usnjrnl.h 9.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205
  1. /*
  2. * usnjrnl.h - Defines for NTFS kernel transaction log ($UsnJrnl) handling.
  3. * Part of the Linux-NTFS project.
  4. *
  5. * Copyright (c) 2005 Anton Altaparmakov
  6. *
  7. * This program/include file is free software; you can redistribute it and/or
  8. * modify it under the terms of the GNU General Public License as published
  9. * by the Free Software Foundation; either version 2 of the License, or
  10. * (at your option) any later version.
  11. *
  12. * This program/include file is distributed in the hope that it will be
  13. * useful, but WITHOUT ANY WARRANTY; without even the implied warranty
  14. * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  15. * GNU General Public License for more details.
  16. *
  17. * You should have received a copy of the GNU General Public License
  18. * along with this program (in the main directory of the Linux-NTFS
  19. * distribution in the file COPYING); if not, write to the Free Software
  20. * Foundation,Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  21. */
  22. #ifndef _LINUX_NTFS_USNJRNL_H
  23. #define _LINUX_NTFS_USNJRNL_H
  24. #ifdef NTFS_RW
  25. #include "types.h"
  26. #include "endian.h"
  27. #include "layout.h"
  28. #include "volume.h"
  29. /*
  30. * Transaction log ($UsnJrnl) organization:
  31. *
  32. * The transaction log records whenever a file is modified in any way. So for
  33. * example it will record that file "blah" was written to at a particular time
  34. * but not what was written. If will record that a file was deleted or
  35. * created, that a file was truncated, etc. See below for all the reason
  36. * codes used.
  37. *
  38. * The transaction log is in the $Extend directory which is in the root
  39. * directory of each volume. If it is not present it means transaction
  40. * logging is disabled. If it is present it means transaction logging is
  41. * either enabled or in the process of being disabled in which case we can
  42. * ignore it as it will go away as soon as Windows gets its hands on it.
  43. *
  44. * To determine whether the transaction logging is enabled or in the process
  45. * of being disabled, need to check the volume flags in the
  46. * $VOLUME_INFORMATION attribute in the $Volume system file (which is present
  47. * in the root directory and has a fixed mft record number, see layout.h).
  48. * If the flag VOLUME_DELETE_USN_UNDERWAY is set it means the transaction log
  49. * is in the process of being disabled and if this flag is clear it means the
  50. * transaction log is enabled.
  51. *
  52. * The transaction log consists of two parts; the $DATA/$Max attribute as well
  53. * as the $DATA/$J attribute. $Max is a header describing the transaction
  54. * log whilst $J is the transaction log data itself as a sequence of variable
  55. * sized USN_RECORDs (see below for all the structures).
  56. *
  57. * We do not care about transaction logging at this point in time but we still
  58. * need to let windows know that the transaction log is out of date. To do
  59. * this we need to stamp the transaction log. This involves setting the
  60. * lowest_valid_usn field in the $DATA/$Max attribute to the usn to be used
  61. * for the next added USN_RECORD to the $DATA/$J attribute as well as
  62. * generating a new journal_id in $DATA/$Max.
  63. *
  64. * The journal_id is as of the current version (2.0) of the transaction log
  65. * simply the 64-bit timestamp of when the journal was either created or last
  66. * stamped.
  67. *
  68. * To determine the next usn there are two ways. The first is to parse
  69. * $DATA/$J and to find the last USN_RECORD in it and to add its record_length
  70. * to its usn (which is the byte offset in the $DATA/$J attribute). The
  71. * second is simply to take the data size of the attribute. Since the usns
  72. * are simply byte offsets into $DATA/$J, this is exactly the next usn. For
  73. * obvious reasons we use the second method as it is much simpler and faster.
  74. *
  75. * As an aside, note that to actually disable the transaction log, one would
  76. * need to set the VOLUME_DELETE_USN_UNDERWAY flag (see above), then go
  77. * through all the mft records on the volume and set the usn field in their
  78. * $STANDARD_INFORMATION attribute to zero. Once that is done, one would need
  79. * to delete the transaction log file, i.e. \$Extent\$UsnJrnl, and finally,
  80. * one would need to clear the VOLUME_DELETE_USN_UNDERWAY flag.
  81. *
  82. * Note that if a volume is unmounted whilst the transaction log is being
  83. * disabled, the process will continue the next time the volume is mounted.
  84. * This is why we can safely mount read-write when we see a transaction log
  85. * in the process of being deleted.
  86. */
  87. /* Some $UsnJrnl related constants. */
  88. #define UsnJrnlMajorVer 2
  89. #define UsnJrnlMinorVer 0
  90. /*
  91. * $DATA/$Max attribute. This is (always?) resident and has a fixed size of
  92. * 32 bytes. It contains the header describing the transaction log.
  93. */
  94. typedef struct {
  95. /*Ofs*/
  96. /* 0*/sle64 maximum_size; /* The maximum on-disk size of the $DATA/$J
  97. attribute. */
  98. /* 8*/sle64 allocation_delta; /* Number of bytes by which to increase the
  99. size of the $DATA/$J attribute. */
  100. /*0x10*/sle64 journal_id; /* Current id of the transaction log. */
  101. /*0x18*/leUSN lowest_valid_usn; /* Lowest valid usn in $DATA/$J for the
  102. current journal_id. */
  103. /* sizeof() = 32 (0x20) bytes */
  104. } __attribute__ ((__packed__)) USN_HEADER;
  105. /*
  106. * Reason flags (32-bit). Cumulative flags describing the change(s) to the
  107. * file since it was last opened. I think the names speak for themselves but
  108. * if you disagree check out the descriptions in the Linux NTFS project NTFS
  109. * documentation: http://www.linux-ntfs.org/
  110. */
  111. enum {
  112. USN_REASON_DATA_OVERWRITE = cpu_to_le32(0x00000001),
  113. USN_REASON_DATA_EXTEND = cpu_to_le32(0x00000002),
  114. USN_REASON_DATA_TRUNCATION = cpu_to_le32(0x00000004),
  115. USN_REASON_NAMED_DATA_OVERWRITE = cpu_to_le32(0x00000010),
  116. USN_REASON_NAMED_DATA_EXTEND = cpu_to_le32(0x00000020),
  117. USN_REASON_NAMED_DATA_TRUNCATION= cpu_to_le32(0x00000040),
  118. USN_REASON_FILE_CREATE = cpu_to_le32(0x00000100),
  119. USN_REASON_FILE_DELETE = cpu_to_le32(0x00000200),
  120. USN_REASON_EA_CHANGE = cpu_to_le32(0x00000400),
  121. USN_REASON_SECURITY_CHANGE = cpu_to_le32(0x00000800),
  122. USN_REASON_RENAME_OLD_NAME = cpu_to_le32(0x00001000),
  123. USN_REASON_RENAME_NEW_NAME = cpu_to_le32(0x00002000),
  124. USN_REASON_INDEXABLE_CHANGE = cpu_to_le32(0x00004000),
  125. USN_REASON_BASIC_INFO_CHANGE = cpu_to_le32(0x00008000),
  126. USN_REASON_HARD_LINK_CHANGE = cpu_to_le32(0x00010000),
  127. USN_REASON_COMPRESSION_CHANGE = cpu_to_le32(0x00020000),
  128. USN_REASON_ENCRYPTION_CHANGE = cpu_to_le32(0x00040000),
  129. USN_REASON_OBJECT_ID_CHANGE = cpu_to_le32(0x00080000),
  130. USN_REASON_REPARSE_POINT_CHANGE = cpu_to_le32(0x00100000),
  131. USN_REASON_STREAM_CHANGE = cpu_to_le32(0x00200000),
  132. USN_REASON_CLOSE = cpu_to_le32(0x80000000),
  133. };
  134. typedef le32 USN_REASON_FLAGS;
  135. /*
  136. * Source info flags (32-bit). Information about the source of the change(s)
  137. * to the file. For detailed descriptions of what these mean, see the Linux
  138. * NTFS project NTFS documentation:
  139. * http://www.linux-ntfs.org/
  140. */
  141. enum {
  142. USN_SOURCE_DATA_MANAGEMENT = cpu_to_le32(0x00000001),
  143. USN_SOURCE_AUXILIARY_DATA = cpu_to_le32(0x00000002),
  144. USN_SOURCE_REPLICATION_MANAGEMENT = cpu_to_le32(0x00000004),
  145. };
  146. typedef le32 USN_SOURCE_INFO_FLAGS;
  147. /*
  148. * $DATA/$J attribute. This is always non-resident, is marked as sparse, and
  149. * is of variabled size. It consists of a sequence of variable size
  150. * USN_RECORDS. The minimum allocated_size is allocation_delta as
  151. * specified in $DATA/$Max. When the maximum_size specified in $DATA/$Max is
  152. * exceeded by more than allocation_delta bytes, allocation_delta bytes are
  153. * allocated and appended to the $DATA/$J attribute and an equal number of
  154. * bytes at the beginning of the attribute are freed and made sparse. Note the
  155. * making sparse only happens at volume checkpoints and hence the actual
  156. * $DATA/$J size can exceed maximum_size + allocation_delta temporarily.
  157. */
  158. typedef struct {
  159. /*Ofs*/
  160. /* 0*/le32 length; /* Byte size of this record (8-byte
  161. aligned). */
  162. /* 4*/le16 major_ver; /* Major version of the transaction log used
  163. for this record. */
  164. /* 6*/le16 minor_ver; /* Minor version of the transaction log used
  165. for this record. */
  166. /* 8*/leMFT_REF mft_reference;/* The mft reference of the file (or
  167. directory) described by this record. */
  168. /*0x10*/leMFT_REF parent_directory;/* The mft reference of the parent
  169. directory of the file described by this
  170. record. */
  171. /*0x18*/leUSN usn; /* The usn of this record. Equals the offset
  172. within the $DATA/$J attribute. */
  173. /*0x20*/sle64 time; /* Time when this record was created. */
  174. /*0x28*/USN_REASON_FLAGS reason;/* Reason flags (see above). */
  175. /*0x2c*/USN_SOURCE_INFO_FLAGS source_info;/* Source info flags (see above). */
  176. /*0x30*/le32 security_id; /* File security_id copied from
  177. $STANDARD_INFORMATION. */
  178. /*0x34*/FILE_ATTR_FLAGS file_attributes; /* File attributes copied from
  179. $STANDARD_INFORMATION or $FILE_NAME (not
  180. sure which). */
  181. /*0x38*/le16 file_name_size; /* Size of the file name in bytes. */
  182. /*0x3a*/le16 file_name_offset; /* Offset to the file name in bytes from the
  183. start of this record. */
  184. /*0x3c*/ntfschar file_name[0]; /* Use when creating only. When reading use
  185. file_name_offset to determine the location
  186. of the name. */
  187. /* sizeof() = 60 (0x3c) bytes */
  188. } __attribute__ ((__packed__)) USN_RECORD;
  189. extern bool ntfs_stamp_usnjrnl(ntfs_volume *vol);
  190. #endif /* NTFS_RW */
  191. #endif /* _LINUX_NTFS_USNJRNL_H */