linux/fs/ntfs/usnjrnl.h
<<
>>
Prefs
   1/*
   2 * usnjrnl.h - Defines for NTFS kernel transaction log ($UsnJrnl) handling.
   3 *             Part of the Linux-NTFS project.
   4 *
   5 * Copyright (c) 2005 Anton Altaparmakov
   6 *
   7 * This program/include file is free software; you can redistribute it and/or
   8 * modify it under the terms of the GNU General Public License as published
   9 * by the Free Software Foundation; either version 2 of the License, or
  10 * (at your option) any later version.
  11 *
  12 * This program/include file is distributed in the hope that it will be
  13 * useful, but WITHOUT ANY WARRANTY; without even the implied warranty
  14 * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 * GNU General Public License for more details.
  16 *
  17 * You should have received a copy of the GNU General Public License
  18 * along with this program (in the main directory of the Linux-NTFS
  19 * distribution in the file COPYING); if not, write to the Free Software
  20 * Foundation,Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  21 */
  22
  23#ifndef _LINUX_NTFS_USNJRNL_H
  24#define _LINUX_NTFS_USNJRNL_H
  25
  26#ifdef NTFS_RW
  27
  28#include "types.h"
  29#include "endian.h"
  30#include "layout.h"
  31#include "volume.h"
  32
  33/*
  34 * Transaction log ($UsnJrnl) organization:
  35 *
  36 * The transaction log records whenever a file is modified in any way.  So for
  37 * example it will record that file "blah" was written to at a particular time
  38 * but not what was written.  If will record that a file was deleted or
  39 * created, that a file was truncated, etc.  See below for all the reason
  40 * codes used.
  41 *
  42 * The transaction log is in the $Extend directory which is in the root
  43 * directory of each volume.  If it is not present it means transaction
  44 * logging is disabled.  If it is present it means transaction logging is
  45 * either enabled or in the process of being disabled in which case we can
  46 * ignore it as it will go away as soon as Windows gets its hands on it.
  47 *
  48 * To determine whether the transaction logging is enabled or in the process
  49 * of being disabled, need to check the volume flags in the
  50 * $VOLUME_INFORMATION attribute in the $Volume system file (which is present
  51 * in the root directory and has a fixed mft record number, see layout.h).
  52 * If the flag VOLUME_DELETE_USN_UNDERWAY is set it means the transaction log
  53 * is in the process of being disabled and if this flag is clear it means the
  54 * transaction log is enabled.
  55 *
  56 * The transaction log consists of two parts; the $DATA/$Max attribute as well
  57 * as the $DATA/$J attribute.  $Max is a header describing the transaction
  58 * log whilst $J is the transaction log data itself as a sequence of variable
  59 * sized USN_RECORDs (see below for all the structures).
  60 *
  61 * We do not care about transaction logging at this point in time but we still
  62 * need to let windows know that the transaction log is out of date.  To do
  63 * this we need to stamp the transaction log.  This involves setting the
  64 * lowest_valid_usn field in the $DATA/$Max attribute to the usn to be used
  65 * for the next added USN_RECORD to the $DATA/$J attribute as well as
  66 * generating a new journal_id in $DATA/$Max.
  67 *
  68 * The journal_id is as of the current version (2.0) of the transaction log
  69 * simply the 64-bit timestamp of when the journal was either created or last
  70 * stamped.
  71 *
  72 * To determine the next usn there are two ways.  The first is to parse
  73 * $DATA/$J and to find the last USN_RECORD in it and to add its record_length
  74 * to its usn (which is the byte offset in the $DATA/$J attribute).  The
  75 * second is simply to take the data size of the attribute.  Since the usns
  76 * are simply byte offsets into $DATA/$J, this is exactly the next usn.  For
  77 * obvious reasons we use the second method as it is much simpler and faster.
  78 *
  79 * As an aside, note that to actually disable the transaction log, one would
  80 * need to set the VOLUME_DELETE_USN_UNDERWAY flag (see above), then go
  81 * through all the mft records on the volume and set the usn field in their
  82 * $STANDARD_INFORMATION attribute to zero.  Once that is done, one would need
  83 * to delete the transaction log file, i.e. \$Extent\$UsnJrnl, and finally,
  84 * one would need to clear the VOLUME_DELETE_USN_UNDERWAY flag.
  85 *
  86 * Note that if a volume is unmounted whilst the transaction log is being
  87 * disabled, the process will continue the next time the volume is mounted.
  88 * This is why we can safely mount read-write when we see a transaction log
  89 * in the process of being deleted.
  90 */
  91
  92/* Some $UsnJrnl related constants. */
  93#define UsnJrnlMajorVer         2
  94#define UsnJrnlMinorVer         0
  95
  96/*
  97 * $DATA/$Max attribute.  This is (always?) resident and has a fixed size of
  98 * 32 bytes.  It contains the header describing the transaction log.
  99 */
 100typedef struct {
 101/*Ofs*/
 102/*   0*/sle64 maximum_size;     /* The maximum on-disk size of the $DATA/$J
 103                                   attribute. */
 104/*   8*/sle64 allocation_delta; /* Number of bytes by which to increase the
 105                                   size of the $DATA/$J attribute. */
 106/*0x10*/sle64 journal_id;       /* Current id of the transaction log. */
 107/*0x18*/leUSN lowest_valid_usn; /* Lowest valid usn in $DATA/$J for the
 108                                   current journal_id. */
 109/* sizeof() = 32 (0x20) bytes */
 110} __attribute__ ((__packed__)) USN_HEADER;
 111
 112/*
 113 * Reason flags (32-bit).  Cumulative flags describing the change(s) to the
 114 * file since it was last opened.  I think the names speak for themselves but
 115 * if you disagree check out the descriptions in the Linux NTFS project NTFS
 116 * documentation: http://www.linux-ntfs.org/
 117 */
 118enum {
 119        USN_REASON_DATA_OVERWRITE       = cpu_to_le32(0x00000001),
 120        USN_REASON_DATA_EXTEND          = cpu_to_le32(0x00000002),
 121        USN_REASON_DATA_TRUNCATION      = cpu_to_le32(0x00000004),
 122        USN_REASON_NAMED_DATA_OVERWRITE = cpu_to_le32(0x00000010),
 123        USN_REASON_NAMED_DATA_EXTEND    = cpu_to_le32(0x00000020),
 124        USN_REASON_NAMED_DATA_TRUNCATION= cpu_to_le32(0x00000040),
 125        USN_REASON_FILE_CREATE          = cpu_to_le32(0x00000100),
 126        USN_REASON_FILE_DELETE          = cpu_to_le32(0x00000200),
 127        USN_REASON_EA_CHANGE            = cpu_to_le32(0x00000400),
 128        USN_REASON_SECURITY_CHANGE      = cpu_to_le32(0x00000800),
 129        USN_REASON_RENAME_OLD_NAME      = cpu_to_le32(0x00001000),
 130        USN_REASON_RENAME_NEW_NAME      = cpu_to_le32(0x00002000),
 131        USN_REASON_INDEXABLE_CHANGE     = cpu_to_le32(0x00004000),
 132        USN_REASON_BASIC_INFO_CHANGE    = cpu_to_le32(0x00008000),
 133        USN_REASON_HARD_LINK_CHANGE     = cpu_to_le32(0x00010000),
 134        USN_REASON_COMPRESSION_CHANGE   = cpu_to_le32(0x00020000),
 135        USN_REASON_ENCRYPTION_CHANGE    = cpu_to_le32(0x00040000),
 136        USN_REASON_OBJECT_ID_CHANGE     = cpu_to_le32(0x00080000),
 137        USN_REASON_REPARSE_POINT_CHANGE = cpu_to_le32(0x00100000),
 138        USN_REASON_STREAM_CHANGE        = cpu_to_le32(0x00200000),
 139        USN_REASON_CLOSE                = cpu_to_le32(0x80000000),
 140};
 141
 142typedef le32 USN_REASON_FLAGS;
 143
 144/*
 145 * Source info flags (32-bit).  Information about the source of the change(s)
 146 * to the file.  For detailed descriptions of what these mean, see the Linux
 147 * NTFS project NTFS documentation:
 148 *      http://www.linux-ntfs.org/
 149 */
 150enum {
 151        USN_SOURCE_DATA_MANAGEMENT        = cpu_to_le32(0x00000001),
 152        USN_SOURCE_AUXILIARY_DATA         = cpu_to_le32(0x00000002),
 153        USN_SOURCE_REPLICATION_MANAGEMENT = cpu_to_le32(0x00000004),
 154};
 155
 156typedef le32 USN_SOURCE_INFO_FLAGS;
 157
 158/*
 159 * $DATA/$J attribute.  This is always non-resident, is marked as sparse, and
 160 * is of variabled size.  It consists of a sequence of variable size
 161 * USN_RECORDS.  The minimum allocated_size is allocation_delta as
 162 * specified in $DATA/$Max.  When the maximum_size specified in $DATA/$Max is
 163 * exceeded by more than allocation_delta bytes, allocation_delta bytes are
 164 * allocated and appended to the $DATA/$J attribute and an equal number of
 165 * bytes at the beginning of the attribute are freed and made sparse.  Note the
 166 * making sparse only happens at volume checkpoints and hence the actual
 167 * $DATA/$J size can exceed maximum_size + allocation_delta temporarily.
 168 */
 169typedef struct {
 170/*Ofs*/
 171/*   0*/le32 length;            /* Byte size of this record (8-byte
 172                                   aligned). */
 173/*   4*/le16 major_ver;         /* Major version of the transaction log used
 174                                   for this record. */
 175/*   6*/le16 minor_ver;         /* Minor version of the transaction log used
 176                                   for this record. */
 177/*   8*/leMFT_REF mft_reference;/* The mft reference of the file (or
 178                                   directory) described by this record. */
 179/*0x10*/leMFT_REF parent_directory;/* The mft reference of the parent
 180                                   directory of the file described by this
 181                                   record. */
 182/*0x18*/leUSN usn;              /* The usn of this record.  Equals the offset
 183                                   within the $DATA/$J attribute. */
 184/*0x20*/sle64 time;             /* Time when this record was created. */
 185/*0x28*/USN_REASON_FLAGS reason;/* Reason flags (see above). */
 186/*0x2c*/USN_SOURCE_INFO_FLAGS source_info;/* Source info flags (see above). */
 187/*0x30*/le32 security_id;       /* File security_id copied from
 188                                   $STANDARD_INFORMATION. */
 189/*0x34*/FILE_ATTR_FLAGS file_attributes;        /* File attributes copied from
 190                                   $STANDARD_INFORMATION or $FILE_NAME (not
 191                                   sure which). */
 192/*0x38*/le16 file_name_size;    /* Size of the file name in bytes. */
 193/*0x3a*/le16 file_name_offset;  /* Offset to the file name in bytes from the
 194                                   start of this record. */
 195/*0x3c*/ntfschar file_name[0];  /* Use when creating only.  When reading use
 196                                   file_name_offset to determine the location
 197                                   of the name. */
 198/* sizeof() = 60 (0x3c) bytes */
 199} __attribute__ ((__packed__)) USN_RECORD;
 200
 201extern bool ntfs_stamp_usnjrnl(ntfs_volume *vol);
 202
 203#endif /* NTFS_RW */
 204
 205#endif /* _LINUX_NTFS_USNJRNL_H */
 206
lxr.linux.no kindly hosted by Redpill Linpro AS, provider of Linux consulting and operations services since 1995.