111 #include <ntdddisk.h> 118 _Inout_ PFLT_CALLBACK_DATA Data
123 _Inout_ PFLT_CALLBACK_DATA Data,
124 _Out_ LONGLONG *VolumeRevision,
125 _Out_ LONGLONG *CacheRevision,
126 _Out_ LONGLONG *FileRevision
131 _In_ PCFLT_RELATED_OBJECTS FltObjects,
132 _Out_ LONGLONG *VolumeRevision,
133 _Out_ LONGLONG *CacheRevision,
134 _Out_ LONGLONG *FileRevision
139 _Inout_ PFLT_CALLBACK_DATA Data,
140 _In_ LPCGUID EcpGuid,
150 #pragma alloc_text(PAGE, AvIsVolumeOnCsvDisk) 151 #pragma alloc_text(PAGE, AvIsCsvDlEcpPresent) 152 #pragma alloc_text(PAGE, AvPreCreateCsvfs) 153 #pragma alloc_text(PAGE, AvPostCreateCsvfs) 154 #pragma alloc_text(PAGE, AvPreCleanupCsvfs) 155 #pragma alloc_text(PAGE, AvQueryCsvRevisionNumbers) 156 #pragma alloc_text(PAGE, AvReadCsvRevisionECP) 157 #pragma alloc_text(PAGE, AvAddCsvRevisionECP) 158 #pragma alloc_text(PAGE, AvFindAckedECP) 163 _In_ PFLT_VOLUME Volume
182 NTSTATUS status = STATUS_SUCCESS;
183 BOOLEAN retValue = FALSE;
184 PDEVICE_OBJECT disk =
NULL, refDeviceObject=
NULL;
186 IO_STATUS_BLOCK iosb;
187 ULONG controlCode = IOCTL_DISK_GET_CLUSTER_INFO;
188 DISK_CLUSTER_INFO outBuf;
193 status = FltGetDiskDeviceObject(Volume, &disk);
194 if (!NT_SUCCESS(status)) {
196 (
"Failed to get disk object from volume, status 0x%x\n", status) );
200 refDeviceObject = IoGetAttachedDeviceReference(disk);
202 iosb.Information = 0;
203 RtlZeroMemory(&outBuf,
sizeof(outBuf));
204 KeInitializeEvent(&event, NotificationEvent, FALSE);
206 irp = IoBuildDeviceIoControlRequest( controlCode,
216 status = STATUS_INSUFFICIENT_RESOURCES;
218 (
"Failed to allocate Irp, status 0x%x\n", status) );
222 status = IoCallDriver( refDeviceObject, irp );
223 if (status == STATUS_PENDING) {
224 KeWaitForSingleObject( &event, Executive, KernelMode, FALSE,
NULL );
225 status = iosb.Status;
229 (
"DeviceIoControl returned status 0x%x\n", status) );
231 if(!NT_SUCCESS( status )) {
235 retValue =
FlagOn( outBuf.Flags, DISK_CLUSTER_FLAG_CSV ) ?
TRUE : FALSE;
236 if (
FlagOn( outBuf.Flags, DISK_CLUSTER_FLAG_CSV) &&
FlagOn(outBuf.Flags, DISK_CLUSTER_FLAG_IN_MAINTENANCE )) {
245 (
"Disk is CSV but in Maintenance\n") );
249 if(retValue ==
TRUE) {
255 (
"Disk is not CSV\n") );
260 if (refDeviceObject) {
261 KeEnterCriticalRegion();
262 ObDereferenceObject( refDeviceObject );
263 refDeviceObject =
NULL;
264 KeLeaveCriticalRegion();
268 ObDereferenceObject( disk );
277 _Inout_ PFLT_CALLBACK_DATA Data
298 PECP_LIST ecpList =
NULL;
299 PCSV_QUERY_FILE_REVISION_ECP_CONTEXT ecpContext;
304 (
"[AV] AvAddCsvRevisionECP: Entered\n") );
309 if (!NT_SUCCESS( status )) {
311 (
"[AV] AvAddCsvRevisionECP: FltGetEcpListFromCallbackData failed 0x%x\n", status) );
315 if (ecpList ==
NULL) {
319 status = FltAllocateExtraCreateParameterList(
Globals.
Filter, 0, &ecpList );
320 if (!NT_SUCCESS(status)) {
322 (
"[AV] AvAddCsvRevisionECP: FltAllocateExtraCreateParameterList failed 0x%x", status) );
328 status = FltSetEcpListIntoCallbackData(
Globals.
Filter, Data, ecpList );
329 if (!NT_SUCCESS(status)) {
331 (
"[AV] AvAddCsvRevisionECP: FltSetEcpListIntoCallbackData failed 0x%x", status) );
343 &GUID_ECP_CSV_QUERY_FILE_REVISION,
346 if (status != STATUS_NOT_FOUND) {
353 &GUID_ECP_CSV_QUERY_FILE_REVISION,
354 sizeof(CSV_QUERY_FILE_REVISION_ECP_CONTEXT),
360 if (!NT_SUCCESS(status)) {
362 (
"[AV] AvAddCsvRevisionECP: FltAllocateExtraCreateParameterFromLookasideList failed 0x%x\n", status) );
366 RtlZeroMemory( ecpContext,
sizeof(CSV_QUERY_FILE_REVISION_ECP_CONTEXT ));
370 if (!NT_SUCCESS(status)) {
372 (
"[AV] AvAddCsvRevisionECP: FltInsertExtraCreateParameter failed 0x%x\n", status) );
380 (
"[AV] AvAddCsvRevisionECP: Leave\n") );
387 _Inout_ PFLT_CALLBACK_DATA Data,
388 _In_ LPCGUID EcpGuid,
417 PECP_LIST ecpList =
NULL;
418 PVOID ecpContext =
NULL;
419 ULONG ecpContextSize = 0;
424 (
"[AV] AvFindAckedECP: Entered\n") );
429 if (NT_SUCCESS(status)) {
431 if (ecpList !=
NULL) {
439 if (NT_SUCCESS(status)) {
443 *EcpSize = ecpContextSize;
445 status = STATUS_UNSUCCESSFUL;
450 status = STATUS_UNSUCCESSFUL;
455 (
"[AV] AvFindAckedECP: leave 0x%x\n", status) );
462 _Inout_ PFLT_CALLBACK_DATA Data,
463 _Out_ LONGLONG *VolumeRevision,
464 _Out_ LONGLONG *CacheRevision,
465 _Out_ LONGLONG *FileRevision
492 PCSV_QUERY_FILE_REVISION_ECP_CONTEXT ecpContext =
NULL;
493 ULONG ecpContextSize = 0;
498 (
"[AV] AvReadCsvRevisionECP: Entered\n") );
502 &GUID_ECP_CSV_QUERY_FILE_REVISION,
506 if (NT_SUCCESS( status )) {
507 *VolumeRevision = ecpContext->FileRevision[0];
508 *CacheRevision = ecpContext->FileRevision[1];
509 *FileRevision = ecpContext->FileRevision[2];
513 (
"[AV] AvReadCsvRevisionECP: leave 0x%x\n", status) );
520 _In_ PCFLT_RELATED_OBJECTS FltObjects,
521 _Out_ LONGLONG *VolumeRevision,
522 _Out_ LONGLONG *CacheRevision,
523 _Out_ LONGLONG *FileRevision
550 CSV_CONTROL_PARAM request;
551 CSV_QUERY_FILE_REVISION revision;
556 RtlZeroMemory( &request,
sizeof( request ) );
557 request.Operation = CsvControlQueryFileRevision;
559 status = FltFsControlFile( FltObjects->Instance,
560 FltObjects->FileObject,
568 if (NT_SUCCESS( status )) {
569 *VolumeRevision = revision.FileRevision[0];
570 *CacheRevision = revision.FileRevision[1];
571 *FileRevision = revision.FileRevision[2];
579 _In_ PFLT_FILTER Filter,
580 _In_ PFLT_CALLBACK_DATA Data
608 status = FltGetEcpListFromCallbackData( Filter, Data, &ecpList );
610 if (NT_SUCCESS(status) && (ecpList !=
NULL)) {
612 status = FltFindExtraCreateParameter( Filter,
614 &GUID_ECP_CSV_DOWN_LEVEL_OPEN,
618 if (NT_SUCCESS(status)) {
629 _Inout_ PFLT_CALLBACK_DATA Data,
630 _In_ PCFLT_RELATED_OBJECTS FltObjects
660 status = FltGetInstanceContext( FltObjects->Instance,
663 if (NT_SUCCESS( status )) {
665 if (instanceContext->
VolumeFSType == FLT_FSTYPE_CSVFS) {
677 FltReleaseContext( instanceContext );
686 (
"[AV] AvPreCreateCsvfs: FltGetInstanceContext failed. status = 0x%x\n", status) );
694 _Inout_ PFLT_CALLBACK_DATA Data,
695 _In_ PCFLT_RELATED_OBJECTS FltObjects,
697 _Out_ BOOLEAN *UpdateRevisionNumbers,
698 _Out_ LONGLONG *VolumeRevisionPtr,
699 _Out_ LONGLONG *CacheRevisionPtr,
700 _Out_ LONGLONG *FileRevisionPtr
740 LONGLONG VolumeRevision = 0, CacheRevision = 0, FileRevision = 0;
741 BOOLEAN needRescanOnCsvfs = FALSE;
745 *UpdateRevisionNumbers = FALSE;
746 *VolumeRevisionPtr = 0;
747 *CacheRevisionPtr = 0;
748 *FileRevisionPtr = 0;
750 status = FltGetInstanceContext( FltObjects->Instance,
753 if (NT_SUCCESS( status )) {
755 if (instanceContext->
VolumeFSType == FLT_FSTYPE_CSVFS) {
765 if (NT_SUCCESS( status )) {
767 (
" [AV] AvPostCreateCsvfs: %I64x:%I64x:%I64x\n",
789 needRescanOnCsvfs = ( (VolumeRevision == 0) ||
790 (CacheRevision == 0) ||
791 (FileRevision == 0) ||
792 (VolumeRevision != StreamContext->VolumeRevision) ||
793 (CacheRevision != StreamContext->CacheRevision) ||
794 (FileRevision != StreamContext->FileRevision) );
797 (
" [AV] AvPostCreateCsvfs: Status 0x%x from AvReadCsvRevisionECP\n", status) );
804 needRescanOnCsvfs =
TRUE;
807 FltReleaseContext( instanceContext );
814 needRescanOnCsvfs =
TRUE;
817 (
"[AV] AvPostCreateCsvfs: FltGetInstanceContext failed. status = 0x%x\n", status) );
821 (
"[Av]: AvPostCreateCsvfs: %ws need rescan\n",
822 needRescanOnCsvfs ? L
"Does" : L
"Does not")
830 if (needRescanOnCsvfs) {
831 if ( StreamContext->TxContext !=
NULL) {
850 if ((VolumeRevision != 0) &&
851 (CacheRevision != 0) &&
852 (FileRevision != 0)) {
853 *UpdateRevisionNumbers =
TRUE;
854 *VolumeRevisionPtr = VolumeRevision;
855 *CacheRevisionPtr = CacheRevision;
856 *FileRevisionPtr = FileRevision;
865 _Unreferenced_parameter_ PFLT_CALLBACK_DATA Data,
866 _In_ PCFLT_RELATED_OBJECTS FltObjects,
868 _Out_ BOOLEAN *UpdateRevisionNumbers,
869 _Out_ LONGLONG *VolumeRevisionPtr,
870 _Out_ LONGLONG *CacheRevisionPtr,
871 _Out_ LONGLONG *FileRevisionPtr
911 LONGLONG VolumeRevision = 0, CacheRevision = 0, FileRevision = 0;
912 BOOLEAN needRescanOnCsvfs = FALSE;
918 *UpdateRevisionNumbers = FALSE;
919 *VolumeRevisionPtr = 0;
920 *CacheRevisionPtr = 0;
921 *FileRevisionPtr = 0;
923 status = FltGetInstanceContext( FltObjects->Instance,
926 if (NT_SUCCESS( status )) {
928 if (instanceContext->
VolumeFSType == FLT_FSTYPE_CSVFS) {
942 if (NT_SUCCESS( status )) {
944 (
" [AV] AvPreCleanupCsvfs: %I64x:%I64x:%I64x\n",
966 needRescanOnCsvfs = ( (VolumeRevision == 0) ||
967 (CacheRevision == 0) ||
968 (FileRevision == 0) ||
969 (VolumeRevision != StreamContext->VolumeRevision) ||
970 (CacheRevision != StreamContext->CacheRevision) ||
971 (FileRevision != StreamContext->FileRevision) );
974 (
" [AV] AvPreCleanupCsvfs: Status 0x%x from AvReadCsvRevisionECP\n", status) );
981 needRescanOnCsvfs =
TRUE;
984 FltReleaseContext( instanceContext );
991 needRescanOnCsvfs =
TRUE;
994 (
"[AV] AvPreCleanupCsvfs: FltGetInstanceContext failed. status = 0x%x\n", status) );
999 (
"[Av]: AvPreCleanupCsvfs: %ws need rescan\n",
1000 needRescanOnCsvfs ? L
"Does" : L
"Does not")
1008 if (needRescanOnCsvfs) {
1009 if ( StreamContext->TxContext !=
NULL) {
1028 if ((VolumeRevision != 0) &&
1029 (CacheRevision != 0) &&
1030 (FileRevision != 0)) {
1031 *UpdateRevisionNumbers =
TRUE;
1032 *VolumeRevisionPtr = VolumeRevision;
1033 *CacheRevisionPtr = CacheRevision;
1034 *FileRevisionPtr = FileRevision;
#define SET_FILE_TX_MODIFIED(_sCtx)
FLT_FILESYSTEM_TYPE VolumeFSType
AV_SCANNER_GLOBAL_DATA Globals
NTSTATUS AvPostCreateCsvfs(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Inout_ PAV_STREAM_CONTEXT StreamContext, _Out_ BOOLEAN *UpdateRevisionNumbers, _Out_ LONGLONG *VolumeRevisionPtr, _Out_ LONGLONG *CacheRevisionPtr, _Out_ LONGLONG *FileRevisionPtr)
#define SET_FILE_MODIFIED(_sCtx)
UNREFERENCED_PARAMETER(FileObject)
NcLoadRegistryStringRetry NULL
BOOLEAN AvIsCsvDlEcpPresent(_In_ PFLT_FILTER Filter, _In_ PFLT_CALLBACK_DATA Data)
NTSTATUS AvAddCsvRevisionECP(_Inout_ PFLT_CALLBACK_DATA Data)
NTSTATUS AvQueryCsvRevisionNumbers(_In_ PCFLT_RELATED_OBJECTS FltObjects, _Out_ LONGLONG *VolumeRevision, _Out_ LONGLONG *CacheRevision, _Out_ LONGLONG *FileRevision)
BOOLEAN AvIsVolumeOnCsvDisk(_In_ PFLT_VOLUME Volume)
NTSTATUS AvReadCsvRevisionECP(_Inout_ PFLT_CALLBACK_DATA Data, _Out_ LONGLONG *VolumeRevision, _Out_ LONGLONG *CacheRevision, _Out_ LONGLONG *FileRevision)
NTSTATUS AvFindAckedECP(_Inout_ PFLT_CALLBACK_DATA Data, _In_ LPCGUID EcpGuid, _Out_ PVOID *Ecp, _Out_ ULONG *EcpSize)
NTSTATUS AvPreCreateCsvfs(_Inout_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects)
NTSTATUS AvPreCleanupCsvfs(_Unreferenced_parameter_ PFLT_CALLBACK_DATA Data, _In_ PCFLT_RELATED_OBJECTS FltObjects, _Inout_ PAV_STREAM_CONTEXT StreamContext, _Out_ BOOLEAN *UpdateRevisionNumbers, _Out_ LONGLONG *VolumeRevisionPtr, _Out_ LONGLONG *CacheRevisionPtr, _Out_ LONGLONG *FileRevisionPtr)
#define AV_DBG_PRINT(_dbgLevel, _string)