1199
* ntfs_attr_find - find (next) attribute in mft record
1200
* @type: attribute type to find
1201
* @name: attribute name to find (optional, i.e. NULL means don't care)
1202
* @name_len: attribute name length (only needed if @name present)
1203
* @ic: IGNORE_CASE or CASE_SENSITIVE (ignored if @name not present)
1204
* @val: attribute value to find (optional, resident attributes only)
1205
* @val_len: attribute value length
1206
* @ctx: search context with mft record and attribute to search from
1208
* You shouldn't need to call this function directly. Use lookup_attr() instead.
1210
* ntfs_attr_find() takes a search context @ctx as parameter and searches the
1211
* mft record specified by @ctx->mrec, beginning at @ctx->attr, for an
1212
* attribute of @type, optionally @name and @val. If found, ntfs_attr_find()
1213
* returns 0 and @ctx->attr will point to the found attribute.
1215
* If not found, ntfs_attr_find() returns -1, with errno set to ENOENT and
1216
* @ctx->attr will point to the attribute before which the attribute being
1217
* searched for would need to be inserted if such an action were to be desired.
1219
* On actual error, ntfs_attr_find() returns -1 with errno set to the error
1220
* code but not to ENOENT. In this case @ctx->attr is undefined and in
1221
* particular do not rely on it not changing.
1223
* If @ctx->is_first is TRUE, the search begins with @ctx->attr itself. If it
1224
* is FALSE, the search begins after @ctx->attr.
1226
* If @type is AT_UNUSED, return the first found attribute, i.e. one can
1227
* enumerate all attributes by setting @type to AT_UNUSED and then calling
1228
* ntfs_attr_find() repeatedly until it returns -1 with errno set to ENOENT to
1229
* indicate that there are no more entries. During the enumeration, each
1230
* successful call of ntfs_attr_find() will return the next attribute in the
1231
* mft record @ctx->mrec.
1233
* If @type is AT_END, seek to the end and return -1 with errno set to ENOENT.
1234
* AT_END is not a valid attribute, its length is zero for example, thus it is
1235
* safer to return error instead of success in this case. This also allows us
1236
* to interoperate cleanly with ntfs_external_attr_find().
1238
* If @name is AT_UNNAMED search for an unnamed attribute. If @name is present
1239
* but not AT_UNNAMED search for a named attribute matching @name. Otherwise,
1240
* match both named and unnamed attributes.
1242
* If @ic is IGNORE_CASE, the @name comparison is not case sensitive and
1243
* @ctx->ntfs_ino must be set to the ntfs inode to which the mft record
1244
* @ctx->mrec belongs. This is so we can get at the ntfs volume and hence at
1245
* the upcase table. If @ic is CASE_SENSITIVE, the comparison is case
1246
* sensitive. When @name is present, @name_len is the @name length in Unicode
1249
* If @name is not present (NULL), we assume that the unnamed attribute is
1250
* being searched for.
1252
* Finally, the resident attribute value @val is looked for, if present.
1253
* If @val is not present (NULL), @val_len is ignored.
1255
* ntfs_attr_find() only searches the specified mft record and it ignores the
1256
* presence of an attribute list attribute (unless it is the one being searched
1257
* for, obviously). If you need to take attribute lists into consideration, use
1258
* ntfs_attr_lookup() instead (see below). This also means that you cannot use
1259
* ntfs_attr_find() to search for extent records of non-resident attributes, as
1260
* extents with lowest_vcn != 0 are usually described by the attribute list
1261
* attribute only. - Note that it is possible that the first extent is only in
1262
* the attribute list while the last extent is in the base mft record, so don't
1263
* rely on being able to find the first extent in the base mft record.
1265
* Warning: Never use @val when looking for attribute types which can be
1266
* non-resident as this most likely will result in a crash!
1268
static int mkntfs_attr_find(const ATTR_TYPES type, const ntfschar *name,
1269
const u32 name_len, const IGNORE_CASE_BOOL ic,
1270
const u8 *val, const u32 val_len, ntfs_attr_search_ctx *ctx)
1273
ntfschar *upcase = vol->upcase;
1274
u32 upcase_len = vol->upcase_len;
1277
* Iterate over attributes in mft record starting at @ctx->attr, or the
1278
* attribute following that, if @ctx->is_first is TRUE.
1280
if (ctx->is_first) {
1282
ctx->is_first = FALSE;
1284
a = (ATTR_RECORD*)((char*)ctx->attr +
1285
le32_to_cpu(ctx->attr->length));
1286
for (;; a = (ATTR_RECORD*)((char*)a + le32_to_cpu(a->length))) {
1287
if (p2n(a) < p2n(ctx->mrec) || (char*)a > (char*)ctx->mrec +
1288
le32_to_cpu(ctx->mrec->bytes_allocated))
1291
if (((type != AT_UNUSED) && (le32_to_cpu(a->type) >
1292
le32_to_cpu(type))) ||
1293
(a->type == AT_END)) {
1299
/* If this is an enumeration return this attribute. */
1300
if (type == AT_UNUSED)
1302
if (a->type != type)
1305
* If @name is AT_UNNAMED we want an unnamed attribute.
1306
* If @name is present, compare the two names.
1307
* Otherwise, match any attribute.
1309
if (name == AT_UNNAMED) {
1310
/* The search failed if the found attribute is named. */
1311
if (a->name_length) {
1315
} else if (name && !ntfs_names_are_equal(name, name_len,
1316
(ntfschar*)((char*)a + le16_to_cpu(a->name_offset)),
1317
a->name_length, ic, upcase, upcase_len)) {
1320
rc = ntfs_names_collate(name, name_len,
1321
(ntfschar*)((char*)a +
1322
le16_to_cpu(a->name_offset)),
1323
a->name_length, 1, IGNORE_CASE,
1324
upcase, upcase_len);
1326
* If @name collates before a->name, there is no
1327
* matching attribute.
1333
/* If the strings are not equal, continue search. */
1336
rc = ntfs_names_collate(name, name_len,
1337
(ntfschar*)((char*)a +
1338
le16_to_cpu(a->name_offset)),
1339
a->name_length, 1, CASE_SENSITIVE,
1340
upcase, upcase_len);
1349
* The names match or @name not present and attribute is
1350
* unnamed. If no @val specified, we have found the attribute
1355
/* @val is present; compare values. */
1359
rc = memcmp(val, (char*)a +le16_to_cpu(a->value_offset),
1361
le32_to_cpu(a->value_length)));
1363
* If @val collates before the current attribute's
1364
* value, there is no matching attribute.
1368
avl = le32_to_cpu(a->value_length);
1371
if (val_len < avl) {
1375
} else if (rc < 0) {
1381
Dputs("mkntfs_attr_find(): File is corrupt. Run chkdsk.");
1387
* ntfs_attr_lookup - find an attribute in an ntfs inode
1388
* @type: attribute type to find
1389
* @name: attribute name to find (optional, i.e. NULL means don't care)
1390
* @name_len: attribute name length (only needed if @name present)
1391
* @ic: IGNORE_CASE or CASE_SENSITIVE (ignored if @name not present)
1392
* @lowest_vcn: lowest vcn to find (optional, non-resident attributes only)
1393
* @val: attribute value to find (optional, resident attributes only)
1394
* @val_len: attribute value length
1395
* @ctx: search context with mft record and attribute to search from
1397
* Find an attribute in an ntfs inode. On first search @ctx->ntfs_ino must
1398
* be the base mft record and @ctx must have been obtained from a call to
1399
* ntfs_attr_get_search_ctx().
1401
* This function transparently handles attribute lists and @ctx is used to
1402
* continue searches where they were left off at.
1404
* If @type is AT_UNUSED, return the first found attribute, i.e. one can
1405
* enumerate all attributes by setting @type to AT_UNUSED and then calling
1406
* ntfs_attr_lookup() repeatedly until it returns -1 with errno set to ENOENT
1407
* to indicate that there are no more entries. During the enumeration, each
1408
* successful call of ntfs_attr_lookup() will return the next attribute, with
1409
* the current attribute being described by the search context @ctx.
1411
* If @type is AT_END, seek to the end of the base mft record ignoring the
1412
* attribute list completely and return -1 with errno set to ENOENT. AT_END is
1413
* not a valid attribute, its length is zero for example, thus it is safer to
1414
* return error instead of success in this case. It should never ne needed to
1415
* do this, but we implement the functionality because it allows for simpler
1416
* code inside ntfs_external_attr_find().
1418
* If @name is AT_UNNAMED search for an unnamed attribute. If @name is present
1419
* but not AT_UNNAMED search for a named attribute matching @name. Otherwise,
1420
* match both named and unnamed attributes.
1422
* After finishing with the attribute/mft record you need to call
1423
* ntfs_attr_put_search_ctx() to cleanup the search context (unmapping any
1424
* mapped extent inodes, etc).
1426
* Return 0 if the search was successful and -1 if not, with errno set to the
1429
* On success, @ctx->attr is the found attribute, it is in mft record
1430
* @ctx->mrec, and @ctx->al_entry is the attribute list entry for this
1431
* attribute with @ctx->base_* being the base mft record to which @ctx->attr
1432
* belongs. If no attribute list attribute is present @ctx->al_entry and
1433
* @ctx->base_* are NULL.
1435
* On error ENOENT, i.e. attribute not found, @ctx->attr is set to the
1436
* attribute which collates just after the attribute being searched for in the
1437
* base ntfs inode, i.e. if one wants to add the attribute to the mft record
1438
* this is the correct place to insert it into, and if there is not enough
1439
* space, the attribute should be placed in an extent mft record.
1440
* @ctx->al_entry points to the position within @ctx->base_ntfs_ino->attr_list
1441
* at which the new attribute's attribute list entry should be inserted. The
1442
* other @ctx fields, base_ntfs_ino, base_mrec, and base_attr are set to NULL.
1443
* The only exception to this is when @type is AT_END, in which case
1444
* @ctx->al_entry is set to NULL also (see above).
1447
* The following error codes are defined:
1448
* ENOENT Attribute not found, not an error as such.
1449
* EINVAL Invalid arguments.
1450
* EIO I/O error or corrupt data structures found.
1451
* ENOMEM Not enough memory to allocate necessary buffers.
1453
static int mkntfs_attr_lookup(const ATTR_TYPES type, const ntfschar *name,
1454
const u32 name_len, const IGNORE_CASE_BOOL ic,
1455
const VCN lowest_vcn __attribute__ ((unused)), const u8 *val,
1456
const u32 val_len, ntfs_attr_search_ctx *ctx)
1458
ntfs_inode *base_ni;
1460
if (!ctx || !ctx->mrec || !ctx->attr) {
1464
if (ctx->base_ntfs_ino)
1465
base_ni = ctx->base_ntfs_ino;
1467
base_ni = ctx->ntfs_ino;
1468
if (!base_ni || !NInoAttrList(base_ni) || type == AT_ATTRIBUTE_LIST)
1469
return mkntfs_attr_find(type, name, name_len, ic, val, val_len,
1157
1476
* insert_positioned_attr_in_mft_record
1158
1477
* Create a non-resident attribute with a predefined on disk location
1159
1478
* specified by the runlist @rl. The clusters specified by @rl are assumed to
3526
* create_file_volume -
3528
static void create_file_volume(MFT_RECORD *m, MFT_REF root_ref, VOLUME_FLAGS fl)
3533
Vprintf("Creating $Volume (mft record 3)\n");
3534
m = (MFT_RECORD*)(buf + 3 * vol->mft_record_size);
3535
err = create_hardlink(index_block, root_ref, m,
3536
MK_LE_MREF(FILE_Volume, FILE_Volume), 0LL, 0LL,
3537
FILE_ATTR_HIDDEN | FILE_ATTR_SYSTEM, 0, 0,
3538
"$Volume", FILE_NAME_WIN32_AND_DOS);
3540
init_system_file_sd(FILE_Volume, &sd, &i);
3541
err = add_attr_sd(m, sd, i);
3544
err = add_attr_data(m, NULL, 0, 0, 0, NULL, 0);
3546
err = add_attr_vol_name(m, vol->vol_name, vol->vol_name ?
3547
strlen(vol->vol_name) : 0);
3549
if (fl & VOLUME_IS_DIRTY)
3550
Qprintf("Setting the volume dirty so check disk runs "
3551
"on next reboot into Windows.\n");
3552
err = add_attr_vol_info(m, fl, vol->major_ver, vol->minor_ver);
3555
err_exit("Couldn't create $Volume: %s\n", strerror(-err));
3559
* create_backup_boot_sector
3561
* Return 0 on success or -1 if it couldn't be created.
3563
static int create_backup_boot_sector(u8 *buff)
3569
Vprintf("Creating backup boot sector.\n");
3571
* Write the first max(512, opts.sector_size) bytes from buf to the
3572
* last sector, but limit that to 8192 bytes of written data since that
3573
* is how big $Boot is (and how big our buffer is)..
3576
if (size < opts.sector_size)
3577
size = opts.sector_size;
3578
if (vol->dev->d_ops->seek(vol->dev, (opts.nr_sectors + 1) *
3579
opts.sector_size - size, SEEK_SET) == (off_t)-1)
3583
bw = mkntfs_write(vol->dev, buff, size);
3590
_s = "unknown error";
3591
if (bw != -1LL || (bw == -1LL && _e != ENOSPC)) {
3592
err_exit("Couldn't write backup boot sector: %s\n", _s);
3594
Eprintf("Seek failed: %s\n", strerror(errno));
3596
Eprintf("Couldn't write backup boot sector. This is due to a "
3597
"limitation in the\nLinux kernel. This is not "
3598
"a major problem as Windows check disk will "
3599
"create the\nbackup boot sector when it "
3600
"is run on your next boot into Windows.\n");
3195
3605
* mkntfs_create_root_structures -
3197
3607
* Note: Might not return.