29 #pragma alloc_text(PAGE, FmmOpenMetadata) 30 #pragma alloc_text(PAGE, FmmCloseMetadata) 31 #pragma alloc_text(PAGE, FmmReleaseMetadataFileReferences) 32 #pragma alloc_text(PAGE, FmmReacquireMetadataFileReferences) 33 #pragma alloc_text(PAGE, FmmSetMetadataOpenTriggerFileObject) 34 #pragma alloc_text(PAGE, FmmBeginFileSystemOperation) 35 #pragma alloc_text(PAGE, FmmEndFileSystemOperation) 44 _In_ BOOLEAN CreateIfNotPresent
67 OBJECT_ATTRIBUTES objectAttributes;
68 IO_STATUS_BLOCK ioStatus;
69 UNICODE_STRING fileName;
76 (
"[Fmm]: Opening metadata file ... (Volume = %p, CreateIfNotPresent = %X)\n",
77 InstanceContext->Volume,
78 CreateIfNotPresent) );
80 status = STATUS_SUCCESS;
81 fileName.Buffer =
NULL;
91 #pragma warning(disable:4127) // Conditional expression is constant 96 fileName.MaximumLength = (USHORT)length;
100 if (!NT_SUCCESS( status )) {
102 goto FmmOpenMetadataCleanup;
105 status = FltGetVolumeName( InstanceContext->Volume, &fileName, &length );
107 if (NT_SUCCESS( status )) {
111 if (NT_SUCCESS( status )) {
117 DebugTrace( DEBUG_TRACE_METADATA_OPERATIONS | DEBUG_TRACE_ERROR,
118 (
"[Fmm]: Failed to get volume name (Volume = %p, Status = 0x%x)\n",
119 InstanceContext->Volume,
124 if (status != STATUS_BUFFER_TOO_SMALL) {
126 goto FmmOpenMetadataCleanup;;
144 InitializeObjectAttributes( &objectAttributes,
157 (
"[Fmm]: Calling FltCreateFile for metadata file %wZ (Volume = %p, Status = 0x%x)\n",
159 InstanceContext->Volume,
167 FmmBeginFileSystemOperation( InstanceContext );
170 InstanceContext->Instance,
171 &InstanceContext->MetadataHandle,
175 (PLARGE_INTEGER)
NULL,
176 FILE_ATTRIBUTE_SYSTEM | FILE_ATTRIBUTE_HIDDEN,
178 (CreateIfNotPresent ? FILE_OPEN_IF : FILE_OPEN),
188 FmmEndFileSystemOperation( InstanceContext );
191 if (!NT_SUCCESS( status )) {
193 DebugTrace( DEBUG_TRACE_METADATA_OPERATIONS | DEBUG_TRACE_ERROR,
194 (
"[Fmm]: FltCreateFile failure for metadata file %wZ (Volume = %p, Status = 0x%x)\n",
196 InstanceContext->Volume,
199 if (CreateIfNotPresent && (status == STATUS_OBJECT_PATH_NOT_FOUND)) {
208 (
"[Fmm]: Creating SystemVolumeInformation folder for metadata file %wZ (Volume = %p, Status = 0x%x)\n",
210 InstanceContext->Volume,
218 FmmBeginFileSystemOperation( InstanceContext );
220 status = FltCreateSystemVolumeInformationFolder( InstanceContext->Instance );
226 FmmEndFileSystemOperation( InstanceContext );
230 if (NT_SUCCESS( status )) {
237 goto RetryFltCreateFile;
240 DebugTrace( DEBUG_TRACE_METADATA_OPERATIONS | DEBUG_TRACE_ERROR,
241 (
"[Fmm]: FltCreateSystemVolumeInformationFolder failure for metadata file %wZ (Volume = %p, Status = 0x%x)\n",
243 InstanceContext->Volume,
248 goto FmmOpenMetadataCleanup;
255 status = ObReferenceObjectByHandle( InstanceContext->MetadataHandle,
256 STANDARD_RIGHTS_REQUIRED,
259 &InstanceContext->MetadataFileObject,
261 if (!NT_SUCCESS( status )) {
263 DebugTrace( DEBUG_TRACE_METADATA_OPERATIONS | DEBUG_TRACE_ERROR,
264 (
"[Fmm]: Failure to get file object from handle for metadata file %wZ (Volume = %p, Status = 0x%x)\n",
266 InstanceContext->Volume,
269 goto FmmOpenMetadataCleanup;
272 if (ioStatus.Information == FILE_CREATED) {
279 (
"[Fmm]: Created new metadata file %wZ (Volume = %p, Status = 0x%x)\n",
281 InstanceContext->Volume,
297 (
"[Fmm]: Opened existing metadata file %wZ (Volume = %p, Status = 0x%x)\n",
299 InstanceContext->Volume,
316 FmmOpenMetadataCleanup:
318 if (!NT_SUCCESS( status )) {
320 DebugTrace( DEBUG_TRACE_METADATA_OPERATIONS | DEBUG_TRACE_ERROR,
321 (
"[Fmm]: Failed to open metadata (Volume = %p, Status = 0x%x)\n",
322 InstanceContext->Volume,
329 if (InstanceContext->MetadataHandle) {
336 FmmBeginFileSystemOperation( InstanceContext );
338 FltClose( InstanceContext->MetadataHandle );
344 FmmEndFileSystemOperation( InstanceContext );
346 InstanceContext->MetadataHandle =
NULL;
348 if (InstanceContext->MetadataFileObject) {
350 ObDereferenceObject( InstanceContext->MetadataFileObject );
351 InstanceContext->MetadataFileObject =
NULL;
357 (
"[Fmm]: Metadata successfully opened (Volume = %p)\n",
358 InstanceContext->Volume) );
368 if (fileName.Buffer != NULL) {
407 FLT_ASSERT( InstanceContext->MetadataHandle );
408 FLT_ASSERT( InstanceContext->MetadataFileObject );
411 (
"[Fmm]: Closing metadata file ... (Volume = %p)\n",
412 InstanceContext->Volume ) );
418 ObDereferenceObject( InstanceContext->MetadataFileObject );
420 InstanceContext->MetadataFileObject =
NULL;
427 FmmBeginFileSystemOperation( InstanceContext );
429 FltClose( InstanceContext->MetadataHandle );
435 FmmEndFileSystemOperation( InstanceContext );
438 InstanceContext->MetadataHandle =
NULL;
450 _Inout_ PFLT_CALLBACK_DATA Cbd
478 NTSTATUS status = STATUS_SUCCESS;
487 status = FltGetInstanceContext( Cbd->Iopb->TargetInstance,
489 if (!NT_SUCCESS( status )) {
491 DebugTrace( DEBUG_TRACE_ERROR | DEBUG_TRACE_METADATA_OPERATIONS,
492 (
"[Fmm]: FmmReleaseMetadataFileReferences -> Failed to get instance context.\n") );
494 goto FmmReleaseMetadataFileReferencesCleanup;
517 status = STATUS_FILE_LOCK_CONFLICT;
519 DebugTrace( DEBUG_TRACE_ERROR | DEBUG_TRACE_METADATA_OPERATIONS,
520 (
"[Fmm]: FmmReleaseMetadataFileReferences -> Failed to get exclusive access to instance context since it is in a state of transition.\n") );
530 (
"[Fmm]: FmmReleaseMetadataFileReferences -> Releasing references to metadata handle and file object (InstanceContext = %p VolumeFileObject = %p)\n",
532 Cbd->Iopb->TargetFileObject) );
538 FmmCloseMetadata( instanceContext );
548 (
"[Fmm]: FmmReleaseMetadataFileReferences -> Exit without attempting to release references to metadata handle and file object (InstanceContext = %p, VolumeFileObject = %p, MetadataOpenTriggerFileObject = %p, MetadataAlreadyOpen = 0x%x)\n",
550 Cbd->Iopb->TargetFileObject,
563 FmmReleaseMetadataFileReferencesCleanup:
569 if (instanceContext !=
NULL) {
571 FltReleaseContext( instanceContext );
581 _Inout_ PFLT_CALLBACK_DATA Cbd
611 NTSTATUS status = STATUS_SUCCESS;
620 status = FltGetInstanceContext( Cbd->Iopb->TargetInstance,
622 if (!NT_SUCCESS( status )) {
624 DebugTrace( DEBUG_TRACE_ERROR | DEBUG_TRACE_METADATA_OPERATIONS,
625 (
"[Fmm]: FmmReacquireMetadataFileReferences -> Failed to get instance context.\n") );
627 goto FmmReacquireMetadataFileReferencesCleanup;
650 status = STATUS_FILE_LOCK_CONFLICT;
652 DebugTrace( DEBUG_TRACE_ERROR | DEBUG_TRACE_METADATA_OPERATIONS,
653 (
"[Fmm]: FmmReacquireMetadataFileReferences -> Failed to get exclusive access to instance context since it is in a state of transition.\n") );
671 (
"[Fmm]: FmmReacquireMetadataFileReferences -> Re-acquiring references to metadata handle and file object (InstanceContext = %p, VolumeFileObject = %p)\n",
673 Cbd->Iopb->TargetFileObject) );
675 status = FmmOpenMetadata( instanceContext,
687 (
"[Fmm]: FmmReacquireMetadataFileReferences -> Exit without attempting to re-acquire references to metadata handle and file object (InstanceContext = %p, VolumeFileObject = %p, MetadataOpenTriggerFileObject = %p, MetadataAlreadyOpen = 0x%x)\n",
689 Cbd->Iopb->TargetFileObject,
697 (
"[Fmm]: FmmReacquireMetadataFileReferences -> Exit without attempting to re-acquire references to metadata handle and file object (InstanceContext = %p, VolumeFileObject = %p, MetadataOpenTriggerFileObject = %p, MetadataAlreadyOpen = 0x%x)\n",
699 Cbd->Iopb->TargetFileObject,
712 FmmReacquireMetadataFileReferencesCleanup:
718 if (instanceContext !=
NULL) {
720 FltReleaseContext( instanceContext );
732 _Inout_ PFLT_CALLBACK_DATA Cbd
759 NTSTATUS status = STATUS_SUCCESS;
768 status = FltGetInstanceContext( Cbd->Iopb->TargetInstance,
770 if (!NT_SUCCESS( status )) {
772 DebugTrace( DEBUG_TRACE_ERROR | DEBUG_TRACE_METADATA_OPERATIONS,
773 (
"[Fmm]: FmmSetMetadataOpenTriggerFileObject -> Failed to get instance context.\n") );
775 goto FmmSetMetadataOpenTriggerFileObjectCleanup;
798 status = STATUS_FILE_LOCK_CONFLICT;
800 DebugTrace( DEBUG_TRACE_ERROR | DEBUG_TRACE_METADATA_OPERATIONS,
801 (
"[Fmm]: FmmSetMetadataOpenTriggerFileObject -> Failed to get exclusive access to instance context since it is in a state of transition.\n") );
805 (
"[Fmm]: FmmSetMetadataOpenTriggerFileObject -> Setting MetadataOpenTriggerFileObject to %p (OldValue = %p).\n",
806 Cbd->Iopb->TargetFileObject,
827 FmmSetMetadataOpenTriggerFileObjectCleanup:
833 if (instanceContext !=
NULL) {
835 FltReleaseContext( instanceContext );
848 FmmBeginFileSystemOperation (
898 FmmReleaseResource( &InstanceContext->MetadataResource );
904 _Requires_lock_not_held_(InstanceContext->MetadataResource)
905 _Acquires_exclusive_lock_(InstanceContext->MetadataResource)
909 FmmEndFileSystemOperation (
940 FmmAcquireResourceExclusive( &InstanceContext->MetadataResource );
963 #if VERIFY_METADATA_OPENED 967 _Inout_ PFLT_CALLBACK_DATA Cbd,
968 _Out_ BOOLEAN* MetadataOpen
994 NTSTATUS status = STATUS_SUCCESS;
1002 status = FltGetInstanceContext( Cbd->Iopb->TargetInstance,
1004 if (!NT_SUCCESS( status )) {
1006 DebugTrace( DEBUG_TRACE_ERROR | DEBUG_TRACE_METADATA_OPERATIONS,
1007 (
"[Fmm]: FmmIsMetadataOpen -> Failed to get instance context.\n") );
1009 goto FmmIsMetadataOpenCleanup;
1032 status = STATUS_FILE_LOCK_CONFLICT;
1034 DebugTrace( DEBUG_TRACE_ERROR | DEBUG_TRACE_METADATA_OPERATIONS,
1035 (
"[Fmm]: FmmIsMetadataOpen -> Failed to get exclusive access to instance context since it is in a state of transition.\n") );
1064 FmmIsMetadataOpenCleanup:
1070 if (instanceContext !=
NULL) {
1072 FltReleaseContext( instanceContext );
PFILE_OBJECT MetadataOpenTriggerFileObject
ERESOURCE MetadataResource
#define DebugTrace(Level, Data)
NTSTATUS FmmSetMetadataOpenTriggerFileObject(_Inout_ PFLT_CALLBACK_DATA Cbd)
FLT_ASSERT(IS_MY_CONTROL_DEVICE_OBJECT(DeviceObject))
AV_SCANNER_GLOBAL_DATA Globals
NTSTATUS FmmReacquireMetadataFileReferences(_Inout_ PFLT_CALLBACK_DATA Cbd)
NcLoadRegistryStringRetry NULL
_Acquires_lock_(_Global_critical_region_)
VOID _IRQL_requires_max_(VOID_IRQL_requires_max_(APC_LEVEL) _IRQL_requires_min_() _IRQL_raises_(PASSIVE_LEVEL) _Requires_lock_held_((CONTAINING_RECORD(DataQueue APC_LEVEL)
_Requires_lock_held_(_Global_critical_region_)
NTSTATUS FmmReleaseMetadataFileReferences(_Inout_ PFLT_CALLBACK_DATA Cbd)
_Releases_lock_(_Global_critical_region_)
PFILE_OBJECT MetadataFileObject