
 158
 159 typedef enum
 160 {
 161     AttributeStandardInformation = 0x10,
 162     AttributeAttributeList = 0x20,
 163     AttributeFileName = 0x30,
 164     AttributeObjectId = 0x40,
 165     AttributeSecurityDescriptor = 0x50,
 166     AttributeVolumeName = 0x60,
 167     AttributeVolumeInformation = 0x70,
 168     AttributeData = 0x80,
 169     AttributeIndexRoot = 0x90,
 170     AttributeIndexAllocation = 0xA0,
 171     AttributeBitmap = 0xB0,
 172     AttributeReparsePoint = 0xC0,
 173     AttributeEAInformation = 0xD0,
 174     AttributeEA = 0xE0,
 175     AttributePropertySet = 0xF0,
 176     AttributeLoggedUtilityStream = 0x100,
 177     AttributeEnd = 0xFFFFFFFF
 178 } ATTRIBUTE_TYPE, *PATTRIBUTE_TYPE;
 179
 180 // FILE_RECORD_END seems to follow AttributeEnd in every file record starting with $Quota.
 181 // No clue what data is being represented here.
 182 #define FILE_RECORD_END              0x11477982
 183
 184 #define NTFS_FILE_MFT                0
 185 #define NTFS_FILE_MFTMIRR            1
 186 #define NTFS_FILE_LOGFILE            2
 187 #define NTFS_FILE_VOLUME            3
 188 #define NTFS_FILE_ATTRDEF            4
 189 #define NTFS_FILE_ROOT                5
 190 #define NTFS_FILE_BITMAP            6
 191 #define NTFS_FILE_BOOT                7
 192 #define NTFS_FILE_BADCLUS            8
 193 #define NTFS_FILE_QUOTA                9
 194 #define NTFS_FILE_UPCASE            10
 195 #define NTFS_FILE_EXTEND            11
 196
 197 #define NTFS_MFT_MASK 0x0000FFFFFFFFFFFFULL
 198
 199 #define COLLATION_BINARY              0x00
 200 #define COLLATION_FILE_NAME           0x01
 201 #define COLLATION_UNICODE_STRING      0x02
 202 #define COLLATION_NTOFS_ULONG         0x10
 203 #define COLLATION_NTOFS_SID           0x11
 204 #define COLLATION_NTOFS_SECURITY_HASH 0x12
 205 #define COLLATION_NTOFS_ULONGS        0x13
 206
 207 #define INDEX_ROOT_SMALL 0x0
 208 #define INDEX_ROOT_LARGE 0x1
 209
 210 #define NTFS_INDEX_ENTRY_NODE            1
 211 #define NTFS_INDEX_ENTRY_END            2
 212
 213 #define NTFS_FILE_NAME_POSIX            0
 214 #define NTFS_FILE_NAME_WIN32            1
 215 #define NTFS_FILE_NAME_DOS            2
 216 #define NTFS_FILE_NAME_WIN32_AND_DOS        3
 217
 218 #define NTFS_FILE_TYPE_READ_ONLY  0x1
 219 #define NTFS_FILE_TYPE_HIDDEN     0x2
 220 #define NTFS_FILE_TYPE_SYSTEM     0x4
 221 #define NTFS_FILE_TYPE_ARCHIVE    0x20
 222 #define NTFS_FILE_TYPE_REPARSE    0x400
 223 #define NTFS_FILE_TYPE_COMPRESSED 0x800
 224 #define NTFS_FILE_TYPE_DIRECTORY  0x10000000
 225
 226 typedef struct
 227 {
 228     ULONG Type;             /* Magic number 'FILE' */
 229     USHORT UsaOffset;       /* Offset to the update sequence */
 230     USHORT UsaCount;        /* Size in words of Update Sequence Number & Array (S) */
 231     ULONGLONG Lsn;          /* $LogFile Sequence Number (LSN) */
 232 } NTFS_RECORD_HEADER, *PNTFS_RECORD_HEADER;
 233
 234 /* NTFS_RECORD_HEADER.Type */
 235 #define NRH_FILE_TYPE  0x454C4946  /* 'FILE' */
 236 #define NRH_INDX_TYPE  0x58444E49  /* 'INDX' */
 237
 238
 239 typedef struct _FILE_RECORD_HEADER
 240 {
 241     NTFS_RECORD_HEADER Ntfs;
 242     USHORT SequenceNumber;        /* Sequence number */
 243     USHORT LinkCount;             /* Hard link count */
 244     USHORT AttributeOffset;       /* Offset to the first Attribute */
 245     USHORT Flags;                 /* Flags */
 246     ULONG BytesInUse;             /* Real size of the FILE record */
 247     ULONG BytesAllocated;         /* Allocated size of the FILE record */
 248     ULONGLONG BaseFileRecord;     /* File reference to the base FILE record */
 249     USHORT NextAttributeNumber;   /* Next Attribute Id */
 250     USHORT Padding;               /* Align to 4 UCHAR boundary (XP) */
 251     ULONG MFTRecordNumber;        /* Number of this MFT Record (XP) */
 252 } FILE_RECORD_HEADER, *PFILE_RECORD_HEADER;
 253
 254 /* Flags in FILE_RECORD_HEADER */
 255
 256 #define FRH_IN_USE    0x0001    /* Record is in use */
 257 #define FRH_DIRECTORY 0x0002    /* Record is a directory */
 258 #define FRH_UNKNOWN1  0x0004    /* Don't know */
 259 #define FRH_UNKNOWN2  0x0008    /* Don't know */
 260
 261 typedef struct
 262 {
 263     ULONG        Type;
 264     ULONG        Length;
 265     UCHAR        IsNonResident;
 266     UCHAR        NameLength;
 267     USHORT        NameOffset;
 268     USHORT        Flags;
 269     USHORT        Instance;
 270     union
 271     {
 272         // Resident attributes
 273         struct
 274         {
 275             ULONG        ValueLength;
 276             USHORT        ValueOffset;
 277             UCHAR        Flags;
 278             UCHAR        Reserved;
 279         } Resident;
 280         // Non-resident attributes
 281         struct
 282         {
 283             ULONGLONG        LowestVCN;
 284             ULONGLONG        HighestVCN;
 285             USHORT        MappingPairsOffset;
 286             USHORT        CompressionUnit;
 287             UCHAR        Reserved[4];
 288             LONGLONG        AllocatedSize;
 289             LONGLONG        DataSize;
 290             LONGLONG        InitializedSize;
 291             LONGLONG        CompressedSize;
 292         } NonResident;
 293     };
 294 } NTFS_ATTR_RECORD, *PNTFS_ATTR_RECORD;
 295
 296 // The beginning and length of an attribute record are always aligned to an 8-byte boundary,
 297 // relative to the beginning of the file record.
 298 #define ATTR_RECORD_ALIGNMENT 8
 299
 300 typedef struct
 301 {
 302     ULONGLONG CreationTime;
 303     ULONGLONG ChangeTime;
 304     ULONGLONG LastWriteTime;
 305     ULONGLONG LastAccessTime;
 306     ULONG FileAttribute;
 307     ULONG AlignmentOrReserved[3];
 308 #if 0
 309     ULONG QuotaId;
 310     ULONG SecurityId;
 311     ULONGLONG QuotaCharge;
 312     USN Usn;
 313 #endif
 314 } STANDARD_INFORMATION, *PSTANDARD_INFORMATION;
 315
 316
 317 typedef struct
 318 {
 319     ATTRIBUTE_TYPE AttributeType;
 320     USHORT Length;
 321     UCHAR NameLength;
 322     UCHAR NameOffset;
 323     ULONGLONG StartVcn; // LowVcn
 324     ULONGLONG FileReferenceNumber;
 325     USHORT AttributeNumber;
 326     USHORT AlignmentOrReserved[3];
 327 } ATTRIBUTE_LIST, *PATTRIBUTE_LIST;
 328
 329
 330 typedef struct
 331 {
 332     ULONGLONG DirectoryFileReferenceNumber;
 333     ULONGLONG CreationTime;
 334     ULONGLONG ChangeTime;
 335     ULONGLONG LastWriteTime;
 336     ULONGLONG LastAccessTime;
 337     ULONGLONG AllocatedSize;
 338     ULONGLONG DataSize;
 339     ULONG FileAttributes;
 340     union
 341     {
 342         struct
 343         {
 344             USHORT PackedEaSize;
 345             USHORT AlignmentOrReserved;
 346         } EaInfo;
 347         ULONG ReparseTag;
 348     } Extended;
 349     UCHAR NameLength;
 350     UCHAR NameType;
 351     WCHAR Name[1];
 352 } FILENAME_ATTRIBUTE, *PFILENAME_ATTRIBUTE;
 353
 354 typedef struct
 355 {
 356     ULONG FirstEntryOffset;
 357     ULONG TotalSizeOfEntries;
 358     ULONG AllocatedSize;
 359     UCHAR Flags;
 360     UCHAR Padding[3];
 361 } INDEX_HEADER_ATTRIBUTE, *PINDEX_HEADER_ATTRIBUTE;
 362
 363 typedef struct
 364 {
 365     ULONG AttributeType;
 366     ULONG CollationRule;
 367     ULONG SizeOfEntry;
 368     UCHAR ClustersPerIndexRecord;
 369     UCHAR Padding[3];
 370     INDEX_HEADER_ATTRIBUTE Header;
 371 } INDEX_ROOT_ATTRIBUTE, *PINDEX_ROOT_ATTRIBUTE;
 372
 373 typedef struct
 374 {
 375     NTFS_RECORD_HEADER Ntfs;
 376     ULONGLONG VCN;
 377     INDEX_HEADER_ATTRIBUTE Header;
 378 } INDEX_BUFFER, *PINDEX_BUFFER;
 379
 380 typedef struct
 381 {
 382     union
 383     {
 384         struct
 385         {
 386             ULONGLONG    IndexedFile;
 387         } Directory;
 388         struct
 389         {
 390             USHORT    DataOffset;
 391             USHORT    DataLength;
 392             ULONG    Reserved;
 393         } ViewIndex;
 394     } Data;
 395     USHORT            Length;
 396     USHORT            KeyLength;
 397     USHORT            Flags;
 398     USHORT            Reserved;
 399     FILENAME_ATTRIBUTE    FileName;
 400 } INDEX_ENTRY_ATTRIBUTE, *PINDEX_ENTRY_ATTRIBUTE;
 401
 402 // Keys are arranged in nodes as an ordered, linked list
 403 typedef struct _B_TREE_KEY
 404 {
 405     struct _B_TREE_KEY *NextKey;
 406     // PB_TREE_FILENAME_NODE LesserChild; // we aren't worried about multi-level trees yet
 407     PINDEX_ENTRY_ATTRIBUTE IndexEntry;   // must be last member for FIELD_OFFSET
 408 }B_TREE_KEY, *PB_TREE_KEY;
 409
 410 // Every Node is just an ordered list of keys.
 411 // Sub-nodes can be found attached to a key (if they exist).
 412 // A key's sub-node precedes that key in the ordered list.
 413 typedef struct
 414 {
 415     ULONG KeyCount;
 416     PB_TREE_KEY FirstKey;
 417 } B_TREE_FILENAME_NODE, *PB_TREE_FILENAME_NODE;
 418
 419 typedef struct
 420 {
 421     PB_TREE_FILENAME_NODE RootNode;
 422 } B_TREE, *PB_TREE;
 423
 424 typedef struct
 425 {
 426     ULONGLONG Unknown1;
 427     UCHAR MajorVersion;
 428     UCHAR MinorVersion;
 429     USHORT Flags;
 430     ULONG Unknown2;
 431 } VOLINFO_ATTRIBUTE, *PVOLINFO_ATTRIBUTE;
 432
 433 typedef struct {
 434     ULONG ReparseTag;
 435     USHORT DataLength;
 436     USHORT Reserved;
 437     UCHAR Data[1];
 438 } REPARSE_POINT_ATTRIBUTE, *PREPARSE_POINT_ATTRIBUTE;
 439
 440 #define IRPCONTEXT_CANWAIT 0x1
 441 #define IRPCONTEXT_COMPLETE 0x2
 442 #define IRPCONTEXT_QUEUE 0x4
 443
 444 typedef struct
 445 {
 446     NTFSIDENTIFIER Identifier;
 447     ULONG Flags;
 448     PIO_STACK_LOCATION Stack;
 449     UCHAR MajorFunction;
 450     UCHAR MinorFunction;
 451     WORK_QUEUE_ITEM WorkQueueItem;
 452     PIRP Irp;
 453     BOOLEAN IsTopLevel;
 454     PDEVICE_OBJECT DeviceObject;
 455     PFILE_OBJECT FileObject;
 456     NTSTATUS SavedExceptionCode;
 457     CCHAR PriorityBoost;
 458 } NTFS_IRP_CONTEXT, *PNTFS_IRP_CONTEXT;
 459
 460 typedef struct _NTFS_ATTR_CONTEXT
 461 {
 462     PUCHAR            CacheRun;
 463     ULONGLONG            CacheRunOffset;
 464     LONGLONG            CacheRunStartLCN;
 465     ULONGLONG            CacheRunLength;
 466     LONGLONG            CacheRunLastLCN;
 467     ULONGLONG            CacheRunCurrentOffset;
 468     LARGE_MCB           DataRunsMCB;
 469     ULONGLONG           FileMFTIndex;
 470     NTFS_ATTR_RECORD    Record;
 471 } NTFS_ATTR_CONTEXT, *PNTFS_ATTR_CONTEXT;
 472
 473 #define FCB_CACHE_INITIALIZED   0x0001
 474 #define FCB_IS_VOLUME_STREAM    0x0002
 475 #define FCB_IS_VOLUME           0x0004
 476 #define MAX_PATH                260
 477
 478 typedef struct _FCB
 479 {
 480     NTFSIDENTIFIER Identifier;
 481
 482     FSRTL_COMMON_FCB_HEADER RFCB;
 483     SECTION_OBJECT_POINTERS SectionObjectPointers;
 484
 485     PFILE_OBJECT FileObject;
 486     PNTFS_VCB Vcb;
 487
 488     WCHAR Stream[MAX_PATH];
 489     WCHAR *ObjectName;          /* point on filename (250 chars max) in PathName */
 490     WCHAR PathName[MAX_PATH];   /* path+filename 260 max */
 491
 492     ERESOURCE PagingIoResource;
 493     ERESOURCE MainResource;
 494
 495     LIST_ENTRY FcbListEntry;
 496     struct _FCB* ParentFcb;
 497
 498     ULONG DirIndex;
 499
 500     LONG RefCount;
 501     ULONG Flags;
 502     ULONG OpenHandleCount;
 503
 504     ULONGLONG MFTIndex;
 505     USHORT LinkCount;
 506
 507     FILENAME_ATTRIBUTE Entry;
 508
 509 } NTFS_FCB, *PNTFS_FCB;
 510
 511 typedef struct _FIND_ATTR_CONTXT
 512 {
 513     PDEVICE_EXTENSION Vcb;
 514     BOOLEAN OnlyResident;
 515     PNTFS_ATTR_RECORD FirstAttr;
 516     PNTFS_ATTR_RECORD CurrAttr;
 517     PNTFS_ATTR_RECORD LastAttr;
 518     PNTFS_ATTR_RECORD NonResidentStart;
 519     PNTFS_ATTR_RECORD NonResidentEnd;
 520     ULONG Offset;
 521 } FIND_ATTR_CONTXT, *PFIND_ATTR_CONTXT;
 522
 523 typedef struct
 524 {
 525     USHORT USN;
 526     USHORT Array[];
 527 } FIXUP_ARRAY, *PFIXUP_ARRAY;
 528
 529 extern PNTFS_GLOBAL_DATA NtfsGlobalData;
 530
 531 FORCEINLINE
 532 NTSTATUS
 533 NtfsMarkIrpContextForQueue(PNTFS_IRP_CONTEXT IrpContext)
 534 {
 535     PULONG Flags = &IrpContext->Flags;
 536
 537     *Flags &= ~IRPCONTEXT_COMPLETE;
 538     *Flags |= IRPCONTEXT_QUEUE;
 539
 540     return STATUS_PENDING;
 541 }
 542
 543 /* attrib.c */
 544
 545 //VOID
 546 //NtfsDumpAttribute(PATTRIBUTE Attribute);
 547
 548 NTSTATUS
 549 AddData(PFILE_RECORD_HEADER FileRecord,
 550         PNTFS_ATTR_RECORD AttributeAddress);
 551
 552 NTSTATUS
 553 AddRun(PNTFS_VCB Vcb,
 554        PNTFS_ATTR_CONTEXT AttrContext,
 555        ULONG AttrOffset,
 556        PFILE_RECORD_HEADER FileRecord,
 557        ULONGLONG NextAssignedCluster,
 558        ULONG RunLength);
 559
 560 NTSTATUS
 561 AddFileName(PFILE_RECORD_HEADER FileRecord,
 562             PNTFS_ATTR_RECORD AttributeAddress,
 563             PDEVICE_EXTENSION DeviceExt,
 564             PFILE_OBJECT FileObject,
 565             BOOLEAN CaseSensitive,
 566             PULONGLONG ParentMftIndex);
 567
 568 NTSTATUS
 569 AddStandardInformation(PFILE_RECORD_HEADER FileRecord,
 570                        PNTFS_ATTR_RECORD AttributeAddress);
 571
 572 NTSTATUS
 573 ConvertDataRunsToLargeMCB(PUCHAR DataRun,
 574                           PLARGE_MCB DataRunsMCB,
 575                           PULONGLONG pNextVBN);
 576
 577 NTSTATUS
 578 ConvertLargeMCBToDataRuns(PLARGE_MCB DataRunsMCB,
 579                           PUCHAR RunBuffer,
 580                           ULONG MaxBufferSize,
 581                           PULONG UsedBufferSize);
 582
 583 PUCHAR
 584 DecodeRun(PUCHAR DataRun,
 585           LONGLONG *DataRunOffset,
 586           ULONGLONG *DataRunLength);
 587
 588 ULONG GetFileNameAttributeLength(PFILENAME_ATTRIBUTE FileNameAttribute);
 589
 590 VOID
 591 NtfsDumpDataRuns(PVOID StartOfRun,
 592                  ULONGLONG CurrentLCN);
 593
 594 VOID
 595 NtfsDumpFileAttributes(PDEVICE_EXTENSION Vcb,
 596                        PFILE_RECORD_HEADER FileRecord);
 597
 598 PSTANDARD_INFORMATION
 599 GetStandardInformationFromRecord(PDEVICE_EXTENSION Vcb,
 600                                  PFILE_RECORD_HEADER FileRecord);
 601
 602 PFILENAME_ATTRIBUTE
 603 GetFileNameFromRecord(PDEVICE_EXTENSION Vcb,
 604                       PFILE_RECORD_HEADER FileRecord,
 605                       UCHAR NameType);
 606
 607 UCHAR
 608 GetPackedByteCount(LONGLONG NumberToPack,
 609                    BOOLEAN IsSigned);
 610
 611 NTSTATUS
 612 GetLastClusterInDataRun(PDEVICE_EXTENSION Vcb,
 613                         PNTFS_ATTR_RECORD Attribute,
 614                         PULONGLONG LastCluster);
 615
 616 PFILENAME_ATTRIBUTE
 617 GetBestFileNameFromRecord(PDEVICE_EXTENSION Vcb,
 618                           PFILE_RECORD_HEADER FileRecord);
 619
 620 NTSTATUS
 621 FindFirstAttribute(PFIND_ATTR_CONTXT Context,
 622                    PDEVICE_EXTENSION Vcb,
 623                    PFILE_RECORD_HEADER FileRecord,
 624                    BOOLEAN OnlyResident,
 625                    PNTFS_ATTR_RECORD * Attribute);
 626
 627 NTSTATUS
 628 FindNextAttribute(PFIND_ATTR_CONTXT Context,
 629                   PNTFS_ATTR_RECORD * Attribute);
 630
 631 VOID
 632 FindCloseAttribute(PFIND_ATTR_CONTXT Context);
 633
 634 NTSTATUS
 635 FreeClusters(PNTFS_VCB Vcb,
 636              PNTFS_ATTR_CONTEXT AttrContext,
 637              ULONG AttrOffset,
 638              PFILE_RECORD_HEADER FileRecord,
 639              ULONG ClustersToFree);
 640
 641 /* blockdev.c */
 642
 643 NTSTATUS
 644 NtfsReadDisk(IN PDEVICE_OBJECT DeviceObject,
 645              IN LONGLONG StartingOffset,
 646              IN ULONG Length,
 647              IN ULONG SectorSize,
 648              IN OUT PUCHAR Buffer,
 649              IN BOOLEAN Override);
 650
 651 NTSTATUS
 652 NtfsWriteDisk(IN PDEVICE_OBJECT DeviceObject,
 653               IN LONGLONG StartingOffset,
 654               IN ULONG Length,
 655               IN ULONG SectorSize,
 656               IN const PUCHAR Buffer);
 657
 658 NTSTATUS
 659 NtfsReadSectors(IN PDEVICE_OBJECT DeviceObject,
 660                 IN ULONG DiskSector,
 661                 IN ULONG SectorCount,
 662                 IN ULONG SectorSize,
 663                 IN OUT PUCHAR Buffer,
 664                 IN BOOLEAN Override);
 665
 666 NTSTATUS
 667 NtfsDeviceIoControl(IN PDEVICE_OBJECT DeviceObject,
 668                     IN ULONG ControlCode,
 669                     IN PVOID InputBuffer,
 670                     IN ULONG InputBufferSize,
 671                     IN OUT PVOID OutputBuffer,
 672                     IN OUT PULONG OutputBufferSize,
 673                     IN BOOLEAN Override);
 674
 675
 676 /* btree.c */
 677
 678 LONG
 679 CompareTreeKeys(PB_TREE_KEY Key1,
 680                 PB_TREE_KEY Key2,
 681                 BOOLEAN CaseSensitive);
 682
 683 NTSTATUS
 684 CreateBTreeFromIndex(/*PDEVICE_EXTENSION Vcb,*/
 685                      PNTFS_ATTR_CONTEXT IndexRootContext,
 686                      PINDEX_ROOT_ATTRIBUTE IndexRoot,
 687                      PB_TREE *NewTree);
 688
 689 NTSTATUS
 690 CreateIndexRootFromBTree(PDEVICE_EXTENSION DeviceExt,
 691                          PB_TREE Tree,
 692                          ULONG MaxIndexSize,
 693                          PINDEX_ROOT_ATTRIBUTE *IndexRoot,
 694                          ULONG *Length);
 695
 696 VOID
 697 DestroyBTree(PB_TREE Tree);
 698
 699 VOID
 700 DumpBTree(PB_TREE Tree);
 701
 702 NTSTATUS
 703 NtfsInsertKey(ULONGLONG FileReference,
 704               PFILENAME_ATTRIBUTE FileNameAttribute,
 705               PB_TREE_FILENAME_NODE Node,
 706               BOOLEAN CaseSensitive);
 707
 708 /* close.c */
 709
 710 NTSTATUS
 711 NtfsCleanup(PNTFS_IRP_CONTEXT IrpContext);
 712
 713
 714 /* close.c */
 715
 716 NTSTATUS
 717 NtfsCloseFile(PDEVICE_EXTENSION DeviceExt,
 718               PFILE_OBJECT FileObject);
 719
 720 NTSTATUS
 721 NtfsClose(PNTFS_IRP_CONTEXT IrpContext);
 722
 723
 724 /* create.c */
 725
 726 NTSTATUS
 727 NtfsCreate(PNTFS_IRP_CONTEXT IrpContext);
 728
 729 NTSTATUS
 730 NtfsCreateFileRecord(PDEVICE_EXTENSION DeviceExt,
 731                      PFILE_OBJECT FileObject,
 732                      BOOLEAN CaseSensitive,
 733                      BOOLEAN CanWait);
 734
 735 /* devctl.c */
 736
 737 NTSTATUS
 738 NtfsDeviceControl(PNTFS_IRP_CONTEXT IrpContext);
 739
 740
 741 /* dirctl.c */
 742
 743 NTSTATUS
 744 NtfsAddFilenameToDirectory(PDEVICE_EXTENSION DeviceExt,
 745                            ULONGLONG DirectoryMftIndex,
 746                            ULONGLONG FileReferenceNumber,
 747                            PFILENAME_ATTRIBUTE FilenameAttribute,
 748                            BOOLEAN CaseSensitive);
 749
 750 ULONGLONG
 751 NtfsGetFileSize(PDEVICE_EXTENSION DeviceExt,
 752                 PFILE_RECORD_HEADER FileRecord,
 753                 PCWSTR Stream,
 754                 ULONG StreamLength,
 755                 PULONGLONG AllocatedSize);
 756
 757 NTSTATUS
 758 NtfsDirectoryControl(PNTFS_IRP_CONTEXT IrpContext);
 759
 760
 761 /* dispatch.c */
 762
 763 DRIVER_DISPATCH NtfsFsdDispatch;
 764 NTSTATUS NTAPI
 765 NtfsFsdDispatch(PDEVICE_OBJECT DeviceObject,
 766                 PIRP Irp);
 767
 768
 769 /* fastio.c */
 770
 771 BOOLEAN NTAPI
 772 NtfsAcqLazyWrite(PVOID Context,
 773                  BOOLEAN Wait);
 774
 775 VOID NTAPI
 776 NtfsRelLazyWrite(PVOID Context);
 777
 778 BOOLEAN NTAPI
 779 NtfsAcqReadAhead(PVOID Context,
 780                  BOOLEAN Wait);
 781
 782 VOID NTAPI
 783 NtfsRelReadAhead(PVOID Context);
 784
 785 FAST_IO_CHECK_IF_POSSIBLE NtfsFastIoCheckIfPossible;
 786 FAST_IO_READ NtfsFastIoRead;
 787 FAST_IO_WRITE NtfsFastIoWrite;
 788
 789
 790 /* fcb.c */
 791
 792 PNTFS_FCB
 793 NtfsCreateFCB(PCWSTR FileName,
 794               PCWSTR Stream,
 795               PNTFS_VCB Vcb);
 796
 797 VOID
 798 NtfsDestroyFCB(PNTFS_FCB Fcb);
 799
 800 BOOLEAN
 801 NtfsFCBIsDirectory(PNTFS_FCB Fcb);
 802
 803 BOOLEAN
 804 NtfsFCBIsReparsePoint(PNTFS_FCB Fcb);
 805
 806 BOOLEAN
 807 NtfsFCBIsCompressed(PNTFS_FCB Fcb);
 808
 809 BOOLEAN
 810 NtfsFCBIsRoot(PNTFS_FCB Fcb);
 811
 812 VOID
 813 NtfsGrabFCB(PNTFS_VCB Vcb,
 814             PNTFS_FCB Fcb);
 815
 816 VOID
 817 NtfsReleaseFCB(PNTFS_VCB Vcb,
 818                PNTFS_FCB Fcb);
 819
 820 VOID
 821 NtfsAddFCBToTable(PNTFS_VCB Vcb,
 822                   PNTFS_FCB Fcb);
 823
 824 PNTFS_FCB
 825 NtfsGrabFCBFromTable(PNTFS_VCB Vcb,
 826                      PCWSTR FileName);
 827
 828 NTSTATUS
 829 NtfsFCBInitializeCache(PNTFS_VCB Vcb,
 830                        PNTFS_FCB Fcb);
 831
 832 PNTFS_FCB
 833 NtfsMakeRootFCB(PNTFS_VCB Vcb);
 834
 835 PNTFS_FCB
 836 NtfsOpenRootFCB(PNTFS_VCB Vcb);
 837
 838 NTSTATUS
 839 NtfsAttachFCBToFileObject(PNTFS_VCB Vcb,
 840                           PNTFS_FCB Fcb,
 841                           PFILE_OBJECT FileObject);
 842
 843 NTSTATUS
 844 NtfsGetFCBForFile(PNTFS_VCB Vcb,
 845                   PNTFS_FCB *pParentFCB,
 846                   PNTFS_FCB *pFCB,
 847                   PCWSTR pFileName,
 848                   BOOLEAN CaseSensitive);
 849
 850 NTSTATUS
 851 NtfsReadFCBAttribute(PNTFS_VCB Vcb,
 852                      PNTFS_FCB pFCB,
 853                      ULONG Type,
 854                      PCWSTR Name,
 855                      ULONG NameLength,
 856                      PVOID * Data);
 857
 858 NTSTATUS
 859 NtfsMakeFCBFromDirEntry(PNTFS_VCB Vcb,
 860                         PNTFS_FCB DirectoryFCB,
 861                         PUNICODE_STRING Name,
 862                         PCWSTR Stream,
 863                         PFILE_RECORD_HEADER Record,
 864                         ULONGLONG MFTIndex,
 865                         PNTFS_FCB * fileFCB);
 866
 867
 868 /* finfo.c */
 869
 870 NTSTATUS
 871 NtfsQueryInformation(PNTFS_IRP_CONTEXT IrpContext);
 872
 873 NTSTATUS
 874 NtfsSetEndOfFile(PNTFS_FCB Fcb,
 875                  PFILE_OBJECT FileObject,
 876                  PDEVICE_EXTENSION DeviceExt,
 877                  ULONG IrpFlags,
 878                  BOOLEAN CaseSensitive,
 879                  PLARGE_INTEGER NewFileSize);
 880
 881 NTSTATUS
 882 NtfsSetInformation(PNTFS_IRP_CONTEXT IrpContext);
 883
 884 /* fsctl.c */
 885
 886 NTSTATUS
 887 NtfsFileSystemControl(PNTFS_IRP_CONTEXT IrpContext);
 888
 889
 890 /* mft.c */
 891 NTSTATUS
 892 AddNewMftEntry(PFILE_RECORD_HEADER FileRecord,
 893                PDEVICE_EXTENSION DeviceExt,
 894                PULONGLONG DestinationIndex,
 895                BOOLEAN CanWait);
 896
 897 PNTFS_ATTR_CONTEXT
 898 PrepareAttributeContext(PNTFS_ATTR_RECORD AttrRecord);
 899
 900 VOID
 901 ReleaseAttributeContext(PNTFS_ATTR_CONTEXT Context);
 902
 903 ULONG
 904 ReadAttribute(PDEVICE_EXTENSION Vcb,
 905               PNTFS_ATTR_CONTEXT Context,
 906               ULONGLONG Offset,
 907               PCHAR Buffer,
 908               ULONG Length);
 909
 910 NTSTATUS
 911 WriteAttribute(PDEVICE_EXTENSION Vcb,
 912                PNTFS_ATTR_CONTEXT Context,
 913                ULONGLONG Offset,
 914                const PUCHAR Buffer,
 915                ULONG Length,
 916                PULONG LengthWritten);
 917
 918 ULONGLONG
 919 AttributeDataLength(PNTFS_ATTR_RECORD AttrRecord);
 920
 921 VOID
 922 InternalSetResidentAttributeLength(PNTFS_ATTR_CONTEXT AttrContext,
 923                                    PFILE_RECORD_HEADER FileRecord,
 924                                    ULONG AttrOffset,
 925                                    ULONG DataSize);
 926
 927 NTSTATUS
 928 SetAttributeDataLength(PFILE_OBJECT FileObject,
 929                        PNTFS_FCB Fcb,
 930                        PNTFS_ATTR_CONTEXT AttrContext,
 931                        ULONG AttrOffset,
 932                        PFILE_RECORD_HEADER FileRecord,
 933                        PLARGE_INTEGER DataSize);
 934
 935 VOID
 936 SetFileRecordEnd(PFILE_RECORD_HEADER FileRecord,
 937                  PNTFS_ATTR_RECORD AttrEnd,
 938                  ULONG EndMarker);
 939
 940 NTSTATUS
 941 SetNonResidentAttributeDataLength(PDEVICE_EXTENSION Vcb,
 942                                   PNTFS_ATTR_CONTEXT AttrContext,
 943                                   ULONG AttrOffset,
 944                                   PFILE_RECORD_HEADER FileRecord,
 945                                   PLARGE_INTEGER DataSize);
 946
 947 NTSTATUS
 948 SetResidentAttributeDataLength(PDEVICE_EXTENSION Vcb,
 949                                PNTFS_ATTR_CONTEXT AttrContext,
 950                                ULONG AttrOffset,
 951                                PFILE_RECORD_HEADER FileRecord,
 952                                PLARGE_INTEGER DataSize);
 953
 954 ULONGLONG
 955 AttributeAllocatedLength(PNTFS_ATTR_RECORD AttrRecord);
 956
 957 BOOLEAN
 958 CompareFileName(PUNICODE_STRING FileName,
 959                 PINDEX_ENTRY_ATTRIBUTE IndexEntry,
 960                 BOOLEAN DirSearch,
 961                 BOOLEAN CaseSensitive);
 962
 963 NTSTATUS
 964 ReadFileRecord(PDEVICE_EXTENSION Vcb,
 965                ULONGLONG index,
 966                PFILE_RECORD_HEADER file);
 967
 968 NTSTATUS
 969 UpdateIndexEntryFileNameSize(PDEVICE_EXTENSION Vcb,
 970                              PFILE_RECORD_HEADER MftRecord,
 971                              PCHAR IndexRecord,
 972                              ULONG IndexBlockSize,
 973                              PINDEX_ENTRY_ATTRIBUTE FirstEntry,
 974                              PINDEX_ENTRY_ATTRIBUTE LastEntry,
 975                              PUNICODE_STRING FileName,
 976                              PULONG StartEntry,
 977                              PULONG CurrentEntry,
 978                              BOOLEAN DirSearch,
 979                              ULONGLONG NewDataSize,
 980                              ULONGLONG NewAllocatedSize,
 981                              BOOLEAN CaseSensitive);
 982
 983 NTSTATUS
 984 UpdateFileNameRecord(PDEVICE_EXTENSION Vcb,
 985                      ULONGLONG ParentMFTIndex,
 986                      PUNICODE_STRING FileName,
 987                      BOOLEAN DirSearch,
 988                      ULONGLONG NewDataSize,
 989                      ULONGLONG NewAllocationSize,
 990                      BOOLEAN CaseSensitive);
 991
 992 NTSTATUS
 993 UpdateFileRecord(PDEVICE_EXTENSION Vcb,
 994                  ULONGLONG MftIndex,
 995                  PFILE_RECORD_HEADER FileRecord);
 996
 997 NTSTATUS
 998 FindAttribute(PDEVICE_EXTENSION Vcb,
 999               PFILE_RECORD_HEADER MftRecord,
1000               ULONG Type,
1001               PCWSTR Name,
1002               ULONG NameLength,
1003               PNTFS_ATTR_CONTEXT * AttrCtx,
1004               PULONG Offset);
1005
1006 VOID
1007 ReadVCN(PDEVICE_EXTENSION Vcb,
1008         PFILE_RECORD_HEADER file,
1009         ATTRIBUTE_TYPE type,
1010         ULONGLONG vcn,
1011         ULONG count,
1012         PVOID buffer);
1013
1014 NTSTATUS
1015 FixupUpdateSequenceArray(PDEVICE_EXTENSION Vcb,
1016                          PNTFS_RECORD_HEADER Record);
1017
1018 NTSTATUS
1019 AddFixupArray(PDEVICE_EXTENSION Vcb,
1020               PNTFS_RECORD_HEADER Record);
1021
1022 NTSTATUS
1023 ReadLCN(PDEVICE_EXTENSION Vcb,
1024         ULONGLONG lcn,
1025         ULONG count,
1026         PVOID buffer);
1027
1028 VOID
1029 EnumerAttribute(PFILE_RECORD_HEADER file,
1030                 PDEVICE_EXTENSION Vcb,
1031                 PDEVICE_OBJECT DeviceObject);
1032
1033 NTSTATUS
1034 NtfsLookupFile(PDEVICE_EXTENSION Vcb,
1035                PUNICODE_STRING PathName,
1036                BOOLEAN CaseSensitive,
1037                PFILE_RECORD_HEADER *FileRecord,
1038                PULONGLONG MFTIndex);
1039
1040 NTSTATUS
1041 NtfsLookupFileAt(PDEVICE_EXTENSION Vcb,
1042                  PUNICODE_STRING PathName,
1043                  BOOLEAN CaseSensitive,
1044                  PFILE_RECORD_HEADER *FileRecord,
1045                  PULONGLONG MFTIndex,
1046                  ULONGLONG CurrentMFTIndex);
1047
1048 VOID
1049 NtfsDumpFileRecord(PDEVICE_EXTENSION Vcb,
1050                    PFILE_RECORD_HEADER FileRecord);
1051
1052 NTSTATUS
1053 NtfsFindFileAt(PDEVICE_EXTENSION Vcb,
1054                PUNICODE_STRING SearchPattern,
1055                PULONG FirstEntry,
1056                PFILE_RECORD_HEADER *FileRecord,
1057                PULONGLONG MFTIndex,
1058                ULONGLONG CurrentMFTIndex,
1059                BOOLEAN CaseSensitive);
1060
1061 NTSTATUS
1062 NtfsFindMftRecord(PDEVICE_EXTENSION Vcb,
1063                   ULONGLONG MFTIndex,
1064                   PUNICODE_STRING FileName,
1065                   PULONG FirstEntry,
1066                   BOOLEAN DirSearch,
1067                   BOOLEAN CaseSensitive,
1068                   ULONGLONG *OutMFTIndex);
1069
1070 /* misc.c */
1071
1072 BOOLEAN
1073 NtfsIsIrpTopLevel(PIRP Irp);
1074
1075 PNTFS_IRP_CONTEXT
1076 NtfsAllocateIrpContext(PDEVICE_OBJECT DeviceObject,
1077                        PIRP Irp);
1078
1079 PVOID
1080 NtfsGetUserBuffer(PIRP Irp,
1081                   BOOLEAN Paging);
1082
1083 NTSTATUS
1084 NtfsLockUserBuffer(IN PIRP Irp,
1085                    IN ULONG Length,
1086                    IN LOCK_OPERATION Operation);
1087
1088 #if 0
1089 BOOLEAN
1090 wstrcmpjoki(PWSTR s1, PWSTR s2);
1091
1092 VOID
1093 CdfsSwapString(PWCHAR Out,
1094                PUCHAR In,
1095                ULONG Count);
1096 #endif
1097
1098 VOID
1099 NtfsFileFlagsToAttributes(ULONG NtfsAttributes,
1100                           PULONG FileAttributes);
1101
1102
1103 /* rw.c */
1104
1105 NTSTATUS
1106 NtfsRead(PNTFS_IRP_CONTEXT IrpContext);
1107
1108 NTSTATUS
1109 NtfsWrite(PNTFS_IRP_CONTEXT IrpContext);
1110
1111
1112 /* volinfo.c */
1113
1114 NTSTATUS
1115 NtfsAllocateClusters(PDEVICE_EXTENSION DeviceExt,
1116                      ULONG FirstDesiredCluster,
1117                      ULONG DesiredClusters,
1118                      PULONG FirstAssignedCluster,
1119                      PULONG AssignedClusters);
1120
1121 ULONGLONG
1122 NtfsGetFreeClusters(PDEVICE_EXTENSION DeviceExt);
1123
1124 NTSTATUS
1125 NtfsQueryVolumeInformation(PNTFS_IRP_CONTEXT IrpContext);
1126
1127 NTSTATUS
1128 NtfsSetVolumeInformation(PNTFS_IRP_CONTEXT IrpContext);
1129
1130
1131 /* ntfs.c */
1132
1133 DRIVER_INITIALIZE DriverEntry;
1134
1135 VOID
1136 NTAPI
1137 NtfsInitializeFunctionPointers(PDRIVER_OBJECT DriverObject);
1138
1139 #endif /* NTFS_H */