path: root/include/ntfs-3g/layout.h (plain)
blob: 8670557e16830840b27e8fe4e2d5b2040e19b81b

1	/*
2	* layout.h - Ntfs on-disk layout structures. Originated from the Linux-NTFS project.
3	*
4	* Copyright (c) 2000-2005 Anton Altaparmakov
5	* Copyright (c) 2005 Yura Pakhuchiy
6	* Copyright (c) 2005-2006 Szabolcs Szakacsits
7	*
8	* This program/include file is free software; you can redistribute it and/or
9	* modify it under the terms of the GNU General Public License as published
10	* by the Free Software Foundation; either version 2 of the License, or
11	* (at your option) any later version.
12	*
13	* This program/include file is distributed in the hope that it will be
14	* useful, but WITHOUT ANY WARRANTY; without even the implied warranty
15	* of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16	* GNU General Public License for more details.
17	*
18	* You should have received a copy of the GNU General Public License
19	* along with this program (in the main directory of the NTFS-3G
20	* distribution in the file COPYING); if not, write to the Free Software
21	* Foundation,Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22	*/
23
24	#ifndef _NTFS_LAYOUT_H
25	#define _NTFS_LAYOUT_H
26
27	#include "types.h"
28	#include "endians.h"
29	#include "support.h"
30
31	/* The NTFS oem_id */
32	#define magicNTFS const_cpu_to_le64(0x202020205346544e) /* "NTFS " */
33	#define NTFS_SB_MAGIC 0x5346544e /* 'NTFS' */
34
35	/*
36	* Location of bootsector on partition:
37	* The standard NTFS_BOOT_SECTOR is on sector 0 of the partition.
38	* On NT4 and above there is one backup copy of the boot sector to
39	* be found on the last sector of the partition (not normally accessible
40	* from within Windows as the bootsector contained number of sectors
41	* value is one less than the actual value!).
42	* On versions of NT 3.51 and earlier, the backup copy was located at
43	* number of sectors/2 (integer divide), i.e. in the middle of the volume.
44	*/
45
46	/**
47	* struct BIOS_PARAMETER_BLOCK - BIOS parameter block (bpb) structure.
48	*/
49	typedef struct {
50	u16 bytes_per_sector; /* Size of a sector in bytes. */
51	u8 sectors_per_cluster; /* Size of a cluster in sectors. */
52	u16 reserved_sectors; /* zero */
53	u8 fats; /* zero */
54	u16 root_entries; /* zero */
55	u16 sectors; /* zero */
56	u8 media_type; /* 0xf8 = hard disk */
57	u16 sectors_per_fat; /* zero */
58	/*0x0d*/u16 sectors_per_track; /* Required to boot Windows. */
59	/*0x0f*/u16 heads; /* Required to boot Windows. */
60	/*0x11*/u32 hidden_sectors; /* Offset to the start of the partition
61	relative to the disk in sectors.
62	Required to boot Windows. */
63	/*0x15*/u32 large_sectors; /* zero */
64	/* sizeof() = 25 (0x19) bytes */
65	} __attribute__((__packed__)) BIOS_PARAMETER_BLOCK;
66
67	/**
68	* struct NTFS_BOOT_SECTOR - NTFS boot sector structure.
69	*/
70	typedef struct {
71	u8 jump[3]; /* Irrelevant (jump to boot up code).*/
72	u64 oem_id; /* Magic "NTFS ". */
73	/*0x0b*/BIOS_PARAMETER_BLOCK bpb; /* See BIOS_PARAMETER_BLOCK. */
74	u8 physical_drive; /* 0x00 floppy, 0x80 hard disk */
75	u8 current_head; /* zero */
76	u8 extended_boot_signature; /* 0x80 */
77	u8 reserved2; /* zero */
78	/*0x28*/s64 number_of_sectors; /* Number of sectors in volume. Gives
79	maximum volume size of 2^63 sectors.
80	Assuming standard sector size of 512
81	bytes, the maximum byte size is
82	approx. 4.7x10^21 bytes. (-; */
83	s64 mft_lcn; /* Cluster location of mft data. */
84	s64 mftmirr_lcn; /* Cluster location of copy of mft. */
85	s8 clusters_per_mft_record; /* Mft record size in clusters. */
86	u8 reserved0[3]; /* zero */
87	s8 clusters_per_index_record; /* Index block size in clusters. */
88	u8 reserved1[3]; /* zero */
89	u64 volume_serial_number; /* Irrelevant (serial number). */
90	u32 checksum; /* Boot sector checksum. */
91	/*0x54*/u8 bootstrap[426]; /* Irrelevant (boot up code). */
92	u16 end_of_sector_marker; /* End of bootsector magic. Always is
93	0xaa55 in little endian. */
94	/* sizeof() = 512 (0x200) bytes */
95	} __attribute__((__packed__)) NTFS_BOOT_SECTOR;
96
97	/**
98	* enum NTFS_RECORD_TYPES -
99	*
100	* Magic identifiers present at the beginning of all ntfs record containing
101	* records (like mft records for example).
102	*/
103	typedef enum {
104	/* Found in $MFT/$DATA. */
105	magic_FILE = const_cpu_to_le32(0x454c4946), /* Mft entry. */
106	magic_INDX = const_cpu_to_le32(0x58444e49), /* Index buffer. */
107	magic_HOLE = const_cpu_to_le32(0x454c4f48), /* ? (NTFS 3.0+?) */
108
109	/* Found in $LogFile/$DATA. */
110	magic_RSTR = const_cpu_to_le32(0x52545352), /* Restart page. */
111	magic_RCRD = const_cpu_to_le32(0x44524352), /* Log record page. */
112
113	/* Found in $LogFile/$DATA. (May be found in $MFT/$DATA, also?) */
114	magic_CHKD = const_cpu_to_le32(0x444b4843), /* Modified by chkdsk. */
115
116	/* Found in all ntfs record containing records. */
117	magic_BAAD = const_cpu_to_le32(0x44414142), /* Failed multi sector
118	transfer was detected. */
119
120	/*
121	* Found in $LogFile/$DATA when a page is full or 0xff bytes and is
122	* thus not initialized. User has to initialize the page before using
123	* it.
124	*/
125	magic_empty = const_cpu_to_le32(0xffffffff),/* Record is empty and has
126	to be initialized before
127	it can be used. */
128	} NTFS_RECORD_TYPES;
129
130	/*
131	* Generic magic comparison macros. Finally found a use for the ## preprocessor
132	* operator! (-8
133	*/
134	#define ntfs_is_magic(x, m) ( (u32)(x) == (u32)magic_##m )
135	#define ntfs_is_magicp(p, m) ( *(u32*)(p) == (u32)magic_##m )
136
137	/*
138	* Specialised magic comparison macros for the NTFS_RECORD_TYPES defined above.
139	*/
140	#define ntfs_is_file_record(x) ( ntfs_is_magic (x, FILE) )
141	#define ntfs_is_file_recordp(p) ( ntfs_is_magicp(p, FILE) )
142	#define ntfs_is_mft_record(x) ( ntfs_is_file_record(x) )
143	#define ntfs_is_mft_recordp(p) ( ntfs_is_file_recordp(p) )
144	#define ntfs_is_indx_record(x) ( ntfs_is_magic (x, INDX) )
145	#define ntfs_is_indx_recordp(p) ( ntfs_is_magicp(p, INDX) )
146	#define ntfs_is_hole_record(x) ( ntfs_is_magic (x, HOLE) )
147	#define ntfs_is_hole_recordp(p) ( ntfs_is_magicp(p, HOLE) )
148
149	#define ntfs_is_rstr_record(x) ( ntfs_is_magic (x, RSTR) )
150	#define ntfs_is_rstr_recordp(p) ( ntfs_is_magicp(p, RSTR) )
151	#define ntfs_is_rcrd_record(x) ( ntfs_is_magic (x, RCRD) )
152	#define ntfs_is_rcrd_recordp(p) ( ntfs_is_magicp(p, RCRD) )
153
154	#define ntfs_is_chkd_record(x) ( ntfs_is_magic (x, CHKD) )
155	#define ntfs_is_chkd_recordp(p) ( ntfs_is_magicp(p, CHKD) )
156
157	#define ntfs_is_baad_record(x) ( ntfs_is_magic (x, BAAD) )
158	#define ntfs_is_baad_recordp(p) ( ntfs_is_magicp(p, BAAD) )
159
160	#define ntfs_is_empty_record(x) ( ntfs_is_magic (x, empty) )
161	#define ntfs_is_empty_recordp(p) ( ntfs_is_magicp(p, empty) )
162
163
164	#define NTFS_BLOCK_SIZE 512
165	#define NTFS_BLOCK_SIZE_BITS 9
166
167	/**
168	* struct NTFS_RECORD -
169	*
170	* The Update Sequence Array (usa) is an array of the u16 values which belong
171	* to the end of each sector protected by the update sequence record in which
172	* this array is contained. Note that the first entry is the Update Sequence
173	* Number (usn), a cyclic counter of how many times the protected record has
174	* been written to disk. The values 0 and -1 (ie. 0xffff) are not used. All
175	* last u16's of each sector have to be equal to the usn (during reading) or
176	* are set to it (during writing). If they are not, an incomplete multi sector
177	* transfer has occurred when the data was written.
178	* The maximum size for the update sequence array is fixed to:
179	* maximum size = usa_ofs + (usa_count * 2) = 510 bytes
180	* The 510 bytes comes from the fact that the last u16 in the array has to
181	* (obviously) finish before the last u16 of the first 512-byte sector.
182	* This formula can be used as a consistency check in that usa_ofs +
183	* (usa_count * 2) has to be less than or equal to 510.
184	*/
185	typedef struct {
186	NTFS_RECORD_TYPES magic;/* A four-byte magic identifying the
187	record type and/or status. */
188	u16 usa_ofs; /* Offset to the Update Sequence Array (usa)
189	from the start of the ntfs record. */
190	u16 usa_count; /* Number of u16 sized entries in the usa
191	including the Update Sequence Number (usn),
192	thus the number of fixups is the usa_count
193	minus 1. */
194	} __attribute__((__packed__)) NTFS_RECORD;
195
196	/**
197	* enum NTFS_SYSTEM_FILES - System files mft record numbers.
198	*
199	* All these files are always marked as used in the bitmap attribute of the
200	* mft; presumably in order to avoid accidental allocation for random other
201	* mft records. Also, the sequence number for each of the system files is
202	* always equal to their mft record number and it is never modified.
203	*/
204	typedef enum {
205	FILE_MFT = 0, /* Master file table (mft). Data attribute
206	contains the entries and bitmap attribute
207	records which ones are in use (bit==1). */
208	FILE_MFTMirr = 1, /* Mft mirror: copy of first four mft records
209	in data attribute. If cluster size > 4kiB,
210	copy of first N mft records, with
211	N = cluster_size / mft_record_size. */
212	FILE_LogFile = 2, /* Journalling log in data attribute. */
213	FILE_Volume = 3, /* Volume name attribute and volume information
214	attribute (flags and ntfs version). Windows
215	refers to this file as volume DASD (Direct
216	Access Storage Device). */
217	FILE_AttrDef = 4, /* Array of attribute definitions in data
218	attribute. */
219	FILE_root = 5, /* Root directory. */
220	FILE_Bitmap = 6, /* Allocation bitmap of all clusters (lcns) in
221	data attribute. */
222	FILE_Boot = 7, /* Boot sector (always at cluster 0) in data
223	attribute. */
224	FILE_BadClus = 8, /* Contains all bad clusters in the non-resident
225	data attribute. */
226	FILE_Secure = 9, /* Shared security descriptors in data attribute
227	and two indexes into the descriptors.
228	Appeared in Windows 2000. Before that, this
229	file was named $Quota but was unused. */
230	FILE_UpCase = 10, /* Uppercase equivalents of all 65536 Unicode
231	characters in data attribute. */
232	FILE_Extend = 11, /* Directory containing other system files (eg.
233	$ObjId, $Quota, $Reparse and $UsnJrnl). This
234	is new to NTFS3.0. */
235	FILE_reserved12 = 12, /* Reserved for future use (records 12-15). */
236	FILE_reserved13 = 13,
237	FILE_reserved14 = 14,
238	FILE_reserved15 = 15,
239	FILE_first_user = 16, /* First user file, used as test limit for
240	whether to allow opening a file or not. */
241	} NTFS_SYSTEM_FILES;
242
243	/**
244	* enum MFT_RECORD_FLAGS -
245	*
246	* These are the so far known MFT_RECORD_* flags (16-bit) which contain
247	* information about the mft record in which they are present.
248	*
249	* MFT_RECORD_IS_4 exists on all $Extend sub-files.
250	* It seems that it marks it is a metadata file with MFT record >24, however,
251	* it is unknown if it is limited to metadata files only.
252	*
253	* MFT_RECORD_IS_VIEW_INDEX exists on every metafile with a non directory
254	* index, that means an INDEX_ROOT and an INDEX_ALLOCATION with a name other
255	* than "$I30". It is unknown if it is limited to metadata files only.
256	*/
257	typedef enum {
258	MFT_RECORD_IN_USE = const_cpu_to_le16(0x0001),
259	MFT_RECORD_IS_DIRECTORY = const_cpu_to_le16(0x0002),
260	MFT_RECORD_IS_4 = const_cpu_to_le16(0x0004),
261	MFT_RECORD_IS_VIEW_INDEX = const_cpu_to_le16(0x0008),
262	MFT_REC_SPACE_FILLER = 0xffff, /* Just to make flags
263	16-bit. */
264	} __attribute__((__packed__)) MFT_RECORD_FLAGS;
265
266	/*
267	* mft references (aka file references or file record segment references) are
268	* used whenever a structure needs to refer to a record in the mft.
269	*
270	* A reference consists of a 48-bit index into the mft and a 16-bit sequence
271	* number used to detect stale references.
272	*
273	* For error reporting purposes we treat the 48-bit index as a signed quantity.
274	*
275	* The sequence number is a circular counter (skipping 0) describing how many
276	* times the referenced mft record has been (re)used. This has to match the
277	* sequence number of the mft record being referenced, otherwise the reference
278	* is considered stale and removed (FIXME: only ntfsck or the driver itself?).
279	*
280	* If the sequence number is zero it is assumed that no sequence number
281	* consistency checking should be performed.
282	*
283	* FIXME: Since inodes are 32-bit as of now, the driver needs to always check
284	* for high_part being 0 and if not either BUG(), cause a panic() or handle
285	* the situation in some other way. This shouldn't be a problem as a volume has
286	* to become HUGE in order to need more than 32-bits worth of mft records.
287	* Assuming the standard mft record size of 1kb only the records (never mind
288	* the non-resident attributes, etc.) would require 4Tb of space on their own
289	* for the first 32 bits worth of records. This is only if some strange person
290	* doesn't decide to foul play and make the mft sparse which would be a really
291	* horrible thing to do as it would trash our current driver implementation. )-:
292	* Do I hear screams "we want 64-bit inodes!" ?!? (-;
293	*
294	* FIXME: The mft zone is defined as the first 12% of the volume. This space is
295	* reserved so that the mft can grow contiguously and hence doesn't become
296	* fragmented. Volume free space includes the empty part of the mft zone and
297	* when the volume's free 88% are used up, the mft zone is shrunk by a factor
298	* of 2, thus making more space available for more files/data. This process is
299	* repeated every time there is no more free space except for the mft zone until
300	* there really is no more free space.
301	*/
302
303	/*
304	* Typedef the MFT_REF as a 64-bit value for easier handling.
305	* Also define two unpacking macros to get to the reference (MREF) and
306	* sequence number (MSEQNO) respectively.
307	* The _LE versions are to be applied on little endian MFT_REFs.
308	* Note: The _LE versions will return a CPU endian formatted value!
309	*/
310	#define MFT_REF_MASK_CPU 0x0000ffffffffffffULL
311	#define MFT_REF_MASK_LE const_cpu_to_le64(MFT_REF_MASK_CPU)
312
313	typedef u64 MFT_REF;
314
315	#define MK_MREF(m, s) ((MFT_REF)(((MFT_REF)(s) << 48) | \
316	((MFT_REF)(m) & MFT_REF_MASK_CPU)))
317	#define MK_LE_MREF(m, s) const_cpu_to_le64(((MFT_REF)(((MFT_REF)(s) << 48) | \
318	((MFT_REF)(m) & MFT_REF_MASK_CPU))))
319
320	#define MREF(x) ((u64)((x) & MFT_REF_MASK_CPU))
321	#define MSEQNO(x) ((u16)(((x) >> 48) & 0xffff))
322	#define MREF_LE(x) ((u64)(const_le64_to_cpu(x) & MFT_REF_MASK_CPU))
323	#define MSEQNO_LE(x) ((u16)((const_le64_to_cpu(x) >> 48) & 0xffff))
324
325	#define IS_ERR_MREF(x) (((x) & 0x0000800000000000ULL) ? 1 : 0)
326	#define ERR_MREF(x) ((u64)((s64)(x)))
327	#define MREF_ERR(x) ((int)((s64)(x)))
328
329	/**
330	* struct MFT_RECORD - An MFT record layout (NTFS 3.1+)
331	*
332	* The mft record header present at the beginning of every record in the mft.
333	* This is followed by a sequence of variable length attribute records which
334	* is terminated by an attribute of type AT_END which is a truncated attribute
335	* in that it only consists of the attribute type code AT_END and none of the
336	* other members of the attribute structure are present.
337	*/
338	typedef struct {
339	/*Ofs*/
340	/* 0 NTFS_RECORD; -- Unfolded here as gcc doesn't like unnamed structs. */
341	NTFS_RECORD_TYPES magic;/* Usually the magic is "FILE". */
342	u16 usa_ofs; /* See NTFS_RECORD definition above. */
343	u16 usa_count; /* See NTFS_RECORD definition above. */
344
345	/* 8*/ LSN lsn; /* $LogFile sequence number for this record.
346	Changed every time the record is modified. */
347	/* 16*/ u16 sequence_number; /* Number of times this mft record has been
348	reused. (See description for MFT_REF
349	above.) NOTE: The increment (skipping zero)
350	is done when the file is deleted. NOTE: If
351	this is zero it is left zero. */
352	/* 18*/ u16 link_count; /* Number of hard links, i.e. the number of
353	directory entries referencing this record.
354	NOTE: Only used in mft base records.
355	NOTE: When deleting a directory entry we
356	check the link_count and if it is 1 we
357	delete the file. Otherwise we delete the
358	FILE_NAME_ATTR being referenced by the
359	directory entry from the mft record and
360	decrement the link_count.
361	FIXME: Careful with Win32 + DOS names! */
362	/* 20*/ u16 attrs_offset; /* Byte offset to the first attribute in this
363	mft record from the start of the mft record.
364	NOTE: Must be aligned to 8-byte boundary. */
365	/* 22*/ MFT_RECORD_FLAGS flags; /* Bit array of MFT_RECORD_FLAGS. When a file
366	is deleted, the MFT_RECORD_IN_USE flag is
367	set to zero. */
368	/* 24*/ u32 bytes_in_use; /* Number of bytes used in this mft record.
369	NOTE: Must be aligned to 8-byte boundary. */
370	/* 28*/ u32 bytes_allocated; /* Number of bytes allocated for this mft
371	record. This should be equal to the mft
372	record size. */
373	/* 32*/ MFT_REF base_mft_record; /* This is zero for base mft records.
374	When it is not zero it is a mft reference
375	pointing to the base mft record to which
376	this record belongs (this is then used to
377	locate the attribute list attribute present
378	in the base record which describes this
379	extension record and hence might need
380	modification when the extension record
381	itself is modified, also locating the
382	attribute list also means finding the other
383	potential extents, belonging to the non-base
384	mft record). */
385	/* 40*/ u16 next_attr_instance; /* The instance number that will be
386	assigned to the next attribute added to this
387	mft record. NOTE: Incremented each time
388	after it is used. NOTE: Every time the mft
389	record is reused this number is set to zero.
390	NOTE: The first instance number is always 0.
391	*/
392	/* The below fields are specific to NTFS 3.1+ (Windows XP and above): */
393	/* 42*/ u16 reserved; /* Reserved/alignment. */
394	/* 44*/ u32 mft_record_number; /* Number of this mft record. */
395	/* sizeof() = 48 bytes */
396	/*
397	* When (re)using the mft record, we place the update sequence array at this
398	* offset, i.e. before we start with the attributes. This also makes sense,
399	* otherwise we could run into problems with the update sequence array
400	* containing in itself the last two bytes of a sector which would mean that
401	* multi sector transfer protection wouldn't work. As you can't protect data
402	* by overwriting it since you then can't get it back...
403	* When reading we obviously use the data from the ntfs record header.
404	*/
405	} __attribute__((__packed__)) MFT_RECORD;
406
407	/**
408	* struct MFT_RECORD_OLD - An MFT record layout (NTFS <=3.0)
409	*
410	* This is the version without the NTFS 3.1+ specific fields.
411	*/
412	typedef struct {
413	/*Ofs*/
414	/* 0 NTFS_RECORD; -- Unfolded here as gcc doesn't like unnamed structs. */
415	NTFS_RECORD_TYPES magic;/* Usually the magic is "FILE". */
416	u16 usa_ofs; /* See NTFS_RECORD definition above. */
417	u16 usa_count; /* See NTFS_RECORD definition above. */
418
419	/* 8*/ LSN lsn; /* $LogFile sequence number for this record.
420	Changed every time the record is modified. */
421	/* 16*/ u16 sequence_number; /* Number of times this mft record has been
422	reused. (See description for MFT_REF
423	above.) NOTE: The increment (skipping zero)
424	is done when the file is deleted. NOTE: If
425	this is zero it is left zero. */
426	/* 18*/ u16 link_count; /* Number of hard links, i.e. the number of
427	directory entries referencing this record.
428	NOTE: Only used in mft base records.
429	NOTE: When deleting a directory entry we
430	check the link_count and if it is 1 we
431	delete the file. Otherwise we delete the
432	FILE_NAME_ATTR being referenced by the
433	directory entry from the mft record and
434	decrement the link_count.
435	FIXME: Careful with Win32 + DOS names! */
436	/* 20*/ u16 attrs_offset; /* Byte offset to the first attribute in this
437	mft record from the start of the mft record.
438	NOTE: Must be aligned to 8-byte boundary. */
439	/* 22*/ MFT_RECORD_FLAGS flags; /* Bit array of MFT_RECORD_FLAGS. When a file
440	is deleted, the MFT_RECORD_IN_USE flag is
441	set to zero. */
442	/* 24*/ u32 bytes_in_use; /* Number of bytes used in this mft record.
443	NOTE: Must be aligned to 8-byte boundary. */
444	/* 28*/ u32 bytes_allocated; /* Number of bytes allocated for this mft
445	record. This should be equal to the mft
446	record size. */
447	/* 32*/ MFT_REF base_mft_record; /* This is zero for base mft records.
448	When it is not zero it is a mft reference
449	pointing to the base mft record to which
450	this record belongs (this is then used to
451	locate the attribute list attribute present
452	in the base record which describes this
453	extension record and hence might need
454	modification when the extension record
455	itself is modified, also locating the
456	attribute list also means finding the other
457	potential extents, belonging to the non-base
458	mft record). */
459	/* 40*/ u16 next_attr_instance; /* The instance number that will be
460	assigned to the next attribute added to this
461	mft record. NOTE: Incremented each time
462	after it is used. NOTE: Every time the mft
463	record is reused this number is set to zero.
464	NOTE: The first instance number is always 0.
465	*/
466	/* sizeof() = 42 bytes */
467	/*
468	* When (re)using the mft record, we place the update sequence array at this
469	* offset, i.e. before we start with the attributes. This also makes sense,
470	* otherwise we could run into problems with the update sequence array
471	* containing in itself the last two bytes of a sector which would mean that
472	* multi sector transfer protection wouldn't work. As you can't protect data
473	* by overwriting it since you then can't get it back...
474	* When reading we obviously use the data from the ntfs record header.
475	*/
476	} __attribute__((__packed__)) MFT_RECORD_OLD;
477
478	/**
479	* enum ATTR_TYPES - System defined attributes (32-bit).
480	*
481	* Each attribute type has a corresponding attribute name (Unicode string of
482	* maximum 64 character length) as described by the attribute definitions
483	* present in the data attribute of the $AttrDef system file.
484	*
485	* On NTFS 3.0 volumes the names are just as the types are named in the below
486	* enum exchanging AT_ for the dollar sign ($). If that isn't a revealing
487	* choice of symbol... (-;
488	*/
489	typedef enum {
490	AT_UNUSED = const_cpu_to_le32( 0),
491	AT_STANDARD_INFORMATION = const_cpu_to_le32( 0x10),
492	AT_ATTRIBUTE_LIST = const_cpu_to_le32( 0x20),
493	AT_FILE_NAME = const_cpu_to_le32( 0x30),
494	AT_OBJECT_ID = const_cpu_to_le32( 0x40),
495	AT_SECURITY_DESCRIPTOR = const_cpu_to_le32( 0x50),
496	AT_VOLUME_NAME = const_cpu_to_le32( 0x60),
497	AT_VOLUME_INFORMATION = const_cpu_to_le32( 0x70),
498	AT_DATA = const_cpu_to_le32( 0x80),
499	AT_INDEX_ROOT = const_cpu_to_le32( 0x90),
500	AT_INDEX_ALLOCATION = const_cpu_to_le32( 0xa0),
501	AT_BITMAP = const_cpu_to_le32( 0xb0),
502	AT_REPARSE_POINT = const_cpu_to_le32( 0xc0),
503	AT_EA_INFORMATION = const_cpu_to_le32( 0xd0),
504	AT_EA = const_cpu_to_le32( 0xe0),
505	AT_PROPERTY_SET = const_cpu_to_le32( 0xf0),
506	AT_LOGGED_UTILITY_STREAM = const_cpu_to_le32( 0x100),
507	AT_FIRST_USER_DEFINED_ATTRIBUTE = const_cpu_to_le32( 0x1000),
508	AT_END = const_cpu_to_le32(0xffffffff),
509	} ATTR_TYPES;
510
511	/**
512	* enum COLLATION_RULES - The collation rules for sorting views/indexes/etc
513	* (32-bit).
514	*
515	* COLLATION_UNICODE_STRING - Collate Unicode strings by comparing their binary
516	* Unicode values, except that when a character can be uppercased, the
517	* upper case value collates before the lower case one.
518	* COLLATION_FILE_NAME - Collate file names as Unicode strings. The collation
519	* is done very much like COLLATION_UNICODE_STRING. In fact I have no idea
520	* what the difference is. Perhaps the difference is that file names
521	* would treat some special characters in an odd way (see
522	* unistr.c::ntfs_collate_names() and unistr.c::legal_ansi_char_array[]
523	* for what I mean but COLLATION_UNICODE_STRING would not give any special
524	* treatment to any characters at all, but this is speculation.
525	* COLLATION_NTOFS_ULONG - Sorting is done according to ascending u32 key
526	* values. E.g. used for $SII index in FILE_Secure, which sorts by
527	* security_id (u32).
528	* COLLATION_NTOFS_SID - Sorting is done according to ascending SID values.
529	* E.g. used for $O index in FILE_Extend/$Quota.
530	* COLLATION_NTOFS_SECURITY_HASH - Sorting is done first by ascending hash
531	* values and second by ascending security_id values. E.g. used for $SDH
532	* index in FILE_Secure.
533	* COLLATION_NTOFS_ULONGS - Sorting is done according to a sequence of ascending
534	* u32 key values. E.g. used for $O index in FILE_Extend/$ObjId, which
535	* sorts by object_id (16-byte), by splitting up the object_id in four
536	* u32 values and using them as individual keys. E.g. take the following
537	* two security_ids, stored as follows on disk:
538	* 1st: a1 61 65 b7 65 7b d4 11 9e 3d 00 e0 81 10 42 59
539	* 2nd: 38 14 37 d2 d2 f3 d4 11 a5 21 c8 6b 79 b1 97 45
540	* To compare them, they are split into four u32 values each, like so:
541	* 1st: 0xb76561a1 0x11d47b65 0xe0003d9e 0x59421081
542	* 2nd: 0xd2371438 0x11d4f3d2 0x6bc821a5 0x4597b179
543	* Now, it is apparent why the 2nd object_id collates after the 1st: the
544	* first u32 value of the 1st object_id is less than the first u32 of
545	* the 2nd object_id. If the first u32 values of both object_ids were
546	* equal then the second u32 values would be compared, etc.
547	*/
548	typedef enum {
549	COLLATION_BINARY = const_cpu_to_le32(0), /* Collate by binary
550	compare where the first byte is most
551	significant. */
552	COLLATION_FILE_NAME = const_cpu_to_le32(1), /* Collate file names
553	as Unicode strings. */
554	COLLATION_UNICODE_STRING = const_cpu_to_le32(2), /* Collate Unicode
555	strings by comparing their binary
556	Unicode values, except that when a
557	character can be uppercased, the upper
558	case value collates before the lower
559	case one. */
560	COLLATION_NTOFS_ULONG = const_cpu_to_le32(16),
561	COLLATION_NTOFS_SID = const_cpu_to_le32(17),
562	COLLATION_NTOFS_SECURITY_HASH = const_cpu_to_le32(18),
563	COLLATION_NTOFS_ULONGS = const_cpu_to_le32(19),
564	} COLLATION_RULES;
565
566	/**
567	* enum ATTR_DEF_FLAGS -
568	*
569	* The flags (32-bit) describing attribute properties in the attribute
570	* definition structure. FIXME: This information is based on Regis's
571	* information and, according to him, it is not certain and probably
572	* incomplete. The INDEXABLE flag is fairly certainly correct as only the file
573	* name attribute has this flag set and this is the only attribute indexed in
574	* NT4.
575	*/
576	typedef enum {
577	ATTR_DEF_INDEXABLE = const_cpu_to_le32(0x02), /* Attribute can be
578	indexed. */
579	ATTR_DEF_MULTIPLE = const_cpu_to_le32(0x04), /* Attribute type
580	can be present multiple times in the
581	mft records of an inode. */
582	ATTR_DEF_NOT_ZERO = const_cpu_to_le32(0x08), /* Attribute value
583	must contain at least one non-zero
584	byte. */
585	ATTR_DEF_INDEXED_UNIQUE = const_cpu_to_le32(0x10), /* Attribute must be
586	indexed and the attribute value must be
587	unique for the attribute type in all of
588	the mft records of an inode. */
589	ATTR_DEF_NAMED_UNIQUE = const_cpu_to_le32(0x20), /* Attribute must be
590	named and the name must be unique for
591	the attribute type in all of the mft
592	records of an inode. */
593	ATTR_DEF_RESIDENT = const_cpu_to_le32(0x40), /* Attribute must be
594	resident. */
595	ATTR_DEF_ALWAYS_LOG = const_cpu_to_le32(0x80), /* Always log
596	modifications to this attribute,
597	regardless of whether it is resident or
598	non-resident. Without this, only log
599	modifications if the attribute is
600	resident. */
601	} ATTR_DEF_FLAGS;
602
603	/**
604	* struct ATTR_DEF -
605	*
606	* The data attribute of FILE_AttrDef contains a sequence of attribute
607	* definitions for the NTFS volume. With this, it is supposed to be safe for an
608	* older NTFS driver to mount a volume containing a newer NTFS version without
609	* damaging it (that's the theory. In practice it's: not damaging it too much).
610	* Entries are sorted by attribute type. The flags describe whether the
611	* attribute can be resident/non-resident and possibly other things, but the
612	* actual bits are unknown.
613	*/
614	typedef struct {
615	/*hex ofs*/
616	/* 0*/ ntfschar name[0x40]; /* Unicode name of the attribute. Zero
617	terminated. */
618	/* 80*/ ATTR_TYPES type; /* Type of the attribute. */
619	/* 84*/ u32 display_rule; /* Default display rule.
620	FIXME: What does it mean? (AIA) */
621	/* 88*/ COLLATION_RULES collation_rule; /* Default collation rule. */
622	/* 8c*/ ATTR_DEF_FLAGS flags; /* Flags describing the attribute. */
623	/* 90*/ s64 min_size; /* Optional minimum attribute size. */
624	/* 98*/ s64 max_size; /* Maximum size of attribute. */
625	/* sizeof() = 0xa0 or 160 bytes */
626	} __attribute__((__packed__)) ATTR_DEF;
627
628	/**
629	* enum ATTR_FLAGS - Attribute flags (16-bit).
630	*/
631	typedef enum {
632	ATTR_IS_COMPRESSED = const_cpu_to_le16(0x0001),
633	ATTR_COMPRESSION_MASK = const_cpu_to_le16(0x00ff), /* Compression
634	method mask. Also, first
635	illegal value. */
636	ATTR_IS_ENCRYPTED = const_cpu_to_le16(0x4000),
637	ATTR_IS_SPARSE = const_cpu_to_le16(0x8000),
638	} __attribute__((__packed__)) ATTR_FLAGS;
639
640	/*
641	* Attribute compression.
642	*
643	* Only the data attribute is ever compressed in the current ntfs driver in
644	* Windows. Further, compression is only applied when the data attribute is
645	* non-resident. Finally, to use compression, the maximum allowed cluster size
646	* on a volume is 4kib.
647	*
648	* The compression method is based on independently compressing blocks of X
649	* clusters, where X is determined from the compression_unit value found in the
650	* non-resident attribute record header (more precisely: X = 2^compression_unit
651	* clusters). On Windows NT/2k, X always is 16 clusters (compression_unit = 4).
652	*
653	* There are three different cases of how a compression block of X clusters
654	* can be stored:
655	*
656	* 1) The data in the block is all zero (a sparse block):
657	* This is stored as a sparse block in the runlist, i.e. the runlist
658	* entry has length = X and lcn = -1. The mapping pairs array actually
659	* uses a delta_lcn value length of 0, i.e. delta_lcn is not present at
660	* all, which is then interpreted by the driver as lcn = -1.
661	* NOTE: Even uncompressed files can be sparse on NTFS 3.0 volumes, then
662	* the same principles apply as above, except that the length is not
663	* restricted to being any particular value.
664	*
665	* 2) The data in the block is not compressed:
666	* This happens when compression doesn't reduce the size of the block
667	* in clusters. I.e. if compression has a small effect so that the
668	* compressed data still occupies X clusters, then the uncompressed data
669	* is stored in the block.
670	* This case is recognised by the fact that the runlist entry has
671	* length = X and lcn >= 0. The mapping pairs array stores this as
672	* normal with a run length of X and some specific delta_lcn, i.e.
673	* delta_lcn has to be present.
674	*
675	* 3) The data in the block is compressed:
676	* The common case. This case is recognised by the fact that the run
677	* list entry has length L < X and lcn >= 0. The mapping pairs array
678	* stores this as normal with a run length of X and some specific
679	* delta_lcn, i.e. delta_lcn has to be present. This runlist entry is
680	* immediately followed by a sparse entry with length = X - L and
681	* lcn = -1. The latter entry is to make up the vcn counting to the
682	* full compression block size X.
683	*
684	* In fact, life is more complicated because adjacent entries of the same type
685	* can be coalesced. This means that one has to keep track of the number of
686	* clusters handled and work on a basis of X clusters at a time being one
687	* block. An example: if length L > X this means that this particular runlist
688	* entry contains a block of length X and part of one or more blocks of length
689	* L - X. Another example: if length L < X, this does not necessarily mean that
690	* the block is compressed as it might be that the lcn changes inside the block
691	* and hence the following runlist entry describes the continuation of the
692	* potentially compressed block. The block would be compressed if the
693	* following runlist entry describes at least X - L sparse clusters, thus
694	* making up the compression block length as described in point 3 above. (Of
695	* course, there can be several runlist entries with small lengths so that the
696	* sparse entry does not follow the first data containing entry with
697	* length < X.)
698	*
699	* NOTE: At the end of the compressed attribute value, there most likely is not
700	* just the right amount of data to make up a compression block, thus this data
701	* is not even attempted to be compressed. It is just stored as is, unless
702	* the number of clusters it occupies is reduced when compressed in which case
703	* it is stored as a compressed compression block, complete with sparse
704	* clusters at the end.
705	*/
706
707	/**
708	* enum RESIDENT_ATTR_FLAGS - Flags of resident attributes (8-bit).
709	*/
710	typedef enum {
711	RESIDENT_ATTR_IS_INDEXED = 0x01, /* Attribute is referenced in an index
712	(has implications for deleting and
713	modifying the attribute). */
714	} __attribute__((__packed__)) RESIDENT_ATTR_FLAGS;
715
716	/**
717	* struct ATTR_RECORD - Attribute record header.
718	*
719	* Always aligned to 8-byte boundary.
720	*/
721	typedef struct {
722	/*Ofs*/
723	/* 0*/ ATTR_TYPES type; /* The (32-bit) type of the attribute. */
724	/* 4*/ u32 length; /* Byte size of the resident part of the
725	attribute (aligned to 8-byte boundary).
726	Used to get to the next attribute. */
727	/* 8*/ u8 non_resident; /* If 0, attribute is resident.
728	If 1, attribute is non-resident. */
729	/* 9*/ u8 name_length; /* Unicode character size of name of attribute.
730	0 if unnamed. */
731	/* 10*/ u16 name_offset; /* If name_length != 0, the byte offset to the
732	beginning of the name from the attribute
733	record. Note that the name is stored as a
734	Unicode string. When creating, place offset
735	just at the end of the record header. Then,
736	follow with attribute value or mapping pairs
737	array, resident and non-resident attributes
738	respectively, aligning to an 8-byte
739	boundary. */
740	/* 12*/ ATTR_FLAGS flags; /* Flags describing the attribute. */
741	/* 14*/ u16 instance; /* The instance of this attribute record. This
742	number is unique within this mft record (see
743	MFT_RECORD/next_attribute_instance notes
744	above for more details). */
745	/* 16*/ union {
746	/* Resident attributes. */
747	struct {
748	/* 16 */ u32 value_length; /* Byte size of attribute value. */
749	/* 20 */ u16 value_offset; /* Byte offset of the attribute
750	value from the start of the
751	attribute record. When creating,
752	align to 8-byte boundary if we
753	have a name present as this might
754	not have a length of a multiple
755	of 8-bytes. */
756	/* 22 */ RESIDENT_ATTR_FLAGS resident_flags; /* See above. */
757	/* 23 */ s8 reservedR; /* Reserved/alignment to 8-byte
758	boundary. */
759	/* 24 */ void *resident_end[0]; /* Use offsetof(ATTR_RECORD,
760	resident_end) to get size of
761	a resident attribute. */
762	} __attribute__((__packed__));
763	/* Non-resident attributes. */
764	struct {
765	/* 16*/ VCN lowest_vcn; /* Lowest valid virtual cluster number
766	for this portion of the attribute value or
767	0 if this is the only extent (usually the
768	case). - Only when an attribute list is used
769	does lowest_vcn != 0 ever occur. */
770	/* 24*/ VCN highest_vcn; /* Highest valid vcn of this extent of
771	the attribute value. - Usually there is only one
772	portion, so this usually equals the attribute
773	value size in clusters minus 1. Can be -1 for
774	zero length files. Can be 0 for "single extent"
775	attributes. */
776	/* 32*/ u16 mapping_pairs_offset; /* Byte offset from the
777	beginning of the structure to the mapping pairs
778	array which contains the mappings between the
779	vcns and the logical cluster numbers (lcns).
780	When creating, place this at the end of this
781	record header aligned to 8-byte boundary. */
782	/* 34*/ u8 compression_unit; /* The compression unit expressed
783	as the log to the base 2 of the number of
784	clusters in a compression unit. 0 means not
785	compressed. (This effectively limits the
786	compression unit size to be a power of two
787	clusters.) WinNT4 only uses a value of 4. */
788	/* 35*/ u8 reserved1[5]; /* Align to 8-byte boundary. */
789	/* The sizes below are only used when lowest_vcn is zero, as otherwise it would
790	be difficult to keep them up-to-date.*/
791	/* 40*/ s64 allocated_size; /* Byte size of disk space
792	allocated to hold the attribute value. Always
793	is a multiple of the cluster size. When a file
794	is compressed, this field is a multiple of the
795	compression block size (2^compression_unit) and
796	it represents the logically allocated space
797	rather than the actual on disk usage. For this
798	use the compressed_size (see below). */
799	/* 48*/ s64 data_size; /* Byte size of the attribute
800	value. Can be larger than allocated_size if
801	attribute value is compressed or sparse. */
802	/* 56*/ s64 initialized_size; /* Byte size of initialized
803	portion of the attribute value. Usually equals
804	data_size. */
805	/* 64 */ void *non_resident_end[0]; /* Use offsetof(ATTR_RECORD,
806	non_resident_end) to get
807	size of a non resident
808	attribute. */
809	/* sizeof(uncompressed attr) = 64*/
810	/* 64*/ s64 compressed_size; /* Byte size of the attribute
811	value after compression. Only present when
812	compressed. Always is a multiple of the
813	cluster size. Represents the actual amount of
814	disk space being used on the disk. */
815	/* 72 */ void *compressed_end[0];
816	/* Use offsetof(ATTR_RECORD, compressed_end) to
817	get size of a compressed attribute. */
818	/* sizeof(compressed attr) = 72*/
819	} __attribute__((__packed__));
820	} __attribute__((__packed__));
821	} __attribute__((__packed__)) ATTR_RECORD;
822
823	typedef ATTR_RECORD ATTR_REC;
824
825	/**
826	* enum FILE_ATTR_FLAGS - File attribute flags (32-bit).
827	*/
828	typedef enum {
829	/*
830	* These flags are only present in the STANDARD_INFORMATION attribute
831	* (in the field file_attributes).
832	*/
833	FILE_ATTR_READONLY = const_cpu_to_le32(0x00000001),
834	FILE_ATTR_HIDDEN = const_cpu_to_le32(0x00000002),
835	FILE_ATTR_SYSTEM = const_cpu_to_le32(0x00000004),
836	/* Old DOS volid. Unused in NT. = cpu_to_le32(0x00000008), */
837
838	FILE_ATTR_DIRECTORY = const_cpu_to_le32(0x00000010),
839	/* FILE_ATTR_DIRECTORY is not considered valid in NT. It is reserved
840	for the DOS SUBDIRECTORY flag. */
841	FILE_ATTR_ARCHIVE = const_cpu_to_le32(0x00000020),
842	FILE_ATTR_DEVICE = const_cpu_to_le32(0x00000040),
843	FILE_ATTR_NORMAL = const_cpu_to_le32(0x00000080),
844
845	FILE_ATTR_TEMPORARY = const_cpu_to_le32(0x00000100),
846	FILE_ATTR_SPARSE_FILE = const_cpu_to_le32(0x00000200),
847	FILE_ATTR_REPARSE_POINT = const_cpu_to_le32(0x00000400),
848	FILE_ATTR_COMPRESSED = const_cpu_to_le32(0x00000800),
849
850	FILE_ATTR_OFFLINE = const_cpu_to_le32(0x00001000),
851	FILE_ATTR_NOT_CONTENT_INDEXED = const_cpu_to_le32(0x00002000),
852	FILE_ATTR_ENCRYPTED = const_cpu_to_le32(0x00004000),
853
854	FILE_ATTR_VALID_FLAGS = const_cpu_to_le32(0x00007fb7),
855	/* FILE_ATTR_VALID_FLAGS masks out the old DOS VolId and the
856	FILE_ATTR_DEVICE and preserves everything else. This mask
857	is used to obtain all flags that are valid for reading. */
858	FILE_ATTR_VALID_SET_FLAGS = const_cpu_to_le32(0x000031a7),
859	/* FILE_ATTR_VALID_SET_FLAGS masks out the old DOS VolId, the
860	FILE_ATTR_DEVICE, FILE_ATTR_DIRECTORY, FILE_ATTR_SPARSE_FILE,
861	FILE_ATTR_REPARSE_POINT, FILE_ATRE_COMPRESSED and FILE_ATTR_ENCRYPTED
862	and preserves the rest. This mask is used to to obtain all flags that
863	are valid for setting. */
864
865	/**
866	* FILE_ATTR_I30_INDEX_PRESENT - Is it a directory?
867	*
868	* This is a copy of the MFT_RECORD_IS_DIRECTORY bit from the mft
869	* record, telling us whether this is a directory or not, i.e. whether
870	* it has an index root attribute named "$I30" or not.
871	*
872	* This flag is only present in the FILE_NAME attribute (in the
873	* file_attributes field).
874	*/
875	FILE_ATTR_I30_INDEX_PRESENT = const_cpu_to_le32(0x10000000),
876
877	/**
878	* FILE_ATTR_VIEW_INDEX_PRESENT - Does have a non-directory index?
879	*
880	* This is a copy of the MFT_RECORD_IS_VIEW_INDEX bit from the mft
881	* record, telling us whether this file has a view index present (eg.
882	* object id index, quota index, one of the security indexes and the
883	* reparse points index).
884	*
885	* This flag is only present in the $STANDARD_INFORMATION and
886	* $FILE_NAME attributes.
887	*/
888	FILE_ATTR_VIEW_INDEX_PRESENT = const_cpu_to_le32(0x20000000),
889	} __attribute__((__packed__)) FILE_ATTR_FLAGS;
890
891	/*
892	* NOTE on times in NTFS: All times are in MS standard time format, i.e. they
893	* are the number of 100-nanosecond intervals since 1st January 1601, 00:00:00
894	* universal coordinated time (UTC). (In Linux time starts 1st January 1970,
895	* 00:00:00 UTC and is stored as the number of 1-second intervals since then.)
896	*/
897
898	/**
899	* struct STANDARD_INFORMATION - Attribute: Standard information (0x10).
900	*
901	* NOTE: Always resident.
902	* NOTE: Present in all base file records on a volume.
903	* NOTE: There is conflicting information about the meaning of each of the time
904	* fields but the meaning as defined below has been verified to be
905	* correct by practical experimentation on Windows NT4 SP6a and is hence
906	* assumed to be the one and only correct interpretation.
907	*/
908	typedef struct {
909	/*Ofs*/
910	/* 0*/ s64 creation_time; /* Time file was created. Updated when
911	a filename is changed(?). */
912	/* 8*/ s64 last_data_change_time; /* Time the data attribute was last
913	modified. */
914	/* 16*/ s64 last_mft_change_time; /* Time this mft record was last
915	modified. */
916	/* 24*/ s64 last_access_time; /* Approximate time when the file was
917	last accessed (obviously this is not
918	updated on read-only volumes). In
919	Windows this is only updated when
920	accessed if some time delta has
921	passed since the last update. Also,
922	last access times updates can be
923	disabled altogether for speed. */
924	/* 32*/ FILE_ATTR_FLAGS file_attributes; /* Flags describing the file. */
925	/* 36*/ union {
926	/* NTFS 1.2 (and previous, presumably) */
927	struct {
928	/* 36 */ u8 reserved12[12]; /* Reserved/alignment to 8-byte
929	boundary. */
930	/* 48 */ void *v1_end[0]; /* Marker for offsetof(). */
931	} __attribute__((__packed__));
932	/* sizeof() = 48 bytes */
933	/* NTFS 3.0 */
934	struct {
935	/*
936	* If a volume has been upgraded from a previous NTFS version, then these
937	* fields are present only if the file has been accessed since the upgrade.
938	* Recognize the difference by comparing the length of the resident attribute
939	* value. If it is 48, then the following fields are missing. If it is 72 then
940	* the fields are present. Maybe just check like this:
941	* if (resident.ValueLength < sizeof(STANDARD_INFORMATION)) {
942	* Assume NTFS 1.2- format.
943	* If (volume version is 3.0+)
944	* Upgrade attribute to NTFS 3.0 format.
945	* else
946	* Use NTFS 1.2- format for access.
947	* } else
948	* Use NTFS 3.0 format for access.
949	* Only problem is that it might be legal to set the length of the value to
950	* arbitrarily large values thus spoiling this check. - But chkdsk probably
951	* views that as a corruption, assuming that it behaves like this for all
952	* attributes.
953	*/
954	/* 36*/ u32 maximum_versions; /* Maximum allowed versions for
955	file. Zero if version numbering is disabled. */
956	/* 40*/ u32 version_number; /* This file's version (if any).
957	Set to zero if maximum_versions is zero. */
958	/* 44*/ u32 class_id; /* Class id from bidirectional
959	class id index (?). */
960	/* 48*/ u32 owner_id; /* Owner_id of the user owning
961	the file. Translate via $Q index in FILE_Extend
962	/$Quota to the quota control entry for the user
963	owning the file. Zero if quotas are disabled. */
964	/* 52*/ u32 security_id; /* Security_id for the file.
965	Translate via $SII index and $SDS data stream
966	in FILE_Secure to the security descriptor. */
967	/* 56*/ u64 quota_charged; /* Byte size of the charge to
968	the quota for all streams of the file. Note: Is
969	zero if quotas are disabled. */
970	/* 64*/ u64 usn; /* Last update sequence number
971	of the file. This is a direct index into the
972	change (aka usn) journal file. It is zero if
973	the usn journal is disabled.
974	NOTE: To disable the journal need to delete
975	the journal file itself and to then walk the
976	whole mft and set all Usn entries in all mft
977	records to zero! (This can take a while!)
978	The journal is FILE_Extend/$UsnJrnl. Win2k
979	will recreate the journal and initiate
980	logging if necessary when mounting the
981	partition. This, in contrast to disabling the
982	journal is a very fast process, so the user
983	won't even notice it. */
984	/* 72*/ void *v3_end[0]; /* Marker for offsetof(). */
985	} __attribute__((__packed__));
986	} __attribute__((__packed__));
987	/* sizeof() = 72 bytes (NTFS 3.0) */
988	} __attribute__((__packed__)) STANDARD_INFORMATION;
989
990	/**
991	* struct ATTR_LIST_ENTRY - Attribute: Attribute list (0x20).
992	*
993	* - Can be either resident or non-resident.
994	* - Value consists of a sequence of variable length, 8-byte aligned,
995	* ATTR_LIST_ENTRY records.
996	* - The attribute list attribute contains one entry for each attribute of
997	* the file in which the list is located, except for the list attribute
998	* itself. The list is sorted: first by attribute type, second by attribute
999	* name (if present), third by instance number. The extents of one
1000	* non-resident attribute (if present) immediately follow after the initial
1001	* extent. They are ordered by lowest_vcn and have their instance set to zero.
1002	* It is not allowed to have two attributes with all sorting keys equal.
1003	* - Further restrictions:
1004	* - If not resident, the vcn to lcn mapping array has to fit inside the
1005	* base mft record.
1006	* - The attribute list attribute value has a maximum size of 256kb. This
1007	* is imposed by the Windows cache manager.
1008	* - Attribute lists are only used when the attributes of mft record do not
1009	* fit inside the mft record despite all attributes (that can be made
1010	* non-resident) having been made non-resident. This can happen e.g. when:
1011	* - File has a large number of hard links (lots of file name
1012	* attributes present).
1013	* - The mapping pairs array of some non-resident attribute becomes so
1014	* large due to fragmentation that it overflows the mft record.
1015	* - The security descriptor is very complex (not applicable to
1016	* NTFS 3.0 volumes).
1017	* - There are many named streams.
1018	*/
1019	typedef struct {
1020	/*Ofs*/
1021	/* 0*/ ATTR_TYPES type; /* Type of referenced attribute. */
1022	/* 4*/ u16 length; /* Byte size of this entry. */
1023	/* 6*/ u8 name_length; /* Size in Unicode chars of the name of the
1024	attribute or 0 if unnamed. */
1025	/* 7*/ u8 name_offset; /* Byte offset to beginning of attribute name
1026	(always set this to where the name would
1027	start even if unnamed). */
1028	/* 8*/ VCN lowest_vcn; /* Lowest virtual cluster number of this portion
1029	of the attribute value. This is usually 0. It
1030	is non-zero for the case where one attribute
1031	does not fit into one mft record and thus
1032	several mft records are allocated to hold
1033	this attribute. In the latter case, each mft
1034	record holds one extent of the attribute and
1035	there is one attribute list entry for each
1036	extent. NOTE: This is DEFINITELY a signed
1037	value! The windows driver uses cmp, followed
1038	by jg when comparing this, thus it treats it
1039	as signed. */
1040	/* 16*/ MFT_REF mft_reference; /* The reference of the mft record holding
1041	the ATTR_RECORD for this portion of the
1042	attribute value. */
1043	/* 24*/ u16 instance; /* If lowest_vcn = 0, the instance of the
1044	attribute being referenced; otherwise 0. */
1045	/* 26*/ ntfschar name[0]; /* Use when creating only. When reading use
1046	name_offset to determine the location of the
1047	name. */
1048	/* sizeof() = 26 + (attribute_name_length * 2) bytes */
1049	} __attribute__((__packed__)) ATTR_LIST_ENTRY;
1050
1051	/*
1052	* The maximum allowed length for a file name.
1053	*/
1054	#define NTFS_MAX_NAME_LEN 255
1055
1056	/**
1057	* enum FILE_NAME_TYPE_FLAGS - Possible namespaces for filenames in ntfs.
1058	* (8-bit).
1059	*/
1060	typedef enum {
1061	FILE_NAME_POSIX = 0x00,
1062	/* This is the largest namespace. It is case sensitive and
1063	allows all Unicode characters except for: '\0' and '/'.
1064	Beware that in WinNT/2k files which eg have the same name
1065	except for their case will not be distinguished by the
1066	standard utilities and thus a "del filename" will delete
1067	both "filename" and "fileName" without warning. */
1068	FILE_NAME_WIN32 = 0x01,
1069	/* The standard WinNT/2k NTFS long filenames. Case insensitive.
1070	All Unicode chars except: '\0', '"', '*', '/', ':', '<',
1071	'>', '?', '\' and '|'. Further, names cannot end with a '.'
1072	or a space. */
1073	FILE_NAME_DOS = 0x02,
1074	/* The standard DOS filenames (8.3 format). Uppercase only.
1075	All 8-bit characters greater space, except: '"', '*', '+',
1076	',', '/', ':', ';', '<', '=', '>', '?' and '\'. */
1077	FILE_NAME_WIN32_AND_DOS = 0x03,
1078	/* 3 means that both the Win32 and the DOS filenames are
1079	identical and hence have been saved in this single filename
1080	record. */
1081	} __attribute__((__packed__)) FILE_NAME_TYPE_FLAGS;
1082
1083	/**
1084	* struct FILE_NAME_ATTR - Attribute: Filename (0x30).
1085	*
1086	* NOTE: Always resident.
1087	* NOTE: All fields, except the parent_directory, are only updated when the
1088	* filename is changed. Until then, they just become out of sync with
1089	* reality and the more up to date values are present in the standard
1090	* information attribute.
1091	* NOTE: There is conflicting information about the meaning of each of the time
1092	* fields but the meaning as defined below has been verified to be
1093	* correct by practical experimentation on Windows NT4 SP6a and is hence
1094	* assumed to be the one and only correct interpretation.
1095	*/
1096	typedef struct {
1097	/*hex ofs*/
1098	/* 0*/ MFT_REF parent_directory; /* Directory this filename is
1099	referenced from. */
1100	/* 8*/ s64 creation_time; /* Time file was created. */
1101	/* 10*/ s64 last_data_change_time; /* Time the data attribute was last
1102	modified. */
1103	/* 18*/ s64 last_mft_change_time; /* Time this mft record was last
1104	modified. */
1105	/* 20*/ s64 last_access_time; /* Last time this mft record was
1106	accessed. */
1107	/* 28*/ s64 allocated_size; /* Byte size of on-disk allocated space
1108	for the data attribute. So for
1109	normal $DATA, this is the
1110	allocated_size from the unnamed
1111	$DATA attribute and for compressed
1112	and/or sparse $DATA, this is the
1113	compressed_size from the unnamed
1114	$DATA attribute. NOTE: This is a
1115	multiple of the cluster size. */
1116	/* 30*/ s64 data_size; /* Byte size of actual data in data
1117	attribute. */
1118	/* 38*/ FILE_ATTR_FLAGS file_attributes; /* Flags describing the file. */
1119	/* 3c*/ union {
1120	/* 3c*/ struct {
1121	/* 3c*/ u16 packed_ea_size; /* Size of the buffer needed to
1122	pack the extended attributes
1123	(EAs), if such are present.*/
1124	/* 3e*/ u16 reserved; /* Reserved for alignment. */
1125	} __attribute__((__packed__));
1126	/* 3c*/ u32 reparse_point_tag; /* Type of reparse point,
1127	present only in reparse
1128	points and only if there are
1129	no EAs. */
1130	} __attribute__((__packed__));
1131	/* 40*/ u8 file_name_length; /* Length of file name in
1132	(Unicode) characters. */
1133	/* 41*/ FILE_NAME_TYPE_FLAGS file_name_type; /* Namespace of the file name.*/
1134	/* 42*/ ntfschar file_name[0]; /* File name in Unicode. */
1135	} __attribute__((__packed__)) FILE_NAME_ATTR;
1136
1137	/**
1138	* struct GUID - GUID structures store globally unique identifiers (GUID).
1139	*
1140	* A GUID is a 128-bit value consisting of one group of eight hexadecimal
1141	* digits, followed by three groups of four hexadecimal digits each, followed
1142	* by one group of twelve hexadecimal digits. GUIDs are Microsoft's
1143	* implementation of the distributed computing environment (DCE) universally
1144	* unique identifier (UUID).
1145	*
1146	* Example of a GUID:
1147	* 1F010768-5A73-BC91-0010-A52216A7227B
1148	*/
1149	typedef struct {
1150	u32 data1; /* The first eight hexadecimal digits of the GUID. */
1151	u16 data2; /* The first group of four hexadecimal digits. */
1152	u16 data3; /* The second group of four hexadecimal digits. */
1153	u8 data4[8]; /* The first two bytes are the third group of four
1154	hexadecimal digits. The remaining six bytes are the
1155	final 12 hexadecimal digits. */
1156	} __attribute__((__packed__)) GUID;
1157
1158	/**
1159	* struct OBJ_ID_INDEX_DATA - FILE_Extend/$ObjId contains an index named $O.
1160	*
1161	* This index contains all object_ids present on the volume as the index keys
1162	* and the corresponding mft_record numbers as the index entry data parts.
1163	*
1164	* The data part (defined below) also contains three other object_ids:
1165	* birth_volume_id - object_id of FILE_Volume on which the file was first
1166	* created. Optional (i.e. can be zero).
1167	* birth_object_id - object_id of file when it was first created. Usually
1168	* equals the object_id. Optional (i.e. can be zero).
1169	* domain_id - Reserved (always zero).
1170	*/
1171	typedef struct {
1172	MFT_REF mft_reference; /* Mft record containing the object_id in
1173	the index entry key. */
1174	union {
1175	struct {
1176	GUID birth_volume_id;
1177	GUID birth_object_id;
1178	GUID domain_id;
1179	} __attribute__((__packed__));
1180	u8 extended_info[48];
1181	} __attribute__((__packed__));
1182	} __attribute__((__packed__)) OBJ_ID_INDEX_DATA;
1183
1184	/**
1185	* struct OBJECT_ID_ATTR - Attribute: Object id (NTFS 3.0+) (0x40).
1186	*
1187	* NOTE: Always resident.
1188	*/
1189	typedef struct {
1190	GUID object_id; /* Unique id assigned to the
1191	file.*/
1192	/* The following fields are optional. The attribute value size is 16
1193	bytes, i.e. sizeof(GUID), if these are not present at all. Note,
1194	the entries can be present but one or more (or all) can be zero
1195	meaning that that particular value(s) is(are) not defined. Note,
1196	when the fields are missing here, it is well possible that they are
1197	to be found within the $Extend/$ObjId system file indexed under the
1198	above object_id. */
1199	union {
1200	struct {
1201	GUID birth_volume_id; /* Unique id of volume on which
1202	the file was first created.*/
1203	GUID birth_object_id; /* Unique id of file when it was
1204	first created. */
1205	GUID domain_id; /* Reserved, zero. */
1206	} __attribute__((__packed__));
1207	u8 extended_info[48];
1208	} __attribute__((__packed__));
1209	} __attribute__((__packed__)) OBJECT_ID_ATTR;
1210
1211	#if 0
1212	/**
1213	* enum IDENTIFIER_AUTHORITIES -
1214	*
1215	* The pre-defined IDENTIFIER_AUTHORITIES used as SID_IDENTIFIER_AUTHORITY in
1216	* the SID structure (see below).
1217	*/
1218	typedef enum { /* SID string prefix. */
1219	SECURITY_NULL_SID_AUTHORITY = {0, 0, 0, 0, 0, 0}, /* S-1-0 */
1220	SECURITY_WORLD_SID_AUTHORITY = {0, 0, 0, 0, 0, 1}, /* S-1-1 */
1221	SECURITY_LOCAL_SID_AUTHORITY = {0, 0, 0, 0, 0, 2}, /* S-1-2 */
1222	SECURITY_CREATOR_SID_AUTHORITY = {0, 0, 0, 0, 0, 3}, /* S-1-3 */
1223	SECURITY_NON_UNIQUE_AUTHORITY = {0, 0, 0, 0, 0, 4}, /* S-1-4 */
1224	SECURITY_NT_SID_AUTHORITY = {0, 0, 0, 0, 0, 5}, /* S-1-5 */
1225	} IDENTIFIER_AUTHORITIES;
1226	#endif
1227
1228	/**
1229	* enum RELATIVE_IDENTIFIERS -
1230	*
1231	* These relative identifiers (RIDs) are used with the above identifier
1232	* authorities to make up universal well-known SIDs.
1233	*
1234	* Note: The relative identifier (RID) refers to the portion of a SID, which
1235	* identifies a user or group in relation to the authority that issued the SID.
1236	* For example, the universal well-known SID Creator Owner ID (S-1-3-0) is
1237	* made up of the identifier authority SECURITY_CREATOR_SID_AUTHORITY (3) and
1238	* the relative identifier SECURITY_CREATOR_OWNER_RID (0).
1239	*/
1240	typedef enum { /* Identifier authority. */
1241	SECURITY_NULL_RID = 0, /* S-1-0 */
1242	SECURITY_WORLD_RID = 0, /* S-1-1 */
1243	SECURITY_LOCAL_RID = 0, /* S-1-2 */
1244
1245	SECURITY_CREATOR_OWNER_RID = 0, /* S-1-3 */
1246	SECURITY_CREATOR_GROUP_RID = 1, /* S-1-3 */
1247
1248	SECURITY_CREATOR_OWNER_SERVER_RID = 2, /* S-1-3 */
1249	SECURITY_CREATOR_GROUP_SERVER_RID = 3, /* S-1-3 */
1250
1251	SECURITY_DIALUP_RID = 1,
1252	SECURITY_NETWORK_RID = 2,
1253	SECURITY_BATCH_RID = 3,
1254	SECURITY_INTERACTIVE_RID = 4,
1255	SECURITY_SERVICE_RID = 6,
1256	SECURITY_ANONYMOUS_LOGON_RID = 7,
1257	SECURITY_PROXY_RID = 8,
1258	SECURITY_ENTERPRISE_CONTROLLERS_RID=9,
1259	SECURITY_SERVER_LOGON_RID = 9,
1260	SECURITY_PRINCIPAL_SELF_RID = 0xa,
1261	SECURITY_AUTHENTICATED_USER_RID = 0xb,
1262	SECURITY_RESTRICTED_CODE_RID = 0xc,
1263	SECURITY_TERMINAL_SERVER_RID = 0xd,
1264
1265	SECURITY_LOGON_IDS_RID = 5,
1266	SECURITY_LOGON_IDS_RID_COUNT = 3,
1267
1268	SECURITY_LOCAL_SYSTEM_RID = 0x12,
1269
1270	SECURITY_NT_NON_UNIQUE = 0x15,
1271
1272	SECURITY_BUILTIN_DOMAIN_RID = 0x20,
1273
1274	/*
1275	* Well-known domain relative sub-authority values (RIDs).
1276	*/
1277
1278	/* Users. */
1279	DOMAIN_USER_RID_ADMIN = 0x1f4,
1280	DOMAIN_USER_RID_GUEST = 0x1f5,
1281	DOMAIN_USER_RID_KRBTGT = 0x1f6,
1282
1283	/* Groups. */
1284	DOMAIN_GROUP_RID_ADMINS = 0x200,
1285	DOMAIN_GROUP_RID_USERS = 0x201,
1286	DOMAIN_GROUP_RID_GUESTS = 0x202,
1287	DOMAIN_GROUP_RID_COMPUTERS = 0x203,
1288	DOMAIN_GROUP_RID_CONTROLLERS = 0x204,
1289	DOMAIN_GROUP_RID_CERT_ADMINS = 0x205,
1290	DOMAIN_GROUP_RID_SCHEMA_ADMINS = 0x206,
1291	DOMAIN_GROUP_RID_ENTERPRISE_ADMINS= 0x207,
1292	DOMAIN_GROUP_RID_POLICY_ADMINS = 0x208,
1293
1294	/* Aliases. */
1295	DOMAIN_ALIAS_RID_ADMINS = 0x220,
1296	DOMAIN_ALIAS_RID_USERS = 0x221,
1297	DOMAIN_ALIAS_RID_GUESTS = 0x222,
1298	DOMAIN_ALIAS_RID_POWER_USERS = 0x223,
1299
1300	DOMAIN_ALIAS_RID_ACCOUNT_OPS = 0x224,
1301	DOMAIN_ALIAS_RID_SYSTEM_OPS = 0x225,
1302	DOMAIN_ALIAS_RID_PRINT_OPS = 0x226,
1303	DOMAIN_ALIAS_RID_BACKUP_OPS = 0x227,
1304
1305	DOMAIN_ALIAS_RID_REPLICATOR = 0x228,
1306	DOMAIN_ALIAS_RID_RAS_SERVERS = 0x229,
1307	DOMAIN_ALIAS_RID_PREW2KCOMPACCESS = 0x22a,
1308	} RELATIVE_IDENTIFIERS;
1309
1310	/*
1311	* The universal well-known SIDs:
1312	*
1313	* NULL_SID S-1-0-0
1314	* WORLD_SID S-1-1-0
1315	* LOCAL_SID S-1-2-0
1316	* CREATOR_OWNER_SID S-1-3-0
1317	* CREATOR_GROUP_SID S-1-3-1
1318	* CREATOR_OWNER_SERVER_SID S-1-3-2
1319	* CREATOR_GROUP_SERVER_SID S-1-3-3
1320	*
1321	* (Non-unique IDs) S-1-4
1322	*
1323	* NT well-known SIDs:
1324	*
1325	* NT_AUTHORITY_SID S-1-5
1326	* DIALUP_SID S-1-5-1
1327	*
1328	* NETWORD_SID S-1-5-2
1329	* BATCH_SID S-1-5-3
1330	* INTERACTIVE_SID S-1-5-4
1331	* SERVICE_SID S-1-5-6
1332	* ANONYMOUS_LOGON_SID S-1-5-7 (aka null logon session)
1333	* PROXY_SID S-1-5-8
1334	* SERVER_LOGON_SID S-1-5-9 (aka domain controller account)
1335	* SELF_SID S-1-5-10 (self RID)
1336	* AUTHENTICATED_USER_SID S-1-5-11
1337	* RESTRICTED_CODE_SID S-1-5-12 (running restricted code)
1338	* TERMINAL_SERVER_SID S-1-5-13 (running on terminal server)
1339	*
1340	* (Logon IDs) S-1-5-5-X-Y
1341	*
1342	* (NT non-unique IDs) S-1-5-0x15-...
1343	*
1344	* (Built-in domain) S-1-5-0x20
1345	*/
1346
1347	/**
1348	* union SID_IDENTIFIER_AUTHORITY - A 48-bit value used in the SID structure
1349	*
1350	* NOTE: This is stored as a big endian number.
1351	*/
1352	typedef union {
1353	struct {
1354	u16 high_part; /* High 16-bits. */
1355	u32 low_part; /* Low 32-bits. */
1356	} __attribute__((__packed__));
1357	u8 value[6]; /* Value as individual bytes. */
1358	} __attribute__((__packed__)) SID_IDENTIFIER_AUTHORITY;
1359
1360	/**
1361	* struct SID -
1362	*
1363	* The SID structure is a variable-length structure used to uniquely identify
1364	* users or groups. SID stands for security identifier.
1365	*
1366	* The standard textual representation of the SID is of the form:
1367	* S-R-I-S-S...
1368	* Where:
1369	* - The first "S" is the literal character 'S' identifying the following
1370	* digits as a SID.
1371	* - R is the revision level of the SID expressed as a sequence of digits
1372	* in decimal.
1373	* - I is the 48-bit identifier_authority, expressed as digits in decimal,
1374	* if I < 2^32, or hexadecimal prefixed by "0x", if I >= 2^32.
1375	* - S... is one or more sub_authority values, expressed as digits in
1376	* decimal.
1377	*
1378	* Example SID; the domain-relative SID of the local Administrators group on
1379	* Windows NT/2k:
1380	* S-1-5-32-544
1381	* This translates to a SID with:
1382	* revision = 1,
1383	* sub_authority_count = 2,
1384	* identifier_authority = {0,0,0,0,0,5}, // SECURITY_NT_AUTHORITY
1385	* sub_authority[0] = 32, // SECURITY_BUILTIN_DOMAIN_RID
1386	* sub_authority[1] = 544 // DOMAIN_ALIAS_RID_ADMINS
1387	*/
1388	typedef struct {
1389	u8 revision;
1390	u8 sub_authority_count;
1391	SID_IDENTIFIER_AUTHORITY identifier_authority;
1392	u32 sub_authority[1]; /* At least one sub_authority. */
1393	} __attribute__((__packed__)) SID;
1394
1395	/**
1396	* enum SID_CONSTANTS - Current constants for SIDs.
1397	*/
1398	typedef enum {
1399	SID_REVISION = 1, /* Current revision level. */
1400	SID_MAX_SUB_AUTHORITIES = 15, /* Maximum number of those. */
1401	SID_RECOMMENDED_SUB_AUTHORITIES = 1, /* Will change to around 6 in
1402	a future revision. */
1403	} SID_CONSTANTS;
1404
1405	/**
1406	* enum ACE_TYPES - The predefined ACE types (8-bit, see below).
1407	*/
1408	typedef enum {
1409	ACCESS_MIN_MS_ACE_TYPE = 0,
1410	ACCESS_ALLOWED_ACE_TYPE = 0,
1411	ACCESS_DENIED_ACE_TYPE = 1,
1412	SYSTEM_AUDIT_ACE_TYPE = 2,
1413	SYSTEM_ALARM_ACE_TYPE = 3, /* Not implemented as of Win2k. */
1414	ACCESS_MAX_MS_V2_ACE_TYPE = 3,
1415
1416	ACCESS_ALLOWED_COMPOUND_ACE_TYPE= 4,
1417	ACCESS_MAX_MS_V3_ACE_TYPE = 4,
1418
1419	/* The following are Win2k only. */
1420	ACCESS_MIN_MS_OBJECT_ACE_TYPE = 5,
1421	ACCESS_ALLOWED_OBJECT_ACE_TYPE = 5,
1422	ACCESS_DENIED_OBJECT_ACE_TYPE = 6,
1423	SYSTEM_AUDIT_OBJECT_ACE_TYPE = 7,
1424	SYSTEM_ALARM_OBJECT_ACE_TYPE = 8,
1425	ACCESS_MAX_MS_OBJECT_ACE_TYPE = 8,
1426
1427	ACCESS_MAX_MS_V4_ACE_TYPE = 8,
1428
1429	/* This one is for WinNT&2k. */
1430	ACCESS_MAX_MS_ACE_TYPE = 8,
1431	} __attribute__((__packed__)) ACE_TYPES;
1432
1433	/**
1434	* enum ACE_FLAGS - The ACE flags (8-bit) for audit and inheritance.
1435	*
1436	* SUCCESSFUL_ACCESS_ACE_FLAG is only used with system audit and alarm ACE
1437	* types to indicate that a message is generated (in Windows!) for successful
1438	* accesses.
1439	*
1440	* FAILED_ACCESS_ACE_FLAG is only used with system audit and alarm ACE types
1441	* to indicate that a message is generated (in Windows!) for failed accesses.
1442	*/
1443	typedef enum {
1444	/* The inheritance flags. */
1445	OBJECT_INHERIT_ACE = 0x01,
1446	CONTAINER_INHERIT_ACE = 0x02,
1447	NO_PROPAGATE_INHERIT_ACE = 0x04,
1448	INHERIT_ONLY_ACE = 0x08,
1449	INHERITED_ACE = 0x10, /* Win2k only. */
1450	VALID_INHERIT_FLAGS = 0x1f,
1451
1452	/* The audit flags. */
1453	SUCCESSFUL_ACCESS_ACE_FLAG = 0x40,
1454	FAILED_ACCESS_ACE_FLAG = 0x80,
1455	} __attribute__((__packed__)) ACE_FLAGS;
1456
1457	/**
1458	* struct ACE_HEADER -
1459	*
1460	* An ACE is an access-control entry in an access-control list (ACL).
1461	* An ACE defines access to an object for a specific user or group or defines
1462	* the types of access that generate system-administration messages or alarms
1463	* for a specific user or group. The user or group is identified by a security
1464	* identifier (SID).
1465	*
1466	* Each ACE starts with an ACE_HEADER structure (aligned on 4-byte boundary),
1467	* which specifies the type and size of the ACE. The format of the subsequent
1468	* data depends on the ACE type.
1469	*/
1470	typedef struct {
1471	ACE_TYPES type; /* Type of the ACE. */
1472	ACE_FLAGS flags; /* Flags describing the ACE. */
1473	u16 size; /* Size in bytes of the ACE. */
1474	} __attribute__((__packed__)) ACE_HEADER;
1475
1476	/**
1477	* enum ACCESS_MASK - The access mask (32-bit).
1478	*
1479	* Defines the access rights.
1480	*/
1481	typedef enum {
1482	/*
1483	* The specific rights (bits 0 to 15). Depend on the type of the
1484	* object being secured by the ACE.
1485	*/
1486
1487	/* Specific rights for files and directories are as follows: */
1488
1489	/* Right to read data from the file. (FILE) */
1490	FILE_READ_DATA = const_cpu_to_le32(0x00000001),
1491	/* Right to list contents of a directory. (DIRECTORY) */
1492	FILE_LIST_DIRECTORY = const_cpu_to_le32(0x00000001),
1493
1494	/* Right to write data to the file. (FILE) */
1495	FILE_WRITE_DATA = const_cpu_to_le32(0x00000002),
1496	/* Right to create a file in the directory. (DIRECTORY) */
1497	FILE_ADD_FILE = const_cpu_to_le32(0x00000002),
1498
1499	/* Right to append data to the file. (FILE) */
1500	FILE_APPEND_DATA = const_cpu_to_le32(0x00000004),
1501	/* Right to create a subdirectory. (DIRECTORY) */
1502	FILE_ADD_SUBDIRECTORY = const_cpu_to_le32(0x00000004),
1503
1504	/* Right to read extended attributes. (FILE/DIRECTORY) */
1505	FILE_READ_EA = const_cpu_to_le32(0x00000008),
1506
1507	/* Right to write extended attributes. (FILE/DIRECTORY) */
1508	FILE_WRITE_EA = const_cpu_to_le32(0x00000010),
1509
1510	/* Right to execute a file. (FILE) */
1511	FILE_EXECUTE = const_cpu_to_le32(0x00000020),
1512	/* Right to traverse the directory. (DIRECTORY) */
1513	FILE_TRAVERSE = const_cpu_to_le32(0x00000020),
1514
1515	/*
1516	* Right to delete a directory and all the files it contains (its
1517	* children), even if the files are read-only. (DIRECTORY)
1518	*/
1519	FILE_DELETE_CHILD = const_cpu_to_le32(0x00000040),
1520
1521	/* Right to read file attributes. (FILE/DIRECTORY) */
1522	FILE_READ_ATTRIBUTES = const_cpu_to_le32(0x00000080),
1523
1524	/* Right to change file attributes. (FILE/DIRECTORY) */
1525	FILE_WRITE_ATTRIBUTES = const_cpu_to_le32(0x00000100),
1526
1527	/*
1528	* The standard rights (bits 16 to 23). Are independent of the type of
1529	* object being secured.
1530	*/
1531
1532	/* Right to delete the object. */
1533	DELETE = const_cpu_to_le32(0x00010000),
1534
1535	/*
1536	* Right to read the information in the object's security descriptor,
1537	* not including the information in the SACL. I.e. right to read the
1538	* security descriptor and owner.
1539	*/
1540	READ_CONTROL = const_cpu_to_le32(0x00020000),
1541
1542	/* Right to modify the DACL in the object's security descriptor. */
1543	WRITE_DAC = const_cpu_to_le32(0x00040000),
1544
1545	/* Right to change the owner in the object's security descriptor. */
1546	WRITE_OWNER = const_cpu_to_le32(0x00080000),
1547
1548	/*
1549	* Right to use the object for synchronization. Enables a process to
1550	* wait until the object is in the signalled state. Some object types
1551	* do not support this access right.
1552	*/
1553	SYNCHRONIZE = const_cpu_to_le32(0x00100000),
1554
1555	/*
1556	* The following STANDARD_RIGHTS_* are combinations of the above for
1557	* convenience and are defined by the Win32 API.
1558	*/
1559
1560	/* These are currently defined to READ_CONTROL. */
1561	STANDARD_RIGHTS_READ = const_cpu_to_le32(0x00020000),
1562	STANDARD_RIGHTS_WRITE = const_cpu_to_le32(0x00020000),
1563	STANDARD_RIGHTS_EXECUTE = const_cpu_to_le32(0x00020000),
1564
1565	/* Combines DELETE, READ_CONTROL, WRITE_DAC, and WRITE_OWNER access. */
1566	STANDARD_RIGHTS_REQUIRED = const_cpu_to_le32(0x000f0000),
1567
1568	/*
1569	* Combines DELETE, READ_CONTROL, WRITE_DAC, WRITE_OWNER, and
1570	* SYNCHRONIZE access.
1571	*/
1572	STANDARD_RIGHTS_ALL = const_cpu_to_le32(0x001f0000),
1573
1574	/*
1575	* The access system ACL and maximum allowed access types (bits 24 to
1576	* 25, bits 26 to 27 are reserved).
1577	*/
1578	ACCESS_SYSTEM_SECURITY = const_cpu_to_le32(0x01000000),
1579	MAXIMUM_ALLOWED = const_cpu_to_le32(0x02000000),
1580
1581	/*
1582	* The generic rights (bits 28 to 31). These map onto the standard and
1583	* specific rights.
1584	*/
1585
1586	/* Read, write, and execute access. */
1587	GENERIC_ALL = const_cpu_to_le32(0x10000000),
1588
1589	/* Execute access. */
1590	GENERIC_EXECUTE = const_cpu_to_le32(0x20000000),
1591
1592	/*
1593	* Write access. For files, this maps onto:
1594	* FILE_APPEND_DATA | FILE_WRITE_ATTRIBUTES | FILE_WRITE_DATA |
1595	* FILE_WRITE_EA | STANDARD_RIGHTS_WRITE | SYNCHRONIZE
1596	* For directories, the mapping has the same numerical value. See
1597	* above for the descriptions of the rights granted.
1598	*/
1599	GENERIC_WRITE = const_cpu_to_le32(0x40000000),
1600
1601	/*
1602	* Read access. For files, this maps onto:
1603	* FILE_READ_ATTRIBUTES | FILE_READ_DATA | FILE_READ_EA |
1604	* STANDARD_RIGHTS_READ | SYNCHRONIZE
1605	* For directories, the mapping has the same numerical value. See
1606	* above for the descriptions of the rights granted.
1607	*/
1608	GENERIC_READ = const_cpu_to_le32(0x80000000),
1609	} ACCESS_MASK;
1610
1611	/**
1612	* struct GENERIC_MAPPING -
1613	*
1614	* The generic mapping array. Used to denote the mapping of each generic
1615	* access right to a specific access mask.
1616	*
1617	* FIXME: What exactly is this and what is it for? (AIA)
1618	*/
1619	typedef struct {
1620	ACCESS_MASK generic_read;
1621	ACCESS_MASK generic_write;
1622	ACCESS_MASK generic_execute;
1623	ACCESS_MASK generic_all;
1624	} __attribute__((__packed__)) GENERIC_MAPPING;
1625
1626	/*
1627	* The predefined ACE type structures are as defined below.
1628	*/
1629
1630	/**
1631	* struct ACCESS_DENIED_ACE -
1632	*
1633	* ACCESS_ALLOWED_ACE, ACCESS_DENIED_ACE, SYSTEM_AUDIT_ACE, SYSTEM_ALARM_ACE
1634	*/
1635	typedef struct {
1636	/* 0 ACE_HEADER; -- Unfolded here as gcc doesn't like unnamed structs. */
1637	ACE_TYPES type; /* Type of the ACE. */
1638	ACE_FLAGS flags; /* Flags describing the ACE. */
1639	u16 size; /* Size in bytes of the ACE. */
1640
1641	/* 4*/ ACCESS_MASK mask; /* Access mask associated with the ACE. */
1642	/* 8*/ SID sid; /* The SID associated with the ACE. */
1643	} __attribute__((__packed__)) ACCESS_ALLOWED_ACE, ACCESS_DENIED_ACE,
1644	SYSTEM_AUDIT_ACE, SYSTEM_ALARM_ACE;
1645
1646	/**
1647	* enum OBJECT_ACE_FLAGS - The object ACE flags (32-bit).
1648	*/
1649	typedef enum {
1650	ACE_OBJECT_TYPE_PRESENT = const_cpu_to_le32(1),
1651	ACE_INHERITED_OBJECT_TYPE_PRESENT = const_cpu_to_le32(2),
1652	} OBJECT_ACE_FLAGS;
1653
1654	/**
1655	* struct ACCESS_ALLOWED_OBJECT_ACE -
1656	*/
1657	typedef struct {
1658	/* 0 ACE_HEADER; -- Unfolded here as gcc doesn't like unnamed structs. */
1659	ACE_TYPES type; /* Type of the ACE. */
1660	ACE_FLAGS flags; /* Flags describing the ACE. */
1661	u16 size; /* Size in bytes of the ACE. */
1662
1663	/* 4*/ ACCESS_MASK mask; /* Access mask associated with the ACE. */
1664	/* 8*/ OBJECT_ACE_FLAGS object_flags; /* Flags describing the object ACE. */
1665	/* 12*/ GUID object_type;
1666	/* 28*/ GUID inherited_object_type;
1667	/* 44*/ SID sid; /* The SID associated with the ACE. */
1668	} __attribute__((__packed__)) ACCESS_ALLOWED_OBJECT_ACE,
1669	ACCESS_DENIED_OBJECT_ACE,
1670	SYSTEM_AUDIT_OBJECT_ACE,
1671	SYSTEM_ALARM_OBJECT_ACE;
1672
1673	/**
1674	* struct ACL - An ACL is an access-control list (ACL).
1675	*
1676	* An ACL starts with an ACL header structure, which specifies the size of
1677	* the ACL and the number of ACEs it contains. The ACL header is followed by
1678	* zero or more access control entries (ACEs). The ACL as well as each ACE
1679	* are aligned on 4-byte boundaries.
1680	*/
1681	typedef struct {
1682	u8 revision; /* Revision of this ACL. */
1683	u8 alignment1;
1684	u16 size; /* Allocated space in bytes for ACL. Includes this
1685	header, the ACEs and the remaining free space. */
1686	u16 ace_count; /* Number of ACEs in the ACL. */
1687	u16 alignment2;
1688	/* sizeof() = 8 bytes */
1689	} __attribute__((__packed__)) ACL;
1690
1691	/**
1692	* enum ACL_CONSTANTS - Current constants for ACLs.
1693	*/
1694	typedef enum {
1695	/* Current revision. */
1696	ACL_REVISION = 2,
1697	ACL_REVISION_DS = 4,
1698
1699	/* History of revisions. */
1700	ACL_REVISION1 = 1,
1701	MIN_ACL_REVISION = 2,
1702	ACL_REVISION2 = 2,
1703	ACL_REVISION3 = 3,
1704	ACL_REVISION4 = 4,
1705	MAX_ACL_REVISION = 4,
1706	} ACL_CONSTANTS;
1707
1708	/**
1709	* enum SECURITY_DESCRIPTOR_CONTROL -
1710	*
1711	* The security descriptor control flags (16-bit).
1712	*
1713	* SE_OWNER_DEFAULTED - This boolean flag, when set, indicates that the
1714	* SID pointed to by the Owner field was provided by a
1715	* defaulting mechanism rather than explicitly provided by the
1716	* original provider of the security descriptor. This may
1717	* affect the treatment of the SID with respect to inheritance
1718	* of an owner.
1719	*
1720	* SE_GROUP_DEFAULTED - This boolean flag, when set, indicates that the
1721	* SID in the Group field was provided by a defaulting mechanism
1722	* rather than explicitly provided by the original provider of
1723	* the security descriptor. This may affect the treatment of
1724	* the SID with respect to inheritance of a primary group.
1725	*
1726	* SE_DACL_PRESENT - This boolean flag, when set, indicates that the
1727	* security descriptor contains a discretionary ACL. If this
1728	* flag is set and the Dacl field of the SECURITY_DESCRIPTOR is
1729	* null, then a null ACL is explicitly being specified.
1730	*
1731	* SE_DACL_DEFAULTED - This boolean flag, when set, indicates that the
1732	* ACL pointed to by the Dacl field was provided by a defaulting
1733	* mechanism rather than explicitly provided by the original
1734	* provider of the security descriptor. This may affect the
1735	* treatment of the ACL with respect to inheritance of an ACL.
1736	* This flag is ignored if the DaclPresent flag is not set.
1737	*
1738	* SE_SACL_PRESENT - This boolean flag, when set, indicates that the
1739	* security descriptor contains a system ACL pointed to by the
1740	* Sacl field. If this flag is set and the Sacl field of the
1741	* SECURITY_DESCRIPTOR is null, then an empty (but present)
1742	* ACL is being specified.
1743	*
1744	* SE_SACL_DEFAULTED - This boolean flag, when set, indicates that the
1745	* ACL pointed to by the Sacl field was provided by a defaulting
1746	* mechanism rather than explicitly provided by the original
1747	* provider of the security descriptor. This may affect the
1748	* treatment of the ACL with respect to inheritance of an ACL.
1749	* This flag is ignored if the SaclPresent flag is not set.
1750	*
1751	* SE_SELF_RELATIVE - This boolean flag, when set, indicates that the
1752	* security descriptor is in self-relative form. In this form,
1753	* all fields of the security descriptor are contiguous in memory
1754	* and all pointer fields are expressed as offsets from the
1755	* beginning of the security descriptor.
1756	*/
1757	typedef enum {
1758	SE_OWNER_DEFAULTED = const_cpu_to_le16(0x0001),
1759	SE_GROUP_DEFAULTED = const_cpu_to_le16(0x0002),
1760	SE_DACL_PRESENT = const_cpu_to_le16(0x0004),
1761	SE_DACL_DEFAULTED = const_cpu_to_le16(0x0008),
1762	SE_SACL_PRESENT = const_cpu_to_le16(0x0010),
1763	SE_SACL_DEFAULTED = const_cpu_to_le16(0x0020),
1764	SE_DACL_AUTO_INHERIT_REQ = const_cpu_to_le16(0x0100),
1765	SE_SACL_AUTO_INHERIT_REQ = const_cpu_to_le16(0x0200),
1766	SE_DACL_AUTO_INHERITED = const_cpu_to_le16(0x0400),
1767	SE_SACL_AUTO_INHERITED = const_cpu_to_le16(0x0800),
1768	SE_DACL_PROTECTED = const_cpu_to_le16(0x1000),
1769	SE_SACL_PROTECTED = const_cpu_to_le16(0x2000),
1770	SE_RM_CONTROL_VALID = const_cpu_to_le16(0x4000),
1771	SE_SELF_RELATIVE = const_cpu_to_le16(0x8000),
1772	} __attribute__((__packed__)) SECURITY_DESCRIPTOR_CONTROL;
1773
1774	/**
1775	* struct SECURITY_DESCRIPTOR_RELATIVE -
1776	*
1777	* Self-relative security descriptor. Contains the owner and group SIDs as well
1778	* as the sacl and dacl ACLs inside the security descriptor itself.
1779	*/
1780	typedef struct {
1781	u8 revision; /* Revision level of the security descriptor. */
1782	u8 alignment;
1783	SECURITY_DESCRIPTOR_CONTROL control; /* Flags qualifying the type of
1784	the descriptor as well as the following fields. */
1785	u32 owner; /* Byte offset to a SID representing an object's
1786	owner. If this is NULL, no owner SID is present in
1787	the descriptor. */
1788	u32 group; /* Byte offset to a SID representing an object's
1789	primary group. If this is NULL, no primary group
1790	SID is present in the descriptor. */
1791	u32 sacl; /* Byte offset to a system ACL. Only valid, if
1792	SE_SACL_PRESENT is set in the control field. If
1793	SE_SACL_PRESENT is set but sacl is NULL, a NULL ACL
1794	is specified. */
1795	u32 dacl; /* Byte offset to a discretionary ACL. Only valid, if
1796	SE_DACL_PRESENT is set in the control field. If
1797	SE_DACL_PRESENT is set but dacl is NULL, a NULL ACL
1798	(unconditionally granting access) is specified. */
1799	/* sizeof() = 0x14 bytes */
1800	} __attribute__((__packed__)) SECURITY_DESCRIPTOR_RELATIVE;
1801
1802	/**
1803	* struct SECURITY_DESCRIPTOR - Absolute security descriptor.
1804	*
1805	* Does not contain the owner and group SIDs, nor the sacl and dacl ACLs inside
1806	* the security descriptor. Instead, it contains pointers to these structures
1807	* in memory. Obviously, absolute security descriptors are only useful for in
1808	* memory representations of security descriptors.
1809	*
1810	* On disk, a self-relative security descriptor is used.
1811	*/
1812	typedef struct {
1813	u8 revision; /* Revision level of the security descriptor. */
1814	u8 alignment;
1815	SECURITY_DESCRIPTOR_CONTROL control; /* Flags qualifying the type of
1816	the descriptor as well as the following fields. */
1817	SID *owner; /* Points to a SID representing an object's owner. If
1818	this is NULL, no owner SID is present in the
1819	descriptor. */
1820	SID *group; /* Points to a SID representing an object's primary
1821	group. If this is NULL, no primary group SID is
1822	present in the descriptor. */
1823	ACL *sacl; /* Points to a system ACL. Only valid, if
1824	SE_SACL_PRESENT is set in the control field. If
1825	SE_SACL_PRESENT is set but sacl is NULL, a NULL ACL
1826	is specified. */
1827	ACL *dacl; /* Points to a discretionary ACL. Only valid, if
1828	SE_DACL_PRESENT is set in the control field. If
1829	SE_DACL_PRESENT is set but dacl is NULL, a NULL ACL
1830	(unconditionally granting access) is specified. */
1831	} __attribute__((__packed__)) SECURITY_DESCRIPTOR;
1832
1833	/**
1834	* enum SECURITY_DESCRIPTOR_CONSTANTS -
1835	*
1836	* Current constants for security descriptors.
1837	*/
1838	typedef enum {
1839	/* Current revision. */
1840	SECURITY_DESCRIPTOR_REVISION = 1,
1841	SECURITY_DESCRIPTOR_REVISION1 = 1,
1842
1843	/* The sizes of both the absolute and relative security descriptors is
1844	the same as pointers, at least on ia32 architecture are 32-bit. */
1845	SECURITY_DESCRIPTOR_MIN_LENGTH = sizeof(SECURITY_DESCRIPTOR),
1846	} SECURITY_DESCRIPTOR_CONSTANTS;
1847
1848	/*
1849	* Attribute: Security descriptor (0x50).
1850	*
1851	* A standard self-relative security descriptor.
1852	*
1853	* NOTE: Can be resident or non-resident.
1854	* NOTE: Not used in NTFS 3.0+, as security descriptors are stored centrally
1855	* in FILE_Secure and the correct descriptor is found using the security_id
1856	* from the standard information attribute.
1857	*/
1858	typedef SECURITY_DESCRIPTOR_RELATIVE SECURITY_DESCRIPTOR_ATTR;
1859
1860	/*
1861	* On NTFS 3.0+, all security descriptors are stored in FILE_Secure. Only one
1862	* referenced instance of each unique security descriptor is stored.
1863	*
1864	* FILE_Secure contains no unnamed data attribute, i.e. it has zero length. It
1865	* does, however, contain two indexes ($SDH and $SII) as well as a named data
1866	* stream ($SDS).
1867	*
1868	* Every unique security descriptor is assigned a unique security identifier
1869	* (security_id, not to be confused with a SID). The security_id is unique for
1870	* the NTFS volume and is used as an index into the $SII index, which maps
1871	* security_ids to the security descriptor's storage location within the $SDS
1872	* data attribute. The $SII index is sorted by ascending security_id.
1873	*
1874	* A simple hash is computed from each security descriptor. This hash is used
1875	* as an index into the $SDH index, which maps security descriptor hashes to
1876	* the security descriptor's storage location within the $SDS data attribute.
1877	* The $SDH index is sorted by security descriptor hash and is stored in a B+
1878	* tree. When searching $SDH (with the intent of determining whether or not a
1879	* new security descriptor is already present in the $SDS data stream), if a
1880	* matching hash is found, but the security descriptors do not match, the
1881	* search in the $SDH index is continued, searching for a next matching hash.
1882	*
1883	* When a precise match is found, the security_id corresponding to the security
1884	* descriptor in the $SDS attribute is read from the found $SDH index entry and
1885	* is stored in the $STANDARD_INFORMATION attribute of the file/directory to
1886	* which the security descriptor is being applied. The $STANDARD_INFORMATION
1887	* attribute is present in all base mft records (i.e. in all files and
1888	* directories).
1889	*
1890	* If a match is not found, the security descriptor is assigned a new unique
1891	* security_id and is added to the $SDS data attribute. Then, entries
1892	* referencing the this security descriptor in the $SDS data attribute are
1893	* added to the $SDH and $SII indexes.
1894	*
1895	* Note: Entries are never deleted from FILE_Secure, even if nothing
1896	* references an entry any more.
1897	*/
1898
1899	/**
1900	* struct SECURITY_DESCRIPTOR_HEADER -
1901	*
1902	* This header precedes each security descriptor in the $SDS data stream.
1903	* This is also the index entry data part of both the $SII and $SDH indexes.
1904	*/
1905	typedef struct {
1906	u32 hash; /* Hash of the security descriptor. */
1907	u32 security_id; /* The security_id assigned to the descriptor. */
1908	u64 offset; /* Byte offset of this entry in the $SDS stream. */
1909	u32 length; /* Size in bytes of this entry in $SDS stream. */
1910	} __attribute__((__packed__)) SECURITY_DESCRIPTOR_HEADER;
1911
1912	/**
1913	* struct SDH_INDEX_DATA -
1914	*/
1915	typedef struct {
1916	u32 hash; /* Hash of the security descriptor. */
1917	u32 security_id; /* The security_id assigned to the descriptor. */
1918	u64 offset; /* Byte offset of this entry in the $SDS stream. */
1919	u32 length; /* Size in bytes of this entry in $SDS stream. */
1920	u32 reserved_II; /* Padding - always unicode "II" or zero. This field
1921	isn't counted in INDEX_ENTRY's data_length. */
1922	} __attribute__((__packed__)) SDH_INDEX_DATA;
1923
1924	/**
1925	* struct SII_INDEX_DATA -
1926	*/
1927	typedef SECURITY_DESCRIPTOR_HEADER SII_INDEX_DATA;
1928
1929	/**
1930	* struct SDS_ENTRY -
1931	*
1932	* The $SDS data stream contains the security descriptors, aligned on 16-byte
1933	* boundaries, sorted by security_id in a B+ tree. Security descriptors cannot
1934	* cross 256kib boundaries (this restriction is imposed by the Windows cache
1935	* manager). Each security descriptor is contained in a SDS_ENTRY structure.
1936	* Also, each security descriptor is stored twice in the $SDS stream with a
1937	* fixed offset of 0x40000 bytes (256kib, the Windows cache manager's max size)
1938	* between them; i.e. if a SDS_ENTRY specifies an offset of 0x51d0, then the
1939	* the first copy of the security descriptor will be at offset 0x51d0 in the
1940	* $SDS data stream and the second copy will be at offset 0x451d0.
1941	*/
1942	typedef struct {
1943	/* 0 SECURITY_DESCRIPTOR_HEADER; -- Unfolded here as gcc doesn't like
1944	unnamed structs. */
1945	u32 hash; /* Hash of the security descriptor. */
1946	u32 security_id; /* The security_id assigned to the descriptor. */
1947	u64 offset; /* Byte offset of this entry in the $SDS stream. */
1948	u32 length; /* Size in bytes of this entry in $SDS stream. */
1949	/* 20*/ SECURITY_DESCRIPTOR_RELATIVE sid; /* The self-relative security
1950	descriptor. */
1951	} __attribute__((__packed__)) SDS_ENTRY;
1952
1953	/**
1954	* struct SII_INDEX_KEY - The index entry key used in the $SII index.
1955	*
1956	* The collation type is COLLATION_NTOFS_ULONG.
1957	*/
1958	typedef struct {
1959	u32 security_id; /* The security_id assigned to the descriptor. */
1960	} __attribute__((__packed__)) SII_INDEX_KEY;
1961
1962	/**
1963	* struct SDH_INDEX_KEY - The index entry key used in the $SDH index.
1964	*
1965	* The keys are sorted first by hash and then by security_id.
1966	* The collation rule is COLLATION_NTOFS_SECURITY_HASH.
1967	*/
1968	typedef struct {
1969	u32 hash; /* Hash of the security descriptor. */
1970	u32 security_id; /* The security_id assigned to the descriptor. */
1971	} __attribute__((__packed__)) SDH_INDEX_KEY;
1972
1973	/**
1974	* struct VOLUME_NAME - Attribute: Volume name (0x60).
1975	*
1976	* NOTE: Always resident.
1977	* NOTE: Present only in FILE_Volume.
1978	*/
1979	typedef struct {
1980	ntfschar name[0]; /* The name of the volume in Unicode. */
1981	} __attribute__((__packed__)) VOLUME_NAME;
1982
1983	/**
1984	* enum VOLUME_FLAGS - Possible flags for the volume (16-bit).
1985	*/
1986	typedef enum {
1987	VOLUME_IS_DIRTY = const_cpu_to_le16(0x0001),
1988	VOLUME_RESIZE_LOG_FILE = const_cpu_to_le16(0x0002),
1989	VOLUME_UPGRADE_ON_MOUNT = const_cpu_to_le16(0x0004),
1990	VOLUME_MOUNTED_ON_NT4 = const_cpu_to_le16(0x0008),
1991	VOLUME_DELETE_USN_UNDERWAY = const_cpu_to_le16(0x0010),
1992	VOLUME_REPAIR_OBJECT_ID = const_cpu_to_le16(0x0020),
1993	VOLUME_CHKDSK_UNDERWAY = const_cpu_to_le16(0x4000),
1994	VOLUME_MODIFIED_BY_CHKDSK = const_cpu_to_le16(0x8000),
1995	VOLUME_FLAGS_MASK = const_cpu_to_le16(0xc03f),
1996	} __attribute__((__packed__)) VOLUME_FLAGS;
1997
1998	/**
1999	* struct VOLUME_INFORMATION - Attribute: Volume information (0x70).
2000	*
2001	* NOTE: Always resident.
2002	* NOTE: Present only in FILE_Volume.
2003	* NOTE: Windows 2000 uses NTFS 3.0 while Windows NT4 service pack 6a uses
2004	* NTFS 1.2. I haven't personally seen other values yet.
2005	*/
2006	typedef struct {
2007	u64 reserved; /* Not used (yet?). */
2008	u8 major_ver; /* Major version of the ntfs format. */
2009	u8 minor_ver; /* Minor version of the ntfs format. */
2010	VOLUME_FLAGS flags; /* Bit array of VOLUME_* flags. */
2011	} __attribute__((__packed__)) VOLUME_INFORMATION;
2012
2013	/**
2014	* struct DATA_ATTR - Attribute: Data attribute (0x80).
2015	*
2016	* NOTE: Can be resident or non-resident.
2017	*
2018	* Data contents of a file (i.e. the unnamed stream) or of a named stream.
2019	*/
2020	typedef struct {
2021	u8 data[0]; /* The file's data contents. */
2022	} __attribute__((__packed__)) DATA_ATTR;
2023
2024	/**
2025	* enum INDEX_HEADER_FLAGS - Index header flags (8-bit).
2026	*/
2027	typedef enum {
2028	/* When index header is in an index root attribute: */
2029	SMALL_INDEX = 0, /* The index is small enough to fit inside the
2030	index root attribute and there is no index
2031	allocation attribute present. */
2032	LARGE_INDEX = 1, /* The index is too large to fit in the index
2033	root attribute and/or an index allocation
2034	attribute is present. */
2035	/*
2036	* When index header is in an index block, i.e. is part of index
2037	* allocation attribute:
2038	*/
2039	LEAF_NODE = 0, /* This is a leaf node, i.e. there are no more
2040	nodes branching off it. */
2041	INDEX_NODE = 1, /* This node indexes other nodes, i.e. is not a
2042	leaf node. */
2043	NODE_MASK = 1, /* Mask for accessing the *_NODE bits. */
2044	} __attribute__((__packed__)) INDEX_HEADER_FLAGS;
2045
2046	/**
2047	* struct INDEX_HEADER -
2048	*
2049	* This is the header for indexes, describing the INDEX_ENTRY records, which
2050	* follow the INDEX_HEADER. Together the index header and the index entries
2051	* make up a complete index.
2052	*
2053	* IMPORTANT NOTE: The offset, length and size structure members are counted
2054	* relative to the start of the index header structure and not relative to the
2055	* start of the index root or index allocation structures themselves.
2056	*/
2057	typedef struct {
2058	/* 0*/ u32 entries_offset; /* Byte offset from the INDEX_HEADER to first
2059	INDEX_ENTRY, aligned to 8-byte boundary. */
2060	/* 4*/ u32 index_length; /* Data size in byte of the INDEX_ENTRY's,
2061	including the INDEX_HEADER, aligned to 8. */
2062	/* 8*/ u32 allocated_size; /* Allocated byte size of this index (block),
2063	multiple of 8 bytes. See more below. */
2064	/*
2065	For the index root attribute, the above two numbers are always
2066	equal, as the attribute is resident and it is resized as needed.
2067
2068	For the index allocation attribute, the attribute is not resident
2069	and the allocated_size is equal to the index_block_size specified
2070	by the corresponding INDEX_ROOT attribute minus the INDEX_BLOCK
2071	size not counting the INDEX_HEADER part (i.e. minus -24).
2072	*/
2073	/* 12*/ INDEX_HEADER_FLAGS ih_flags; /* Bit field of INDEX_HEADER_FLAGS. */
2074	/* 13*/ u8 reserved[3]; /* Reserved/align to 8-byte boundary.*/
2075	/* sizeof() == 16 */
2076	} __attribute__((__packed__)) INDEX_HEADER;
2077
2078	/**
2079	* struct INDEX_ROOT - Attribute: Index root (0x90).
2080	*
2081	* NOTE: Always resident.
2082	*
2083	* This is followed by a sequence of index entries (INDEX_ENTRY structures)
2084	* as described by the index header.
2085	*
2086	* When a directory is small enough to fit inside the index root then this
2087	* is the only attribute describing the directory. When the directory is too
2088	* large to fit in the index root, on the other hand, two additional attributes
2089	* are present: an index allocation attribute, containing sub-nodes of the B+
2090	* directory tree (see below), and a bitmap attribute, describing which virtual
2091	* cluster numbers (vcns) in the index allocation attribute are in use by an
2092	* index block.
2093	*
2094	* NOTE: The root directory (FILE_root) contains an entry for itself. Other
2095	* directories do not contain entries for themselves, though.
2096	*/
2097	typedef struct {
2098	/* 0*/ ATTR_TYPES type; /* Type of the indexed attribute. Is
2099	$FILE_NAME for directories, zero
2100	for view indexes. No other values
2101	allowed. */
2102	/* 4*/ COLLATION_RULES collation_rule; /* Collation rule used to sort the
2103	index entries. If type is $FILE_NAME,
2104	this must be COLLATION_FILE_NAME. */
2105	/* 8*/ u32 index_block_size; /* Size of index block in bytes (in
2106	the index allocation attribute). */
2107	/* 12*/ s8 clusters_per_index_block; /* Size of index block in clusters (in
2108	the index allocation attribute), when
2109	an index block is >= than a cluster,
2110	otherwise sectors per index block. */
2111	/* 13*/ u8 reserved[3]; /* Reserved/align to 8-byte boundary. */
2112	/* 16*/ INDEX_HEADER index; /* Index header describing the
2113	following index entries. */
2114	/* sizeof()= 32 bytes */
2115	} __attribute__((__packed__)) INDEX_ROOT;
2116
2117	/**
2118	* struct INDEX_BLOCK - Attribute: Index allocation (0xa0).
2119	*
2120	* NOTE: Always non-resident (doesn't make sense to be resident anyway!).
2121	*
2122	* This is an array of index blocks. Each index block starts with an
2123	* INDEX_BLOCK structure containing an index header, followed by a sequence of
2124	* index entries (INDEX_ENTRY structures), as described by the INDEX_HEADER.
2125	*/
2126	typedef struct {
2127	/* 0 NTFS_RECORD; -- Unfolded here as gcc doesn't like unnamed structs. */
2128	NTFS_RECORD_TYPES magic;/* Magic is "INDX". */
2129	u16 usa_ofs; /* See NTFS_RECORD definition. */
2130	u16 usa_count; /* See NTFS_RECORD definition. */
2131
2132	/* 8*/ LSN lsn; /* $LogFile sequence number of the last
2133	modification of this index block. */
2134	/* 16*/ VCN index_block_vcn; /* Virtual cluster number of the index block. */
2135	/* 24*/ INDEX_HEADER index; /* Describes the following index entries. */
2136	/* sizeof()= 40 (0x28) bytes */
2137	/*
2138	* When creating the index block, we place the update sequence array at this
2139	* offset, i.e. before we start with the index entries. This also makes sense,
2140	* otherwise we could run into problems with the update sequence array
2141	* containing in itself the last two bytes of a sector which would mean that
2142	* multi sector transfer protection wouldn't work. As you can't protect data
2143	* by overwriting it since you then can't get it back...
2144	* When reading use the data from the ntfs record header.
2145	*/
2146	} __attribute__((__packed__)) INDEX_BLOCK;
2147
2148	typedef INDEX_BLOCK INDEX_ALLOCATION;
2149
2150	/**
2151	* struct REPARSE_INDEX_KEY -
2152	*
2153	* The system file FILE_Extend/$Reparse contains an index named $R listing
2154	* all reparse points on the volume. The index entry keys are as defined
2155	* below. Note, that there is no index data associated with the index entries.
2156	*
2157	* The index entries are sorted by the index key file_id. The collation rule is
2158	* COLLATION_NTOFS_ULONGS. FIXME: Verify whether the reparse_tag is not the
2159	* primary key / is not a key at all. (AIA)
2160	*/
2161	typedef struct {
2162	u32 reparse_tag; /* Reparse point type (inc. flags). */
2163	MFT_REF file_id; /* Mft record of the file containing the
2164	reparse point attribute. */
2165	} __attribute__((__packed__)) REPARSE_INDEX_KEY;
2166
2167	/**
2168	* enum QUOTA_FLAGS - Quota flags (32-bit).
2169	*/
2170	typedef enum {
2171	/* The user quota flags. Names explain meaning. */
2172	QUOTA_FLAG_DEFAULT_LIMITS = const_cpu_to_le32(0x00000001),
2173	QUOTA_FLAG_LIMIT_REACHED = const_cpu_to_le32(0x00000002),
2174	QUOTA_FLAG_ID_DELETED = const_cpu_to_le32(0x00000004),
2175
2176	QUOTA_FLAG_USER_MASK = const_cpu_to_le32(0x00000007),
2177	/* Bit mask for user quota flags. */
2178
2179	/* These flags are only present in the quota defaults index entry,
2180	i.e. in the entry where owner_id = QUOTA_DEFAULTS_ID. */
2181	QUOTA_FLAG_TRACKING_ENABLED = const_cpu_to_le32(0x00000010),
2182	QUOTA_FLAG_ENFORCEMENT_ENABLED = const_cpu_to_le32(0x00000020),
2183	QUOTA_FLAG_TRACKING_REQUESTED = const_cpu_to_le32(0x00000040),
2184	QUOTA_FLAG_LOG_THRESHOLD = const_cpu_to_le32(0x00000080),
2185	QUOTA_FLAG_LOG_LIMIT = const_cpu_to_le32(0x00000100),
2186	QUOTA_FLAG_OUT_OF_DATE = const_cpu_to_le32(0x00000200),
2187	QUOTA_FLAG_CORRUPT = const_cpu_to_le32(0x00000400),
2188	QUOTA_FLAG_PENDING_DELETES = const_cpu_to_le32(0x00000800),
2189	} QUOTA_FLAGS;
2190
2191	/**
2192	* struct QUOTA_CONTROL_ENTRY -
2193	*
2194	* The system file FILE_Extend/$Quota contains two indexes $O and $Q. Quotas
2195	* are on a per volume and per user basis.
2196	*
2197	* The $Q index contains one entry for each existing user_id on the volume. The
2198	* index key is the user_id of the user/group owning this quota control entry,
2199	* i.e. the key is the owner_id. The user_id of the owner of a file, i.e. the
2200	* owner_id, is found in the standard information attribute. The collation rule
2201	* for $Q is COLLATION_NTOFS_ULONG.
2202	*
2203	* The $O index contains one entry for each user/group who has been assigned
2204	* a quota on that volume. The index key holds the SID of the user_id the
2205	* entry belongs to, i.e. the owner_id. The collation rule for $O is
2206	* COLLATION_NTOFS_SID.
2207	*
2208	* The $O index entry data is the user_id of the user corresponding to the SID.
2209	* This user_id is used as an index into $Q to find the quota control entry
2210	* associated with the SID.
2211	*
2212	* The $Q index entry data is the quota control entry and is defined below.
2213	*/
2214	typedef struct {
2215	u32 version; /* Currently equals 2. */
2216	QUOTA_FLAGS flags; /* Flags describing this quota entry. */
2217	u64 bytes_used; /* How many bytes of the quota are in use. */
2218	s64 change_time; /* Last time this quota entry was changed. */
2219	s64 threshold; /* Soft quota (-1 if not limited). */
2220	s64 limit; /* Hard quota (-1 if not limited). */
2221	s64 exceeded_time; /* How long the soft quota has been exceeded. */
2222	/* The below field is NOT present for the quota defaults entry. */
2223	SID sid; /* The SID of the user/object associated with
2224	this quota entry. If this field is missing
2225	then the INDEX_ENTRY is padded with zeros
2226	to multiply of 8 which are not counted in
2227	the data_length field. If the sid is present
2228	then this structure is padded with zeros to
2229	multiply of 8 and the padding is counted in
2230	the INDEX_ENTRY's data_length. */
2231	} __attribute__((__packed__)) QUOTA_CONTROL_ENTRY;
2232
2233	/**
2234	* struct QUOTA_O_INDEX_DATA -
2235	*/
2236	typedef struct {
2237	u32 owner_id;
2238	u32 unknown; /* Always 32. Seems to be padding and it's not
2239	counted in the INDEX_ENTRY's data_length.
2240	This field shouldn't be really here. */
2241	} __attribute__((__packed__)) QUOTA_O_INDEX_DATA;
2242
2243	/**
2244	* enum PREDEFINED_OWNER_IDS - Predefined owner_id values (32-bit).
2245	*/
2246	typedef enum {
2247	QUOTA_INVALID_ID = const_cpu_to_le32(0x00000000),
2248	QUOTA_DEFAULTS_ID = const_cpu_to_le32(0x00000001),
2249	QUOTA_FIRST_USER_ID = const_cpu_to_le32(0x00000100),
2250	} PREDEFINED_OWNER_IDS;
2251
2252	/**
2253	* enum INDEX_ENTRY_FLAGS - Index entry flags (16-bit).
2254	*/
2255	typedef enum {
2256	INDEX_ENTRY_NODE = const_cpu_to_le16(1), /* This entry contains a
2257	sub-node, i.e. a reference to an index
2258	block in form of a virtual cluster
2259	number (see below). */
2260	INDEX_ENTRY_END = const_cpu_to_le16(2), /* This signifies the last
2261	entry in an index block. The index
2262	entry does not represent a file but it
2263	can point to a sub-node. */
2264	INDEX_ENTRY_SPACE_FILLER = 0xffff, /* Just to force 16-bit width. */
2265	} __attribute__((__packed__)) INDEX_ENTRY_FLAGS;
2266
2267	/**
2268	* struct INDEX_ENTRY_HEADER - This the index entry header (see below).
2269	*
2270	* ==========================================================
2271	* !!!!! SEE DESCRIPTION OF THE FIELDS AT INDEX_ENTRY !!!!!
2272	* ==========================================================
2273	*/
2274	typedef struct {
2275	/* 0*/ union {
2276	MFT_REF indexed_file;
2277	struct {
2278	u16 data_offset;
2279	u16 data_length;
2280	u32 reservedV;
2281	} __attribute__((__packed__));
2282	} __attribute__((__packed__));
2283	/* 8*/ u16 length;
2284	/* 10*/ u16 key_length;
2285	/* 12*/ INDEX_ENTRY_FLAGS flags;
2286	/* 14*/ u16 reserved;
2287	/* sizeof() = 16 bytes */
2288	} __attribute__((__packed__)) INDEX_ENTRY_HEADER;
2289
2290	/**
2291	* struct INDEX_ENTRY - This is an index entry.
2292	*
2293	* A sequence of such entries follows each INDEX_HEADER structure. Together
2294	* they make up a complete index. The index follows either an index root
2295	* attribute or an index allocation attribute.
2296	*
2297	* NOTE: Before NTFS 3.0 only filename attributes were indexed.
2298	*/
2299	typedef struct {
2300	/* 0 INDEX_ENTRY_HEADER; -- Unfolded here as gcc dislikes unnamed structs. */
2301	union { /* Only valid when INDEX_ENTRY_END is not set. */
2302	MFT_REF indexed_file; /* The mft reference of the file
2303	described by this index
2304	entry. Used for directory
2305	indexes. */
2306	struct { /* Used for views/indexes to find the entry's data. */
2307	u16 data_offset; /* Data byte offset from this
2308	INDEX_ENTRY. Follows the
2309	index key. */
2310	u16 data_length; /* Data length in bytes. */
2311	u32 reservedV; /* Reserved (zero). */
2312	} __attribute__((__packed__));
2313	} __attribute__((__packed__));
2314	/* 8*/ u16 length; /* Byte size of this index entry, multiple of
2315	8-bytes. Size includes INDEX_ENTRY_HEADER
2316	and the optional subnode VCN. See below. */
2317	/* 10*/ u16 key_length; /* Byte size of the key value, which is in the
2318	index entry. It follows field reserved. Not
2319	multiple of 8-bytes. */
2320	/* 12*/ INDEX_ENTRY_FLAGS ie_flags; /* Bit field of INDEX_ENTRY_* flags. */
2321	/* 14*/ u16 reserved; /* Reserved/align to 8-byte boundary. */
2322	/* End of INDEX_ENTRY_HEADER */
2323	/* 16*/ union { /* The key of the indexed attribute. NOTE: Only present
2324	if INDEX_ENTRY_END bit in flags is not set. NOTE: On
2325	NTFS versions before 3.0 the only valid key is the
2326	FILE_NAME_ATTR. On NTFS 3.0+ the following
2327	additional index keys are defined: */
2328	FILE_NAME_ATTR file_name;/* $I30 index in directories. */
2329	SII_INDEX_KEY sii; /* $SII index in $Secure. */
2330	SDH_INDEX_KEY sdh; /* $SDH index in $Secure. */
2331	GUID object_id; /* $O index in FILE_Extend/$ObjId: The
2332	object_id of the mft record found in
2333	the data part of the index. */
2334	REPARSE_INDEX_KEY reparse; /* $R index in
2335	FILE_Extend/$Reparse. */
2336	SID sid; /* $O index in FILE_Extend/$Quota:
2337	SID of the owner of the user_id. */
2338	u32 owner_id; /* $Q index in FILE_Extend/$Quota:
2339	user_id of the owner of the quota
2340	control entry in the data part of
2341	the index. */
2342	} __attribute__((__packed__)) key;
2343	/* The (optional) index data is inserted here when creating.
2344	VCN vcn; If INDEX_ENTRY_NODE bit in ie_flags is set, the last
2345	eight bytes of this index entry contain the virtual
2346	cluster number of the index block that holds the
2347	entries immediately preceding the current entry.
2348
2349	If the key_length is zero, then the vcn immediately
2350	follows the INDEX_ENTRY_HEADER.
2351
2352	The address of the vcn of "ie" INDEX_ENTRY is given by
2353	(char*)ie + le16_to_cpu(ie->length) - sizeof(VCN)
2354	*/
2355	} __attribute__((__packed__)) INDEX_ENTRY;
2356
2357	/**
2358	* struct BITMAP_ATTR - Attribute: Bitmap (0xb0).
2359	*
2360	* Contains an array of bits (aka a bitfield).
2361	*
2362	* When used in conjunction with the index allocation attribute, each bit
2363	* corresponds to one index block within the index allocation attribute. Thus
2364	* the number of bits in the bitmap * index block size / cluster size is the
2365	* number of clusters in the index allocation attribute.
2366	*/
2367	typedef struct {
2368	u8 bitmap[0]; /* Array of bits. */
2369	} __attribute__((__packed__)) BITMAP_ATTR;
2370
2371	/**
2372	* enum PREDEFINED_REPARSE_TAGS -
2373	*
2374	* The reparse point tag defines the type of the reparse point. It also
2375	* includes several flags, which further describe the reparse point.
2376	*
2377	* The reparse point tag is an unsigned 32-bit value divided in three parts:
2378	*
2379	* 1. The least significant 16 bits (i.e. bits 0 to 15) specify the type of
2380	* the reparse point.
2381	* 2. The 13 bits after this (i.e. bits 16 to 28) are reserved for future use.
2382	* 3. The most significant three bits are flags describing the reparse point.
2383	* They are defined as follows:
2384	* bit 29: Name surrogate bit. If set, the filename is an alias for
2385	* another object in the system.
2386	* bit 30: High-latency bit. If set, accessing the first byte of data will
2387	* be slow. (E.g. the data is stored on a tape drive.)
2388	* bit 31: Microsoft bit. If set, the tag is owned by Microsoft. User
2389	* defined tags have to use zero here.
2390	*/
2391	typedef enum {
2392	IO_REPARSE_TAG_IS_ALIAS = const_cpu_to_le32(0x20000000),
2393	IO_REPARSE_TAG_IS_HIGH_LATENCY = const_cpu_to_le32(0x40000000),
2394	IO_REPARSE_TAG_IS_MICROSOFT = const_cpu_to_le32(0x80000000),
2395
2396	IO_REPARSE_TAG_RESERVED_ZERO = const_cpu_to_le32(0x00000000),
2397	IO_REPARSE_TAG_RESERVED_ONE = const_cpu_to_le32(0x00000001),
2398	IO_REPARSE_TAG_RESERVED_RANGE = const_cpu_to_le32(0x00000001),
2399
2400	IO_REPARSE_TAG_NSS = const_cpu_to_le32(0x68000005),
2401	IO_REPARSE_TAG_NSS_RECOVER = const_cpu_to_le32(0x68000006),
2402	IO_REPARSE_TAG_SIS = const_cpu_to_le32(0x68000007),
2403	IO_REPARSE_TAG_DFS = const_cpu_to_le32(0x68000008),
2404
2405	IO_REPARSE_TAG_MOUNT_POINT = const_cpu_to_le32(0x88000003),
2406
2407	IO_REPARSE_TAG_HSM = const_cpu_to_le32(0xa8000004),
2408
2409	IO_REPARSE_TAG_SYMBOLIC_LINK = const_cpu_to_le32(0xe8000000),
2410
2411	IO_REPARSE_TAG_VALID_VALUES = const_cpu_to_le32(0xe000ffff),
2412	} PREDEFINED_REPARSE_TAGS;
2413
2414	/**
2415	* struct REPARSE_POINT - Attribute: Reparse point (0xc0).
2416	*
2417	* NOTE: Can be resident or non-resident.
2418	*/
2419	typedef struct {
2420	u32 reparse_tag; /* Reparse point type (inc. flags). */
2421	u16 reparse_data_length; /* Byte size of reparse data. */
2422	u16 reserved; /* Align to 8-byte boundary. */
2423	u8 reparse_data[0]; /* Meaning depends on reparse_tag. */
2424	} __attribute__((__packed__)) REPARSE_POINT;
2425
2426	/**
2427	* struct EA_INFORMATION - Attribute: Extended attribute information (0xd0).
2428	*
2429	* NOTE: Always resident.
2430	*/
2431	typedef struct {
2432	u16 ea_length; /* Byte size of the packed extended
2433	attributes. */
2434	u16 need_ea_count; /* The number of extended attributes which have
2435	the NEED_EA bit set. */
2436	u32 ea_query_length; /* Byte size of the buffer required to query
2437	the extended attributes when calling
2438	ZwQueryEaFile() in Windows NT/2k. I.e. the
2439	byte size of the unpacked extended
2440	attributes. */
2441	} __attribute__((__packed__)) EA_INFORMATION;
2442
2443	/**
2444	* enum EA_FLAGS - Extended attribute flags (8-bit).
2445	*/
2446	typedef enum {
2447	NEED_EA = 0x80, /* Indicate that the file to which the EA
2448	belongs cannot be interpreted without
2449	understanding the associated extended
2450	attributes. */
2451	} __attribute__((__packed__)) EA_FLAGS;
2452
2453	/**
2454	* struct EA_ATTR - Attribute: Extended attribute (EA) (0xe0).
2455	*
2456	* Like the attribute list and the index buffer list, the EA attribute value is
2457	* a sequence of EA_ATTR variable length records.
2458	*
2459	* FIXME: It appears weird that the EA name is not Unicode. Is it true?
2460	* FIXME: It seems that name is always uppercased. Is it true?
2461	*/
2462	typedef struct {
2463	u32 next_entry_offset; /* Offset to the next EA_ATTR. */
2464	EA_FLAGS flags; /* Flags describing the EA. */
2465	u8 name_length; /* Length of the name of the extended
2466	attribute in bytes. */
2467	u16 value_length; /* Byte size of the EA's value. */
2468	u8 name[0]; /* Name of the EA. */
2469	u8 value[0]; /* The value of the EA. Immediately
2470	follows the name. */
2471	} __attribute__((__packed__)) EA_ATTR;
2472
2473	/**
2474	* struct PROPERTY_SET - Attribute: Property set (0xf0).
2475	*
2476	* Intended to support Native Structure Storage (NSS) - a feature removed from
2477	* NTFS 3.0 during beta testing.
2478	*/
2479	typedef struct {
2480	/* Irrelevant as feature unused. */
2481	} __attribute__((__packed__)) PROPERTY_SET;
2482
2483	/**
2484	* struct LOGGED_UTILITY_STREAM - Attribute: Logged utility stream (0x100).
2485	*
2486	* NOTE: Can be resident or non-resident.
2487	*
2488	* Operations on this attribute are logged to the journal ($LogFile) like
2489	* normal metadata changes.
2490	*
2491	* Used by the Encrypting File System (EFS). All encrypted files have this
2492	* attribute with the name $EFS. See below for the relevant structures.
2493	*/
2494	typedef struct {
2495	/* Can be anything the creator chooses. */
2496	} __attribute__((__packed__)) LOGGED_UTILITY_STREAM;
2497
2498	/*
2499	* $EFS Data Structure:
2500	*
2501	* The following information is about the data structures that are contained
2502	* inside a logged utility stream (0x100) with a name of "$EFS".
2503	*
2504	* The stream starts with an instance of EFS_ATTR_HEADER.
2505	*
2506	* Next, at offsets offset_to_ddf_array and offset_to_drf_array (unless any of
2507	* them is 0) there is a EFS_DF_ARRAY_HEADER immediately followed by a sequence
2508	* of multiple data decryption/recovery fields.
2509	*
2510	* Each data decryption/recovery field starts with a EFS_DF_HEADER and the next
2511	* one (if it exists) can be found by adding EFS_DF_HEADER->df_length bytes to
2512	* the offset of the beginning of the current EFS_DF_HEADER.
2513	*
2514	* The data decryption/recovery field contains an EFS_DF_CERTIFICATE_HEADER, a
2515	* SID, an optional GUID, an optional container name, a non-optional user name,
2516	* and the encrypted FEK.
2517	*
2518	* Note all the below are best guesses so may have mistakes/inaccuracies.
2519	* Corrections/clarifications/additions are always welcome!
2520	*
2521	* Ntfs.sys takes an EFS value length of <= 0x54 or > 0x40000 to BSOD, i.e. it
2522	* is invalid.
2523	*/
2524
2525	/**
2526	* struct EFS_ATTR_HEADER - "$EFS" header.
2527	*
2528	* The header of the Logged utility stream (0x100) attribute named "$EFS".
2529	*/
2530	typedef struct {
2531	/* 0*/ u32 length; /* Length of EFS attribute in bytes. */
2532	u32 state; /* Always 0? */
2533	u32 version; /* Efs version. Always 2? */
2534	u32 crypto_api_version; /* Always 0? */
2535	/* 16*/ u8 unknown4[16]; /* MD5 hash of decrypted FEK? This field is
2536	created with a call to UuidCreate() so is
2537	unlikely to be an MD5 hash and is more
2538	likely to be GUID of this encrytped file
2539	or something like that. */
2540	/* 32*/ u8 unknown5[16]; /* MD5 hash of DDFs? */
2541	/* 48*/ u8 unknown6[16]; /* MD5 hash of DRFs? */
2542	/* 64*/ u32 offset_to_ddf_array;/* Offset in bytes to the array of data
2543	decryption fields (DDF), see below. Zero if
2544	no DDFs are present. */
2545	u32 offset_to_drf_array;/* Offset in bytes to the array of data
2546	recovery fields (DRF), see below. Zero if
2547	no DRFs are present. */
2548	u32 reserved; /* Reserved. */
2549	} __attribute__((__packed__)) EFS_ATTR_HEADER;
2550
2551	/**
2552	* struct EFS_DF_ARRAY_HEADER -
2553	*/
2554	typedef struct {
2555	u32 df_count; /* Number of data decryption/recovery fields in
2556	the array. */
2557	} __attribute__((__packed__)) EFS_DF_ARRAY_HEADER;
2558
2559	/**
2560	* struct EFS_DF_HEADER -
2561	*/
2562	typedef struct {
2563	/* 0*/ u32 df_length; /* Length of this data decryption/recovery
2564	field in bytes. */
2565	u32 cred_header_offset; /* Offset in bytes to the credential header. */
2566	u32 fek_size; /* Size in bytes of the encrypted file
2567	encryption key (FEK). */
2568	u32 fek_offset; /* Offset in bytes to the FEK from the start of
2569	the data decryption/recovery field. */
2570	/* 16*/ u32 unknown1; /* always 0? Might be just padding. */
2571	} __attribute__((__packed__)) EFS_DF_HEADER;
2572
2573	/**
2574	* struct EFS_DF_CREDENTIAL_HEADER -
2575	*/
2576	typedef struct {
2577	/* 0*/ u32 cred_length; /* Length of this credential in bytes. */
2578	u32 sid_offset; /* Offset in bytes to the user's sid from start
2579	of this structure. Zero if no sid is
2580	present. */
2581	/* 8*/ u32 type; /* Type of this credential:
2582	1 = CryptoAPI container.
2583	2 = Unexpected type.
2584	3 = Certificate thumbprint.
2585	other = Unknown type. */
2586	union {
2587	/* CryptoAPI container. */
2588	struct {
2589	/* 12*/ u32 container_name_offset; /* Offset in bytes to
2590	the name of the container from start of this
2591	structure (may not be zero). */
2592	/* 16*/ u32 provider_name_offset; /* Offset in bytes to
2593	the name of the provider from start of this
2594	structure (may not be zero). */
2595	u32 public_key_blob_offset; /* Offset in bytes to
2596	the public key blob from start of this
2597	structure. */
2598	/* 24*/ u32 public_key_blob_size; /* Size in bytes of
2599	public key blob. */
2600	} __attribute__((__packed__));
2601	/* Certificate thumbprint. */
2602	struct {
2603	/* 12*/ u32 cert_thumbprint_header_size; /* Size in
2604	bytes of the header of the certificate
2605	thumbprint. */
2606	/* 16*/ u32 cert_thumbprint_header_offset; /* Offset in
2607	bytes to the header of the certificate
2608	thumbprint from start of this structure. */
2609	u32 unknown1; /* Always 0? Might be padding... */
2610	u32 unknown2; /* Always 0? Might be padding... */
2611	} __attribute__((__packed__));
2612	} __attribute__((__packed__));
2613	} __attribute__((__packed__)) EFS_DF_CREDENTIAL_HEADER;
2614
2615	typedef EFS_DF_CREDENTIAL_HEADER EFS_DF_CRED_HEADER;
2616
2617	/**
2618	* struct EFS_DF_CERTIFICATE_THUMBPRINT_HEADER -
2619	*/
2620	typedef struct {
2621	/* 0*/ u32 thumbprint_offset; /* Offset in bytes to the thumbprint. */
2622	u32 thumbprint_size; /* Size of thumbprint in bytes. */
2623	/* 8*/ u32 container_name_offset; /* Offset in bytes to the name of the
2624	container from start of this
2625	structure or 0 if no name present. */
2626	u32 provider_name_offset; /* Offset in bytes to the name of the
2627	cryptographic provider from start of
2628	this structure or 0 if no name
2629	present. */
2630	/* 16*/ u32 user_name_offset; /* Offset in bytes to the user name
2631	from start of this structure or 0 if
2632	no user name present. (This is also
2633	known as lpDisplayInformation.) */
2634	} __attribute__((__packed__)) EFS_DF_CERTIFICATE_THUMBPRINT_HEADER;
2635
2636	typedef EFS_DF_CERTIFICATE_THUMBPRINT_HEADER EFS_DF_CERT_THUMBPRINT_HEADER;
2637
2638	typedef enum {
2639	INTX_SYMBOLIC_LINK =
2640	const_cpu_to_le64(0x014B4E4C78746E49ULL), /* "IntxLNK\1" */
2641	INTX_CHARACTER_DEVICE =
2642	const_cpu_to_le64(0x0052484378746E49ULL), /* "IntxCHR\0" */
2643	INTX_BLOCK_DEVICE =
2644	const_cpu_to_le64(0x004B4C4278746E49ULL), /* "IntxBLK\0" */
2645	} INTX_FILE_TYPES;
2646
2647	typedef struct {
2648	INTX_FILE_TYPES magic; /* Intx file magic. */
2649	union {
2650	/* For character and block devices. */
2651	struct {
2652	u64 major; /* Major device number. */
2653	u64 minor; /* Minor device number. */
2654	void *device_end[0]; /* Marker for offsetof(). */
2655	} __attribute__((__packed__));
2656	/* For symbolic links. */
2657	ntfschar target[0];
2658	} __attribute__((__packed__));
2659	} __attribute__((__packed__)) INTX_FILE;
2660
2661	#endif /* defined _NTFS_LAYOUT_H */
2662