mirror of https://github.com/tongzx/nt5src
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
5666 lines
134 KiB
5666 lines
134 KiB
/*++ BUILD Version: 0013 // Increment this if a change has global effects
|
|
|
|
Copyright (c) 1989 Microsoft Corporation
|
|
|
|
Module Name:
|
|
|
|
io.h
|
|
|
|
Abstract:
|
|
|
|
This module contains the internal structure definitions and APIs used by
|
|
the NT I/O system.
|
|
|
|
Author:
|
|
|
|
Darryl E. Havens (darrylh) 12-Apr-1989
|
|
|
|
|
|
Revision History:
|
|
|
|
|
|
--*/
|
|
|
|
#ifndef _IO_
|
|
#define _IO_
|
|
|
|
// begin_ntddk begin_wdm begin_nthal begin_ntifs begin_ntndis begin_ntosp
|
|
//
|
|
// Define I/O system data structure type codes. Each major data structure in
|
|
// the I/O system has a type code The type field in each structure is at the
|
|
// same offset. The following values can be used to determine which type of
|
|
// data structure a pointer refers to.
|
|
//
|
|
|
|
#define IO_TYPE_ADAPTER 0x00000001
|
|
#define IO_TYPE_CONTROLLER 0x00000002
|
|
#define IO_TYPE_DEVICE 0x00000003
|
|
#define IO_TYPE_DRIVER 0x00000004
|
|
#define IO_TYPE_FILE 0x00000005
|
|
#define IO_TYPE_IRP 0x00000006
|
|
#define IO_TYPE_MASTER_ADAPTER 0x00000007
|
|
#define IO_TYPE_OPEN_PACKET 0x00000008
|
|
#define IO_TYPE_TIMER 0x00000009
|
|
#define IO_TYPE_VPB 0x0000000a
|
|
#define IO_TYPE_ERROR_LOG 0x0000000b
|
|
#define IO_TYPE_ERROR_MESSAGE 0x0000000c
|
|
#define IO_TYPE_DEVICE_OBJECT_EXTENSION 0x0000000d
|
|
|
|
|
|
//
|
|
// Define the major function codes for IRPs.
|
|
//
|
|
|
|
|
|
#define IRP_MJ_CREATE 0x00
|
|
#define IRP_MJ_CREATE_NAMED_PIPE 0x01
|
|
#define IRP_MJ_CLOSE 0x02
|
|
#define IRP_MJ_READ 0x03
|
|
#define IRP_MJ_WRITE 0x04
|
|
#define IRP_MJ_QUERY_INFORMATION 0x05
|
|
#define IRP_MJ_SET_INFORMATION 0x06
|
|
#define IRP_MJ_QUERY_EA 0x07
|
|
#define IRP_MJ_SET_EA 0x08
|
|
#define IRP_MJ_FLUSH_BUFFERS 0x09
|
|
#define IRP_MJ_QUERY_VOLUME_INFORMATION 0x0a
|
|
#define IRP_MJ_SET_VOLUME_INFORMATION 0x0b
|
|
#define IRP_MJ_DIRECTORY_CONTROL 0x0c
|
|
#define IRP_MJ_FILE_SYSTEM_CONTROL 0x0d
|
|
#define IRP_MJ_DEVICE_CONTROL 0x0e
|
|
#define IRP_MJ_INTERNAL_DEVICE_CONTROL 0x0f
|
|
#define IRP_MJ_SHUTDOWN 0x10
|
|
#define IRP_MJ_LOCK_CONTROL 0x11
|
|
#define IRP_MJ_CLEANUP 0x12
|
|
#define IRP_MJ_CREATE_MAILSLOT 0x13
|
|
#define IRP_MJ_QUERY_SECURITY 0x14
|
|
#define IRP_MJ_SET_SECURITY 0x15
|
|
#define IRP_MJ_POWER 0x16
|
|
#define IRP_MJ_SYSTEM_CONTROL 0x17
|
|
#define IRP_MJ_DEVICE_CHANGE 0x18
|
|
#define IRP_MJ_QUERY_QUOTA 0x19
|
|
#define IRP_MJ_SET_QUOTA 0x1a
|
|
#define IRP_MJ_PNP 0x1b
|
|
#define IRP_MJ_PNP_POWER IRP_MJ_PNP // Obsolete....
|
|
#define IRP_MJ_MAXIMUM_FUNCTION 0x1b
|
|
|
|
//
|
|
// Make the Scsi major code the same as internal device control.
|
|
//
|
|
|
|
#define IRP_MJ_SCSI IRP_MJ_INTERNAL_DEVICE_CONTROL
|
|
|
|
//
|
|
// Define the minor function codes for IRPs. The lower 128 codes, from 0x00 to
|
|
// 0x7f are reserved to Microsoft. The upper 128 codes, from 0x80 to 0xff, are
|
|
// reserved to customers of Microsoft.
|
|
//
|
|
|
|
// end_wdm end_ntndis
|
|
//
|
|
// Directory control minor function codes
|
|
//
|
|
|
|
#define IRP_MN_QUERY_DIRECTORY 0x01
|
|
#define IRP_MN_NOTIFY_CHANGE_DIRECTORY 0x02
|
|
|
|
//
|
|
// File system control minor function codes. Note that "user request" is
|
|
// assumed to be zero by both the I/O system and file systems. Do not change
|
|
// this value.
|
|
//
|
|
|
|
#define IRP_MN_USER_FS_REQUEST 0x00
|
|
#define IRP_MN_MOUNT_VOLUME 0x01
|
|
#define IRP_MN_VERIFY_VOLUME 0x02
|
|
#define IRP_MN_LOAD_FILE_SYSTEM 0x03
|
|
#define IRP_MN_TRACK_LINK 0x04 // To be obsoleted soon
|
|
#define IRP_MN_KERNEL_CALL 0x04
|
|
|
|
//
|
|
// Lock control minor function codes
|
|
//
|
|
|
|
#define IRP_MN_LOCK 0x01
|
|
#define IRP_MN_UNLOCK_SINGLE 0x02
|
|
#define IRP_MN_UNLOCK_ALL 0x03
|
|
#define IRP_MN_UNLOCK_ALL_BY_KEY 0x04
|
|
|
|
//
|
|
// Read and Write minor function codes for file systems supporting Lan Manager
|
|
// software. All of these subfunction codes are invalid if the file has been
|
|
// opened with FO_NO_INTERMEDIATE_BUFFERING. They are also invalid in combi-
|
|
// nation with synchronous calls (Irp Flag or file open option).
|
|
//
|
|
// Note that "normal" is assumed to be zero by both the I/O system and file
|
|
// systems. Do not change this value.
|
|
//
|
|
|
|
#define IRP_MN_NORMAL 0x00
|
|
#define IRP_MN_DPC 0x01
|
|
#define IRP_MN_MDL 0x02
|
|
#define IRP_MN_COMPLETE 0x04
|
|
#define IRP_MN_COMPRESSED 0x08
|
|
|
|
#define IRP_MN_MDL_DPC (IRP_MN_MDL | IRP_MN_DPC)
|
|
#define IRP_MN_COMPLETE_MDL (IRP_MN_COMPLETE | IRP_MN_MDL)
|
|
#define IRP_MN_COMPLETE_MDL_DPC (IRP_MN_COMPLETE_MDL | IRP_MN_DPC)
|
|
|
|
// begin_wdm
|
|
//
|
|
// Device Control Request minor function codes for SCSI support. Note that
|
|
// user requests are assumed to be zero.
|
|
//
|
|
|
|
#define IRP_MN_SCSI_CLASS 0x01
|
|
|
|
//
|
|
// PNP minor function codes.
|
|
//
|
|
|
|
#define IRP_MN_START_DEVICE 0x00
|
|
#define IRP_MN_QUERY_REMOVE_DEVICE 0x01
|
|
#define IRP_MN_REMOVE_DEVICE 0x02
|
|
#define IRP_MN_CANCEL_REMOVE_DEVICE 0x03
|
|
#define IRP_MN_STOP_DEVICE 0x04
|
|
#define IRP_MN_QUERY_STOP_DEVICE 0x05
|
|
#define IRP_MN_CANCEL_STOP_DEVICE 0x06
|
|
|
|
#define IRP_MN_QUERY_DEVICE_RELATIONS 0x07
|
|
#define IRP_MN_QUERY_INTERFACE 0x08
|
|
#define IRP_MN_QUERY_CAPABILITIES 0x09
|
|
#define IRP_MN_QUERY_RESOURCES 0x0A
|
|
#define IRP_MN_QUERY_RESOURCE_REQUIREMENTS 0x0B
|
|
#define IRP_MN_QUERY_DEVICE_TEXT 0x0C
|
|
#define IRP_MN_FILTER_RESOURCE_REQUIREMENTS 0x0D
|
|
|
|
#define IRP_MN_READ_CONFIG 0x0F
|
|
#define IRP_MN_WRITE_CONFIG 0x10
|
|
#define IRP_MN_EJECT 0x11
|
|
#define IRP_MN_SET_LOCK 0x12
|
|
#define IRP_MN_QUERY_ID 0x13
|
|
#define IRP_MN_QUERY_PNP_DEVICE_STATE 0x14
|
|
#define IRP_MN_QUERY_BUS_INFORMATION 0x15
|
|
#define IRP_MN_DEVICE_USAGE_NOTIFICATION 0x16
|
|
#define IRP_MN_SURPRISE_REMOVAL 0x17
|
|
// end_wdm
|
|
#define IRP_MN_QUERY_LEGACY_BUS_INFORMATION 0x18
|
|
// begin_wdm
|
|
|
|
//
|
|
// POWER minor function codes
|
|
//
|
|
#define IRP_MN_WAIT_WAKE 0x00
|
|
#define IRP_MN_POWER_SEQUENCE 0x01
|
|
#define IRP_MN_SET_POWER 0x02
|
|
#define IRP_MN_QUERY_POWER 0x03
|
|
|
|
// begin_ntminiport
|
|
//
|
|
// WMI minor function codes under IRP_MJ_SYSTEM_CONTROL
|
|
//
|
|
|
|
#define IRP_MN_QUERY_ALL_DATA 0x00
|
|
#define IRP_MN_QUERY_SINGLE_INSTANCE 0x01
|
|
#define IRP_MN_CHANGE_SINGLE_INSTANCE 0x02
|
|
#define IRP_MN_CHANGE_SINGLE_ITEM 0x03
|
|
#define IRP_MN_ENABLE_EVENTS 0x04
|
|
#define IRP_MN_DISABLE_EVENTS 0x05
|
|
#define IRP_MN_ENABLE_COLLECTION 0x06
|
|
#define IRP_MN_DISABLE_COLLECTION 0x07
|
|
#define IRP_MN_REGINFO 0x08
|
|
#define IRP_MN_EXECUTE_METHOD 0x09
|
|
// Minor code 0x0a is reserved
|
|
#define IRP_MN_REGINFO_EX 0x0b
|
|
|
|
// end_ntminiport
|
|
// end_wdm end_ntddk end_nthal end_ntifs end_ntosp
|
|
|
|
// The following minor code is reserved as a private WMI minor function
|
|
// For drivers who cannot include io.h, please see wmikm.h
|
|
//
|
|
// begin_wmikm
|
|
#define IRP_MN_SET_TRACE_NOTIFY 0x0A
|
|
|
|
// end_wmikm
|
|
// begin_wdm begin_ntddk begin_nthal begin_ntifs begin_ntosp
|
|
|
|
//
|
|
// Define option flags for IoCreateFile. Note that these values must be
|
|
// exactly the same as the SL_... flags for a create function. Note also
|
|
// that there are flags that may be passed to IoCreateFile that are not
|
|
// placed in the stack location for the create IRP. These flags start in
|
|
// the next byte.
|
|
//
|
|
|
|
#define IO_FORCE_ACCESS_CHECK 0x0001
|
|
// end_ntddk end_wdm end_nthal end_ntosp
|
|
|
|
#define IO_OPEN_PAGING_FILE 0x0002
|
|
#define IO_OPEN_TARGET_DIRECTORY 0x0004
|
|
|
|
//
|
|
// Flags not passed to driver
|
|
//
|
|
|
|
// begin_ntddk begin_wdm begin_ntosp
|
|
#define IO_NO_PARAMETER_CHECKING 0x0100
|
|
|
|
//
|
|
// Define Information fields for whether or not a REPARSE or a REMOUNT has
|
|
// occurred in the file system.
|
|
//
|
|
|
|
#define IO_REPARSE 0x0
|
|
#define IO_REMOUNT 0x1
|
|
|
|
// end_ntddk end_wdm
|
|
|
|
#define IO_CHECK_CREATE_PARAMETERS 0x0200
|
|
#define IO_ATTACH_DEVICE 0x0400
|
|
|
|
// end_ntosp
|
|
|
|
// begin_ntifs begin_ntosp
|
|
|
|
//
|
|
// This flag is only meaning full to IoCreateFileSpecifyDeviceObjectHint.
|
|
// FileHandles created using IoCreateFileSpecifyDeviceObjectHint with this
|
|
// flag set will bypass ShareAccess checks on this file.
|
|
//
|
|
|
|
#define IO_IGNORE_SHARE_ACCESS_CHECK 0x0800 // Ignores share access checks on opens.
|
|
|
|
// end_ntifs end_ntosp
|
|
|
|
// Define kernel-only, internal option flags
|
|
//
|
|
|
|
#define IO_ATTACH_DEVICE_API 0x80000000
|
|
|
|
|
|
// end_ntifs
|
|
|
|
//
|
|
// Define the driver interfaces required to write memory dumps.
|
|
//
|
|
|
|
//
|
|
// Define stall routine type for the dump driver.
|
|
//
|
|
// begin_ntosp
|
|
typedef
|
|
VOID
|
|
(*PSTALL_ROUTINE) (
|
|
IN ULONG Delay
|
|
);
|
|
|
|
//
|
|
// Define the interfaces for the dump driver's routines.
|
|
//
|
|
|
|
typedef
|
|
BOOLEAN
|
|
(*PDUMP_DRIVER_OPEN) (
|
|
IN LARGE_INTEGER PartitionOffset
|
|
);
|
|
|
|
typedef
|
|
NTSTATUS
|
|
(*PDUMP_DRIVER_WRITE) (
|
|
IN PLARGE_INTEGER DiskByteOffset,
|
|
IN PMDL Mdl
|
|
);
|
|
|
|
//
|
|
// Actions accepted by DRIVER_WRITE_PENDING
|
|
//
|
|
#define IO_DUMP_WRITE_FULFILL 0 // fulfill IO request as if DRIVER_WAIT
|
|
#define IO_DUMP_WRITE_START 1 // start new IO
|
|
#define IO_DUMP_WRITE_RESUME 2 // resume pending IO
|
|
#define IO_DUMP_WRITE_FINISH 3 // finish pending IO
|
|
#define IO_DUMP_WRITE_INIT 4 // initialize locals
|
|
|
|
// size of data used by WRITE_PENDING that should be preserved
|
|
// between the calls
|
|
#define IO_DUMP_WRITE_DATA_PAGES 2
|
|
#define IO_DUMP_WRITE_DATA_SIZE (IO_DUMP_WRITE_DATA_PAGES << PAGE_SHIFT)
|
|
|
|
typedef
|
|
NTSTATUS
|
|
(*PDUMP_DRIVER_WRITE_PENDING) (
|
|
IN LONG Action,
|
|
IN PLARGE_INTEGER DiskByteOffset,
|
|
IN PMDL Mdl,
|
|
IN PVOID LocalData
|
|
);
|
|
|
|
|
|
typedef
|
|
VOID
|
|
(*PDUMP_DRIVER_FINISH) (
|
|
VOID
|
|
);
|
|
|
|
struct _ADAPTER_OBJECT;
|
|
|
|
//
|
|
// This is the information passed from the system to the disk dump driver
|
|
// during the driver's initialization.
|
|
//
|
|
|
|
typedef struct _DUMP_INITIALIZATION_CONTEXT {
|
|
ULONG Length;
|
|
ULONG Reserved; // Was MBR Checksum. Should be zero now.
|
|
PVOID MemoryBlock;
|
|
PVOID CommonBuffer[2];
|
|
PHYSICAL_ADDRESS PhysicalAddress[2];
|
|
PSTALL_ROUTINE StallRoutine;
|
|
PDUMP_DRIVER_OPEN OpenRoutine;
|
|
PDUMP_DRIVER_WRITE WriteRoutine;
|
|
PDUMP_DRIVER_FINISH FinishRoutine;
|
|
struct _ADAPTER_OBJECT *AdapterObject;
|
|
PVOID MappedRegisterBase;
|
|
PVOID PortConfiguration;
|
|
BOOLEAN CrashDump;
|
|
ULONG MaximumTransferSize;
|
|
ULONG CommonBufferSize;
|
|
PVOID TargetAddress; //Opaque pointer to target address structure
|
|
PDUMP_DRIVER_WRITE_PENDING WritePendingRoutine;
|
|
ULONG PartitionStyle;
|
|
union {
|
|
struct {
|
|
ULONG Signature;
|
|
ULONG CheckSum;
|
|
} Mbr;
|
|
struct {
|
|
GUID DiskId;
|
|
} Gpt;
|
|
} DiskInfo;
|
|
} DUMP_INITIALIZATION_CONTEXT, *PDUMP_INITIALIZATION_CONTEXT;
|
|
|
|
|
|
// begin_ntddk
|
|
//
|
|
// Define callout routine type for use in IoQueryDeviceDescription().
|
|
//
|
|
|
|
typedef NTSTATUS (*PIO_QUERY_DEVICE_ROUTINE)(
|
|
IN PVOID Context,
|
|
IN PUNICODE_STRING PathName,
|
|
IN INTERFACE_TYPE BusType,
|
|
IN ULONG BusNumber,
|
|
IN PKEY_VALUE_FULL_INFORMATION *BusInformation,
|
|
IN CONFIGURATION_TYPE ControllerType,
|
|
IN ULONG ControllerNumber,
|
|
IN PKEY_VALUE_FULL_INFORMATION *ControllerInformation,
|
|
IN CONFIGURATION_TYPE PeripheralType,
|
|
IN ULONG PeripheralNumber,
|
|
IN PKEY_VALUE_FULL_INFORMATION *PeripheralInformation
|
|
);
|
|
|
|
|
|
// Defines the order of the information in the array of
|
|
// PKEY_VALUE_FULL_INFORMATION.
|
|
//
|
|
|
|
typedef enum _IO_QUERY_DEVICE_DATA_FORMAT {
|
|
IoQueryDeviceIdentifier = 0,
|
|
IoQueryDeviceConfigurationData,
|
|
IoQueryDeviceComponentInformation,
|
|
IoQueryDeviceMaxData
|
|
} IO_QUERY_DEVICE_DATA_FORMAT, *PIO_QUERY_DEVICE_DATA_FORMAT;
|
|
|
|
// begin_wdm begin_ntifs
|
|
//
|
|
// Define the objects that can be created by IoCreateFile.
|
|
//
|
|
|
|
typedef enum _CREATE_FILE_TYPE {
|
|
CreateFileTypeNone,
|
|
CreateFileTypeNamedPipe,
|
|
CreateFileTypeMailslot
|
|
} CREATE_FILE_TYPE;
|
|
|
|
// end_ntddk end_wdm end_ntifs
|
|
|
|
//
|
|
// Define the named pipe create parameters structure used for internal calls
|
|
// to IoCreateFile when a named pipe is being created. This structure allows
|
|
// code invoking this routine to pass information specific to this function
|
|
// when creating a named pipe.
|
|
//
|
|
|
|
typedef struct _NAMED_PIPE_CREATE_PARAMETERS {
|
|
ULONG NamedPipeType;
|
|
ULONG ReadMode;
|
|
ULONG CompletionMode;
|
|
ULONG MaximumInstances;
|
|
ULONG InboundQuota;
|
|
ULONG OutboundQuota;
|
|
LARGE_INTEGER DefaultTimeout;
|
|
BOOLEAN TimeoutSpecified;
|
|
} NAMED_PIPE_CREATE_PARAMETERS, *PNAMED_PIPE_CREATE_PARAMETERS;
|
|
|
|
// end_ntosp
|
|
|
|
//
|
|
// Define the mailslot create parameters structure used for internal calls
|
|
// to IoCreateFile when a mailslot is being created. This structure allows
|
|
// code invoking this routine to pass information specific to this function
|
|
// when creating a mailslot.
|
|
//
|
|
|
|
typedef struct _MAILSLOT_CREATE_PARAMETERS {
|
|
ULONG MailslotQuota;
|
|
ULONG MaximumMessageSize;
|
|
LARGE_INTEGER ReadTimeout;
|
|
BOOLEAN TimeoutSpecified;
|
|
} MAILSLOT_CREATE_PARAMETERS, *PMAILSLOT_CREATE_PARAMETERS;
|
|
|
|
//
|
|
// Define the dump driver stack context structure
|
|
//
|
|
|
|
typedef struct DUMP_STACK_IMAGE{
|
|
LIST_ENTRY Link;
|
|
PLDR_DATA_TABLE_ENTRY Image;
|
|
PVOID ImageBase;
|
|
ULONG SizeOfImage;
|
|
} DUMP_STACK_IMAGE, *PDUMP_STACK_IMAGE;
|
|
|
|
typedef struct _DUMP_STACK_CONTEXT {
|
|
DUMP_INITIALIZATION_CONTEXT Init;
|
|
LARGE_INTEGER PartitionOffset;
|
|
PVOID DumpPointers;
|
|
ULONG PointersLength;
|
|
PWCHAR ModulePrefix;
|
|
LIST_ENTRY DriverList;
|
|
ANSI_STRING InitMsg;
|
|
ANSI_STRING ProgMsg;
|
|
ANSI_STRING DoneMsg;
|
|
PVOID FileObject;
|
|
enum _DEVICE_USAGE_NOTIFICATION_TYPE UsageType;
|
|
} DUMP_STACK_CONTEXT, *PDUMP_STACK_CONTEXT;
|
|
|
|
#define IO_DUMP_MAX_MDL_PAGES 8
|
|
#define IO_DUMP_MEMORY_BLOCK_PAGES 8
|
|
#define IO_DUMP_COMMON_BUFFER_SIZE 0x2000
|
|
|
|
NTSTATUS
|
|
IoGetDumpStack(
|
|
IN PWCHAR ModulePrefix,
|
|
OUT PDUMP_STACK_CONTEXT *DumpStack,
|
|
IN enum _DEVICE_USAGE_NOTIFICATION_TYPE UsageType,
|
|
IN ULONG IgnoreDeviceUsageFailure
|
|
);
|
|
|
|
NTSTATUS
|
|
IoInitializeDumpStack(
|
|
IN PDUMP_STACK_CONTEXT DumpStack,
|
|
IN PUCHAR MessageBuffer OPTIONAL
|
|
);
|
|
|
|
typedef enum _CRASHDUMP_CONFIGURATION {
|
|
CrashDumpDisable = 0,
|
|
CrashDumpReconfigure
|
|
} CRASHDUMP_CONFIGURATION;
|
|
|
|
NTSTATUS
|
|
IoConfigureCrashDump(
|
|
CRASHDUMP_CONFIGURATION Config
|
|
);
|
|
|
|
BOOLEAN
|
|
IoInitializeCrashDump(
|
|
IN HANDLE Pagefile
|
|
);
|
|
|
|
VOID
|
|
IoGetDumpHiberRanges (
|
|
IN PVOID HiberContext,
|
|
IN PDUMP_STACK_CONTEXT DumpStack
|
|
);
|
|
|
|
NTKERNELAPI
|
|
BOOLEAN
|
|
IoWriteCrashDump(
|
|
IN ULONG BugCheckCode,
|
|
IN ULONG_PTR BugCheckParameter1,
|
|
IN ULONG_PTR BugCheckParameter2,
|
|
IN ULONG_PTR BugCheckParameter3,
|
|
IN ULONG_PTR BugCheckParameter4,
|
|
IN PVOID ContextSave,
|
|
IN PKTHREAD Thread,
|
|
OUT PBOOLEAN Reboot
|
|
);
|
|
|
|
BOOLEAN
|
|
IoIsTriageDumpEnabled(
|
|
VOID
|
|
);
|
|
|
|
BOOLEAN
|
|
IoAddTriageDumpDataBlock(
|
|
IN PVOID Address,
|
|
IN ULONG Length
|
|
);
|
|
|
|
|
|
VOID
|
|
IoFreeDumpStack(
|
|
IN PDUMP_STACK_CONTEXT DumpStack
|
|
);
|
|
|
|
// begin_ntddk begin_wdm begin_nthal begin_ntifs begin_ntosp
|
|
//
|
|
// Define the structures used by the I/O system
|
|
//
|
|
|
|
//
|
|
// Define empty typedefs for the _IRP, _DEVICE_OBJECT, and _DRIVER_OBJECT
|
|
// structures so they may be referenced by function types before they are
|
|
// actually defined.
|
|
//
|
|
struct _DEVICE_DESCRIPTION;
|
|
struct _DEVICE_OBJECT;
|
|
struct _DMA_ADAPTER;
|
|
struct _DRIVER_OBJECT;
|
|
struct _DRIVE_LAYOUT_INFORMATION;
|
|
struct _DISK_PARTITION;
|
|
struct _FILE_OBJECT;
|
|
struct _IRP;
|
|
struct _SCSI_REQUEST_BLOCK;
|
|
struct _SCATTER_GATHER_LIST;
|
|
|
|
//
|
|
// Define the I/O version of a DPC routine.
|
|
//
|
|
|
|
typedef
|
|
VOID
|
|
(*PIO_DPC_ROUTINE) (
|
|
IN PKDPC Dpc,
|
|
IN struct _DEVICE_OBJECT *DeviceObject,
|
|
IN struct _IRP *Irp,
|
|
IN PVOID Context
|
|
);
|
|
|
|
//
|
|
// Define driver timer routine type.
|
|
//
|
|
|
|
typedef
|
|
VOID
|
|
(*PIO_TIMER_ROUTINE) (
|
|
IN struct _DEVICE_OBJECT *DeviceObject,
|
|
IN PVOID Context
|
|
);
|
|
|
|
//
|
|
// Define driver initialization routine type.
|
|
//
|
|
typedef
|
|
NTSTATUS
|
|
(*PDRIVER_INITIALIZE) (
|
|
IN struct _DRIVER_OBJECT *DriverObject,
|
|
IN PUNICODE_STRING RegistryPath
|
|
);
|
|
|
|
// end_wdm
|
|
//
|
|
// Define driver reinitialization routine type.
|
|
//
|
|
|
|
typedef
|
|
VOID
|
|
(*PDRIVER_REINITIALIZE) (
|
|
IN struct _DRIVER_OBJECT *DriverObject,
|
|
IN PVOID Context,
|
|
IN ULONG Count
|
|
);
|
|
|
|
// begin_wdm begin_ntndis
|
|
//
|
|
// Define driver cancel routine type.
|
|
//
|
|
|
|
typedef
|
|
VOID
|
|
(*PDRIVER_CANCEL) (
|
|
IN struct _DEVICE_OBJECT *DeviceObject,
|
|
IN struct _IRP *Irp
|
|
);
|
|
|
|
//
|
|
// Define driver dispatch routine type.
|
|
//
|
|
|
|
typedef
|
|
NTSTATUS
|
|
(*PDRIVER_DISPATCH) (
|
|
IN struct _DEVICE_OBJECT *DeviceObject,
|
|
IN struct _IRP *Irp
|
|
);
|
|
|
|
//
|
|
// Define driver start I/O routine type.
|
|
//
|
|
|
|
typedef
|
|
VOID
|
|
(*PDRIVER_STARTIO) (
|
|
IN struct _DEVICE_OBJECT *DeviceObject,
|
|
IN struct _IRP *Irp
|
|
);
|
|
|
|
//
|
|
// Define driver unload routine type.
|
|
//
|
|
typedef
|
|
VOID
|
|
(*PDRIVER_UNLOAD) (
|
|
IN struct _DRIVER_OBJECT *DriverObject
|
|
);
|
|
//
|
|
// Define driver AddDevice routine type.
|
|
//
|
|
|
|
typedef
|
|
NTSTATUS
|
|
(*PDRIVER_ADD_DEVICE) (
|
|
IN struct _DRIVER_OBJECT *DriverObject,
|
|
IN struct _DEVICE_OBJECT *PhysicalDeviceObject
|
|
);
|
|
|
|
// end_ntddk end_wdm end_nthal end_ntndis end_ntosp
|
|
|
|
//
|
|
// Define driver FS notification change routine type.
|
|
//
|
|
|
|
typedef
|
|
VOID
|
|
(*PDRIVER_FS_NOTIFICATION) (
|
|
IN struct _DEVICE_OBJECT *DeviceObject,
|
|
IN BOOLEAN FsActive
|
|
);
|
|
|
|
// begin_ntddk begin_wdm begin_ntosp
|
|
|
|
//
|
|
// Define fast I/O procedure prototypes.
|
|
//
|
|
// Fast I/O read and write procedures.
|
|
//
|
|
|
|
typedef
|
|
BOOLEAN
|
|
(*PFAST_IO_CHECK_IF_POSSIBLE) (
|
|
IN struct _FILE_OBJECT *FileObject,
|
|
IN PLARGE_INTEGER FileOffset,
|
|
IN ULONG Length,
|
|
IN BOOLEAN Wait,
|
|
IN ULONG LockKey,
|
|
IN BOOLEAN CheckForReadOperation,
|
|
OUT PIO_STATUS_BLOCK IoStatus,
|
|
IN struct _DEVICE_OBJECT *DeviceObject
|
|
);
|
|
|
|
typedef
|
|
BOOLEAN
|
|
(*PFAST_IO_READ) (
|
|
IN struct _FILE_OBJECT *FileObject,
|
|
IN PLARGE_INTEGER FileOffset,
|
|
IN ULONG Length,
|
|
IN BOOLEAN Wait,
|
|
IN ULONG LockKey,
|
|
OUT PVOID Buffer,
|
|
OUT PIO_STATUS_BLOCK IoStatus,
|
|
IN struct _DEVICE_OBJECT *DeviceObject
|
|
);
|
|
|
|
typedef
|
|
BOOLEAN
|
|
(*PFAST_IO_WRITE) (
|
|
IN struct _FILE_OBJECT *FileObject,
|
|
IN PLARGE_INTEGER FileOffset,
|
|
IN ULONG Length,
|
|
IN BOOLEAN Wait,
|
|
IN ULONG LockKey,
|
|
IN PVOID Buffer,
|
|
OUT PIO_STATUS_BLOCK IoStatus,
|
|
IN struct _DEVICE_OBJECT *DeviceObject
|
|
);
|
|
|
|
//
|
|
// Fast I/O query basic and standard information procedures.
|
|
//
|
|
|
|
typedef
|
|
BOOLEAN
|
|
(*PFAST_IO_QUERY_BASIC_INFO) (
|
|
IN struct _FILE_OBJECT *FileObject,
|
|
IN BOOLEAN Wait,
|
|
OUT PFILE_BASIC_INFORMATION Buffer,
|
|
OUT PIO_STATUS_BLOCK IoStatus,
|
|
IN struct _DEVICE_OBJECT *DeviceObject
|
|
);
|
|
|
|
typedef
|
|
BOOLEAN
|
|
(*PFAST_IO_QUERY_STANDARD_INFO) (
|
|
IN struct _FILE_OBJECT *FileObject,
|
|
IN BOOLEAN Wait,
|
|
OUT PFILE_STANDARD_INFORMATION Buffer,
|
|
OUT PIO_STATUS_BLOCK IoStatus,
|
|
IN struct _DEVICE_OBJECT *DeviceObject
|
|
);
|
|
|
|
//
|
|
// Fast I/O lock and unlock procedures.
|
|
//
|
|
|
|
typedef
|
|
BOOLEAN
|
|
(*PFAST_IO_LOCK) (
|
|
IN struct _FILE_OBJECT *FileObject,
|
|
IN PLARGE_INTEGER FileOffset,
|
|
IN PLARGE_INTEGER Length,
|
|
PEPROCESS ProcessId,
|
|
ULONG Key,
|
|
BOOLEAN FailImmediately,
|
|
BOOLEAN ExclusiveLock,
|
|
OUT PIO_STATUS_BLOCK IoStatus,
|
|
IN struct _DEVICE_OBJECT *DeviceObject
|
|
);
|
|
|
|
typedef
|
|
BOOLEAN
|
|
(*PFAST_IO_UNLOCK_SINGLE) (
|
|
IN struct _FILE_OBJECT *FileObject,
|
|
IN PLARGE_INTEGER FileOffset,
|
|
IN PLARGE_INTEGER Length,
|
|
PEPROCESS ProcessId,
|
|
ULONG Key,
|
|
OUT PIO_STATUS_BLOCK IoStatus,
|
|
IN struct _DEVICE_OBJECT *DeviceObject
|
|
);
|
|
|
|
typedef
|
|
BOOLEAN
|
|
(*PFAST_IO_UNLOCK_ALL) (
|
|
IN struct _FILE_OBJECT *FileObject,
|
|
PEPROCESS ProcessId,
|
|
OUT PIO_STATUS_BLOCK IoStatus,
|
|
IN struct _DEVICE_OBJECT *DeviceObject
|
|
);
|
|
|
|
typedef
|
|
BOOLEAN
|
|
(*PFAST_IO_UNLOCK_ALL_BY_KEY) (
|
|
IN struct _FILE_OBJECT *FileObject,
|
|
PVOID ProcessId,
|
|
ULONG Key,
|
|
OUT PIO_STATUS_BLOCK IoStatus,
|
|
IN struct _DEVICE_OBJECT *DeviceObject
|
|
);
|
|
|
|
//
|
|
// Fast I/O device control procedure.
|
|
//
|
|
|
|
typedef
|
|
BOOLEAN
|
|
(*PFAST_IO_DEVICE_CONTROL) (
|
|
IN struct _FILE_OBJECT *FileObject,
|
|
IN BOOLEAN Wait,
|
|
IN PVOID InputBuffer OPTIONAL,
|
|
IN ULONG InputBufferLength,
|
|
OUT PVOID OutputBuffer OPTIONAL,
|
|
IN ULONG OutputBufferLength,
|
|
IN ULONG IoControlCode,
|
|
OUT PIO_STATUS_BLOCK IoStatus,
|
|
IN struct _DEVICE_OBJECT *DeviceObject
|
|
);
|
|
|
|
//
|
|
// Define callbacks for NtCreateSection to synchronize correctly with
|
|
// the file system. It pre-acquires the resources that will be needed
|
|
// when calling to query and set file/allocation size in the file system.
|
|
//
|
|
|
|
typedef
|
|
VOID
|
|
(*PFAST_IO_ACQUIRE_FILE) (
|
|
IN struct _FILE_OBJECT *FileObject
|
|
);
|
|
|
|
typedef
|
|
VOID
|
|
(*PFAST_IO_RELEASE_FILE) (
|
|
IN struct _FILE_OBJECT *FileObject
|
|
);
|
|
|
|
//
|
|
// Define callback for drivers that have device objects attached to lower-
|
|
// level drivers' device objects. This callback is made when the lower-level
|
|
// driver is deleting its device object.
|
|
//
|
|
|
|
typedef
|
|
VOID
|
|
(*PFAST_IO_DETACH_DEVICE) (
|
|
IN struct _DEVICE_OBJECT *SourceDevice,
|
|
IN struct _DEVICE_OBJECT *TargetDevice
|
|
);
|
|
|
|
//
|
|
// This structure is used by the server to quickly get the information needed
|
|
// to service a server open call. It is takes what would be two fast io calls
|
|
// one for basic information and the other for standard information and makes
|
|
// it into one call.
|
|
//
|
|
|
|
typedef
|
|
BOOLEAN
|
|
(*PFAST_IO_QUERY_NETWORK_OPEN_INFO) (
|
|
IN struct _FILE_OBJECT *FileObject,
|
|
IN BOOLEAN Wait,
|
|
OUT struct _FILE_NETWORK_OPEN_INFORMATION *Buffer,
|
|
OUT struct _IO_STATUS_BLOCK *IoStatus,
|
|
IN struct _DEVICE_OBJECT *DeviceObject
|
|
);
|
|
|
|
//
|
|
// Define Mdl-based routines for the server to call
|
|
//
|
|
|
|
typedef
|
|
BOOLEAN
|
|
(*PFAST_IO_MDL_READ) (
|
|
IN struct _FILE_OBJECT *FileObject,
|
|
IN PLARGE_INTEGER FileOffset,
|
|
IN ULONG Length,
|
|
IN ULONG LockKey,
|
|
OUT PMDL *MdlChain,
|
|
OUT PIO_STATUS_BLOCK IoStatus,
|
|
IN struct _DEVICE_OBJECT *DeviceObject
|
|
);
|
|
|
|
typedef
|
|
BOOLEAN
|
|
(*PFAST_IO_MDL_READ_COMPLETE) (
|
|
IN struct _FILE_OBJECT *FileObject,
|
|
IN PMDL MdlChain,
|
|
IN struct _DEVICE_OBJECT *DeviceObject
|
|
);
|
|
|
|
typedef
|
|
BOOLEAN
|
|
(*PFAST_IO_PREPARE_MDL_WRITE) (
|
|
IN struct _FILE_OBJECT *FileObject,
|
|
IN PLARGE_INTEGER FileOffset,
|
|
IN ULONG Length,
|
|
IN ULONG LockKey,
|
|
OUT PMDL *MdlChain,
|
|
OUT PIO_STATUS_BLOCK IoStatus,
|
|
IN struct _DEVICE_OBJECT *DeviceObject
|
|
);
|
|
|
|
typedef
|
|
BOOLEAN
|
|
(*PFAST_IO_MDL_WRITE_COMPLETE) (
|
|
IN struct _FILE_OBJECT *FileObject,
|
|
IN PLARGE_INTEGER FileOffset,
|
|
IN PMDL MdlChain,
|
|
IN struct _DEVICE_OBJECT *DeviceObject
|
|
);
|
|
|
|
//
|
|
// If this routine is present, it will be called by FsRtl
|
|
// to acquire the file for the mapped page writer.
|
|
//
|
|
|
|
typedef
|
|
NTSTATUS
|
|
(*PFAST_IO_ACQUIRE_FOR_MOD_WRITE) (
|
|
IN struct _FILE_OBJECT *FileObject,
|
|
IN PLARGE_INTEGER EndingOffset,
|
|
OUT struct _ERESOURCE **ResourceToRelease,
|
|
IN struct _DEVICE_OBJECT *DeviceObject
|
|
);
|
|
|
|
typedef
|
|
NTSTATUS
|
|
(*PFAST_IO_RELEASE_FOR_MOD_WRITE) (
|
|
IN struct _FILE_OBJECT *FileObject,
|
|
IN struct _ERESOURCE *ResourceToRelease,
|
|
IN struct _DEVICE_OBJECT *DeviceObject
|
|
);
|
|
|
|
//
|
|
// If this routine is present, it will be called by FsRtl
|
|
// to acquire the file for the mapped page writer.
|
|
//
|
|
|
|
typedef
|
|
NTSTATUS
|
|
(*PFAST_IO_ACQUIRE_FOR_CCFLUSH) (
|
|
IN struct _FILE_OBJECT *FileObject,
|
|
IN struct _DEVICE_OBJECT *DeviceObject
|
|
);
|
|
|
|
typedef
|
|
NTSTATUS
|
|
(*PFAST_IO_RELEASE_FOR_CCFLUSH) (
|
|
IN struct _FILE_OBJECT *FileObject,
|
|
IN struct _DEVICE_OBJECT *DeviceObject
|
|
);
|
|
|
|
typedef
|
|
BOOLEAN
|
|
(*PFAST_IO_READ_COMPRESSED) (
|
|
IN struct _FILE_OBJECT *FileObject,
|
|
IN PLARGE_INTEGER FileOffset,
|
|
IN ULONG Length,
|
|
IN ULONG LockKey,
|
|
OUT PVOID Buffer,
|
|
OUT PMDL *MdlChain,
|
|
OUT PIO_STATUS_BLOCK IoStatus,
|
|
OUT struct _COMPRESSED_DATA_INFO *CompressedDataInfo,
|
|
IN ULONG CompressedDataInfoLength,
|
|
IN struct _DEVICE_OBJECT *DeviceObject
|
|
);
|
|
|
|
typedef
|
|
BOOLEAN
|
|
(*PFAST_IO_WRITE_COMPRESSED) (
|
|
IN struct _FILE_OBJECT *FileObject,
|
|
IN PLARGE_INTEGER FileOffset,
|
|
IN ULONG Length,
|
|
IN ULONG LockKey,
|
|
IN PVOID Buffer,
|
|
OUT PMDL *MdlChain,
|
|
OUT PIO_STATUS_BLOCK IoStatus,
|
|
IN struct _COMPRESSED_DATA_INFO *CompressedDataInfo,
|
|
IN ULONG CompressedDataInfoLength,
|
|
IN struct _DEVICE_OBJECT *DeviceObject
|
|
);
|
|
|
|
typedef
|
|
BOOLEAN
|
|
(*PFAST_IO_MDL_READ_COMPLETE_COMPRESSED) (
|
|
IN struct _FILE_OBJECT *FileObject,
|
|
IN PMDL MdlChain,
|
|
IN struct _DEVICE_OBJECT *DeviceObject
|
|
);
|
|
|
|
typedef
|
|
BOOLEAN
|
|
(*PFAST_IO_MDL_WRITE_COMPLETE_COMPRESSED) (
|
|
IN struct _FILE_OBJECT *FileObject,
|
|
IN PLARGE_INTEGER FileOffset,
|
|
IN PMDL MdlChain,
|
|
IN struct _DEVICE_OBJECT *DeviceObject
|
|
);
|
|
|
|
typedef
|
|
BOOLEAN
|
|
(*PFAST_IO_QUERY_OPEN) (
|
|
IN struct _IRP *Irp,
|
|
OUT PFILE_NETWORK_OPEN_INFORMATION NetworkInformation,
|
|
IN struct _DEVICE_OBJECT *DeviceObject
|
|
);
|
|
|
|
//
|
|
// Define the structure to describe the Fast I/O dispatch routines. Any
|
|
// additions made to this structure MUST be added monotonically to the end
|
|
// of the structure, and fields CANNOT be removed from the middle.
|
|
//
|
|
|
|
typedef struct _FAST_IO_DISPATCH {
|
|
ULONG SizeOfFastIoDispatch;
|
|
PFAST_IO_CHECK_IF_POSSIBLE FastIoCheckIfPossible;
|
|
PFAST_IO_READ FastIoRead;
|
|
PFAST_IO_WRITE FastIoWrite;
|
|
PFAST_IO_QUERY_BASIC_INFO FastIoQueryBasicInfo;
|
|
PFAST_IO_QUERY_STANDARD_INFO FastIoQueryStandardInfo;
|
|
PFAST_IO_LOCK FastIoLock;
|
|
PFAST_IO_UNLOCK_SINGLE FastIoUnlockSingle;
|
|
PFAST_IO_UNLOCK_ALL FastIoUnlockAll;
|
|
PFAST_IO_UNLOCK_ALL_BY_KEY FastIoUnlockAllByKey;
|
|
PFAST_IO_DEVICE_CONTROL FastIoDeviceControl;
|
|
PFAST_IO_ACQUIRE_FILE AcquireFileForNtCreateSection;
|
|
PFAST_IO_RELEASE_FILE ReleaseFileForNtCreateSection;
|
|
PFAST_IO_DETACH_DEVICE FastIoDetachDevice;
|
|
PFAST_IO_QUERY_NETWORK_OPEN_INFO FastIoQueryNetworkOpenInfo;
|
|
PFAST_IO_ACQUIRE_FOR_MOD_WRITE AcquireForModWrite;
|
|
PFAST_IO_MDL_READ MdlRead;
|
|
PFAST_IO_MDL_READ_COMPLETE MdlReadComplete;
|
|
PFAST_IO_PREPARE_MDL_WRITE PrepareMdlWrite;
|
|
PFAST_IO_MDL_WRITE_COMPLETE MdlWriteComplete;
|
|
PFAST_IO_READ_COMPRESSED FastIoReadCompressed;
|
|
PFAST_IO_WRITE_COMPRESSED FastIoWriteCompressed;
|
|
PFAST_IO_MDL_READ_COMPLETE_COMPRESSED MdlReadCompleteCompressed;
|
|
PFAST_IO_MDL_WRITE_COMPLETE_COMPRESSED MdlWriteCompleteCompressed;
|
|
PFAST_IO_QUERY_OPEN FastIoQueryOpen;
|
|
PFAST_IO_RELEASE_FOR_MOD_WRITE ReleaseForModWrite;
|
|
PFAST_IO_ACQUIRE_FOR_CCFLUSH AcquireForCcFlush;
|
|
PFAST_IO_RELEASE_FOR_CCFLUSH ReleaseForCcFlush;
|
|
} FAST_IO_DISPATCH, *PFAST_IO_DISPATCH;
|
|
|
|
// end_ntddk end_wdm end_ntosp
|
|
|
|
//
|
|
// Valid values for FS_FILTER_PARAMETERS.AcquireForSectionSynchronization.SyncType
|
|
//
|
|
|
|
typedef enum _FS_FILTER_SECTION_SYNC_TYPE {
|
|
SyncTypeOther = 0,
|
|
SyncTypeCreateSection
|
|
} FS_FILTER_SECTION_SYNC_TYPE, *PFS_FILTER_SECTION_SYNC_TYPE;
|
|
|
|
//
|
|
// Parameters union for the operations that
|
|
// are exposed to the filters through the
|
|
// FsFilterCallbacks registration mechanism.
|
|
//
|
|
|
|
typedef union _FS_FILTER_PARAMETERS {
|
|
|
|
//
|
|
// AcquireForModifiedPageWriter
|
|
//
|
|
|
|
struct {
|
|
PLARGE_INTEGER EndingOffset;
|
|
} AcquireForModifiedPageWriter;
|
|
|
|
//
|
|
// ReleaseForModifiedPageWriter
|
|
//
|
|
|
|
struct {
|
|
PERESOURCE ResourceToRelease;
|
|
} ReleaseForModifiedPageWriter;
|
|
|
|
//
|
|
// AcquireForSectionSynchronization
|
|
//
|
|
|
|
struct {
|
|
FS_FILTER_SECTION_SYNC_TYPE SyncType;
|
|
ULONG PageProtection;
|
|
} AcquireForSectionSynchronization;
|
|
|
|
//
|
|
// Other
|
|
//
|
|
|
|
struct {
|
|
PVOID Argument1;
|
|
PVOID Argument2;
|
|
PVOID Argument3;
|
|
PVOID Argument4;
|
|
PVOID Argument5;
|
|
} Others;
|
|
|
|
} FS_FILTER_PARAMETERS, *PFS_FILTER_PARAMETERS;
|
|
|
|
//
|
|
// These are the valid values for the Operation field
|
|
// of the FS_FILTER_CALLBACK_DATA structure.
|
|
//
|
|
|
|
#define FS_FILTER_ACQUIRE_FOR_SECTION_SYNCHRONIZATION (UCHAR)-1
|
|
#define FS_FILTER_RELEASE_FOR_SECTION_SYNCHRONIZATION (UCHAR)-2
|
|
#define FS_FILTER_ACQUIRE_FOR_MOD_WRITE (UCHAR)-3
|
|
#define FS_FILTER_RELEASE_FOR_MOD_WRITE (UCHAR)-4
|
|
#define FS_FILTER_ACQUIRE_FOR_CC_FLUSH (UCHAR)-5
|
|
#define FS_FILTER_RELEASE_FOR_CC_FLUSH (UCHAR)-6
|
|
|
|
typedef struct _FS_FILTER_CALLBACK_DATA {
|
|
|
|
ULONG SizeOfFsFilterCallbackData;
|
|
UCHAR Operation;
|
|
UCHAR Reserved;
|
|
|
|
struct _DEVICE_OBJECT *DeviceObject;
|
|
struct _FILE_OBJECT *FileObject;
|
|
|
|
FS_FILTER_PARAMETERS Parameters;
|
|
|
|
} FS_FILTER_CALLBACK_DATA, *PFS_FILTER_CALLBACK_DATA;
|
|
|
|
//
|
|
// Prototype for the callbacks received before an operation
|
|
// is passed to the base file system.
|
|
//
|
|
// A filter can fail this operation, but consistant failure
|
|
// will halt system progress.
|
|
//
|
|
|
|
typedef
|
|
NTSTATUS
|
|
(*PFS_FILTER_CALLBACK) (
|
|
IN PFS_FILTER_CALLBACK_DATA Data,
|
|
OUT PVOID *CompletionContext
|
|
);
|
|
|
|
//
|
|
// Prototype for the completion callback received after an
|
|
// operation is completed.
|
|
//
|
|
|
|
typedef
|
|
VOID
|
|
(*PFS_FILTER_COMPLETION_CALLBACK) (
|
|
IN PFS_FILTER_CALLBACK_DATA Data,
|
|
IN NTSTATUS OperationStatus,
|
|
IN PVOID CompletionContext
|
|
);
|
|
|
|
//
|
|
// This is the structure that the file system filter fills in to
|
|
// receive notifications for these locking operations.
|
|
//
|
|
// A filter should set the field to NULL for any notification callback
|
|
// it doesn't wish to receive.
|
|
//
|
|
|
|
typedef struct _FS_FILTER_CALLBACKS {
|
|
|
|
ULONG SizeOfFsFilterCallbacks;
|
|
ULONG Reserved; // For alignment
|
|
|
|
PFS_FILTER_CALLBACK PreAcquireForSectionSynchronization;
|
|
PFS_FILTER_COMPLETION_CALLBACK PostAcquireForSectionSynchronization;
|
|
PFS_FILTER_CALLBACK PreReleaseForSectionSynchronization;
|
|
PFS_FILTER_COMPLETION_CALLBACK PostReleaseForSectionSynchronization;
|
|
PFS_FILTER_CALLBACK PreAcquireForCcFlush;
|
|
PFS_FILTER_COMPLETION_CALLBACK PostAcquireForCcFlush;
|
|
PFS_FILTER_CALLBACK PreReleaseForCcFlush;
|
|
PFS_FILTER_COMPLETION_CALLBACK PostReleaseForCcFlush;
|
|
PFS_FILTER_CALLBACK PreAcquireForModifiedPageWriter;
|
|
PFS_FILTER_COMPLETION_CALLBACK PostAcquireForModifiedPageWriter;
|
|
PFS_FILTER_CALLBACK PreReleaseForModifiedPageWriter;
|
|
PFS_FILTER_COMPLETION_CALLBACK PostReleaseForModifiedPageWriter;
|
|
|
|
} FS_FILTER_CALLBACKS, *PFS_FILTER_CALLBACKS;
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
FsRtlRegisterFileSystemFilterCallbacks (
|
|
IN struct _DRIVER_OBJECT *FilterDriverObject,
|
|
IN PFS_FILTER_CALLBACKS Callbacks
|
|
);
|
|
|
|
// begin_ntddk begin_wdm begin_nthal begin_ntosp
|
|
//
|
|
// Define the actions that a driver execution routine may request of the
|
|
// adapter/controller allocation routines upon return.
|
|
//
|
|
|
|
typedef enum _IO_ALLOCATION_ACTION {
|
|
KeepObject = 1,
|
|
DeallocateObject,
|
|
DeallocateObjectKeepRegisters
|
|
} IO_ALLOCATION_ACTION, *PIO_ALLOCATION_ACTION;
|
|
|
|
//
|
|
// Define device driver adapter/controller execution routine.
|
|
//
|
|
|
|
typedef
|
|
IO_ALLOCATION_ACTION
|
|
(*PDRIVER_CONTROL) (
|
|
IN struct _DEVICE_OBJECT *DeviceObject,
|
|
IN struct _IRP *Irp,
|
|
IN PVOID MapRegisterBase,
|
|
IN PVOID Context
|
|
);
|
|
|
|
// end_ntddk end_wdm end_nthal end_ntifs end_ntosp
|
|
|
|
//
|
|
// Define the I/O system's structure for a connected interrupt. This is
|
|
// useful for connecting an ISR to several different processors.
|
|
//
|
|
|
|
typedef struct _IO_INTERRUPT_STRUCTURE {
|
|
KINTERRUPT InterruptObject;
|
|
PKINTERRUPT InterruptArray[MAXIMUM_PROCESSORS];
|
|
KSPIN_LOCK SpinLock;
|
|
} IO_INTERRUPT_STRUCTURE, *PIO_INTERRUPT_STRUCTURE;
|
|
|
|
// begin_ntddk begin_wdm begin_ntifs begin_ntosp
|
|
//
|
|
// Define the I/O system's security context type for use by file system's
|
|
// when checking access to volumes, files, and directories.
|
|
//
|
|
|
|
typedef struct _IO_SECURITY_CONTEXT {
|
|
PSECURITY_QUALITY_OF_SERVICE SecurityQos;
|
|
PACCESS_STATE AccessState;
|
|
ACCESS_MASK DesiredAccess;
|
|
ULONG FullCreateOptions;
|
|
} IO_SECURITY_CONTEXT, *PIO_SECURITY_CONTEXT;
|
|
|
|
// end_ntddk end_wdm end_ntifs end_ntosp
|
|
|
|
//
|
|
// Define the I/O system's version of a timer.
|
|
//
|
|
|
|
typedef struct _IO_TIMER {
|
|
CSHORT Type;
|
|
CSHORT TimerFlag;
|
|
LIST_ENTRY TimerList;
|
|
PIO_TIMER_ROUTINE TimerRoutine;
|
|
PVOID Context;
|
|
struct _DEVICE_OBJECT *DeviceObject;
|
|
} IO_TIMER, *PIO_TIMER;
|
|
|
|
//
|
|
// Define the client driver object extension header.
|
|
//
|
|
|
|
typedef struct _IO_CLIENT_EXTENSION {
|
|
struct _IO_CLIENT_EXTENSION *NextExtension;
|
|
PVOID ClientIdentificationAddress;
|
|
} IO_CLIENT_EXTENSION, *PIO_CLIENT_EXTENSION;
|
|
|
|
// begin_ntddk begin_nthal begin_ntifs begin_ntosp
|
|
//
|
|
// Define Volume Parameter Block (VPB) flags.
|
|
//
|
|
|
|
#define VPB_MOUNTED 0x00000001
|
|
#define VPB_LOCKED 0x00000002
|
|
#define VPB_PERSISTENT 0x00000004
|
|
#define VPB_REMOVE_PENDING 0x00000008
|
|
#define VPB_RAW_MOUNT 0x00000010
|
|
|
|
|
|
//
|
|
// Volume Parameter Block (VPB)
|
|
//
|
|
|
|
#define MAXIMUM_VOLUME_LABEL_LENGTH (32 * sizeof(WCHAR)) // 32 characters
|
|
|
|
typedef struct _VPB {
|
|
CSHORT Type;
|
|
CSHORT Size;
|
|
USHORT Flags;
|
|
USHORT VolumeLabelLength; // in bytes
|
|
struct _DEVICE_OBJECT *DeviceObject;
|
|
struct _DEVICE_OBJECT *RealDevice;
|
|
ULONG SerialNumber;
|
|
ULONG ReferenceCount;
|
|
WCHAR VolumeLabel[MAXIMUM_VOLUME_LABEL_LENGTH / sizeof(WCHAR)];
|
|
} VPB, *PVPB;
|
|
|
|
|
|
#if defined(_WIN64)
|
|
|
|
//
|
|
// Use __inline DMA macros (hal.h)
|
|
//
|
|
#ifndef USE_DMA_MACROS
|
|
#define USE_DMA_MACROS
|
|
#endif
|
|
|
|
//
|
|
// Only PnP drivers!
|
|
//
|
|
#ifndef NO_LEGACY_DRIVERS
|
|
#define NO_LEGACY_DRIVERS
|
|
#endif
|
|
|
|
#endif // _WIN64
|
|
|
|
|
|
#if defined(USE_DMA_MACROS) && (defined(_NTDDK_) || defined(_NTDRIVER_) || defined(_NTOSP_))
|
|
|
|
// begin_wdm
|
|
//
|
|
// Define object type specific fields of various objects used by the I/O system
|
|
//
|
|
|
|
typedef struct _DMA_ADAPTER *PADAPTER_OBJECT;
|
|
|
|
// end_wdm
|
|
#else
|
|
|
|
//
|
|
// Define object type specific fields of various objects used by the I/O system
|
|
//
|
|
|
|
typedef struct _ADAPTER_OBJECT *PADAPTER_OBJECT; // ntndis
|
|
|
|
#endif // USE_DMA_MACROS && (_NTDDK_ || _NTDRIVER_ || _NTOSP_)
|
|
|
|
// begin_wdm
|
|
//
|
|
// Define Wait Context Block (WCB)
|
|
//
|
|
|
|
typedef struct _WAIT_CONTEXT_BLOCK {
|
|
KDEVICE_QUEUE_ENTRY WaitQueueEntry;
|
|
PDRIVER_CONTROL DeviceRoutine;
|
|
PVOID DeviceContext;
|
|
ULONG NumberOfMapRegisters;
|
|
PVOID DeviceObject;
|
|
PVOID CurrentIrp;
|
|
PKDPC BufferChainingDpc;
|
|
} WAIT_CONTEXT_BLOCK, *PWAIT_CONTEXT_BLOCK;
|
|
|
|
// end_wdm
|
|
|
|
typedef struct _CONTROLLER_OBJECT {
|
|
CSHORT Type;
|
|
CSHORT Size;
|
|
PVOID ControllerExtension;
|
|
KDEVICE_QUEUE DeviceWaitQueue;
|
|
|
|
ULONG Spare1;
|
|
LARGE_INTEGER Spare2;
|
|
|
|
} CONTROLLER_OBJECT, *PCONTROLLER_OBJECT;
|
|
|
|
// begin_wdm
|
|
//
|
|
// Define Device Object (DO) flags
|
|
//
|
|
// end_wdm end_ntddk end_nthal end_ntifs
|
|
|
|
#define DO_VERIFY_VOLUME 0x00000002 // ntddk nthal ntifs
|
|
#define DO_BUFFERED_IO 0x00000004 // ntddk nthal ntifs wdm
|
|
#define DO_EXCLUSIVE 0x00000008 // ntddk nthal ntifs wdm
|
|
#define DO_DIRECT_IO 0x00000010 // ntddk nthal ntifs wdm
|
|
#define DO_MAP_IO_BUFFER 0x00000020 // ntddk nthal ntifs wdm
|
|
#define DO_DEVICE_HAS_NAME 0x00000040 // ntddk nthal ntifs
|
|
#define DO_DEVICE_INITIALIZING 0x00000080 // ntddk nthal ntifs wdm
|
|
#define DO_SYSTEM_BOOT_PARTITION 0x00000100 // ntddk nthal ntifs
|
|
#define DO_LONG_TERM_REQUESTS 0x00000200 // ntddk nthal ntifs
|
|
#define DO_NEVER_LAST_DEVICE 0x00000400 // ntddk nthal ntifs
|
|
#define DO_SHUTDOWN_REGISTERED 0x00000800 // ntddk nthal ntifs wdm
|
|
#define DO_BUS_ENUMERATED_DEVICE 0x00001000 // ntddk nthal ntifs wdm
|
|
#define DO_POWER_PAGABLE 0x00002000 // ntddk nthal ntifs wdm
|
|
#define DO_POWER_INRUSH 0x00004000 // ntddk nthal ntifs wdm
|
|
#define DO_POWER_NOOP 0x00008000
|
|
#define DO_LOW_PRIORITY_FILESYSTEM 0x00010000 // ntddk nthal ntifs
|
|
#define DO_XIP 0x00020000
|
|
|
|
// begin_wdm begin_ntddk begin_nthal begin_ntifs
|
|
//
|
|
// Device Object structure definition
|
|
//
|
|
|
|
typedef struct DECLSPEC_ALIGN(MEMORY_ALLOCATION_ALIGNMENT) _DEVICE_OBJECT {
|
|
CSHORT Type;
|
|
USHORT Size;
|
|
LONG ReferenceCount;
|
|
struct _DRIVER_OBJECT *DriverObject;
|
|
struct _DEVICE_OBJECT *NextDevice;
|
|
struct _DEVICE_OBJECT *AttachedDevice;
|
|
struct _IRP *CurrentIrp;
|
|
PIO_TIMER Timer;
|
|
ULONG Flags; // See above: DO_...
|
|
ULONG Characteristics; // See ntioapi: FILE_...
|
|
PVPB Vpb;
|
|
PVOID DeviceExtension;
|
|
DEVICE_TYPE DeviceType;
|
|
CCHAR StackSize;
|
|
union {
|
|
LIST_ENTRY ListEntry;
|
|
WAIT_CONTEXT_BLOCK Wcb;
|
|
} Queue;
|
|
ULONG AlignmentRequirement;
|
|
KDEVICE_QUEUE DeviceQueue;
|
|
KDPC Dpc;
|
|
|
|
//
|
|
// The following field is for exclusive use by the filesystem to keep
|
|
// track of the number of Fsp threads currently using the device
|
|
//
|
|
|
|
ULONG ActiveThreadCount;
|
|
PSECURITY_DESCRIPTOR SecurityDescriptor;
|
|
KEVENT DeviceLock;
|
|
|
|
USHORT SectorSize;
|
|
USHORT Spare1;
|
|
|
|
struct _DEVOBJ_EXTENSION *DeviceObjectExtension;
|
|
PVOID Reserved;
|
|
} DEVICE_OBJECT;
|
|
|
|
typedef struct _DEVICE_OBJECT *PDEVICE_OBJECT; // ntndis
|
|
|
|
// end_ntddk end_nthal end_ntifs end_wdm end_ntosp
|
|
//
|
|
// Define the Device Object Extension Flags
|
|
//
|
|
|
|
#define DOE_UNLOAD_PENDING 0x00000001
|
|
#define DOE_DELETE_PENDING 0x00000002
|
|
#define DOE_REMOVE_PENDING 0x00000004
|
|
#define DOE_REMOVE_PROCESSED 0x00000008
|
|
#define DOE_START_PENDING 0x00000010
|
|
#define DOE_STARTIO_REQUESTED 0x00000020
|
|
#define DOE_STARTIO_REQUESTED_BYKEY 0x00000040
|
|
#define DOE_STARTIO_CANCELABLE 0x00000080
|
|
#define DOE_STARTIO_DEFERRED 0x00000100 // Use non-recursive startio
|
|
#define DOE_STARTIO_NO_CANCEL 0x00000200 // Pass non-cancelable IRP to startio
|
|
|
|
// begin_ntddk begin_nthal begin_ntifs begin_wdm begin_ntosp
|
|
|
|
struct _DEVICE_OBJECT_POWER_EXTENSION;
|
|
|
|
typedef struct _DEVOBJ_EXTENSION {
|
|
|
|
CSHORT Type;
|
|
USHORT Size;
|
|
|
|
//
|
|
// Public part of the DeviceObjectExtension structure
|
|
//
|
|
|
|
PDEVICE_OBJECT DeviceObject; // owning device object
|
|
|
|
// end_ntddk end_nthal end_ntifs end_wdm end_ntosp
|
|
|
|
//
|
|
// Universal Power Data - all device objects must have this
|
|
//
|
|
|
|
ULONG PowerFlags; // see ntos\po\pop.h
|
|
// WARNING: Access via PO macros
|
|
// and with PO locking rules ONLY.
|
|
|
|
//
|
|
// Pointer to the non-universal power data
|
|
// Power data that only some device objects need is stored in the
|
|
// device object power extension -> DOPE
|
|
// see po.h
|
|
//
|
|
|
|
struct _DEVICE_OBJECT_POWER_EXTENSION *Dope;
|
|
|
|
//
|
|
// power state information
|
|
//
|
|
|
|
//
|
|
// Device object extension flags. Protected by the IopDatabaseLock.
|
|
//
|
|
|
|
ULONG ExtensionFlags;
|
|
|
|
//
|
|
// PnP manager fields
|
|
//
|
|
|
|
PVOID DeviceNode;
|
|
|
|
//
|
|
// AttachedTo is a pointer to the device object that this device
|
|
// object is attached to. The attachment chain is now doubly
|
|
// linked: this pointer and DeviceObject->AttachedDevice provide the
|
|
// linkage.
|
|
//
|
|
|
|
PDEVICE_OBJECT AttachedTo;
|
|
|
|
//
|
|
// The next two fields are used to prevent recursion in IoStartNextPacket
|
|
// interfaces.
|
|
//
|
|
|
|
LONG StartIoCount; // Used to keep track of number of pending start ios.
|
|
LONG StartIoKey; // Next startio key
|
|
ULONG StartIoFlags; // Start Io Flags. Need a separate flag so that it can be accessed without locks
|
|
PVPB Vpb; // If not NULL contains the VPB of the mounted volume.
|
|
// Set in the filesystem's volume device object.
|
|
// This is a reverse VPB pointer.
|
|
|
|
// begin_ntddk begin_wdm begin_nthal begin_ntifs begin_ntosp
|
|
|
|
} DEVOBJ_EXTENSION, *PDEVOBJ_EXTENSION;
|
|
|
|
//
|
|
// Define Driver Object (DRVO) flags
|
|
//
|
|
|
|
#define DRVO_UNLOAD_INVOKED 0x00000001
|
|
#define DRVO_LEGACY_DRIVER 0x00000002
|
|
#define DRVO_BUILTIN_DRIVER 0x00000004 // Driver objects for Hal, PnP Mgr
|
|
// end_wdm
|
|
#define DRVO_REINIT_REGISTERED 0x00000008
|
|
#define DRVO_INITIALIZED 0x00000010
|
|
#define DRVO_BOOTREINIT_REGISTERED 0x00000020
|
|
#define DRVO_LEGACY_RESOURCES 0x00000040
|
|
// end_ntddk end_nthal end_ntifs end_ntosp
|
|
#define DRVO_BASE_FILESYSTEM_DRIVER 0x00000080 // A driver that is at the bottom of the filesystem stack.
|
|
// begin_ntddk begin_nthal begin_ntifs begin_ntosp
|
|
|
|
// begin_wdm
|
|
|
|
typedef struct _DRIVER_EXTENSION {
|
|
|
|
//
|
|
// Back pointer to Driver Object
|
|
//
|
|
|
|
struct _DRIVER_OBJECT *DriverObject;
|
|
|
|
//
|
|
// The AddDevice entry point is called by the Plug & Play manager
|
|
// to inform the driver when a new device instance arrives that this
|
|
// driver must control.
|
|
//
|
|
|
|
PDRIVER_ADD_DEVICE AddDevice;
|
|
|
|
//
|
|
// The count field is used to count the number of times the driver has
|
|
// had its registered reinitialization routine invoked.
|
|
//
|
|
|
|
ULONG Count;
|
|
|
|
//
|
|
// The service name field is used by the pnp manager to determine
|
|
// where the driver related info is stored in the registry.
|
|
//
|
|
|
|
UNICODE_STRING ServiceKeyName;
|
|
|
|
//
|
|
// Note: any new shared fields get added here.
|
|
//
|
|
|
|
// end_ntddk end_wdm end_nthal end_ntifs end_ntosp
|
|
|
|
//
|
|
// The client driver object extension field is used by class driver
|
|
// to store per driver information.
|
|
//
|
|
|
|
PIO_CLIENT_EXTENSION ClientDriverExtension;
|
|
|
|
//
|
|
// The file system filter callback extension field is used
|
|
// to safely notify filters of system operations that were
|
|
// previously not shown to file system filters.
|
|
//
|
|
|
|
PFS_FILTER_CALLBACKS FsFilterCallbacks;
|
|
|
|
// begin_ntddk begin_wdm begin_nthal begin_ntifs begin_ntosp
|
|
|
|
} DRIVER_EXTENSION, *PDRIVER_EXTENSION;
|
|
|
|
|
|
typedef struct _DRIVER_OBJECT {
|
|
CSHORT Type;
|
|
CSHORT Size;
|
|
|
|
//
|
|
// The following links all of the devices created by a single driver
|
|
// together on a list, and the Flags word provides an extensible flag
|
|
// location for driver objects.
|
|
//
|
|
|
|
PDEVICE_OBJECT DeviceObject;
|
|
ULONG Flags;
|
|
|
|
//
|
|
// The following section describes where the driver is loaded. The count
|
|
// field is used to count the number of times the driver has had its
|
|
// registered reinitialization routine invoked.
|
|
//
|
|
|
|
PVOID DriverStart;
|
|
ULONG DriverSize;
|
|
PVOID DriverSection;
|
|
PDRIVER_EXTENSION DriverExtension;
|
|
|
|
//
|
|
// The driver name field is used by the error log thread
|
|
// determine the name of the driver that an I/O request is/was bound.
|
|
//
|
|
|
|
UNICODE_STRING DriverName;
|
|
|
|
//
|
|
// The following section is for registry support. Thise is a pointer
|
|
// to the path to the hardware information in the registry
|
|
//
|
|
|
|
PUNICODE_STRING HardwareDatabase;
|
|
|
|
//
|
|
// The following section contains the optional pointer to an array of
|
|
// alternate entry points to a driver for "fast I/O" support. Fast I/O
|
|
// is performed by invoking the driver routine directly with separate
|
|
// parameters, rather than using the standard IRP call mechanism. Note
|
|
// that these functions may only be used for synchronous I/O, and when
|
|
// the file is cached.
|
|
//
|
|
|
|
PFAST_IO_DISPATCH FastIoDispatch;
|
|
|
|
//
|
|
// The following section describes the entry points to this particular
|
|
// driver. Note that the major function dispatch table must be the last
|
|
// field in the object so that it remains extensible.
|
|
//
|
|
|
|
PDRIVER_INITIALIZE DriverInit;
|
|
PDRIVER_STARTIO DriverStartIo;
|
|
PDRIVER_UNLOAD DriverUnload;
|
|
PDRIVER_DISPATCH MajorFunction[IRP_MJ_MAXIMUM_FUNCTION + 1];
|
|
|
|
} DRIVER_OBJECT;
|
|
typedef struct _DRIVER_OBJECT *PDRIVER_OBJECT; // ntndis
|
|
|
|
|
|
// end_ntddk end_wdm end_ntifs end_ntosp
|
|
|
|
//
|
|
// Device Handler Object. There is one of these objects per PnP
|
|
// device. This object is given to the device driver as a PVOID
|
|
// and is used by the driver to refer to a particular device.
|
|
//
|
|
|
|
typedef struct _DEVICE_HANDLER_OBJECT {
|
|
CSHORT Type;
|
|
USHORT Size;
|
|
|
|
//
|
|
// Indentifies which bus extender this device handler
|
|
// object is associated with
|
|
//
|
|
|
|
struct _BUS_HANDLER *BusHandler;
|
|
|
|
//
|
|
// The associated SlotNumber for this device handler
|
|
//
|
|
|
|
ULONG SlotNumber;
|
|
|
|
// end_nthal
|
|
|
|
//
|
|
// System internal fields
|
|
//
|
|
|
|
//
|
|
// Pnp stuff
|
|
//
|
|
|
|
UNICODE_STRING ServiceKeyName;
|
|
ULONG InstanceOrdinal;
|
|
|
|
// begin_nthal
|
|
|
|
|
|
} DEVICE_HANDLER_OBJECT, *PDEVICE_HANDLER_OBJECT;
|
|
|
|
// begin_ntddk begin_wdm begin_ntifs begin_ntosp
|
|
|
|
//
|
|
// The following structure is pointed to by the SectionObject pointer field
|
|
// of a file object, and is allocated by the various NT file systems.
|
|
//
|
|
|
|
typedef struct _SECTION_OBJECT_POINTERS {
|
|
PVOID DataSectionObject;
|
|
PVOID SharedCacheMap;
|
|
PVOID ImageSectionObject;
|
|
} SECTION_OBJECT_POINTERS;
|
|
typedef SECTION_OBJECT_POINTERS *PSECTION_OBJECT_POINTERS;
|
|
|
|
//
|
|
// Define the format of a completion message.
|
|
//
|
|
|
|
typedef struct _IO_COMPLETION_CONTEXT {
|
|
PVOID Port;
|
|
PVOID Key;
|
|
} IO_COMPLETION_CONTEXT, *PIO_COMPLETION_CONTEXT;
|
|
|
|
//
|
|
// Define File Object (FO) flags
|
|
//
|
|
|
|
#define FO_FILE_OPEN 0x00000001
|
|
#define FO_SYNCHRONOUS_IO 0x00000002
|
|
#define FO_ALERTABLE_IO 0x00000004
|
|
#define FO_NO_INTERMEDIATE_BUFFERING 0x00000008
|
|
#define FO_WRITE_THROUGH 0x00000010
|
|
#define FO_SEQUENTIAL_ONLY 0x00000020
|
|
#define FO_CACHE_SUPPORTED 0x00000040
|
|
#define FO_NAMED_PIPE 0x00000080
|
|
#define FO_STREAM_FILE 0x00000100
|
|
#define FO_MAILSLOT 0x00000200
|
|
#define FO_GENERATE_AUDIT_ON_CLOSE 0x00000400
|
|
#define FO_DIRECT_DEVICE_OPEN 0x00000800
|
|
#define FO_FILE_MODIFIED 0x00001000
|
|
#define FO_FILE_SIZE_CHANGED 0x00002000
|
|
#define FO_CLEANUP_COMPLETE 0x00004000
|
|
#define FO_TEMPORARY_FILE 0x00008000
|
|
#define FO_DELETE_ON_CLOSE 0x00010000
|
|
#define FO_OPENED_CASE_SENSITIVE 0x00020000
|
|
#define FO_HANDLE_CREATED 0x00040000
|
|
#define FO_FILE_FAST_IO_READ 0x00080000
|
|
#define FO_RANDOM_ACCESS 0x00100000
|
|
#define FO_FILE_OPEN_CANCELLED 0x00200000
|
|
#define FO_VOLUME_OPEN 0x00400000
|
|
#define FO_FILE_OBJECT_HAS_EXTENSION 0x00800000
|
|
#define FO_REMOTE_ORIGIN 0x01000000
|
|
|
|
typedef struct _FILE_OBJECT {
|
|
CSHORT Type;
|
|
CSHORT Size;
|
|
PDEVICE_OBJECT DeviceObject;
|
|
PVPB Vpb;
|
|
PVOID FsContext;
|
|
PVOID FsContext2;
|
|
PSECTION_OBJECT_POINTERS SectionObjectPointer;
|
|
PVOID PrivateCacheMap;
|
|
NTSTATUS FinalStatus;
|
|
struct _FILE_OBJECT *RelatedFileObject;
|
|
BOOLEAN LockOperation;
|
|
BOOLEAN DeletePending;
|
|
BOOLEAN ReadAccess;
|
|
BOOLEAN WriteAccess;
|
|
BOOLEAN DeleteAccess;
|
|
BOOLEAN SharedRead;
|
|
BOOLEAN SharedWrite;
|
|
BOOLEAN SharedDelete;
|
|
ULONG Flags;
|
|
UNICODE_STRING FileName;
|
|
LARGE_INTEGER CurrentByteOffset;
|
|
ULONG Waiters;
|
|
ULONG Busy;
|
|
PVOID LastLock;
|
|
KEVENT Lock;
|
|
KEVENT Event;
|
|
PIO_COMPLETION_CONTEXT CompletionContext;
|
|
} FILE_OBJECT;
|
|
typedef struct _FILE_OBJECT *PFILE_OBJECT; // ntndis
|
|
|
|
//
|
|
// Define I/O Request Packet (IRP) flags
|
|
//
|
|
|
|
#define IRP_NOCACHE 0x00000001
|
|
#define IRP_PAGING_IO 0x00000002
|
|
#define IRP_MOUNT_COMPLETION 0x00000002
|
|
#define IRP_SYNCHRONOUS_API 0x00000004
|
|
#define IRP_ASSOCIATED_IRP 0x00000008
|
|
#define IRP_BUFFERED_IO 0x00000010
|
|
#define IRP_DEALLOCATE_BUFFER 0x00000020
|
|
#define IRP_INPUT_OPERATION 0x00000040
|
|
#define IRP_SYNCHRONOUS_PAGING_IO 0x00000040
|
|
#define IRP_CREATE_OPERATION 0x00000080
|
|
#define IRP_READ_OPERATION 0x00000100
|
|
#define IRP_WRITE_OPERATION 0x00000200
|
|
#define IRP_CLOSE_OPERATION 0x00000400
|
|
// end_wdm
|
|
|
|
#define IRP_DEFER_IO_COMPLETION 0x00000800
|
|
#define IRP_OB_QUERY_NAME 0x00001000
|
|
#define IRP_HOLD_DEVICE_QUEUE 0x00002000
|
|
#define IRP_RETRY_IO_COMPLETION 0x00004000
|
|
#define IRP_CLASS_CACHE_OPERATION 0x00008000
|
|
|
|
#define IRP_SET_USER_EVENT IRP_CLOSE_OPERATION
|
|
|
|
// begin_wdm
|
|
//
|
|
// Define I/O request packet (IRP) alternate flags for allocation control.
|
|
//
|
|
|
|
#define IRP_QUOTA_CHARGED 0x01
|
|
#define IRP_ALLOCATED_MUST_SUCCEED 0x02
|
|
#define IRP_ALLOCATED_FIXED_SIZE 0x04
|
|
#define IRP_LOOKASIDE_ALLOCATION 0x08
|
|
|
|
//
|
|
// I/O Request Packet (IRP) definition
|
|
//
|
|
|
|
typedef struct _IRP {
|
|
CSHORT Type;
|
|
USHORT Size;
|
|
|
|
//
|
|
// Define the common fields used to control the IRP.
|
|
//
|
|
|
|
//
|
|
// Define a pointer to the Memory Descriptor List (MDL) for this I/O
|
|
// request. This field is only used if the I/O is "direct I/O".
|
|
//
|
|
|
|
PMDL MdlAddress;
|
|
|
|
//
|
|
// Flags word - used to remember various flags.
|
|
//
|
|
|
|
ULONG Flags;
|
|
|
|
//
|
|
// The following union is used for one of three purposes:
|
|
//
|
|
// 1. This IRP is an associated IRP. The field is a pointer to a master
|
|
// IRP.
|
|
//
|
|
// 2. This is the master IRP. The field is the count of the number of
|
|
// IRPs which must complete (associated IRPs) before the master can
|
|
// complete.
|
|
//
|
|
// 3. This operation is being buffered and the field is the address of
|
|
// the system space buffer.
|
|
//
|
|
|
|
union {
|
|
struct _IRP *MasterIrp;
|
|
LONG IrpCount;
|
|
PVOID SystemBuffer;
|
|
} AssociatedIrp;
|
|
|
|
//
|
|
// Thread list entry - allows queueing the IRP to the thread pending I/O
|
|
// request packet list.
|
|
//
|
|
|
|
LIST_ENTRY ThreadListEntry;
|
|
|
|
//
|
|
// I/O status - final status of operation.
|
|
//
|
|
|
|
IO_STATUS_BLOCK IoStatus;
|
|
|
|
//
|
|
// Requestor mode - mode of the original requestor of this operation.
|
|
//
|
|
|
|
KPROCESSOR_MODE RequestorMode;
|
|
|
|
//
|
|
// Pending returned - TRUE if pending was initially returned as the
|
|
// status for this packet.
|
|
//
|
|
|
|
BOOLEAN PendingReturned;
|
|
|
|
//
|
|
// Stack state information.
|
|
//
|
|
|
|
CHAR StackCount;
|
|
CHAR CurrentLocation;
|
|
|
|
//
|
|
// Cancel - packet has been canceled.
|
|
//
|
|
|
|
BOOLEAN Cancel;
|
|
|
|
//
|
|
// Cancel Irql - Irql at which the cancel spinlock was acquired.
|
|
//
|
|
|
|
KIRQL CancelIrql;
|
|
|
|
//
|
|
// ApcEnvironment - Used to save the APC environment at the time that the
|
|
// packet was initialized.
|
|
//
|
|
|
|
CCHAR ApcEnvironment;
|
|
|
|
//
|
|
// Allocation control flags.
|
|
//
|
|
|
|
UCHAR AllocationFlags;
|
|
|
|
//
|
|
// User parameters.
|
|
//
|
|
|
|
PIO_STATUS_BLOCK UserIosb;
|
|
PKEVENT UserEvent;
|
|
union {
|
|
struct {
|
|
PIO_APC_ROUTINE UserApcRoutine;
|
|
PVOID UserApcContext;
|
|
} AsynchronousParameters;
|
|
LARGE_INTEGER AllocationSize;
|
|
} Overlay;
|
|
|
|
//
|
|
// CancelRoutine - Used to contain the address of a cancel routine supplied
|
|
// by a device driver when the IRP is in a cancelable state.
|
|
//
|
|
|
|
PDRIVER_CANCEL CancelRoutine;
|
|
|
|
//
|
|
// Note that the UserBuffer parameter is outside of the stack so that I/O
|
|
// completion can copy data back into the user's address space without
|
|
// having to know exactly which service was being invoked. The length
|
|
// of the copy is stored in the second half of the I/O status block. If
|
|
// the UserBuffer field is NULL, then no copy is performed.
|
|
//
|
|
|
|
PVOID UserBuffer;
|
|
|
|
//
|
|
// Kernel structures
|
|
//
|
|
// The following section contains kernel structures which the IRP needs
|
|
// in order to place various work information in kernel controller system
|
|
// queues. Because the size and alignment cannot be controlled, they are
|
|
// placed here at the end so they just hang off and do not affect the
|
|
// alignment of other fields in the IRP.
|
|
//
|
|
|
|
union {
|
|
|
|
struct {
|
|
|
|
union {
|
|
|
|
//
|
|
// DeviceQueueEntry - The device queue entry field is used to
|
|
// queue the IRP to the device driver device queue.
|
|
//
|
|
|
|
KDEVICE_QUEUE_ENTRY DeviceQueueEntry;
|
|
|
|
struct {
|
|
|
|
//
|
|
// The following are available to the driver to use in
|
|
// whatever manner is desired, while the driver owns the
|
|
// packet.
|
|
//
|
|
|
|
PVOID DriverContext[4];
|
|
|
|
} ;
|
|
|
|
} ;
|
|
|
|
//
|
|
// Thread - pointer to caller's Thread Control Block.
|
|
//
|
|
|
|
PETHREAD Thread;
|
|
|
|
//
|
|
// Auxiliary buffer - pointer to any auxiliary buffer that is
|
|
// required to pass information to a driver that is not contained
|
|
// in a normal buffer.
|
|
//
|
|
|
|
PCHAR AuxiliaryBuffer;
|
|
|
|
//
|
|
// The following unnamed structure must be exactly identical
|
|
// to the unnamed structure used in the minipacket header used
|
|
// for completion queue entries.
|
|
//
|
|
|
|
struct {
|
|
|
|
//
|
|
// List entry - used to queue the packet to completion queue, among
|
|
// others.
|
|
//
|
|
|
|
LIST_ENTRY ListEntry;
|
|
|
|
union {
|
|
|
|
//
|
|
// Current stack location - contains a pointer to the current
|
|
// IO_STACK_LOCATION structure in the IRP stack. This field
|
|
// should never be directly accessed by drivers. They should
|
|
// use the standard functions.
|
|
//
|
|
|
|
struct _IO_STACK_LOCATION *CurrentStackLocation;
|
|
|
|
//
|
|
// Minipacket type.
|
|
//
|
|
|
|
ULONG PacketType;
|
|
};
|
|
};
|
|
|
|
//
|
|
// Original file object - pointer to the original file object
|
|
// that was used to open the file. This field is owned by the
|
|
// I/O system and should not be used by any other drivers.
|
|
//
|
|
|
|
PFILE_OBJECT OriginalFileObject;
|
|
|
|
} Overlay;
|
|
|
|
//
|
|
// APC - This APC control block is used for the special kernel APC as
|
|
// well as for the caller's APC, if one was specified in the original
|
|
// argument list. If so, then the APC is reused for the normal APC for
|
|
// whatever mode the caller was in and the "special" routine that is
|
|
// invoked before the APC gets control simply deallocates the IRP.
|
|
//
|
|
|
|
KAPC Apc;
|
|
|
|
//
|
|
// CompletionKey - This is the key that is used to distinguish
|
|
// individual I/O operations initiated on a single file handle.
|
|
//
|
|
|
|
PVOID CompletionKey;
|
|
|
|
} Tail;
|
|
|
|
} IRP, *PIRP;
|
|
|
|
//
|
|
// Define completion routine types for use in stack locations in an IRP
|
|
//
|
|
|
|
typedef
|
|
NTSTATUS
|
|
(*PIO_COMPLETION_ROUTINE) (
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN PIRP Irp,
|
|
IN PVOID Context
|
|
);
|
|
|
|
//
|
|
// Define stack location control flags
|
|
//
|
|
|
|
#define SL_PENDING_RETURNED 0x01
|
|
#define SL_INVOKE_ON_CANCEL 0x20
|
|
#define SL_INVOKE_ON_SUCCESS 0x40
|
|
#define SL_INVOKE_ON_ERROR 0x80
|
|
|
|
//
|
|
// Define flags for various functions
|
|
//
|
|
|
|
//
|
|
// Create / Create Named Pipe
|
|
//
|
|
// The following flags must exactly match those in the IoCreateFile call's
|
|
// options. The case sensitive flag is added in later, by the parse routine,
|
|
// and is not an actual option to open. Rather, it is part of the object
|
|
// manager's attributes structure.
|
|
//
|
|
|
|
#define SL_FORCE_ACCESS_CHECK 0x01
|
|
#define SL_OPEN_PAGING_FILE 0x02
|
|
#define SL_OPEN_TARGET_DIRECTORY 0x04
|
|
|
|
#define SL_CASE_SENSITIVE 0x80
|
|
|
|
//
|
|
// Read / Write
|
|
//
|
|
|
|
#define SL_KEY_SPECIFIED 0x01
|
|
#define SL_OVERRIDE_VERIFY_VOLUME 0x02
|
|
#define SL_WRITE_THROUGH 0x04
|
|
#define SL_FT_SEQUENTIAL_WRITE 0x08
|
|
|
|
//
|
|
// Device I/O Control
|
|
//
|
|
//
|
|
// Same SL_OVERRIDE_VERIFY_VOLUME as for read/write above.
|
|
//
|
|
|
|
#define SL_READ_ACCESS_GRANTED 0x01
|
|
#define SL_WRITE_ACCESS_GRANTED 0x04 // Gap for SL_OVERRIDE_VERIFY_VOLUME
|
|
|
|
//
|
|
// Lock
|
|
//
|
|
|
|
#define SL_FAIL_IMMEDIATELY 0x01
|
|
#define SL_EXCLUSIVE_LOCK 0x02
|
|
|
|
//
|
|
// QueryDirectory / QueryEa / QueryQuota
|
|
//
|
|
|
|
#define SL_RESTART_SCAN 0x01
|
|
#define SL_RETURN_SINGLE_ENTRY 0x02
|
|
#define SL_INDEX_SPECIFIED 0x04
|
|
|
|
//
|
|
// NotifyDirectory
|
|
//
|
|
|
|
#define SL_WATCH_TREE 0x01
|
|
|
|
//
|
|
// FileSystemControl
|
|
//
|
|
// minor: mount/verify volume
|
|
//
|
|
|
|
#define SL_ALLOW_RAW_MOUNT 0x01
|
|
|
|
//
|
|
// Define PNP/POWER types required by IRP_MJ_PNP/IRP_MJ_POWER.
|
|
//
|
|
|
|
typedef enum _DEVICE_RELATION_TYPE {
|
|
BusRelations,
|
|
EjectionRelations,
|
|
PowerRelations,
|
|
RemovalRelations,
|
|
TargetDeviceRelation,
|
|
SingleBusRelations
|
|
} DEVICE_RELATION_TYPE, *PDEVICE_RELATION_TYPE;
|
|
|
|
typedef struct _DEVICE_RELATIONS {
|
|
ULONG Count;
|
|
PDEVICE_OBJECT Objects[1]; // variable length
|
|
} DEVICE_RELATIONS, *PDEVICE_RELATIONS;
|
|
|
|
typedef enum _DEVICE_USAGE_NOTIFICATION_TYPE {
|
|
DeviceUsageTypeUndefined,
|
|
DeviceUsageTypePaging,
|
|
DeviceUsageTypeHibernation,
|
|
DeviceUsageTypeDumpFile
|
|
} DEVICE_USAGE_NOTIFICATION_TYPE;
|
|
|
|
// begin_ntminiport
|
|
|
|
// workaround overloaded definition (rpc generated headers all define INTERFACE
|
|
// to match the class name).
|
|
#undef INTERFACE
|
|
|
|
typedef struct _INTERFACE {
|
|
USHORT Size;
|
|
USHORT Version;
|
|
PVOID Context;
|
|
PINTERFACE_REFERENCE InterfaceReference;
|
|
PINTERFACE_DEREFERENCE InterfaceDereference;
|
|
// interface specific entries go here
|
|
} INTERFACE, *PINTERFACE;
|
|
|
|
// end_ntminiport
|
|
|
|
typedef struct _DEVICE_CAPABILITIES {
|
|
USHORT Size;
|
|
USHORT Version; // the version documented here is version 1
|
|
ULONG DeviceD1:1;
|
|
ULONG DeviceD2:1;
|
|
ULONG LockSupported:1;
|
|
ULONG EjectSupported:1; // Ejectable in S0
|
|
ULONG Removable:1;
|
|
ULONG DockDevice:1;
|
|
ULONG UniqueID:1;
|
|
ULONG SilentInstall:1;
|
|
ULONG RawDeviceOK:1;
|
|
ULONG SurpriseRemovalOK:1;
|
|
ULONG WakeFromD0:1;
|
|
ULONG WakeFromD1:1;
|
|
ULONG WakeFromD2:1;
|
|
ULONG WakeFromD3:1;
|
|
ULONG HardwareDisabled:1;
|
|
ULONG NonDynamic:1;
|
|
ULONG WarmEjectSupported:1;
|
|
ULONG NoDisplayInUI:1;
|
|
ULONG Reserved:14;
|
|
|
|
ULONG Address;
|
|
ULONG UINumber;
|
|
|
|
DEVICE_POWER_STATE DeviceState[POWER_SYSTEM_MAXIMUM];
|
|
SYSTEM_POWER_STATE SystemWake;
|
|
DEVICE_POWER_STATE DeviceWake;
|
|
ULONG D1Latency;
|
|
ULONG D2Latency;
|
|
ULONG D3Latency;
|
|
} DEVICE_CAPABILITIES, *PDEVICE_CAPABILITIES;
|
|
|
|
typedef struct _POWER_SEQUENCE {
|
|
ULONG SequenceD1;
|
|
ULONG SequenceD2;
|
|
ULONG SequenceD3;
|
|
} POWER_SEQUENCE, *PPOWER_SEQUENCE;
|
|
|
|
typedef enum {
|
|
BusQueryDeviceID = 0, // <Enumerator>\<Enumerator-specific device id>
|
|
BusQueryHardwareIDs = 1, // Hardware ids
|
|
BusQueryCompatibleIDs = 2, // compatible device ids
|
|
BusQueryInstanceID = 3, // persistent id for this instance of the device
|
|
BusQueryDeviceSerialNumber = 4 // serial number for this device
|
|
} BUS_QUERY_ID_TYPE, *PBUS_QUERY_ID_TYPE;
|
|
|
|
typedef ULONG PNP_DEVICE_STATE, *PPNP_DEVICE_STATE;
|
|
|
|
#define PNP_DEVICE_DISABLED 0x00000001
|
|
#define PNP_DEVICE_DONT_DISPLAY_IN_UI 0x00000002
|
|
#define PNP_DEVICE_FAILED 0x00000004
|
|
#define PNP_DEVICE_REMOVED 0x00000008
|
|
#define PNP_DEVICE_RESOURCE_REQUIREMENTS_CHANGED 0x00000010
|
|
#define PNP_DEVICE_NOT_DISABLEABLE 0x00000020
|
|
|
|
typedef enum {
|
|
DeviceTextDescription = 0, // DeviceDesc property
|
|
DeviceTextLocationInformation = 1 // DeviceLocation property
|
|
} DEVICE_TEXT_TYPE, *PDEVICE_TEXT_TYPE;
|
|
|
|
//
|
|
// Define I/O Request Packet (IRP) stack locations
|
|
//
|
|
|
|
#if !defined(_AMD64_) && !defined(_IA64_)
|
|
#include "pshpack4.h"
|
|
#endif
|
|
|
|
// begin_ntndis
|
|
|
|
#if defined(_WIN64)
|
|
#define POINTER_ALIGNMENT DECLSPEC_ALIGN(8)
|
|
#else
|
|
#define POINTER_ALIGNMENT
|
|
#endif
|
|
|
|
// end_ntndis
|
|
|
|
typedef struct _IO_STACK_LOCATION {
|
|
UCHAR MajorFunction;
|
|
UCHAR MinorFunction;
|
|
UCHAR Flags;
|
|
UCHAR Control;
|
|
|
|
//
|
|
// The following user parameters are based on the service that is being
|
|
// invoked. Drivers and file systems can determine which set to use based
|
|
// on the above major and minor function codes.
|
|
//
|
|
|
|
union {
|
|
|
|
//
|
|
// System service parameters for: NtCreateFile
|
|
//
|
|
|
|
struct {
|
|
PIO_SECURITY_CONTEXT SecurityContext;
|
|
ULONG Options;
|
|
USHORT POINTER_ALIGNMENT FileAttributes;
|
|
USHORT ShareAccess;
|
|
ULONG POINTER_ALIGNMENT EaLength;
|
|
} Create;
|
|
|
|
// end_ntddk end_wdm end_nthal end_ntifs end_ntosp
|
|
|
|
//
|
|
// System service parameters for: NtCreateNamedPipeFile
|
|
//
|
|
// Notice that the fields in the following parameter structure must
|
|
// match those for the create structure other than the last longword.
|
|
// This is so that no distinctions need be made by the I/O system's
|
|
// parse routine other than for the last longword.
|
|
//
|
|
|
|
struct {
|
|
PIO_SECURITY_CONTEXT SecurityContext;
|
|
ULONG Options;
|
|
USHORT POINTER_ALIGNMENT Reserved;
|
|
USHORT ShareAccess;
|
|
PNAMED_PIPE_CREATE_PARAMETERS Parameters;
|
|
} CreatePipe;
|
|
|
|
//
|
|
// System service parameters for: NtCreateMailslotFile
|
|
//
|
|
// Notice that the fields in the following parameter structure must
|
|
// match those for the create structure other than the last longword.
|
|
// This is so that no distinctions need be made by the I/O system's
|
|
// parse routine other than for the last longword.
|
|
//
|
|
|
|
struct {
|
|
PIO_SECURITY_CONTEXT SecurityContext;
|
|
ULONG Options;
|
|
USHORT POINTER_ALIGNMENT Reserved;
|
|
USHORT ShareAccess;
|
|
PMAILSLOT_CREATE_PARAMETERS Parameters;
|
|
} CreateMailslot;
|
|
|
|
// begin_ntddk begin_wdm begin_nthal begin_ntifs begin_ntosp
|
|
|
|
//
|
|
// System service parameters for: NtReadFile
|
|
//
|
|
|
|
struct {
|
|
ULONG Length;
|
|
ULONG POINTER_ALIGNMENT Key;
|
|
LARGE_INTEGER ByteOffset;
|
|
} Read;
|
|
|
|
//
|
|
// System service parameters for: NtWriteFile
|
|
//
|
|
|
|
struct {
|
|
ULONG Length;
|
|
ULONG POINTER_ALIGNMENT Key;
|
|
LARGE_INTEGER ByteOffset;
|
|
} Write;
|
|
|
|
// end_ntddk end_wdm end_nthal
|
|
|
|
//
|
|
// System service parameters for: NtQueryDirectoryFile
|
|
//
|
|
|
|
struct {
|
|
ULONG Length;
|
|
PSTRING FileName;
|
|
FILE_INFORMATION_CLASS FileInformationClass;
|
|
ULONG POINTER_ALIGNMENT FileIndex;
|
|
} QueryDirectory;
|
|
|
|
//
|
|
// System service parameters for: NtNotifyChangeDirectoryFile
|
|
//
|
|
|
|
struct {
|
|
ULONG Length;
|
|
ULONG POINTER_ALIGNMENT CompletionFilter;
|
|
} NotifyDirectory;
|
|
|
|
// begin_ntddk begin_wdm begin_nthal
|
|
|
|
//
|
|
// System service parameters for: NtQueryInformationFile
|
|
//
|
|
|
|
struct {
|
|
ULONG Length;
|
|
FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass;
|
|
} QueryFile;
|
|
|
|
//
|
|
// System service parameters for: NtSetInformationFile
|
|
//
|
|
|
|
struct {
|
|
ULONG Length;
|
|
FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass;
|
|
PFILE_OBJECT FileObject;
|
|
union {
|
|
struct {
|
|
BOOLEAN ReplaceIfExists;
|
|
BOOLEAN AdvanceOnly;
|
|
};
|
|
ULONG ClusterCount;
|
|
HANDLE DeleteHandle;
|
|
};
|
|
} SetFile;
|
|
|
|
// end_ntddk end_wdm end_nthal end_ntosp
|
|
|
|
//
|
|
// System service parameters for: NtQueryEaFile
|
|
//
|
|
|
|
struct {
|
|
ULONG Length;
|
|
PVOID EaList;
|
|
ULONG EaListLength;
|
|
ULONG POINTER_ALIGNMENT EaIndex;
|
|
} QueryEa;
|
|
|
|
//
|
|
// System service parameters for: NtSetEaFile
|
|
//
|
|
|
|
struct {
|
|
ULONG Length;
|
|
} SetEa;
|
|
|
|
// begin_ntddk begin_wdm begin_nthal begin_ntosp
|
|
|
|
//
|
|
// System service parameters for: NtQueryVolumeInformationFile
|
|
//
|
|
|
|
struct {
|
|
ULONG Length;
|
|
FS_INFORMATION_CLASS POINTER_ALIGNMENT FsInformationClass;
|
|
} QueryVolume;
|
|
|
|
// end_ntddk end_wdm end_nthal end_ntosp
|
|
|
|
//
|
|
// System service parameters for: NtSetVolumeInformationFile
|
|
//
|
|
|
|
struct {
|
|
ULONG Length;
|
|
FS_INFORMATION_CLASS POINTER_ALIGNMENT FsInformationClass;
|
|
} SetVolume;
|
|
// begin_ntosp
|
|
//
|
|
// System service parameters for: NtFsControlFile
|
|
//
|
|
// Note that the user's output buffer is stored in the UserBuffer field
|
|
// and the user's input buffer is stored in the SystemBuffer field.
|
|
//
|
|
|
|
struct {
|
|
ULONG OutputBufferLength;
|
|
ULONG POINTER_ALIGNMENT InputBufferLength;
|
|
ULONG POINTER_ALIGNMENT FsControlCode;
|
|
PVOID Type3InputBuffer;
|
|
} FileSystemControl;
|
|
//
|
|
// System service parameters for: NtLockFile/NtUnlockFile
|
|
//
|
|
|
|
struct {
|
|
PLARGE_INTEGER Length;
|
|
ULONG POINTER_ALIGNMENT Key;
|
|
LARGE_INTEGER ByteOffset;
|
|
} LockControl;
|
|
|
|
// begin_ntddk begin_wdm begin_nthal
|
|
|
|
//
|
|
// System service parameters for: NtFlushBuffersFile
|
|
//
|
|
// No extra user-supplied parameters.
|
|
//
|
|
|
|
// end_ntddk end_wdm end_nthal
|
|
// end_ntosp
|
|
|
|
//
|
|
// System service parameters for: NtCancelIoFile
|
|
//
|
|
// No extra user-supplied parameters.
|
|
//
|
|
|
|
// begin_ntddk begin_wdm begin_nthal begin_ntosp
|
|
|
|
//
|
|
// System service parameters for: NtDeviceIoControlFile
|
|
//
|
|
// Note that the user's output buffer is stored in the UserBuffer field
|
|
// and the user's input buffer is stored in the SystemBuffer field.
|
|
//
|
|
|
|
struct {
|
|
ULONG OutputBufferLength;
|
|
ULONG POINTER_ALIGNMENT InputBufferLength;
|
|
ULONG POINTER_ALIGNMENT IoControlCode;
|
|
PVOID Type3InputBuffer;
|
|
} DeviceIoControl;
|
|
|
|
// end_wdm
|
|
//
|
|
// System service parameters for: NtQuerySecurityObject
|
|
//
|
|
|
|
struct {
|
|
SECURITY_INFORMATION SecurityInformation;
|
|
ULONG POINTER_ALIGNMENT Length;
|
|
} QuerySecurity;
|
|
|
|
//
|
|
// System service parameters for: NtSetSecurityObject
|
|
//
|
|
|
|
struct {
|
|
SECURITY_INFORMATION SecurityInformation;
|
|
PSECURITY_DESCRIPTOR SecurityDescriptor;
|
|
} SetSecurity;
|
|
|
|
// begin_wdm
|
|
//
|
|
// Non-system service parameters.
|
|
//
|
|
// Parameters for MountVolume
|
|
//
|
|
|
|
struct {
|
|
PVPB Vpb;
|
|
PDEVICE_OBJECT DeviceObject;
|
|
} MountVolume;
|
|
|
|
//
|
|
// Parameters for VerifyVolume
|
|
//
|
|
|
|
struct {
|
|
PVPB Vpb;
|
|
PDEVICE_OBJECT DeviceObject;
|
|
} VerifyVolume;
|
|
|
|
//
|
|
// Parameters for Scsi with internal device contorl.
|
|
//
|
|
|
|
struct {
|
|
struct _SCSI_REQUEST_BLOCK *Srb;
|
|
} Scsi;
|
|
|
|
// end_ntddk end_wdm end_nthal end_ntosp
|
|
|
|
//
|
|
// System service parameters for: NtQueryQuotaInformationFile
|
|
//
|
|
|
|
struct {
|
|
ULONG Length;
|
|
PSID StartSid;
|
|
PFILE_GET_QUOTA_INFORMATION SidList;
|
|
ULONG SidListLength;
|
|
} QueryQuota;
|
|
|
|
//
|
|
// System service parameters for: NtSetQuotaInformationFile
|
|
//
|
|
|
|
struct {
|
|
ULONG Length;
|
|
} SetQuota;
|
|
|
|
// begin_ntddk begin_wdm begin_nthal begin_ntosp
|
|
|
|
//
|
|
// Parameters for IRP_MN_QUERY_DEVICE_RELATIONS
|
|
//
|
|
|
|
struct {
|
|
DEVICE_RELATION_TYPE Type;
|
|
} QueryDeviceRelations;
|
|
|
|
//
|
|
// Parameters for IRP_MN_QUERY_INTERFACE
|
|
//
|
|
|
|
struct {
|
|
CONST GUID *InterfaceType;
|
|
USHORT Size;
|
|
USHORT Version;
|
|
PINTERFACE Interface;
|
|
PVOID InterfaceSpecificData;
|
|
} QueryInterface;
|
|
|
|
// end_ntifs
|
|
|
|
//
|
|
// Parameters for IRP_MN_QUERY_CAPABILITIES
|
|
//
|
|
|
|
struct {
|
|
PDEVICE_CAPABILITIES Capabilities;
|
|
} DeviceCapabilities;
|
|
|
|
//
|
|
// Parameters for IRP_MN_FILTER_RESOURCE_REQUIREMENTS
|
|
//
|
|
|
|
struct {
|
|
PIO_RESOURCE_REQUIREMENTS_LIST IoResourceRequirementList;
|
|
} FilterResourceRequirements;
|
|
|
|
//
|
|
// Parameters for IRP_MN_READ_CONFIG and IRP_MN_WRITE_CONFIG
|
|
//
|
|
|
|
struct {
|
|
ULONG WhichSpace;
|
|
PVOID Buffer;
|
|
ULONG Offset;
|
|
ULONG POINTER_ALIGNMENT Length;
|
|
} ReadWriteConfig;
|
|
|
|
//
|
|
// Parameters for IRP_MN_SET_LOCK
|
|
//
|
|
|
|
struct {
|
|
BOOLEAN Lock;
|
|
} SetLock;
|
|
|
|
//
|
|
// Parameters for IRP_MN_QUERY_ID
|
|
//
|
|
|
|
struct {
|
|
BUS_QUERY_ID_TYPE IdType;
|
|
} QueryId;
|
|
|
|
//
|
|
// Parameters for IRP_MN_QUERY_DEVICE_TEXT
|
|
//
|
|
|
|
struct {
|
|
DEVICE_TEXT_TYPE DeviceTextType;
|
|
LCID POINTER_ALIGNMENT LocaleId;
|
|
} QueryDeviceText;
|
|
|
|
//
|
|
// Parameters for IRP_MN_DEVICE_USAGE_NOTIFICATION
|
|
//
|
|
|
|
struct {
|
|
BOOLEAN InPath;
|
|
BOOLEAN Reserved[3];
|
|
DEVICE_USAGE_NOTIFICATION_TYPE POINTER_ALIGNMENT Type;
|
|
} UsageNotification;
|
|
|
|
//
|
|
// Parameters for IRP_MN_WAIT_WAKE
|
|
//
|
|
|
|
struct {
|
|
SYSTEM_POWER_STATE PowerState;
|
|
} WaitWake;
|
|
|
|
//
|
|
// Parameter for IRP_MN_POWER_SEQUENCE
|
|
//
|
|
|
|
struct {
|
|
PPOWER_SEQUENCE PowerSequence;
|
|
} PowerSequence;
|
|
|
|
//
|
|
// Parameters for IRP_MN_SET_POWER and IRP_MN_QUERY_POWER
|
|
//
|
|
|
|
struct {
|
|
ULONG SystemContext;
|
|
POWER_STATE_TYPE POINTER_ALIGNMENT Type;
|
|
POWER_STATE POINTER_ALIGNMENT State;
|
|
POWER_ACTION POINTER_ALIGNMENT ShutdownType;
|
|
} Power;
|
|
|
|
//
|
|
// Parameters for StartDevice
|
|
//
|
|
|
|
struct {
|
|
PCM_RESOURCE_LIST AllocatedResources;
|
|
PCM_RESOURCE_LIST AllocatedResourcesTranslated;
|
|
} StartDevice;
|
|
|
|
// begin_ntifs
|
|
//
|
|
// Parameters for Cleanup
|
|
//
|
|
// No extra parameters supplied
|
|
//
|
|
|
|
//
|
|
// WMI Irps
|
|
//
|
|
|
|
struct {
|
|
ULONG_PTR ProviderId;
|
|
PVOID DataPath;
|
|
ULONG BufferSize;
|
|
PVOID Buffer;
|
|
} WMI;
|
|
|
|
//
|
|
// Others - driver-specific
|
|
//
|
|
|
|
struct {
|
|
PVOID Argument1;
|
|
PVOID Argument2;
|
|
PVOID Argument3;
|
|
PVOID Argument4;
|
|
} Others;
|
|
|
|
} Parameters;
|
|
|
|
//
|
|
// Save a pointer to this device driver's device object for this request
|
|
// so it can be passed to the completion routine if needed.
|
|
//
|
|
|
|
PDEVICE_OBJECT DeviceObject;
|
|
|
|
//
|
|
// The following location contains a pointer to the file object for this
|
|
//
|
|
|
|
PFILE_OBJECT FileObject;
|
|
|
|
//
|
|
// The following routine is invoked depending on the flags in the above
|
|
// flags field.
|
|
//
|
|
|
|
PIO_COMPLETION_ROUTINE CompletionRoutine;
|
|
|
|
//
|
|
// The following is used to store the address of the context parameter
|
|
// that should be passed to the CompletionRoutine.
|
|
//
|
|
|
|
PVOID Context;
|
|
|
|
} IO_STACK_LOCATION, *PIO_STACK_LOCATION;
|
|
#if !defined(_AMD64_) && !defined(_IA64_)
|
|
#include "poppack.h"
|
|
#endif
|
|
|
|
//
|
|
// Define the share access structure used by file systems to determine
|
|
// whether or not another accessor may open the file.
|
|
//
|
|
|
|
typedef struct _SHARE_ACCESS {
|
|
ULONG OpenCount;
|
|
ULONG Readers;
|
|
ULONG Writers;
|
|
ULONG Deleters;
|
|
ULONG SharedRead;
|
|
ULONG SharedWrite;
|
|
ULONG SharedDelete;
|
|
} SHARE_ACCESS, *PSHARE_ACCESS;
|
|
|
|
// end_wdm
|
|
|
|
//
|
|
// The following structure is used by drivers that are initializing to
|
|
// determine the number of devices of a particular type that have already
|
|
// been initialized. It is also used to track whether or not the AtDisk
|
|
// address range has already been claimed. Finally, it is used by the
|
|
// NtQuerySystemInformation system service to return device type counts.
|
|
//
|
|
|
|
typedef struct _CONFIGURATION_INFORMATION {
|
|
|
|
//
|
|
// This field indicates the total number of disks in the system. This
|
|
// number should be used by the driver to determine the name of new
|
|
// disks. This field should be updated by the driver as it finds new
|
|
// disks.
|
|
//
|
|
|
|
ULONG DiskCount; // Count of hard disks thus far
|
|
ULONG FloppyCount; // Count of floppy disks thus far
|
|
ULONG CdRomCount; // Count of CD-ROM drives thus far
|
|
ULONG TapeCount; // Count of tape drives thus far
|
|
ULONG ScsiPortCount; // Count of SCSI port adapters thus far
|
|
ULONG SerialCount; // Count of serial devices thus far
|
|
ULONG ParallelCount; // Count of parallel devices thus far
|
|
|
|
//
|
|
// These next two fields indicate ownership of one of the two IO address
|
|
// spaces that are used by WD1003-compatable disk controllers.
|
|
//
|
|
|
|
BOOLEAN AtDiskPrimaryAddressClaimed; // 0x1F0 - 0x1FF
|
|
BOOLEAN AtDiskSecondaryAddressClaimed; // 0x170 - 0x17F
|
|
|
|
//
|
|
// Indicates the structure version, as anything value belong this will have been added.
|
|
// Use the structure size as the version.
|
|
//
|
|
|
|
ULONG Version;
|
|
|
|
//
|
|
// Indicates the total number of medium changer devices in the system.
|
|
// This field will be updated by the drivers as it determines that
|
|
// new devices have been found and will be supported.
|
|
//
|
|
|
|
ULONG MediumChangerCount;
|
|
|
|
} CONFIGURATION_INFORMATION, *PCONFIGURATION_INFORMATION;
|
|
|
|
// end_ntddk end_nthal end_ntosp
|
|
|
|
//
|
|
// The following are global counters used by the I/O system to indicate the
|
|
// amount of I/O being performed in the system. The first three counters
|
|
// are just that, counts of operations that have been requested, while the
|
|
// last three counters track the amount of data transferred for each type
|
|
// of I/O request.
|
|
//
|
|
|
|
extern KSPIN_LOCK IoStatisticsLock;
|
|
extern ULONG IoReadOperationCount;
|
|
extern ULONG IoWriteOperationCount;
|
|
extern ULONG IoOtherOperationCount;
|
|
extern LARGE_INTEGER IoReadTransferCount;
|
|
extern LARGE_INTEGER IoWriteTransferCount;
|
|
extern LARGE_INTEGER IoOtherTransferCount;
|
|
|
|
//
|
|
// It is difficult for cached file systems to properly charge quota
|
|
// for the storage that they allocate on behalf of user file handles,
|
|
// so the following amount of additional quota is charged against each
|
|
// handle as a "best guess" as to the amount of quota the file system
|
|
// will allocate on behalf of this handle.
|
|
//
|
|
|
|
//
|
|
// These numbers are totally arbitrary, and can be changed if it turns out
|
|
// that the file systems actually allocate more (or less) on behalf of
|
|
// their file objects. The non-paged pool charge constant is added to the
|
|
// size of a FILE_OBJECT to get the actual charge amount.
|
|
//
|
|
|
|
#define IO_FILE_OBJECT_NON_PAGED_POOL_CHARGE 64
|
|
#define IO_FILE_OBJECT_PAGED_POOL_CHARGE 1024
|
|
|
|
|
|
// begin_ntddk begin_wdm begin_nthal begin_ntosp
|
|
//
|
|
// Public I/O routine definitions
|
|
//
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoAcquireCancelSpinLock(
|
|
OUT PKIRQL Irql
|
|
);
|
|
|
|
// end_ntddk end_wdm end_nthal end_ntosp
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoAcquireVpbSpinLock(
|
|
OUT PKIRQL Irql
|
|
);
|
|
|
|
// begin_ntddk begin_nthal end_ntifs begin_ntosp
|
|
|
|
DECLSPEC_DEPRECATED_DDK // Use AllocateAdapterChannel
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoAllocateAdapterChannel(
|
|
IN PADAPTER_OBJECT AdapterObject,
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN ULONG NumberOfMapRegisters,
|
|
IN PDRIVER_CONTROL ExecutionRoutine,
|
|
IN PVOID Context
|
|
);
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoAllocateController(
|
|
IN PCONTROLLER_OBJECT ControllerObject,
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN PDRIVER_CONTROL ExecutionRoutine,
|
|
IN PVOID Context
|
|
);
|
|
|
|
// begin_wdm
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoAllocateDriverObjectExtension(
|
|
IN PDRIVER_OBJECT DriverObject,
|
|
IN PVOID ClientIdentificationAddress,
|
|
IN ULONG DriverObjectExtensionSize,
|
|
OUT PVOID *DriverObjectExtension
|
|
);
|
|
|
|
// begin_ntifs
|
|
|
|
NTKERNELAPI
|
|
PVOID
|
|
IoAllocateErrorLogEntry(
|
|
IN PVOID IoObject,
|
|
IN UCHAR EntrySize
|
|
);
|
|
|
|
NTKERNELAPI
|
|
PIRP
|
|
IoAllocateIrp(
|
|
IN CCHAR StackSize,
|
|
IN BOOLEAN ChargeQuota
|
|
);
|
|
|
|
NTKERNELAPI
|
|
PMDL
|
|
IoAllocateMdl(
|
|
IN PVOID VirtualAddress,
|
|
IN ULONG Length,
|
|
IN BOOLEAN SecondaryBuffer,
|
|
IN BOOLEAN ChargeQuota,
|
|
IN OUT PIRP Irp OPTIONAL
|
|
);
|
|
|
|
// end_wdm end_ntifs
|
|
//++
|
|
//
|
|
// VOID
|
|
// IoAssignArcName(
|
|
// IN PUNICODE_STRING ArcName,
|
|
// IN PUNICODE_STRING DeviceName
|
|
// )
|
|
//
|
|
// Routine Description:
|
|
//
|
|
// This routine is invoked by drivers of bootable media to create a symbolic
|
|
// link between the ARC name of their device and its NT name. This allows
|
|
// the system to determine which device in the system was actually booted
|
|
// from since the ARC firmware only deals in ARC names, and NT only deals
|
|
// in NT names.
|
|
//
|
|
// Arguments:
|
|
//
|
|
// ArcName - Supplies the Unicode string representing the ARC name.
|
|
//
|
|
// DeviceName - Supplies the name to which the ARCname refers.
|
|
//
|
|
// Return Value:
|
|
//
|
|
// None.
|
|
//
|
|
//--
|
|
|
|
#define IoAssignArcName( ArcName, DeviceName ) ( \
|
|
IoCreateSymbolicLink( (ArcName), (DeviceName) ) )
|
|
|
|
DECLSPEC_DEPRECATED_DDK // Use Pnp or IoReprtDetectedDevice
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoAssignResources (
|
|
IN PUNICODE_STRING RegistryPath,
|
|
IN PUNICODE_STRING DriverClassName OPTIONAL,
|
|
IN PDRIVER_OBJECT DriverObject,
|
|
IN PDEVICE_OBJECT DeviceObject OPTIONAL,
|
|
IN PIO_RESOURCE_REQUIREMENTS_LIST RequestedResources,
|
|
IN OUT PCM_RESOURCE_LIST *AllocatedResources
|
|
);
|
|
|
|
// end_ntddk end_nthal end_ntosp
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoAsynchronousPageWrite(
|
|
IN PFILE_OBJECT FileObject,
|
|
IN PMDL MemoryDescriptorList,
|
|
IN PLARGE_INTEGER StartingOffset,
|
|
IN PIO_APC_ROUTINE ApcRoutine,
|
|
IN PVOID ApcContext,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
OUT PIRP *Irp OPTIONAL
|
|
);
|
|
|
|
// begin_ntddk begin_wdm begin_nthal begin_ntifs begin_ntosp
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoAttachDevice(
|
|
IN PDEVICE_OBJECT SourceDevice,
|
|
IN PUNICODE_STRING TargetDevice,
|
|
OUT PDEVICE_OBJECT *AttachedDevice
|
|
);
|
|
|
|
// end_wdm
|
|
|
|
DECLSPEC_DEPRECATED_DDK // Use IoAttachDeviceToDeviceStack
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoAttachDeviceByPointer(
|
|
IN PDEVICE_OBJECT SourceDevice,
|
|
IN PDEVICE_OBJECT TargetDevice
|
|
);
|
|
|
|
// begin_wdm
|
|
|
|
NTKERNELAPI
|
|
PDEVICE_OBJECT
|
|
IoAttachDeviceToDeviceStack(
|
|
IN PDEVICE_OBJECT SourceDevice,
|
|
IN PDEVICE_OBJECT TargetDevice
|
|
);
|
|
|
|
NTKERNELAPI
|
|
PIRP
|
|
IoBuildAsynchronousFsdRequest(
|
|
IN ULONG MajorFunction,
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN OUT PVOID Buffer OPTIONAL,
|
|
IN ULONG Length OPTIONAL,
|
|
IN PLARGE_INTEGER StartingOffset OPTIONAL,
|
|
IN PIO_STATUS_BLOCK IoStatusBlock OPTIONAL
|
|
);
|
|
|
|
NTKERNELAPI
|
|
PIRP
|
|
IoBuildDeviceIoControlRequest(
|
|
IN ULONG IoControlCode,
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN PVOID InputBuffer OPTIONAL,
|
|
IN ULONG InputBufferLength,
|
|
OUT PVOID OutputBuffer OPTIONAL,
|
|
IN ULONG OutputBufferLength,
|
|
IN BOOLEAN InternalDeviceIoControl,
|
|
IN PKEVENT Event,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock
|
|
);
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoBuildPartialMdl(
|
|
IN PMDL SourceMdl,
|
|
IN OUT PMDL TargetMdl,
|
|
IN PVOID VirtualAddress,
|
|
IN ULONG Length
|
|
);
|
|
|
|
typedef struct _BOOTDISK_INFORMATION {
|
|
LONGLONG BootPartitionOffset;
|
|
LONGLONG SystemPartitionOffset;
|
|
ULONG BootDeviceSignature;
|
|
ULONG SystemDeviceSignature;
|
|
} BOOTDISK_INFORMATION, *PBOOTDISK_INFORMATION;
|
|
|
|
//
|
|
// This structure should follow the previous structure field for field.
|
|
//
|
|
typedef struct _BOOTDISK_INFORMATION_EX {
|
|
LONGLONG BootPartitionOffset;
|
|
LONGLONG SystemPartitionOffset;
|
|
ULONG BootDeviceSignature;
|
|
ULONG SystemDeviceSignature;
|
|
GUID BootDeviceGuid;
|
|
GUID SystemDeviceGuid;
|
|
BOOLEAN BootDeviceIsGpt;
|
|
BOOLEAN SystemDeviceIsGpt;
|
|
} BOOTDISK_INFORMATION_EX, *PBOOTDISK_INFORMATION_EX;
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoGetBootDiskInformation(
|
|
IN OUT PBOOTDISK_INFORMATION BootDiskInformation,
|
|
IN ULONG Size
|
|
);
|
|
|
|
// end_ntddk end_nthal end_wdm end_ntifs end_ntosp
|
|
|
|
NTSTATUS
|
|
IoBuildPoDeviceNotifyList (
|
|
IN OUT PVOID Order
|
|
);
|
|
|
|
VOID
|
|
IoMovePoNotifyChildren(
|
|
IN PVOID Notify,
|
|
IN PVOID Order
|
|
);
|
|
|
|
PVOID
|
|
IoGetPoNotifyParent(
|
|
PVOID Notify
|
|
);
|
|
|
|
NTSTATUS
|
|
IoNotifyPowerOperationVetoed(
|
|
IN POWER_ACTION VetoedPowerOperation,
|
|
IN PDEVICE_OBJECT TargetedDeviceObject OPTIONAL,
|
|
IN PDEVICE_OBJECT VetoingDeviceObject
|
|
);
|
|
|
|
// begin_ntddk begin_nthal begin_wdm begin_ntifs begin_ntosp
|
|
|
|
NTKERNELAPI
|
|
PIRP
|
|
IoBuildSynchronousFsdRequest(
|
|
IN ULONG MajorFunction,
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN OUT PVOID Buffer OPTIONAL,
|
|
IN ULONG Length OPTIONAL,
|
|
IN PLARGE_INTEGER StartingOffset OPTIONAL,
|
|
IN PKEVENT Event,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
FASTCALL
|
|
IofCallDriver(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN OUT PIRP Irp
|
|
);
|
|
|
|
#define IoCallDriver(a,b) \
|
|
IofCallDriver(a,b)
|
|
|
|
NTKERNELAPI
|
|
BOOLEAN
|
|
IoCancelIrp(
|
|
IN PIRP Irp
|
|
);
|
|
|
|
// end_ntddk end_wdm end_nthal end_ntifs end_ntosp
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoCancelThreadIo(
|
|
IN PETHREAD Thread
|
|
);
|
|
|
|
// begin_ntifs
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoCheckDesiredAccess(
|
|
IN OUT PACCESS_MASK DesiredAccess,
|
|
IN ACCESS_MASK GrantedAccess
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoCheckEaBufferValidity(
|
|
IN PFILE_FULL_EA_INFORMATION EaBuffer,
|
|
IN ULONG EaLength,
|
|
OUT PULONG ErrorOffset
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoCheckFunctionAccess(
|
|
IN ACCESS_MASK GrantedAccess,
|
|
IN UCHAR MajorFunction,
|
|
IN UCHAR MinorFunction,
|
|
IN ULONG IoControlCode,
|
|
IN PVOID Arg1 OPTIONAL,
|
|
IN PVOID Arg2 OPTIONAL
|
|
);
|
|
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoCheckQuerySetFileInformation(
|
|
IN FILE_INFORMATION_CLASS FileInformationClass,
|
|
IN ULONG Length,
|
|
IN BOOLEAN SetOperation
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoCheckQuerySetVolumeInformation(
|
|
IN FS_INFORMATION_CLASS FsInformationClass,
|
|
IN ULONG Length,
|
|
IN BOOLEAN SetOperation
|
|
);
|
|
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoCheckQuotaBufferValidity(
|
|
IN PFILE_QUOTA_INFORMATION QuotaBuffer,
|
|
IN ULONG QuotaLength,
|
|
OUT PULONG ErrorOffset
|
|
);
|
|
|
|
// begin_ntddk begin_wdm begin_nthal begin_ntosp
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoCheckShareAccess(
|
|
IN ACCESS_MASK DesiredAccess,
|
|
IN ULONG DesiredShareAccess,
|
|
IN OUT PFILE_OBJECT FileObject,
|
|
IN OUT PSHARE_ACCESS ShareAccess,
|
|
IN BOOLEAN Update
|
|
);
|
|
|
|
//
|
|
// This value should be returned from completion routines to continue
|
|
// completing the IRP upwards. Otherwise, STATUS_MORE_PROCESSING_REQUIRED
|
|
// should be returned.
|
|
//
|
|
#define STATUS_CONTINUE_COMPLETION STATUS_SUCCESS
|
|
|
|
//
|
|
// Completion routines can also use this enumeration in place of status codes.
|
|
//
|
|
typedef enum _IO_COMPLETION_ROUTINE_RESULT {
|
|
|
|
ContinueCompletion = STATUS_CONTINUE_COMPLETION,
|
|
StopCompletion = STATUS_MORE_PROCESSING_REQUIRED
|
|
|
|
} IO_COMPLETION_ROUTINE_RESULT, *PIO_COMPLETION_ROUTINE_RESULT;
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
FASTCALL
|
|
IofCompleteRequest(
|
|
IN PIRP Irp,
|
|
IN CCHAR PriorityBoost
|
|
);
|
|
|
|
#define IoCompleteRequest(a,b) \
|
|
IofCompleteRequest(a,b)
|
|
|
|
// end_ntifs
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoConnectInterrupt(
|
|
OUT PKINTERRUPT *InterruptObject,
|
|
IN PKSERVICE_ROUTINE ServiceRoutine,
|
|
IN PVOID ServiceContext,
|
|
IN PKSPIN_LOCK SpinLock OPTIONAL,
|
|
IN ULONG Vector,
|
|
IN KIRQL Irql,
|
|
IN KIRQL SynchronizeIrql,
|
|
IN KINTERRUPT_MODE InterruptMode,
|
|
IN BOOLEAN ShareVector,
|
|
IN KAFFINITY ProcessorEnableMask,
|
|
IN BOOLEAN FloatingSave
|
|
);
|
|
|
|
// end_wdm
|
|
|
|
NTKERNELAPI
|
|
PCONTROLLER_OBJECT
|
|
IoCreateController(
|
|
IN ULONG Size
|
|
);
|
|
|
|
// begin_wdm begin_ntifs
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoCreateDevice(
|
|
IN PDRIVER_OBJECT DriverObject,
|
|
IN ULONG DeviceExtensionSize,
|
|
IN PUNICODE_STRING DeviceName OPTIONAL,
|
|
IN DEVICE_TYPE DeviceType,
|
|
IN ULONG DeviceCharacteristics,
|
|
IN BOOLEAN Exclusive,
|
|
OUT PDEVICE_OBJECT *DeviceObject
|
|
);
|
|
|
|
#define WDM_MAJORVERSION 0x01
|
|
#define WDM_MINORVERSION 0x20
|
|
|
|
NTKERNELAPI
|
|
BOOLEAN
|
|
IoIsWdmVersionAvailable(
|
|
IN UCHAR MajorVersion,
|
|
IN UCHAR MinorVersion
|
|
);
|
|
|
|
// end_nthal
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoCreateFile(
|
|
OUT PHANDLE FileHandle,
|
|
IN ACCESS_MASK DesiredAccess,
|
|
IN POBJECT_ATTRIBUTES ObjectAttributes,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
IN PLARGE_INTEGER AllocationSize OPTIONAL,
|
|
IN ULONG FileAttributes,
|
|
IN ULONG ShareAccess,
|
|
IN ULONG Disposition,
|
|
IN ULONG CreateOptions,
|
|
IN PVOID EaBuffer OPTIONAL,
|
|
IN ULONG EaLength,
|
|
IN CREATE_FILE_TYPE CreateFileType,
|
|
IN PVOID ExtraCreateParameters OPTIONAL,
|
|
IN ULONG Options
|
|
);
|
|
|
|
// end_ntddk end_wdm end_ntosp
|
|
|
|
NTKERNELAPI
|
|
PFILE_OBJECT
|
|
IoCreateStreamFileObject(
|
|
IN PFILE_OBJECT FileObject OPTIONAL,
|
|
IN PDEVICE_OBJECT DeviceObject OPTIONAL
|
|
);
|
|
|
|
NTKERNELAPI
|
|
PFILE_OBJECT
|
|
IoCreateStreamFileObjectEx(
|
|
IN PFILE_OBJECT FileObject OPTIONAL,
|
|
IN PDEVICE_OBJECT DeviceObject OPTIONAL,
|
|
OUT PHANDLE FileObjectHandle OPTIONAL
|
|
);
|
|
|
|
NTKERNELAPI
|
|
PFILE_OBJECT
|
|
IoCreateStreamFileObjectLite(
|
|
IN PFILE_OBJECT FileObject OPTIONAL,
|
|
IN PDEVICE_OBJECT DeviceObject OPTIONAL
|
|
);
|
|
|
|
// begin_nthal begin_ntddk begin_wdm begin_ntosp
|
|
|
|
NTKERNELAPI
|
|
PKEVENT
|
|
IoCreateNotificationEvent(
|
|
IN PUNICODE_STRING EventName,
|
|
OUT PHANDLE EventHandle
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoCreateSymbolicLink(
|
|
IN PUNICODE_STRING SymbolicLinkName,
|
|
IN PUNICODE_STRING DeviceName
|
|
);
|
|
|
|
NTKERNELAPI
|
|
PKEVENT
|
|
IoCreateSynchronizationEvent(
|
|
IN PUNICODE_STRING EventName,
|
|
OUT PHANDLE EventHandle
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoCreateUnprotectedSymbolicLink(
|
|
IN PUNICODE_STRING SymbolicLinkName,
|
|
IN PUNICODE_STRING DeviceName
|
|
);
|
|
|
|
// end_wdm
|
|
|
|
//++
|
|
//
|
|
// VOID
|
|
// IoDeassignArcName(
|
|
// IN PUNICODE_STRING ArcName
|
|
// )
|
|
//
|
|
// Routine Description:
|
|
//
|
|
// This routine is invoked by drivers to deassign an ARC name that they
|
|
// created to a device. This is generally only called if the driver is
|
|
// deleting the device object, which means that the driver is probably
|
|
// unloading.
|
|
//
|
|
// Arguments:
|
|
//
|
|
// ArcName - Supplies the ARC name to be removed.
|
|
//
|
|
// Return Value:
|
|
//
|
|
// None.
|
|
//
|
|
//--
|
|
|
|
#define IoDeassignArcName( ArcName ) ( \
|
|
IoDeleteSymbolicLink( (ArcName) ) )
|
|
|
|
// end_ntifs
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoDeleteController(
|
|
IN PCONTROLLER_OBJECT ControllerObject
|
|
);
|
|
|
|
// begin_wdm begin_ntifs
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoDeleteDevice(
|
|
IN PDEVICE_OBJECT DeviceObject
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoDeleteSymbolicLink(
|
|
IN PUNICODE_STRING SymbolicLinkName
|
|
);
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoDetachDevice(
|
|
IN OUT PDEVICE_OBJECT TargetDevice
|
|
);
|
|
|
|
// end_ntifs
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoDisconnectInterrupt(
|
|
IN PKINTERRUPT InterruptObject
|
|
);
|
|
|
|
// end_ntddk end_wdm end_nthal
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoEnqueueIrp(
|
|
IN PIRP Irp
|
|
);
|
|
// end_ntosp
|
|
|
|
NTKERNELAPI // ntifs
|
|
BOOLEAN // ntifs
|
|
IoFastQueryNetworkAttributes( // ntifs
|
|
IN POBJECT_ATTRIBUTES ObjectAttributes, // ntifs
|
|
IN ACCESS_MASK DesiredAccess, // ntifs
|
|
IN ULONG OpenOptions, // ntifs
|
|
OUT PIO_STATUS_BLOCK IoStatus, // ntifs
|
|
OUT PFILE_NETWORK_OPEN_INFORMATION Buffer // ntifs
|
|
); // ntifs
|
|
|
|
// begin_ntddk begin_nthal begin_ntosp
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoFreeController(
|
|
IN PCONTROLLER_OBJECT ControllerObject
|
|
);
|
|
|
|
// begin_wdm begin_ntifs
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoFreeIrp(
|
|
IN PIRP Irp
|
|
);
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoFreeMdl(
|
|
IN PMDL Mdl
|
|
);
|
|
|
|
// end_ntddk end_wdm end_nthal end_ntifs end_ntosp
|
|
|
|
VOID
|
|
IoFreePoDeviceNotifyList (
|
|
IN OUT PVOID Order
|
|
);
|
|
|
|
NTSTATUS
|
|
IoGetDeviceInstanceName(
|
|
IN PDEVICE_OBJECT PhysicalDeviceObject,
|
|
OUT PUNICODE_STRING InstanceName
|
|
);
|
|
|
|
NTSTATUS
|
|
IoGetLegacyVetoList(
|
|
OUT PWSTR *VetoList OPTIONAL,
|
|
OUT PPNP_VETO_TYPE VetoType
|
|
);
|
|
|
|
// begin_ntifs begin_ntosp
|
|
|
|
NTKERNELAPI
|
|
PDEVICE_OBJECT
|
|
IoGetAttachedDevice(
|
|
IN PDEVICE_OBJECT DeviceObject
|
|
);
|
|
|
|
NTKERNELAPI // ntddk wdm nthal
|
|
PDEVICE_OBJECT // ntddk wdm nthal
|
|
IoGetAttachedDeviceReference( // ntddk wdm nthal
|
|
IN PDEVICE_OBJECT DeviceObject // ntddk wdm nthal
|
|
); // ntddk wdm nthal
|
|
// ntddk wdm nthal
|
|
NTKERNELAPI
|
|
PDEVICE_OBJECT
|
|
IoGetBaseFileSystemDeviceObject(
|
|
IN PFILE_OBJECT FileObject
|
|
);
|
|
|
|
NTKERNELAPI // ntddk nthal ntosp
|
|
PCONFIGURATION_INFORMATION // ntddk nthal ntosp
|
|
IoGetConfigurationInformation( VOID ); // ntddk nthal ntosp
|
|
|
|
// begin_ntddk begin_wdm begin_nthal
|
|
|
|
//++
|
|
//
|
|
// PIO_STACK_LOCATION
|
|
// IoGetCurrentIrpStackLocation(
|
|
// IN PIRP Irp
|
|
// )
|
|
//
|
|
// Routine Description:
|
|
//
|
|
// This routine is invoked to return a pointer to the current stack location
|
|
// in an I/O Request Packet (IRP).
|
|
//
|
|
// Arguments:
|
|
//
|
|
// Irp - Pointer to the I/O Request Packet.
|
|
//
|
|
// Return Value:
|
|
//
|
|
// The function value is a pointer to the current stack location in the
|
|
// packet.
|
|
//
|
|
//--
|
|
|
|
#define IoGetCurrentIrpStackLocation( Irp ) ( (Irp)->Tail.Overlay.CurrentStackLocation )
|
|
|
|
// end_nthal end_wdm
|
|
|
|
NTKERNELAPI
|
|
PDEVICE_OBJECT
|
|
IoGetDeviceToVerify(
|
|
IN PETHREAD Thread
|
|
);
|
|
|
|
// begin_wdm
|
|
|
|
NTKERNELAPI
|
|
PVOID
|
|
IoGetDriverObjectExtension(
|
|
IN PDRIVER_OBJECT DriverObject,
|
|
IN PVOID ClientIdentificationAddress
|
|
);
|
|
|
|
NTKERNELAPI
|
|
PEPROCESS
|
|
IoGetCurrentProcess(
|
|
VOID
|
|
);
|
|
|
|
// begin_nthal
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoGetDeviceObjectPointer(
|
|
IN PUNICODE_STRING ObjectName,
|
|
IN ACCESS_MASK DesiredAccess,
|
|
OUT PFILE_OBJECT *FileObject,
|
|
OUT PDEVICE_OBJECT *DeviceObject
|
|
);
|
|
|
|
NTKERNELAPI
|
|
struct _DMA_ADAPTER *
|
|
IoGetDmaAdapter(
|
|
IN PDEVICE_OBJECT PhysicalDeviceObject, OPTIONAL // required for PnP drivers
|
|
IN struct _DEVICE_DESCRIPTION *DeviceDescription,
|
|
IN OUT PULONG NumberOfMapRegisters
|
|
);
|
|
|
|
NTKERNELAPI
|
|
BOOLEAN
|
|
IoForwardIrpSynchronously(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN PIRP Irp
|
|
);
|
|
|
|
#define IoForwardAndCatchIrp IoForwardIrpSynchronously
|
|
|
|
// end_wdm
|
|
|
|
NTKERNELAPI
|
|
PGENERIC_MAPPING
|
|
IoGetFileObjectGenericMapping(
|
|
VOID
|
|
);
|
|
|
|
// end_nthal
|
|
|
|
|
|
// begin_wdm
|
|
|
|
//++
|
|
//
|
|
// ULONG
|
|
// IoGetFunctionCodeFromCtlCode(
|
|
// IN ULONG ControlCode
|
|
// )
|
|
//
|
|
// Routine Description:
|
|
//
|
|
// This routine extracts the function code from IOCTL and FSCTL function
|
|
// control codes.
|
|
// This routine should only be used by kernel mode code.
|
|
//
|
|
// Arguments:
|
|
//
|
|
// ControlCode - A function control code (IOCTL or FSCTL) from which the
|
|
// function code must be extracted.
|
|
//
|
|
// Return Value:
|
|
//
|
|
// The extracted function code.
|
|
//
|
|
// Note:
|
|
//
|
|
// The CTL_CODE macro, used to create IOCTL and FSCTL function control
|
|
// codes, is defined in ntioapi.h
|
|
//
|
|
//--
|
|
|
|
#define IoGetFunctionCodeFromCtlCode( ControlCode ) (\
|
|
( ControlCode >> 2) & 0x00000FFF )
|
|
|
|
// begin_nthal
|
|
|
|
NTKERNELAPI
|
|
PVOID
|
|
IoGetInitialStack(
|
|
VOID
|
|
);
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoGetStackLimits (
|
|
OUT PULONG_PTR LowLimit,
|
|
OUT PULONG_PTR HighLimit
|
|
);
|
|
|
|
//
|
|
// The following function is used to tell the caller how much stack is available
|
|
//
|
|
|
|
FORCEINLINE
|
|
ULONG_PTR
|
|
IoGetRemainingStackSize (
|
|
VOID
|
|
)
|
|
{
|
|
ULONG_PTR Top;
|
|
ULONG_PTR Bottom;
|
|
|
|
IoGetStackLimits( &Bottom, &Top );
|
|
return((ULONG_PTR)(&Top) - Bottom );
|
|
}
|
|
|
|
//++
|
|
//
|
|
// PIO_STACK_LOCATION
|
|
// IoGetNextIrpStackLocation(
|
|
// IN PIRP Irp
|
|
// )
|
|
//
|
|
// Routine Description:
|
|
//
|
|
// This routine is invoked to return a pointer to the next stack location
|
|
// in an I/O Request Packet (IRP).
|
|
//
|
|
// Arguments:
|
|
//
|
|
// Irp - Pointer to the I/O Request Packet.
|
|
//
|
|
// Return Value:
|
|
//
|
|
// The function value is a pointer to the next stack location in the packet.
|
|
//
|
|
//--
|
|
|
|
#define IoGetNextIrpStackLocation( Irp ) (\
|
|
(Irp)->Tail.Overlay.CurrentStackLocation - 1 )
|
|
|
|
NTKERNELAPI
|
|
PDEVICE_OBJECT
|
|
IoGetRelatedDeviceObject(
|
|
IN PFILE_OBJECT FileObject
|
|
);
|
|
|
|
// end_ntddk end_wdm end_nthal
|
|
|
|
NTKERNELAPI
|
|
ULONG
|
|
IoGetRequestorProcessId(
|
|
IN PIRP Irp
|
|
);
|
|
|
|
NTKERNELAPI
|
|
PEPROCESS
|
|
IoGetRequestorProcess(
|
|
IN PIRP Irp
|
|
);
|
|
|
|
// end_ntosp
|
|
|
|
NTKERNELAPI
|
|
PIRP
|
|
IoGetTopLevelIrp(
|
|
VOID
|
|
);
|
|
|
|
// begin_ntddk begin_wdm begin_nthal begin_ntosp
|
|
|
|
//++
|
|
//
|
|
// VOID
|
|
// IoInitializeDpcRequest(
|
|
// IN PDEVICE_OBJECT DeviceObject,
|
|
// IN PIO_DPC_ROUTINE DpcRoutine
|
|
// )
|
|
//
|
|
// Routine Description:
|
|
//
|
|
// This routine is invoked to initialize the DPC in a device object for a
|
|
// device driver during its initialization routine. The DPC is used later
|
|
// when the driver interrupt service routine requests that a DPC routine
|
|
// be queued for later execution.
|
|
//
|
|
// Arguments:
|
|
//
|
|
// DeviceObject - Pointer to the device object that the request is for.
|
|
//
|
|
// DpcRoutine - Address of the driver's DPC routine to be executed when
|
|
// the DPC is dequeued for processing.
|
|
//
|
|
// Return Value:
|
|
//
|
|
// None.
|
|
//
|
|
//--
|
|
|
|
#define IoInitializeDpcRequest( DeviceObject, DpcRoutine ) (\
|
|
KeInitializeDpc( &(DeviceObject)->Dpc, \
|
|
(PKDEFERRED_ROUTINE) (DpcRoutine), \
|
|
(DeviceObject) ) )
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoInitializeIrp(
|
|
IN OUT PIRP Irp,
|
|
IN USHORT PacketSize,
|
|
IN CCHAR StackSize
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoInitializeTimer(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN PIO_TIMER_ROUTINE TimerRoutine,
|
|
IN PVOID Context
|
|
);
|
|
|
|
// end_ntddk end_wdm end_nthal end_ntifs end_ntosp
|
|
|
|
// begin_ntddk begin_wdm begin_ntifs begin_ntosp
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoReuseIrp(
|
|
IN OUT PIRP Irp,
|
|
IN NTSTATUS Iostatus
|
|
);
|
|
|
|
// end_wdm
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoCancelFileOpen(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN PFILE_OBJECT FileObject
|
|
);
|
|
// end_ntddk end_ntifs end_ntosp
|
|
|
|
NTKERNELAPI
|
|
BOOLEAN
|
|
IoInitSystem(
|
|
PLOADER_PARAMETER_BLOCK LoaderBlock
|
|
);
|
|
|
|
// begin_ntddk begin_wdm begin_nthal begin_ntifs begin_ntosp
|
|
|
|
//++
|
|
//
|
|
// BOOLEAN
|
|
// IoIsErrorUserInduced(
|
|
// IN NTSTATUS Status
|
|
// )
|
|
//
|
|
// Routine Description:
|
|
//
|
|
// This routine is invoked to determine if an error was as a
|
|
// result of user actions. Typically these error are related
|
|
// to removable media and will result in a pop-up.
|
|
//
|
|
// Arguments:
|
|
//
|
|
// Status - The status value to check.
|
|
//
|
|
// Return Value:
|
|
// The function value is TRUE if the user induced the error,
|
|
// otherwise FALSE is returned.
|
|
//
|
|
//--
|
|
#define IoIsErrorUserInduced( Status ) ((BOOLEAN) \
|
|
(((Status) == STATUS_DEVICE_NOT_READY) || \
|
|
((Status) == STATUS_IO_TIMEOUT) || \
|
|
((Status) == STATUS_MEDIA_WRITE_PROTECTED) || \
|
|
((Status) == STATUS_NO_MEDIA_IN_DEVICE) || \
|
|
((Status) == STATUS_VERIFY_REQUIRED) || \
|
|
((Status) == STATUS_UNRECOGNIZED_MEDIA) || \
|
|
((Status) == STATUS_WRONG_VOLUME)))
|
|
|
|
// end_ntddk end_wdm end_nthal end_ntosp
|
|
|
|
//++
|
|
//
|
|
// BOOLEAN
|
|
// IoIsFileOpenedExclusively(
|
|
// IN PFILE_OBJECT FileObject
|
|
// )
|
|
//
|
|
// Routine Description:
|
|
//
|
|
// This routine is invoked to determine whether the file open represented
|
|
// by the specified file object is opened exclusively.
|
|
//
|
|
// Arguments:
|
|
//
|
|
// FileObject - Pointer to the file object that represents the open instance
|
|
// of the target file to be tested for exclusive access.
|
|
//
|
|
// Return Value:
|
|
//
|
|
// The function value is TRUE if the open instance of the file is exclusive;
|
|
// otherwise FALSE is returned.
|
|
//
|
|
//--
|
|
|
|
#define IoIsFileOpenedExclusively( FileObject ) (\
|
|
(BOOLEAN) !((FileObject)->SharedRead || (FileObject)->SharedWrite || (FileObject)->SharedDelete))
|
|
|
|
NTKERNELAPI
|
|
BOOLEAN
|
|
IoIsOperationSynchronous(
|
|
IN PIRP Irp
|
|
);
|
|
|
|
NTKERNELAPI
|
|
BOOLEAN
|
|
IoIsSystemThread(
|
|
IN PETHREAD Thread
|
|
);
|
|
|
|
NTKERNELAPI
|
|
BOOLEAN
|
|
IoIsValidNameGraftingBuffer(
|
|
IN PIRP Irp,
|
|
IN PREPARSE_DATA_BUFFER ReparseBuffer
|
|
);
|
|
|
|
// begin_ntddk begin_nthal begin_ntosp
|
|
|
|
NTKERNELAPI
|
|
PIRP
|
|
IoMakeAssociatedIrp(
|
|
IN PIRP Irp,
|
|
IN CCHAR StackSize
|
|
);
|
|
|
|
// begin_wdm
|
|
|
|
//++
|
|
//
|
|
// VOID
|
|
// IoMarkIrpPending(
|
|
// IN OUT PIRP Irp
|
|
// )
|
|
//
|
|
// Routine Description:
|
|
//
|
|
// This routine marks the specified I/O Request Packet (IRP) to indicate
|
|
// that an initial status of STATUS_PENDING was returned to the caller.
|
|
// This is used so that I/O completion can determine whether or not to
|
|
// fully complete the I/O operation requested by the packet.
|
|
//
|
|
// Arguments:
|
|
//
|
|
// Irp - Pointer to the I/O Request Packet to be marked pending.
|
|
//
|
|
// Return Value:
|
|
//
|
|
// None.
|
|
//
|
|
//--
|
|
|
|
#define IoMarkIrpPending( Irp ) ( \
|
|
IoGetCurrentIrpStackLocation( (Irp) )->Control |= SL_PENDING_RETURNED )
|
|
|
|
// end_ntddk end_wdm end_nthal end_ntifs end_ntosp
|
|
|
|
NTKERNELAPI
|
|
BOOLEAN
|
|
IoPageFileCreated(
|
|
IN HANDLE FileHandle
|
|
);
|
|
|
|
NTKERNELAPI // ntifs
|
|
NTSTATUS // ntifs
|
|
IoPageRead( // ntifs
|
|
IN PFILE_OBJECT FileObject, // ntifs
|
|
IN PMDL MemoryDescriptorList, // ntifs
|
|
IN PLARGE_INTEGER StartingOffset, // ntifs
|
|
IN PKEVENT Event, // ntifs
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock // ntifs
|
|
); // ntifs
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoAsynchronousPageRead(
|
|
IN PFILE_OBJECT FileObject,
|
|
IN PMDL MemoryDescriptorList,
|
|
IN PLARGE_INTEGER StartingOffset,
|
|
IN PKEVENT Event,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock
|
|
);
|
|
|
|
// begin_ntddk begin_ntosp
|
|
DECLSPEC_DEPRECATED_DDK // Use IoGetDeviceProperty
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoQueryDeviceDescription(
|
|
IN PINTERFACE_TYPE BusType OPTIONAL,
|
|
IN PULONG BusNumber OPTIONAL,
|
|
IN PCONFIGURATION_TYPE ControllerType OPTIONAL,
|
|
IN PULONG ControllerNumber OPTIONAL,
|
|
IN PCONFIGURATION_TYPE PeripheralType OPTIONAL,
|
|
IN PULONG PeripheralNumber OPTIONAL,
|
|
IN PIO_QUERY_DEVICE_ROUTINE CalloutRoutine,
|
|
IN PVOID Context
|
|
);
|
|
|
|
// end_ntddk end_ntosp
|
|
|
|
|
|
// begin_ntifs
|
|
|
|
NTSTATUS
|
|
IoQueryFileDosDeviceName(
|
|
IN PFILE_OBJECT FileObject,
|
|
OUT POBJECT_NAME_INFORMATION *ObjectNameInformation
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoQueryFileInformation(
|
|
IN PFILE_OBJECT FileObject,
|
|
IN FILE_INFORMATION_CLASS FileInformationClass,
|
|
IN ULONG Length,
|
|
OUT PVOID FileInformation,
|
|
OUT PULONG ReturnedLength
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoQueryVolumeInformation(
|
|
IN PFILE_OBJECT FileObject,
|
|
IN FS_INFORMATION_CLASS FsInformationClass,
|
|
IN ULONG Length,
|
|
OUT PVOID FsInformation,
|
|
OUT PULONG ReturnedLength
|
|
);
|
|
|
|
// begin_ntosp
|
|
NTKERNELAPI
|
|
VOID
|
|
IoQueueThreadIrp(
|
|
IN PIRP Irp
|
|
);
|
|
// end_ntosp
|
|
|
|
// begin_ntddk begin_nthal begin_ntosp
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoRaiseHardError(
|
|
IN PIRP Irp,
|
|
IN PVPB Vpb OPTIONAL,
|
|
IN PDEVICE_OBJECT RealDeviceObject
|
|
);
|
|
|
|
NTKERNELAPI
|
|
BOOLEAN
|
|
IoRaiseInformationalHardError(
|
|
IN NTSTATUS ErrorStatus,
|
|
IN PUNICODE_STRING String OPTIONAL,
|
|
IN PKTHREAD Thread OPTIONAL
|
|
);
|
|
|
|
NTKERNELAPI
|
|
BOOLEAN
|
|
IoSetThreadHardErrorMode(
|
|
IN BOOLEAN EnableHardErrors
|
|
);
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoRegisterBootDriverReinitialization(
|
|
IN PDRIVER_OBJECT DriverObject,
|
|
IN PDRIVER_REINITIALIZE DriverReinitializationRoutine,
|
|
IN PVOID Context
|
|
);
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoRegisterDriverReinitialization(
|
|
IN PDRIVER_OBJECT DriverObject,
|
|
IN PDRIVER_REINITIALIZE DriverReinitializationRoutine,
|
|
IN PVOID Context
|
|
);
|
|
|
|
// end_ntddk end_nthal end_ntosp
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoRegisterFileSystem(
|
|
IN OUT PDEVICE_OBJECT DeviceObject
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoRegisterFsRegistrationChange(
|
|
IN PDRIVER_OBJECT DriverObject,
|
|
IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine
|
|
);
|
|
|
|
// begin_ntddk begin_nthal begin_ntosp
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoRegisterShutdownNotification(
|
|
IN PDEVICE_OBJECT DeviceObject
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoRegisterLastChanceShutdownNotification(
|
|
IN PDEVICE_OBJECT DeviceObject
|
|
);
|
|
|
|
// begin_wdm
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoReleaseCancelSpinLock(
|
|
IN KIRQL Irql
|
|
);
|
|
|
|
// end_ntddk end_nthal end_wdm end_ntosp
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoReleaseVpbSpinLock(
|
|
IN KIRQL Irql
|
|
);
|
|
|
|
// begin_ntddk begin_nthal begin_ntosp
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoRemoveShareAccess(
|
|
IN PFILE_OBJECT FileObject,
|
|
IN OUT PSHARE_ACCESS ShareAccess
|
|
);
|
|
|
|
// end_ntddk end_ntifs end_ntosp
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoReportHalResourceUsage(
|
|
IN PUNICODE_STRING HalName,
|
|
IN PCM_RESOURCE_LIST RawResourceList,
|
|
IN PCM_RESOURCE_LIST TranslatedResourceList,
|
|
IN ULONG ResourceListSize
|
|
);
|
|
|
|
// begin_ntddk begin_ntifs begin_ntosp
|
|
|
|
DECLSPEC_DEPRECATED_DDK // Use IoReportResourceForDetection
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoReportResourceUsage(
|
|
IN PUNICODE_STRING DriverClassName OPTIONAL,
|
|
IN PDRIVER_OBJECT DriverObject,
|
|
IN PCM_RESOURCE_LIST DriverList OPTIONAL,
|
|
IN ULONG DriverListSize OPTIONAL,
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN PCM_RESOURCE_LIST DeviceList OPTIONAL,
|
|
IN ULONG DeviceListSize OPTIONAL,
|
|
IN BOOLEAN OverrideConflict,
|
|
OUT PBOOLEAN ConflictDetected
|
|
);
|
|
|
|
// begin_wdm
|
|
|
|
//++
|
|
//
|
|
// VOID
|
|
// IoRequestDpc(
|
|
// IN PDEVICE_OBJECT DeviceObject,
|
|
// IN PIRP Irp,
|
|
// IN PVOID Context
|
|
// )
|
|
//
|
|
// Routine Description:
|
|
//
|
|
// This routine is invoked by the device driver's interrupt service routine
|
|
// to request that a DPC routine be queued for later execution at a lower
|
|
// IRQL.
|
|
//
|
|
// Arguments:
|
|
//
|
|
// DeviceObject - Device object for which the request is being processed.
|
|
//
|
|
// Irp - Pointer to the current I/O Request Packet (IRP) for the specified
|
|
// device.
|
|
//
|
|
// Context - Provides a general context parameter to be passed to the
|
|
// DPC routine.
|
|
//
|
|
// Return Value:
|
|
//
|
|
// None.
|
|
//
|
|
//--
|
|
|
|
#define IoRequestDpc( DeviceObject, Irp, Context ) ( \
|
|
KeInsertQueueDpc( &(DeviceObject)->Dpc, (Irp), (Context) ) )
|
|
|
|
//++
|
|
//
|
|
// PDRIVER_CANCEL
|
|
// IoSetCancelRoutine(
|
|
// IN PIRP Irp,
|
|
// IN PDRIVER_CANCEL CancelRoutine
|
|
// )
|
|
//
|
|
// Routine Description:
|
|
//
|
|
// This routine is invoked to set the address of a cancel routine which
|
|
// is to be invoked when an I/O packet has been canceled.
|
|
//
|
|
// Arguments:
|
|
//
|
|
// Irp - Pointer to the I/O Request Packet itself.
|
|
//
|
|
// CancelRoutine - Address of the cancel routine that is to be invoked
|
|
// if the IRP is cancelled.
|
|
//
|
|
// Return Value:
|
|
//
|
|
// Previous value of CancelRoutine field in the IRP.
|
|
//
|
|
//--
|
|
|
|
#define IoSetCancelRoutine( Irp, NewCancelRoutine ) ( \
|
|
(PDRIVER_CANCEL) InterlockedExchangePointer( (PVOID *) &(Irp)->CancelRoutine, (PVOID) (NewCancelRoutine) ) )
|
|
|
|
//++
|
|
//
|
|
// VOID
|
|
// IoSetCompletionRoutine(
|
|
// IN PIRP Irp,
|
|
// IN PIO_COMPLETION_ROUTINE CompletionRoutine,
|
|
// IN PVOID Context,
|
|
// IN BOOLEAN InvokeOnSuccess,
|
|
// IN BOOLEAN InvokeOnError,
|
|
// IN BOOLEAN InvokeOnCancel
|
|
// )
|
|
//
|
|
// Routine Description:
|
|
//
|
|
// This routine is invoked to set the address of a completion routine which
|
|
// is to be invoked when an I/O packet has been completed by a lower-level
|
|
// driver.
|
|
//
|
|
// Arguments:
|
|
//
|
|
// Irp - Pointer to the I/O Request Packet itself.
|
|
//
|
|
// CompletionRoutine - Address of the completion routine that is to be
|
|
// invoked once the next level driver completes the packet.
|
|
//
|
|
// Context - Specifies a context parameter to be passed to the completion
|
|
// routine.
|
|
//
|
|
// InvokeOnSuccess - Specifies that the completion routine is invoked when the
|
|
// operation is successfully completed.
|
|
//
|
|
// InvokeOnError - Specifies that the completion routine is invoked when the
|
|
// operation completes with an error status.
|
|
//
|
|
// InvokeOnCancel - Specifies that the completion routine is invoked when the
|
|
// operation is being canceled.
|
|
//
|
|
// Return Value:
|
|
//
|
|
// None.
|
|
//
|
|
//--
|
|
|
|
#define IoSetCompletionRoutine( Irp, Routine, CompletionContext, Success, Error, Cancel ) { \
|
|
PIO_STACK_LOCATION __irpSp; \
|
|
ASSERT( (Success) | (Error) | (Cancel) ? (Routine) != NULL : TRUE ); \
|
|
__irpSp = IoGetNextIrpStackLocation( (Irp) ); \
|
|
__irpSp->CompletionRoutine = (Routine); \
|
|
__irpSp->Context = (CompletionContext); \
|
|
__irpSp->Control = 0; \
|
|
if ((Success)) { __irpSp->Control = SL_INVOKE_ON_SUCCESS; } \
|
|
if ((Error)) { __irpSp->Control |= SL_INVOKE_ON_ERROR; } \
|
|
if ((Cancel)) { __irpSp->Control |= SL_INVOKE_ON_CANCEL; } }
|
|
|
|
NTSTATUS
|
|
IoSetCompletionRoutineEx(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN PIRP Irp,
|
|
IN PIO_COMPLETION_ROUTINE CompletionRoutine,
|
|
IN PVOID Context,
|
|
IN BOOLEAN InvokeOnSuccess,
|
|
IN BOOLEAN InvokeOnError,
|
|
IN BOOLEAN InvokeOnCancel
|
|
);
|
|
|
|
|
|
// end_ntddk end_wdm end_nthal end_ntosp
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoSetDeviceToVerify(
|
|
IN PETHREAD Thread,
|
|
IN PDEVICE_OBJECT DeviceObject
|
|
);
|
|
|
|
// begin_ntddk begin_nthal begin_ntosp
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoSetHardErrorOrVerifyDevice(
|
|
IN PIRP Irp,
|
|
IN PDEVICE_OBJECT DeviceObject
|
|
);
|
|
|
|
// end_ntddk end_nthal
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoSetInformation(
|
|
IN PFILE_OBJECT FileObject,
|
|
IN FILE_INFORMATION_CLASS FileInformationClass,
|
|
IN ULONG Length,
|
|
IN PVOID FileInformation
|
|
);
|
|
|
|
// end_ntosp
|
|
|
|
// begin_ntddk begin_wdm begin_nthal begin_ntosp
|
|
|
|
//++
|
|
//
|
|
// VOID
|
|
// IoSetNextIrpStackLocation (
|
|
// IN OUT PIRP Irp
|
|
// )
|
|
//
|
|
// Routine Description:
|
|
//
|
|
// This routine is invoked to set the current IRP stack location to
|
|
// the next stack location, i.e. it "pushes" the stack.
|
|
//
|
|
// Arguments:
|
|
//
|
|
// Irp - Pointer to the I/O Request Packet (IRP).
|
|
//
|
|
// Return Value:
|
|
//
|
|
// None.
|
|
//
|
|
//--
|
|
|
|
#define IoSetNextIrpStackLocation( Irp ) { \
|
|
(Irp)->CurrentLocation--; \
|
|
(Irp)->Tail.Overlay.CurrentStackLocation--; }
|
|
|
|
//++
|
|
//
|
|
// VOID
|
|
// IoCopyCurrentIrpStackLocationToNext(
|
|
// IN PIRP Irp
|
|
// )
|
|
//
|
|
// Routine Description:
|
|
//
|
|
// This routine is invoked to copy the IRP stack arguments and file
|
|
// pointer from the current IrpStackLocation to the next
|
|
// in an I/O Request Packet (IRP).
|
|
//
|
|
// If the caller wants to call IoCallDriver with a completion routine
|
|
// but does not wish to change the arguments otherwise,
|
|
// the caller first calls IoCopyCurrentIrpStackLocationToNext,
|
|
// then IoSetCompletionRoutine, then IoCallDriver.
|
|
//
|
|
// Arguments:
|
|
//
|
|
// Irp - Pointer to the I/O Request Packet.
|
|
//
|
|
// Return Value:
|
|
//
|
|
// None.
|
|
//
|
|
//--
|
|
|
|
#define IoCopyCurrentIrpStackLocationToNext( Irp ) { \
|
|
PIO_STACK_LOCATION __irpSp; \
|
|
PIO_STACK_LOCATION __nextIrpSp; \
|
|
__irpSp = IoGetCurrentIrpStackLocation( (Irp) ); \
|
|
__nextIrpSp = IoGetNextIrpStackLocation( (Irp) ); \
|
|
RtlCopyMemory( __nextIrpSp, __irpSp, FIELD_OFFSET(IO_STACK_LOCATION, CompletionRoutine)); \
|
|
__nextIrpSp->Control = 0; }
|
|
|
|
//++
|
|
//
|
|
// VOID
|
|
// IoSkipCurrentIrpStackLocation (
|
|
// IN PIRP Irp
|
|
// )
|
|
//
|
|
// Routine Description:
|
|
//
|
|
// This routine is invoked to increment the current stack location of
|
|
// a given IRP.
|
|
//
|
|
// If the caller wishes to call the next driver in a stack, and does not
|
|
// wish to change the arguments, nor does he wish to set a completion
|
|
// routine, then the caller first calls IoSkipCurrentIrpStackLocation
|
|
// and the calls IoCallDriver.
|
|
//
|
|
// Arguments:
|
|
//
|
|
// Irp - Pointer to the I/O Request Packet.
|
|
//
|
|
// Return Value:
|
|
//
|
|
// None
|
|
//
|
|
//--
|
|
|
|
#define IoSkipCurrentIrpStackLocation( Irp ) { \
|
|
(Irp)->CurrentLocation++; \
|
|
(Irp)->Tail.Overlay.CurrentStackLocation++; }
|
|
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoSetShareAccess(
|
|
IN ACCESS_MASK DesiredAccess,
|
|
IN ULONG DesiredShareAccess,
|
|
IN OUT PFILE_OBJECT FileObject,
|
|
OUT PSHARE_ACCESS ShareAccess
|
|
);
|
|
|
|
// end_ntddk end_wdm end_nthal end_ntosp
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoSetTopLevelIrp(
|
|
IN PIRP Irp
|
|
);
|
|
|
|
// end_ntifs
|
|
|
|
// begin_ntddk begin_wdm begin_ntosp
|
|
|
|
|
|
typedef struct _IO_REMOVE_LOCK_TRACKING_BLOCK * PIO_REMOVE_LOCK_TRACKING_BLOCK;
|
|
|
|
typedef struct _IO_REMOVE_LOCK_COMMON_BLOCK {
|
|
BOOLEAN Removed;
|
|
BOOLEAN Reserved [3];
|
|
LONG IoCount;
|
|
KEVENT RemoveEvent;
|
|
|
|
} IO_REMOVE_LOCK_COMMON_BLOCK;
|
|
|
|
typedef struct _IO_REMOVE_LOCK_DBG_BLOCK {
|
|
LONG Signature;
|
|
LONG HighWatermark;
|
|
LONGLONG MaxLockedTicks;
|
|
LONG AllocateTag;
|
|
LIST_ENTRY LockList;
|
|
KSPIN_LOCK Spin;
|
|
LONG LowMemoryCount;
|
|
ULONG Reserved1[4];
|
|
PVOID Reserved2;
|
|
PIO_REMOVE_LOCK_TRACKING_BLOCK Blocks;
|
|
} IO_REMOVE_LOCK_DBG_BLOCK;
|
|
|
|
typedef struct _IO_REMOVE_LOCK {
|
|
IO_REMOVE_LOCK_COMMON_BLOCK Common;
|
|
#if DBG
|
|
IO_REMOVE_LOCK_DBG_BLOCK Dbg;
|
|
#endif
|
|
} IO_REMOVE_LOCK, *PIO_REMOVE_LOCK;
|
|
|
|
#define IoInitializeRemoveLock(Lock, Tag, Maxmin, HighWater) \
|
|
IoInitializeRemoveLockEx (Lock, Tag, Maxmin, HighWater, sizeof (IO_REMOVE_LOCK))
|
|
|
|
NTSYSAPI
|
|
VOID
|
|
NTAPI
|
|
IoInitializeRemoveLockEx(
|
|
IN PIO_REMOVE_LOCK Lock,
|
|
IN ULONG AllocateTag, // Used only on checked kernels
|
|
IN ULONG MaxLockedMinutes, // Used only on checked kernels
|
|
IN ULONG HighWatermark, // Used only on checked kernels
|
|
IN ULONG RemlockSize // are we checked or free
|
|
);
|
|
//
|
|
// Initialize a remove lock.
|
|
//
|
|
// Note: Allocation for remove locks needs to be within the device extension,
|
|
// so that the memory for this structure stays allocated until such time as the
|
|
// device object itself is deallocated.
|
|
//
|
|
|
|
#define IoAcquireRemoveLock(RemoveLock, Tag) \
|
|
IoAcquireRemoveLockEx(RemoveLock, Tag, __FILE__, __LINE__, sizeof (IO_REMOVE_LOCK))
|
|
|
|
NTSYSAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
IoAcquireRemoveLockEx (
|
|
IN PIO_REMOVE_LOCK RemoveLock,
|
|
IN OPTIONAL PVOID Tag, // Optional
|
|
IN PCSTR File,
|
|
IN ULONG Line,
|
|
IN ULONG RemlockSize // are we checked or free
|
|
);
|
|
|
|
//
|
|
// Routine Description:
|
|
//
|
|
// This routine is called to acquire the remove lock for a device object.
|
|
// While the lock is held, the caller can assume that no pending pnp REMOVE
|
|
// requests will be completed.
|
|
//
|
|
// The lock should be acquired immediately upon entering a dispatch routine.
|
|
// It should also be acquired before creating any new reference to the
|
|
// device object if there's a chance of releasing the reference before the
|
|
// new one is done, in addition to references to the driver code itself,
|
|
// which is removed from memory when the last device object goes.
|
|
//
|
|
// Arguments:
|
|
//
|
|
// RemoveLock - A pointer to an initialized REMOVE_LOCK structure.
|
|
//
|
|
// Tag - Used for tracking lock allocation and release. The same tag
|
|
// specified when acquiring the lock must be used to release the lock.
|
|
// Tags are only checked in checked versions of the driver.
|
|
//
|
|
// File - set to __FILE__ as the location in the code where the lock was taken.
|
|
//
|
|
// Line - set to __LINE__.
|
|
//
|
|
// Return Value:
|
|
//
|
|
// Returns whether or not the remove lock was obtained.
|
|
// If successful the caller should continue with work calling
|
|
// IoReleaseRemoveLock when finished.
|
|
//
|
|
// If not successful the lock was not obtained. The caller should abort the
|
|
// work but not call IoReleaseRemoveLock.
|
|
//
|
|
|
|
#define IoReleaseRemoveLock(RemoveLock, Tag) \
|
|
IoReleaseRemoveLockEx(RemoveLock, Tag, sizeof (IO_REMOVE_LOCK))
|
|
|
|
NTSYSAPI
|
|
VOID
|
|
NTAPI
|
|
IoReleaseRemoveLockEx(
|
|
IN PIO_REMOVE_LOCK RemoveLock,
|
|
IN PVOID Tag, // Optional
|
|
IN ULONG RemlockSize // are we checked or free
|
|
);
|
|
//
|
|
//
|
|
// Routine Description:
|
|
//
|
|
// This routine is called to release the remove lock on the device object. It
|
|
// must be called when finished using a previously locked reference to the
|
|
// device object. If an Tag was specified when acquiring the lock then the
|
|
// same Tag must be specified when releasing the lock.
|
|
//
|
|
// When the lock count reduces to zero, this routine will signal the waiting
|
|
// event to release the waiting thread deleting the device object protected
|
|
// by this lock.
|
|
//
|
|
// Arguments:
|
|
//
|
|
// DeviceObject - the device object to lock
|
|
//
|
|
// Tag - The TAG (if any) specified when acquiring the lock. This is used
|
|
// for lock tracking purposes
|
|
//
|
|
// Return Value:
|
|
//
|
|
// none
|
|
//
|
|
|
|
#define IoReleaseRemoveLockAndWait(RemoveLock, Tag) \
|
|
IoReleaseRemoveLockAndWaitEx(RemoveLock, Tag, sizeof (IO_REMOVE_LOCK))
|
|
|
|
NTSYSAPI
|
|
VOID
|
|
NTAPI
|
|
IoReleaseRemoveLockAndWaitEx(
|
|
IN PIO_REMOVE_LOCK RemoveLock,
|
|
IN PVOID Tag,
|
|
IN ULONG RemlockSize // are we checked or free
|
|
);
|
|
//
|
|
//
|
|
// Routine Description:
|
|
//
|
|
// This routine is called when the client would like to delete the
|
|
// remove-locked resource. This routine will block until all the remove
|
|
// locks have released.
|
|
//
|
|
// This routine MUST be called after acquiring the lock.
|
|
//
|
|
// Arguments:
|
|
//
|
|
// RemoveLock
|
|
//
|
|
// Return Value:
|
|
//
|
|
// none
|
|
//
|
|
|
|
// end_ntddk end_wdm end_ntosp
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoShutdownSystem(
|
|
IN ULONG Phase
|
|
);
|
|
|
|
// begin_ntddk begin_wdm begin_nthal begin_ntifs begin_ntosp
|
|
|
|
//++
|
|
//
|
|
// USHORT
|
|
// IoSizeOfIrp(
|
|
// IN CCHAR StackSize
|
|
// )
|
|
//
|
|
// Routine Description:
|
|
//
|
|
// Determines the size of an IRP given the number of stack locations
|
|
// the IRP will have.
|
|
//
|
|
// Arguments:
|
|
//
|
|
// StackSize - Number of stack locations for the IRP.
|
|
//
|
|
// Return Value:
|
|
//
|
|
// Size in bytes of the IRP.
|
|
//
|
|
//--
|
|
|
|
#define IoSizeOfIrp( StackSize ) \
|
|
((USHORT) (sizeof( IRP ) + ((StackSize) * (sizeof( IO_STACK_LOCATION )))))
|
|
|
|
// end_ntifs
|
|
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoStartNextPacket(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN BOOLEAN Cancelable
|
|
);
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoStartNextPacketByKey(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN BOOLEAN Cancelable,
|
|
IN ULONG Key
|
|
);
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoStartPacket(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN PIRP Irp,
|
|
IN PULONG Key OPTIONAL,
|
|
IN PDRIVER_CANCEL CancelFunction OPTIONAL
|
|
);
|
|
|
|
VOID
|
|
IoSetStartIoAttributes(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN BOOLEAN DeferredStartIo,
|
|
IN BOOLEAN NonCancelable
|
|
);
|
|
|
|
// begin_ntifs
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoStartTimer(
|
|
IN PDEVICE_OBJECT DeviceObject
|
|
);
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoStopTimer(
|
|
IN PDEVICE_OBJECT DeviceObject
|
|
);
|
|
|
|
// end_ntddk end_wdm end_nthal end_ntosp
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoSynchronousPageWrite(
|
|
IN PFILE_OBJECT FileObject,
|
|
IN PMDL MemoryDescriptorList,
|
|
IN PLARGE_INTEGER StartingOffset,
|
|
IN PKEVENT Event,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock
|
|
);
|
|
|
|
// begin_ntosp
|
|
|
|
NTKERNELAPI
|
|
PEPROCESS
|
|
IoThreadToProcess(
|
|
IN PETHREAD Thread
|
|
);
|
|
|
|
// end_ntosp
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoUnregisterFileSystem(
|
|
IN OUT PDEVICE_OBJECT DeviceObject
|
|
);
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoUnregisterFsRegistrationChange(
|
|
IN PDRIVER_OBJECT DriverObject,
|
|
IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine
|
|
);
|
|
|
|
// begin_ntddk begin_wdm begin_nthal begin_ntosp
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoUnregisterShutdownNotification(
|
|
IN PDEVICE_OBJECT DeviceObject
|
|
);
|
|
|
|
// end_wdm
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoUpdateShareAccess(
|
|
IN PFILE_OBJECT FileObject,
|
|
IN OUT PSHARE_ACCESS ShareAccess
|
|
);
|
|
|
|
// end_ntddk end_nthal
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoVerifyVolume(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN BOOLEAN AllowRawMount
|
|
);
|
|
|
|
|
|
NTKERNELAPI // ntddk wdm nthal
|
|
VOID // ntddk wdm nthal
|
|
IoWriteErrorLogEntry( // ntddk wdm nthal
|
|
IN PVOID ElEntry // ntddk wdm nthal
|
|
); // ntddk wdm nthal
|
|
|
|
// end_ntifs end_ntosp
|
|
|
|
|
|
typedef BOOLEAN (*PIO_TRAVERSE_WORKER)(
|
|
IN ULONG Level,
|
|
IN PVOID DeviceNode,
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN PVOID Context
|
|
);
|
|
|
|
typedef BOOLEAN (*PIO_LEVEL_END_WORKER)(
|
|
IN ULONG Level,
|
|
IN PVOID Context
|
|
);
|
|
|
|
//
|
|
// Used by PO to traverse DevNode tree
|
|
//
|
|
|
|
VOID
|
|
IoTraverseDeviceTree(
|
|
IN BOOLEAN Inverted,
|
|
IN LONG CurrentLevel,
|
|
IN PIO_TRAVERSE_WORKER WorkerFunction,
|
|
IN PIO_LEVEL_END_WORKER LevelEndFunction,
|
|
IN PVOID Context
|
|
);
|
|
|
|
// begin_nthal begin_ntosp
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoCreateDriver (
|
|
IN PUNICODE_STRING DriverName, OPTIONAL
|
|
IN PDRIVER_INITIALIZE InitializationFunction
|
|
);
|
|
|
|
NTKERNELAPI
|
|
VOID
|
|
IoDeleteDriver (
|
|
IN PDRIVER_OBJECT DriverObject
|
|
);
|
|
|
|
// end_nthal end_ntosp
|
|
|
|
#define _WMIKM_
|
|
|
|
//
|
|
// This defines the codes used to define what a request must do
|
|
//
|
|
|
|
typedef enum tagWMIACTIONCODE
|
|
{
|
|
WmiGetAllData = IRP_MN_QUERY_ALL_DATA,
|
|
WmiGetSingleInstance = IRP_MN_QUERY_SINGLE_INSTANCE,
|
|
WmiChangeSingleInstance = IRP_MN_CHANGE_SINGLE_INSTANCE,
|
|
WmiChangeSingleItem = IRP_MN_CHANGE_SINGLE_ITEM,
|
|
WmiEnableEvents = IRP_MN_ENABLE_EVENTS,
|
|
WmiDisableEvents = IRP_MN_DISABLE_EVENTS,
|
|
WmiEnableCollection = IRP_MN_ENABLE_COLLECTION,
|
|
WmiDisableCollection = IRP_MN_DISABLE_COLLECTION,
|
|
WmiRegisterInfo = IRP_MN_REGINFO,
|
|
WmiExecuteMethodCall = IRP_MN_EXECUTE_METHOD
|
|
} WMIACTIONCODE;
|
|
|
|
|
|
//
|
|
// This is the prototype for the callback WMI will make to a data provider
|
|
//
|
|
|
|
typedef NTSTATUS (*WMIENTRY)(
|
|
IN WMIACTIONCODE ActionCode,
|
|
IN PVOID DataPath,
|
|
IN ULONG BufferSize,
|
|
IN OUT PVOID Buffer,
|
|
IN PVOID Context,
|
|
OUT PULONG Size
|
|
);
|
|
|
|
#define WMIREG_FLAG_CALLBACK 0x80000000
|
|
// begin_wmikm
|
|
//
|
|
// The following is set for a KM provider who is considered private to
|
|
// kernel tracing
|
|
//
|
|
#define WMIREG_FLAG_TRACE_PROVIDER 0x00010000
|
|
|
|
//
|
|
// The following mask is to extract the trace callout class
|
|
//
|
|
#define WMIREG_FLAG_TRACE_NOTIFY_MASK 0x00F00000
|
|
|
|
//
|
|
// We use 4 bits for the trace callout classes.
|
|
//
|
|
#define WMIREG_NOTIFY_DISK_IO 1 << 20
|
|
#define WMIREG_NOTIFY_TDI_IO 2 << 20
|
|
|
|
// end_wmikm
|
|
|
|
// begin_ntddk begin_wdm begin_ntifs begin_ntosp begin_ntosp
|
|
|
|
typedef struct _IO_WORKITEM *PIO_WORKITEM;
|
|
|
|
typedef
|
|
VOID
|
|
(*PIO_WORKITEM_ROUTINE) (
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN PVOID Context
|
|
);
|
|
|
|
PIO_WORKITEM
|
|
IoAllocateWorkItem(
|
|
PDEVICE_OBJECT DeviceObject
|
|
);
|
|
|
|
VOID
|
|
IoFreeWorkItem(
|
|
PIO_WORKITEM IoWorkItem
|
|
);
|
|
|
|
VOID
|
|
IoQueueWorkItem(
|
|
IN PIO_WORKITEM IoWorkItem,
|
|
IN PIO_WORKITEM_ROUTINE WorkerRoutine,
|
|
IN WORK_QUEUE_TYPE QueueType,
|
|
IN PVOID Context
|
|
);
|
|
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoWMIRegistrationControl(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN ULONG Action
|
|
);
|
|
|
|
//
|
|
// Action code for IoWMIRegistrationControl api
|
|
//
|
|
|
|
#define WMIREG_ACTION_REGISTER 1
|
|
#define WMIREG_ACTION_DEREGISTER 2
|
|
#define WMIREG_ACTION_REREGISTER 3
|
|
#define WMIREG_ACTION_UPDATE_GUIDS 4
|
|
#define WMIREG_ACTION_BLOCK_IRPS 5
|
|
|
|
//
|
|
// Code passed in IRP_MN_REGINFO WMI irp
|
|
//
|
|
|
|
#define WMIREGISTER 0
|
|
#define WMIUPDATE 1
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoWMIAllocateInstanceIds(
|
|
IN GUID *Guid,
|
|
IN ULONG InstanceCount,
|
|
OUT ULONG *FirstInstanceId
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoWMISuggestInstanceName(
|
|
IN PDEVICE_OBJECT PhysicalDeviceObject OPTIONAL,
|
|
IN PUNICODE_STRING SymbolicLinkName OPTIONAL,
|
|
IN BOOLEAN CombineNames,
|
|
OUT PUNICODE_STRING SuggestedInstanceName
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoWMIWriteEvent(
|
|
IN PVOID WnodeEventItem
|
|
);
|
|
|
|
#if defined(_WIN64)
|
|
NTKERNELAPI
|
|
ULONG IoWMIDeviceObjectToProviderId(
|
|
PDEVICE_OBJECT DeviceObject
|
|
);
|
|
#else
|
|
#define IoWMIDeviceObjectToProviderId(DeviceObject) ((ULONG)(DeviceObject))
|
|
#endif
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS IoWMIOpenBlock(
|
|
IN GUID *DataBlockGuid,
|
|
IN ULONG DesiredAccess,
|
|
OUT PVOID *DataBlockObject
|
|
);
|
|
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS IoWMIQueryAllData(
|
|
IN PVOID DataBlockObject,
|
|
IN OUT ULONG *InOutBufferSize,
|
|
OUT /* non paged */ PVOID OutBuffer
|
|
);
|
|
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoWMIQueryAllDataMultiple(
|
|
IN PVOID *DataBlockObjectList,
|
|
IN ULONG ObjectCount,
|
|
IN OUT ULONG *InOutBufferSize,
|
|
OUT /* non paged */ PVOID OutBuffer
|
|
);
|
|
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoWMIQuerySingleInstance(
|
|
IN PVOID DataBlockObject,
|
|
IN PUNICODE_STRING InstanceName,
|
|
IN OUT ULONG *InOutBufferSize,
|
|
OUT /* non paged */ PVOID OutBuffer
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoWMIQuerySingleInstanceMultiple(
|
|
IN PVOID *DataBlockObjectList,
|
|
IN PUNICODE_STRING InstanceNames,
|
|
IN ULONG ObjectCount,
|
|
IN OUT ULONG *InOutBufferSize,
|
|
OUT /* non paged */ PVOID OutBuffer
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoWMISetSingleInstance(
|
|
IN PVOID DataBlockObject,
|
|
IN PUNICODE_STRING InstanceName,
|
|
IN ULONG Version,
|
|
IN ULONG ValueBufferSize,
|
|
IN PVOID ValueBuffer
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoWMISetSingleItem(
|
|
IN PVOID DataBlockObject,
|
|
IN PUNICODE_STRING InstanceName,
|
|
IN ULONG DataItemId,
|
|
IN ULONG Version,
|
|
IN ULONG ValueBufferSize,
|
|
IN PVOID ValueBuffer
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoWMIExecuteMethod(
|
|
IN PVOID DataBlockObject,
|
|
IN PUNICODE_STRING InstanceName,
|
|
IN ULONG MethodId,
|
|
IN ULONG InBufferSize,
|
|
IN OUT PULONG OutBufferSize,
|
|
IN OUT PUCHAR InOutBuffer
|
|
);
|
|
|
|
|
|
|
|
typedef VOID (*WMI_NOTIFICATION_CALLBACK)(
|
|
PVOID Wnode,
|
|
PVOID Context
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoWMISetNotificationCallback(
|
|
IN PVOID Object,
|
|
IN WMI_NOTIFICATION_CALLBACK Callback,
|
|
IN PVOID Context
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoWMIHandleToInstanceName(
|
|
IN PVOID DataBlockObject,
|
|
IN HANDLE FileHandle,
|
|
OUT PUNICODE_STRING InstanceName
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoWMIDeviceObjectToInstanceName(
|
|
IN PVOID DataBlockObject,
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
OUT PUNICODE_STRING InstanceName
|
|
);
|
|
|
|
// end_ntddk end_wdm end_ntifs end_ntosp
|
|
|
|
|
|
|
|
NTKERNELAPI
|
|
BOOLEAN
|
|
WMIInitialize(
|
|
ULONG Phase,
|
|
PVOID LoaderBlock
|
|
);
|
|
|
|
//
|
|
// IoRemoteBootClient indicates whether the system was booted as a remote
|
|
// boot client.
|
|
//
|
|
|
|
extern BOOLEAN IoRemoteBootClient;
|
|
#if defined(REMOTE_BOOT)
|
|
extern BOOLEAN IoCscInitializationFailed;
|
|
#endif // defined(REMOTE_BOOT)
|
|
|
|
// Used to convert a handle to a device stack.
|
|
NTSTATUS
|
|
IoGetRelatedTargetDevice(
|
|
IN PFILE_OBJECT FileObject,
|
|
OUT PDEVICE_OBJECT *DeviceObject
|
|
);
|
|
|
|
// begin_ntosp
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoSetIoCompletion (
|
|
IN PVOID IoCompletion,
|
|
IN PVOID KeyContext,
|
|
IN PVOID ApcContext,
|
|
IN NTSTATUS IoStatus,
|
|
IN ULONG_PTR IoStatusInformation,
|
|
IN BOOLEAN Quota
|
|
);
|
|
|
|
|
|
// end_ntosp
|
|
|
|
//
|
|
// Safeboot definitions - placeholder until a home can be found.
|
|
//
|
|
|
|
typedef struct _BOOT_LOG_RECORD {
|
|
UNICODE_STRING LoadedString;
|
|
UNICODE_STRING NotLoadedString;
|
|
UNICODE_STRING LogFileName;
|
|
UNICODE_STRING HeaderString;
|
|
ERESOURCE Resource;
|
|
ULONG NextKey;
|
|
BOOLEAN FileLogging;
|
|
} BOOT_LOG_RECORD, *PBOOT_LOG_RECORD;
|
|
|
|
VOID
|
|
IopCopyBootLogRegistryToFile(
|
|
VOID
|
|
);
|
|
|
|
VOID
|
|
IopInitializeBootLogging(
|
|
PLOADER_PARAMETER_BLOCK LoaderBlock,
|
|
PCHAR HeaderString
|
|
);
|
|
|
|
VOID
|
|
IopBootLog(
|
|
PUNICODE_STRING LogEntry,
|
|
BOOLEAN Loaded
|
|
);
|
|
|
|
NTSTATUS
|
|
IopSetRegistryStringValue(
|
|
IN HANDLE KeyHandle,
|
|
IN PUNICODE_STRING ValueName,
|
|
IN PUNICODE_STRING ValueData
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoGetRequestorSessionId(
|
|
IN PIRP Irp,
|
|
OUT PULONG pSessionId
|
|
);
|
|
|
|
NTSTATUS
|
|
IoShutdownPnpDevices(
|
|
VOID
|
|
);
|
|
|
|
|
|
VOID
|
|
IovFreeIrp(
|
|
IN PIRP Irp
|
|
);
|
|
|
|
PIRP
|
|
IovAllocateIrp(
|
|
IN CCHAR StackSize,
|
|
IN BOOLEAN ChargeQuota
|
|
);
|
|
|
|
VOID
|
|
IoVerifierInit(
|
|
IN ULONG VerifierFlags
|
|
);
|
|
|
|
NTSTATUS
|
|
FASTCALL
|
|
IovCallDriver(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN OUT PIRP Irp
|
|
);
|
|
|
|
VOID
|
|
FASTCALL
|
|
IovCompleteRequest(
|
|
IN PIRP Irp,
|
|
IN CCHAR PriorityBoost
|
|
);
|
|
|
|
PIRP
|
|
IovBuildAsynchronousFsdRequest(
|
|
IN ULONG MajorFunction,
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN OUT PVOID Buffer OPTIONAL,
|
|
IN ULONG Length OPTIONAL,
|
|
IN PLARGE_INTEGER StartingOffset OPTIONAL,
|
|
IN PIO_STATUS_BLOCK IoStatusBlock OPTIONAL
|
|
);
|
|
|
|
|
|
PIRP
|
|
IovBuildDeviceIoControlRequest(
|
|
IN ULONG IoControlCode,
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN PVOID InputBuffer OPTIONAL,
|
|
IN ULONG InputBufferLength,
|
|
OUT PVOID OutputBuffer OPTIONAL,
|
|
IN ULONG OutputBufferLength,
|
|
IN BOOLEAN InternalDeviceIoControl,
|
|
IN PKEVENT Event,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock
|
|
);
|
|
|
|
NTSTATUS
|
|
IovInitializeTimer(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN PIO_TIMER_ROUTINE TimerRoutine,
|
|
IN PVOID Context
|
|
);
|
|
|
|
|
|
NTKERNELAPI
|
|
PVOID
|
|
IoAllocateGenericErrorLogEntry(
|
|
IN UCHAR EntrySize
|
|
);
|
|
|
|
VOID
|
|
IoRetryIrpCompletions(
|
|
VOID
|
|
);
|
|
|
|
// begin_ntddk begin_wdm begin_ntifs begin_ntosp
|
|
#if defined(_WIN64)
|
|
BOOLEAN
|
|
IoIs32bitProcess(
|
|
IN PIRP Irp
|
|
);
|
|
#endif
|
|
// end_ntddk end_wdm end_ntifs end_ntosp
|
|
|
|
// begin_ntosp
|
|
NTKERNELAPI
|
|
VOID
|
|
FASTCALL
|
|
IoAssignDriveLetters(
|
|
PLOADER_PARAMETER_BLOCK LoaderBlock,
|
|
PSTRING NtDeviceName,
|
|
OUT PUCHAR NtSystemPath,
|
|
OUT PSTRING NtSystemPathString
|
|
);
|
|
// end_ntosp
|
|
|
|
|
|
// begin_ntddk
|
|
NTKERNELAPI
|
|
VOID
|
|
FASTCALL
|
|
HalExamineMBR(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN ULONG SectorSize,
|
|
IN ULONG MBRTypeIdentifier,
|
|
OUT PVOID *Buffer
|
|
);
|
|
|
|
DECLSPEC_DEPRECATED_DDK // Use IoReadPartitionTableEx
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
FASTCALL
|
|
IoReadPartitionTable(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN ULONG SectorSize,
|
|
IN BOOLEAN ReturnRecognizedPartitions,
|
|
OUT struct _DRIVE_LAYOUT_INFORMATION **PartitionBuffer
|
|
);
|
|
|
|
DECLSPEC_DEPRECATED_DDK // Use IoSetPartitionInformationEx
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
FASTCALL
|
|
IoSetPartitionInformation(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN ULONG SectorSize,
|
|
IN ULONG PartitionNumber,
|
|
IN ULONG PartitionType
|
|
);
|
|
|
|
// begin_ntosp
|
|
DECLSPEC_DEPRECATED_DDK // Use IoWritePartitionTableEx
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
FASTCALL
|
|
IoWritePartitionTable(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN ULONG SectorSize,
|
|
IN ULONG SectorsPerTrack,
|
|
IN ULONG NumberOfHeads,
|
|
IN struct _DRIVE_LAYOUT_INFORMATION *PartitionBuffer
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoCreateDisk(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN struct _CREATE_DISK* Disk
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoReadPartitionTableEx(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN struct _DRIVE_LAYOUT_INFORMATION_EX** DriveLayout
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoWritePartitionTableEx(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN struct _DRIVE_LAYOUT_INFORMATION_EX* DriveLayout
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoSetPartitionInformationEx(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN ULONG PartitionNumber,
|
|
IN struct _SET_PARTITION_INFORMATION_EX* PartitionInfo
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoUpdateDiskGeometry(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN struct _DISK_GEOMETRY_EX* OldDiskGeometry,
|
|
IN struct _DISK_GEOMETRY_EX* NewDiskGeometry
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoVerifyPartitionTable(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN BOOLEAN FixErrors
|
|
);
|
|
|
|
typedef struct _DISK_SIGNATURE {
|
|
ULONG PartitionStyle;
|
|
union {
|
|
struct {
|
|
ULONG Signature;
|
|
ULONG CheckSum;
|
|
} Mbr;
|
|
|
|
struct {
|
|
GUID DiskId;
|
|
} Gpt;
|
|
};
|
|
} DISK_SIGNATURE, *PDISK_SIGNATURE;
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoReadDiskSignature(
|
|
IN PDEVICE_OBJECT DeviceObject,
|
|
IN ULONG BytesPerSector,
|
|
OUT PDISK_SIGNATURE Signature
|
|
);
|
|
|
|
// end_ntosp
|
|
// end_ntddk
|
|
|
|
// begin_ntosp begin_ntifs begin_ntddk
|
|
|
|
NTSTATUS
|
|
IoVolumeDeviceToDosName(
|
|
IN PVOID VolumeDeviceObject,
|
|
OUT PUNICODE_STRING DosName
|
|
);
|
|
// end_ntosp end_ntifs end_ntddk
|
|
|
|
// begin_ntosp begin_ntifs
|
|
NTSTATUS
|
|
IoEnumerateDeviceObjectList(
|
|
IN PDRIVER_OBJECT DriverObject,
|
|
IN PDEVICE_OBJECT *DeviceObjectList,
|
|
IN ULONG DeviceObjectListSize,
|
|
OUT PULONG ActualNumberDeviceObjects
|
|
);
|
|
|
|
PDEVICE_OBJECT
|
|
IoGetLowerDeviceObject(
|
|
IN PDEVICE_OBJECT DeviceObject
|
|
);
|
|
|
|
PDEVICE_OBJECT
|
|
IoGetDeviceAttachmentBaseRef(
|
|
IN PDEVICE_OBJECT DeviceObject
|
|
);
|
|
|
|
NTSTATUS
|
|
IoGetDiskDeviceObject(
|
|
IN PDEVICE_OBJECT FileSystemDeviceObject,
|
|
OUT PDEVICE_OBJECT *DiskDeviceObject
|
|
);
|
|
|
|
// end_ntosp end_ntifs
|
|
|
|
// begin_ntosp begin_ntifs begin_ntddk
|
|
|
|
NTSTATUS
|
|
IoSetSystemPartition(
|
|
PUNICODE_STRING VolumeNameString
|
|
);
|
|
|
|
// begin_wdm
|
|
VOID
|
|
IoFreeErrorLogEntry(
|
|
PVOID ElEntry
|
|
);
|
|
|
|
// Cancel SAFE API set start
|
|
//
|
|
// The following APIs are to help ease the pain of writing queue packages that
|
|
// handle the cancellation race well. The idea of this set of APIs is to not
|
|
// force a single queue data structure but allow the cancel logic to be hidden
|
|
// from the drivers. A driver implements a queue and as part of its header
|
|
// includes the IO_CSQ structure. In its initialization routine it calls
|
|
// IoInitializeCsq. Then in the dispatch routine when the driver wants to
|
|
// insert an IRP into the queue it calls IoCsqInsertIrp. When the driver wants
|
|
// to remove something from the queue it calls IoCsqRemoveIrp. Note that Insert
|
|
// can fail if the IRP was cancelled in the meantime. Remove can also fail if
|
|
// the IRP was already cancelled.
|
|
//
|
|
// There are typically two modes where drivers queue IRPs. These two modes are
|
|
// covered by the cancel safe queue API set.
|
|
//
|
|
// Mode 1:
|
|
// One is where the driver queues the IRP and at some later
|
|
// point in time dequeues an IRP and issues the IO request.
|
|
// For this mode the driver should use IoCsqInsertIrp and IoCsqRemoveNextIrp.
|
|
// The driver in this case is expected to pass NULL to the irp context
|
|
// parameter in IoInsertIrp.
|
|
//
|
|
// Mode 2:
|
|
// In this the driver queues theIRP, issues the IO request (like issuing a DMA
|
|
// request or writing to a register) and when the IO request completes (either
|
|
// using a DPC or timer) the driver dequeues the IRP and completes it. For this
|
|
// mode the driver should use IoCsqInsertIrp and IoCsqRemoveIrp. In this case
|
|
// the driver should allocate an IRP context and pass it in to IoCsqInsertIrp.
|
|
// The cancel API code creates an association between the IRP and the context
|
|
// and thus ensures that when the time comes to remove the IRP it can ascertain
|
|
// correctly.
|
|
//
|
|
// Note that the cancel API set assumes that the field DriverContext[3] is
|
|
// always available for use and that the driver does not use it.
|
|
//
|
|
|
|
|
|
//
|
|
// Bookkeeping structure. This should be opaque to drivers.
|
|
// Drivers typically include this as part of their queue headers.
|
|
// Given a CSQ pointer the driver should be able to get its
|
|
// queue header using CONTAINING_RECORD macro
|
|
//
|
|
|
|
typedef struct _IO_CSQ IO_CSQ, *PIO_CSQ;
|
|
|
|
#define IO_TYPE_CSQ_IRP_CONTEXT 1
|
|
#define IO_TYPE_CSQ 2
|
|
|
|
//
|
|
// IRP context structure. This structure is necessary if the driver is using
|
|
// the second mode.
|
|
//
|
|
|
|
|
|
typedef struct _IO_CSQ_IRP_CONTEXT {
|
|
ULONG Type;
|
|
PIRP Irp;
|
|
PIO_CSQ Csq;
|
|
} IO_CSQ_IRP_CONTEXT, *PIO_CSQ_IRP_CONTEXT;
|
|
|
|
//
|
|
// Routines that insert/remove IRP
|
|
//
|
|
|
|
typedef VOID
|
|
(*PIO_CSQ_INSERT_IRP)(
|
|
IN struct _IO_CSQ *Csq,
|
|
IN PIRP Irp
|
|
);
|
|
|
|
typedef VOID
|
|
(*PIO_CSQ_REMOVE_IRP)(
|
|
IN PIO_CSQ Csq,
|
|
IN PIRP Irp
|
|
);
|
|
|
|
//
|
|
// Retrieves next entry after Irp from the queue.
|
|
// Returns NULL if there are no entries in the queue.
|
|
// If Irp is NUL, returns the entry in the head of the queue.
|
|
// This routine does not remove the IRP from the queue.
|
|
//
|
|
|
|
|
|
typedef PIRP
|
|
(*PIO_CSQ_PEEK_NEXT_IRP)(
|
|
IN PIO_CSQ Csq,
|
|
IN PIRP Irp,
|
|
IN PVOID PeekContext
|
|
);
|
|
|
|
//
|
|
// Lock routine that protects the cancel safe queue.
|
|
//
|
|
|
|
typedef VOID
|
|
(*PIO_CSQ_ACQUIRE_LOCK)(
|
|
IN PIO_CSQ Csq,
|
|
OUT PKIRQL Irql
|
|
);
|
|
|
|
typedef VOID
|
|
(*PIO_CSQ_RELEASE_LOCK)(
|
|
IN PIO_CSQ Csq,
|
|
IN KIRQL Irql
|
|
);
|
|
|
|
|
|
//
|
|
// Completes the IRP with STATUS_CANCELLED. IRP is guaranteed to be valid
|
|
// In most cases this routine just calls IoCompleteRequest(Irp, STATUS_CANCELLED);
|
|
//
|
|
|
|
typedef VOID
|
|
(*PIO_CSQ_COMPLETE_CANCELED_IRP)(
|
|
IN PIO_CSQ Csq,
|
|
IN PIRP Irp
|
|
);
|
|
|
|
//
|
|
// Bookkeeping structure. This should be opaque to drivers.
|
|
// Drivers typically include this as part of their queue headers.
|
|
// Given a CSQ pointer the driver should be able to get its
|
|
// queue header using CONTAINING_RECORD macro
|
|
//
|
|
|
|
typedef struct _IO_CSQ {
|
|
ULONG Type;
|
|
PIO_CSQ_INSERT_IRP CsqInsertIrp;
|
|
PIO_CSQ_REMOVE_IRP CsqRemoveIrp;
|
|
PIO_CSQ_PEEK_NEXT_IRP CsqPeekNextIrp;
|
|
PIO_CSQ_ACQUIRE_LOCK CsqAcquireLock;
|
|
PIO_CSQ_RELEASE_LOCK CsqReleaseLock;
|
|
PIO_CSQ_COMPLETE_CANCELED_IRP CsqCompleteCanceledIrp;
|
|
PVOID ReservePointer; // Future expansion
|
|
} IO_CSQ, *PIO_CSQ;
|
|
|
|
//
|
|
// Initializes the cancel queue structure.
|
|
//
|
|
|
|
NTSTATUS
|
|
IoCsqInitialize(
|
|
IN PIO_CSQ Csq,
|
|
IN PIO_CSQ_INSERT_IRP CsqInsertIrp,
|
|
IN PIO_CSQ_REMOVE_IRP CsqRemoveIrp,
|
|
IN PIO_CSQ_PEEK_NEXT_IRP CsqPeekNextIrp,
|
|
IN PIO_CSQ_ACQUIRE_LOCK CsqAcquireLock,
|
|
IN PIO_CSQ_RELEASE_LOCK CsqReleaseLock,
|
|
IN PIO_CSQ_COMPLETE_CANCELED_IRP CsqCompleteCanceledIrp
|
|
);
|
|
|
|
|
|
//
|
|
// The caller calls this routine to insert the IRP and return STATUS_PENDING.
|
|
//
|
|
|
|
VOID
|
|
IoCsqInsertIrp(
|
|
IN PIO_CSQ Csq,
|
|
IN PIRP Irp,
|
|
IN PIO_CSQ_IRP_CONTEXT Context
|
|
);
|
|
|
|
//
|
|
// Returns an IRP if one can be found. NULL otherwise.
|
|
//
|
|
|
|
PIRP
|
|
IoCsqRemoveNextIrp(
|
|
IN PIO_CSQ Csq,
|
|
IN PVOID PeekContext
|
|
);
|
|
|
|
//
|
|
// This routine is called from timeout or DPCs.
|
|
// The context is presumably part of the DPC or timer context.
|
|
// If succesfull returns the IRP associated with context.
|
|
//
|
|
|
|
PIRP
|
|
IoCsqRemoveIrp(
|
|
IN PIO_CSQ Csq,
|
|
IN PIO_CSQ_IRP_CONTEXT Context
|
|
);
|
|
|
|
// Cancel SAFE API set end
|
|
|
|
// end_ntosp end_ntifs end_ntddk end_wdm
|
|
|
|
// begin_ntosp begin_ntifs
|
|
|
|
NTSTATUS
|
|
IoCreateFileSpecifyDeviceObjectHint(
|
|
OUT PHANDLE FileHandle,
|
|
IN ACCESS_MASK DesiredAccess,
|
|
IN POBJECT_ATTRIBUTES ObjectAttributes,
|
|
OUT PIO_STATUS_BLOCK IoStatusBlock,
|
|
IN PLARGE_INTEGER AllocationSize OPTIONAL,
|
|
IN ULONG FileAttributes,
|
|
IN ULONG ShareAccess,
|
|
IN ULONG Disposition,
|
|
IN ULONG CreateOptions,
|
|
IN PVOID EaBuffer OPTIONAL,
|
|
IN ULONG EaLength,
|
|
IN CREATE_FILE_TYPE CreateFileType,
|
|
IN PVOID ExtraCreateParameters OPTIONAL,
|
|
IN ULONG Options,
|
|
IN PVOID DeviceObject
|
|
);
|
|
|
|
NTSTATUS
|
|
IoAttachDeviceToDeviceStackSafe(
|
|
IN PDEVICE_OBJECT SourceDevice,
|
|
IN PDEVICE_OBJECT TargetDevice,
|
|
OUT PDEVICE_OBJECT *AttachedToDeviceObject
|
|
);
|
|
|
|
// end_ntosp
|
|
|
|
NTKERNELAPI
|
|
BOOLEAN
|
|
IoIsFileOriginRemote(
|
|
IN PFILE_OBJECT FileObject
|
|
);
|
|
|
|
NTKERNELAPI
|
|
NTSTATUS
|
|
IoSetFileOrigin(
|
|
IN PFILE_OBJECT FileObject,
|
|
IN BOOLEAN Remote
|
|
);
|
|
|
|
// end_ntifs
|
|
|
|
PVOID
|
|
IoGetFileObjectFilterContext(
|
|
IN PFILE_OBJECT FileObject
|
|
);
|
|
|
|
NTSTATUS
|
|
IoChangeFileObjectFilterContext(
|
|
IN PFILE_OBJECT FileObject,
|
|
IN PVOID FilterContext,
|
|
IN BOOLEAN Set
|
|
);
|
|
|
|
BOOLEAN
|
|
IoIsDeviceEjectable(
|
|
IN PDEVICE_OBJECT
|
|
);
|
|
|
|
NTSTATUS
|
|
IoComputeDesiredAccessFileObject(
|
|
IN PFILE_OBJECT FileObject,
|
|
OUT PNTSTATUS DesiredAccess
|
|
);
|
|
|
|
// begin_ntosp begin_ntifs begin_ntddk
|
|
|
|
NTSTATUS
|
|
IoValidateDeviceIoControlAccess(
|
|
IN PIRP Irp,
|
|
IN ULONG RequiredAccess
|
|
);
|
|
// end_ntosp end_ntifs end_ntddk end_wdm
|
|
#endif // _IO_
|