1/*
2 * layout.h - Ntfs on-disk layout structures.  Originated from the Linux-NTFS project.
3 *
4 * Copyright (c) 2000-2005 Anton Altaparmakov
5 * Copyright (c)      2005 Yura Pakhuchiy
6 * Copyright (c) 2005-2006 Szabolcs Szakacsits
7 *
8 * This program/include file is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License as published
10 * by the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 *
13 * This program/include file is distributed in the hope that it will be
14 * useful, but WITHOUT ANY WARRANTY; without even the implied warranty
15 * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program (in the main directory of the NTFS-3G
20 * distribution in the file COPYING); if not, write to the Free Software
21 * Foundation,Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
22 */
23
24#ifndef _NTFS_LAYOUT_H
25#define _NTFS_LAYOUT_H
26
27#include "types.h"
28#include "endians.h"
29#include "support.h"
30
31/* The NTFS oem_id */
32#define magicNTFS	const_cpu_to_le64(0x202020205346544e)	/* "NTFS    " */
33#define NTFS_SB_MAGIC	0x5346544e				/* 'NTFS' */
34
35/*
36 * Location of bootsector on partition:
37 *	The standard NTFS_BOOT_SECTOR is on sector 0 of the partition.
38 *	On NT4 and above there is one backup copy of the boot sector to
39 *	be found on the last sector of the partition (not normally accessible
40 *	from within Windows as the bootsector contained number of sectors
41 *	value is one less than the actual value!).
42 *	On versions of NT 3.51 and earlier, the backup copy was located at
43 *	number of sectors/2 (integer divide), i.e. in the middle of the volume.
44 */
45
46/**
47 * struct BIOS_PARAMETER_BLOCK - BIOS parameter block (bpb) structure.
48 */
49typedef struct {
50	le16 bytes_per_sector;		/* Size of a sector in bytes. */
51	u8  sectors_per_cluster;	/* Size of a cluster in sectors. */
52	le16 reserved_sectors;		/* zero */
53	u8  fats;			/* zero */
54	le16 root_entries;		/* zero */
55	le16 sectors;			/* zero */
56	u8  media_type;			/* 0xf8 = hard disk */
57	le16 sectors_per_fat;		/* zero */
58/*0x0d*/le16 sectors_per_track;		/* Required to boot Windows. */
59/*0x0f*/le16 heads;			/* Required to boot Windows. */
60/*0x11*/le32 hidden_sectors;		/* Offset to the start of the partition
61					   relative to the disk in sectors.
62					   Required to boot Windows. */
63/*0x15*/le32 large_sectors;		/* zero */
64/* sizeof() = 25 (0x19) bytes */
65} __attribute__((__packed__)) BIOS_PARAMETER_BLOCK;
66
67/**
68 * struct NTFS_BOOT_SECTOR - NTFS boot sector structure.
69 */
70typedef struct {
71	u8  jump[3];			/* Irrelevant (jump to boot up code).*/
72	le64 oem_id;			/* Magic "NTFS    ". */
73/*0x0b*/BIOS_PARAMETER_BLOCK bpb;	/* See BIOS_PARAMETER_BLOCK. */
74	u8 physical_drive;		/* 0x00 floppy, 0x80 hard disk */
75	u8 current_head;		/* zero */
76	u8 extended_boot_signature; 	/* 0x80 */
77	u8 reserved2;			/* zero */
78/*0x28*/sle64 number_of_sectors;		/* Number of sectors in volume. Gives
79					   maximum volume size of 2^63 sectors.
80					   Assuming standard sector size of 512
81					   bytes, the maximum byte size is
82					   approx. 4.7x10^21 bytes. (-; */
83	sle64 mft_lcn;			/* Cluster location of mft data. */
84	sle64 mftmirr_lcn;		/* Cluster location of copy of mft. */
85	s8  clusters_per_mft_record;	/* Mft record size in clusters. */
86	u8  reserved0[3];		/* zero */
87	s8  clusters_per_index_record;	/* Index block size in clusters. */
88	u8  reserved1[3];		/* zero */
89	le64 volume_serial_number;	/* Irrelevant (serial number). */
90	le32 checksum;			/* Boot sector checksum. */
91/*0x54*/u8  bootstrap[426];		/* Irrelevant (boot up code). */
92	le16 end_of_sector_marker;	/* End of bootsector magic. Always is
93					   0xaa55 in little endian. */
94/* sizeof() = 512 (0x200) bytes */
95} __attribute__((__packed__)) NTFS_BOOT_SECTOR;
96
97/**
98 * enum NTFS_RECORD_TYPES -
99 *
100 * Magic identifiers present at the beginning of all ntfs record containing
101 * records (like mft records for example).
102 */
103typedef enum {
104	/* Found in $MFT/$DATA. */
105	magic_FILE = const_cpu_to_le32(0x454c4946), /* Mft entry. */
106	magic_INDX = const_cpu_to_le32(0x58444e49), /* Index buffer. */
107	magic_HOLE = const_cpu_to_le32(0x454c4f48), /* ? (NTFS 3.0+?) */
108
109	/* Found in $LogFile/$DATA. */
110	magic_RSTR = const_cpu_to_le32(0x52545352), /* Restart page. */
111	magic_RCRD = const_cpu_to_le32(0x44524352), /* Log record page. */
112
113	/* Found in $LogFile/$DATA.  (May be found in $MFT/$DATA, also?) */
114	magic_CHKD = const_cpu_to_le32(0x444b4843), /* Modified by chkdsk. */
115
116	/* Found in all ntfs record containing records. */
117	magic_BAAD = const_cpu_to_le32(0x44414142), /* Failed multi sector
118						       transfer was detected. */
119
120	/*
121	 * Found in $LogFile/$DATA when a page is full or 0xff bytes and is
122	 * thus not initialized.  User has to initialize the page before using
123	 * it.
124	 */
125	magic_empty = const_cpu_to_le32(0xffffffff),/* Record is empty and has
126						       to be initialized before
127						       it can be used. */
128} NTFS_RECORD_TYPES;
129
130/*
131 * Generic magic comparison macros. Finally found a use for the ## preprocessor
132 * operator! (-8
133 */
134#define ntfs_is_magic(x, m)	(   (u32)(x) == (u32)magic_##m )
135#define ntfs_is_magicp(p, m)	( *(u32*)(p) == (u32)magic_##m )
136
137/*
138 * Specialised magic comparison macros for the NTFS_RECORD_TYPES defined above.
139 */
140#define ntfs_is_file_record(x)	( ntfs_is_magic (x, FILE) )
141#define ntfs_is_file_recordp(p)	( ntfs_is_magicp(p, FILE) )
142#define ntfs_is_mft_record(x)	( ntfs_is_file_record(x) )
143#define ntfs_is_mft_recordp(p)	( ntfs_is_file_recordp(p) )
144#define ntfs_is_indx_record(x)	( ntfs_is_magic (x, INDX) )
145#define ntfs_is_indx_recordp(p)	( ntfs_is_magicp(p, INDX) )
146#define ntfs_is_hole_record(x)	( ntfs_is_magic (x, HOLE) )
147#define ntfs_is_hole_recordp(p)	( ntfs_is_magicp(p, HOLE) )
148
149#define ntfs_is_rstr_record(x)	( ntfs_is_magic (x, RSTR) )
150#define ntfs_is_rstr_recordp(p)	( ntfs_is_magicp(p, RSTR) )
151#define ntfs_is_rcrd_record(x)	( ntfs_is_magic (x, RCRD) )
152#define ntfs_is_rcrd_recordp(p)	( ntfs_is_magicp(p, RCRD) )
153
154#define ntfs_is_chkd_record(x)	( ntfs_is_magic (x, CHKD) )
155#define ntfs_is_chkd_recordp(p)	( ntfs_is_magicp(p, CHKD) )
156
157#define ntfs_is_baad_record(x)	( ntfs_is_magic (x, BAAD) )
158#define ntfs_is_baad_recordp(p)	( ntfs_is_magicp(p, BAAD) )
159
160#define ntfs_is_empty_record(x)		( ntfs_is_magic (x, empty) )
161#define ntfs_is_empty_recordp(p)	( ntfs_is_magicp(p, empty) )
162
163
164/*
165 * The size of a logical sector in bytes, used as the sequence number stride for
166 * multi-sector transfers.  This is intended to be less than or equal to the
167 * physical sector size, since if this were greater than the physical sector
168 * size, then incomplete multi-sector transfers may not be detected.
169 */
170#define NTFS_BLOCK_SIZE		512
171#define NTFS_BLOCK_SIZE_BITS	9
172
173/**
174 * struct NTFS_RECORD -
175 *
176 * The Update Sequence Array (usa) is an array of the le16 values which belong
177 * to the end of each sector protected by the update sequence record in which
178 * this array is contained. Note that the first entry is the Update Sequence
179 * Number (usn), a cyclic counter of how many times the protected record has
180 * been written to disk. The values 0 and -1 (ie. 0xffff) are not used. All
181 * last le16's of each sector have to be equal to the usn (during reading) or
182 * are set to it (during writing). If they are not, an incomplete multi sector
183 * transfer has occurred when the data was written.
184 * The maximum size for the update sequence array is fixed to:
185 *	maximum size = usa_ofs + (usa_count * 2) = 510 bytes
186 * The 510 bytes comes from the fact that the last le16 in the array has to
187 * (obviously) finish before the last le16 of the first 512-byte sector.
188 * This formula can be used as a consistency check in that usa_ofs +
189 * (usa_count * 2) has to be less than or equal to 510.
190 */
191typedef struct {
192	NTFS_RECORD_TYPES magic;/* A four-byte magic identifying the
193				   record type and/or status. */
194	le16 usa_ofs;		/* Offset to the Update Sequence Array (usa)
195				   from the start of the ntfs record. */
196	le16 usa_count;		/* Number of le16 sized entries in the usa
197				   including the Update Sequence Number (usn),
198				   thus the number of fixups is the usa_count
199				   minus 1. */
200} __attribute__((__packed__)) NTFS_RECORD;
201
202/**
203 * enum NTFS_SYSTEM_FILES - System files mft record numbers.
204 *
205 * All these files are always marked as used in the bitmap attribute of the
206 * mft; presumably in order to avoid accidental allocation for random other
207 * mft records. Also, the sequence number for each of the system files is
208 * always equal to their mft record number and it is never modified.
209 */
210typedef enum {
211	FILE_MFT	= 0,	/* Master file table (mft). Data attribute
212				   contains the entries and bitmap attribute
213				   records which ones are in use (bit==1). */
214	FILE_MFTMirr	= 1,	/* Mft mirror: copy of first four mft records
215				   in data attribute. If cluster size > 4kiB,
216				   copy of first N mft records, with
217					N = cluster_size / mft_record_size. */
218	FILE_LogFile	= 2,	/* Journalling log in data attribute. */
219	FILE_Volume	= 3,	/* Volume name attribute and volume information
220				   attribute (flags and ntfs version). Windows
221				   refers to this file as volume DASD (Direct
222				   Access Storage Device). */
223	FILE_AttrDef	= 4,	/* Array of attribute definitions in data
224				   attribute. */
225	FILE_root	= 5,	/* Root directory. */
226	FILE_Bitmap	= 6,	/* Allocation bitmap of all clusters (lcns) in
227				   data attribute. */
228	FILE_Boot	= 7,	/* Boot sector (always at cluster 0) in data
229				   attribute. */
230	FILE_BadClus	= 8,	/* Contains all bad clusters in the non-resident
231				   data attribute. */
232	FILE_Secure	= 9,	/* Shared security descriptors in data attribute
233				   and two indexes into the descriptors.
234				   Appeared in Windows 2000. Before that, this
235				   file was named $Quota but was unused. */
236	FILE_UpCase	= 10,	/* Uppercase equivalents of all 65536 Unicode
237				   characters in data attribute. */
238	FILE_Extend	= 11,	/* Directory containing other system files (eg.
239				   $ObjId, $Quota, $Reparse and $UsnJrnl). This
240				   is new to NTFS3.0. */
241	FILE_reserved12	= 12,	/* Reserved for future use (records 12-15). */
242	FILE_reserved13	= 13,
243	FILE_reserved14	= 14,
244	FILE_mft_data	= 15,	/* Reserved for first extent of $MFT:$DATA */
245	FILE_first_user	= 16,	/* First user file, used as test limit for
246				   whether to allow opening a file or not. */
247} NTFS_SYSTEM_FILES;
248
249/**
250 * enum MFT_RECORD_FLAGS -
251 *
252 * These are the so far known MFT_RECORD_* flags (16-bit) which contain
253 * information about the mft record in which they are present.
254 *
255 * MFT_RECORD_IS_4 exists on all $Extend sub-files.
256 * It seems that it marks it is a metadata file with MFT record >24, however,
257 * it is unknown if it is limited to metadata files only.
258 *
259 * MFT_RECORD_IS_VIEW_INDEX exists on every metafile with a non directory
260 * index, that means an INDEX_ROOT and an INDEX_ALLOCATION with a name other
261 * than "$I30". It is unknown if it is limited to metadata files only.
262 */
263typedef enum {
264	MFT_RECORD_IN_USE		= const_cpu_to_le16(0x0001),
265	MFT_RECORD_IS_DIRECTORY		= const_cpu_to_le16(0x0002),
266	MFT_RECORD_IS_4			= const_cpu_to_le16(0x0004),
267	MFT_RECORD_IS_VIEW_INDEX	= const_cpu_to_le16(0x0008),
268	MFT_REC_SPACE_FILLER		= 0xffff, /* Just to make flags
269						     16-bit. */
270} __attribute__((__packed__)) MFT_RECORD_FLAGS;
271
272/*
273 * mft references (aka file references or file record segment references) are
274 * used whenever a structure needs to refer to a record in the mft.
275 *
276 * A reference consists of a 48-bit index into the mft and a 16-bit sequence
277 * number used to detect stale references.
278 *
279 * For error reporting purposes we treat the 48-bit index as a signed quantity.
280 *
281 * The sequence number is a circular counter (skipping 0) describing how many
282 * times the referenced mft record has been (re)used. This has to match the
283 * sequence number of the mft record being referenced, otherwise the reference
284 * is considered stale and removed (FIXME: only ntfsck or the driver itself?).
285 *
286 * If the sequence number is zero it is assumed that no sequence number
287 * consistency checking should be performed.
288 *
289 * FIXME: Since inodes are 32-bit as of now, the driver needs to always check
290 * for high_part being 0 and if not either BUG(), cause a panic() or handle
291 * the situation in some other way. This shouldn't be a problem as a volume has
292 * to become HUGE in order to need more than 32-bits worth of mft records.
293 * Assuming the standard mft record size of 1kb only the records (never mind
294 * the non-resident attributes, etc.) would require 4Tb of space on their own
295 * for the first 32 bits worth of records. This is only if some strange person
296 * doesn't decide to foul play and make the mft sparse which would be a really
297 * horrible thing to do as it would trash our current driver implementation. )-:
298 * Do I hear screams "we want 64-bit inodes!" ?!? (-;
299 *
300 * FIXME: The mft zone is defined as the first 12% of the volume. This space is
301 * reserved so that the mft can grow contiguously and hence doesn't become
302 * fragmented. Volume free space includes the empty part of the mft zone and
303 * when the volume's free 88% are used up, the mft zone is shrunk by a factor
304 * of 2, thus making more space available for more files/data. This process is
305 * repeated every time there is no more free space except for the mft zone until
306 * there really is no more free space.
307 */
308
309/*
310 * Typedef the MFT_REF as a 64-bit value for easier handling.
311 * Also define two unpacking macros to get to the reference (MREF) and
312 * sequence number (MSEQNO) respectively.
313 * The _LE versions are to be applied on little endian MFT_REFs.
314 * Note: The _LE versions will return a CPU endian formatted value!
315 */
316#define MFT_REF_MASK_CPU 0x0000ffffffffffffULL
317#define MFT_REF_MASK_LE const_cpu_to_le64(MFT_REF_MASK_CPU)
318
319typedef u64 MFT_REF;
320typedef le64 leMFT_REF;   /* a little-endian MFT_MREF */
321
322#define MK_MREF(m, s)	((MFT_REF)(((MFT_REF)(s) << 48) |		\
323					((MFT_REF)(m) & MFT_REF_MASK_CPU)))
324#define MK_LE_MREF(m, s) const_cpu_to_le64(((MFT_REF)(((MFT_REF)(s) << 48) | \
325					((MFT_REF)(m) & MFT_REF_MASK_CPU))))
326
327#define MREF(x)		((u64)((x) & MFT_REF_MASK_CPU))
328#define MSEQNO(x)	((u16)(((x) >> 48) & 0xffff))
329#define MREF_LE(x)	((u64)(const_le64_to_cpu(x) & MFT_REF_MASK_CPU))
330#define MSEQNO_LE(x)	((u16)((const_le64_to_cpu(x) >> 48) & 0xffff))
331
332#define IS_ERR_MREF(x)	(((x) & 0x0000800000000000ULL) ? 1 : 0)
333#define ERR_MREF(x)	((u64)((s64)(x)))
334#define MREF_ERR(x)	((int)((s64)(x)))
335
336/**
337 * struct MFT_RECORD - An MFT record layout (NTFS 3.1+)
338 *
339 * The mft record header present at the beginning of every record in the mft.
340 * This is followed by a sequence of variable length attribute records which
341 * is terminated by an attribute of type AT_END which is a truncated attribute
342 * in that it only consists of the attribute type code AT_END and none of the
343 * other members of the attribute structure are present.
344 */
345typedef struct {
346/*Ofs*/
347/*  0	NTFS_RECORD; -- Unfolded here as gcc doesn't like unnamed structs. */
348	NTFS_RECORD_TYPES magic;/* Usually the magic is "FILE". */
349	le16 usa_ofs;		/* See NTFS_RECORD definition above. */
350	le16 usa_count;		/* See NTFS_RECORD definition above. */
351
352/*  8*/	leLSN lsn;		/* $LogFile sequence number for this record.
353				   Changed every time the record is modified. */
354/* 16*/	le16 sequence_number;	/* Number of times this mft record has been
355				   reused. (See description for MFT_REF
356				   above.) NOTE: The increment (skipping zero)
357				   is done when the file is deleted. NOTE: If
358				   this is zero it is left zero. */
359/* 18*/	le16 link_count;		/* Number of hard links, i.e. the number of
360				   directory entries referencing this record.
361				   NOTE: Only used in mft base records.
362				   NOTE: When deleting a directory entry we
363				   check the link_count and if it is 1 we
364				   delete the file. Otherwise we delete the
365				   FILE_NAME_ATTR being referenced by the
366				   directory entry from the mft record and
367				   decrement the link_count.
368				   FIXME: Careful with Win32 + DOS names! */
369/* 20*/	le16 attrs_offset;	/* Byte offset to the first attribute in this
370				   mft record from the start of the mft record.
371				   NOTE: Must be aligned to 8-byte boundary. */
372/* 22*/	MFT_RECORD_FLAGS flags;	/* Bit array of MFT_RECORD_FLAGS. When a file
373				   is deleted, the MFT_RECORD_IN_USE flag is
374				   set to zero. */
375/* 24*/	le32 bytes_in_use;	/* Number of bytes used in this mft record.
376				   NOTE: Must be aligned to 8-byte boundary. */
377/* 28*/	le32 bytes_allocated;	/* Number of bytes allocated for this mft
378				   record. This should be equal to the mft
379				   record size. */
380/* 32*/	leMFT_REF base_mft_record;
381				/* This is zero for base mft records.
382				   When it is not zero it is a mft reference
383				   pointing to the base mft record to which
384				   this record belongs (this is then used to
385				   locate the attribute list attribute present
386				   in the base record which describes this
387				   extension record and hence might need
388				   modification when the extension record
389				   itself is modified, also locating the
390				   attribute list also means finding the other
391				   potential extents, belonging to the non-base
392				   mft record). */
393/* 40*/	le16 next_attr_instance; /* The instance number that will be
394				   assigned to the next attribute added to this
395				   mft record. NOTE: Incremented each time
396				   after it is used. NOTE: Every time the mft
397				   record is reused this number is set to zero.
398				   NOTE: The first instance number is always 0.
399				 */
400/* The below fields are specific to NTFS 3.1+ (Windows XP and above): */
401/* 42*/ le16 reserved;		/* Reserved/alignment. */
402/* 44*/ le32 mft_record_number;	/* Number of this mft record. */
403/* sizeof() = 48 bytes */
404/*
405 * When (re)using the mft record, we place the update sequence array at this
406 * offset, i.e. before we start with the attributes. This also makes sense,
407 * otherwise we could run into problems with the update sequence array
408 * containing in itself the last two bytes of a sector which would mean that
409 * multi sector transfer protection wouldn't work. As you can't protect data
410 * by overwriting it since you then can't get it back...
411 * When reading we obviously use the data from the ntfs record header.
412 */
413} __attribute__((__packed__)) MFT_RECORD;
414
415/**
416 * struct MFT_RECORD_OLD - An MFT record layout (NTFS <=3.0)
417 *
418 * This is the version without the NTFS 3.1+ specific fields.
419 */
420typedef struct {
421/*Ofs*/
422/*  0	NTFS_RECORD; -- Unfolded here as gcc doesn't like unnamed structs. */
423	NTFS_RECORD_TYPES magic;/* Usually the magic is "FILE". */
424	le16 usa_ofs;		/* See NTFS_RECORD definition above. */
425	le16 usa_count;		/* See NTFS_RECORD definition above. */
426
427/*  8*/	leLSN lsn;		/* $LogFile sequence number for this record.
428				   Changed every time the record is modified. */
429/* 16*/	le16 sequence_number;	/* Number of times this mft record has been
430				   reused. (See description for MFT_REF
431				   above.) NOTE: The increment (skipping zero)
432				   is done when the file is deleted. NOTE: If
433				   this is zero it is left zero. */
434/* 18*/	le16 link_count;		/* Number of hard links, i.e. the number of
435				   directory entries referencing this record.
436				   NOTE: Only used in mft base records.
437				   NOTE: When deleting a directory entry we
438				   check the link_count and if it is 1 we
439				   delete the file. Otherwise we delete the
440				   FILE_NAME_ATTR being referenced by the
441				   directory entry from the mft record and
442				   decrement the link_count.
443				   FIXME: Careful with Win32 + DOS names! */
444/* 20*/	le16 attrs_offset;	/* Byte offset to the first attribute in this
445				   mft record from the start of the mft record.
446				   NOTE: Must be aligned to 8-byte boundary. */
447/* 22*/	MFT_RECORD_FLAGS flags;	/* Bit array of MFT_RECORD_FLAGS. When a file
448				   is deleted, the MFT_RECORD_IN_USE flag is
449				   set to zero. */
450/* 24*/	le32 bytes_in_use;	/* Number of bytes used in this mft record.
451				   NOTE: Must be aligned to 8-byte boundary. */
452/* 28*/	le32 bytes_allocated;	/* Number of bytes allocated for this mft
453				   record. This should be equal to the mft
454				   record size. */
455/* 32*/	leMFT_REF base_mft_record;
456				/* This is zero for base mft records.
457				   When it is not zero it is a mft reference
458				   pointing to the base mft record to which
459				   this record belongs (this is then used to
460				   locate the attribute list attribute present
461				   in the base record which describes this
462				   extension record and hence might need
463				   modification when the extension record
464				   itself is modified, also locating the
465				   attribute list also means finding the other
466				   potential extents, belonging to the non-base
467				   mft record). */
468/* 40*/	le16 next_attr_instance; /* The instance number that will be
469				   assigned to the next attribute added to this
470				   mft record. NOTE: Incremented each time
471				   after it is used. NOTE: Every time the mft
472				   record is reused this number is set to zero.
473				   NOTE: The first instance number is always 0.
474				 */
475/* sizeof() = 42 bytes */
476/*
477 * When (re)using the mft record, we place the update sequence array at this
478 * offset, i.e. before we start with the attributes. This also makes sense,
479 * otherwise we could run into problems with the update sequence array
480 * containing in itself the last two bytes of a sector which would mean that
481 * multi sector transfer protection wouldn't work. As you can't protect data
482 * by overwriting it since you then can't get it back...
483 * When reading we obviously use the data from the ntfs record header.
484 */
485} __attribute__((__packed__)) MFT_RECORD_OLD;
486
487/**
488 * enum ATTR_TYPES - System defined attributes (32-bit).
489 *
490 * Each attribute type has a corresponding attribute name (Unicode string of
491 * maximum 64 character length) as described by the attribute definitions
492 * present in the data attribute of the $AttrDef system file.
493 *
494 * On NTFS 3.0 volumes the names are just as the types are named in the below
495 * enum exchanging AT_ for the dollar sign ($). If that isn't a revealing
496 * choice of symbol... (-;
497 */
498typedef enum {
499	AT_UNUSED			= const_cpu_to_le32(         0),
500	AT_STANDARD_INFORMATION		= const_cpu_to_le32(      0x10),
501	AT_ATTRIBUTE_LIST		= const_cpu_to_le32(      0x20),
502	AT_FILE_NAME			= const_cpu_to_le32(      0x30),
503	AT_OBJECT_ID			= const_cpu_to_le32(      0x40),
504	AT_SECURITY_DESCRIPTOR		= const_cpu_to_le32(      0x50),
505	AT_VOLUME_NAME			= const_cpu_to_le32(      0x60),
506	AT_VOLUME_INFORMATION		= const_cpu_to_le32(      0x70),
507	AT_DATA				= const_cpu_to_le32(      0x80),
508	AT_INDEX_ROOT			= const_cpu_to_le32(      0x90),
509	AT_INDEX_ALLOCATION		= const_cpu_to_le32(      0xa0),
510	AT_BITMAP			= const_cpu_to_le32(      0xb0),
511	AT_REPARSE_POINT		= const_cpu_to_le32(      0xc0),
512	AT_EA_INFORMATION		= const_cpu_to_le32(      0xd0),
513	AT_EA				= const_cpu_to_le32(      0xe0),
514	AT_PROPERTY_SET			= const_cpu_to_le32(      0xf0),
515	AT_LOGGED_UTILITY_STREAM	= const_cpu_to_le32(     0x100),
516	AT_FIRST_USER_DEFINED_ATTRIBUTE	= const_cpu_to_le32(    0x1000),
517	AT_END				= const_cpu_to_le32(0xffffffff),
518} ATTR_TYPES;
519
520/**
521 * enum COLLATION_RULES - The collation rules for sorting views/indexes/etc
522 * (32-bit).
523 *
524 * COLLATION_BINARY - Collate by binary compare where the first byte is most
525 *	significant.
526 * COLLATION_FILE_NAME - Collate Unicode strings by comparing their 16-bit
527 *	coding units, primarily ignoring case using the volume's $UpCase table,
528 *	but falling back to a case-sensitive comparison if the names are equal
529 *	ignoring case.
530 * COLLATION_UNICODE_STRING - TODO: this is not yet implemented and still needs
531 *	to be properly documented --- is it really the same as
532 *	COLLATION_FILE_NAME?
533 * COLLATION_NTOFS_ULONG - Sorting is done according to ascending le32 key
534 *	values. E.g. used for $SII index in FILE_Secure, which sorts by
535 *	security_id (le32).
536 * COLLATION_NTOFS_SID - Sorting is done according to ascending SID values.
537 *	E.g. used for $O index in FILE_Extend/$Quota.
538 * COLLATION_NTOFS_SECURITY_HASH - Sorting is done first by ascending hash
539 *	values and second by ascending security_id values. E.g. used for $SDH
540 *	index in FILE_Secure.
541 * COLLATION_NTOFS_ULONGS - Sorting is done according to a sequence of ascending
542 *	le32 key values. E.g. used for $O index in FILE_Extend/$ObjId, which
543 *	sorts by object_id (16-byte), by splitting up the object_id in four
544 *	le32 values and using them as individual keys. E.g. take the following
545 *	two security_ids, stored as follows on disk:
546 *		1st: a1 61 65 b7 65 7b d4 11 9e 3d 00 e0 81 10 42 59
547 *		2nd: 38 14 37 d2 d2 f3 d4 11 a5 21 c8 6b 79 b1 97 45
548 *	To compare them, they are split into four le32 values each, like so:
549 *		1st: 0xb76561a1 0x11d47b65 0xe0003d9e 0x59421081
550 *		2nd: 0xd2371438 0x11d4f3d2 0x6bc821a5 0x4597b179
551 *	Now, it is apparent why the 2nd object_id collates after the 1st: the
552 *	first le32 value of the 1st object_id is less than the first le32 of
553 *	the 2nd object_id. If the first le32 values of both object_ids were
554 *	equal then the second le32 values would be compared, etc.
555 */
556typedef enum {
557	COLLATION_BINARY		= const_cpu_to_le32(0),
558	COLLATION_FILE_NAME		= const_cpu_to_le32(1),
559	COLLATION_UNICODE_STRING	= const_cpu_to_le32(2),
560	COLLATION_NTOFS_ULONG		= const_cpu_to_le32(16),
561	COLLATION_NTOFS_SID		= const_cpu_to_le32(17),
562	COLLATION_NTOFS_SECURITY_HASH	= const_cpu_to_le32(18),
563	COLLATION_NTOFS_ULONGS		= const_cpu_to_le32(19),
564} COLLATION_RULES;
565
566/**
567 * enum ATTR_DEF_FLAGS -
568 *
569 * The flags (32-bit) describing attribute properties in the attribute
570 * definition structure.  FIXME: This information is based on Regis's
571 * information and, according to him, it is not certain and probably
572 * incomplete.  The INDEXABLE flag is fairly certainly correct as only the file
573 * name attribute has this flag set and this is the only attribute indexed in
574 * NT4.
575 */
576typedef enum {
577	ATTR_DEF_INDEXABLE	= const_cpu_to_le32(0x02), /* Attribute can be
578					indexed. */
579	ATTR_DEF_MULTIPLE	= const_cpu_to_le32(0x04), /* Attribute type
580					can be present multiple times in the
581					mft records of an inode. */
582	ATTR_DEF_NOT_ZERO	= const_cpu_to_le32(0x08), /* Attribute value
583					must contain at least one non-zero
584					byte. */
585	ATTR_DEF_INDEXED_UNIQUE	= const_cpu_to_le32(0x10), /* Attribute must be
586					indexed and the attribute value must be
587					unique for the attribute type in all of
588					the mft records of an inode. */
589	ATTR_DEF_NAMED_UNIQUE	= const_cpu_to_le32(0x20), /* Attribute must be
590					named and the name must be unique for
591					the attribute type in all of the mft
592					records of an inode. */
593	ATTR_DEF_RESIDENT	= const_cpu_to_le32(0x40), /* Attribute must be
594					resident. */
595	ATTR_DEF_ALWAYS_LOG	= const_cpu_to_le32(0x80), /* Always log
596					modifications to this attribute,
597					regardless of whether it is resident or
598					non-resident.  Without this, only log
599					modifications if the attribute is
600					resident. */
601} ATTR_DEF_FLAGS;
602
603/**
604 * struct ATTR_DEF -
605 *
606 * The data attribute of FILE_AttrDef contains a sequence of attribute
607 * definitions for the NTFS volume. With this, it is supposed to be safe for an
608 * older NTFS driver to mount a volume containing a newer NTFS version without
609 * damaging it (that's the theory. In practice it's: not damaging it too much).
610 * Entries are sorted by attribute type. The flags describe whether the
611 * attribute can be resident/non-resident and possibly other things, but the
612 * actual bits are unknown.
613 */
614typedef struct {
615/*hex ofs*/
616/*  0*/	ntfschar name[0x40];		/* Unicode name of the attribute. Zero
617					   terminated. */
618/* 80*/	ATTR_TYPES type;		/* Type of the attribute. */
619/* 84*/	le32 display_rule;		/* Default display rule.
620					   FIXME: What does it mean? (AIA) */
621/* 88*/ COLLATION_RULES collation_rule;	/* Default collation rule. */
622/* 8c*/	ATTR_DEF_FLAGS flags;		/* Flags describing the attribute. */
623/* 90*/	sle64 min_size;			/* Optional minimum attribute size. */
624/* 98*/	sle64 max_size;			/* Maximum size of attribute. */
625/* sizeof() = 0xa0 or 160 bytes */
626} __attribute__((__packed__)) ATTR_DEF;
627
628/**
629 * enum ATTR_FLAGS - Attribute flags (16-bit).
630 */
631typedef enum {
632	ATTR_IS_COMPRESSED	= const_cpu_to_le16(0x0001),
633	ATTR_COMPRESSION_MASK	= const_cpu_to_le16(0x00ff),  /* Compression
634						method mask. Also, first
635						illegal value. */
636	ATTR_IS_ENCRYPTED	= const_cpu_to_le16(0x4000),
637	ATTR_IS_SPARSE		= const_cpu_to_le16(0x8000),
638} __attribute__((__packed__)) ATTR_FLAGS;
639
640/*
641 * Attribute compression.
642 *
643 * Only the data attribute is ever compressed in the current ntfs driver in
644 * Windows. Further, compression is only applied when the data attribute is
645 * non-resident. Finally, to use compression, the maximum allowed cluster size
646 * on a volume is 4kib.
647 *
648 * The compression method is based on independently compressing blocks of X
649 * clusters, where X is determined from the compression_unit value found in the
650 * non-resident attribute record header (more precisely: X = 2^compression_unit
651 * clusters). On Windows NT/2k, X always is 16 clusters (compression_unit = 4).
652 *
653 * There are three different cases of how a compression block of X clusters
654 * can be stored:
655 *
656 *   1) The data in the block is all zero (a sparse block):
657 *	  This is stored as a sparse block in the runlist, i.e. the runlist
658 *	  entry has length = X and lcn = -1. The mapping pairs array actually
659 *	  uses a delta_lcn value length of 0, i.e. delta_lcn is not present at
660 *	  all, which is then interpreted by the driver as lcn = -1.
661 *	  NOTE: Even uncompressed files can be sparse on NTFS 3.0 volumes, then
662 *	  the same principles apply as above, except that the length is not
663 *	  restricted to being any particular value.
664 *
665 *   2) The data in the block is not compressed:
666 *	  This happens when compression doesn't reduce the size of the block
667 *	  in clusters. I.e. if compression has a small effect so that the
668 *	  compressed data still occupies X clusters, then the uncompressed data
669 *	  is stored in the block.
670 *	  This case is recognised by the fact that the runlist entry has
671 *	  length = X and lcn >= 0. The mapping pairs array stores this as
672 *	  normal with a run length of X and some specific delta_lcn, i.e.
673 *	  delta_lcn has to be present.
674 *
675 *   3) The data in the block is compressed:
676 *	  The common case. This case is recognised by the fact that the run
677 *	  list entry has length L < X and lcn >= 0. The mapping pairs array
678 *	  stores this as normal with a run length of X and some specific
679 *	  delta_lcn, i.e. delta_lcn has to be present. This runlist entry is
680 *	  immediately followed by a sparse entry with length = X - L and
681 *	  lcn = -1. The latter entry is to make up the vcn counting to the
682 *	  full compression block size X.
683 *
684 * In fact, life is more complicated because adjacent entries of the same type
685 * can be coalesced. This means that one has to keep track of the number of
686 * clusters handled and work on a basis of X clusters at a time being one
687 * block. An example: if length L > X this means that this particular runlist
688 * entry contains a block of length X and part of one or more blocks of length
689 * L - X. Another example: if length L < X, this does not necessarily mean that
690 * the block is compressed as it might be that the lcn changes inside the block
691 * and hence the following runlist entry describes the continuation of the
692 * potentially compressed block. The block would be compressed if the
693 * following runlist entry describes at least X - L sparse clusters, thus
694 * making up the compression block length as described in point 3 above. (Of
695 * course, there can be several runlist entries with small lengths so that the
696 * sparse entry does not follow the first data containing entry with
697 * length < X.)
698 *
699 * NOTE: At the end of the compressed attribute value, there most likely is not
700 * just the right amount of data to make up a compression block, thus this data
701 * is not even attempted to be compressed. It is just stored as is, unless
702 * the number of clusters it occupies is reduced when compressed in which case
703 * it is stored as a compressed compression block, complete with sparse
704 * clusters at the end.
705 */
706
707/**
708 * enum RESIDENT_ATTR_FLAGS - Flags of resident attributes (8-bit).
709 */
710typedef enum {
711	RESIDENT_ATTR_IS_INDEXED = 0x01, /* Attribute is referenced in an index
712					    (has implications for deleting and
713					    modifying the attribute). */
714} __attribute__((__packed__)) RESIDENT_ATTR_FLAGS;
715
716/**
717 * struct ATTR_RECORD - Attribute record header.
718 *
719 * Always aligned to 8-byte boundary.
720 */
721typedef struct {
722/*Ofs*/
723/*  0*/	ATTR_TYPES type;	/* The (32-bit) type of the attribute. */
724/*  4*/	le32 length;		/* Byte size of the resident part of the
725				   attribute (aligned to 8-byte boundary).
726				   Used to get to the next attribute. */
727/*  8*/	u8 non_resident;	/* If 0, attribute is resident.
728				   If 1, attribute is non-resident. */
729/*  9*/	u8 name_length;		/* Unicode character size of name of attribute.
730				   0 if unnamed. */
731/* 10*/	le16 name_offset;	/* If name_length != 0, the byte offset to the
732				   beginning of the name from the attribute
733				   record. Note that the name is stored as a
734				   Unicode string. When creating, place offset
735				   just at the end of the record header. Then,
736				   follow with attribute value or mapping pairs
737				   array, resident and non-resident attributes
738				   respectively, aligning to an 8-byte
739				   boundary. */
740/* 12*/	ATTR_FLAGS flags;	/* Flags describing the attribute. */
741/* 14*/	le16 instance;		/* The instance of this attribute record. This
742				   number is unique within this mft record (see
743				   MFT_RECORD/next_attribute_instance notes
744				   above for more details). */
745/* 16*/	union {
746		/* Resident attributes. */
747		struct {
748/* 16 */		le32 value_length; /* Byte size of attribute value. */
749/* 20 */		le16 value_offset; /* Byte offset of the attribute
750					       value from the start of the
751					       attribute record. When creating,
752					       align to 8-byte boundary if we
753					       have a name present as this might
754					       not have a length of a multiple
755					       of 8-bytes. */
756/* 22 */		RESIDENT_ATTR_FLAGS resident_flags; /* See above. */
757/* 23 */		s8 reservedR;	    /* Reserved/alignment to 8-byte
758					       boundary. */
759/* 24 */		void *resident_end[0]; /* Use offsetof(ATTR_RECORD,
760						  resident_end) to get size of
761						  a resident attribute. */
762		} __attribute__((__packed__));
763		/* Non-resident attributes. */
764		struct {
765/* 16*/			leVCN lowest_vcn;	/* Lowest valid virtual cluster number
766				for this portion of the attribute value or
767				0 if this is the only extent (usually the
768				case). - Only when an attribute list is used
769				does lowest_vcn != 0 ever occur. */
770/* 24*/			leVCN highest_vcn; /* Highest valid vcn of this extent of
771				the attribute value. - Usually there is only one
772				portion, so this usually equals the attribute
773				value size in clusters minus 1. Can be -1 for
774				zero length files. Can be 0 for "single extent"
775				attributes. */
776/* 32*/			le16 mapping_pairs_offset; /* Byte offset from the
777				beginning of the structure to the mapping pairs
778				array which contains the mappings between the
779				vcns and the logical cluster numbers (lcns).
780				When creating, place this at the end of this
781				record header aligned to 8-byte boundary. */
782/* 34*/			u8 compression_unit; /* The compression unit expressed
783				as the log to the base 2 of the number of
784				clusters in a compression unit. 0 means not
785				compressed. (This effectively limits the
786				compression unit size to be a power of two
787				clusters.) WinNT4 only uses a value of 4. */
788/* 35*/			u8 reserved1[5];	/* Align to 8-byte boundary. */
789/* The sizes below are only used when lowest_vcn is zero, as otherwise it would
790   be difficult to keep them up-to-date.*/
791/* 40*/			sle64 allocated_size;	/* Byte size of disk space
792				allocated to hold the attribute value. Always
793				is a multiple of the cluster size. When a file
794				is compressed, this field is a multiple of the
795				compression block size (2^compression_unit) and
796				it represents the logically allocated space
797				rather than the actual on disk usage. For this
798				use the compressed_size (see below). */
799/* 48*/			sle64 data_size;	/* Byte size of the attribute
800				value. Can be larger than allocated_size if
801				attribute value is compressed or sparse. */
802/* 56*/			sle64 initialized_size;	/* Byte size of initialized
803				portion of the attribute value. Usually equals
804				data_size. */
805/* 64 */		void *non_resident_end[0]; /* Use offsetof(ATTR_RECORD,
806						      non_resident_end) to get
807						      size of a non resident
808						      attribute. */
809/* sizeof(uncompressed attr) = 64*/
810/* 64*/			sle64 compressed_size;	/* Byte size of the attribute
811				value after compression. Only present when
812				compressed. Always is a multiple of the
813				cluster size. Represents the actual amount of
814				disk space being used on the disk. */
815/* 72 */		void *compressed_end[0];
816				/* Use offsetof(ATTR_RECORD, compressed_end) to
817				   get size of a compressed attribute. */
818/* sizeof(compressed attr) = 72*/
819		} __attribute__((__packed__));
820	} __attribute__((__packed__));
821} __attribute__((__packed__)) ATTR_RECORD;
822
823typedef ATTR_RECORD ATTR_REC;
824
825/**
826 * enum FILE_ATTR_FLAGS - File attribute flags (32-bit).
827 */
828typedef enum {
829	/*
830	 * These flags are only present in the STANDARD_INFORMATION attribute
831	 * (in the field file_attributes).
832	 */
833	FILE_ATTR_READONLY		= const_cpu_to_le32(0x00000001),
834	FILE_ATTR_HIDDEN		= const_cpu_to_le32(0x00000002),
835	FILE_ATTR_SYSTEM		= const_cpu_to_le32(0x00000004),
836	/* Old DOS volid. Unused in NT.	= const_cpu_to_le32(0x00000008), */
837
838	FILE_ATTR_DIRECTORY		= const_cpu_to_le32(0x00000010),
839	/* FILE_ATTR_DIRECTORY is not considered valid in NT. It is reserved
840	   for the DOS SUBDIRECTORY flag. */
841	FILE_ATTR_ARCHIVE		= const_cpu_to_le32(0x00000020),
842	FILE_ATTR_DEVICE		= const_cpu_to_le32(0x00000040),
843	FILE_ATTR_NORMAL		= const_cpu_to_le32(0x00000080),
844
845	FILE_ATTR_TEMPORARY		= const_cpu_to_le32(0x00000100),
846	FILE_ATTR_SPARSE_FILE		= const_cpu_to_le32(0x00000200),
847	FILE_ATTR_REPARSE_POINT		= const_cpu_to_le32(0x00000400),
848	FILE_ATTR_COMPRESSED		= const_cpu_to_le32(0x00000800),
849
850	FILE_ATTR_OFFLINE		= const_cpu_to_le32(0x00001000),
851	FILE_ATTR_NOT_CONTENT_INDEXED	= const_cpu_to_le32(0x00002000),
852	FILE_ATTR_ENCRYPTED		= const_cpu_to_le32(0x00004000),
853
854	FILE_ATTR_VALID_FLAGS		= const_cpu_to_le32(0x00007fb7),
855	/* FILE_ATTR_VALID_FLAGS masks out the old DOS VolId and the
856	   FILE_ATTR_DEVICE and preserves everything else. This mask
857	   is used to obtain all flags that are valid for reading. */
858	FILE_ATTR_VALID_SET_FLAGS	= const_cpu_to_le32(0x000031a7),
859	/* FILE_ATTR_VALID_SET_FLAGS masks out the old DOS VolId, the
860	   FILE_ATTR_DEVICE, FILE_ATTR_DIRECTORY, FILE_ATTR_SPARSE_FILE,
861	   FILE_ATTR_REPARSE_POINT, FILE_ATRE_COMPRESSED and FILE_ATTR_ENCRYPTED
862	   and preserves the rest. This mask is used to to obtain all flags that
863	   are valid for setting. */
864
865	/**
866	 * FILE_ATTR_I30_INDEX_PRESENT - Is it a directory?
867	 *
868	 * This is a copy of the MFT_RECORD_IS_DIRECTORY bit from the mft
869	 * record, telling us whether this is a directory or not, i.e. whether
870	 * it has an index root attribute named "$I30" or not.
871	 *
872	 * This flag is only present in the FILE_NAME attribute (in the
873	 * file_attributes field).
874	 */
875	FILE_ATTR_I30_INDEX_PRESENT	= const_cpu_to_le32(0x10000000),
876
877	/**
878	 * FILE_ATTR_VIEW_INDEX_PRESENT - Does have a non-directory index?
879	 *
880	 * This is a copy of the MFT_RECORD_IS_VIEW_INDEX bit from the mft
881	 * record, telling us whether this file has a view index present (eg.
882	 * object id index, quota index, one of the security indexes and the
883	 * reparse points index).
884	 *
885	 * This flag is only present in the $STANDARD_INFORMATION and
886	 * $FILE_NAME attributes.
887	 */
888	FILE_ATTR_VIEW_INDEX_PRESENT	= const_cpu_to_le32(0x20000000),
889} __attribute__((__packed__)) FILE_ATTR_FLAGS;
890
891/*
892 * NOTE on times in NTFS: All times are in MS standard time format, i.e. they
893 * are the number of 100-nanosecond intervals since 1st January 1601, 00:00:00
894 * universal coordinated time (UTC). (In Linux time starts 1st January 1970,
895 * 00:00:00 UTC and is stored as the number of 1-second intervals since then.)
896 */
897
898/**
899 * struct STANDARD_INFORMATION - Attribute: Standard information (0x10).
900 *
901 * NOTE: Always resident.
902 * NOTE: Present in all base file records on a volume.
903 * NOTE: There is conflicting information about the meaning of each of the time
904 *	 fields but the meaning as defined below has been verified to be
905 *	 correct by practical experimentation on Windows NT4 SP6a and is hence
906 *	 assumed to be the one and only correct interpretation.
907 */
908typedef struct {
909/*Ofs*/
910/*  0*/	sle64 creation_time;		/* Time file was created. Updated when
911					   a filename is changed(?). */
912/*  8*/	sle64 last_data_change_time;	/* Time the data attribute was last
913					   modified. */
914/* 16*/	sle64 last_mft_change_time;	/* Time this mft record was last
915					   modified. */
916/* 24*/	sle64 last_access_time;		/* Approximate time when the file was
917					   last accessed (obviously this is not
918					   updated on read-only volumes). In
919					   Windows this is only updated when
920					   accessed if some time delta has
921					   passed since the last update. Also,
922					   last access times updates can be
923					   disabled altogether for speed. */
924/* 32*/	FILE_ATTR_FLAGS file_attributes; /* Flags describing the file. */
925/* 36*/	union {
926		/* NTFS 1.2 (and previous, presumably) */
927		struct {
928		/* 36 */ u8 reserved12[12];	/* Reserved/alignment to 8-byte
929						   boundary. */
930		/* 48 */ void *v1_end[0];	/* Marker for offsetof(). */
931		} __attribute__((__packed__));
932/* sizeof() = 48 bytes */
933		/* NTFS 3.0 */
934		struct {
935/*
936 * If a volume has been upgraded from a previous NTFS version, then these
937 * fields are present only if the file has been accessed since the upgrade.
938 * Recognize the difference by comparing the length of the resident attribute
939 * value. If it is 48, then the following fields are missing. If it is 72 then
940 * the fields are present. Maybe just check like this:
941 *	if (resident.ValueLength < sizeof(STANDARD_INFORMATION)) {
942 *		Assume NTFS 1.2- format.
943 *		If (volume version is 3.0+)
944 *			Upgrade attribute to NTFS 3.0 format.
945 *		else
946 *			Use NTFS 1.2- format for access.
947 *	} else
948 *		Use NTFS 3.0 format for access.
949 * Only problem is that it might be legal to set the length of the value to
950 * arbitrarily large values thus spoiling this check. - But chkdsk probably
951 * views that as a corruption, assuming that it behaves like this for all
952 * attributes.
953 */
954		/* 36*/	le32 maximum_versions;	/* Maximum allowed versions for
955				file. Zero if version numbering is disabled. */
956		/* 40*/	le32 version_number;	/* This file's version (if any).
957				Set to zero if maximum_versions is zero. */
958		/* 44*/	le32 class_id;		/* Class id from bidirectional
959				class id index (?). */
960		/* 48*/	le32 owner_id;		/* Owner_id of the user owning
961				the file. Translate via $Q index in FILE_Extend
962				/$Quota to the quota control entry for the user
963				owning the file. Zero if quotas are disabled. */
964		/* 52*/	le32 security_id;	/* Security_id for the file.
965				Translate via $SII index and $SDS data stream
966				in FILE_Secure to the security descriptor. */
967		/* 56*/	le64 quota_charged;	/* Byte size of the charge to
968				the quota for all streams of the file. Note: Is
969				zero if quotas are disabled. */
970		/* 64*/	le64 usn;		/* Last update sequence number
971				of the file. This is a direct index into the
972				change (aka usn) journal file. It is zero if
973				the usn journal is disabled.
974				NOTE: To disable the journal need to delete
975				the journal file itself and to then walk the
976				whole mft and set all Usn entries in all mft
977				records to zero! (This can take a while!)
978				The journal is FILE_Extend/$UsnJrnl. Win2k
979				will recreate the journal and initiate
980				logging if necessary when mounting the
981				partition. This, in contrast to disabling the
982				journal is a very fast process, so the user
983				won't even notice it. */
984		/* 72*/ void *v3_end[0]; /* Marker for offsetof(). */
985		} __attribute__((__packed__));
986	} __attribute__((__packed__));
987/* sizeof() = 72 bytes (NTFS 3.0) */
988} __attribute__((__packed__)) STANDARD_INFORMATION;
989
990/**
991 * struct ATTR_LIST_ENTRY - Attribute: Attribute list (0x20).
992 *
993 * - Can be either resident or non-resident.
994 * - Value consists of a sequence of variable length, 8-byte aligned,
995 * ATTR_LIST_ENTRY records.
996 * - The attribute list attribute contains one entry for each attribute of
997 * the file in which the list is located, except for the list attribute
998 * itself. The list is sorted: first by attribute type, second by attribute
999 * name (if present), third by instance number. The extents of one
1000 * non-resident attribute (if present) immediately follow after the initial
1001 * extent. They are ordered by lowest_vcn and have their instance set to zero.
1002 * It is not allowed to have two attributes with all sorting keys equal.
1003 * - Further restrictions:
1004 *	- If not resident, the vcn to lcn mapping array has to fit inside the
1005 *	  base mft record.
1006 *	- The attribute list attribute value has a maximum size of 256kb. This
1007 *	  is imposed by the Windows cache manager.
1008 * - Attribute lists are only used when the attributes of mft record do not
1009 * fit inside the mft record despite all attributes (that can be made
1010 * non-resident) having been made non-resident. This can happen e.g. when:
1011 *	- File has a large number of hard links (lots of file name
1012 *	  attributes present).
1013 *	- The mapping pairs array of some non-resident attribute becomes so
1014 *	  large due to fragmentation that it overflows the mft record.
1015 *	- The security descriptor is very complex (not applicable to
1016 *	  NTFS 3.0 volumes).
1017 *	- There are many named streams.
1018 */
1019typedef struct {
1020/*Ofs*/
1021/*  0*/	ATTR_TYPES type;	/* Type of referenced attribute. */
1022/*  4*/	le16 length;		/* Byte size of this entry. */
1023/*  6*/	u8 name_length;		/* Size in Unicode chars of the name of the
1024				   attribute or 0 if unnamed. */
1025/*  7*/	u8 name_offset;		/* Byte offset to beginning of attribute name
1026				   (always set this to where the name would
1027				   start even if unnamed). */
1028/*  8*/	leVCN lowest_vcn;	/* Lowest virtual cluster number of this portion
1029				   of the attribute value. This is usually 0. It
1030				   is non-zero for the case where one attribute
1031				   does not fit into one mft record and thus
1032				   several mft records are allocated to hold
1033				   this attribute. In the latter case, each mft
1034				   record holds one extent of the attribute and
1035				   there is one attribute list entry for each
1036				   extent. NOTE: This is DEFINITELY a signed
1037				   value! The windows driver uses cmp, followed
1038				   by jg when comparing this, thus it treats it
1039				   as signed. */
1040/* 16*/	leMFT_REF mft_reference;/* The reference of the mft record holding
1041				   the ATTR_RECORD for this portion of the
1042				   attribute value. */
1043/* 24*/	le16 instance;		/* If lowest_vcn = 0, the instance of the
1044				   attribute being referenced; otherwise 0. */
1045/* 26*/	ntfschar name[0];	/* Use when creating only. When reading use
1046				   name_offset to determine the location of the
1047				   name. */
1048/* sizeof() = 26 + (attribute_name_length * 2) bytes */
1049} __attribute__((__packed__)) ATTR_LIST_ENTRY;
1050
1051/*
1052 * The maximum allowed length for a file name.
1053 */
1054#define NTFS_MAX_NAME_LEN	255
1055
1056/**
1057 * enum FILE_NAME_TYPE_FLAGS - Possible namespaces for filenames in ntfs.
1058 * (8-bit).
1059 */
1060typedef enum {
1061	FILE_NAME_POSIX			= 0x00,
1062		/* This is the largest namespace. It is case sensitive and
1063		   allows all Unicode characters except for: '\0' and '/'.
1064		   Beware that in WinNT/2k files which eg have the same name
1065		   except for their case will not be distinguished by the
1066		   standard utilities and thus a "del filename" will delete
1067		   both "filename" and "fileName" without warning. */
1068	FILE_NAME_WIN32			= 0x01,
1069		/* The standard WinNT/2k NTFS long filenames. Case insensitive.
1070		   All Unicode chars except: '\0', '"', '*', '/', ':', '<',
1071		   '>', '?', '\' and '|'.  Trailing dots and spaces are allowed,
1072		   even though on Windows a filename with such a suffix can only
1073		   be created and accessed using a WinNT-style path, i.e.
1074		   \\?\-prefixed.  (If a regular path is used, Windows will
1075		   strip the trailing dots and spaces, which makes such
1076		   filenames incompatible with most Windows software.) */
1077	FILE_NAME_DOS			= 0x02,
1078		/* The standard DOS filenames (8.3 format). Uppercase only.
1079		   All 8-bit characters greater space, except: '"', '*', '+',
1080		   ',', '/', ':', ';', '<', '=', '>', '?' and '\'.  Trailing
1081		   dots and spaces are forbidden. */
1082	FILE_NAME_WIN32_AND_DOS		= 0x03,
1083		/* 3 means that both the Win32 and the DOS filenames are
1084		   identical and hence have been saved in this single filename
1085		   record. */
1086} __attribute__((__packed__)) FILE_NAME_TYPE_FLAGS;
1087
1088/**
1089 * struct FILE_NAME_ATTR - Attribute: Filename (0x30).
1090 *
1091 * NOTE: Always resident.
1092 * NOTE: All fields, except the parent_directory, are only updated when the
1093 *	 filename is changed. Until then, they just become out of sync with
1094 *	 reality and the more up to date values are present in the standard
1095 *	 information attribute.
1096 * NOTE: There is conflicting information about the meaning of each of the time
1097 *	 fields but the meaning as defined below has been verified to be
1098 *	 correct by practical experimentation on Windows NT4 SP6a and is hence
1099 *	 assumed to be the one and only correct interpretation.
1100 */
1101typedef struct {
1102/*hex ofs*/
1103/*  0*/	leMFT_REF parent_directory;	/* Directory this filename is
1104					   referenced from. */
1105/*  8*/	sle64 creation_time;		/* Time file was created. */
1106/* 10*/	sle64 last_data_change_time;	/* Time the data attribute was last
1107					   modified. */
1108/* 18*/	sle64 last_mft_change_time;	/* Time this mft record was last
1109					   modified. */
1110/* 20*/	sle64 last_access_time;		/* Last time this mft record was
1111					   accessed. */
1112/* 28*/	sle64 allocated_size;		/* Byte size of on-disk allocated space
1113					   for the data attribute.  So for
1114					   normal $DATA, this is the
1115					   allocated_size from the unnamed
1116					   $DATA attribute and for compressed
1117					   and/or sparse $DATA, this is the
1118					   compressed_size from the unnamed
1119					   $DATA attribute.  NOTE: This is a
1120					   multiple of the cluster size. */
1121/* 30*/	sle64 data_size;			/* Byte size of actual data in data
1122					   attribute. */
1123/* 38*/	FILE_ATTR_FLAGS file_attributes;	/* Flags describing the file. */
1124/* 3c*/	union {
1125	/* 3c*/	struct {
1126		/* 3c*/	le16 packed_ea_size;	/* Size of the buffer needed to
1127						   pack the extended attributes
1128						   (EAs), if such are present.*/
1129		/* 3e*/	le16 reserved;		/* Reserved for alignment. */
1130		} __attribute__((__packed__));
1131	/* 3c*/	le32 reparse_point_tag;		/* Type of reparse point,
1132						   present only in reparse
1133						   points and only if there are
1134						   no EAs. */
1135	} __attribute__((__packed__));
1136/* 40*/	u8 file_name_length;			/* Length of file name in
1137						   (Unicode) characters. */
1138/* 41*/	FILE_NAME_TYPE_FLAGS file_name_type;	/* Namespace of the file name.*/
1139/* 42*/	ntfschar file_name[0];			/* File name in Unicode. */
1140} __attribute__((__packed__)) FILE_NAME_ATTR;
1141
1142/**
1143 * struct GUID - GUID structures store globally unique identifiers (GUID).
1144 *
1145 * A GUID is a 128-bit value consisting of one group of eight hexadecimal
1146 * digits, followed by three groups of four hexadecimal digits each, followed
1147 * by one group of twelve hexadecimal digits. GUIDs are Microsoft's
1148 * implementation of the distributed computing environment (DCE) universally
1149 * unique identifier (UUID).
1150 *
1151 * Example of a GUID:
1152 *	1F010768-5A73-BC91-0010-A52216A7227B
1153 */
1154typedef struct {
1155	le32 data1;	/* The first eight hexadecimal digits of the GUID. */
1156	le16 data2;	/* The first group of four hexadecimal digits. */
1157	le16 data3;	/* The second group of four hexadecimal digits. */
1158	u8 data4[8];	/* The first two bytes are the third group of four
1159			   hexadecimal digits. The remaining six bytes are the
1160			   final 12 hexadecimal digits. */
1161} __attribute__((__packed__)) GUID;
1162
1163/**
1164 * struct OBJ_ID_INDEX_DATA - FILE_Extend/$ObjId contains an index named $O.
1165 *
1166 * This index contains all object_ids present on the volume as the index keys
1167 * and the corresponding mft_record numbers as the index entry data parts.
1168 *
1169 * The data part (defined below) also contains three other object_ids:
1170 *	birth_volume_id - object_id of FILE_Volume on which the file was first
1171 *			  created. Optional (i.e. can be zero).
1172 *	birth_object_id - object_id of file when it was first created. Usually
1173 *			  equals the object_id. Optional (i.e. can be zero).
1174 *	domain_id	- Reserved (always zero).
1175 */
1176typedef struct {
1177	leMFT_REF mft_reference;	/* Mft record containing the object_id
1178					   in the index entry key. */
1179	union {
1180		struct {
1181			GUID birth_volume_id;
1182			GUID birth_object_id;
1183			GUID domain_id;
1184		} __attribute__((__packed__));
1185		u8 extended_info[48];
1186	} __attribute__((__packed__));
1187} __attribute__((__packed__)) OBJ_ID_INDEX_DATA;
1188
1189/**
1190 * struct OBJECT_ID_ATTR - Attribute: Object id (NTFS 3.0+) (0x40).
1191 *
1192 * NOTE: Always resident.
1193 */
1194typedef struct {
1195	GUID object_id;				/* Unique id assigned to the
1196						   file.*/
1197	/* The following fields are optional. The attribute value size is 16
1198	   bytes, i.e. sizeof(GUID), if these are not present at all. Note,
1199	   the entries can be present but one or more (or all) can be zero
1200	   meaning that that particular value(s) is(are) not defined. Note,
1201	   when the fields are missing here, it is well possible that they are
1202	   to be found within the $Extend/$ObjId system file indexed under the
1203	   above object_id. */
1204	union {
1205		struct {
1206			GUID birth_volume_id;	/* Unique id of volume on which
1207						   the file was first created.*/
1208			GUID birth_object_id;	/* Unique id of file when it was
1209						   first created. */
1210			GUID domain_id;		/* Reserved, zero. */
1211		} __attribute__((__packed__));
1212		u8 extended_info[48];
1213	} __attribute__((__packed__));
1214} __attribute__((__packed__)) OBJECT_ID_ATTR;
1215
1216#if 0
1217/**
1218 * enum IDENTIFIER_AUTHORITIES -
1219 *
1220 * The pre-defined IDENTIFIER_AUTHORITIES used as SID_IDENTIFIER_AUTHORITY in
1221 * the SID structure (see below).
1222 */
1223typedef enum {					/* SID string prefix. */
1224	SECURITY_NULL_SID_AUTHORITY	= {0, 0, 0, 0, 0, 0},	/* S-1-0 */
1225	SECURITY_WORLD_SID_AUTHORITY	= {0, 0, 0, 0, 0, 1},	/* S-1-1 */
1226	SECURITY_LOCAL_SID_AUTHORITY	= {0, 0, 0, 0, 0, 2},	/* S-1-2 */
1227	SECURITY_CREATOR_SID_AUTHORITY	= {0, 0, 0, 0, 0, 3},	/* S-1-3 */
1228	SECURITY_NON_UNIQUE_AUTHORITY	= {0, 0, 0, 0, 0, 4},	/* S-1-4 */
1229	SECURITY_NT_SID_AUTHORITY	= {0, 0, 0, 0, 0, 5},	/* S-1-5 */
1230} IDENTIFIER_AUTHORITIES;
1231#endif
1232
1233/**
1234 * enum RELATIVE_IDENTIFIERS -
1235 *
1236 * These relative identifiers (RIDs) are used with the above identifier
1237 * authorities to make up universal well-known SIDs.
1238 *
1239 * Note: The relative identifier (RID) refers to the portion of a SID, which
1240 * identifies a user or group in relation to the authority that issued the SID.
1241 * For example, the universal well-known SID Creator Owner ID (S-1-3-0) is
1242 * made up of the identifier authority SECURITY_CREATOR_SID_AUTHORITY (3) and
1243 * the relative identifier SECURITY_CREATOR_OWNER_RID (0).
1244 */
1245typedef enum {					/* Identifier authority. */
1246	SECURITY_NULL_RID		  = 0,	/* S-1-0 */
1247	SECURITY_WORLD_RID		  = 0,	/* S-1-1 */
1248	SECURITY_LOCAL_RID		  = 0,	/* S-1-2 */
1249
1250	SECURITY_CREATOR_OWNER_RID	  = 0,	/* S-1-3 */
1251	SECURITY_CREATOR_GROUP_RID	  = 1,	/* S-1-3 */
1252
1253	SECURITY_CREATOR_OWNER_SERVER_RID = 2,	/* S-1-3 */
1254	SECURITY_CREATOR_GROUP_SERVER_RID = 3,	/* S-1-3 */
1255
1256	SECURITY_DIALUP_RID		  = 1,
1257	SECURITY_NETWORK_RID		  = 2,
1258	SECURITY_BATCH_RID		  = 3,
1259	SECURITY_INTERACTIVE_RID	  = 4,
1260	SECURITY_SERVICE_RID		  = 6,
1261	SECURITY_ANONYMOUS_LOGON_RID	  = 7,
1262	SECURITY_PROXY_RID		  = 8,
1263	SECURITY_ENTERPRISE_CONTROLLERS_RID=9,
1264	SECURITY_SERVER_LOGON_RID	  = 9,
1265	SECURITY_PRINCIPAL_SELF_RID	  = 0xa,
1266	SECURITY_AUTHENTICATED_USER_RID	  = 0xb,
1267	SECURITY_RESTRICTED_CODE_RID	  = 0xc,
1268	SECURITY_TERMINAL_SERVER_RID	  = 0xd,
1269
1270	SECURITY_LOGON_IDS_RID		  = 5,
1271	SECURITY_LOGON_IDS_RID_COUNT	  = 3,
1272
1273	SECURITY_LOCAL_SYSTEM_RID	  = 0x12,
1274
1275	SECURITY_NT_NON_UNIQUE		  = 0x15,
1276
1277	SECURITY_BUILTIN_DOMAIN_RID	  = 0x20,
1278
1279	/*
1280	 * Well-known domain relative sub-authority values (RIDs).
1281	 */
1282
1283	/* Users. */
1284	DOMAIN_USER_RID_ADMIN		  = 0x1f4,
1285	DOMAIN_USER_RID_GUEST		  = 0x1f5,
1286	DOMAIN_USER_RID_KRBTGT		  = 0x1f6,
1287
1288	/* Groups. */
1289	DOMAIN_GROUP_RID_ADMINS		  = 0x200,
1290	DOMAIN_GROUP_RID_USERS		  = 0x201,
1291	DOMAIN_GROUP_RID_GUESTS		  = 0x202,
1292	DOMAIN_GROUP_RID_COMPUTERS	  = 0x203,
1293	DOMAIN_GROUP_RID_CONTROLLERS	  = 0x204,
1294	DOMAIN_GROUP_RID_CERT_ADMINS	  = 0x205,
1295	DOMAIN_GROUP_RID_SCHEMA_ADMINS	  = 0x206,
1296	DOMAIN_GROUP_RID_ENTERPRISE_ADMINS= 0x207,
1297	DOMAIN_GROUP_RID_POLICY_ADMINS	  = 0x208,
1298
1299	/* Aliases. */
1300	DOMAIN_ALIAS_RID_ADMINS		  = 0x220,
1301	DOMAIN_ALIAS_RID_USERS		  = 0x221,
1302	DOMAIN_ALIAS_RID_GUESTS		  = 0x222,
1303	DOMAIN_ALIAS_RID_POWER_USERS	  = 0x223,
1304
1305	DOMAIN_ALIAS_RID_ACCOUNT_OPS	  = 0x224,
1306	DOMAIN_ALIAS_RID_SYSTEM_OPS	  = 0x225,
1307	DOMAIN_ALIAS_RID_PRINT_OPS	  = 0x226,
1308	DOMAIN_ALIAS_RID_BACKUP_OPS	  = 0x227,
1309
1310	DOMAIN_ALIAS_RID_REPLICATOR	  = 0x228,
1311	DOMAIN_ALIAS_RID_RAS_SERVERS	  = 0x229,
1312	DOMAIN_ALIAS_RID_PREW2KCOMPACCESS = 0x22a,
1313} RELATIVE_IDENTIFIERS;
1314
1315/*
1316 * The universal well-known SIDs:
1317 *
1318 *	NULL_SID			S-1-0-0
1319 *	WORLD_SID			S-1-1-0
1320 *	LOCAL_SID			S-1-2-0
1321 *	CREATOR_OWNER_SID		S-1-3-0
1322 *	CREATOR_GROUP_SID		S-1-3-1
1323 *	CREATOR_OWNER_SERVER_SID	S-1-3-2
1324 *	CREATOR_GROUP_SERVER_SID	S-1-3-3
1325 *
1326 *	(Non-unique IDs)		S-1-4
1327 *
1328 * NT well-known SIDs:
1329 *
1330 *	NT_AUTHORITY_SID	S-1-5
1331 *	DIALUP_SID		S-1-5-1
1332 *
1333 *	NETWORD_SID		S-1-5-2
1334 *	BATCH_SID		S-1-5-3
1335 *	INTERACTIVE_SID		S-1-5-4
1336 *	SERVICE_SID		S-1-5-6
1337 *	ANONYMOUS_LOGON_SID	S-1-5-7		(aka null logon session)
1338 *	PROXY_SID		S-1-5-8
1339 *	SERVER_LOGON_SID	S-1-5-9		(aka domain controller account)
1340 *	SELF_SID		S-1-5-10	(self RID)
1341 *	AUTHENTICATED_USER_SID	S-1-5-11
1342 *	RESTRICTED_CODE_SID	S-1-5-12	(running restricted code)
1343 *	TERMINAL_SERVER_SID	S-1-5-13	(running on terminal server)
1344 *
1345 *	(Logon IDs)		S-1-5-5-X-Y
1346 *
1347 *	(NT non-unique IDs)	S-1-5-0x15-...
1348 *
1349 *	(Built-in domain)	S-1-5-0x20
1350 */
1351
1352/**
1353 * union SID_IDENTIFIER_AUTHORITY - A 48-bit value used in the SID structure
1354 *
1355 * NOTE: This is stored as a big endian number.
1356 */
1357typedef union {
1358	struct {
1359		be16 high_part;		/* High 16-bits. */
1360		be32 low_part;		/* Low 32-bits. */
1361	} __attribute__((__packed__));
1362	u8 value[6];			/* Value as individual bytes. */
1363} __attribute__((__packed__)) SID_IDENTIFIER_AUTHORITY;
1364
1365/**
1366 * struct SID -
1367 *
1368 * The SID structure is a variable-length structure used to uniquely identify
1369 * users or groups. SID stands for security identifier.
1370 *
1371 * The standard textual representation of the SID is of the form:
1372 *	S-R-I-S-S...
1373 * Where:
1374 *    - The first "S" is the literal character 'S' identifying the following
1375 *	digits as a SID.
1376 *    - R is the revision level of the SID expressed as a sequence of digits
1377 *	in decimal.
1378 *    - I is the 48-bit identifier_authority, expressed as digits in decimal,
1379 *	if I < 2^32, or hexadecimal prefixed by "0x", if I >= 2^32.
1380 *    - S... is one or more sub_authority values, expressed as digits in
1381 *	decimal.
1382 *
1383 * Example SID; the domain-relative SID of the local Administrators group on
1384 * Windows NT/2k:
1385 *	S-1-5-32-544
1386 * This translates to a SID with:
1387 *	revision = 1,
1388 *	sub_authority_count = 2,
1389 *	identifier_authority = {0,0,0,0,0,5},	// SECURITY_NT_AUTHORITY
1390 *	sub_authority[0] = 32,			// SECURITY_BUILTIN_DOMAIN_RID
1391 *	sub_authority[1] = 544			// DOMAIN_ALIAS_RID_ADMINS
1392 */
1393typedef struct {
1394	u8 revision;
1395	u8 sub_authority_count;
1396	SID_IDENTIFIER_AUTHORITY identifier_authority;
1397	le32 sub_authority[1];		/* At least one sub_authority. */
1398} __attribute__((__packed__)) SID;
1399
1400/**
1401 * enum SID_CONSTANTS - Current constants for SIDs.
1402 */
1403typedef enum {
1404	SID_REVISION			=  1,	/* Current revision level. */
1405	SID_MAX_SUB_AUTHORITIES		= 15,	/* Maximum number of those. */
1406	SID_RECOMMENDED_SUB_AUTHORITIES	=  1,	/* Will change to around 6 in
1407						   a future revision. */
1408} SID_CONSTANTS;
1409
1410/**
1411 * enum ACE_TYPES - The predefined ACE types (8-bit, see below).
1412 */
1413typedef enum {
1414	ACCESS_MIN_MS_ACE_TYPE		= 0,
1415	ACCESS_ALLOWED_ACE_TYPE		= 0,
1416	ACCESS_DENIED_ACE_TYPE		= 1,
1417	SYSTEM_AUDIT_ACE_TYPE		= 2,
1418	SYSTEM_ALARM_ACE_TYPE		= 3, /* Not implemented as of Win2k. */
1419	ACCESS_MAX_MS_V2_ACE_TYPE	= 3,
1420
1421	ACCESS_ALLOWED_COMPOUND_ACE_TYPE= 4,
1422	ACCESS_MAX_MS_V3_ACE_TYPE	= 4,
1423
1424	/* The following are Win2k only. */
1425	ACCESS_MIN_MS_OBJECT_ACE_TYPE	= 5,
1426	ACCESS_ALLOWED_OBJECT_ACE_TYPE	= 5,
1427	ACCESS_DENIED_OBJECT_ACE_TYPE	= 6,
1428	SYSTEM_AUDIT_OBJECT_ACE_TYPE	= 7,
1429	SYSTEM_ALARM_OBJECT_ACE_TYPE	= 8,
1430	ACCESS_MAX_MS_OBJECT_ACE_TYPE	= 8,
1431
1432	ACCESS_MAX_MS_V4_ACE_TYPE	= 8,
1433
1434	/* This one is for WinNT&2k. */
1435	ACCESS_MAX_MS_ACE_TYPE		= 8,
1436} __attribute__((__packed__)) ACE_TYPES;
1437
1438/**
1439 * enum ACE_FLAGS - The ACE flags (8-bit) for audit and inheritance.
1440 *
1441 * SUCCESSFUL_ACCESS_ACE_FLAG is only used with system audit and alarm ACE
1442 * types to indicate that a message is generated (in Windows!) for successful
1443 * accesses.
1444 *
1445 * FAILED_ACCESS_ACE_FLAG is only used with system audit and alarm ACE types
1446 * to indicate that a message is generated (in Windows!) for failed accesses.
1447 */
1448typedef enum {
1449	/* The inheritance flags. */
1450	OBJECT_INHERIT_ACE		= 0x01,
1451	CONTAINER_INHERIT_ACE		= 0x02,
1452	NO_PROPAGATE_INHERIT_ACE	= 0x04,
1453	INHERIT_ONLY_ACE		= 0x08,
1454	INHERITED_ACE			= 0x10,	/* Win2k only. */
1455	VALID_INHERIT_FLAGS		= 0x1f,
1456
1457	/* The audit flags. */
1458	SUCCESSFUL_ACCESS_ACE_FLAG	= 0x40,
1459	FAILED_ACCESS_ACE_FLAG		= 0x80,
1460} __attribute__((__packed__)) ACE_FLAGS;
1461
1462/**
1463 * struct ACE_HEADER -
1464 *
1465 * An ACE is an access-control entry in an access-control list (ACL).
1466 * An ACE defines access to an object for a specific user or group or defines
1467 * the types of access that generate system-administration messages or alarms
1468 * for a specific user or group. The user or group is identified by a security
1469 * identifier (SID).
1470 *
1471 * Each ACE starts with an ACE_HEADER structure (aligned on 4-byte boundary),
1472 * which specifies the type and size of the ACE. The format of the subsequent
1473 * data depends on the ACE type.
1474 */
1475typedef struct {
1476	ACE_TYPES type;		/* Type of the ACE. */
1477	ACE_FLAGS flags;	/* Flags describing the ACE. */
1478	le16 size;		/* Size in bytes of the ACE. */
1479} __attribute__((__packed__)) ACE_HEADER;
1480
1481/**
1482 * enum ACCESS_MASK - The access mask (32-bit).
1483 *
1484 * Defines the access rights.
1485 */
1486typedef enum {
1487	/*
1488	 * The specific rights (bits 0 to 15). Depend on the type of the
1489	 * object being secured by the ACE.
1490	 */
1491
1492	/* Specific rights for files and directories are as follows: */
1493
1494	/* Right to read data from the file. (FILE) */
1495	FILE_READ_DATA			= const_cpu_to_le32(0x00000001),
1496	/* Right to list contents of a directory. (DIRECTORY) */
1497	FILE_LIST_DIRECTORY		= const_cpu_to_le32(0x00000001),
1498
1499	/* Right to write data to the file. (FILE) */
1500	FILE_WRITE_DATA			= const_cpu_to_le32(0x00000002),
1501	/* Right to create a file in the directory. (DIRECTORY) */
1502	FILE_ADD_FILE			= const_cpu_to_le32(0x00000002),
1503
1504	/* Right to append data to the file. (FILE) */
1505	FILE_APPEND_DATA		= const_cpu_to_le32(0x00000004),
1506	/* Right to create a subdirectory. (DIRECTORY) */
1507	FILE_ADD_SUBDIRECTORY		= const_cpu_to_le32(0x00000004),
1508
1509	/* Right to read extended attributes. (FILE/DIRECTORY) */
1510	FILE_READ_EA			= const_cpu_to_le32(0x00000008),
1511
1512	/* Right to write extended attributes. (FILE/DIRECTORY) */
1513	FILE_WRITE_EA			= const_cpu_to_le32(0x00000010),
1514
1515	/* Right to execute a file. (FILE) */
1516	FILE_EXECUTE			= const_cpu_to_le32(0x00000020),
1517	/* Right to traverse the directory. (DIRECTORY) */
1518	FILE_TRAVERSE			= const_cpu_to_le32(0x00000020),
1519
1520	/*
1521	 * Right to delete a directory and all the files it contains (its
1522	 * children), even if the files are read-only. (DIRECTORY)
1523	 */
1524	FILE_DELETE_CHILD		= const_cpu_to_le32(0x00000040),
1525
1526	/* Right to read file attributes. (FILE/DIRECTORY) */
1527	FILE_READ_ATTRIBUTES		= const_cpu_to_le32(0x00000080),
1528
1529	/* Right to change file attributes. (FILE/DIRECTORY) */
1530	FILE_WRITE_ATTRIBUTES		= const_cpu_to_le32(0x00000100),
1531
1532	/*
1533	 * The standard rights (bits 16 to 23). Are independent of the type of
1534	 * object being secured.
1535	 */
1536
1537	/* Right to delete the object. */
1538	DELETE				= const_cpu_to_le32(0x00010000),
1539
1540	/*
1541	 * Right to read the information in the object's security descriptor,
1542	 * not including the information in the SACL. I.e. right to read the
1543	 * security descriptor and owner.
1544	 */
1545	READ_CONTROL			= const_cpu_to_le32(0x00020000),
1546
1547	/* Right to modify the DACL in the object's security descriptor. */
1548	WRITE_DAC			= const_cpu_to_le32(0x00040000),
1549
1550	/* Right to change the owner in the object's security descriptor. */
1551	WRITE_OWNER			= const_cpu_to_le32(0x00080000),
1552
1553	/*
1554	 * Right to use the object for synchronization. Enables a process to
1555	 * wait until the object is in the signalled state. Some object types
1556	 * do not support this access right.
1557	 */
1558	SYNCHRONIZE			= const_cpu_to_le32(0x00100000),
1559
1560	/*
1561	 * The following STANDARD_RIGHTS_* are combinations of the above for
1562	 * convenience and are defined by the Win32 API.
1563	 */
1564
1565	/* These are currently defined to READ_CONTROL. */
1566	STANDARD_RIGHTS_READ		= const_cpu_to_le32(0x00020000),
1567	STANDARD_RIGHTS_WRITE		= const_cpu_to_le32(0x00020000),
1568	STANDARD_RIGHTS_EXECUTE		= const_cpu_to_le32(0x00020000),
1569
1570	/* Combines DELETE, READ_CONTROL, WRITE_DAC, and WRITE_OWNER access. */
1571	STANDARD_RIGHTS_REQUIRED	= const_cpu_to_le32(0x000f0000),
1572
1573	/*
1574	 * Combines DELETE, READ_CONTROL, WRITE_DAC, WRITE_OWNER, and
1575	 * SYNCHRONIZE access.
1576	 */
1577	STANDARD_RIGHTS_ALL		= const_cpu_to_le32(0x001f0000),
1578
1579	/*
1580	 * The access system ACL and maximum allowed access types (bits 24 to
1581	 * 25, bits 26 to 27 are reserved).
1582	 */
1583	ACCESS_SYSTEM_SECURITY		= const_cpu_to_le32(0x01000000),
1584	MAXIMUM_ALLOWED			= const_cpu_to_le32(0x02000000),
1585
1586	/*
1587	 * The generic rights (bits 28 to 31). These map onto the standard and
1588	 * specific rights.
1589	 */
1590
1591	/* Read, write, and execute access. */
1592	GENERIC_ALL			= const_cpu_to_le32(0x10000000),
1593
1594	/* Execute access. */
1595	GENERIC_EXECUTE			= const_cpu_to_le32(0x20000000),
1596
1597	/*
1598	 * Write access. For files, this maps onto:
1599	 *	FILE_APPEND_DATA | FILE_WRITE_ATTRIBUTES | FILE_WRITE_DATA |
1600	 *	FILE_WRITE_EA | STANDARD_RIGHTS_WRITE | SYNCHRONIZE
1601	 * For directories, the mapping has the same numerical value. See
1602	 * above for the descriptions of the rights granted.
1603	 */
1604	GENERIC_WRITE			= const_cpu_to_le32(0x40000000),
1605
1606	/*
1607	 * Read access. For files, this maps onto:
1608	 *	FILE_READ_ATTRIBUTES | FILE_READ_DATA | FILE_READ_EA |
1609	 *	STANDARD_RIGHTS_READ | SYNCHRONIZE
1610	 * For directories, the mapping has the same numerical value. See
1611	 * above for the descriptions of the rights granted.
1612	 */
1613	GENERIC_READ			= const_cpu_to_le32(0x80000000),
1614} ACCESS_MASK;
1615
1616/**
1617 * struct GENERIC_MAPPING -
1618 *
1619 * The generic mapping array. Used to denote the mapping of each generic
1620 * access right to a specific access mask.
1621 *
1622 * FIXME: What exactly is this and what is it for? (AIA)
1623 */
1624typedef struct {
1625	ACCESS_MASK generic_read;
1626	ACCESS_MASK generic_write;
1627	ACCESS_MASK generic_execute;
1628	ACCESS_MASK generic_all;
1629} __attribute__((__packed__)) GENERIC_MAPPING;
1630
1631/*
1632 * The predefined ACE type structures are as defined below.
1633 */
1634
1635/**
1636 * struct ACCESS_DENIED_ACE -
1637 *
1638 * ACCESS_ALLOWED_ACE, ACCESS_DENIED_ACE, SYSTEM_AUDIT_ACE, SYSTEM_ALARM_ACE
1639 */
1640typedef struct {
1641/*  0	ACE_HEADER; -- Unfolded here as gcc doesn't like unnamed structs. */
1642	ACE_TYPES type;		/* Type of the ACE. */
1643	ACE_FLAGS flags;	/* Flags describing the ACE. */
1644	le16 size;		/* Size in bytes of the ACE. */
1645
1646/*  4*/	ACCESS_MASK mask;	/* Access mask associated with the ACE. */
1647/*  8*/	SID sid;		/* The SID associated with the ACE. */
1648} __attribute__((__packed__)) ACCESS_ALLOWED_ACE, ACCESS_DENIED_ACE,
1649			       SYSTEM_AUDIT_ACE, SYSTEM_ALARM_ACE;
1650
1651/**
1652 * enum OBJECT_ACE_FLAGS - The object ACE flags (32-bit).
1653 */
1654typedef enum {
1655	ACE_OBJECT_TYPE_PRESENT			= const_cpu_to_le32(1),
1656	ACE_INHERITED_OBJECT_TYPE_PRESENT	= const_cpu_to_le32(2),
1657} OBJECT_ACE_FLAGS;
1658
1659/**
1660 * struct ACCESS_ALLOWED_OBJECT_ACE -
1661 */
1662typedef struct {
1663/*  0	ACE_HEADER; -- Unfolded here as gcc doesn't like unnamed structs. */
1664	ACE_TYPES type;		/* Type of the ACE. */
1665	ACE_FLAGS flags;	/* Flags describing the ACE. */
1666	le16 size;		/* Size in bytes of the ACE. */
1667
1668/*  4*/	ACCESS_MASK mask;	/* Access mask associated with the ACE. */
1669/*  8*/	OBJECT_ACE_FLAGS object_flags;	/* Flags describing the object ACE. */
1670/* 12*/	GUID object_type;
1671/* 28*/	GUID inherited_object_type;
1672/* 44*/	SID sid;		/* The SID associated with the ACE. */
1673} __attribute__((__packed__)) ACCESS_ALLOWED_OBJECT_ACE,
1674			       ACCESS_DENIED_OBJECT_ACE,
1675			       SYSTEM_AUDIT_OBJECT_ACE,
1676			       SYSTEM_ALARM_OBJECT_ACE;
1677
1678/**
1679 * struct ACL - An ACL is an access-control list (ACL).
1680 *
1681 * An ACL starts with an ACL header structure, which specifies the size of
1682 * the ACL and the number of ACEs it contains. The ACL header is followed by
1683 * zero or more access control entries (ACEs). The ACL as well as each ACE
1684 * are aligned on 4-byte boundaries.
1685 */
1686typedef struct {
1687	u8 revision;	/* Revision of this ACL. */
1688	u8 alignment1;
1689	le16 size;	/* Allocated space in bytes for ACL. Includes this
1690			   header, the ACEs and the remaining free space. */
1691	le16 ace_count;	/* Number of ACEs in the ACL. */
1692	le16 alignment2;
1693/* sizeof() = 8 bytes */
1694} __attribute__((__packed__)) ACL;
1695
1696/**
1697 * enum ACL_CONSTANTS - Current constants for ACLs.
1698 */
1699typedef enum {
1700	/* Current revision. */
1701	ACL_REVISION		= 2,
1702	ACL_REVISION_DS		= 4,
1703
1704	/* History of revisions. */
1705	ACL_REVISION1		= 1,
1706	MIN_ACL_REVISION	= 2,
1707	ACL_REVISION2		= 2,
1708	ACL_REVISION3		= 3,
1709	ACL_REVISION4		= 4,
1710	MAX_ACL_REVISION	= 4,
1711} ACL_CONSTANTS;
1712
1713/**
1714 * enum SECURITY_DESCRIPTOR_CONTROL -
1715 *
1716 * The security descriptor control flags (16-bit).
1717 *
1718 * SE_OWNER_DEFAULTED - This boolean flag, when set, indicates that the
1719 *	SID pointed to by the Owner field was provided by a
1720 *	defaulting mechanism rather than explicitly provided by the
1721 *	original provider of the security descriptor.  This may
1722 *	affect the treatment of the SID with respect to inheritance
1723 *	of an owner.
1724 *
1725 * SE_GROUP_DEFAULTED - This boolean flag, when set, indicates that the
1726 *	SID in the Group field was provided by a defaulting mechanism
1727 *	rather than explicitly provided by the original provider of
1728 *	the security descriptor.  This may affect the treatment of
1729 *	the SID with respect to inheritance of a primary group.
1730 *
1731 * SE_DACL_PRESENT - This boolean flag, when set, indicates that the
1732 *	security descriptor contains a discretionary ACL.  If this
1733 *	flag is set and the Dacl field of the SECURITY_DESCRIPTOR is
1734 *	null, then a null ACL is explicitly being specified.
1735 *
1736 * SE_DACL_DEFAULTED - This boolean flag, when set, indicates that the
1737 *	ACL pointed to by the Dacl field was provided by a defaulting
1738 *	mechanism rather than explicitly provided by the original
1739 *	provider of the security descriptor.  This may affect the
1740 *	treatment of the ACL with respect to inheritance of an ACL.
1741 *	This flag is ignored if the DaclPresent flag is not set.
1742 *
1743 * SE_SACL_PRESENT - This boolean flag, when set,  indicates that the
1744 *	security descriptor contains a system ACL pointed to by the
1745 *	Sacl field.  If this flag is set and the Sacl field of the
1746 *	SECURITY_DESCRIPTOR is null, then an empty (but present)
1747 *	ACL is being specified.
1748 *
1749 * SE_SACL_DEFAULTED - This boolean flag, when set, indicates that the
1750 *	ACL pointed to by the Sacl field was provided by a defaulting
1751 *	mechanism rather than explicitly provided by the original
1752 *	provider of the security descriptor.  This may affect the
1753 *	treatment of the ACL with respect to inheritance of an ACL.
1754 *	This flag is ignored if the SaclPresent flag is not set.
1755 *
1756 * SE_SELF_RELATIVE - This boolean flag, when set, indicates that the
1757 *	security descriptor is in self-relative form.  In this form,
1758 *	all fields of the security descriptor are contiguous in memory
1759 *	and all pointer fields are expressed as offsets from the
1760 *	beginning of the security descriptor.
1761 */
1762typedef enum {
1763	SE_OWNER_DEFAULTED		= const_cpu_to_le16(0x0001),
1764	SE_GROUP_DEFAULTED		= const_cpu_to_le16(0x0002),
1765	SE_DACL_PRESENT			= const_cpu_to_le16(0x0004),
1766	SE_DACL_DEFAULTED		= const_cpu_to_le16(0x0008),
1767	SE_SACL_PRESENT			= const_cpu_to_le16(0x0010),
1768	SE_SACL_DEFAULTED		= const_cpu_to_le16(0x0020),
1769	SE_DACL_AUTO_INHERIT_REQ	= const_cpu_to_le16(0x0100),
1770	SE_SACL_AUTO_INHERIT_REQ	= const_cpu_to_le16(0x0200),
1771	SE_DACL_AUTO_INHERITED		= const_cpu_to_le16(0x0400),
1772	SE_SACL_AUTO_INHERITED		= const_cpu_to_le16(0x0800),
1773	SE_DACL_PROTECTED		= const_cpu_to_le16(0x1000),
1774	SE_SACL_PROTECTED		= const_cpu_to_le16(0x2000),
1775	SE_RM_CONTROL_VALID		= const_cpu_to_le16(0x4000),
1776	SE_SELF_RELATIVE		= const_cpu_to_le16(0x8000),
1777} __attribute__((__packed__)) SECURITY_DESCRIPTOR_CONTROL;
1778
1779/**
1780 * struct SECURITY_DESCRIPTOR_RELATIVE -
1781 *
1782 * Self-relative security descriptor. Contains the owner and group SIDs as well
1783 * as the sacl and dacl ACLs inside the security descriptor itself.
1784 */
1785typedef struct {
1786	u8 revision;	/* Revision level of the security descriptor. */
1787	u8 alignment;
1788	SECURITY_DESCRIPTOR_CONTROL control; /* Flags qualifying the type of
1789			   the descriptor as well as the following fields. */
1790	le32 owner;	/* Byte offset to a SID representing an object's
1791			   owner. If this is NULL, no owner SID is present in
1792			   the descriptor. */
1793	le32 group;	/* Byte offset to a SID representing an object's
1794			   primary group. If this is NULL, no primary group
1795			   SID is present in the descriptor. */
1796	le32 sacl;	/* Byte offset to a system ACL. Only valid, if
1797			   SE_SACL_PRESENT is set in the control field. If
1798			   SE_SACL_PRESENT is set but sacl is NULL, a NULL ACL
1799			   is specified. */
1800	le32 dacl;	/* Byte offset to a discretionary ACL. Only valid, if
1801			   SE_DACL_PRESENT is set in the control field. If
1802			   SE_DACL_PRESENT is set but dacl is NULL, a NULL ACL
1803			   (unconditionally granting access) is specified. */
1804/* sizeof() = 0x14 bytes */
1805} __attribute__((__packed__)) SECURITY_DESCRIPTOR_RELATIVE;
1806
1807/**
1808 * struct SECURITY_DESCRIPTOR - Absolute security descriptor.
1809 *
1810 * Does not contain the owner and group SIDs, nor the sacl and dacl ACLs inside
1811 * the security descriptor. Instead, it contains pointers to these structures
1812 * in memory. Obviously, absolute security descriptors are only useful for in
1813 * memory representations of security descriptors.
1814 *
1815 * On disk, a self-relative security descriptor is used.
1816 */
1817typedef struct {
1818	u8 revision;	/* Revision level of the security descriptor. */
1819	u8 alignment;
1820	SECURITY_DESCRIPTOR_CONTROL control;	/* Flags qualifying the type of
1821			   the descriptor as well as the following fields. */
1822	SID *owner;	/* Points to a SID representing an object's owner. If
1823			   this is NULL, no owner SID is present in the
1824			   descriptor. */
1825	SID *group;	/* Points to a SID representing an object's primary
1826			   group. If this is NULL, no primary group SID is
1827			   present in the descriptor. */
1828	ACL *sacl;	/* Points to a system ACL. Only valid, if
1829			   SE_SACL_PRESENT is set in the control field. If
1830			   SE_SACL_PRESENT is set but sacl is NULL, a NULL ACL
1831			   is specified. */
1832	ACL *dacl;	/* Points to a discretionary ACL. Only valid, if
1833			   SE_DACL_PRESENT is set in the control field. If
1834			   SE_DACL_PRESENT is set but dacl is NULL, a NULL ACL
1835			   (unconditionally granting access) is specified. */
1836} __attribute__((__packed__)) SECURITY_DESCRIPTOR;
1837
1838/**
1839 * enum SECURITY_DESCRIPTOR_CONSTANTS -
1840 *
1841 * Current constants for security descriptors.
1842 */
1843typedef enum {
1844	/* Current revision. */
1845	SECURITY_DESCRIPTOR_REVISION	= 1,
1846	SECURITY_DESCRIPTOR_REVISION1	= 1,
1847
1848	/* The sizes of both the absolute and relative security descriptors is
1849	   the same as pointers, at least on ia32 architecture are 32-bit. */
1850	SECURITY_DESCRIPTOR_MIN_LENGTH	= sizeof(SECURITY_DESCRIPTOR),
1851} SECURITY_DESCRIPTOR_CONSTANTS;
1852
1853/*
1854 * Attribute: Security descriptor (0x50).
1855 *
1856 * A standard self-relative security descriptor.
1857 *
1858 * NOTE: Can be resident or non-resident.
1859 * NOTE: Not used in NTFS 3.0+, as security descriptors are stored centrally
1860 * in FILE_Secure and the correct descriptor is found using the security_id
1861 * from the standard information attribute.
1862 */
1863typedef SECURITY_DESCRIPTOR_RELATIVE SECURITY_DESCRIPTOR_ATTR;
1864
1865/*
1866 * On NTFS 3.0+, all security descriptors are stored in FILE_Secure. Only one
1867 * referenced instance of each unique security descriptor is stored.
1868 *
1869 * FILE_Secure contains no unnamed data attribute, i.e. it has zero length. It
1870 * does, however, contain two indexes ($SDH and $SII) as well as a named data
1871 * stream ($SDS).
1872 *
1873 * Every unique security descriptor is assigned a unique security identifier
1874 * (security_id, not to be confused with a SID). The security_id is unique for
1875 * the NTFS volume and is used as an index into the $SII index, which maps
1876 * security_ids to the security descriptor's storage location within the $SDS
1877 * data attribute. The $SII index is sorted by ascending security_id.
1878 *
1879 * A simple hash is computed from each security descriptor. This hash is used
1880 * as an index into the $SDH index, which maps security descriptor hashes to
1881 * the security descriptor's storage location within the $SDS data attribute.
1882 * The $SDH index is sorted by security descriptor hash and is stored in a B+
1883 * tree. When searching $SDH (with the intent of determining whether or not a
1884 * new security descriptor is already present in the $SDS data stream), if a
1885 * matching hash is found, but the security descriptors do not match, the
1886 * search in the $SDH index is continued, searching for a next matching hash.
1887 *
1888 * When a precise match is found, the security_id corresponding to the security
1889 * descriptor in the $SDS attribute is read from the found $SDH index entry and
1890 * is stored in the $STANDARD_INFORMATION attribute of the file/directory to
1891 * which the security descriptor is being applied. The $STANDARD_INFORMATION
1892 * attribute is present in all base mft records (i.e. in all files and
1893 * directories).
1894 *
1895 * If a match is not found, the security descriptor is assigned a new unique
1896 * security_id and is added to the $SDS data attribute. Then, entries
1897 * referencing the this security descriptor in the $SDS data attribute are
1898 * added to the $SDH and $SII indexes.
1899 *
1900 * Note: Entries are never deleted from FILE_Secure, even if nothing
1901 * references an entry any more.
1902 */
1903
1904/**
1905 * struct SECURITY_DESCRIPTOR_HEADER -
1906 *
1907 * This header precedes each security descriptor in the $SDS data stream.
1908 * This is also the index entry data part of both the $SII and $SDH indexes.
1909 */
1910typedef struct {
1911	le32 hash;	   /* Hash of the security descriptor. */
1912	le32 security_id;   /* The security_id assigned to the descriptor. */
1913	le64 offset;	   /* Byte offset of this entry in the $SDS stream. */
1914	le32 length;	   /* Size in bytes of this entry in $SDS stream. */
1915} __attribute__((__packed__)) SECURITY_DESCRIPTOR_HEADER;
1916
1917/**
1918 * struct SDH_INDEX_DATA -
1919 */
1920typedef struct {
1921	le32 hash;          /* Hash of the security descriptor. */
1922	le32 security_id;   /* The security_id assigned to the descriptor. */
1923	le64 offset;	   /* Byte offset of this entry in the $SDS stream. */
1924	le32 length;	   /* Size in bytes of this entry in $SDS stream. */
1925	le32 reserved_II;   /* Padding - always unicode "II" or zero. This field
1926			      isn't counted in INDEX_ENTRY's data_length. */
1927} __attribute__((__packed__)) SDH_INDEX_DATA;
1928
1929/**
1930 * struct SII_INDEX_DATA -
1931 */
1932typedef SECURITY_DESCRIPTOR_HEADER SII_INDEX_DATA;
1933
1934/**
1935 * struct SDS_ENTRY -
1936 *
1937 * The $SDS data stream contains the security descriptors, aligned on 16-byte
1938 * boundaries, sorted by security_id in a B+ tree. Security descriptors cannot
1939 * cross 256kib boundaries (this restriction is imposed by the Windows cache
1940 * manager). Each security descriptor is contained in a SDS_ENTRY structure.
1941 * Also, each security descriptor is stored twice in the $SDS stream with a
1942 * fixed offset of 0x40000 bytes (256kib, the Windows cache manager's max size)
1943 * between them; i.e. if a SDS_ENTRY specifies an offset of 0x51d0, then the
1944 * the first copy of the security descriptor will be at offset 0x51d0 in the
1945 * $SDS data stream and the second copy will be at offset 0x451d0.
1946 */
1947typedef struct {
1948/*  0	SECURITY_DESCRIPTOR_HEADER; -- Unfolded here as gcc doesn't like
1949				       unnamed structs. */
1950	le32 hash;	   /* Hash of the security descriptor. */
1951	le32 security_id;   /* The security_id assigned to the descriptor. */
1952	le64 offset;	   /* Byte offset of this entry in the $SDS stream. */
1953	le32 length;	   /* Size in bytes of this entry in $SDS stream. */
1954/* 20*/	SECURITY_DESCRIPTOR_RELATIVE sid; /* The self-relative security
1955					     descriptor. */
1956} __attribute__((__packed__)) SDS_ENTRY;
1957
1958/**
1959 * struct SII_INDEX_KEY - The index entry key used in the $SII index.
1960 *
1961 * The collation type is COLLATION_NTOFS_ULONG.
1962 */
1963typedef struct {
1964	le32 security_id;   /* The security_id assigned to the descriptor. */
1965} __attribute__((__packed__)) SII_INDEX_KEY;
1966
1967/**
1968 * struct SDH_INDEX_KEY - The index entry key used in the $SDH index.
1969 *
1970 * The keys are sorted first by hash and then by security_id.
1971 * The collation rule is COLLATION_NTOFS_SECURITY_HASH.
1972 */
1973typedef struct {
1974	le32 hash;	   /* Hash of the security descriptor. */
1975	le32 security_id;   /* The security_id assigned to the descriptor. */
1976} __attribute__((__packed__)) SDH_INDEX_KEY;
1977
1978/**
1979 * struct VOLUME_NAME - Attribute: Volume name (0x60).
1980 *
1981 * NOTE: Always resident.
1982 * NOTE: Present only in FILE_Volume.
1983 */
1984typedef struct {
1985	ntfschar name[0];	/* The name of the volume in Unicode. */
1986} __attribute__((__packed__)) VOLUME_NAME;
1987
1988/**
1989 * enum VOLUME_FLAGS - Possible flags for the volume (16-bit).
1990 */
1991typedef enum {
1992	VOLUME_IS_DIRTY			= const_cpu_to_le16(0x0001),
1993	VOLUME_RESIZE_LOG_FILE		= const_cpu_to_le16(0x0002),
1994	VOLUME_UPGRADE_ON_MOUNT		= const_cpu_to_le16(0x0004),
1995	VOLUME_MOUNTED_ON_NT4		= const_cpu_to_le16(0x0008),
1996	VOLUME_DELETE_USN_UNDERWAY	= const_cpu_to_le16(0x0010),
1997	VOLUME_REPAIR_OBJECT_ID		= const_cpu_to_le16(0x0020),
1998	VOLUME_CHKDSK_UNDERWAY		= const_cpu_to_le16(0x4000),
1999	VOLUME_MODIFIED_BY_CHKDSK	= const_cpu_to_le16(0x8000),
2000	VOLUME_FLAGS_MASK		= const_cpu_to_le16(0xc03f),
2001} __attribute__((__packed__)) VOLUME_FLAGS;
2002
2003/**
2004 * struct VOLUME_INFORMATION - Attribute: Volume information (0x70).
2005 *
2006 * NOTE: Always resident.
2007 * NOTE: Present only in FILE_Volume.
2008 * NOTE: Windows 2000 uses NTFS 3.0 while Windows NT4 service pack 6a uses
2009 *	 NTFS 1.2. I haven't personally seen other values yet.
2010 */
2011typedef struct {
2012	le64 reserved;		/* Not used (yet?). */
2013	u8 major_ver;		/* Major version of the ntfs format. */
2014	u8 minor_ver;		/* Minor version of the ntfs format. */
2015	VOLUME_FLAGS flags;	/* Bit array of VOLUME_* flags. */
2016} __attribute__((__packed__)) VOLUME_INFORMATION;
2017
2018/**
2019 * struct DATA_ATTR - Attribute: Data attribute (0x80).
2020 *
2021 * NOTE: Can be resident or non-resident.
2022 *
2023 * Data contents of a file (i.e. the unnamed stream) or of a named stream.
2024 */
2025typedef struct {
2026	u8 data[0];		/* The file's data contents. */
2027} __attribute__((__packed__)) DATA_ATTR;
2028
2029/**
2030 * enum INDEX_HEADER_FLAGS - Index header flags (8-bit).
2031 */
2032typedef enum {
2033	/* When index header is in an index root attribute: */
2034	SMALL_INDEX	= 0, /* The index is small enough to fit inside the
2035				index root attribute and there is no index
2036				allocation attribute present. */
2037	LARGE_INDEX	= 1, /* The index is too large to fit in the index
2038				root attribute and/or an index allocation
2039				attribute is present. */
2040	/*
2041	 * When index header is in an index block, i.e. is part of index
2042	 * allocation attribute:
2043	 */
2044	LEAF_NODE	= 0, /* This is a leaf node, i.e. there are no more
2045				nodes branching off it. */
2046	INDEX_NODE	= 1, /* This node indexes other nodes, i.e. is not a
2047				leaf node. */
2048	NODE_MASK	= 1, /* Mask for accessing the *_NODE bits. */
2049} __attribute__((__packed__)) INDEX_HEADER_FLAGS;
2050
2051/**
2052 * struct INDEX_HEADER -
2053 *
2054 * This is the header for indexes, describing the INDEX_ENTRY records, which
2055 * follow the INDEX_HEADER. Together the index header and the index entries
2056 * make up a complete index.
2057 *
2058 * IMPORTANT NOTE: The offset, length and size structure members are counted
2059 * relative to the start of the index header structure and not relative to the
2060 * start of the index root or index allocation structures themselves.
2061 */
2062typedef struct {
2063/*  0*/	le32 entries_offset;	/* Byte offset from the INDEX_HEADER to first
2064				   INDEX_ENTRY, aligned to 8-byte boundary.  */
2065/*  4*/	le32 index_length;	/* Data size in byte of the INDEX_ENTRY's,
2066				   including the INDEX_HEADER, aligned to 8. */
2067/*  8*/	le32 allocated_size;	/* Allocated byte size of this index (block),
2068				   multiple of 8 bytes. See more below.      */
2069	/*
2070	   For the index root attribute, the above two numbers are always
2071	   equal, as the attribute is resident and it is resized as needed.
2072
2073	   For the index allocation attribute, the attribute is not resident
2074	   and the allocated_size is equal to the index_block_size specified
2075	   by the corresponding INDEX_ROOT attribute minus the INDEX_BLOCK
2076	   size not counting the INDEX_HEADER part (i.e. minus -24).
2077	 */
2078/* 12*/	INDEX_HEADER_FLAGS ih_flags;	/* Bit field of INDEX_HEADER_FLAGS.  */
2079/* 13*/	u8 reserved[3];			/* Reserved/align to 8-byte boundary.*/
2080/* sizeof() == 16 */
2081} __attribute__((__packed__)) INDEX_HEADER;
2082
2083/**
2084 * struct INDEX_ROOT - Attribute: Index root (0x90).
2085 *
2086 * NOTE: Always resident.
2087 *
2088 * This is followed by a sequence of index entries (INDEX_ENTRY structures)
2089 * as described by the index header.
2090 *
2091 * When a directory is small enough to fit inside the index root then this
2092 * is the only attribute describing the directory. When the directory is too
2093 * large to fit in the index root, on the other hand, two additional attributes
2094 * are present: an index allocation attribute, containing sub-nodes of the B+
2095 * directory tree (see below), and a bitmap attribute, describing which virtual
2096 * cluster numbers (vcns) in the index allocation attribute are in use by an
2097 * index block.
2098 *
2099 * NOTE: The root directory (FILE_root) contains an entry for itself. Other
2100 * directories do not contain entries for themselves, though.
2101 */
2102typedef struct {
2103/*  0*/	ATTR_TYPES type;		/* Type of the indexed attribute. Is
2104					   $FILE_NAME for directories, zero
2105					   for view indexes. No other values
2106					   allowed. */
2107/*  4*/	COLLATION_RULES collation_rule;	/* Collation rule used to sort the
2108					   index entries. If type is $FILE_NAME,
2109					   this must be COLLATION_FILE_NAME. */
2110/*  8*/	le32 index_block_size;		/* Size of index block in bytes (in
2111					   the index allocation attribute). */
2112/* 12*/	s8 clusters_per_index_block;	/* Size of index block in clusters (in
2113					   the index allocation attribute), when
2114					   an index block is >= than a cluster,
2115					   otherwise sectors per index block. */
2116/* 13*/	u8 reserved[3];			/* Reserved/align to 8-byte boundary. */
2117/* 16*/	INDEX_HEADER index;		/* Index header describing the
2118					   following index entries. */
2119/* sizeof()= 32 bytes */
2120} __attribute__((__packed__)) INDEX_ROOT;
2121
2122/**
2123 * struct INDEX_BLOCK - Attribute: Index allocation (0xa0).
2124 *
2125 * NOTE: Always non-resident (doesn't make sense to be resident anyway!).
2126 *
2127 * This is an array of index blocks. Each index block starts with an
2128 * INDEX_BLOCK structure containing an index header, followed by a sequence of
2129 * index entries (INDEX_ENTRY structures), as described by the INDEX_HEADER.
2130 */
2131typedef struct {
2132/*  0	NTFS_RECORD; -- Unfolded here as gcc doesn't like unnamed structs. */
2133	NTFS_RECORD_TYPES magic;/* Magic is "INDX". */
2134	le16 usa_ofs;		/* See NTFS_RECORD definition. */
2135	le16 usa_count;		/* See NTFS_RECORD definition. */
2136
2137/*  8*/	leLSN lsn;		/* $LogFile sequence number of the last
2138				   modification of this index block. */
2139/* 16*/	leVCN index_block_vcn;	/* Virtual cluster number of the index block. */
2140/* 24*/	INDEX_HEADER index;	/* Describes the following index entries. */
2141/* sizeof()= 40 (0x28) bytes */
2142/*
2143 * When creating the index block, we place the update sequence array at this
2144 * offset, i.e. before we start with the index entries. This also makes sense,
2145 * otherwise we could run into problems with the update sequence array
2146 * containing in itself the last two bytes of a sector which would mean that
2147 * multi sector transfer protection wouldn't work. As you can't protect data
2148 * by overwriting it since you then can't get it back...
2149 * When reading use the data from the ntfs record header.
2150 */
2151} __attribute__((__packed__)) INDEX_BLOCK;
2152
2153typedef INDEX_BLOCK INDEX_ALLOCATION;
2154
2155/**
2156 * struct REPARSE_INDEX_KEY -
2157 *
2158 * The system file FILE_Extend/$Reparse contains an index named $R listing
2159 * all reparse points on the volume. The index entry keys are as defined
2160 * below. Note, that there is no index data associated with the index entries.
2161 *
2162 * The index entries are sorted by the index key file_id. The collation rule is
2163 * COLLATION_NTOFS_ULONGS. FIXME: Verify whether the reparse_tag is not the
2164 * primary key / is not a key at all. (AIA)
2165 */
2166typedef struct {
2167	le32 reparse_tag;	/* Reparse point type (inc. flags). */
2168	leMFT_REF file_id;	/* Mft record of the file containing the
2169				   reparse point attribute. */
2170} __attribute__((__packed__)) REPARSE_INDEX_KEY;
2171
2172/**
2173 * enum QUOTA_FLAGS - Quota flags (32-bit).
2174 */
2175typedef enum {
2176	/* The user quota flags. Names explain meaning. */
2177	QUOTA_FLAG_DEFAULT_LIMITS	= const_cpu_to_le32(0x00000001),
2178	QUOTA_FLAG_LIMIT_REACHED	= const_cpu_to_le32(0x00000002),
2179	QUOTA_FLAG_ID_DELETED		= const_cpu_to_le32(0x00000004),
2180
2181	QUOTA_FLAG_USER_MASK		= const_cpu_to_le32(0x00000007),
2182		/* Bit mask for user quota flags. */
2183
2184	/* These flags are only present in the quota defaults index entry,
2185	   i.e. in the entry where owner_id = QUOTA_DEFAULTS_ID. */
2186	QUOTA_FLAG_TRACKING_ENABLED	= const_cpu_to_le32(0x00000010),
2187	QUOTA_FLAG_ENFORCEMENT_ENABLED	= const_cpu_to_le32(0x00000020),
2188	QUOTA_FLAG_TRACKING_REQUESTED	= const_cpu_to_le32(0x00000040),
2189	QUOTA_FLAG_LOG_THRESHOLD	= const_cpu_to_le32(0x00000080),
2190	QUOTA_FLAG_LOG_LIMIT		= const_cpu_to_le32(0x00000100),
2191	QUOTA_FLAG_OUT_OF_DATE		= const_cpu_to_le32(0x00000200),
2192	QUOTA_FLAG_CORRUPT		= const_cpu_to_le32(0x00000400),
2193	QUOTA_FLAG_PENDING_DELETES	= const_cpu_to_le32(0x00000800),
2194} QUOTA_FLAGS;
2195
2196/**
2197 * struct QUOTA_CONTROL_ENTRY -
2198 *
2199 * The system file FILE_Extend/$Quota contains two indexes $O and $Q. Quotas
2200 * are on a per volume and per user basis.
2201 *
2202 * The $Q index contains one entry for each existing user_id on the volume. The
2203 * index key is the user_id of the user/group owning this quota control entry,
2204 * i.e. the key is the owner_id. The user_id of the owner of a file, i.e. the
2205 * owner_id, is found in the standard information attribute. The collation rule
2206 * for $Q is COLLATION_NTOFS_ULONG.
2207 *
2208 * The $O index contains one entry for each user/group who has been assigned
2209 * a quota on that volume. The index key holds the SID of the user_id the
2210 * entry belongs to, i.e. the owner_id. The collation rule for $O is
2211 * COLLATION_NTOFS_SID.
2212 *
2213 * The $O index entry data is the user_id of the user corresponding to the SID.
2214 * This user_id is used as an index into $Q to find the quota control entry
2215 * associated with the SID.
2216 *
2217 * The $Q index entry data is the quota control entry and is defined below.
2218 */
2219typedef struct {
2220	le32 version;		/* Currently equals 2. */
2221	QUOTA_FLAGS flags;	/* Flags describing this quota entry. */
2222	le64 bytes_used;		/* How many bytes of the quota are in use. */
2223	sle64 change_time;	/* Last time this quota entry was changed. */
2224	sle64 threshold;		/* Soft quota (-1 if not limited). */
2225	sle64 limit;		/* Hard quota (-1 if not limited). */
2226	sle64 exceeded_time;	/* How long the soft quota has been exceeded. */
2227/* The below field is NOT present for the quota defaults entry. */
2228	SID sid;		/* The SID of the user/object associated with
2229				   this quota entry. If this field is missing
2230				   then the INDEX_ENTRY is padded to a multiple
2231				   of 8 with zeros which are not counted in
2232				   the data_length field. If the sid is present
2233				   then this structure is padded with zeros to
2234				   a multiple of 8 and the padding is counted in
2235				   the INDEX_ENTRY's data_length. */
2236} __attribute__((__packed__)) QUOTA_CONTROL_ENTRY;
2237
2238/**
2239 * struct QUOTA_O_INDEX_DATA -
2240 */
2241typedef struct {
2242	le32 owner_id;
2243	le32 unknown;		/* Always 32. Seems to be padding and it's not
2244				   counted in the INDEX_ENTRY's data_length.
2245				   This field shouldn't be really here. */
2246} __attribute__((__packed__)) QUOTA_O_INDEX_DATA;
2247
2248/**
2249 * enum PREDEFINED_OWNER_IDS - Predefined owner_id values (32-bit).
2250 */
2251typedef enum {
2252	QUOTA_INVALID_ID	= const_cpu_to_le32(0x00000000),
2253	QUOTA_DEFAULTS_ID	= const_cpu_to_le32(0x00000001),
2254	QUOTA_FIRST_USER_ID	= const_cpu_to_le32(0x00000100),
2255} PREDEFINED_OWNER_IDS;
2256
2257/**
2258 * enum INDEX_ENTRY_FLAGS - Index entry flags (16-bit).
2259 */
2260typedef enum {
2261	INDEX_ENTRY_NODE = const_cpu_to_le16(1), /* This entry contains a
2262					sub-node, i.e. a reference to an index
2263					block in form of a virtual cluster
2264					number (see below). */
2265	INDEX_ENTRY_END  = const_cpu_to_le16(2), /* This signifies the last
2266					entry in an index block. The index
2267					entry does not represent a file but it
2268					can point to a sub-node. */
2269	INDEX_ENTRY_SPACE_FILLER = 0xffff, /* Just to force 16-bit width. */
2270} __attribute__((__packed__)) INDEX_ENTRY_FLAGS;
2271
2272/**
2273 * struct INDEX_ENTRY_HEADER - This the index entry header (see below).
2274 *
2275 *         ==========================================================
2276 *         !!!!!  SEE DESCRIPTION OF THE FIELDS AT INDEX_ENTRY  !!!!!
2277 *         ==========================================================
2278 */
2279typedef struct {
2280/*  0*/	union {
2281		leMFT_REF indexed_file;
2282		struct {
2283			le16 data_offset;
2284			le16 data_length;
2285			le32 reservedV;
2286		} __attribute__((__packed__));
2287	} __attribute__((__packed__));
2288/*  8*/	le16 length;
2289/* 10*/	le16 key_length;
2290/* 12*/	INDEX_ENTRY_FLAGS flags;
2291/* 14*/	le16 reserved;
2292/* sizeof() = 16 bytes */
2293} __attribute__((__packed__)) INDEX_ENTRY_HEADER;
2294
2295/**
2296 * struct INDEX_ENTRY - This is an index entry.
2297 *
2298 * A sequence of such entries follows each INDEX_HEADER structure. Together
2299 * they make up a complete index. The index follows either an index root
2300 * attribute or an index allocation attribute.
2301 *
2302 * NOTE: Before NTFS 3.0 only filename attributes were indexed.
2303 */
2304typedef struct {
2305/*  0	INDEX_ENTRY_HEADER; -- Unfolded here as gcc dislikes unnamed structs. */
2306	union {		/* Only valid when INDEX_ENTRY_END is not set. */
2307		leMFT_REF indexed_file;		/* The mft reference of the file
2308						   described by this index
2309						   entry. Used for directory
2310						   indexes. */
2311		struct { /* Used for views/indexes to find the entry's data. */
2312			le16 data_offset;	/* Data byte offset from this
2313						   INDEX_ENTRY. Follows the
2314						   index key. */
2315			le16 data_length;	/* Data length in bytes. */
2316			le32 reservedV;		/* Reserved (zero). */
2317		} __attribute__((__packed__));
2318	} __attribute__((__packed__));
2319/*  8*/ le16 length;		 /* Byte size of this index entry, multiple of
2320				    8-bytes. Size includes INDEX_ENTRY_HEADER
2321				    and the optional subnode VCN. See below. */
2322/* 10*/ le16 key_length;		 /* Byte size of the key value, which is in the
2323				    index entry. It follows field reserved. Not
2324				    multiple of 8-bytes. */
2325/* 12*/	INDEX_ENTRY_FLAGS ie_flags; /* Bit field of INDEX_ENTRY_* flags. */
2326/* 14*/	le16 reserved;		 /* Reserved/align to 8-byte boundary. */
2327/*	End of INDEX_ENTRY_HEADER */
2328/* 16*/	union {		/* The key of the indexed attribute. NOTE: Only present
2329			   if INDEX_ENTRY_END bit in flags is not set. NOTE: On
2330			   NTFS versions before 3.0 the only valid key is the
2331			   FILE_NAME_ATTR. On NTFS 3.0+ the following
2332			   additional index keys are defined: */
2333		FILE_NAME_ATTR file_name;/* $I30 index in directories. */
2334		SII_INDEX_KEY sii;	/* $SII index in $Secure. */
2335		SDH_INDEX_KEY sdh;	/* $SDH index in $Secure. */
2336		GUID object_id;		/* $O index in FILE_Extend/$ObjId: The
2337					   object_id of the mft record found in
2338					   the data part of the index. */
2339		REPARSE_INDEX_KEY reparse;	/* $R index in
2340						   FILE_Extend/$Reparse. */
2341		SID sid;		/* $O index in FILE_Extend/$Quota:
2342					   SID of the owner of the user_id. */
2343		le32 owner_id;		/* $Q index in FILE_Extend/$Quota:
2344					   user_id of the owner of the quota
2345					   control entry in the data part of
2346					   the index. */
2347	} __attribute__((__packed__)) key;
2348	/* The (optional) index data is inserted here when creating.
2349	leVCN vcn;	   If INDEX_ENTRY_NODE bit in ie_flags is set, the last
2350			   eight bytes of this index entry contain the virtual
2351			   cluster number of the index block that holds the
2352			   entries immediately preceding the current entry.
2353
2354			   If the key_length is zero, then the vcn immediately
2355			   follows the INDEX_ENTRY_HEADER.
2356
2357			   The address of the vcn of "ie" INDEX_ENTRY is given by
2358			   (char*)ie + le16_to_cpu(ie->length) - sizeof(VCN)
2359	*/
2360} __attribute__((__packed__)) INDEX_ENTRY;
2361
2362/**
2363 * struct BITMAP_ATTR - Attribute: Bitmap (0xb0).
2364 *
2365 * Contains an array of bits (aka a bitfield).
2366 *
2367 * When used in conjunction with the index allocation attribute, each bit
2368 * corresponds to one index block within the index allocation attribute. Thus
2369 * the number of bits in the bitmap * index block size / cluster size is the
2370 * number of clusters in the index allocation attribute.
2371 */
2372typedef struct {
2373	u8 bitmap[0];			/* Array of bits. */
2374} __attribute__((__packed__)) BITMAP_ATTR;
2375
2376/**
2377 * enum PREDEFINED_REPARSE_TAGS -
2378 *
2379 * The reparse point tag defines the type of the reparse point. It also
2380 * includes several flags, which further describe the reparse point.
2381 *
2382 * The reparse point tag is an unsigned 32-bit value divided in three parts:
2383 *
2384 * 1. The least significant 16 bits (i.e. bits 0 to 15) specify the type of
2385 *    the reparse point.
2386 * 2. The 13 bits after this (i.e. bits 16 to 28) are reserved for future use.
2387 * 3. The most significant three bits are flags describing the reparse point.
2388 *    They are defined as follows:
2389 *	bit 29: Name surrogate bit. If set, the filename is an alias for
2390 *		another object in the system.
2391 *	bit 30: High-latency bit. If set, accessing the first byte of data will
2392 *		be slow. (E.g. the data is stored on a tape drive.)
2393 *	bit 31: Microsoft bit. If set, the tag is owned by Microsoft. User
2394 *		defined tags have to use zero here.
2395 */
2396typedef enum {
2397	IO_REPARSE_TAG_IS_ALIAS		= const_cpu_to_le32(0x20000000),
2398	IO_REPARSE_TAG_IS_HIGH_LATENCY	= const_cpu_to_le32(0x40000000),
2399	IO_REPARSE_TAG_IS_MICROSOFT	= const_cpu_to_le32(0x80000000),
2400
2401	IO_REPARSE_TAG_RESERVED_ZERO	= const_cpu_to_le32(0x00000000),
2402	IO_REPARSE_TAG_RESERVED_ONE	= const_cpu_to_le32(0x00000001),
2403	IO_REPARSE_TAG_RESERVED_RANGE	= const_cpu_to_le32(0x00000001),
2404
2405	IO_REPARSE_TAG_CSV		= const_cpu_to_le32(0x80000009),
2406	IO_REPARSE_TAG_DEDUP		= const_cpu_to_le32(0x80000013),
2407	IO_REPARSE_TAG_DFS		= const_cpu_to_le32(0x8000000A),
2408	IO_REPARSE_TAG_DFSR		= const_cpu_to_le32(0x80000012),
2409	IO_REPARSE_TAG_HSM		= const_cpu_to_le32(0xC0000004),
2410	IO_REPARSE_TAG_HSM2		= const_cpu_to_le32(0x80000006),
2411	IO_REPARSE_TAG_MOUNT_POINT	= const_cpu_to_le32(0xA0000003),
2412	IO_REPARSE_TAG_NFS		= const_cpu_to_le32(0x80000014),
2413	IO_REPARSE_TAG_SIS		= const_cpu_to_le32(0x80000007),
2414	IO_REPARSE_TAG_SYMLINK		= const_cpu_to_le32(0xA000000C),
2415	IO_REPARSE_TAG_WIM		= const_cpu_to_le32(0x80000008),
2416	IO_REPARSE_TAG_WOF		= const_cpu_to_le32(0x80000017),
2417
2418	IO_REPARSE_TAG_VALID_VALUES	= const_cpu_to_le32(0xf000ffff),
2419} PREDEFINED_REPARSE_TAGS;
2420
2421/**
2422 * struct REPARSE_POINT - Attribute: Reparse point (0xc0).
2423 *
2424 * NOTE: Can be resident or non-resident.
2425 */
2426typedef struct {
2427	le32 reparse_tag;		/* Reparse point type (inc. flags). */
2428	le16 reparse_data_length;	/* Byte size of reparse data. */
2429	le16 reserved;			/* Align to 8-byte boundary. */
2430	u8 reparse_data[0];		/* Meaning depends on reparse_tag. */
2431} __attribute__((__packed__)) REPARSE_POINT;
2432
2433/**
2434 * struct EA_INFORMATION - Attribute: Extended attribute information (0xd0).
2435 *
2436 * NOTE: Always resident.
2437 */
2438typedef struct {
2439	le16 ea_length;		/* Byte size of the packed extended
2440				   attributes. */
2441	le16 need_ea_count;	/* The number of extended attributes which have
2442				   the NEED_EA bit set. */
2443	le32 ea_query_length;	/* Byte size of the buffer required to query
2444				   the extended attributes when calling
2445				   ZwQueryEaFile() in Windows NT/2k. I.e. the
2446				   byte size of the unpacked extended
2447				   attributes. */
2448} __attribute__((__packed__)) EA_INFORMATION;
2449
2450/**
2451 * enum EA_FLAGS - Extended attribute flags (8-bit).
2452 */
2453typedef enum {
2454	NEED_EA	= 0x80,		/* Indicate that the file to which the EA
2455				   belongs cannot be interpreted without
2456				   understanding the associated extended
2457				   attributes. */
2458} __attribute__((__packed__)) EA_FLAGS;
2459
2460/**
2461 * struct EA_ATTR - Attribute: Extended attribute (EA) (0xe0).
2462 *
2463 * Like the attribute list and the index buffer list, the EA attribute value is
2464 * a sequence of EA_ATTR variable length records.
2465 *
2466 * FIXME: It appears weird that the EA name is not Unicode. Is it true?
2467 * FIXME: It seems that name is always uppercased. Is it true?
2468 */
2469typedef struct {
2470	le32 next_entry_offset;	/* Offset to the next EA_ATTR. */
2471	EA_FLAGS flags;		/* Flags describing the EA. */
2472	u8 name_length;		/* Length of the name of the extended
2473				   attribute in bytes. */
2474	le16 value_length;	/* Byte size of the EA's value. */
2475	u8 name[0];		/* Name of the EA. */
2476	u8 value[0];		/* The value of the EA. Immediately
2477				   follows the name. */
2478} __attribute__((__packed__)) EA_ATTR;
2479
2480/**
2481 * struct PROPERTY_SET - Attribute: Property set (0xf0).
2482 *
2483 * Intended to support Native Structure Storage (NSS) - a feature removed from
2484 * NTFS 3.0 during beta testing.
2485 */
2486typedef struct {
2487	/* Irrelevant as feature unused. */
2488} __attribute__((__packed__)) PROPERTY_SET;
2489
2490/**
2491 * struct LOGGED_UTILITY_STREAM - Attribute: Logged utility stream (0x100).
2492 *
2493 * NOTE: Can be resident or non-resident.
2494 *
2495 * Operations on this attribute are logged to the journal ($LogFile) like
2496 * normal metadata changes.
2497 *
2498 * Used by the Encrypting File System (EFS).  All encrypted files have this
2499 * attribute with the name $EFS.  See below for the relevant structures.
2500 */
2501typedef struct {
2502	/* Can be anything the creator chooses. */
2503} __attribute__((__packed__)) LOGGED_UTILITY_STREAM;
2504
2505/*
2506 * $EFS Data Structure:
2507 *
2508 * The following information is about the data structures that are contained
2509 * inside a logged utility stream (0x100) with a name of "$EFS".
2510 *
2511 * The stream starts with an instance of EFS_ATTR_HEADER.
2512 *
2513 * Next, at offsets offset_to_ddf_array and offset_to_drf_array (unless any of
2514 * them is 0) there is a EFS_DF_ARRAY_HEADER immediately followed by a sequence
2515 * of multiple data decryption/recovery fields.
2516 *
2517 * Each data decryption/recovery field starts with a EFS_DF_HEADER and the next
2518 * one (if it exists) can be found by adding EFS_DF_HEADER->df_length bytes to
2519 * the offset of the beginning of the current EFS_DF_HEADER.
2520 *
2521 * The data decryption/recovery field contains an EFS_DF_CERTIFICATE_HEADER, a
2522 * SID, an optional GUID, an optional container name, a non-optional user name,
2523 * and the encrypted FEK.
2524 *
2525 * Note all the below are best guesses so may have mistakes/inaccuracies.
2526 * Corrections/clarifications/additions are always welcome!
2527 *
2528 * Ntfs.sys takes an EFS value length of <= 0x54 or > 0x40000 to BSOD, i.e. it
2529 * is invalid.
2530 */
2531
2532/**
2533 * struct EFS_ATTR_HEADER - "$EFS" header.
2534 *
2535 * The header of the Logged utility stream (0x100) attribute named "$EFS".
2536 */
2537typedef struct {
2538/*  0*/	le32 length;		/* Length of EFS attribute in bytes. */
2539	le32 state;		/* Always 0? */
2540	le32 version;		/* Efs version.  Always 2? */
2541	le32 crypto_api_version;	/* Always 0? */
2542/* 16*/	u8 unknown4[16];	/* MD5 hash of decrypted FEK?  This field is
2543				   created with a call to UuidCreate() so is
2544				   unlikely to be an MD5 hash and is more
2545				   likely to be GUID of this encrytped file
2546				   or something like that. */
2547/* 32*/	u8 unknown5[16];	/* MD5 hash of DDFs? */
2548/* 48*/	u8 unknown6[16];	/* MD5 hash of DRFs? */
2549/* 64*/	le32 offset_to_ddf_array;/* Offset in bytes to the array of data
2550				   decryption fields (DDF), see below.  Zero if
2551				   no DDFs are present. */
2552	le32 offset_to_drf_array;/* Offset in bytes to the array of data
2553				   recovery fields (DRF), see below.  Zero if
2554				   no DRFs are present. */
2555	le32 reserved;		/* Reserved. */
2556} __attribute__((__packed__)) EFS_ATTR_HEADER;
2557
2558/**
2559 * struct EFS_DF_ARRAY_HEADER -
2560 */
2561typedef struct {
2562	le32 df_count;		/* Number of data decryption/recovery fields in
2563				   the array. */
2564} __attribute__((__packed__)) EFS_DF_ARRAY_HEADER;
2565
2566/**
2567 * struct EFS_DF_HEADER -
2568 */
2569typedef struct {
2570/*  0*/	le32 df_length;		/* Length of this data decryption/recovery
2571				   field in bytes. */
2572	le32 cred_header_offset;	/* Offset in bytes to the credential header. */
2573	le32 fek_size;		/* Size in bytes of the encrypted file
2574				   encryption key (FEK). */
2575	le32 fek_offset;		/* Offset in bytes to the FEK from the start of
2576				   the data decryption/recovery field. */
2577/* 16*/	le32 unknown1;		/* always 0?  Might be just padding. */
2578} __attribute__((__packed__)) EFS_DF_HEADER;
2579
2580/**
2581 * struct EFS_DF_CREDENTIAL_HEADER -
2582 */
2583typedef struct {
2584/*  0*/	le32 cred_length;	/* Length of this credential in bytes. */
2585	le32 sid_offset;		/* Offset in bytes to the user's sid from start
2586				   of this structure.  Zero if no sid is
2587				   present. */
2588/*  8*/	le32 type;		/* Type of this credential:
2589					1 = CryptoAPI container.
2590					2 = Unexpected type.
2591					3 = Certificate thumbprint.
2592					other = Unknown type. */
2593	union {
2594		/* CryptoAPI container. */
2595		struct {
2596/* 12*/			le32 container_name_offset;	/* Offset in bytes to
2597				   the name of the container from start of this
2598				   structure (may not be zero). */
2599/* 16*/			le32 provider_name_offset;	/* Offset in bytes to
2600				   the name of the provider from start of this
2601				   structure (may not be zero). */
2602			le32 public_key_blob_offset;	/* Offset in bytes to
2603				   the public key blob from start of this
2604				   structure. */
2605/* 24*/			le32 public_key_blob_size;	/* Size in bytes of
2606				   public key blob. */
2607		} __attribute__((__packed__));
2608		/* Certificate thumbprint. */
2609		struct {
2610/* 12*/			le32 cert_thumbprint_header_size;	/* Size in
2611				   bytes of the header of the certificate
2612				   thumbprint. */
2613/* 16*/			le32 cert_thumbprint_header_offset;	/* Offset in
2614				   bytes to the header of the certificate
2615				   thumbprint from start of this structure. */
2616			le32 unknown1;	/* Always 0?  Might be padding... */
2617			le32 unknown2;	/* Always 0?  Might be padding... */
2618		} __attribute__((__packed__));
2619	} __attribute__((__packed__));
2620} __attribute__((__packed__)) EFS_DF_CREDENTIAL_HEADER;
2621
2622typedef EFS_DF_CREDENTIAL_HEADER EFS_DF_CRED_HEADER;
2623
2624/**
2625 * struct EFS_DF_CERTIFICATE_THUMBPRINT_HEADER -
2626 */
2627typedef struct {
2628/*  0*/	le32 thumbprint_offset;		/* Offset in bytes to the thumbprint. */
2629	le32 thumbprint_size;		/* Size of thumbprint in bytes. */
2630/*  8*/	le32 container_name_offset;	/* Offset in bytes to the name of the
2631					   container from start of this
2632					   structure or 0 if no name present. */
2633	le32 provider_name_offset;	/* Offset in bytes to the name of the
2634					   cryptographic provider from start of
2635					   this structure or 0 if no name
2636					   present. */
2637/* 16*/	le32 user_name_offset;		/* Offset in bytes to the user name
2638					   from start of this structure or 0 if
2639					   no user name present.  (This is also
2640					   known as lpDisplayInformation.) */
2641} __attribute__((__packed__)) EFS_DF_CERTIFICATE_THUMBPRINT_HEADER;
2642
2643typedef EFS_DF_CERTIFICATE_THUMBPRINT_HEADER EFS_DF_CERT_THUMBPRINT_HEADER;
2644
2645typedef enum {
2646	INTX_SYMBOLIC_LINK =
2647		const_cpu_to_le64(0x014B4E4C78746E49ULL), /* "IntxLNK\1" */
2648	INTX_CHARACTER_DEVICE =
2649		const_cpu_to_le64(0x0052484378746E49ULL), /* "IntxCHR\0" */
2650	INTX_BLOCK_DEVICE =
2651		const_cpu_to_le64(0x004B4C4278746E49ULL), /* "IntxBLK\0" */
2652} INTX_FILE_TYPES;
2653
2654typedef struct {
2655	INTX_FILE_TYPES magic;		/* Intx file magic. */
2656	union {
2657		/* For character and block devices. */
2658		struct {
2659			le64 major;		/* Major device number. */
2660			le64 minor;		/* Minor device number. */
2661			void *device_end[0];	/* Marker for offsetof(). */
2662		} __attribute__((__packed__));
2663		/* For symbolic links. */
2664		ntfschar target[0];
2665	} __attribute__((__packed__));
2666} __attribute__((__packed__)) INTX_FILE;
2667
2668#endif /* defined _NTFS_LAYOUT_H */
2669