1 /* 2 * Copyright (C) 2011-2012 Paulo Alcantara <pcacjr (at) gmail.com> 3 * 4 * This program is free software; you can redistribute it and/or modify 5 * it under the terms of the GNU General Public License as published by 6 * the Free Software Foundation; either version 2 of the License, or 7 * (at your option) any later version. 8 * 9 * This program is distributed in the hope that it will be useful, 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 12 * GNU General Public License for more details. 13 * 14 * You should have received a copy of the GNU General Public License 15 * along with this program; if not, write to the 16 * Free Software Foundation, Inc., 17 * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. 18 */ 19 20 #include "runlist.h" 21 22 #ifndef _NTFS_H_ 23 #define _NTFS_H_ 24 25 struct ntfs_bpb { 26 uint8_t jmp_boot[3]; 27 char oem_name[8]; 28 uint16_t sector_size; 29 uint8_t sec_per_clust; 30 uint16_t res_sectors; 31 uint8_t zero_0[3]; 32 uint16_t zero_1; 33 uint8_t media; 34 uint16_t zero_2; 35 uint16_t unused_0; 36 uint16_t unused_1; 37 uint32_t unused_2; 38 uint32_t zero_3; 39 uint32_t unused_3; 40 uint64_t total_sectors; 41 uint64_t mft_lclust; 42 uint64_t mft_mirr_lclust; 43 int8_t clust_per_mft_record; 44 uint8_t unused_4[3]; 45 uint8_t clust_per_idx_record; 46 uint8_t unused_5[3]; 47 uint64_t vol_serial; 48 uint32_t unused_6; 49 50 uint8_t pad[428]; /* padding to a sector boundary (512 bytes) */ 51 } __attribute__((__packed__)); 52 53 /* Function type for an NTFS-version-dependent MFT record lookup */ 54 struct ntfs_mft_record; 55 typedef struct ntfs_mft_record *f_mft_record_lookup(struct fs_info *, 56 uint32_t, block_t *); 57 58 struct ntfs_sb_info { 59 block_t mft_blk; /* The first MFT record block */ 60 uint64_t mft_lcn; /* LCN of the first MFT record */ 61 unsigned mft_size; /* The MFT size in sectors */ 62 uint64_t mft_record_size; /* MFT record size in bytes */ 63 64 uint8_t clust_per_idx_record; /* Clusters per Index Record */ 65 66 unsigned long long clusters; /* Total number of clusters */ 67 68 unsigned clust_shift; /* Based on sectors */ 69 unsigned clust_byte_shift; /* Based on bytes */ 70 unsigned clust_mask; 71 unsigned clust_size; 72 73 uint8_t major_ver; /* Major version from $Volume */ 74 uint8_t minor_ver; /* Minor version from $Volume */ 75 76 /* NTFS-version-dependent MFT record lookup function to use */ 77 f_mft_record_lookup *mft_record_lookup; 78 } __attribute__((__packed__)); 79 80 /* The NTFS in-memory inode structure */ 81 struct ntfs_inode { 82 int64_t initialized_size; 83 int64_t allocated_size; 84 unsigned long mft_no; /* Number of the mft record / inode */ 85 uint16_t seq_no; /* Sequence number of the mft record */ 86 uint32_t type; /* Attribute type of this inode */ 87 uint8_t non_resident; 88 union { /* Non-resident $DATA attribute */ 89 struct { /* Used only if non_resident flags isn't set */ 90 uint32_t offset; /* Data offset */ 91 } resident; 92 struct { /* Used only if non_resident is set */ 93 struct runlist *rlist; 94 } non_resident; 95 } data; 96 uint32_t start_cluster; /* Starting cluster address */ 97 sector_t start; /* Starting sector */ 98 sector_t offset; /* Current sector offset */ 99 sector_t here; /* Sector corresponding to offset */ 100 }; 101 102 /* This is structure is used to keep a state for ntfs_readdir() callers. 103 * As NTFS stores directory entries in a complex way, this is structure 104 * ends up saving a state required to find out where we must start from 105 * for the next ntfs_readdir() call. 106 */ 107 struct ntfs_readdir_state { 108 unsigned long mft_no; /* MFT record number */ 109 bool in_idx_root; /* It's true if we're still in the INDEX root */ 110 uint32_t idx_blks_count; /* Number of read INDX blocks */ 111 uint32_t entries_count; /* Number of read INDEX entries */ 112 int64_t last_vcn; /* Last VCN of the INDX block */ 113 }; 114 115 enum { 116 MAP_UNSPEC, 117 MAP_START = 1 << 0, 118 MAP_END = 1 << 1, 119 MAP_ALLOCATED = 1 << 2, 120 MAP_UNALLOCATED = 1 << 3, 121 MAP_MASK = 0x0000000F, 122 }; 123 124 struct mapping_chunk { 125 uint64_t vcn; 126 int64_t lcn; 127 uint64_t len; 128 uint32_t flags; 129 }; 130 131 /* System defined attributes (32-bit) 132 * Each attribute type has a corresponding attribute name (in Unicode) 133 */ 134 enum { 135 NTFS_AT_UNUSED = 0x00, 136 NTFS_AT_STANDARD_INFORMATION = 0x10, 137 NTFS_AT_ATTR_LIST = 0x20, 138 NTFS_AT_FILENAME = 0x30, 139 NTFS_AT_OBJ_ID = 0x40, 140 NTFS_AT_SECURITY_DESCP = 0x50, 141 NTFS_AT_VOL_NAME = 0x60, 142 NTFS_AT_VOL_INFO = 0x70, 143 NTFS_AT_DATA = 0x80, 144 NTFS_AT_INDEX_ROOT = 0x90, 145 NTFS_AT_INDEX_ALLOCATION = 0xA0, 146 NTFS_AT_BITMAP = 0xB0, 147 NTFS_AT_REPARSE_POINT = 0xC0, 148 NTFS_AT_EA_INFO = 0xD0, 149 NTFS_AT_EA = 0xE0, 150 NTFS_AT_PROPERTY_SET = 0xF0, 151 NTFS_AT_LOGGED_UTIL_STREAM = 0x100, 152 NTFS_AT_FIRST_USER_DEFINED_ATTR = 0x1000, 153 NTFS_AT_END = 0xFFFFFFFF, 154 }; 155 156 /* NTFS File Permissions (also called attributes in DOS terminology) */ 157 enum { 158 NTFS_FILE_ATTR_READONLY = 0x00000001, 159 NTFS_FILE_ATTR_HIDDEN = 0x00000002, 160 NTFS_FILE_ATTR_SYSTEM = 0x00000004, 161 NTFS_FILE_ATTR_DIRECTORY = 0x00000010, 162 NTFS_FILE_ATTR_ARCHIVE = 0x00000020, 163 NTFS_FILE_ATTR_DEVICE = 0x00000040, 164 NTFS_FILE_ATTR_NORMAL = 0x00000080, 165 NTFS_FILE_ATTR_TEMPORARY = 0x00000100, 166 NTFS_FILE_ATTR_SPARSE_FILE = 0x00000200, 167 NTFS_FILE_ATTR_REPARSE_POINT = 0x00000400, 168 NTFS_FILE_ATTR_COMPRESSED = 0x00000800, 169 NTFS_FILE_ATTR_OFFLINE = 0x00001000, 170 NTFS_FILE_ATTR_NOT_CONTENT_INDEXED = 0x00002000, 171 NTFS_FILE_ATTR_ENCRYPTED = 0x00004000, 172 NTFS_FILE_ATTR_VALID_FLAGS = 0x00007FB7, 173 NTFS_FILE_ATTR_VALID_SET_FLAGS = 0x000031A7, 174 NTFS_FILE_ATTR_DUP_FILE_NAME_INDEX_PRESENT = 0x10000000, 175 NTFS_FILE_ATTR_DUP_VIEW_INDEX_PRESENT = 0x20000000, 176 }; 177 178 /* 179 * Magic identifiers present at the beginning of all ntfs record containing 180 * records (like mft records for example). 181 */ 182 enum { 183 /* Found in $MFT/$DATA */ 184 NTFS_MAGIC_FILE = 0x454C4946, /* MFT entry */ 185 NTFS_MAGIC_INDX = 0x58444E49, /* Index buffer */ 186 NTFS_MAGIC_HOLE = 0x454C4F48, 187 188 /* Found in $LogFile/$DATA */ 189 NTFS_MAGIC_RSTR = 0x52545352, 190 NTFS_MAGIC_RCRD = 0x44524352, 191 /* Found in $LogFile/$DATA (May be found in $MFT/$DATA, also ?) */ 192 NTFS_MAGIC_CHKDSK = 0x444B4843, 193 /* Found in all ntfs record containing records. */ 194 NTFS_MAGIC_BAAD = 0x44414142, 195 NTFS_MAGIC_EMPTY = 0xFFFFFFFF, /* Record is empty */ 196 }; 197 198 struct ntfs_record { 199 uint32_t magic; 200 uint16_t usa_ofs; 201 uint16_t usa_count; 202 } __attribute__((__packed__)) NTFS_RECORD; 203 204 /* The $MFT metadata file types */ 205 enum ntfs_system_file { 206 FILE_MFT = 0, 207 FILE_MFTMirr = 1, 208 FILE_LogFile = 2, 209 FILE_Volume = 3, 210 FILE_AttrDef = 4, 211 FILE_root = 5, 212 FILE_Bitmap = 6, 213 FILE_Boot = 7, 214 FILE_BadClus = 8, 215 FILE_Secure = 9, 216 FILE_UpCase = 10, 217 FILE_Extend = 11, 218 FILE_reserved12 = 12, 219 FILE_reserved13 = 13, 220 FILE_reserved14 = 14, 221 FILE_reserved15 = 15, 222 FILE_reserved16 = 16, 223 }; 224 225 enum { 226 MFT_RECORD_IN_USE = 0x0001, 227 MFT_RECORD_IS_DIRECTORY = 0x0002, 228 } __attribute__((__packed__)); 229 230 struct ntfs_mft_record { 231 uint32_t magic; 232 uint16_t usa_ofs; 233 uint16_t usa_count; 234 uint64_t lsn; 235 uint16_t seq_no; 236 uint16_t link_count; 237 uint16_t attrs_offset; 238 uint16_t flags; /* MFT record flags */ 239 uint32_t bytes_in_use; 240 uint32_t bytes_allocated; 241 uint64_t base_mft_record; 242 uint16_t next_attr_instance; 243 uint16_t reserved; 244 uint32_t mft_record_no; 245 } __attribute__((__packed__)); /* 48 bytes */ 246 247 /* This is the version without the NTFS 3.1+ specific fields */ 248 struct ntfs_mft_record_old { 249 uint32_t magic; 250 uint16_t usa_ofs; 251 uint16_t usa_count; 252 uint64_t lsn; 253 uint16_t seq_no; 254 uint16_t link_count; 255 uint16_t attrs_offset; 256 uint16_t flags; /* MFT record flags */ 257 uint32_t bytes_in_use; 258 uint32_t bytes_allocated; 259 uint64_t base_mft_record; 260 uint16_t next_attr_instance; 261 } __attribute__((__packed__)); /* 42 bytes */ 262 263 enum { 264 ATTR_DEF_INDEXABLE = 0x02, 265 ATTR_DEF_MULTIPLE = 0x04, 266 ATTR_DEF_NOT_ZERO = 0x08, 267 ATTR_DEF_INDEXED_UNIQUE = 0x10, 268 ATTR_DEF_NAMED_UNIQUE = 0x20, 269 ATTR_DEF_RESIDENT = 0x40, 270 ATTR_DEF_ALWAYS_LOG = 0x80, 271 }; 272 273 struct ntfs_attr_record { 274 uint32_t type; /* Attr. type code */ 275 uint32_t len; 276 uint8_t non_resident; 277 uint8_t name_len; 278 uint16_t name_offset; 279 uint16_t flags; /* Attr. flags */ 280 uint16_t instance; 281 union { 282 struct { /* Resident attribute */ 283 uint32_t value_len; 284 uint16_t value_offset; 285 uint8_t flags; /* Flags of resident attributes */ 286 int8_t reserved; 287 } __attribute__((__packed__)) resident; 288 struct { /* Non-resident attributes */ 289 uint64_t lowest_vcn; 290 uint64_t highest_vcn; 291 uint16_t mapping_pairs_offset; 292 uint8_t compression_unit; 293 uint8_t reserved[5]; 294 int64_t allocated_size; 295 int64_t data_size; /* Byte size of the attribute value. 296 * Note: it can be larger than 297 * allocated_size if attribute value is 298 * compressed or sparse. 299 */ 300 int64_t initialized_size; 301 int64_t compressed_size; 302 } __attribute__((__packed__)) non_resident; 303 } __attribute__((__packed__)) data; 304 } __attribute__((__packed__)); 305 306 /* Attribute: Attribute List (0x20) 307 * Note: it can be either resident or non-resident 308 */ 309 struct ntfs_attr_list_entry { 310 uint32_t type; 311 uint16_t length; 312 uint8_t name_length; 313 uint8_t name_offset; 314 uint64_t lowest_vcn; 315 uint64_t mft_ref; 316 uint16_t instance; 317 uint16_t name[0]; 318 } __attribute__((__packed__)); 319 320 #define NTFS_MAX_FILE_NAME_LEN 255 321 322 /* Possible namespaces for filenames in ntfs (8-bit) */ 323 enum { 324 FILE_NAME_POSIX = 0x00, 325 FILE_NAME_WIN32 = 0x01, 326 FILE_NAME_DOS = 0x02, 327 FILE_NAME_WIN32_AND_DOS = 0x03, 328 } __attribute__((__packed__)); 329 330 /* Attribute: Filename (0x30) 331 * Note: always resident 332 */ 333 struct ntfs_filename_attr { 334 uint64_t parent_directory; 335 int64_t ctime; 336 int64_t atime; 337 int64_t mtime; 338 int64_t rtime; 339 uint64_t allocated_size; 340 uint64_t data_size; 341 uint32_t file_attrs; 342 union { 343 struct { 344 uint16_t packed_ea_size; 345 uint16_t reserved; /* reserved for alignment */ 346 } __attribute__((__packed__)) ea; 347 struct { 348 uint32_t reparse_point_tag; 349 } __attribute__((__packed__)) rp; 350 } __attribute__((__packed__)) type; 351 uint8_t file_name_len; 352 uint8_t file_name_type; 353 uint16_t file_name[0]; /* File name in Unicode */ 354 } __attribute__((__packed__)); 355 356 /* Attribute: Volume Name (0x60) 357 * Note: always resident 358 * Note: Present only in FILE_volume 359 */ 360 struct ntfs_vol_name { 361 uint16_t name[0]; /* The name of the volume in Unicode */ 362 } __attribute__((__packed__)); 363 364 /* Attribute: Volume Information (0x70) 365 * Note: always resident 366 * Note: present only in FILE_Volume 367 */ 368 struct ntfs_vol_info { 369 uint64_t reserved; 370 uint8_t major_ver; 371 uint8_t minor_ver; 372 uint16_t flags; /* Volume flags */ 373 } __attribute__((__packed__)); 374 375 /* Attribute: Data attribute (0x80) 376 * Note: can be either resident or non-resident 377 */ 378 struct ntfs_data_attr { 379 uint8_t data[0]; 380 } __attribute__((__packed__)); 381 382 /* Index header flags (8-bit) */ 383 enum { 384 SMALL_INDEX = 0, 385 LARGE_INDEX = 1, 386 LEAF_NODE = 0, 387 INDEX_NODE = 1, 388 NODE_MASK = 1, 389 } __attribute__((__packed__)); 390 391 /* Header for the indexes, describing the INDEX_ENTRY records, which 392 * follow the struct ntfs_idx_header. 393 */ 394 struct ntfs_idx_header { 395 uint32_t entries_offset; 396 uint32_t index_len; 397 uint32_t allocated_size; 398 uint8_t flags; /* Index header flags */ 399 uint8_t reserved[3]; /* Align to 8-byte boundary */ 400 } __attribute__((__packed__)); 401 402 /* Attribute: Index Root (0x90) 403 * Note: always resident 404 */ 405 struct ntfs_idx_root { 406 uint32_t type; /* It is $FILE_NAME for directories, zero for view indexes. 407 * No other values allowed. 408 */ 409 uint32_t collation_rule; 410 uint32_t index_block_size; 411 uint8_t clust_per_index_block; 412 uint8_t reserved[3]; 413 struct ntfs_idx_header index; 414 } __attribute__((__packed__)); 415 416 /* Attribute: Index allocation (0xA0) 417 * Note: always non-resident, of course! :-) 418 */ 419 struct ntfs_idx_allocation { 420 uint32_t magic; 421 uint16_t usa_ofs; /* Update Sequence Array offsets */ 422 uint16_t usa_count; /* Update Sequence Array number in bytes */ 423 int64_t lsn; 424 int64_t index_block_vcn; /* Virtual cluster number of the index block */ 425 struct ntfs_idx_header index; 426 } __attribute__((__packed__)); 427 428 enum { 429 INDEX_ENTRY_NODE = 1, 430 INDEX_ENTRY_END = 2, 431 /* force enum bit width to 16-bit */ 432 INDEX_ENTRY_SPACE_FILTER = 0xFFFF, 433 } __attribute__((__packed__)); 434 435 struct ntfs_idx_entry_header { 436 union { 437 struct { /* Only valid when INDEX_ENTRY_END is not set */ 438 uint64_t indexed_file; 439 } __attribute__((__packed__)) dir; 440 struct { /* Used for views/indexes to find the entry's data */ 441 uint16_t data_offset; 442 uint16_t data_len; 443 uint32_t reservedV; 444 } __attribute__((__packed__)) vi; 445 } __attribute__((__packed__)) data; 446 uint16_t len; 447 uint16_t key_len; 448 uint16_t flags; /* Index entry flags */ 449 uint16_t reserved; /* Align to 8-byte boundary */ 450 } __attribute__((__packed__)); 451 452 struct ntfs_idx_entry { 453 union { 454 struct { /* Only valid when INDEX_ENTRY_END is not set */ 455 uint64_t indexed_file; 456 } __attribute__((__packed__)) dir; 457 struct { /* Used for views/indexes to find the entry's data */ 458 uint16_t data_offset; 459 uint16_t data_len; 460 uint32_t reservedV; 461 } __attribute__((__packed__)) vi; 462 } __attribute__((__packed__)) data; 463 uint16_t len; 464 uint16_t key_len; 465 uint16_t flags; /* Index entry flags */ 466 uint16_t reserved; /* Align to 8-byte boundary */ 467 union { 468 struct ntfs_filename_attr file_name; 469 //SII_INDEX_KEY sii; 470 //SDH_INDEX_KEY sdh; 471 //GUID object_id; 472 //REPARSE_INDEX_KEY reparse; 473 //SID sid; 474 uint32_t owner_id; 475 } __attribute__((__packed__)) key; 476 } __attribute__((__packed__)); 477 478 static inline struct ntfs_sb_info *NTFS_SB(struct fs_info *fs) 479 { 480 return fs->fs_info; 481 } 482 483 #define NTFS_PVT(i) ((struct ntfs_inode *)((i)->pvt)) 484 485 #endif /* _NTFS_H_ */ 486
