1/* SPDX-License-Identifier: GPL-2.0 */ 2/* 3 * 4 * Copyright (C) 2019-2021 Paragon Software GmbH, All rights reserved. 5 * 6 * on-disk ntfs structs 7 */ 8 9// clang-format off 10#ifndef _LINUX_NTFS3_NTFS_H 11#define _LINUX_NTFS3_NTFS_H 12 13#include <linux/blkdev.h> 14#include <linux/build_bug.h> 15#include <linux/kernel.h> 16#include <linux/stddef.h> 17#include <linux/string.h> 18#include <linux/types.h> 19 20#include "debug.h" 21 22/* TODO: Check 4K MFT record and 512 bytes cluster. */ 23 24/* Check each run for marked clusters. */ 25#define NTFS3_CHECK_FREE_CLST 26 27#define NTFS_NAME_LEN 255 28 29/* 30 * ntfs.sys used 500 maximum links on-disk struct allows up to 0xffff. 31 * xfstest generic/041 creates 3003 hardlinks. 32 */ 33#define NTFS_LINK_MAX 4000 34 35/* 36 * Activate to use 64 bit clusters instead of 32 bits in ntfs.sys. 37 * Logical and virtual cluster number if needed, may be 38 * redefined to use 64 bit value. 39 */ 40//#define CONFIG_NTFS3_64BIT_CLUSTER 41 42#define NTFS_LZNT_MAX_CLUSTER 4096 43#define NTFS_LZNT_CUNIT 4 44#define NTFS_LZNT_CLUSTERS (1u<<NTFS_LZNT_CUNIT) 45 46struct GUID { 47 __le32 Data1; 48 __le16 Data2; 49 __le16 Data3; 50 u8 Data4[8]; 51}; 52 53/* 54 * This struct repeats layout of ATTR_FILE_NAME 55 * at offset 0x40. 56 * It used to store global constants NAME_MFT/NAME_MIRROR... 57 * most constant names are shorter than 10. 58 */ 59struct cpu_str { 60 u8 len; 61 u8 unused; 62 u16 name[10]; 63}; 64 65struct le_str { 66 u8 len; 67 u8 unused; 68 __le16 name[]; 69}; 70 71static_assert(SECTOR_SHIFT == 9); 72 73#ifdef CONFIG_NTFS3_64BIT_CLUSTER 74typedef u64 CLST; 75static_assert(sizeof(size_t) == 8); 76#else 77typedef u32 CLST; 78#endif 79 80#define SPARSE_LCN64 ((u64)-1) 81#define SPARSE_LCN ((CLST)-1) 82#define RESIDENT_LCN ((CLST)-2) 83#define COMPRESSED_LCN ((CLST)-3) 84 85#define COMPRESSION_UNIT 4 86#define COMPRESS_MAX_CLUSTER 0x1000 87 88enum RECORD_NUM { 89 MFT_REC_MFT = 0, 90 MFT_REC_MIRR = 1, 91 MFT_REC_LOG = 2, 92 MFT_REC_VOL = 3, 93 MFT_REC_ATTR = 4, 94 MFT_REC_ROOT = 5, 95 MFT_REC_BITMAP = 6, 96 MFT_REC_BOOT = 7, 97 MFT_REC_BADCLUST = 8, 98 MFT_REC_SECURE = 9, 99 MFT_REC_UPCASE = 10, 100 MFT_REC_EXTEND = 11, 101 MFT_REC_RESERVED = 12, 102 MFT_REC_FREE = 16, 103 MFT_REC_USER = 24, 104}; 105 106enum ATTR_TYPE { 107 ATTR_ZERO = cpu_to_le32(0x00), 108 ATTR_STD = cpu_to_le32(0x10), 109 ATTR_LIST = cpu_to_le32(0x20), 110 ATTR_NAME = cpu_to_le32(0x30), 111 ATTR_ID = cpu_to_le32(0x40), 112 ATTR_SECURE = cpu_to_le32(0x50), 113 ATTR_LABEL = cpu_to_le32(0x60), 114 ATTR_VOL_INFO = cpu_to_le32(0x70), 115 ATTR_DATA = cpu_to_le32(0x80), 116 ATTR_ROOT = cpu_to_le32(0x90), 117 ATTR_ALLOC = cpu_to_le32(0xA0), 118 ATTR_BITMAP = cpu_to_le32(0xB0), 119 ATTR_REPARSE = cpu_to_le32(0xC0), 120 ATTR_EA_INFO = cpu_to_le32(0xD0), 121 ATTR_EA = cpu_to_le32(0xE0), 122 ATTR_PROPERTYSET = cpu_to_le32(0xF0), 123 ATTR_LOGGED_UTILITY_STREAM = cpu_to_le32(0x100), 124 ATTR_END = cpu_to_le32(0xFFFFFFFF) 125}; 126 127static_assert(sizeof(enum ATTR_TYPE) == 4); 128 129enum FILE_ATTRIBUTE { 130 FILE_ATTRIBUTE_READONLY = cpu_to_le32(0x00000001), 131 FILE_ATTRIBUTE_HIDDEN = cpu_to_le32(0x00000002), 132 FILE_ATTRIBUTE_SYSTEM = cpu_to_le32(0x00000004), 133 FILE_ATTRIBUTE_ARCHIVE = cpu_to_le32(0x00000020), 134 FILE_ATTRIBUTE_DEVICE = cpu_to_le32(0x00000040), 135 FILE_ATTRIBUTE_TEMPORARY = cpu_to_le32(0x00000100), 136 FILE_ATTRIBUTE_SPARSE_FILE = cpu_to_le32(0x00000200), 137 FILE_ATTRIBUTE_REPARSE_POINT = cpu_to_le32(0x00000400), 138 FILE_ATTRIBUTE_COMPRESSED = cpu_to_le32(0x00000800), 139 FILE_ATTRIBUTE_OFFLINE = cpu_to_le32(0x00001000), 140 FILE_ATTRIBUTE_NOT_CONTENT_INDEXED = cpu_to_le32(0x00002000), 141 FILE_ATTRIBUTE_ENCRYPTED = cpu_to_le32(0x00004000), 142 FILE_ATTRIBUTE_VALID_FLAGS = cpu_to_le32(0x00007fb7), 143 FILE_ATTRIBUTE_DIRECTORY = cpu_to_le32(0x10000000), 144 FILE_ATTRIBUTE_INDEX = cpu_to_le32(0x20000000) 145}; 146 147static_assert(sizeof(enum FILE_ATTRIBUTE) == 4); 148 149extern const struct cpu_str NAME_MFT; 150extern const struct cpu_str NAME_MIRROR; 151extern const struct cpu_str NAME_LOGFILE; 152extern const struct cpu_str NAME_VOLUME; 153extern const struct cpu_str NAME_ATTRDEF; 154extern const struct cpu_str NAME_ROOT; 155extern const struct cpu_str NAME_BITMAP; 156extern const struct cpu_str NAME_BOOT; 157extern const struct cpu_str NAME_BADCLUS; 158extern const struct cpu_str NAME_QUOTA; 159extern const struct cpu_str NAME_SECURE; 160extern const struct cpu_str NAME_UPCASE; 161extern const struct cpu_str NAME_EXTEND; 162extern const struct cpu_str NAME_OBJID; 163extern const struct cpu_str NAME_REPARSE; 164extern const struct cpu_str NAME_USNJRNL; 165 166extern const __le16 I30_NAME[4]; 167extern const __le16 SII_NAME[4]; 168extern const __le16 SDH_NAME[4]; 169extern const __le16 SO_NAME[2]; 170extern const __le16 SQ_NAME[2]; 171extern const __le16 SR_NAME[2]; 172 173extern const __le16 BAD_NAME[4]; 174extern const __le16 SDS_NAME[4]; 175extern const __le16 WOF_NAME[17]; /* WofCompressedData */ 176 177/* MFT record number structure. */ 178struct MFT_REF { 179 __le32 low; // The low part of the number. 180 __le16 high; // The high part of the number. 181 __le16 seq; // The sequence number of MFT record. 182}; 183 184static_assert(sizeof(__le64) == sizeof(struct MFT_REF)); 185 186static inline CLST ino_get(const struct MFT_REF *ref) 187{ 188#ifdef CONFIG_NTFS3_64BIT_CLUSTER 189 return le32_to_cpu(ref->low) | ((u64)le16_to_cpu(ref->high) << 32); 190#else 191 return le32_to_cpu(ref->low); 192#endif 193} 194 195struct NTFS_BOOT { 196 u8 jump_code[3]; // 0x00: Jump to boot code. 197 u8 system_id[8]; // 0x03: System ID, equals "NTFS " 198 199 // NOTE: This member is not aligned(!) 200 // bytes_per_sector[0] must be 0. 201 // bytes_per_sector[1] must be multiplied by 256. 202 u8 bytes_per_sector[2]; // 0x0B: Bytes per sector. 203 204 u8 sectors_per_clusters;// 0x0D: Sectors per cluster. 205 u8 unused1[7]; 206 u8 media_type; // 0x15: Media type (0xF8 - harddisk) 207 u8 unused2[2]; 208 __le16 sct_per_track; // 0x18: number of sectors per track. 209 __le16 heads; // 0x1A: number of heads per cylinder. 210 __le32 hidden_sectors; // 0x1C: number of 'hidden' sectors. 211 u8 unused3[4]; 212 u8 bios_drive_num; // 0x24: BIOS drive number =0x80. 213 u8 unused4; 214 u8 signature_ex; // 0x26: Extended BOOT signature =0x80. 215 u8 unused5; 216 __le64 sectors_per_volume;// 0x28: Size of volume in sectors. 217 __le64 mft_clst; // 0x30: First cluster of $MFT 218 __le64 mft2_clst; // 0x38: First cluster of $MFTMirr 219 s8 record_size; // 0x40: Size of MFT record in clusters(sectors). 220 u8 unused6[3]; 221 s8 index_size; // 0x44: Size of INDX record in clusters(sectors). 222 u8 unused7[3]; 223 __le64 serial_num; // 0x48: Volume serial number 224 __le32 check_sum; // 0x50: Simple additive checksum of all 225 // of the u32's which precede the 'check_sum'. 226 227 u8 boot_code[0x200 - 0x50 - 2 - 4]; // 0x54: 228 u8 boot_magic[2]; // 0x1FE: Boot signature =0x55 + 0xAA 229}; 230 231static_assert(sizeof(struct NTFS_BOOT) == 0x200); 232 233enum NTFS_SIGNATURE { 234 NTFS_FILE_SIGNATURE = cpu_to_le32(0x454C4946), // 'FILE' 235 NTFS_INDX_SIGNATURE = cpu_to_le32(0x58444E49), // 'INDX' 236 NTFS_CHKD_SIGNATURE = cpu_to_le32(0x444B4843), // 'CHKD' 237 NTFS_RSTR_SIGNATURE = cpu_to_le32(0x52545352), // 'RSTR' 238 NTFS_RCRD_SIGNATURE = cpu_to_le32(0x44524352), // 'RCRD' 239 NTFS_BAAD_SIGNATURE = cpu_to_le32(0x44414142), // 'BAAD' 240 NTFS_HOLE_SIGNATURE = cpu_to_le32(0x454C4F48), // 'HOLE' 241 NTFS_FFFF_SIGNATURE = cpu_to_le32(0xffffffff), 242}; 243 244static_assert(sizeof(enum NTFS_SIGNATURE) == 4); 245 246/* MFT Record header structure. */ 247struct NTFS_RECORD_HEADER { 248 /* Record magic number, equals 'FILE'/'INDX'/'RSTR'/'RCRD'. */ 249 enum NTFS_SIGNATURE sign; // 0x00: 250 __le16 fix_off; // 0x04: 251 __le16 fix_num; // 0x06: 252 __le64 lsn; // 0x08: Log file sequence number, 253}; 254 255static_assert(sizeof(struct NTFS_RECORD_HEADER) == 0x10); 256 257static inline int is_baad(const struct NTFS_RECORD_HEADER *hdr) 258{ 259 return hdr->sign == NTFS_BAAD_SIGNATURE; 260} 261 262/* Possible bits in struct MFT_REC.flags. */ 263enum RECORD_FLAG { 264 RECORD_FLAG_IN_USE = cpu_to_le16(0x0001), 265 RECORD_FLAG_DIR = cpu_to_le16(0x0002), 266 RECORD_FLAG_SYSTEM = cpu_to_le16(0x0004), 267 RECORD_FLAG_INDEX = cpu_to_le16(0x0008), 268}; 269 270/* MFT Record structure. */ 271struct MFT_REC { 272 struct NTFS_RECORD_HEADER rhdr; // 'FILE' 273 274 __le16 seq; // 0x10: Sequence number for this record. 275 __le16 hard_links; // 0x12: The number of hard links to record. 276 __le16 attr_off; // 0x14: Offset to attributes. 277 __le16 flags; // 0x16: See RECORD_FLAG. 278 __le32 used; // 0x18: The size of used part. 279 __le32 total; // 0x1C: Total record size. 280 281 struct MFT_REF parent_ref; // 0x20: Parent MFT record. 282 __le16 next_attr_id; // 0x28: The next attribute Id. 283 284 __le16 res; // 0x2A: High part of MFT record? 285 __le32 mft_record; // 0x2C: Current MFT record number. 286 __le16 fixups[]; // 0x30: 287}; 288 289#define MFTRECORD_FIXUP_OFFSET_1 offsetof(struct MFT_REC, res) 290#define MFTRECORD_FIXUP_OFFSET_3 offsetof(struct MFT_REC, fixups) 291/* 292 * define MFTRECORD_FIXUP_OFFSET as MFTRECORD_FIXUP_OFFSET_3 (0x30) 293 * to format new mft records with bigger header (as current ntfs.sys does) 294 * 295 * define MFTRECORD_FIXUP_OFFSET as MFTRECORD_FIXUP_OFFSET_1 (0x2A) 296 * to format new mft records with smaller header (as old ntfs.sys did) 297 * Both variants are valid. 298 */ 299#define MFTRECORD_FIXUP_OFFSET MFTRECORD_FIXUP_OFFSET_1 300 301static_assert(MFTRECORD_FIXUP_OFFSET_1 == 0x2A); 302static_assert(MFTRECORD_FIXUP_OFFSET_3 == 0x30); 303 304static inline bool is_rec_base(const struct MFT_REC *rec) 305{ 306 const struct MFT_REF *r = &rec->parent_ref; 307 308 return !r->low && !r->high && !r->seq; 309} 310 311static inline bool is_mft_rec5(const struct MFT_REC *rec) 312{ 313 return le16_to_cpu(rec->rhdr.fix_off) >= 314 offsetof(struct MFT_REC, fixups); 315} 316 317static inline bool is_rec_inuse(const struct MFT_REC *rec) 318{ 319 return rec->flags & RECORD_FLAG_IN_USE; 320} 321 322static inline bool clear_rec_inuse(struct MFT_REC *rec) 323{ 324 return rec->flags &= ~RECORD_FLAG_IN_USE; 325} 326 327/* Possible values of ATTR_RESIDENT.flags */ 328#define RESIDENT_FLAG_INDEXED 0x01 329 330struct ATTR_RESIDENT { 331 __le32 data_size; // 0x10: The size of data. 332 __le16 data_off; // 0x14: Offset to data. 333 u8 flags; // 0x16: Resident flags ( 1 - indexed ). 334 u8 res; // 0x17: 335}; // sizeof() = 0x18 336 337struct ATTR_NONRESIDENT { 338 __le64 svcn; // 0x10: Starting VCN of this segment. 339 __le64 evcn; // 0x18: End VCN of this segment. 340 __le16 run_off; // 0x20: Offset to packed runs. 341 // Unit of Compression size for this stream, expressed 342 // as a log of the cluster size. 343 // 344 // 0 means file is not compressed 345 // 1, 2, 3, and 4 are potentially legal values if the 346 // stream is compressed, however the implementation 347 // may only choose to use 4, or possibly 3. 348 // Note that 4 means cluster size time 16. 349 // If convenient the implementation may wish to accept a 350 // reasonable range of legal values here (1-5?), 351 // even if the implementation only generates 352 // a smaller set of values itself. 353 u8 c_unit; // 0x22: 354 u8 res1[5]; // 0x23: 355 __le64 alloc_size; // 0x28: The allocated size of attribute in bytes. 356 // (multiple of cluster size) 357 __le64 data_size; // 0x30: The size of attribute in bytes <= alloc_size. 358 __le64 valid_size; // 0x38: The size of valid part in bytes <= data_size. 359 __le64 total_size; // 0x40: The sum of the allocated clusters for a file. 360 // (present only for the first segment (0 == vcn) 361 // of compressed attribute) 362 363}; // sizeof()=0x40 or 0x48 (if compressed) 364 365/* Possible values of ATTRIB.flags: */ 366#define ATTR_FLAG_COMPRESSED cpu_to_le16(0x0001) 367#define ATTR_FLAG_COMPRESSED_MASK cpu_to_le16(0x00FF) 368#define ATTR_FLAG_ENCRYPTED cpu_to_le16(0x4000) 369#define ATTR_FLAG_SPARSED cpu_to_le16(0x8000) 370 371struct ATTRIB { 372 enum ATTR_TYPE type; // 0x00: The type of this attribute. 373 __le32 size; // 0x04: The size of this attribute. 374 u8 non_res; // 0x08: Is this attribute non-resident? 375 u8 name_len; // 0x09: This attribute name length. 376 __le16 name_off; // 0x0A: Offset to the attribute name. 377 __le16 flags; // 0x0C: See ATTR_FLAG_XXX. 378 __le16 id; // 0x0E: Unique id (per record). 379 380 union { 381 struct ATTR_RESIDENT res; // 0x10 382 struct ATTR_NONRESIDENT nres; // 0x10 383 }; 384}; 385 386/* Define attribute sizes. */ 387#define SIZEOF_RESIDENT 0x18 388#define SIZEOF_NONRESIDENT_EX 0x48 389#define SIZEOF_NONRESIDENT 0x40 390 391#define SIZEOF_RESIDENT_LE cpu_to_le16(0x18) 392#define SIZEOF_NONRESIDENT_EX_LE cpu_to_le16(0x48) 393#define SIZEOF_NONRESIDENT_LE cpu_to_le16(0x40) 394 395static inline u64 attr_ondisk_size(const struct ATTRIB *attr) 396{ 397 return attr->non_res ? ((attr->flags & 398 (ATTR_FLAG_COMPRESSED | ATTR_FLAG_SPARSED)) ? 399 le64_to_cpu(attr->nres.total_size) : 400 le64_to_cpu(attr->nres.alloc_size)) 401 : ALIGN(le32_to_cpu(attr->res.data_size), 8); 402} 403 404static inline u64 attr_size(const struct ATTRIB *attr) 405{ 406 return attr->non_res ? le64_to_cpu(attr->nres.data_size) : 407 le32_to_cpu(attr->res.data_size); 408} 409 410static inline bool is_attr_encrypted(const struct ATTRIB *attr) 411{ 412 return attr->flags & ATTR_FLAG_ENCRYPTED; 413} 414 415static inline bool is_attr_sparsed(const struct ATTRIB *attr) 416{ 417 return attr->flags & ATTR_FLAG_SPARSED; 418} 419 420static inline bool is_attr_compressed(const struct ATTRIB *attr) 421{ 422 return attr->flags & ATTR_FLAG_COMPRESSED; 423} 424 425static inline bool is_attr_ext(const struct ATTRIB *attr) 426{ 427 return attr->flags & (ATTR_FLAG_SPARSED | ATTR_FLAG_COMPRESSED); 428} 429 430static inline bool is_attr_indexed(const struct ATTRIB *attr) 431{ 432 return !attr->non_res && (attr->res.flags & RESIDENT_FLAG_INDEXED); 433} 434 435static inline __le16 const *attr_name(const struct ATTRIB *attr) 436{ 437 return Add2Ptr(attr, le16_to_cpu(attr->name_off)); 438} 439 440static inline u64 attr_svcn(const struct ATTRIB *attr) 441{ 442 return attr->non_res ? le64_to_cpu(attr->nres.svcn) : 0; 443} 444 445static_assert(sizeof(struct ATTRIB) == 0x48); 446static_assert(sizeof(((struct ATTRIB *)NULL)->res) == 0x08); 447static_assert(sizeof(((struct ATTRIB *)NULL)->nres) == 0x38); 448 449static inline void *resident_data_ex(const struct ATTRIB *attr, u32 datasize) 450{ 451 u32 asize, rsize; 452 u16 off; 453 454 if (attr->non_res) 455 return NULL; 456 457 asize = le32_to_cpu(attr->size); 458 off = le16_to_cpu(attr->res.data_off); 459 460 if (asize < datasize + off) 461 return NULL; 462 463 rsize = le32_to_cpu(attr->res.data_size); 464 if (rsize < datasize) 465 return NULL; 466 467 return Add2Ptr(attr, off); 468} 469 470static inline void *resident_data(const struct ATTRIB *attr) 471{ 472 return Add2Ptr(attr, le16_to_cpu(attr->res.data_off)); 473} 474 475static inline void *attr_run(const struct ATTRIB *attr) 476{ 477 return Add2Ptr(attr, le16_to_cpu(attr->nres.run_off)); 478} 479 480/* Standard information attribute (0x10). */ 481struct ATTR_STD_INFO { 482 __le64 cr_time; // 0x00: File creation file. 483 __le64 m_time; // 0x08: File modification time. 484 __le64 c_time; // 0x10: Last time any attribute was modified. 485 __le64 a_time; // 0x18: File last access time. 486 enum FILE_ATTRIBUTE fa; // 0x20: Standard DOS attributes & more. 487 __le32 max_ver_num; // 0x24: Maximum Number of Versions. 488 __le32 ver_num; // 0x28: Version Number. 489 __le32 class_id; // 0x2C: Class Id from bidirectional Class Id index. 490}; 491 492static_assert(sizeof(struct ATTR_STD_INFO) == 0x30); 493 494#define SECURITY_ID_INVALID 0x00000000 495#define SECURITY_ID_FIRST 0x00000100 496 497struct ATTR_STD_INFO5 { 498 __le64 cr_time; // 0x00: File creation file. 499 __le64 m_time; // 0x08: File modification time. 500 __le64 c_time; // 0x10: Last time any attribute was modified. 501 __le64 a_time; // 0x18: File last access time. 502 enum FILE_ATTRIBUTE fa; // 0x20: Standard DOS attributes & more. 503 __le32 max_ver_num; // 0x24: Maximum Number of Versions. 504 __le32 ver_num; // 0x28: Version Number. 505 __le32 class_id; // 0x2C: Class Id from bidirectional Class Id index. 506 507 __le32 owner_id; // 0x30: Owner Id of the user owning the file. 508 __le32 security_id; // 0x34: The Security Id is a key in the $SII Index and $SDS. 509 __le64 quota_charge; // 0x38: 510 __le64 usn; // 0x40: Last Update Sequence Number of the file. This is a direct 511 // index into the file $UsnJrnl. If zero, the USN Journal is 512 // disabled. 513}; 514 515static_assert(sizeof(struct ATTR_STD_INFO5) == 0x48); 516 517/* Attribute list entry structure (0x20) */ 518struct ATTR_LIST_ENTRY { 519 enum ATTR_TYPE type; // 0x00: The type of attribute. 520 __le16 size; // 0x04: The size of this record. 521 u8 name_len; // 0x06: The length of attribute name. 522 u8 name_off; // 0x07: The offset to attribute name. 523 __le64 vcn; // 0x08: Starting VCN of this attribute. 524 struct MFT_REF ref; // 0x10: MFT record number with attribute. 525 __le16 id; // 0x18: struct ATTRIB ID. 526 __le16 name[]; // 0x1A: To get real name use name_off. 527 528}; // sizeof(0x20) 529 530static inline u32 le_size(u8 name_len) 531{ 532 return ALIGN(offsetof(struct ATTR_LIST_ENTRY, name) + 533 name_len * sizeof(short), 8); 534} 535 536/* Returns 0 if 'attr' has the same type and name. */ 537static inline int le_cmp(const struct ATTR_LIST_ENTRY *le, 538 const struct ATTRIB *attr) 539{ 540 return le->type != attr->type || le->name_len != attr->name_len || 541 (!le->name_len && 542 memcmp(Add2Ptr(le, le->name_off), 543 Add2Ptr(attr, le16_to_cpu(attr->name_off)), 544 le->name_len * sizeof(short))); 545} 546 547static inline __le16 const *le_name(const struct ATTR_LIST_ENTRY *le) 548{ 549 return Add2Ptr(le, le->name_off); 550} 551 552/* File name types (the field type in struct ATTR_FILE_NAME). */ 553#define FILE_NAME_POSIX 0 554#define FILE_NAME_UNICODE 1 555#define FILE_NAME_DOS 2 556#define FILE_NAME_UNICODE_AND_DOS (FILE_NAME_DOS | FILE_NAME_UNICODE) 557 558/* Filename attribute structure (0x30). */ 559struct NTFS_DUP_INFO { 560 __le64 cr_time; // 0x00: File creation file. 561 __le64 m_time; // 0x08: File modification time. 562 __le64 c_time; // 0x10: Last time any attribute was modified. 563 __le64 a_time; // 0x18: File last access time. 564 __le64 alloc_size; // 0x20: Data attribute allocated size, multiple of cluster size. 565 __le64 data_size; // 0x28: Data attribute size <= Dataalloc_size. 566 enum FILE_ATTRIBUTE fa; // 0x30: Standard DOS attributes & more. 567 __le16 ea_size; // 0x34: Packed EAs. 568 __le16 reparse; // 0x36: Used by Reparse. 569 570}; // 0x38 571 572struct ATTR_FILE_NAME { 573 struct MFT_REF home; // 0x00: MFT record for directory. 574 struct NTFS_DUP_INFO dup;// 0x08: 575 u8 name_len; // 0x40: File name length in words. 576 u8 type; // 0x41: File name type. 577 __le16 name[]; // 0x42: File name. 578}; 579 580static_assert(sizeof(((struct ATTR_FILE_NAME *)NULL)->dup) == 0x38); 581static_assert(offsetof(struct ATTR_FILE_NAME, name) == 0x42); 582#define SIZEOF_ATTRIBUTE_FILENAME 0x44 583#define SIZEOF_ATTRIBUTE_FILENAME_MAX (0x42 + 255 * 2) 584 585static inline struct ATTRIB *attr_from_name(struct ATTR_FILE_NAME *fname) 586{ 587 return (struct ATTRIB *)((char *)fname - SIZEOF_RESIDENT); 588} 589 590static inline u16 fname_full_size(const struct ATTR_FILE_NAME *fname) 591{ 592 /* Don't return struct_size(fname, name, fname->name_len); */ 593 return offsetof(struct ATTR_FILE_NAME, name) + 594 fname->name_len * sizeof(short); 595} 596 597static inline u8 paired_name(u8 type) 598{ 599 if (type == FILE_NAME_UNICODE) 600 return FILE_NAME_DOS; 601 if (type == FILE_NAME_DOS) 602 return FILE_NAME_UNICODE; 603 return FILE_NAME_POSIX; 604} 605 606/* Index entry defines ( the field flags in NtfsDirEntry ). */ 607#define NTFS_IE_HAS_SUBNODES cpu_to_le16(1) 608#define NTFS_IE_LAST cpu_to_le16(2) 609 610/* Directory entry structure. */ 611struct NTFS_DE { 612 union { 613 struct MFT_REF ref; // 0x00: MFT record number with this file. 614 struct { 615 __le16 data_off; // 0x00: 616 __le16 data_size; // 0x02: 617 __le32 res; // 0x04: Must be 0. 618 } view; 619 }; 620 __le16 size; // 0x08: The size of this entry. 621 __le16 key_size; // 0x0A: The size of File name length in bytes + 0x42. 622 __le16 flags; // 0x0C: Entry flags: NTFS_IE_XXX. 623 __le16 res; // 0x0E: 624 625 // Here any indexed attribute can be placed. 626 // One of them is: 627 // struct ATTR_FILE_NAME AttrFileName; 628 // 629 630 // The last 8 bytes of this structure contains 631 // the VBN of subnode. 632 // !!! Note !!! 633 // This field is presented only if (flags & NTFS_IE_HAS_SUBNODES) 634 // __le64 vbn; 635}; 636 637static_assert(sizeof(struct NTFS_DE) == 0x10); 638 639static inline void de_set_vbn_le(struct NTFS_DE *e, __le64 vcn) 640{ 641 __le64 *v = Add2Ptr(e, le16_to_cpu(e->size) - sizeof(__le64)); 642 643 *v = vcn; 644} 645 646static inline void de_set_vbn(struct NTFS_DE *e, CLST vcn) 647{ 648 __le64 *v = Add2Ptr(e, le16_to_cpu(e->size) - sizeof(__le64)); 649 650 *v = cpu_to_le64(vcn); 651} 652 653static inline __le64 de_get_vbn_le(const struct NTFS_DE *e) 654{ 655 return *(__le64 *)Add2Ptr(e, le16_to_cpu(e->size) - sizeof(__le64)); 656} 657 658static inline CLST de_get_vbn(const struct NTFS_DE *e) 659{ 660 __le64 *v = Add2Ptr(e, le16_to_cpu(e->size) - sizeof(__le64)); 661 662 return le64_to_cpu(*v); 663} 664 665static inline struct NTFS_DE *de_get_next(const struct NTFS_DE *e) 666{ 667 return Add2Ptr(e, le16_to_cpu(e->size)); 668} 669 670static inline struct ATTR_FILE_NAME *de_get_fname(const struct NTFS_DE *e) 671{ 672 return le16_to_cpu(e->key_size) >= SIZEOF_ATTRIBUTE_FILENAME ? 673 Add2Ptr(e, sizeof(struct NTFS_DE)) : 674 NULL; 675} 676 677static inline bool de_is_last(const struct NTFS_DE *e) 678{ 679 return e->flags & NTFS_IE_LAST; 680} 681 682static inline bool de_has_vcn(const struct NTFS_DE *e) 683{ 684 return e->flags & NTFS_IE_HAS_SUBNODES; 685} 686 687static inline bool de_has_vcn_ex(const struct NTFS_DE *e) 688{ 689 return (e->flags & NTFS_IE_HAS_SUBNODES) && 690 (u64)(-1) != *((u64 *)Add2Ptr(e, le16_to_cpu(e->size) - 691 sizeof(__le64))); 692} 693 694#define MAX_BYTES_PER_NAME_ENTRY \ 695 ALIGN(sizeof(struct NTFS_DE) + \ 696 offsetof(struct ATTR_FILE_NAME, name) + \ 697 NTFS_NAME_LEN * sizeof(short), 8) 698 699struct INDEX_HDR { 700 __le32 de_off; // 0x00: The offset from the start of this structure 701 // to the first NTFS_DE. 702 __le32 used; // 0x04: The size of this structure plus all 703 // entries (quad-word aligned). 704 __le32 total; // 0x08: The allocated size of for this structure plus all entries. 705 u8 flags; // 0x0C: 0x00 = Small directory, 0x01 = Large directory. 706 u8 res[3]; 707 708 // 709 // de_off + used <= total 710 // 711}; 712 713static_assert(sizeof(struct INDEX_HDR) == 0x10); 714 715static inline struct NTFS_DE *hdr_first_de(const struct INDEX_HDR *hdr) 716{ 717 u32 de_off = le32_to_cpu(hdr->de_off); 718 u32 used = le32_to_cpu(hdr->used); 719 struct NTFS_DE *e; 720 u16 esize; 721 722 if (de_off >= used || de_off + sizeof(struct NTFS_DE) > used ) 723 return NULL; 724 725 e = Add2Ptr(hdr, de_off); 726 esize = le16_to_cpu(e->size); 727 if (esize < sizeof(struct NTFS_DE) || de_off + esize > used) 728 return NULL; 729 730 return e; 731} 732 733static inline struct NTFS_DE *hdr_next_de(const struct INDEX_HDR *hdr, 734 const struct NTFS_DE *e) 735{ 736 size_t off = PtrOffset(hdr, e); 737 u32 used = le32_to_cpu(hdr->used); 738 u16 esize; 739 740 if (off >= used) 741 return NULL; 742 743 esize = le16_to_cpu(e->size); 744 745 if (esize < sizeof(struct NTFS_DE) || 746 off + esize + sizeof(struct NTFS_DE) > used) 747 return NULL; 748 749 return Add2Ptr(e, esize); 750} 751 752static inline bool hdr_has_subnode(const struct INDEX_HDR *hdr) 753{ 754 return hdr->flags & 1; 755} 756 757struct INDEX_BUFFER { 758 struct NTFS_RECORD_HEADER rhdr; // 'INDX' 759 __le64 vbn; // 0x10: vcn if index >= cluster or vsn id index < cluster 760 struct INDEX_HDR ihdr; // 0x18: 761}; 762 763static_assert(sizeof(struct INDEX_BUFFER) == 0x28); 764 765static inline bool ib_is_empty(const struct INDEX_BUFFER *ib) 766{ 767 const struct NTFS_DE *first = hdr_first_de(&ib->ihdr); 768 769 return !first || de_is_last(first); 770} 771 772static inline bool ib_is_leaf(const struct INDEX_BUFFER *ib) 773{ 774 return !(ib->ihdr.flags & 1); 775} 776 777/* Index root structure ( 0x90 ). */ 778enum COLLATION_RULE { 779 NTFS_COLLATION_TYPE_BINARY = cpu_to_le32(0), 780 // $I30 781 NTFS_COLLATION_TYPE_FILENAME = cpu_to_le32(0x01), 782 // $SII of $Secure and $Q of Quota 783 NTFS_COLLATION_TYPE_UINT = cpu_to_le32(0x10), 784 // $O of Quota 785 NTFS_COLLATION_TYPE_SID = cpu_to_le32(0x11), 786 // $SDH of $Secure 787 NTFS_COLLATION_TYPE_SECURITY_HASH = cpu_to_le32(0x12), 788 // $O of ObjId and "$R" for Reparse 789 NTFS_COLLATION_TYPE_UINTS = cpu_to_le32(0x13) 790}; 791 792static_assert(sizeof(enum COLLATION_RULE) == 4); 793 794// 795struct INDEX_ROOT { 796 enum ATTR_TYPE type; // 0x00: The type of attribute to index on. 797 enum COLLATION_RULE rule; // 0x04: The rule. 798 __le32 index_block_size;// 0x08: The size of index record. 799 u8 index_block_clst; // 0x0C: The number of clusters or sectors per index. 800 u8 res[3]; 801 struct INDEX_HDR ihdr; // 0x10: 802}; 803 804static_assert(sizeof(struct INDEX_ROOT) == 0x20); 805static_assert(offsetof(struct INDEX_ROOT, ihdr) == 0x10); 806 807#define VOLUME_FLAG_DIRTY cpu_to_le16(0x0001) 808#define VOLUME_FLAG_RESIZE_LOG_FILE cpu_to_le16(0x0002) 809 810struct VOLUME_INFO { 811 __le64 res1; // 0x00 812 u8 major_ver; // 0x08: NTFS major version number (before .) 813 u8 minor_ver; // 0x09: NTFS minor version number (after .) 814 __le16 flags; // 0x0A: Volume flags, see VOLUME_FLAG_XXX 815 816}; // sizeof=0xC 817 818#define SIZEOF_ATTRIBUTE_VOLUME_INFO 0xc 819 820#define NTFS_LABEL_MAX_LENGTH (0x100 / sizeof(short)) 821#define NTFS_ATTR_INDEXABLE cpu_to_le32(0x00000002) 822#define NTFS_ATTR_DUPALLOWED cpu_to_le32(0x00000004) 823#define NTFS_ATTR_MUST_BE_INDEXED cpu_to_le32(0x00000010) 824#define NTFS_ATTR_MUST_BE_NAMED cpu_to_le32(0x00000020) 825#define NTFS_ATTR_MUST_BE_RESIDENT cpu_to_le32(0x00000040) 826#define NTFS_ATTR_LOG_ALWAYS cpu_to_le32(0x00000080) 827 828/* $AttrDef file entry. */ 829struct ATTR_DEF_ENTRY { 830 __le16 name[0x40]; // 0x00: Attr name. 831 enum ATTR_TYPE type; // 0x80: struct ATTRIB type. 832 __le32 res; // 0x84: 833 enum COLLATION_RULE rule; // 0x88: 834 __le32 flags; // 0x8C: NTFS_ATTR_XXX (see above). 835 __le64 min_sz; // 0x90: Minimum attribute data size. 836 __le64 max_sz; // 0x98: Maximum attribute data size. 837}; 838 839static_assert(sizeof(struct ATTR_DEF_ENTRY) == 0xa0); 840 841/* Object ID (0x40) */ 842struct OBJECT_ID { 843 struct GUID ObjId; // 0x00: Unique Id assigned to file. 844 845 // Birth Volume Id is the Object Id of the Volume on. 846 // which the Object Id was allocated. It never changes. 847 struct GUID BirthVolumeId; //0x10: 848 849 // Birth Object Id is the first Object Id that was 850 // ever assigned to this MFT Record. I.e. If the Object Id 851 // is changed for some reason, this field will reflect the 852 // original value of the Object Id. 853 struct GUID BirthObjectId; // 0x20: 854 855 // Domain Id is currently unused but it is intended to be 856 // used in a network environment where the local machine is 857 // part of a Windows 2000 Domain. This may be used in a Windows 858 // 2000 Advanced Server managed domain. 859 struct GUID DomainId; // 0x30: 860}; 861 862static_assert(sizeof(struct OBJECT_ID) == 0x40); 863 864/* O Directory entry structure ( rule = 0x13 ) */ 865struct NTFS_DE_O { 866 struct NTFS_DE de; 867 struct GUID ObjId; // 0x10: Unique Id assigned to file. 868 struct MFT_REF ref; // 0x20: MFT record number with this file. 869 870 // Birth Volume Id is the Object Id of the Volume on 871 // which the Object Id was allocated. It never changes. 872 struct GUID BirthVolumeId; // 0x28: 873 874 // Birth Object Id is the first Object Id that was 875 // ever assigned to this MFT Record. I.e. If the Object Id 876 // is changed for some reason, this field will reflect the 877 // original value of the Object Id. 878 // This field is valid if data_size == 0x48. 879 struct GUID BirthObjectId; // 0x38: 880 881 // Domain Id is currently unused but it is intended 882 // to be used in a network environment where the local 883 // machine is part of a Windows 2000 Domain. This may be 884 // used in a Windows 2000 Advanced Server managed domain. 885 struct GUID BirthDomainId; // 0x48: 886}; 887 888static_assert(sizeof(struct NTFS_DE_O) == 0x58); 889 890/* Q Directory entry structure ( rule = 0x11 ) */ 891struct NTFS_DE_Q { 892 struct NTFS_DE de; 893 __le32 owner_id; // 0x10: Unique Id assigned to file 894 895 /* here is 0x30 bytes of user quota. NOTE: 4 byte aligned! */ 896 __le32 Version; // 0x14: 0x02 897 __le32 Flags; // 0x18: Quota flags, see above 898 __le64 BytesUsed; // 0x1C: 899 __le64 ChangeTime; // 0x24: 900 __le64 WarningLimit; // 0x28: 901 __le64 HardLimit; // 0x34: 902 __le64 ExceededTime; // 0x3C: 903 904 // SID is placed here 905}__packed; // sizeof() = 0x44 906 907static_assert(sizeof(struct NTFS_DE_Q) == 0x44); 908 909#define SecurityDescriptorsBlockSize 0x40000 // 256K 910#define SecurityDescriptorMaxSize 0x20000 // 128K 911#define Log2OfSecurityDescriptorsBlockSize 18 912 913struct SECURITY_KEY { 914 __le32 hash; // Hash value for descriptor 915 __le32 sec_id; // Security Id (guaranteed unique) 916}; 917 918/* Security descriptors (the content of $Secure::SDS data stream) */ 919struct SECURITY_HDR { 920 struct SECURITY_KEY key; // 0x00: Security Key. 921 __le64 off; // 0x08: Offset of this entry in the file. 922 __le32 size; // 0x10: Size of this entry, 8 byte aligned. 923 /* 924 * Security descriptor itself is placed here. 925 * Total size is 16 byte aligned. 926 */ 927} __packed; 928 929static_assert(sizeof(struct SECURITY_HDR) == 0x14); 930 931/* SII Directory entry structure */ 932struct NTFS_DE_SII { 933 struct NTFS_DE de; 934 __le32 sec_id; // 0x10: Key: sizeof(security_id) = wKeySize 935 struct SECURITY_HDR sec_hdr; // 0x14: 936} __packed; 937 938static_assert(offsetof(struct NTFS_DE_SII, sec_hdr) == 0x14); 939static_assert(sizeof(struct NTFS_DE_SII) == 0x28); 940 941/* SDH Directory entry structure */ 942struct NTFS_DE_SDH { 943 struct NTFS_DE de; 944 struct SECURITY_KEY key; // 0x10: Key 945 struct SECURITY_HDR sec_hdr; // 0x18: Data 946 __le16 magic[2]; // 0x2C: 0x00490049 "I I" 947}; 948 949#define SIZEOF_SDH_DIRENTRY 0x30 950 951struct REPARSE_KEY { 952 __le32 ReparseTag; // 0x00: Reparse Tag 953 struct MFT_REF ref; // 0x04: MFT record number with this file 954}; // sizeof() = 0x0C 955 956static_assert(offsetof(struct REPARSE_KEY, ref) == 0x04); 957#define SIZEOF_REPARSE_KEY 0x0C 958 959/* Reparse Directory entry structure */ 960struct NTFS_DE_R { 961 struct NTFS_DE de; 962 struct REPARSE_KEY key; // 0x10: Reparse Key. 963 u32 zero; // 0x1c: 964}; // sizeof() = 0x20 965 966static_assert(sizeof(struct NTFS_DE_R) == 0x20); 967 968/* CompressReparseBuffer.WofVersion */ 969#define WOF_CURRENT_VERSION cpu_to_le32(1) 970/* CompressReparseBuffer.WofProvider */ 971#define WOF_PROVIDER_WIM cpu_to_le32(1) 972/* CompressReparseBuffer.WofProvider */ 973#define WOF_PROVIDER_SYSTEM cpu_to_le32(2) 974/* CompressReparseBuffer.ProviderVer */ 975#define WOF_PROVIDER_CURRENT_VERSION cpu_to_le32(1) 976 977#define WOF_COMPRESSION_XPRESS4K cpu_to_le32(0) // 4k 978#define WOF_COMPRESSION_LZX32K cpu_to_le32(1) // 32k 979#define WOF_COMPRESSION_XPRESS8K cpu_to_le32(2) // 8k 980#define WOF_COMPRESSION_XPRESS16K cpu_to_le32(3) // 16k 981 982/* 983 * ATTR_REPARSE (0xC0) 984 * 985 * The reparse struct GUID structure is used by all 3rd party layered drivers to 986 * store data in a reparse point. For non-Microsoft tags, The struct GUID field 987 * cannot be GUID_NULL. 988 * The constraints on reparse tags are defined below. 989 * Microsoft tags can also be used with this format of the reparse point buffer. 990 */ 991struct REPARSE_POINT { 992 __le32 ReparseTag; // 0x00: 993 __le16 ReparseDataLength;// 0x04: 994 __le16 Reserved; 995 996 struct GUID Guid; // 0x08: 997 998 // 999 // Here GenericReparseBuffer is placed 1000 // 1001}; 1002 1003static_assert(sizeof(struct REPARSE_POINT) == 0x18); 1004 1005/* Maximum allowed size of the reparse data. */ 1006#define MAXIMUM_REPARSE_DATA_BUFFER_SIZE (16 * 1024) 1007 1008/* 1009 * The value of the following constant needs to satisfy the following 1010 * conditions: 1011 * (1) Be at least as large as the largest of the reserved tags. 1012 * (2) Be strictly smaller than all the tags in use. 1013 */ 1014#define IO_REPARSE_TAG_RESERVED_RANGE 1 1015 1016/* 1017 * The reparse tags are a ULONG. The 32 bits are laid out as follows: 1018 * 1019 * 3 3 2 2 2 2 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1 1020 * 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 1021 * +-+-+-+-+-----------------------+-------------------------------+ 1022 * |M|R|N|R| Reserved bits | Reparse Tag Value | 1023 * +-+-+-+-+-----------------------+-------------------------------+ 1024 * 1025 * M is the Microsoft bit. When set to 1, it denotes a tag owned by Microsoft. 1026 * All ISVs must use a tag with a 0 in this position. 1027 * Note: If a Microsoft tag is used by non-Microsoft software, the 1028 * behavior is not defined. 1029 * 1030 * R is reserved. Must be zero for non-Microsoft tags. 1031 * 1032 * N is name surrogate. When set to 1, the file represents another named 1033 * entity in the system. 1034 * 1035 * The M and N bits are OR-able. 1036 * The following macros check for the M and N bit values: 1037 */ 1038 1039/* 1040 * Macro to determine whether a reparse point tag corresponds to a tag 1041 * owned by Microsoft. 1042 */ 1043#define IsReparseTagMicrosoft(_tag) (((_tag)&IO_REPARSE_TAG_MICROSOFT)) 1044 1045/* Macro to determine whether a reparse point tag is a name surrogate. */ 1046#define IsReparseTagNameSurrogate(_tag) (((_tag)&IO_REPARSE_TAG_NAME_SURROGATE)) 1047 1048/* 1049 * The following constant represents the bits that are valid to use in 1050 * reparse tags. 1051 */ 1052#define IO_REPARSE_TAG_VALID_VALUES 0xF000FFFF 1053 1054/* 1055 * Macro to determine whether a reparse tag is a valid tag. 1056 */ 1057#define IsReparseTagValid(_tag) \ 1058 (!((_tag) & ~IO_REPARSE_TAG_VALID_VALUES) && \ 1059 ((_tag) > IO_REPARSE_TAG_RESERVED_RANGE)) 1060 1061/* Microsoft tags for reparse points. */ 1062 1063enum IO_REPARSE_TAG { 1064 IO_REPARSE_TAG_SYMBOLIC_LINK = cpu_to_le32(0), 1065 IO_REPARSE_TAG_NAME_SURROGATE = cpu_to_le32(0x20000000), 1066 IO_REPARSE_TAG_MICROSOFT = cpu_to_le32(0x80000000), 1067 IO_REPARSE_TAG_MOUNT_POINT = cpu_to_le32(0xA0000003), 1068 IO_REPARSE_TAG_SYMLINK = cpu_to_le32(0xA000000C), 1069 IO_REPARSE_TAG_HSM = cpu_to_le32(0xC0000004), 1070 IO_REPARSE_TAG_SIS = cpu_to_le32(0x80000007), 1071 IO_REPARSE_TAG_DEDUP = cpu_to_le32(0x80000013), 1072 IO_REPARSE_TAG_COMPRESS = cpu_to_le32(0x80000017), 1073 1074 /* 1075 * The reparse tag 0x80000008 is reserved for Microsoft internal use. 1076 * May be published in the future. 1077 */ 1078 1079 /* Microsoft reparse tag reserved for DFS */ 1080 IO_REPARSE_TAG_DFS = cpu_to_le32(0x8000000A), 1081 1082 /* Microsoft reparse tag reserved for the file system filter manager. */ 1083 IO_REPARSE_TAG_FILTER_MANAGER = cpu_to_le32(0x8000000B), 1084 1085 /* Non-Microsoft tags for reparse points */ 1086 1087 /* Tag allocated to CONGRUENT, May 2000. Used by IFSTEST. */ 1088 IO_REPARSE_TAG_IFSTEST_CONGRUENT = cpu_to_le32(0x00000009), 1089 1090 /* Tag allocated to ARKIVIO. */ 1091 IO_REPARSE_TAG_ARKIVIO = cpu_to_le32(0x0000000C), 1092 1093 /* Tag allocated to SOLUTIONSOFT. */ 1094 IO_REPARSE_TAG_SOLUTIONSOFT = cpu_to_le32(0x2000000D), 1095 1096 /* Tag allocated to COMMVAULT. */ 1097 IO_REPARSE_TAG_COMMVAULT = cpu_to_le32(0x0000000E), 1098 1099 /* OneDrive?? */ 1100 IO_REPARSE_TAG_CLOUD = cpu_to_le32(0x9000001A), 1101 IO_REPARSE_TAG_CLOUD_1 = cpu_to_le32(0x9000101A), 1102 IO_REPARSE_TAG_CLOUD_2 = cpu_to_le32(0x9000201A), 1103 IO_REPARSE_TAG_CLOUD_3 = cpu_to_le32(0x9000301A), 1104 IO_REPARSE_TAG_CLOUD_4 = cpu_to_le32(0x9000401A), 1105 IO_REPARSE_TAG_CLOUD_5 = cpu_to_le32(0x9000501A), 1106 IO_REPARSE_TAG_CLOUD_6 = cpu_to_le32(0x9000601A), 1107 IO_REPARSE_TAG_CLOUD_7 = cpu_to_le32(0x9000701A), 1108 IO_REPARSE_TAG_CLOUD_8 = cpu_to_le32(0x9000801A), 1109 IO_REPARSE_TAG_CLOUD_9 = cpu_to_le32(0x9000901A), 1110 IO_REPARSE_TAG_CLOUD_A = cpu_to_le32(0x9000A01A), 1111 IO_REPARSE_TAG_CLOUD_B = cpu_to_le32(0x9000B01A), 1112 IO_REPARSE_TAG_CLOUD_C = cpu_to_le32(0x9000C01A), 1113 IO_REPARSE_TAG_CLOUD_D = cpu_to_le32(0x9000D01A), 1114 IO_REPARSE_TAG_CLOUD_E = cpu_to_le32(0x9000E01A), 1115 IO_REPARSE_TAG_CLOUD_F = cpu_to_le32(0x9000F01A), 1116 1117}; 1118 1119#define SYMLINK_FLAG_RELATIVE 1 1120 1121/* Microsoft reparse buffer. (see DDK for details) */ 1122struct REPARSE_DATA_BUFFER { 1123 __le32 ReparseTag; // 0x00: 1124 __le16 ReparseDataLength; // 0x04: 1125 __le16 Reserved; 1126 1127 union { 1128 /* If ReparseTag == 0xA0000003 (IO_REPARSE_TAG_MOUNT_POINT) */ 1129 struct { 1130 __le16 SubstituteNameOffset; // 0x08 1131 __le16 SubstituteNameLength; // 0x0A 1132 __le16 PrintNameOffset; // 0x0C 1133 __le16 PrintNameLength; // 0x0E 1134 __le16 PathBuffer[]; // 0x10 1135 } MountPointReparseBuffer; 1136 1137 /* 1138 * If ReparseTag == 0xA000000C (IO_REPARSE_TAG_SYMLINK) 1139 * https://msdn.microsoft.com/en-us/library/cc232006.aspx 1140 */ 1141 struct { 1142 __le16 SubstituteNameOffset; // 0x08 1143 __le16 SubstituteNameLength; // 0x0A 1144 __le16 PrintNameOffset; // 0x0C 1145 __le16 PrintNameLength; // 0x0E 1146 // 0-absolute path 1- relative path, SYMLINK_FLAG_RELATIVE 1147 __le32 Flags; // 0x10 1148 __le16 PathBuffer[]; // 0x14 1149 } SymbolicLinkReparseBuffer; 1150 1151 /* If ReparseTag == 0x80000017U */ 1152 struct { 1153 __le32 WofVersion; // 0x08 == 1 1154 /* 1155 * 1 - WIM backing provider ("WIMBoot"), 1156 * 2 - System compressed file provider 1157 */ 1158 __le32 WofProvider; // 0x0C: 1159 __le32 ProviderVer; // 0x10: == 1 WOF_FILE_PROVIDER_CURRENT_VERSION == 1 1160 __le32 CompressionFormat; // 0x14: 0, 1, 2, 3. See WOF_COMPRESSION_XXX 1161 } CompressReparseBuffer; 1162 1163 struct { 1164 u8 DataBuffer[1]; // 0x08: 1165 } GenericReparseBuffer; 1166 }; 1167}; 1168 1169/* ATTR_EA_INFO (0xD0) */ 1170 1171#define FILE_NEED_EA 0x80 // See ntifs.h 1172/* 1173 * FILE_NEED_EA, indicates that the file to which the EA belongs cannot be 1174 * interpreted without understanding the associated extended attributes. 1175 */ 1176struct EA_INFO { 1177 __le16 size_pack; // 0x00: Size of buffer to hold in packed form. 1178 __le16 count; // 0x02: Count of EA's with FILE_NEED_EA bit set. 1179 __le32 size; // 0x04: Size of buffer to hold in unpacked form. 1180}; 1181 1182static_assert(sizeof(struct EA_INFO) == 8); 1183 1184/* ATTR_EA (0xE0) */ 1185struct EA_FULL { 1186 __le32 size; // 0x00: (not in packed) 1187 u8 flags; // 0x04: 1188 u8 name_len; // 0x05: 1189 __le16 elength; // 0x06: 1190 u8 name[]; // 0x08: 1191}; 1192 1193static_assert(offsetof(struct EA_FULL, name) == 8); 1194 1195#define ACL_REVISION 2 1196#define ACL_REVISION_DS 4 1197 1198#define SE_SELF_RELATIVE cpu_to_le16(0x8000) 1199 1200struct SECURITY_DESCRIPTOR_RELATIVE { 1201 u8 Revision; 1202 u8 Sbz1; 1203 __le16 Control; 1204 __le32 Owner; 1205 __le32 Group; 1206 __le32 Sacl; 1207 __le32 Dacl; 1208}; 1209static_assert(sizeof(struct SECURITY_DESCRIPTOR_RELATIVE) == 0x14); 1210 1211struct ACE_HEADER { 1212 u8 AceType; 1213 u8 AceFlags; 1214 __le16 AceSize; 1215}; 1216static_assert(sizeof(struct ACE_HEADER) == 4); 1217 1218struct ACL { 1219 u8 AclRevision; 1220 u8 Sbz1; 1221 __le16 AclSize; 1222 __le16 AceCount; 1223 __le16 Sbz2; 1224}; 1225static_assert(sizeof(struct ACL) == 8); 1226 1227struct SID { 1228 u8 Revision; 1229 u8 SubAuthorityCount; 1230 u8 IdentifierAuthority[6]; 1231 __le32 SubAuthority[]; 1232}; 1233static_assert(offsetof(struct SID, SubAuthority) == 8); 1234 1235#endif /* _LINUX_NTFS3_NTFS_H */ 1236// clang-format on 1237