📄 fatstruc.h
字号:
PFILE_OBJECT VirtualEaFile;
struct _FCB *EaFcb;
//
// The following field is a pointer to the file object that has the
// volume locked. if the VcbState has the locked flag set.
//
PFILE_OBJECT FileObjectWithVcbLocked;
//
// The following is the head of a list of notify Irps.
//
LIST_ENTRY DirNotifyList;
//
// The following is used to synchronize the dir notify list.
//
PNOTIFY_SYNC NotifySync;
//
// The following fast mutex is used to synchronize directory stream
// file object creation.
//
FAST_MUTEX DirectoryFileCreationMutex;
//
// This field holds the thread address of the current (or most recent
// depending on VcbState) thread doing a verify operation on this volume.
//
PKTHREAD VerifyThread;
//
// The following two structures are used for CleanVolume callbacks.
//
KDPC CleanVolumeDpc;
KTIMER CleanVolumeTimer;
//
// This field records the last time FatMarkVolumeDirty was called, and
// avoids excessive calls to push the CleanVolume forward in time.
//
LARGE_INTEGER LastFatMarkVolumeDirtyCall;
//
// The following fields holds a pointer to a struct which is used to
// hold performance counters.
//
struct _FILE_SYSTEM_STATISTICS *Statistics;
//
// The property tunneling cache for this volume
//
TUNNEL Tunnel;
//
// The media change count is returned by IOCTL_CHECK_VERIFY and
// is used to verify that no user-mode app has swallowed a media change
// notification. This is only meaningful for removable media.
//
ULONG ChangeCount;
//
// Preallocated VPB for swapout, so we are not forced to consider
// must succeed pool.
//
PVPB SwapVpb;
//
// Per volume threading of the close queues.
//
LIST_ENTRY AsyncCloseList;
LIST_ENTRY DelayedCloseList;
//
// Fast mutex used by the ADVANCED FCB HEADER in this structure
//
FAST_MUTEX AdvancedFcbHeaderMutex;
//
// This is the close context associated with the Virtual Volume File.
//
PCLOSE_CONTEXT CloseContext;
//
// How many close contexts were preallocated on this Vcb
//
#if DBG
ULONG CloseContextCount;
#endif
} VCB;
typedef VCB *PVCB;
#define VCB_STATE_FLAG_LOCKED (0x00000001)
#define VCB_STATE_FLAG_REMOVABLE_MEDIA (0x00000002)
#define VCB_STATE_FLAG_VOLUME_DIRTY (0x00000004)
#define VCB_STATE_FLAG_MOUNTED_DIRTY (0x00000010)
#define VCB_STATE_FLAG_SHUTDOWN (0x00000040)
#define VCB_STATE_FLAG_CLOSE_IN_PROGRESS (0x00000080)
#define VCB_STATE_FLAG_DELETED_FCB (0x00000100)
#define VCB_STATE_FLAG_CREATE_IN_PROGRESS (0x00000200)
#define VCB_STATE_FLAG_BOOT_OR_PAGING_FILE (0x00000800)
#define VCB_STATE_FLAG_DEFERRED_FLUSH (0x00001000)
#define VCB_STATE_FLAG_ASYNC_CLOSE_ACTIVE (0x00002000)
#define VCB_STATE_FLAG_WRITE_PROTECTED (0x00004000)
#define VCB_STATE_FLAG_REMOVAL_PREVENTED (0x00008000)
#define VCB_STATE_FLAG_VOLUME_DISMOUNTED (0x00010000)
#define VCB_STATE_VPB_NOT_ON_DEVICE (0x00020000)
#define VCB_STATE_FLAG_VPB_MUST_BE_FREED (0x00040000)
#define VCB_STATE_FLAG_DISMOUNT_IN_PROGRESS (0x00080000)
//
// N.B - VOLUME_DISMOUNTED is an indication that FSCTL_DISMOUNT volume was
// executed on a volume. It does not replace VcbCondition as an indication
// that the volume is invalid/unrecoverable.
//
//
// Define the file system statistics struct. Vcb->Statistics points to an
// array of these (one per processor) and they must be 64 byte aligned to
// prevent cache line tearing.
//
typedef struct _FILE_SYSTEM_STATISTICS {
//
// This contains the actual data.
//
FILESYSTEM_STATISTICS Common;
FAT_STATISTICS Fat;
//
// Pad this structure to a multiple of 64 bytes.
//
UCHAR Pad[64-(sizeof(FILESYSTEM_STATISTICS)+sizeof(FAT_STATISTICS))%64];
} FILE_SYSTEM_STATISTICS;
typedef FILE_SYSTEM_STATISTICS *PFILE_SYSTEM_STATISTICS;
//
// The Volume Device Object is an I/O system device object with a workqueue
// and an VCB record appended to the end. There are multiple of these
// records, one for every mounted volume, and are created during
// a volume mount operation. The work queue is for handling an overload of
// work requests to the volume.
//
typedef struct _VOLUME_DEVICE_OBJECT {
DEVICE_OBJECT DeviceObject;
//
// The following field tells how many requests for this volume have
// either been enqueued to ExWorker threads or are currently being
// serviced by ExWorker threads. If the number goes above
// a certain threshold, put the request on the overflow queue to be
// executed later.
//
ULONG PostedRequestCount;
//
// The following field indicates the number of IRP's waiting
// to be serviced in the overflow queue.
//
ULONG OverflowQueueCount;
//
// The following field contains the queue header of the overflow queue.
// The Overflow queue is a list of IRP's linked via the IRP's ListEntry
// field.
//
LIST_ENTRY OverflowQueue;
//
// The following spinlock protects access to all the above fields.
//
KSPIN_LOCK OverflowQueueSpinLock;
//
// This is a common head for the FAT volume file
//
FSRTL_COMMON_FCB_HEADER VolumeFileHeader;
//
// This is the file system specific volume control block.
//
VCB Vcb;
} VOLUME_DEVICE_OBJECT;
typedef VOLUME_DEVICE_OBJECT *PVOLUME_DEVICE_OBJECT;
//
// This is the structure used to contains the short name for a file
//
typedef struct _FILE_NAME_NODE {
//
// This points back to the Fcb for this file.
//
struct _FCB *Fcb;
//
// This is the name of this node.
//
union {
OEM_STRING Oem;
UNICODE_STRING Unicode;
} Name;
//
// Marker so we can figure out what kind of name we opened up in
// Fcb searches
//
BOOLEAN FileNameDos;
//
// And the links. Our parent Dcb has a pointer to the root entry.
//
RTL_SPLAY_LINKS Links;
} FILE_NAME_NODE;
typedef FILE_NAME_NODE *PFILE_NAME_NODE;
//
// This structure contains fields which must be in non-paged pool.
//
typedef struct _NON_PAGED_FCB {
//
// The following field contains a record of special pointers used by
// MM and Cache to manipluate section objects. Note that the values
// are set outside of the file system. However the file system on an
// open/create will set the file object's SectionObject field to point
// to this field
//
SECTION_OBJECT_POINTERS SectionObjectPointers;
//
// This context is non-zero only if the file currently has asynchronous
// non-cached valid data length extending writes. It allows
// synchronization between pending writes and other operations.
//
ULONG OutstandingAsyncWrites;
//
// This event is set when OutstandingAsyncWrites transitions to zero.
//
PKEVENT OutstandingAsyncEvent;
//
// This is the mutex that is inserted into the FCB_ADVANCED_HEADER
// FastMutex field
//
FAST_MUTEX AdvancedFcbHeaderMutex;
} NON_PAGED_FCB;
typedef NON_PAGED_FCB *PNON_PAGED_FCB;
//
// The Fcb/Dcb record corresponds to every open file and directory, and to
// every directory on an opened path. They are ordered in two queues, one
// queue contains every Fcb/Dcb record off of FatData.FcbQueue, the other
// queue contains only device specific records off of Vcb.VcbSpecificFcbQueue
//
typedef enum _FCB_CONDITION {
FcbGood = 1,
FcbBad,
FcbNeedsToBeVerified
} FCB_CONDITION;
typedef struct _FCB {
//
// The following field is used for fast I/O
//
// The following comments refer to the use of the AllocationSize field
// of the FsRtl-defined header to the nonpaged Fcb.
//
// For a directory when we create a Dcb we will not immediately
// initialize the cache map, instead we will postpone it until our first
// call to FatReadDirectoryFile or FatPrepareWriteDirectoryFile.
// At that time we will search the Fat to find out the current allocation
// size (by calling FatLookupFileAllocationSize) and then initialize the
// cache map to this allocation size.
//
// For a file when we create an Fcb we will not immediately initialize
// the cache map, instead we will postpone it until we need it and
// then we determine the allocation size from either searching the
// fat to determine the real file allocation, or from the allocation
// that we've just allocated if we're creating a file.
//
// A value of -1 indicates that we do not know what the current allocation
// size really is, and need to examine the fat to find it. A value
// of than -1 is the real file/directory allocation size.
//
// Whenever we need to extend the allocation size we call
// FatAddFileAllocation which (if we're really extending the allocation)
// will modify the Fat, Mcb, and update this field. The caller
// of FatAddFileAllocation is then responsible for altering the Cache
// map size.
//
// We are now using the ADVANCED fcb header to support filter contexts
// at the stream level
//
FSRTL_ADVANCED_FCB_HEADER Header;
//
// This structure contains fields which must be in non-paged pool.
//
PNON_PAGED_FCB NonPaged;
//
// The head of the fat alloaction chain. FirstClusterOfFile == 0
// means that the file has no current allocation.
//
ULONG FirstClusterOfFile;
//
// The links for the queue of all fcbs for a specific dcb off of
// Dcb.ParentDcbQueue. For the root directory this queue is empty
// For a non-existent fcb this queue is off of the non existent
// fcb queue entry in the vcb.
//
LIST_ENTRY ParentDcbLinks;
//
// A pointer to the Dcb that is the parent directory containing
// this fcb. If this record itself is the root dcb then this field
// is null.
//
struct _FCB *ParentDcb;
//
// A pointer to the Vcb containing this Fcb
//
PVCB Vcb;
//
// The internal state of the Fcb. This is a collection Fcb state flags.
// Also the shared access for each time this file/directory is opened.
//
ULONG FcbState;
FCB_CONDITION FcbCondition;
SHARE_ACCESS ShareAccess;
#ifdef SYSCACHE_COMPILE
//
// For syscache we keep a bitmask that tells us if we have dispatched IO for
// the page aligned chunks of the stream.
//
PULONG WriteMask;
ULONG WriteMaskData;
#endif
//
// A count of the number of file objects that have been opened for
// this file/directory, but not yet been cleaned up yet. This count
// is only used for data file objects, not for the Acl or Ea stream
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -