/*++
Copyright (c) 1992 Microsoft Corporation
Module Name:
ntfs_rec.c
Abstract:
This module contains the mini-file system recognizer for NTFS.
Author:
Darryl E. Havens (darrylh) 8-dec-1992
Environment:
Kernel mode, local to I/O system
Revision History:
--*/
#include "fs_rec.h"
#include "ntfs_rec.h"
//
// The local debug trace level
//
#define Dbg (FSREC_DEBUG_LEVEL_NTFS)
#ifdef ALLOC_PRAGMA
#pragma alloc_text(PAGE,NtfsRecFsControl)
#pragma alloc_text(PAGE,IsNtfsVolume)
#endif // ALLOC_PRAGMA
NTSTATUS
NtfsRecFsControl(
IN PDEVICE_OBJECT DeviceObject,
IN PIRP Irp
)
/*++
Routine Description:
This function performs the mount and driver reload functions for this mini-
file system recognizer driver.
Arguments:
DeviceObject - Pointer to this driver's device object.
Irp - Pointer to the I/O Request Packet (IRP) representing the function to
be performed.
Return Value:
The function value is the final status of the operation.
--*/
{
NTSTATUS status;
PIO_STACK_LOCATION irpSp;
PDEVICE_EXTENSION deviceExtension;
PDEVICE_OBJECT targetDevice;
PPACKED_BOOT_SECTOR buffer;
LARGE_INTEGER byteOffset;
LARGE_INTEGER secondByteOffset;
LARGE_INTEGER lastByteOffset;
UNICODE_STRING driverName;
ULONG bytesPerSector;
LARGE_INTEGER numberOfSectors;
PAGED_CODE();
//
// Begin by determining what function that is to be performed.
//
deviceExtension = (PDEVICE_EXTENSION) DeviceObject->DeviceExtension;
irpSp = IoGetCurrentIrpStackLocation( Irp );
switch ( irpSp->MinorFunction ) {
case IRP_MN_MOUNT_VOLUME:
//
// Attempt to mount a volume: Determine whether or not the volume in
// question is an NTFS volume and, if so, let the I/O system know that it
// is by returning a special status code so that this driver can get
// called back to load the NTFS file system.
//
status = STATUS_UNRECOGNIZED_VOLUME;
//
// Attempt to determine whether or not the target volume being mounted
// is an NTFS volume.
//
targetDevice = irpSp->Parameters.MountVolume.DeviceObject;
if (FsRecGetDeviceSectorSize( targetDevice,
&bytesPerSector ) &&
FsRecGetDeviceSectors( targetDevice,
bytesPerSector,
&numberOfSectors )) {
byteOffset.QuadPart = 0;
buffer = NULL;
secondByteOffset.QuadPart = numberOfSectors.QuadPart >> 1;
secondByteOffset.QuadPart *= (LONG) bytesPerSector;
lastByteOffset.QuadPart = (numberOfSectors.QuadPart - 1) * (LONG) bytesPerSector;
if (FsRecReadBlock( targetDevice,
&byteOffset,
sizeof( PACKED_BOOT_SECTOR ),
bytesPerSector,
(PVOID *)&buffer,
NULL ))
{
if (IsNtfsVolume( buffer, bytesPerSector, &numberOfSectors )) {
status = STATUS_FS_DRIVER_REQUIRED;
}
} else {
if (FsRecReadBlock( targetDevice,
&secondByteOffset,
sizeof( PACKED_BOOT_SECTOR ),
bytesPerSector,
(PVOID *)&buffer,
NULL ) &&
IsNtfsVolume( buffer, bytesPerSector, &numberOfSectors )) {
status = STATUS_FS_DRIVER_REQUIRED;
} else {
if (FsRecReadBlock( targetDevice,
&lastByteOffset,
sizeof( PACKED_BOOT_SECTOR ),
bytesPerSector,
(PVOID *)&buffer,
NULL ) &&
IsNtfsVolume( buffer, bytesPerSector, &numberOfSectors )) {
status = STATUS_FS_DRIVER_REQUIRED;
}
}
}
if (buffer != NULL) {
ExFreePool( buffer );
}
}
break;
case IRP_MN_LOAD_FILE_SYSTEM:
status = FsRecLoadFileSystem( DeviceObject,
L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Ntfs" );
break;
default:
status = STATUS_INVALID_DEVICE_REQUEST;
}
//
// Finally, complete the request and return the same status code to the
// caller.
//
Irp->IoStatus.Status = status;
IoCompleteRequest( Irp, IO_NO_INCREMENT );
return status;
}
BOOLEAN
IsNtfsVolume(
IN PPACKED_BOOT_SECTOR BootSector,
IN ULONG BytesPerSector,
IN PLARGE_INTEGER NumberOfSectors
)
/*++
Routine Description:
This routine looks at the buffer passed in which contains the NTFS boot
sector and determines whether or not it represents an NTFS volume.
Arguments:
BootSector - Pointer to buffer containing a potential NTFS boot sector.
BytesPerSector - Supplies the number of bytes per sector for the drive.
NumberOfSectors - Supplies the number of sectors on the partition.
Return Value:
The function returns TRUE if the buffer contains a recognizable NTFS boot
sector, otherwise it returns FALSE.
--*/
{
PAGED_CODE();
//
// Now perform all the checks, starting with the Name and Checksum.
// The remaining checks should be obvious, including some fields which
// must be 0 and other fields which must be a small power of 2.
//
if (BootSector->Oem[0] == 'N' &&
BootSector->Oem[1] == 'T' &&
BootSector->Oem[2] == 'F' &&
BootSector->Oem[3] == 'S' &&
BootSector->Oem[4] == ' ' &&
BootSector->Oem[5] == ' ' &&
BootSector->Oem[6] == ' ' &&
BootSector->Oem[7] == ' '
&&
//
// Check number of bytes per sector. The low order byte of this
// number must be zero (smallest sector size = 0x100) and the
// high order byte shifted must equal the bytes per sector gotten
// from the device and stored in the Vcb. And just to be sure,
// sector size must be less than page size.
//
BootSector->PackedBpb.BytesPerSector[0] == 0
&&
((ULONG) (BootSector->PackedBpb.BytesPerSector[1] << 8) == BytesPerSector)
&&
BootSector->PackedBpb.BytesPerSector[1] << 8 <= PAGE_SIZE
&&
//
// Sectors per cluster must be a power of 2.
//
(BootSector->PackedBpb.SectorsPerCluster[0] == 0x1 ||
BootSector->PackedBpb.SectorsPerCluster[0] == 0x2 ||
BootSector->PackedBpb.SectorsPerCluster[0] == 0x4 ||
BootSector->PackedBpb.SectorsPerCluster[0] == 0x8 ||
BootSector->PackedBpb.SectorsPerCluster[0] == 0x10 ||
BootSector->PackedBpb.SectorsPerCluster[0] == 0x20 ||
BootSector->PackedBpb.SectorsPerCluster[0] == 0x40 ||
BootSector->PackedBpb.SectorsPerCluster[0] == 0x80)
&&
//
// These fields must all be zero. For both Fat and HPFS, some of
// these fields must be nonzero.
//
BootSector->PackedBpb.ReservedSectors[0] == 0 &&
BootSector->PackedBpb.ReservedSectors[1] == 0 &&
BootSector->PackedBpb.Fats[0] == 0 &&
BootSector->PackedBpb.RootEntries[0] == 0 &&
BootSector->PackedBpb.RootEntries[1] == 0 &&
BootSector->PackedBpb.Sectors[0] == 0 &&
BootSector->PackedBpb.Sectors[1] == 0 &&
BootSector->PackedBpb.SectorsPerFat[0] == 0 &&
BootSector->PackedBpb.SectorsPerFat[1] == 0 &&
BootSector->PackedBpb.LargeSectors[0] == 0 &&
BootSector->PackedBpb.LargeSectors[1] == 0 &&
BootSector->PackedBpb.LargeSectors[2] == 0 &&
BootSector->PackedBpb.LargeSectors[3] == 0
&&
//
// Number of Sectors cannot be greater than the number of sectors
// on the partition.
//
!( BootSector->NumberSectors.QuadPart > NumberOfSectors->QuadPart )
&&
//
// Check that both Lcn values are for sectors within the partition.
//
!( BootSector->MftStartLcn.QuadPart *
BootSector->PackedBpb.SectorsPerCluster[0] >
NumberOfSectors->QuadPart )
&&
!( BootSector->Mft2StartLcn.QuadPart *
BootSector->PackedBpb.SectorsPerCluster[0] >
NumberOfSectors->QuadPart )
&&
//
// Clusters per file record segment and default clusters for Index
// Allocation Buffers must be a power of 2. A negative number indicates
// a shift value to get the actual size of the structure.
//
((BootSector->ClustersPerFileRecordSegment >= -31 &&
BootSector->ClustersPerFileRecordSegment <= -9) ||
BootSector->ClustersPerFileRecordSegment == 0x1 ||
BootSector->ClustersPerFileRecordSegment == 0x2 ||
BootSector->ClustersPerFileRecordSegment == 0x4 ||
BootSector->ClustersPerFileRecordSegment == 0x8 ||
BootSector->ClustersPerFileRecordSegment == 0x10 ||
BootSector->ClustersPerFileRecordSegment == 0x20 ||
BootSector->ClustersPerFileRecordSegment == 0x40)
&&
((BootSector->DefaultClustersPerIndexAllocationBuffer >= -31 &&
BootSector->DefaultClustersPerIndexAllocationBuffer <= -9) ||
BootSector->DefaultClustersPerIndexAllocationBuffer == 0x1 ||
BootSector->DefaultClustersPerIndexAllocationBuffer == 0x2 ||
BootSector->DefaultClustersPerIndexAllocationBuffer == 0x4 ||
BootSector->DefaultClustersPerIndexAllocationBuffer == 0x8 ||
BootSector->DefaultClustersPerIndexAllocationBuffer == 0x10 ||
BootSector->DefaultClustersPerIndexAllocationBuffer == 0x20 ||
BootSector->DefaultClustersPerIndexAllocationBuffer == 0x40)) {
return TRUE;
} else {
//
// This does not appear to be an NTFS volume.
//
return FALSE;
}
}