/*++ BUILD Version: 0013 // Increment this if a change has global effects Copyright (c) 1989 Microsoft Corporation Module Name: io.h Abstract: This module contains the internal structure definitions and APIs used by the NT I/O system. Author: Darryl E. Havens (darrylh) 12-Apr-1989 Revision History: --*/ #ifndef _IO_ #define _IO_ // begin_ntddk begin_wdm begin_nthal begin_ntifs begin_ntndis begin_ntosp // // Define I/O system data structure type codes. Each major data structure in // the I/O system has a type code The type field in each structure is at the // same offset. The following values can be used to determine which type of // data structure a pointer refers to. // #define IO_TYPE_ADAPTER 0x00000001 #define IO_TYPE_CONTROLLER 0x00000002 #define IO_TYPE_DEVICE 0x00000003 #define IO_TYPE_DRIVER 0x00000004 #define IO_TYPE_FILE 0x00000005 #define IO_TYPE_IRP 0x00000006 #define IO_TYPE_MASTER_ADAPTER 0x00000007 #define IO_TYPE_OPEN_PACKET 0x00000008 #define IO_TYPE_TIMER 0x00000009 #define IO_TYPE_VPB 0x0000000a #define IO_TYPE_ERROR_LOG 0x0000000b #define IO_TYPE_ERROR_MESSAGE 0x0000000c #define IO_TYPE_DEVICE_OBJECT_EXTENSION 0x0000000d // // Define the major function codes for IRPs. // #define IRP_MJ_CREATE 0x00 #define IRP_MJ_CREATE_NAMED_PIPE 0x01 #define IRP_MJ_CLOSE 0x02 #define IRP_MJ_READ 0x03 #define IRP_MJ_WRITE 0x04 #define IRP_MJ_QUERY_INFORMATION 0x05 #define IRP_MJ_SET_INFORMATION 0x06 #define IRP_MJ_QUERY_EA 0x07 #define IRP_MJ_SET_EA 0x08 #define IRP_MJ_FLUSH_BUFFERS 0x09 #define IRP_MJ_QUERY_VOLUME_INFORMATION 0x0a #define IRP_MJ_SET_VOLUME_INFORMATION 0x0b #define IRP_MJ_DIRECTORY_CONTROL 0x0c #define IRP_MJ_FILE_SYSTEM_CONTROL 0x0d #define IRP_MJ_DEVICE_CONTROL 0x0e #define IRP_MJ_INTERNAL_DEVICE_CONTROL 0x0f #define IRP_MJ_SHUTDOWN 0x10 #define IRP_MJ_LOCK_CONTROL 0x11 #define IRP_MJ_CLEANUP 0x12 #define IRP_MJ_CREATE_MAILSLOT 0x13 #define IRP_MJ_QUERY_SECURITY 0x14 #define IRP_MJ_SET_SECURITY 0x15 #define IRP_MJ_POWER 0x16 #define IRP_MJ_SYSTEM_CONTROL 0x17 #define IRP_MJ_DEVICE_CHANGE 0x18 #define IRP_MJ_QUERY_QUOTA 0x19 #define IRP_MJ_SET_QUOTA 0x1a #define IRP_MJ_PNP 0x1b #define IRP_MJ_PNP_POWER IRP_MJ_PNP // Obsolete.... #define IRP_MJ_MAXIMUM_FUNCTION 0x1b // // Make the Scsi major code the same as internal device control. // #define IRP_MJ_SCSI IRP_MJ_INTERNAL_DEVICE_CONTROL // // Define the minor function codes for IRPs. The lower 128 codes, from 0x00 to // 0x7f are reserved to Microsoft. The upper 128 codes, from 0x80 to 0xff, are // reserved to customers of Microsoft. // // end_wdm end_ntndis // // Directory control minor function codes // #define IRP_MN_QUERY_DIRECTORY 0x01 #define IRP_MN_NOTIFY_CHANGE_DIRECTORY 0x02 // // File system control minor function codes. Note that "user request" is // assumed to be zero by both the I/O system and file systems. Do not change // this value. // #define IRP_MN_USER_FS_REQUEST 0x00 #define IRP_MN_MOUNT_VOLUME 0x01 #define IRP_MN_VERIFY_VOLUME 0x02 #define IRP_MN_LOAD_FILE_SYSTEM 0x03 #define IRP_MN_TRACK_LINK 0x04 // To be obsoleted soon #define IRP_MN_KERNEL_CALL 0x04 // // Lock control minor function codes // #define IRP_MN_LOCK 0x01 #define IRP_MN_UNLOCK_SINGLE 0x02 #define IRP_MN_UNLOCK_ALL 0x03 #define IRP_MN_UNLOCK_ALL_BY_KEY 0x04 // // Read and Write minor function codes for file systems supporting Lan Manager // software. All of these subfunction codes are invalid if the file has been // opened with FO_NO_INTERMEDIATE_BUFFERING. They are also invalid in combi- // nation with synchronous calls (Irp Flag or file open option). // // Note that "normal" is assumed to be zero by both the I/O system and file // systems. Do not change this value. // #define IRP_MN_NORMAL 0x00 #define IRP_MN_DPC 0x01 #define IRP_MN_MDL 0x02 #define IRP_MN_COMPLETE 0x04 #define IRP_MN_COMPRESSED 0x08 #define IRP_MN_MDL_DPC (IRP_MN_MDL | IRP_MN_DPC) #define IRP_MN_COMPLETE_MDL (IRP_MN_COMPLETE | IRP_MN_MDL) #define IRP_MN_COMPLETE_MDL_DPC (IRP_MN_COMPLETE_MDL | IRP_MN_DPC) // begin_wdm // // Device Control Request minor function codes for SCSI support. Note that // user requests are assumed to be zero. // #define IRP_MN_SCSI_CLASS 0x01 // // PNP minor function codes. // #define IRP_MN_START_DEVICE 0x00 #define IRP_MN_QUERY_REMOVE_DEVICE 0x01 #define IRP_MN_REMOVE_DEVICE 0x02 #define IRP_MN_CANCEL_REMOVE_DEVICE 0x03 #define IRP_MN_STOP_DEVICE 0x04 #define IRP_MN_QUERY_STOP_DEVICE 0x05 #define IRP_MN_CANCEL_STOP_DEVICE 0x06 #define IRP_MN_QUERY_DEVICE_RELATIONS 0x07 #define IRP_MN_QUERY_INTERFACE 0x08 #define IRP_MN_QUERY_CAPABILITIES 0x09 #define IRP_MN_QUERY_RESOURCES 0x0A #define IRP_MN_QUERY_RESOURCE_REQUIREMENTS 0x0B #define IRP_MN_QUERY_DEVICE_TEXT 0x0C #define IRP_MN_FILTER_RESOURCE_REQUIREMENTS 0x0D #define IRP_MN_READ_CONFIG 0x0F #define IRP_MN_WRITE_CONFIG 0x10 #define IRP_MN_EJECT 0x11 #define IRP_MN_SET_LOCK 0x12 #define IRP_MN_QUERY_ID 0x13 #define IRP_MN_QUERY_PNP_DEVICE_STATE 0x14 #define IRP_MN_QUERY_BUS_INFORMATION 0x15 #define IRP_MN_DEVICE_USAGE_NOTIFICATION 0x16 #define IRP_MN_SURPRISE_REMOVAL 0x17 // end_wdm #define IRP_MN_QUERY_LEGACY_BUS_INFORMATION 0x18 // begin_wdm // // POWER minor function codes // #define IRP_MN_WAIT_WAKE 0x00 #define IRP_MN_POWER_SEQUENCE 0x01 #define IRP_MN_SET_POWER 0x02 #define IRP_MN_QUERY_POWER 0x03 // begin_ntminiport // // WMI minor function codes under IRP_MJ_SYSTEM_CONTROL // #define IRP_MN_QUERY_ALL_DATA 0x00 #define IRP_MN_QUERY_SINGLE_INSTANCE 0x01 #define IRP_MN_CHANGE_SINGLE_INSTANCE 0x02 #define IRP_MN_CHANGE_SINGLE_ITEM 0x03 #define IRP_MN_ENABLE_EVENTS 0x04 #define IRP_MN_DISABLE_EVENTS 0x05 #define IRP_MN_ENABLE_COLLECTION 0x06 #define IRP_MN_DISABLE_COLLECTION 0x07 #define IRP_MN_REGINFO 0x08 #define IRP_MN_EXECUTE_METHOD 0x09 // Minor code 0x0a is reserved #define IRP_MN_REGINFO_EX 0x0b // end_ntminiport // end_wdm end_ntddk end_nthal end_ntifs end_ntosp // The following minor code is reserved as a private WMI minor function // For drivers who cannot include io.h, please see wmikm.h // // begin_wmikm #define IRP_MN_SET_TRACE_NOTIFY 0x0A // end_wmikm // begin_wdm begin_ntddk begin_nthal begin_ntifs begin_ntosp // // Define option flags for IoCreateFile. Note that these values must be // exactly the same as the SL_... flags for a create function. Note also // that there are flags that may be passed to IoCreateFile that are not // placed in the stack location for the create IRP. These flags start in // the next byte. // #define IO_FORCE_ACCESS_CHECK 0x0001 // end_ntddk end_wdm end_nthal end_ntosp #define IO_OPEN_PAGING_FILE 0x0002 #define IO_OPEN_TARGET_DIRECTORY 0x0004 // // Flags not passed to driver // // begin_ntddk begin_wdm begin_ntosp #define IO_NO_PARAMETER_CHECKING 0x0100 // // Define Information fields for whether or not a REPARSE or a REMOUNT has // occurred in the file system. // #define IO_REPARSE 0x0 #define IO_REMOUNT 0x1 // end_ntddk end_wdm #define IO_CHECK_CREATE_PARAMETERS 0x0200 #define IO_ATTACH_DEVICE 0x0400 // end_ntosp // begin_ntifs begin_ntosp // // This flag is only meaning full to IoCreateFileSpecifyDeviceObjectHint. // FileHandles created using IoCreateFileSpecifyDeviceObjectHint with this // flag set will bypass ShareAccess checks on this file. // #define IO_IGNORE_SHARE_ACCESS_CHECK 0x0800 // Ignores share access checks on opens. // end_ntifs end_ntosp // Define kernel-only, internal option flags // #define IO_ATTACH_DEVICE_API 0x80000000 // end_ntifs // // Define the driver interfaces required to write memory dumps. // // // Define stall routine type for the dump driver. // // begin_ntosp typedef VOID (*PSTALL_ROUTINE) ( IN ULONG Delay ); // // Define the interfaces for the dump driver's routines. // typedef BOOLEAN (*PDUMP_DRIVER_OPEN) ( IN LARGE_INTEGER PartitionOffset ); typedef NTSTATUS (*PDUMP_DRIVER_WRITE) ( IN PLARGE_INTEGER DiskByteOffset, IN PMDL Mdl ); // // Actions accepted by DRIVER_WRITE_PENDING // #define IO_DUMP_WRITE_FULFILL 0 // fulfill IO request as if DRIVER_WAIT #define IO_DUMP_WRITE_START 1 // start new IO #define IO_DUMP_WRITE_RESUME 2 // resume pending IO #define IO_DUMP_WRITE_FINISH 3 // finish pending IO #define IO_DUMP_WRITE_INIT 4 // initialize locals // size of data used by WRITE_PENDING that should be preserved // between the calls #define IO_DUMP_WRITE_DATA_PAGES 2 #define IO_DUMP_WRITE_DATA_SIZE (IO_DUMP_WRITE_DATA_PAGES << PAGE_SHIFT) typedef NTSTATUS (*PDUMP_DRIVER_WRITE_PENDING) ( IN LONG Action, IN PLARGE_INTEGER DiskByteOffset, IN PMDL Mdl, IN PVOID LocalData ); typedef VOID (*PDUMP_DRIVER_FINISH) ( VOID ); struct _ADAPTER_OBJECT; // // This is the information passed from the system to the disk dump driver // during the driver's initialization. // typedef struct _DUMP_INITIALIZATION_CONTEXT { ULONG Length; ULONG Reserved; // Was MBR Checksum. Should be zero now. PVOID MemoryBlock; PVOID CommonBuffer[2]; PHYSICAL_ADDRESS PhysicalAddress[2]; PSTALL_ROUTINE StallRoutine; PDUMP_DRIVER_OPEN OpenRoutine; PDUMP_DRIVER_WRITE WriteRoutine; PDUMP_DRIVER_FINISH FinishRoutine; struct _ADAPTER_OBJECT *AdapterObject; PVOID MappedRegisterBase; PVOID PortConfiguration; BOOLEAN CrashDump; ULONG MaximumTransferSize; ULONG CommonBufferSize; PVOID TargetAddress; //Opaque pointer to target address structure PDUMP_DRIVER_WRITE_PENDING WritePendingRoutine; ULONG PartitionStyle; union { struct { ULONG Signature; ULONG CheckSum; } Mbr; struct { GUID DiskId; } Gpt; } DiskInfo; } DUMP_INITIALIZATION_CONTEXT, *PDUMP_INITIALIZATION_CONTEXT; // begin_ntddk // // Define callout routine type for use in IoQueryDeviceDescription(). // typedef NTSTATUS (*PIO_QUERY_DEVICE_ROUTINE)( IN PVOID Context, IN PUNICODE_STRING PathName, IN INTERFACE_TYPE BusType, IN ULONG BusNumber, IN PKEY_VALUE_FULL_INFORMATION *BusInformation, IN CONFIGURATION_TYPE ControllerType, IN ULONG ControllerNumber, IN PKEY_VALUE_FULL_INFORMATION *ControllerInformation, IN CONFIGURATION_TYPE PeripheralType, IN ULONG PeripheralNumber, IN PKEY_VALUE_FULL_INFORMATION *PeripheralInformation ); // Defines the order of the information in the array of // PKEY_VALUE_FULL_INFORMATION. // typedef enum _IO_QUERY_DEVICE_DATA_FORMAT { IoQueryDeviceIdentifier = 0, IoQueryDeviceConfigurationData, IoQueryDeviceComponentInformation, IoQueryDeviceMaxData } IO_QUERY_DEVICE_DATA_FORMAT, *PIO_QUERY_DEVICE_DATA_FORMAT; // begin_wdm begin_ntifs // // Define the objects that can be created by IoCreateFile. // typedef enum _CREATE_FILE_TYPE { CreateFileTypeNone, CreateFileTypeNamedPipe, CreateFileTypeMailslot } CREATE_FILE_TYPE; // end_ntddk end_wdm end_ntifs // // Define the named pipe create parameters structure used for internal calls // to IoCreateFile when a named pipe is being created. This structure allows // code invoking this routine to pass information specific to this function // when creating a named pipe. // typedef struct _NAMED_PIPE_CREATE_PARAMETERS { ULONG NamedPipeType; ULONG ReadMode; ULONG CompletionMode; ULONG MaximumInstances; ULONG InboundQuota; ULONG OutboundQuota; LARGE_INTEGER DefaultTimeout; BOOLEAN TimeoutSpecified; } NAMED_PIPE_CREATE_PARAMETERS, *PNAMED_PIPE_CREATE_PARAMETERS; // end_ntosp // // Define the mailslot create parameters structure used for internal calls // to IoCreateFile when a mailslot is being created. This structure allows // code invoking this routine to pass information specific to this function // when creating a mailslot. // typedef struct _MAILSLOT_CREATE_PARAMETERS { ULONG MailslotQuota; ULONG MaximumMessageSize; LARGE_INTEGER ReadTimeout; BOOLEAN TimeoutSpecified; } MAILSLOT_CREATE_PARAMETERS, *PMAILSLOT_CREATE_PARAMETERS; // // Define the dump driver stack context structure // typedef struct DUMP_STACK_IMAGE{ LIST_ENTRY Link; PLDR_DATA_TABLE_ENTRY Image; PVOID ImageBase; ULONG SizeOfImage; } DUMP_STACK_IMAGE, *PDUMP_STACK_IMAGE; typedef struct _DUMP_STACK_CONTEXT { DUMP_INITIALIZATION_CONTEXT Init; LARGE_INTEGER PartitionOffset; PVOID DumpPointers; ULONG PointersLength; PWCHAR ModulePrefix; LIST_ENTRY DriverList; ANSI_STRING InitMsg; ANSI_STRING ProgMsg; ANSI_STRING DoneMsg; PVOID FileObject; enum _DEVICE_USAGE_NOTIFICATION_TYPE UsageType; } DUMP_STACK_CONTEXT, *PDUMP_STACK_CONTEXT; #define IO_DUMP_MAX_MDL_PAGES 8 #define IO_DUMP_MEMORY_BLOCK_PAGES 8 #define IO_DUMP_COMMON_BUFFER_SIZE 0x2000 NTSTATUS IoGetDumpStack( IN PWCHAR ModulePrefix, OUT PDUMP_STACK_CONTEXT *DumpStack, IN enum _DEVICE_USAGE_NOTIFICATION_TYPE UsageType, IN ULONG IgnoreDeviceUsageFailure ); NTSTATUS IoInitializeDumpStack( IN PDUMP_STACK_CONTEXT DumpStack, IN PUCHAR MessageBuffer OPTIONAL ); typedef enum _CRASHDUMP_CONFIGURATION { CrashDumpDisable = 0, CrashDumpReconfigure } CRASHDUMP_CONFIGURATION; NTSTATUS IoConfigureCrashDump( CRASHDUMP_CONFIGURATION Config ); BOOLEAN IoInitializeCrashDump( IN HANDLE Pagefile ); VOID IoGetDumpHiberRanges ( IN PVOID HiberContext, IN PDUMP_STACK_CONTEXT DumpStack ); NTKERNELAPI BOOLEAN IoWriteCrashDump( IN ULONG BugCheckCode, IN ULONG_PTR BugCheckParameter1, IN ULONG_PTR BugCheckParameter2, IN ULONG_PTR BugCheckParameter3, IN ULONG_PTR BugCheckParameter4, IN PVOID ContextSave, IN PKTHREAD Thread, OUT PBOOLEAN Reboot ); BOOLEAN IoIsTriageDumpEnabled( VOID ); BOOLEAN IoAddTriageDumpDataBlock( IN PVOID Address, IN ULONG Length ); VOID IoFreeDumpStack( IN PDUMP_STACK_CONTEXT DumpStack ); // begin_ntddk begin_wdm begin_nthal begin_ntifs begin_ntosp // // Define the structures used by the I/O system // // // Define empty typedefs for the _IRP, _DEVICE_OBJECT, and _DRIVER_OBJECT // structures so they may be referenced by function types before they are // actually defined. // struct _DEVICE_DESCRIPTION; struct _DEVICE_OBJECT; struct _DMA_ADAPTER; struct _DRIVER_OBJECT; struct _DRIVE_LAYOUT_INFORMATION; struct _DISK_PARTITION; struct _FILE_OBJECT; struct _IRP; struct _SCSI_REQUEST_BLOCK; struct _SCATTER_GATHER_LIST; // // Define the I/O version of a DPC routine. // typedef VOID (*PIO_DPC_ROUTINE) ( IN PKDPC Dpc, IN struct _DEVICE_OBJECT *DeviceObject, IN struct _IRP *Irp, IN PVOID Context ); // // Define driver timer routine type. // typedef VOID (*PIO_TIMER_ROUTINE) ( IN struct _DEVICE_OBJECT *DeviceObject, IN PVOID Context ); // // Define driver initialization routine type. // typedef NTSTATUS (*PDRIVER_INITIALIZE) ( IN struct _DRIVER_OBJECT *DriverObject, IN PUNICODE_STRING RegistryPath ); // end_wdm // // Define driver reinitialization routine type. // typedef VOID (*PDRIVER_REINITIALIZE) ( IN struct _DRIVER_OBJECT *DriverObject, IN PVOID Context, IN ULONG Count ); // begin_wdm begin_ntndis // // Define driver cancel routine type. // typedef VOID (*PDRIVER_CANCEL) ( IN struct _DEVICE_OBJECT *DeviceObject, IN struct _IRP *Irp ); // // Define driver dispatch routine type. // typedef NTSTATUS (*PDRIVER_DISPATCH) ( IN struct _DEVICE_OBJECT *DeviceObject, IN struct _IRP *Irp ); // // Define driver start I/O routine type. // typedef VOID (*PDRIVER_STARTIO) ( IN struct _DEVICE_OBJECT *DeviceObject, IN struct _IRP *Irp ); // // Define driver unload routine type. // typedef VOID (*PDRIVER_UNLOAD) ( IN struct _DRIVER_OBJECT *DriverObject ); // // Define driver AddDevice routine type. // typedef NTSTATUS (*PDRIVER_ADD_DEVICE) ( IN struct _DRIVER_OBJECT *DriverObject, IN struct _DEVICE_OBJECT *PhysicalDeviceObject ); // end_ntddk end_wdm end_nthal end_ntndis end_ntosp // // Define driver FS notification change routine type. // typedef VOID (*PDRIVER_FS_NOTIFICATION) ( IN struct _DEVICE_OBJECT *DeviceObject, IN BOOLEAN FsActive ); // begin_ntddk begin_wdm begin_ntosp // // Define fast I/O procedure prototypes. // // Fast I/O read and write procedures. // typedef BOOLEAN (*PFAST_IO_CHECK_IF_POSSIBLE) ( IN struct _FILE_OBJECT *FileObject, IN PLARGE_INTEGER FileOffset, IN ULONG Length, IN BOOLEAN Wait, IN ULONG LockKey, IN BOOLEAN CheckForReadOperation, OUT PIO_STATUS_BLOCK IoStatus, IN struct _DEVICE_OBJECT *DeviceObject ); typedef BOOLEAN (*PFAST_IO_READ) ( IN struct _FILE_OBJECT *FileObject, IN PLARGE_INTEGER FileOffset, IN ULONG Length, IN BOOLEAN Wait, IN ULONG LockKey, OUT PVOID Buffer, OUT PIO_STATUS_BLOCK IoStatus, IN struct _DEVICE_OBJECT *DeviceObject ); typedef BOOLEAN (*PFAST_IO_WRITE) ( IN struct _FILE_OBJECT *FileObject, IN PLARGE_INTEGER FileOffset, IN ULONG Length, IN BOOLEAN Wait, IN ULONG LockKey, IN PVOID Buffer, OUT PIO_STATUS_BLOCK IoStatus, IN struct _DEVICE_OBJECT *DeviceObject ); // // Fast I/O query basic and standard information procedures. // typedef BOOLEAN (*PFAST_IO_QUERY_BASIC_INFO) ( IN struct _FILE_OBJECT *FileObject, IN BOOLEAN Wait, OUT PFILE_BASIC_INFORMATION Buffer, OUT PIO_STATUS_BLOCK IoStatus, IN struct _DEVICE_OBJECT *DeviceObject ); typedef BOOLEAN (*PFAST_IO_QUERY_STANDARD_INFO) ( IN struct _FILE_OBJECT *FileObject, IN BOOLEAN Wait, OUT PFILE_STANDARD_INFORMATION Buffer, OUT PIO_STATUS_BLOCK IoStatus, IN struct _DEVICE_OBJECT *DeviceObject ); // // Fast I/O lock and unlock procedures. // typedef BOOLEAN (*PFAST_IO_LOCK) ( IN struct _FILE_OBJECT *FileObject, IN PLARGE_INTEGER FileOffset, IN PLARGE_INTEGER Length, PEPROCESS ProcessId, ULONG Key, BOOLEAN FailImmediately, BOOLEAN ExclusiveLock, OUT PIO_STATUS_BLOCK IoStatus, IN struct _DEVICE_OBJECT *DeviceObject ); typedef BOOLEAN (*PFAST_IO_UNLOCK_SINGLE) ( IN struct _FILE_OBJECT *FileObject, IN PLARGE_INTEGER FileOffset, IN PLARGE_INTEGER Length, PEPROCESS ProcessId, ULONG Key, OUT PIO_STATUS_BLOCK IoStatus, IN struct _DEVICE_OBJECT *DeviceObject ); typedef BOOLEAN (*PFAST_IO_UNLOCK_ALL) ( IN struct _FILE_OBJECT *FileObject, PEPROCESS ProcessId, OUT PIO_STATUS_BLOCK IoStatus, IN struct _DEVICE_OBJECT *DeviceObject ); typedef BOOLEAN (*PFAST_IO_UNLOCK_ALL_BY_KEY) ( IN struct _FILE_OBJECT *FileObject, PVOID ProcessId, ULONG Key, OUT PIO_STATUS_BLOCK IoStatus, IN struct _DEVICE_OBJECT *DeviceObject ); // // Fast I/O device control procedure. // typedef BOOLEAN (*PFAST_IO_DEVICE_CONTROL) ( IN struct _FILE_OBJECT *FileObject, IN BOOLEAN Wait, IN PVOID InputBuffer OPTIONAL, IN ULONG InputBufferLength, OUT PVOID OutputBuffer OPTIONAL, IN ULONG OutputBufferLength, IN ULONG IoControlCode, OUT PIO_STATUS_BLOCK IoStatus, IN struct _DEVICE_OBJECT *DeviceObject ); // // Define callbacks for NtCreateSection to synchronize correctly with // the file system. It pre-acquires the resources that will be needed // when calling to query and set file/allocation size in the file system. // typedef VOID (*PFAST_IO_ACQUIRE_FILE) ( IN struct _FILE_OBJECT *FileObject ); typedef VOID (*PFAST_IO_RELEASE_FILE) ( IN struct _FILE_OBJECT *FileObject ); // // Define callback for drivers that have device objects attached to lower- // level drivers' device objects. This callback is made when the lower-level // driver is deleting its device object. // typedef VOID (*PFAST_IO_DETACH_DEVICE) ( IN struct _DEVICE_OBJECT *SourceDevice, IN struct _DEVICE_OBJECT *TargetDevice ); // // This structure is used by the server to quickly get the information needed // to service a server open call. It is takes what would be two fast io calls // one for basic information and the other for standard information and makes // it into one call. // typedef BOOLEAN (*PFAST_IO_QUERY_NETWORK_OPEN_INFO) ( IN struct _FILE_OBJECT *FileObject, IN BOOLEAN Wait, OUT struct _FILE_NETWORK_OPEN_INFORMATION *Buffer, OUT struct _IO_STATUS_BLOCK *IoStatus, IN struct _DEVICE_OBJECT *DeviceObject ); // // Define Mdl-based routines for the server to call // typedef BOOLEAN (*PFAST_IO_MDL_READ) ( IN struct _FILE_OBJECT *FileObject, IN PLARGE_INTEGER FileOffset, IN ULONG Length, IN ULONG LockKey, OUT PMDL *MdlChain, OUT PIO_STATUS_BLOCK IoStatus, IN struct _DEVICE_OBJECT *DeviceObject ); typedef BOOLEAN (*PFAST_IO_MDL_READ_COMPLETE) ( IN struct _FILE_OBJECT *FileObject, IN PMDL MdlChain, IN struct _DEVICE_OBJECT *DeviceObject ); typedef BOOLEAN (*PFAST_IO_PREPARE_MDL_WRITE) ( IN struct _FILE_OBJECT *FileObject, IN PLARGE_INTEGER FileOffset, IN ULONG Length, IN ULONG LockKey, OUT PMDL *MdlChain, OUT PIO_STATUS_BLOCK IoStatus, IN struct _DEVICE_OBJECT *DeviceObject ); typedef BOOLEAN (*PFAST_IO_MDL_WRITE_COMPLETE) ( IN struct _FILE_OBJECT *FileObject, IN PLARGE_INTEGER FileOffset, IN PMDL MdlChain, IN struct _DEVICE_OBJECT *DeviceObject ); // // If this routine is present, it will be called by FsRtl // to acquire the file for the mapped page writer. // typedef NTSTATUS (*PFAST_IO_ACQUIRE_FOR_MOD_WRITE) ( IN struct _FILE_OBJECT *FileObject, IN PLARGE_INTEGER EndingOffset, OUT struct _ERESOURCE **ResourceToRelease, IN struct _DEVICE_OBJECT *DeviceObject ); typedef NTSTATUS (*PFAST_IO_RELEASE_FOR_MOD_WRITE) ( IN struct _FILE_OBJECT *FileObject, IN struct _ERESOURCE *ResourceToRelease, IN struct _DEVICE_OBJECT *DeviceObject ); // // If this routine is present, it will be called by FsRtl // to acquire the file for the mapped page writer. // typedef NTSTATUS (*PFAST_IO_ACQUIRE_FOR_CCFLUSH) ( IN struct _FILE_OBJECT *FileObject, IN struct _DEVICE_OBJECT *DeviceObject ); typedef NTSTATUS (*PFAST_IO_RELEASE_FOR_CCFLUSH) ( IN struct _FILE_OBJECT *FileObject, IN struct _DEVICE_OBJECT *DeviceObject ); typedef BOOLEAN (*PFAST_IO_READ_COMPRESSED) ( IN struct _FILE_OBJECT *FileObject, IN PLARGE_INTEGER FileOffset, IN ULONG Length, IN ULONG LockKey, OUT PVOID Buffer, OUT PMDL *MdlChain, OUT PIO_STATUS_BLOCK IoStatus, OUT struct _COMPRESSED_DATA_INFO *CompressedDataInfo, IN ULONG CompressedDataInfoLength, IN struct _DEVICE_OBJECT *DeviceObject ); typedef BOOLEAN (*PFAST_IO_WRITE_COMPRESSED) ( IN struct _FILE_OBJECT *FileObject, IN PLARGE_INTEGER FileOffset, IN ULONG Length, IN ULONG LockKey, IN PVOID Buffer, OUT PMDL *MdlChain, OUT PIO_STATUS_BLOCK IoStatus, IN struct _COMPRESSED_DATA_INFO *CompressedDataInfo, IN ULONG CompressedDataInfoLength, IN struct _DEVICE_OBJECT *DeviceObject ); typedef BOOLEAN (*PFAST_IO_MDL_READ_COMPLETE_COMPRESSED) ( IN struct _FILE_OBJECT *FileObject, IN PMDL MdlChain, IN struct _DEVICE_OBJECT *DeviceObject ); typedef BOOLEAN (*PFAST_IO_MDL_WRITE_COMPLETE_COMPRESSED) ( IN struct _FILE_OBJECT *FileObject, IN PLARGE_INTEGER FileOffset, IN PMDL MdlChain, IN struct _DEVICE_OBJECT *DeviceObject ); typedef BOOLEAN (*PFAST_IO_QUERY_OPEN) ( IN struct _IRP *Irp, OUT PFILE_NETWORK_OPEN_INFORMATION NetworkInformation, IN struct _DEVICE_OBJECT *DeviceObject ); // // Define the structure to describe the Fast I/O dispatch routines. Any // additions made to this structure MUST be added monotonically to the end // of the structure, and fields CANNOT be removed from the middle. // typedef struct _FAST_IO_DISPATCH { ULONG SizeOfFastIoDispatch; PFAST_IO_CHECK_IF_POSSIBLE FastIoCheckIfPossible; PFAST_IO_READ FastIoRead; PFAST_IO_WRITE FastIoWrite; PFAST_IO_QUERY_BASIC_INFO FastIoQueryBasicInfo; PFAST_IO_QUERY_STANDARD_INFO FastIoQueryStandardInfo; PFAST_IO_LOCK FastIoLock; PFAST_IO_UNLOCK_SINGLE FastIoUnlockSingle; PFAST_IO_UNLOCK_ALL FastIoUnlockAll; PFAST_IO_UNLOCK_ALL_BY_KEY FastIoUnlockAllByKey; PFAST_IO_DEVICE_CONTROL FastIoDeviceControl; PFAST_IO_ACQUIRE_FILE AcquireFileForNtCreateSection; PFAST_IO_RELEASE_FILE ReleaseFileForNtCreateSection; PFAST_IO_DETACH_DEVICE FastIoDetachDevice; PFAST_IO_QUERY_NETWORK_OPEN_INFO FastIoQueryNetworkOpenInfo; PFAST_IO_ACQUIRE_FOR_MOD_WRITE AcquireForModWrite; PFAST_IO_MDL_READ MdlRead; PFAST_IO_MDL_READ_COMPLETE MdlReadComplete; PFAST_IO_PREPARE_MDL_WRITE PrepareMdlWrite; PFAST_IO_MDL_WRITE_COMPLETE MdlWriteComplete; PFAST_IO_READ_COMPRESSED FastIoReadCompressed; PFAST_IO_WRITE_COMPRESSED FastIoWriteCompressed; PFAST_IO_MDL_READ_COMPLETE_COMPRESSED MdlReadCompleteCompressed; PFAST_IO_MDL_WRITE_COMPLETE_COMPRESSED MdlWriteCompleteCompressed; PFAST_IO_QUERY_OPEN FastIoQueryOpen; PFAST_IO_RELEASE_FOR_MOD_WRITE ReleaseForModWrite; PFAST_IO_ACQUIRE_FOR_CCFLUSH AcquireForCcFlush; PFAST_IO_RELEASE_FOR_CCFLUSH ReleaseForCcFlush; } FAST_IO_DISPATCH, *PFAST_IO_DISPATCH; // end_ntddk end_wdm end_ntosp // // Valid values for FS_FILTER_PARAMETERS.AcquireForSectionSynchronization.SyncType // typedef enum _FS_FILTER_SECTION_SYNC_TYPE { SyncTypeOther = 0, SyncTypeCreateSection } FS_FILTER_SECTION_SYNC_TYPE, *PFS_FILTER_SECTION_SYNC_TYPE; // // Parameters union for the operations that // are exposed to the filters through the // FsFilterCallbacks registration mechanism. // typedef union _FS_FILTER_PARAMETERS { // // AcquireForModifiedPageWriter // struct { PLARGE_INTEGER EndingOffset; } AcquireForModifiedPageWriter; // // ReleaseForModifiedPageWriter // struct { PERESOURCE ResourceToRelease; } ReleaseForModifiedPageWriter; // // AcquireForSectionSynchronization // struct { FS_FILTER_SECTION_SYNC_TYPE SyncType; ULONG PageProtection; } AcquireForSectionSynchronization; // // Other // struct { PVOID Argument1; PVOID Argument2; PVOID Argument3; PVOID Argument4; PVOID Argument5; } Others; } FS_FILTER_PARAMETERS, *PFS_FILTER_PARAMETERS; // // These are the valid values for the Operation field // of the FS_FILTER_CALLBACK_DATA structure. // #define FS_FILTER_ACQUIRE_FOR_SECTION_SYNCHRONIZATION (UCHAR)-1 #define FS_FILTER_RELEASE_FOR_SECTION_SYNCHRONIZATION (UCHAR)-2 #define FS_FILTER_ACQUIRE_FOR_MOD_WRITE (UCHAR)-3 #define FS_FILTER_RELEASE_FOR_MOD_WRITE (UCHAR)-4 #define FS_FILTER_ACQUIRE_FOR_CC_FLUSH (UCHAR)-5 #define FS_FILTER_RELEASE_FOR_CC_FLUSH (UCHAR)-6 typedef struct _FS_FILTER_CALLBACK_DATA { ULONG SizeOfFsFilterCallbackData; UCHAR Operation; UCHAR Reserved; struct _DEVICE_OBJECT *DeviceObject; struct _FILE_OBJECT *FileObject; FS_FILTER_PARAMETERS Parameters; } FS_FILTER_CALLBACK_DATA, *PFS_FILTER_CALLBACK_DATA; // // Prototype for the callbacks received before an operation // is passed to the base file system. // // A filter can fail this operation, but consistant failure // will halt system progress. // typedef NTSTATUS (*PFS_FILTER_CALLBACK) ( IN PFS_FILTER_CALLBACK_DATA Data, OUT PVOID *CompletionContext ); // // Prototype for the completion callback received after an // operation is completed. // typedef VOID (*PFS_FILTER_COMPLETION_CALLBACK) ( IN PFS_FILTER_CALLBACK_DATA Data, IN NTSTATUS OperationStatus, IN PVOID CompletionContext ); // // This is the structure that the file system filter fills in to // receive notifications for these locking operations. // // A filter should set the field to NULL for any notification callback // it doesn't wish to receive. // typedef struct _FS_FILTER_CALLBACKS { ULONG SizeOfFsFilterCallbacks; ULONG Reserved; // For alignment PFS_FILTER_CALLBACK PreAcquireForSectionSynchronization; PFS_FILTER_COMPLETION_CALLBACK PostAcquireForSectionSynchronization; PFS_FILTER_CALLBACK PreReleaseForSectionSynchronization; PFS_FILTER_COMPLETION_CALLBACK PostReleaseForSectionSynchronization; PFS_FILTER_CALLBACK PreAcquireForCcFlush; PFS_FILTER_COMPLETION_CALLBACK PostAcquireForCcFlush; PFS_FILTER_CALLBACK PreReleaseForCcFlush; PFS_FILTER_COMPLETION_CALLBACK PostReleaseForCcFlush; PFS_FILTER_CALLBACK PreAcquireForModifiedPageWriter; PFS_FILTER_COMPLETION_CALLBACK PostAcquireForModifiedPageWriter; PFS_FILTER_CALLBACK PreReleaseForModifiedPageWriter; PFS_FILTER_COMPLETION_CALLBACK PostReleaseForModifiedPageWriter; } FS_FILTER_CALLBACKS, *PFS_FILTER_CALLBACKS; NTKERNELAPI NTSTATUS FsRtlRegisterFileSystemFilterCallbacks ( IN struct _DRIVER_OBJECT *FilterDriverObject, IN PFS_FILTER_CALLBACKS Callbacks ); // begin_ntddk begin_wdm begin_nthal begin_ntosp // // Define the actions that a driver execution routine may request of the // adapter/controller allocation routines upon return. // typedef enum _IO_ALLOCATION_ACTION { KeepObject = 1, DeallocateObject, DeallocateObjectKeepRegisters } IO_ALLOCATION_ACTION, *PIO_ALLOCATION_ACTION; // // Define device driver adapter/controller execution routine. // typedef IO_ALLOCATION_ACTION (*PDRIVER_CONTROL) ( IN struct _DEVICE_OBJECT *DeviceObject, IN struct _IRP *Irp, IN PVOID MapRegisterBase, IN PVOID Context ); // end_ntddk end_wdm end_nthal end_ntifs end_ntosp // // Define the I/O system's structure for a connected interrupt. This is // useful for connecting an ISR to several different processors. // typedef struct _IO_INTERRUPT_STRUCTURE { KINTERRUPT InterruptObject; PKINTERRUPT InterruptArray[MAXIMUM_PROCESSORS]; KSPIN_LOCK SpinLock; } IO_INTERRUPT_STRUCTURE, *PIO_INTERRUPT_STRUCTURE; // begin_ntddk begin_wdm begin_ntifs begin_ntosp // // Define the I/O system's security context type for use by file system's // when checking access to volumes, files, and directories. // typedef struct _IO_SECURITY_CONTEXT { PSECURITY_QUALITY_OF_SERVICE SecurityQos; PACCESS_STATE AccessState; ACCESS_MASK DesiredAccess; ULONG FullCreateOptions; } IO_SECURITY_CONTEXT, *PIO_SECURITY_CONTEXT; // end_ntddk end_wdm end_ntifs end_ntosp // // Define the I/O system's version of a timer. // typedef struct _IO_TIMER { CSHORT Type; CSHORT TimerFlag; LIST_ENTRY TimerList; PIO_TIMER_ROUTINE TimerRoutine; PVOID Context; struct _DEVICE_OBJECT *DeviceObject; } IO_TIMER, *PIO_TIMER; // // Define the client driver object extension header. // typedef struct _IO_CLIENT_EXTENSION { struct _IO_CLIENT_EXTENSION *NextExtension; PVOID ClientIdentificationAddress; } IO_CLIENT_EXTENSION, *PIO_CLIENT_EXTENSION; // begin_ntddk begin_nthal begin_ntifs begin_ntosp // // Define Volume Parameter Block (VPB) flags. // #define VPB_MOUNTED 0x00000001 #define VPB_LOCKED 0x00000002 #define VPB_PERSISTENT 0x00000004 #define VPB_REMOVE_PENDING 0x00000008 #define VPB_RAW_MOUNT 0x00000010 // // Volume Parameter Block (VPB) // #define MAXIMUM_VOLUME_LABEL_LENGTH (32 * sizeof(WCHAR)) // 32 characters typedef struct _VPB { CSHORT Type; CSHORT Size; USHORT Flags; USHORT VolumeLabelLength; // in bytes struct _DEVICE_OBJECT *DeviceObject; struct _DEVICE_OBJECT *RealDevice; ULONG SerialNumber; ULONG ReferenceCount; WCHAR VolumeLabel[MAXIMUM_VOLUME_LABEL_LENGTH / sizeof(WCHAR)]; } VPB, *PVPB; #if defined(_WIN64) // // Use __inline DMA macros (hal.h) // #ifndef USE_DMA_MACROS #define USE_DMA_MACROS #endif // // Only PnP drivers! // #ifndef NO_LEGACY_DRIVERS #define NO_LEGACY_DRIVERS #endif #endif // _WIN64 #if defined(USE_DMA_MACROS) && (defined(_NTDDK_) || defined(_NTDRIVER_) || defined(_NTOSP_)) // begin_wdm // // Define object type specific fields of various objects used by the I/O system // typedef struct _DMA_ADAPTER *PADAPTER_OBJECT; // end_wdm #else // // Define object type specific fields of various objects used by the I/O system // typedef struct _ADAPTER_OBJECT *PADAPTER_OBJECT; // ntndis #endif // USE_DMA_MACROS && (_NTDDK_ || _NTDRIVER_ || _NTOSP_) // begin_wdm // // Define Wait Context Block (WCB) // typedef struct _WAIT_CONTEXT_BLOCK { KDEVICE_QUEUE_ENTRY WaitQueueEntry; PDRIVER_CONTROL DeviceRoutine; PVOID DeviceContext; ULONG NumberOfMapRegisters; PVOID DeviceObject; PVOID CurrentIrp; PKDPC BufferChainingDpc; } WAIT_CONTEXT_BLOCK, *PWAIT_CONTEXT_BLOCK; // end_wdm typedef struct _CONTROLLER_OBJECT { CSHORT Type; CSHORT Size; PVOID ControllerExtension; KDEVICE_QUEUE DeviceWaitQueue; ULONG Spare1; LARGE_INTEGER Spare2; } CONTROLLER_OBJECT, *PCONTROLLER_OBJECT; // begin_wdm // // Define Device Object (DO) flags // // end_wdm end_ntddk end_nthal end_ntifs #define DO_VERIFY_VOLUME 0x00000002 // ntddk nthal ntifs #define DO_BUFFERED_IO 0x00000004 // ntddk nthal ntifs wdm #define DO_EXCLUSIVE 0x00000008 // ntddk nthal ntifs wdm #define DO_DIRECT_IO 0x00000010 // ntddk nthal ntifs wdm #define DO_MAP_IO_BUFFER 0x00000020 // ntddk nthal ntifs wdm #define DO_DEVICE_HAS_NAME 0x00000040 // ntddk nthal ntifs #define DO_DEVICE_INITIALIZING 0x00000080 // ntddk nthal ntifs wdm #define DO_SYSTEM_BOOT_PARTITION 0x00000100 // ntddk nthal ntifs #define DO_LONG_TERM_REQUESTS 0x00000200 // ntddk nthal ntifs #define DO_NEVER_LAST_DEVICE 0x00000400 // ntddk nthal ntifs #define DO_SHUTDOWN_REGISTERED 0x00000800 // ntddk nthal ntifs wdm #define DO_BUS_ENUMERATED_DEVICE 0x00001000 // ntddk nthal ntifs wdm #define DO_POWER_PAGABLE 0x00002000 // ntddk nthal ntifs wdm #define DO_POWER_INRUSH 0x00004000 // ntddk nthal ntifs wdm #define DO_POWER_NOOP 0x00008000 #define DO_LOW_PRIORITY_FILESYSTEM 0x00010000 // ntddk nthal ntifs #define DO_XIP 0x00020000 // begin_wdm begin_ntddk begin_nthal begin_ntifs // // Device Object structure definition // typedef struct DECLSPEC_ALIGN(MEMORY_ALLOCATION_ALIGNMENT) _DEVICE_OBJECT { CSHORT Type; USHORT Size; LONG ReferenceCount; struct _DRIVER_OBJECT *DriverObject; struct _DEVICE_OBJECT *NextDevice; struct _DEVICE_OBJECT *AttachedDevice; struct _IRP *CurrentIrp; PIO_TIMER Timer; ULONG Flags; // See above: DO_... ULONG Characteristics; // See ntioapi: FILE_... PVPB Vpb; PVOID DeviceExtension; DEVICE_TYPE DeviceType; CCHAR StackSize; union { LIST_ENTRY ListEntry; WAIT_CONTEXT_BLOCK Wcb; } Queue; ULONG AlignmentRequirement; KDEVICE_QUEUE DeviceQueue; KDPC Dpc; // // The following field is for exclusive use by the filesystem to keep // track of the number of Fsp threads currently using the device // ULONG ActiveThreadCount; PSECURITY_DESCRIPTOR SecurityDescriptor; KEVENT DeviceLock; USHORT SectorSize; USHORT Spare1; struct _DEVOBJ_EXTENSION *DeviceObjectExtension; PVOID Reserved; } DEVICE_OBJECT; typedef struct _DEVICE_OBJECT *PDEVICE_OBJECT; // ntndis // end_ntddk end_nthal end_ntifs end_wdm end_ntosp // // Define the Device Object Extension Flags // #define DOE_UNLOAD_PENDING 0x00000001 #define DOE_DELETE_PENDING 0x00000002 #define DOE_REMOVE_PENDING 0x00000004 #define DOE_REMOVE_PROCESSED 0x00000008 #define DOE_START_PENDING 0x00000010 #define DOE_STARTIO_REQUESTED 0x00000020 #define DOE_STARTIO_REQUESTED_BYKEY 0x00000040 #define DOE_STARTIO_CANCELABLE 0x00000080 #define DOE_STARTIO_DEFERRED 0x00000100 // Use non-recursive startio #define DOE_STARTIO_NO_CANCEL 0x00000200 // Pass non-cancelable IRP to startio // begin_ntddk begin_nthal begin_ntifs begin_wdm begin_ntosp struct _DEVICE_OBJECT_POWER_EXTENSION; typedef struct _DEVOBJ_EXTENSION { CSHORT Type; USHORT Size; // // Public part of the DeviceObjectExtension structure // PDEVICE_OBJECT DeviceObject; // owning device object // end_ntddk end_nthal end_ntifs end_wdm end_ntosp // // Universal Power Data - all device objects must have this // ULONG PowerFlags; // see ntos\po\pop.h // WARNING: Access via PO macros // and with PO locking rules ONLY. // // Pointer to the non-universal power data // Power data that only some device objects need is stored in the // device object power extension -> DOPE // see po.h // struct _DEVICE_OBJECT_POWER_EXTENSION *Dope; // // power state information // // // Device object extension flags. Protected by the IopDatabaseLock. // ULONG ExtensionFlags; // // PnP manager fields // PVOID DeviceNode; // // AttachedTo is a pointer to the device object that this device // object is attached to. The attachment chain is now doubly // linked: this pointer and DeviceObject->AttachedDevice provide the // linkage. // PDEVICE_OBJECT AttachedTo; // // The next two fields are used to prevent recursion in IoStartNextPacket // interfaces. // LONG StartIoCount; // Used to keep track of number of pending start ios. LONG StartIoKey; // Next startio key ULONG StartIoFlags; // Start Io Flags. Need a separate flag so that it can be accessed without locks PVPB Vpb; // If not NULL contains the VPB of the mounted volume. // Set in the filesystem's volume device object. // This is a reverse VPB pointer. // begin_ntddk begin_wdm begin_nthal begin_ntifs begin_ntosp } DEVOBJ_EXTENSION, *PDEVOBJ_EXTENSION; // // Define Driver Object (DRVO) flags // #define DRVO_UNLOAD_INVOKED 0x00000001 #define DRVO_LEGACY_DRIVER 0x00000002 #define DRVO_BUILTIN_DRIVER 0x00000004 // Driver objects for Hal, PnP Mgr // end_wdm #define DRVO_REINIT_REGISTERED 0x00000008 #define DRVO_INITIALIZED 0x00000010 #define DRVO_BOOTREINIT_REGISTERED 0x00000020 #define DRVO_LEGACY_RESOURCES 0x00000040 // end_ntddk end_nthal end_ntifs end_ntosp #define DRVO_BASE_FILESYSTEM_DRIVER 0x00000080 // A driver that is at the bottom of the filesystem stack. // begin_ntddk begin_nthal begin_ntifs begin_ntosp // begin_wdm typedef struct _DRIVER_EXTENSION { // // Back pointer to Driver Object // struct _DRIVER_OBJECT *DriverObject; // // The AddDevice entry point is called by the Plug & Play manager // to inform the driver when a new device instance arrives that this // driver must control. // PDRIVER_ADD_DEVICE AddDevice; // // The count field is used to count the number of times the driver has // had its registered reinitialization routine invoked. // ULONG Count; // // The service name field is used by the pnp manager to determine // where the driver related info is stored in the registry. // UNICODE_STRING ServiceKeyName; // // Note: any new shared fields get added here. // // end_ntddk end_wdm end_nthal end_ntifs end_ntosp // // The client driver object extension field is used by class driver // to store per driver information. // PIO_CLIENT_EXTENSION ClientDriverExtension; // // The file system filter callback extension field is used // to safely notify filters of system operations that were // previously not shown to file system filters. // PFS_FILTER_CALLBACKS FsFilterCallbacks; // begin_ntddk begin_wdm begin_nthal begin_ntifs begin_ntosp } DRIVER_EXTENSION, *PDRIVER_EXTENSION; typedef struct _DRIVER_OBJECT { CSHORT Type; CSHORT Size; // // The following links all of the devices created by a single driver // together on a list, and the Flags word provides an extensible flag // location for driver objects. // PDEVICE_OBJECT DeviceObject; ULONG Flags; // // The following section describes where the driver is loaded. The count // field is used to count the number of times the driver has had its // registered reinitialization routine invoked. // PVOID DriverStart; ULONG DriverSize; PVOID DriverSection; PDRIVER_EXTENSION DriverExtension; // // The driver name field is used by the error log thread // determine the name of the driver that an I/O request is/was bound. // UNICODE_STRING DriverName; // // The following section is for registry support. Thise is a pointer // to the path to the hardware information in the registry // PUNICODE_STRING HardwareDatabase; // // The following section contains the optional pointer to an array of // alternate entry points to a driver for "fast I/O" support. Fast I/O // is performed by invoking the driver routine directly with separate // parameters, rather than using the standard IRP call mechanism. Note // that these functions may only be used for synchronous I/O, and when // the file is cached. // PFAST_IO_DISPATCH FastIoDispatch; // // The following section describes the entry points to this particular // driver. Note that the major function dispatch table must be the last // field in the object so that it remains extensible. // PDRIVER_INITIALIZE DriverInit; PDRIVER_STARTIO DriverStartIo; PDRIVER_UNLOAD DriverUnload; PDRIVER_DISPATCH MajorFunction[IRP_MJ_MAXIMUM_FUNCTION + 1]; } DRIVER_OBJECT; typedef struct _DRIVER_OBJECT *PDRIVER_OBJECT; // ntndis // end_ntddk end_wdm end_ntifs end_ntosp // // Device Handler Object. There is one of these objects per PnP // device. This object is given to the device driver as a PVOID // and is used by the driver to refer to a particular device. // typedef struct _DEVICE_HANDLER_OBJECT { CSHORT Type; USHORT Size; // // Indentifies which bus extender this device handler // object is associated with // struct _BUS_HANDLER *BusHandler; // // The associated SlotNumber for this device handler // ULONG SlotNumber; // end_nthal // // System internal fields // // // Pnp stuff // UNICODE_STRING ServiceKeyName; ULONG InstanceOrdinal; // begin_nthal } DEVICE_HANDLER_OBJECT, *PDEVICE_HANDLER_OBJECT; // begin_ntddk begin_wdm begin_ntifs begin_ntosp // // The following structure is pointed to by the SectionObject pointer field // of a file object, and is allocated by the various NT file systems. // typedef struct _SECTION_OBJECT_POINTERS { PVOID DataSectionObject; PVOID SharedCacheMap; PVOID ImageSectionObject; } SECTION_OBJECT_POINTERS; typedef SECTION_OBJECT_POINTERS *PSECTION_OBJECT_POINTERS; // // Define the format of a completion message. // typedef struct _IO_COMPLETION_CONTEXT { PVOID Port; PVOID Key; } IO_COMPLETION_CONTEXT, *PIO_COMPLETION_CONTEXT; // // Define File Object (FO) flags // #define FO_FILE_OPEN 0x00000001 #define FO_SYNCHRONOUS_IO 0x00000002 #define FO_ALERTABLE_IO 0x00000004 #define FO_NO_INTERMEDIATE_BUFFERING 0x00000008 #define FO_WRITE_THROUGH 0x00000010 #define FO_SEQUENTIAL_ONLY 0x00000020 #define FO_CACHE_SUPPORTED 0x00000040 #define FO_NAMED_PIPE 0x00000080 #define FO_STREAM_FILE 0x00000100 #define FO_MAILSLOT 0x00000200 #define FO_GENERATE_AUDIT_ON_CLOSE 0x00000400 #define FO_DIRECT_DEVICE_OPEN 0x00000800 #define FO_FILE_MODIFIED 0x00001000 #define FO_FILE_SIZE_CHANGED 0x00002000 #define FO_CLEANUP_COMPLETE 0x00004000 #define FO_TEMPORARY_FILE 0x00008000 #define FO_DELETE_ON_CLOSE 0x00010000 #define FO_OPENED_CASE_SENSITIVE 0x00020000 #define FO_HANDLE_CREATED 0x00040000 #define FO_FILE_FAST_IO_READ 0x00080000 #define FO_RANDOM_ACCESS 0x00100000 #define FO_FILE_OPEN_CANCELLED 0x00200000 #define FO_VOLUME_OPEN 0x00400000 #define FO_FILE_OBJECT_HAS_EXTENSION 0x00800000 #define FO_REMOTE_ORIGIN 0x01000000 typedef struct _FILE_OBJECT { CSHORT Type; CSHORT Size; PDEVICE_OBJECT DeviceObject; PVPB Vpb; PVOID FsContext; PVOID FsContext2; PSECTION_OBJECT_POINTERS SectionObjectPointer; PVOID PrivateCacheMap; NTSTATUS FinalStatus; struct _FILE_OBJECT *RelatedFileObject; BOOLEAN LockOperation; BOOLEAN DeletePending; BOOLEAN ReadAccess; BOOLEAN WriteAccess; BOOLEAN DeleteAccess; BOOLEAN SharedRead; BOOLEAN SharedWrite; BOOLEAN SharedDelete; ULONG Flags; UNICODE_STRING FileName; LARGE_INTEGER CurrentByteOffset; ULONG Waiters; ULONG Busy; PVOID LastLock; KEVENT Lock; KEVENT Event; PIO_COMPLETION_CONTEXT CompletionContext; } FILE_OBJECT; typedef struct _FILE_OBJECT *PFILE_OBJECT; // ntndis // // Define I/O Request Packet (IRP) flags // #define IRP_NOCACHE 0x00000001 #define IRP_PAGING_IO 0x00000002 #define IRP_MOUNT_COMPLETION 0x00000002 #define IRP_SYNCHRONOUS_API 0x00000004 #define IRP_ASSOCIATED_IRP 0x00000008 #define IRP_BUFFERED_IO 0x00000010 #define IRP_DEALLOCATE_BUFFER 0x00000020 #define IRP_INPUT_OPERATION 0x00000040 #define IRP_SYNCHRONOUS_PAGING_IO 0x00000040 #define IRP_CREATE_OPERATION 0x00000080 #define IRP_READ_OPERATION 0x00000100 #define IRP_WRITE_OPERATION 0x00000200 #define IRP_CLOSE_OPERATION 0x00000400 // end_wdm #define IRP_DEFER_IO_COMPLETION 0x00000800 #define IRP_OB_QUERY_NAME 0x00001000 #define IRP_HOLD_DEVICE_QUEUE 0x00002000 #define IRP_RETRY_IO_COMPLETION 0x00004000 #define IRP_CLASS_CACHE_OPERATION 0x00008000 #define IRP_SET_USER_EVENT IRP_CLOSE_OPERATION // begin_wdm // // Define I/O request packet (IRP) alternate flags for allocation control. // #define IRP_QUOTA_CHARGED 0x01 #define IRP_ALLOCATED_MUST_SUCCEED 0x02 #define IRP_ALLOCATED_FIXED_SIZE 0x04 #define IRP_LOOKASIDE_ALLOCATION 0x08 // // I/O Request Packet (IRP) definition // typedef struct _IRP { CSHORT Type; USHORT Size; // // Define the common fields used to control the IRP. // // // Define a pointer to the Memory Descriptor List (MDL) for this I/O // request. This field is only used if the I/O is "direct I/O". // PMDL MdlAddress; // // Flags word - used to remember various flags. // ULONG Flags; // // The following union is used for one of three purposes: // // 1. This IRP is an associated IRP. The field is a pointer to a master // IRP. // // 2. This is the master IRP. The field is the count of the number of // IRPs which must complete (associated IRPs) before the master can // complete. // // 3. This operation is being buffered and the field is the address of // the system space buffer. // union { struct _IRP *MasterIrp; LONG IrpCount; PVOID SystemBuffer; } AssociatedIrp; // // Thread list entry - allows queueing the IRP to the thread pending I/O // request packet list. // LIST_ENTRY ThreadListEntry; // // I/O status - final status of operation. // IO_STATUS_BLOCK IoStatus; // // Requestor mode - mode of the original requestor of this operation. // KPROCESSOR_MODE RequestorMode; // // Pending returned - TRUE if pending was initially returned as the // status for this packet. // BOOLEAN PendingReturned; // // Stack state information. // CHAR StackCount; CHAR CurrentLocation; // // Cancel - packet has been canceled. // BOOLEAN Cancel; // // Cancel Irql - Irql at which the cancel spinlock was acquired. // KIRQL CancelIrql; // // ApcEnvironment - Used to save the APC environment at the time that the // packet was initialized. // CCHAR ApcEnvironment; // // Allocation control flags. // UCHAR AllocationFlags; // // User parameters. // PIO_STATUS_BLOCK UserIosb; PKEVENT UserEvent; union { struct { PIO_APC_ROUTINE UserApcRoutine; PVOID UserApcContext; } AsynchronousParameters; LARGE_INTEGER AllocationSize; } Overlay; // // CancelRoutine - Used to contain the address of a cancel routine supplied // by a device driver when the IRP is in a cancelable state. // PDRIVER_CANCEL CancelRoutine; // // Note that the UserBuffer parameter is outside of the stack so that I/O // completion can copy data back into the user's address space without // having to know exactly which service was being invoked. The length // of the copy is stored in the second half of the I/O status block. If // the UserBuffer field is NULL, then no copy is performed. // PVOID UserBuffer; // // Kernel structures // // The following section contains kernel structures which the IRP needs // in order to place various work information in kernel controller system // queues. Because the size and alignment cannot be controlled, they are // placed here at the end so they just hang off and do not affect the // alignment of other fields in the IRP. // union { struct { union { // // DeviceQueueEntry - The device queue entry field is used to // queue the IRP to the device driver device queue. // KDEVICE_QUEUE_ENTRY DeviceQueueEntry; struct { // // The following are available to the driver to use in // whatever manner is desired, while the driver owns the // packet. // PVOID DriverContext[4]; } ; } ; // // Thread - pointer to caller's Thread Control Block. // PETHREAD Thread; // // Auxiliary buffer - pointer to any auxiliary buffer that is // required to pass information to a driver that is not contained // in a normal buffer. // PCHAR AuxiliaryBuffer; // // The following unnamed structure must be exactly identical // to the unnamed structure used in the minipacket header used // for completion queue entries. // struct { // // List entry - used to queue the packet to completion queue, among // others. // LIST_ENTRY ListEntry; union { // // Current stack location - contains a pointer to the current // IO_STACK_LOCATION structure in the IRP stack. This field // should never be directly accessed by drivers. They should // use the standard functions. // struct _IO_STACK_LOCATION *CurrentStackLocation; // // Minipacket type. // ULONG PacketType; }; }; // // Original file object - pointer to the original file object // that was used to open the file. This field is owned by the // I/O system and should not be used by any other drivers. // PFILE_OBJECT OriginalFileObject; } Overlay; // // APC - This APC control block is used for the special kernel APC as // well as for the caller's APC, if one was specified in the original // argument list. If so, then the APC is reused for the normal APC for // whatever mode the caller was in and the "special" routine that is // invoked before the APC gets control simply deallocates the IRP. // KAPC Apc; // // CompletionKey - This is the key that is used to distinguish // individual I/O operations initiated on a single file handle. // PVOID CompletionKey; } Tail; } IRP, *PIRP; // // Define completion routine types for use in stack locations in an IRP // typedef NTSTATUS (*PIO_COMPLETION_ROUTINE) ( IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp, IN PVOID Context ); // // Define stack location control flags // #define SL_PENDING_RETURNED 0x01 #define SL_INVOKE_ON_CANCEL 0x20 #define SL_INVOKE_ON_SUCCESS 0x40 #define SL_INVOKE_ON_ERROR 0x80 // // Define flags for various functions // // // Create / Create Named Pipe // // The following flags must exactly match those in the IoCreateFile call's // options. The case sensitive flag is added in later, by the parse routine, // and is not an actual option to open. Rather, it is part of the object // manager's attributes structure. // #define SL_FORCE_ACCESS_CHECK 0x01 #define SL_OPEN_PAGING_FILE 0x02 #define SL_OPEN_TARGET_DIRECTORY 0x04 #define SL_CASE_SENSITIVE 0x80 // // Read / Write // #define SL_KEY_SPECIFIED 0x01 #define SL_OVERRIDE_VERIFY_VOLUME 0x02 #define SL_WRITE_THROUGH 0x04 #define SL_FT_SEQUENTIAL_WRITE 0x08 // // Device I/O Control // // // Same SL_OVERRIDE_VERIFY_VOLUME as for read/write above. // #define SL_READ_ACCESS_GRANTED 0x01 #define SL_WRITE_ACCESS_GRANTED 0x04 // Gap for SL_OVERRIDE_VERIFY_VOLUME // // Lock // #define SL_FAIL_IMMEDIATELY 0x01 #define SL_EXCLUSIVE_LOCK 0x02 // // QueryDirectory / QueryEa / QueryQuota // #define SL_RESTART_SCAN 0x01 #define SL_RETURN_SINGLE_ENTRY 0x02 #define SL_INDEX_SPECIFIED 0x04 // // NotifyDirectory // #define SL_WATCH_TREE 0x01 // // FileSystemControl // // minor: mount/verify volume // #define SL_ALLOW_RAW_MOUNT 0x01 // // Define PNP/POWER types required by IRP_MJ_PNP/IRP_MJ_POWER. // typedef enum _DEVICE_RELATION_TYPE { BusRelations, EjectionRelations, PowerRelations, RemovalRelations, TargetDeviceRelation, SingleBusRelations } DEVICE_RELATION_TYPE, *PDEVICE_RELATION_TYPE; typedef struct _DEVICE_RELATIONS { ULONG Count; PDEVICE_OBJECT Objects[1]; // variable length } DEVICE_RELATIONS, *PDEVICE_RELATIONS; typedef enum _DEVICE_USAGE_NOTIFICATION_TYPE { DeviceUsageTypeUndefined, DeviceUsageTypePaging, DeviceUsageTypeHibernation, DeviceUsageTypeDumpFile } DEVICE_USAGE_NOTIFICATION_TYPE; // begin_ntminiport // workaround overloaded definition (rpc generated headers all define INTERFACE // to match the class name). #undef INTERFACE typedef struct _INTERFACE { USHORT Size; USHORT Version; PVOID Context; PINTERFACE_REFERENCE InterfaceReference; PINTERFACE_DEREFERENCE InterfaceDereference; // interface specific entries go here } INTERFACE, *PINTERFACE; // end_ntminiport typedef struct _DEVICE_CAPABILITIES { USHORT Size; USHORT Version; // the version documented here is version 1 ULONG DeviceD1:1; ULONG DeviceD2:1; ULONG LockSupported:1; ULONG EjectSupported:1; // Ejectable in S0 ULONG Removable:1; ULONG DockDevice:1; ULONG UniqueID:1; ULONG SilentInstall:1; ULONG RawDeviceOK:1; ULONG SurpriseRemovalOK:1; ULONG WakeFromD0:1; ULONG WakeFromD1:1; ULONG WakeFromD2:1; ULONG WakeFromD3:1; ULONG HardwareDisabled:1; ULONG NonDynamic:1; ULONG WarmEjectSupported:1; ULONG NoDisplayInUI:1; ULONG Reserved:14; ULONG Address; ULONG UINumber; DEVICE_POWER_STATE DeviceState[POWER_SYSTEM_MAXIMUM]; SYSTEM_POWER_STATE SystemWake; DEVICE_POWER_STATE DeviceWake; ULONG D1Latency; ULONG D2Latency; ULONG D3Latency; } DEVICE_CAPABILITIES, *PDEVICE_CAPABILITIES; typedef struct _POWER_SEQUENCE { ULONG SequenceD1; ULONG SequenceD2; ULONG SequenceD3; } POWER_SEQUENCE, *PPOWER_SEQUENCE; typedef enum { BusQueryDeviceID = 0, // \ BusQueryHardwareIDs = 1, // Hardware ids BusQueryCompatibleIDs = 2, // compatible device ids BusQueryInstanceID = 3, // persistent id for this instance of the device BusQueryDeviceSerialNumber = 4 // serial number for this device } BUS_QUERY_ID_TYPE, *PBUS_QUERY_ID_TYPE; typedef ULONG PNP_DEVICE_STATE, *PPNP_DEVICE_STATE; #define PNP_DEVICE_DISABLED 0x00000001 #define PNP_DEVICE_DONT_DISPLAY_IN_UI 0x00000002 #define PNP_DEVICE_FAILED 0x00000004 #define PNP_DEVICE_REMOVED 0x00000008 #define PNP_DEVICE_RESOURCE_REQUIREMENTS_CHANGED 0x00000010 #define PNP_DEVICE_NOT_DISABLEABLE 0x00000020 typedef enum { DeviceTextDescription = 0, // DeviceDesc property DeviceTextLocationInformation = 1 // DeviceLocation property } DEVICE_TEXT_TYPE, *PDEVICE_TEXT_TYPE; // // Define I/O Request Packet (IRP) stack locations // #if !defined(_AMD64_) && !defined(_IA64_) #include "pshpack4.h" #endif // begin_ntndis #if defined(_WIN64) #define POINTER_ALIGNMENT DECLSPEC_ALIGN(8) #else #define POINTER_ALIGNMENT #endif // end_ntndis typedef struct _IO_STACK_LOCATION { UCHAR MajorFunction; UCHAR MinorFunction; UCHAR Flags; UCHAR Control; // // The following user parameters are based on the service that is being // invoked. Drivers and file systems can determine which set to use based // on the above major and minor function codes. // union { // // System service parameters for: NtCreateFile // struct { PIO_SECURITY_CONTEXT SecurityContext; ULONG Options; USHORT POINTER_ALIGNMENT FileAttributes; USHORT ShareAccess; ULONG POINTER_ALIGNMENT EaLength; } Create; // end_ntddk end_wdm end_nthal end_ntifs end_ntosp // // System service parameters for: NtCreateNamedPipeFile // // Notice that the fields in the following parameter structure must // match those for the create structure other than the last longword. // This is so that no distinctions need be made by the I/O system's // parse routine other than for the last longword. // struct { PIO_SECURITY_CONTEXT SecurityContext; ULONG Options; USHORT POINTER_ALIGNMENT Reserved; USHORT ShareAccess; PNAMED_PIPE_CREATE_PARAMETERS Parameters; } CreatePipe; // // System service parameters for: NtCreateMailslotFile // // Notice that the fields in the following parameter structure must // match those for the create structure other than the last longword. // This is so that no distinctions need be made by the I/O system's // parse routine other than for the last longword. // struct { PIO_SECURITY_CONTEXT SecurityContext; ULONG Options; USHORT POINTER_ALIGNMENT Reserved; USHORT ShareAccess; PMAILSLOT_CREATE_PARAMETERS Parameters; } CreateMailslot; // begin_ntddk begin_wdm begin_nthal begin_ntifs begin_ntosp // // System service parameters for: NtReadFile // struct { ULONG Length; ULONG POINTER_ALIGNMENT Key; LARGE_INTEGER ByteOffset; } Read; // // System service parameters for: NtWriteFile // struct { ULONG Length; ULONG POINTER_ALIGNMENT Key; LARGE_INTEGER ByteOffset; } Write; // end_ntddk end_wdm end_nthal // // System service parameters for: NtQueryDirectoryFile // struct { ULONG Length; PSTRING FileName; FILE_INFORMATION_CLASS FileInformationClass; ULONG POINTER_ALIGNMENT FileIndex; } QueryDirectory; // // System service parameters for: NtNotifyChangeDirectoryFile // struct { ULONG Length; ULONG POINTER_ALIGNMENT CompletionFilter; } NotifyDirectory; // begin_ntddk begin_wdm begin_nthal // // System service parameters for: NtQueryInformationFile // struct { ULONG Length; FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass; } QueryFile; // // System service parameters for: NtSetInformationFile // struct { ULONG Length; FILE_INFORMATION_CLASS POINTER_ALIGNMENT FileInformationClass; PFILE_OBJECT FileObject; union { struct { BOOLEAN ReplaceIfExists; BOOLEAN AdvanceOnly; }; ULONG ClusterCount; HANDLE DeleteHandle; }; } SetFile; // end_ntddk end_wdm end_nthal end_ntosp // // System service parameters for: NtQueryEaFile // struct { ULONG Length; PVOID EaList; ULONG EaListLength; ULONG POINTER_ALIGNMENT EaIndex; } QueryEa; // // System service parameters for: NtSetEaFile // struct { ULONG Length; } SetEa; // begin_ntddk begin_wdm begin_nthal begin_ntosp // // System service parameters for: NtQueryVolumeInformationFile // struct { ULONG Length; FS_INFORMATION_CLASS POINTER_ALIGNMENT FsInformationClass; } QueryVolume; // end_ntddk end_wdm end_nthal end_ntosp // // System service parameters for: NtSetVolumeInformationFile // struct { ULONG Length; FS_INFORMATION_CLASS POINTER_ALIGNMENT FsInformationClass; } SetVolume; // begin_ntosp // // System service parameters for: NtFsControlFile // // Note that the user's output buffer is stored in the UserBuffer field // and the user's input buffer is stored in the SystemBuffer field. // struct { ULONG OutputBufferLength; ULONG POINTER_ALIGNMENT InputBufferLength; ULONG POINTER_ALIGNMENT FsControlCode; PVOID Type3InputBuffer; } FileSystemControl; // // System service parameters for: NtLockFile/NtUnlockFile // struct { PLARGE_INTEGER Length; ULONG POINTER_ALIGNMENT Key; LARGE_INTEGER ByteOffset; } LockControl; // begin_ntddk begin_wdm begin_nthal // // System service parameters for: NtFlushBuffersFile // // No extra user-supplied parameters. // // end_ntddk end_wdm end_nthal // end_ntosp // // System service parameters for: NtCancelIoFile // // No extra user-supplied parameters. // // begin_ntddk begin_wdm begin_nthal begin_ntosp // // System service parameters for: NtDeviceIoControlFile // // Note that the user's output buffer is stored in the UserBuffer field // and the user's input buffer is stored in the SystemBuffer field. // struct { ULONG OutputBufferLength; ULONG POINTER_ALIGNMENT InputBufferLength; ULONG POINTER_ALIGNMENT IoControlCode; PVOID Type3InputBuffer; } DeviceIoControl; // end_wdm // // System service parameters for: NtQuerySecurityObject // struct { SECURITY_INFORMATION SecurityInformation; ULONG POINTER_ALIGNMENT Length; } QuerySecurity; // // System service parameters for: NtSetSecurityObject // struct { SECURITY_INFORMATION SecurityInformation; PSECURITY_DESCRIPTOR SecurityDescriptor; } SetSecurity; // begin_wdm // // Non-system service parameters. // // Parameters for MountVolume // struct { PVPB Vpb; PDEVICE_OBJECT DeviceObject; } MountVolume; // // Parameters for VerifyVolume // struct { PVPB Vpb; PDEVICE_OBJECT DeviceObject; } VerifyVolume; // // Parameters for Scsi with internal device contorl. // struct { struct _SCSI_REQUEST_BLOCK *Srb; } Scsi; // end_ntddk end_wdm end_nthal end_ntosp // // System service parameters for: NtQueryQuotaInformationFile // struct { ULONG Length; PSID StartSid; PFILE_GET_QUOTA_INFORMATION SidList; ULONG SidListLength; } QueryQuota; // // System service parameters for: NtSetQuotaInformationFile // struct { ULONG Length; } SetQuota; // begin_ntddk begin_wdm begin_nthal begin_ntosp // // Parameters for IRP_MN_QUERY_DEVICE_RELATIONS // struct { DEVICE_RELATION_TYPE Type; } QueryDeviceRelations; // // Parameters for IRP_MN_QUERY_INTERFACE // struct { CONST GUID *InterfaceType; USHORT Size; USHORT Version; PINTERFACE Interface; PVOID InterfaceSpecificData; } QueryInterface; // end_ntifs // // Parameters for IRP_MN_QUERY_CAPABILITIES // struct { PDEVICE_CAPABILITIES Capabilities; } DeviceCapabilities; // // Parameters for IRP_MN_FILTER_RESOURCE_REQUIREMENTS // struct { PIO_RESOURCE_REQUIREMENTS_LIST IoResourceRequirementList; } FilterResourceRequirements; // // Parameters for IRP_MN_READ_CONFIG and IRP_MN_WRITE_CONFIG // struct { ULONG WhichSpace; PVOID Buffer; ULONG Offset; ULONG POINTER_ALIGNMENT Length; } ReadWriteConfig; // // Parameters for IRP_MN_SET_LOCK // struct { BOOLEAN Lock; } SetLock; // // Parameters for IRP_MN_QUERY_ID // struct { BUS_QUERY_ID_TYPE IdType; } QueryId; // // Parameters for IRP_MN_QUERY_DEVICE_TEXT // struct { DEVICE_TEXT_TYPE DeviceTextType; LCID POINTER_ALIGNMENT LocaleId; } QueryDeviceText; // // Parameters for IRP_MN_DEVICE_USAGE_NOTIFICATION // struct { BOOLEAN InPath; BOOLEAN Reserved[3]; DEVICE_USAGE_NOTIFICATION_TYPE POINTER_ALIGNMENT Type; } UsageNotification; // // Parameters for IRP_MN_WAIT_WAKE // struct { SYSTEM_POWER_STATE PowerState; } WaitWake; // // Parameter for IRP_MN_POWER_SEQUENCE // struct { PPOWER_SEQUENCE PowerSequence; } PowerSequence; // // Parameters for IRP_MN_SET_POWER and IRP_MN_QUERY_POWER // struct { ULONG SystemContext; POWER_STATE_TYPE POINTER_ALIGNMENT Type; POWER_STATE POINTER_ALIGNMENT State; POWER_ACTION POINTER_ALIGNMENT ShutdownType; } Power; // // Parameters for StartDevice // struct { PCM_RESOURCE_LIST AllocatedResources; PCM_RESOURCE_LIST AllocatedResourcesTranslated; } StartDevice; // begin_ntifs // // Parameters for Cleanup // // No extra parameters supplied // // // WMI Irps // struct { ULONG_PTR ProviderId; PVOID DataPath; ULONG BufferSize; PVOID Buffer; } WMI; // // Others - driver-specific // struct { PVOID Argument1; PVOID Argument2; PVOID Argument3; PVOID Argument4; } Others; } Parameters; // // Save a pointer to this device driver's device object for this request // so it can be passed to the completion routine if needed. // PDEVICE_OBJECT DeviceObject; // // The following location contains a pointer to the file object for this // PFILE_OBJECT FileObject; // // The following routine is invoked depending on the flags in the above // flags field. // PIO_COMPLETION_ROUTINE CompletionRoutine; // // The following is used to store the address of the context parameter // that should be passed to the CompletionRoutine. // PVOID Context; } IO_STACK_LOCATION, *PIO_STACK_LOCATION; #if !defined(_AMD64_) && !defined(_IA64_) #include "poppack.h" #endif // // Define the share access structure used by file systems to determine // whether or not another accessor may open the file. // typedef struct _SHARE_ACCESS { ULONG OpenCount; ULONG Readers; ULONG Writers; ULONG Deleters; ULONG SharedRead; ULONG SharedWrite; ULONG SharedDelete; } SHARE_ACCESS, *PSHARE_ACCESS; // end_wdm // // The following structure is used by drivers that are initializing to // determine the number of devices of a particular type that have already // been initialized. It is also used to track whether or not the AtDisk // address range has already been claimed. Finally, it is used by the // NtQuerySystemInformation system service to return device type counts. // typedef struct _CONFIGURATION_INFORMATION { // // This field indicates the total number of disks in the system. This // number should be used by the driver to determine the name of new // disks. This field should be updated by the driver as it finds new // disks. // ULONG DiskCount; // Count of hard disks thus far ULONG FloppyCount; // Count of floppy disks thus far ULONG CdRomCount; // Count of CD-ROM drives thus far ULONG TapeCount; // Count of tape drives thus far ULONG ScsiPortCount; // Count of SCSI port adapters thus far ULONG SerialCount; // Count of serial devices thus far ULONG ParallelCount; // Count of parallel devices thus far // // These next two fields indicate ownership of one of the two IO address // spaces that are used by WD1003-compatable disk controllers. // BOOLEAN AtDiskPrimaryAddressClaimed; // 0x1F0 - 0x1FF BOOLEAN AtDiskSecondaryAddressClaimed; // 0x170 - 0x17F // // Indicates the structure version, as anything value belong this will have been added. // Use the structure size as the version. // ULONG Version; // // Indicates the total number of medium changer devices in the system. // This field will be updated by the drivers as it determines that // new devices have been found and will be supported. // ULONG MediumChangerCount; } CONFIGURATION_INFORMATION, *PCONFIGURATION_INFORMATION; // end_ntddk end_nthal end_ntosp // // The following are global counters used by the I/O system to indicate the // amount of I/O being performed in the system. The first three counters // are just that, counts of operations that have been requested, while the // last three counters track the amount of data transferred for each type // of I/O request. // extern KSPIN_LOCK IoStatisticsLock; extern ULONG IoReadOperationCount; extern ULONG IoWriteOperationCount; extern ULONG IoOtherOperationCount; extern LARGE_INTEGER IoReadTransferCount; extern LARGE_INTEGER IoWriteTransferCount; extern LARGE_INTEGER IoOtherTransferCount; // // It is difficult for cached file systems to properly charge quota // for the storage that they allocate on behalf of user file handles, // so the following amount of additional quota is charged against each // handle as a "best guess" as to the amount of quota the file system // will allocate on behalf of this handle. // // // These numbers are totally arbitrary, and can be changed if it turns out // that the file systems actually allocate more (or less) on behalf of // their file objects. The non-paged pool charge constant is added to the // size of a FILE_OBJECT to get the actual charge amount. // #define IO_FILE_OBJECT_NON_PAGED_POOL_CHARGE 64 #define IO_FILE_OBJECT_PAGED_POOL_CHARGE 1024 // begin_ntddk begin_wdm begin_nthal begin_ntosp // // Public I/O routine definitions // NTKERNELAPI VOID IoAcquireCancelSpinLock( OUT PKIRQL Irql ); // end_ntddk end_wdm end_nthal end_ntosp NTKERNELAPI VOID IoAcquireVpbSpinLock( OUT PKIRQL Irql ); // begin_ntddk begin_nthal end_ntifs begin_ntosp DECLSPEC_DEPRECATED_DDK // Use AllocateAdapterChannel NTKERNELAPI NTSTATUS IoAllocateAdapterChannel( IN PADAPTER_OBJECT AdapterObject, IN PDEVICE_OBJECT DeviceObject, IN ULONG NumberOfMapRegisters, IN PDRIVER_CONTROL ExecutionRoutine, IN PVOID Context ); NTKERNELAPI VOID IoAllocateController( IN PCONTROLLER_OBJECT ControllerObject, IN PDEVICE_OBJECT DeviceObject, IN PDRIVER_CONTROL ExecutionRoutine, IN PVOID Context ); // begin_wdm NTKERNELAPI NTSTATUS IoAllocateDriverObjectExtension( IN PDRIVER_OBJECT DriverObject, IN PVOID ClientIdentificationAddress, IN ULONG DriverObjectExtensionSize, OUT PVOID *DriverObjectExtension ); // begin_ntifs NTKERNELAPI PVOID IoAllocateErrorLogEntry( IN PVOID IoObject, IN UCHAR EntrySize ); NTKERNELAPI PIRP IoAllocateIrp( IN CCHAR StackSize, IN BOOLEAN ChargeQuota ); NTKERNELAPI PMDL IoAllocateMdl( IN PVOID VirtualAddress, IN ULONG Length, IN BOOLEAN SecondaryBuffer, IN BOOLEAN ChargeQuota, IN OUT PIRP Irp OPTIONAL ); // end_wdm end_ntifs //++ // // VOID // IoAssignArcName( // IN PUNICODE_STRING ArcName, // IN PUNICODE_STRING DeviceName // ) // // Routine Description: // // This routine is invoked by drivers of bootable media to create a symbolic // link between the ARC name of their device and its NT name. This allows // the system to determine which device in the system was actually booted // from since the ARC firmware only deals in ARC names, and NT only deals // in NT names. // // Arguments: // // ArcName - Supplies the Unicode string representing the ARC name. // // DeviceName - Supplies the name to which the ARCname refers. // // Return Value: // // None. // //-- #define IoAssignArcName( ArcName, DeviceName ) ( \ IoCreateSymbolicLink( (ArcName), (DeviceName) ) ) DECLSPEC_DEPRECATED_DDK // Use Pnp or IoReprtDetectedDevice NTKERNELAPI NTSTATUS IoAssignResources ( IN PUNICODE_STRING RegistryPath, IN PUNICODE_STRING DriverClassName OPTIONAL, IN PDRIVER_OBJECT DriverObject, IN PDEVICE_OBJECT DeviceObject OPTIONAL, IN PIO_RESOURCE_REQUIREMENTS_LIST RequestedResources, IN OUT PCM_RESOURCE_LIST *AllocatedResources ); // end_ntddk end_nthal end_ntosp NTKERNELAPI NTSTATUS IoAsynchronousPageWrite( IN PFILE_OBJECT FileObject, IN PMDL MemoryDescriptorList, IN PLARGE_INTEGER StartingOffset, IN PIO_APC_ROUTINE ApcRoutine, IN PVOID ApcContext, OUT PIO_STATUS_BLOCK IoStatusBlock, OUT PIRP *Irp OPTIONAL ); // begin_ntddk begin_wdm begin_nthal begin_ntifs begin_ntosp NTKERNELAPI NTSTATUS IoAttachDevice( IN PDEVICE_OBJECT SourceDevice, IN PUNICODE_STRING TargetDevice, OUT PDEVICE_OBJECT *AttachedDevice ); // end_wdm DECLSPEC_DEPRECATED_DDK // Use IoAttachDeviceToDeviceStack NTKERNELAPI NTSTATUS IoAttachDeviceByPointer( IN PDEVICE_OBJECT SourceDevice, IN PDEVICE_OBJECT TargetDevice ); // begin_wdm NTKERNELAPI PDEVICE_OBJECT IoAttachDeviceToDeviceStack( IN PDEVICE_OBJECT SourceDevice, IN PDEVICE_OBJECT TargetDevice ); NTKERNELAPI PIRP IoBuildAsynchronousFsdRequest( IN ULONG MajorFunction, IN PDEVICE_OBJECT DeviceObject, IN OUT PVOID Buffer OPTIONAL, IN ULONG Length OPTIONAL, IN PLARGE_INTEGER StartingOffset OPTIONAL, IN PIO_STATUS_BLOCK IoStatusBlock OPTIONAL ); NTKERNELAPI PIRP IoBuildDeviceIoControlRequest( IN ULONG IoControlCode, IN PDEVICE_OBJECT DeviceObject, IN PVOID InputBuffer OPTIONAL, IN ULONG InputBufferLength, OUT PVOID OutputBuffer OPTIONAL, IN ULONG OutputBufferLength, IN BOOLEAN InternalDeviceIoControl, IN PKEVENT Event, OUT PIO_STATUS_BLOCK IoStatusBlock ); NTKERNELAPI VOID IoBuildPartialMdl( IN PMDL SourceMdl, IN OUT PMDL TargetMdl, IN PVOID VirtualAddress, IN ULONG Length ); typedef struct _BOOTDISK_INFORMATION { LONGLONG BootPartitionOffset; LONGLONG SystemPartitionOffset; ULONG BootDeviceSignature; ULONG SystemDeviceSignature; } BOOTDISK_INFORMATION, *PBOOTDISK_INFORMATION; // // This structure should follow the previous structure field for field. // typedef struct _BOOTDISK_INFORMATION_EX { LONGLONG BootPartitionOffset; LONGLONG SystemPartitionOffset; ULONG BootDeviceSignature; ULONG SystemDeviceSignature; GUID BootDeviceGuid; GUID SystemDeviceGuid; BOOLEAN BootDeviceIsGpt; BOOLEAN SystemDeviceIsGpt; } BOOTDISK_INFORMATION_EX, *PBOOTDISK_INFORMATION_EX; NTKERNELAPI NTSTATUS IoGetBootDiskInformation( IN OUT PBOOTDISK_INFORMATION BootDiskInformation, IN ULONG Size ); // end_ntddk end_nthal end_wdm end_ntifs end_ntosp NTSTATUS IoBuildPoDeviceNotifyList ( IN OUT PVOID Order ); VOID IoMovePoNotifyChildren( IN PVOID Notify, IN PVOID Order ); PVOID IoGetPoNotifyParent( PVOID Notify ); NTSTATUS IoNotifyPowerOperationVetoed( IN POWER_ACTION VetoedPowerOperation, IN PDEVICE_OBJECT TargetedDeviceObject OPTIONAL, IN PDEVICE_OBJECT VetoingDeviceObject ); // begin_ntddk begin_nthal begin_wdm begin_ntifs begin_ntosp NTKERNELAPI PIRP IoBuildSynchronousFsdRequest( IN ULONG MajorFunction, IN PDEVICE_OBJECT DeviceObject, IN OUT PVOID Buffer OPTIONAL, IN ULONG Length OPTIONAL, IN PLARGE_INTEGER StartingOffset OPTIONAL, IN PKEVENT Event, OUT PIO_STATUS_BLOCK IoStatusBlock ); NTKERNELAPI NTSTATUS FASTCALL IofCallDriver( IN PDEVICE_OBJECT DeviceObject, IN OUT PIRP Irp ); #define IoCallDriver(a,b) \ IofCallDriver(a,b) NTKERNELAPI BOOLEAN IoCancelIrp( IN PIRP Irp ); // end_ntddk end_wdm end_nthal end_ntifs end_ntosp NTKERNELAPI VOID IoCancelThreadIo( IN PETHREAD Thread ); // begin_ntifs NTKERNELAPI NTSTATUS IoCheckDesiredAccess( IN OUT PACCESS_MASK DesiredAccess, IN ACCESS_MASK GrantedAccess ); NTKERNELAPI NTSTATUS IoCheckEaBufferValidity( IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset ); NTKERNELAPI NTSTATUS IoCheckFunctionAccess( IN ACCESS_MASK GrantedAccess, IN UCHAR MajorFunction, IN UCHAR MinorFunction, IN ULONG IoControlCode, IN PVOID Arg1 OPTIONAL, IN PVOID Arg2 OPTIONAL ); NTKERNELAPI NTSTATUS IoCheckQuerySetFileInformation( IN FILE_INFORMATION_CLASS FileInformationClass, IN ULONG Length, IN BOOLEAN SetOperation ); NTKERNELAPI NTSTATUS IoCheckQuerySetVolumeInformation( IN FS_INFORMATION_CLASS FsInformationClass, IN ULONG Length, IN BOOLEAN SetOperation ); NTKERNELAPI NTSTATUS IoCheckQuotaBufferValidity( IN PFILE_QUOTA_INFORMATION QuotaBuffer, IN ULONG QuotaLength, OUT PULONG ErrorOffset ); // begin_ntddk begin_wdm begin_nthal begin_ntosp NTKERNELAPI NTSTATUS IoCheckShareAccess( IN ACCESS_MASK DesiredAccess, IN ULONG DesiredShareAccess, IN OUT PFILE_OBJECT FileObject, IN OUT PSHARE_ACCESS ShareAccess, IN BOOLEAN Update ); // // This value should be returned from completion routines to continue // completing the IRP upwards. Otherwise, STATUS_MORE_PROCESSING_REQUIRED // should be returned. // #define STATUS_CONTINUE_COMPLETION STATUS_SUCCESS // // Completion routines can also use this enumeration in place of status codes. // typedef enum _IO_COMPLETION_ROUTINE_RESULT { ContinueCompletion = STATUS_CONTINUE_COMPLETION, StopCompletion = STATUS_MORE_PROCESSING_REQUIRED } IO_COMPLETION_ROUTINE_RESULT, *PIO_COMPLETION_ROUTINE_RESULT; NTKERNELAPI VOID FASTCALL IofCompleteRequest( IN PIRP Irp, IN CCHAR PriorityBoost ); #define IoCompleteRequest(a,b) \ IofCompleteRequest(a,b) // end_ntifs NTKERNELAPI NTSTATUS IoConnectInterrupt( OUT PKINTERRUPT *InterruptObject, IN PKSERVICE_ROUTINE ServiceRoutine, IN PVOID ServiceContext, IN PKSPIN_LOCK SpinLock OPTIONAL, IN ULONG Vector, IN KIRQL Irql, IN KIRQL SynchronizeIrql, IN KINTERRUPT_MODE InterruptMode, IN BOOLEAN ShareVector, IN KAFFINITY ProcessorEnableMask, IN BOOLEAN FloatingSave ); // end_wdm NTKERNELAPI PCONTROLLER_OBJECT IoCreateController( IN ULONG Size ); // begin_wdm begin_ntifs NTKERNELAPI NTSTATUS IoCreateDevice( IN PDRIVER_OBJECT DriverObject, IN ULONG DeviceExtensionSize, IN PUNICODE_STRING DeviceName OPTIONAL, IN DEVICE_TYPE DeviceType, IN ULONG DeviceCharacteristics, IN BOOLEAN Exclusive, OUT PDEVICE_OBJECT *DeviceObject ); #define WDM_MAJORVERSION 0x01 #define WDM_MINORVERSION 0x20 NTKERNELAPI BOOLEAN IoIsWdmVersionAvailable( IN UCHAR MajorVersion, IN UCHAR MinorVersion ); // end_nthal NTKERNELAPI NTSTATUS IoCreateFile( OUT PHANDLE FileHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PLARGE_INTEGER AllocationSize OPTIONAL, IN ULONG FileAttributes, IN ULONG ShareAccess, IN ULONG Disposition, IN ULONG CreateOptions, IN PVOID EaBuffer OPTIONAL, IN ULONG EaLength, IN CREATE_FILE_TYPE CreateFileType, IN PVOID ExtraCreateParameters OPTIONAL, IN ULONG Options ); // end_ntddk end_wdm end_ntosp NTKERNELAPI PFILE_OBJECT IoCreateStreamFileObject( IN PFILE_OBJECT FileObject OPTIONAL, IN PDEVICE_OBJECT DeviceObject OPTIONAL ); NTKERNELAPI PFILE_OBJECT IoCreateStreamFileObjectEx( IN PFILE_OBJECT FileObject OPTIONAL, IN PDEVICE_OBJECT DeviceObject OPTIONAL, OUT PHANDLE FileObjectHandle OPTIONAL ); NTKERNELAPI PFILE_OBJECT IoCreateStreamFileObjectLite( IN PFILE_OBJECT FileObject OPTIONAL, IN PDEVICE_OBJECT DeviceObject OPTIONAL ); // begin_nthal begin_ntddk begin_wdm begin_ntosp NTKERNELAPI PKEVENT IoCreateNotificationEvent( IN PUNICODE_STRING EventName, OUT PHANDLE EventHandle ); NTKERNELAPI NTSTATUS IoCreateSymbolicLink( IN PUNICODE_STRING SymbolicLinkName, IN PUNICODE_STRING DeviceName ); NTKERNELAPI PKEVENT IoCreateSynchronizationEvent( IN PUNICODE_STRING EventName, OUT PHANDLE EventHandle ); NTKERNELAPI NTSTATUS IoCreateUnprotectedSymbolicLink( IN PUNICODE_STRING SymbolicLinkName, IN PUNICODE_STRING DeviceName ); // end_wdm //++ // // VOID // IoDeassignArcName( // IN PUNICODE_STRING ArcName // ) // // Routine Description: // // This routine is invoked by drivers to deassign an ARC name that they // created to a device. This is generally only called if the driver is // deleting the device object, which means that the driver is probably // unloading. // // Arguments: // // ArcName - Supplies the ARC name to be removed. // // Return Value: // // None. // //-- #define IoDeassignArcName( ArcName ) ( \ IoDeleteSymbolicLink( (ArcName) ) ) // end_ntifs NTKERNELAPI VOID IoDeleteController( IN PCONTROLLER_OBJECT ControllerObject ); // begin_wdm begin_ntifs NTKERNELAPI VOID IoDeleteDevice( IN PDEVICE_OBJECT DeviceObject ); NTKERNELAPI NTSTATUS IoDeleteSymbolicLink( IN PUNICODE_STRING SymbolicLinkName ); NTKERNELAPI VOID IoDetachDevice( IN OUT PDEVICE_OBJECT TargetDevice ); // end_ntifs NTKERNELAPI VOID IoDisconnectInterrupt( IN PKINTERRUPT InterruptObject ); // end_ntddk end_wdm end_nthal NTKERNELAPI VOID IoEnqueueIrp( IN PIRP Irp ); // end_ntosp NTKERNELAPI // ntifs BOOLEAN // ntifs IoFastQueryNetworkAttributes( // ntifs IN POBJECT_ATTRIBUTES ObjectAttributes, // ntifs IN ACCESS_MASK DesiredAccess, // ntifs IN ULONG OpenOptions, // ntifs OUT PIO_STATUS_BLOCK IoStatus, // ntifs OUT PFILE_NETWORK_OPEN_INFORMATION Buffer // ntifs ); // ntifs // begin_ntddk begin_nthal begin_ntosp NTKERNELAPI VOID IoFreeController( IN PCONTROLLER_OBJECT ControllerObject ); // begin_wdm begin_ntifs NTKERNELAPI VOID IoFreeIrp( IN PIRP Irp ); NTKERNELAPI VOID IoFreeMdl( IN PMDL Mdl ); // end_ntddk end_wdm end_nthal end_ntifs end_ntosp VOID IoFreePoDeviceNotifyList ( IN OUT PVOID Order ); NTSTATUS IoGetDeviceInstanceName( IN PDEVICE_OBJECT PhysicalDeviceObject, OUT PUNICODE_STRING InstanceName ); NTSTATUS IoGetLegacyVetoList( OUT PWSTR *VetoList OPTIONAL, OUT PPNP_VETO_TYPE VetoType ); // begin_ntifs begin_ntosp NTKERNELAPI PDEVICE_OBJECT IoGetAttachedDevice( IN PDEVICE_OBJECT DeviceObject ); NTKERNELAPI // ntddk wdm nthal PDEVICE_OBJECT // ntddk wdm nthal IoGetAttachedDeviceReference( // ntddk wdm nthal IN PDEVICE_OBJECT DeviceObject // ntddk wdm nthal ); // ntddk wdm nthal // ntddk wdm nthal NTKERNELAPI PDEVICE_OBJECT IoGetBaseFileSystemDeviceObject( IN PFILE_OBJECT FileObject ); NTKERNELAPI // ntddk nthal ntosp PCONFIGURATION_INFORMATION // ntddk nthal ntosp IoGetConfigurationInformation( VOID ); // ntddk nthal ntosp // begin_ntddk begin_wdm begin_nthal //++ // // PIO_STACK_LOCATION // IoGetCurrentIrpStackLocation( // IN PIRP Irp // ) // // Routine Description: // // This routine is invoked to return a pointer to the current stack location // in an I/O Request Packet (IRP). // // Arguments: // // Irp - Pointer to the I/O Request Packet. // // Return Value: // // The function value is a pointer to the current stack location in the // packet. // //-- #define IoGetCurrentIrpStackLocation( Irp ) ( (Irp)->Tail.Overlay.CurrentStackLocation ) // end_nthal end_wdm NTKERNELAPI PDEVICE_OBJECT IoGetDeviceToVerify( IN PETHREAD Thread ); // begin_wdm NTKERNELAPI PVOID IoGetDriverObjectExtension( IN PDRIVER_OBJECT DriverObject, IN PVOID ClientIdentificationAddress ); NTKERNELAPI PEPROCESS IoGetCurrentProcess( VOID ); // begin_nthal NTKERNELAPI NTSTATUS IoGetDeviceObjectPointer( IN PUNICODE_STRING ObjectName, IN ACCESS_MASK DesiredAccess, OUT PFILE_OBJECT *FileObject, OUT PDEVICE_OBJECT *DeviceObject ); NTKERNELAPI struct _DMA_ADAPTER * IoGetDmaAdapter( IN PDEVICE_OBJECT PhysicalDeviceObject, OPTIONAL // required for PnP drivers IN struct _DEVICE_DESCRIPTION *DeviceDescription, IN OUT PULONG NumberOfMapRegisters ); NTKERNELAPI BOOLEAN IoForwardIrpSynchronously( IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp ); #define IoForwardAndCatchIrp IoForwardIrpSynchronously // end_wdm NTKERNELAPI PGENERIC_MAPPING IoGetFileObjectGenericMapping( VOID ); // end_nthal // begin_wdm //++ // // ULONG // IoGetFunctionCodeFromCtlCode( // IN ULONG ControlCode // ) // // Routine Description: // // This routine extracts the function code from IOCTL and FSCTL function // control codes. // This routine should only be used by kernel mode code. // // Arguments: // // ControlCode - A function control code (IOCTL or FSCTL) from which the // function code must be extracted. // // Return Value: // // The extracted function code. // // Note: // // The CTL_CODE macro, used to create IOCTL and FSCTL function control // codes, is defined in ntioapi.h // //-- #define IoGetFunctionCodeFromCtlCode( ControlCode ) (\ ( ControlCode >> 2) & 0x00000FFF ) // begin_nthal NTKERNELAPI PVOID IoGetInitialStack( VOID ); NTKERNELAPI VOID IoGetStackLimits ( OUT PULONG_PTR LowLimit, OUT PULONG_PTR HighLimit ); // // The following function is used to tell the caller how much stack is available // FORCEINLINE ULONG_PTR IoGetRemainingStackSize ( VOID ) { ULONG_PTR Top; ULONG_PTR Bottom; IoGetStackLimits( &Bottom, &Top ); return((ULONG_PTR)(&Top) - Bottom ); } //++ // // PIO_STACK_LOCATION // IoGetNextIrpStackLocation( // IN PIRP Irp // ) // // Routine Description: // // This routine is invoked to return a pointer to the next stack location // in an I/O Request Packet (IRP). // // Arguments: // // Irp - Pointer to the I/O Request Packet. // // Return Value: // // The function value is a pointer to the next stack location in the packet. // //-- #define IoGetNextIrpStackLocation( Irp ) (\ (Irp)->Tail.Overlay.CurrentStackLocation - 1 ) NTKERNELAPI PDEVICE_OBJECT IoGetRelatedDeviceObject( IN PFILE_OBJECT FileObject ); // end_ntddk end_wdm end_nthal NTKERNELAPI ULONG IoGetRequestorProcessId( IN PIRP Irp ); NTKERNELAPI PEPROCESS IoGetRequestorProcess( IN PIRP Irp ); // end_ntosp NTKERNELAPI PIRP IoGetTopLevelIrp( VOID ); // begin_ntddk begin_wdm begin_nthal begin_ntosp //++ // // VOID // IoInitializeDpcRequest( // IN PDEVICE_OBJECT DeviceObject, // IN PIO_DPC_ROUTINE DpcRoutine // ) // // Routine Description: // // This routine is invoked to initialize the DPC in a device object for a // device driver during its initialization routine. The DPC is used later // when the driver interrupt service routine requests that a DPC routine // be queued for later execution. // // Arguments: // // DeviceObject - Pointer to the device object that the request is for. // // DpcRoutine - Address of the driver's DPC routine to be executed when // the DPC is dequeued for processing. // // Return Value: // // None. // //-- #define IoInitializeDpcRequest( DeviceObject, DpcRoutine ) (\ KeInitializeDpc( &(DeviceObject)->Dpc, \ (PKDEFERRED_ROUTINE) (DpcRoutine), \ (DeviceObject) ) ) NTKERNELAPI VOID IoInitializeIrp( IN OUT PIRP Irp, IN USHORT PacketSize, IN CCHAR StackSize ); NTKERNELAPI NTSTATUS IoInitializeTimer( IN PDEVICE_OBJECT DeviceObject, IN PIO_TIMER_ROUTINE TimerRoutine, IN PVOID Context ); // end_ntddk end_wdm end_nthal end_ntifs end_ntosp // begin_ntddk begin_wdm begin_ntifs begin_ntosp NTKERNELAPI VOID IoReuseIrp( IN OUT PIRP Irp, IN NTSTATUS Iostatus ); // end_wdm NTKERNELAPI VOID IoCancelFileOpen( IN PDEVICE_OBJECT DeviceObject, IN PFILE_OBJECT FileObject ); // end_ntddk end_ntifs end_ntosp NTKERNELAPI BOOLEAN IoInitSystem( PLOADER_PARAMETER_BLOCK LoaderBlock ); // begin_ntddk begin_wdm begin_nthal begin_ntifs begin_ntosp //++ // // BOOLEAN // IoIsErrorUserInduced( // IN NTSTATUS Status // ) // // Routine Description: // // This routine is invoked to determine if an error was as a // result of user actions. Typically these error are related // to removable media and will result in a pop-up. // // Arguments: // // Status - The status value to check. // // Return Value: // The function value is TRUE if the user induced the error, // otherwise FALSE is returned. // //-- #define IoIsErrorUserInduced( Status ) ((BOOLEAN) \ (((Status) == STATUS_DEVICE_NOT_READY) || \ ((Status) == STATUS_IO_TIMEOUT) || \ ((Status) == STATUS_MEDIA_WRITE_PROTECTED) || \ ((Status) == STATUS_NO_MEDIA_IN_DEVICE) || \ ((Status) == STATUS_VERIFY_REQUIRED) || \ ((Status) == STATUS_UNRECOGNIZED_MEDIA) || \ ((Status) == STATUS_WRONG_VOLUME))) // end_ntddk end_wdm end_nthal end_ntosp //++ // // BOOLEAN // IoIsFileOpenedExclusively( // IN PFILE_OBJECT FileObject // ) // // Routine Description: // // This routine is invoked to determine whether the file open represented // by the specified file object is opened exclusively. // // Arguments: // // FileObject - Pointer to the file object that represents the open instance // of the target file to be tested for exclusive access. // // Return Value: // // The function value is TRUE if the open instance of the file is exclusive; // otherwise FALSE is returned. // //-- #define IoIsFileOpenedExclusively( FileObject ) (\ (BOOLEAN) !((FileObject)->SharedRead || (FileObject)->SharedWrite || (FileObject)->SharedDelete)) NTKERNELAPI BOOLEAN IoIsOperationSynchronous( IN PIRP Irp ); NTKERNELAPI BOOLEAN IoIsSystemThread( IN PETHREAD Thread ); NTKERNELAPI BOOLEAN IoIsValidNameGraftingBuffer( IN PIRP Irp, IN PREPARSE_DATA_BUFFER ReparseBuffer ); // begin_ntddk begin_nthal begin_ntosp NTKERNELAPI PIRP IoMakeAssociatedIrp( IN PIRP Irp, IN CCHAR StackSize ); // begin_wdm //++ // // VOID // IoMarkIrpPending( // IN OUT PIRP Irp // ) // // Routine Description: // // This routine marks the specified I/O Request Packet (IRP) to indicate // that an initial status of STATUS_PENDING was returned to the caller. // This is used so that I/O completion can determine whether or not to // fully complete the I/O operation requested by the packet. // // Arguments: // // Irp - Pointer to the I/O Request Packet to be marked pending. // // Return Value: // // None. // //-- #define IoMarkIrpPending( Irp ) ( \ IoGetCurrentIrpStackLocation( (Irp) )->Control |= SL_PENDING_RETURNED ) // end_ntddk end_wdm end_nthal end_ntifs end_ntosp NTKERNELAPI BOOLEAN IoPageFileCreated( IN HANDLE FileHandle ); NTKERNELAPI // ntifs NTSTATUS // ntifs IoPageRead( // ntifs IN PFILE_OBJECT FileObject, // ntifs IN PMDL MemoryDescriptorList, // ntifs IN PLARGE_INTEGER StartingOffset, // ntifs IN PKEVENT Event, // ntifs OUT PIO_STATUS_BLOCK IoStatusBlock // ntifs ); // ntifs NTKERNELAPI NTSTATUS IoAsynchronousPageRead( IN PFILE_OBJECT FileObject, IN PMDL MemoryDescriptorList, IN PLARGE_INTEGER StartingOffset, IN PKEVENT Event, OUT PIO_STATUS_BLOCK IoStatusBlock ); // begin_ntddk begin_ntosp DECLSPEC_DEPRECATED_DDK // Use IoGetDeviceProperty NTKERNELAPI NTSTATUS IoQueryDeviceDescription( IN PINTERFACE_TYPE BusType OPTIONAL, IN PULONG BusNumber OPTIONAL, IN PCONFIGURATION_TYPE ControllerType OPTIONAL, IN PULONG ControllerNumber OPTIONAL, IN PCONFIGURATION_TYPE PeripheralType OPTIONAL, IN PULONG PeripheralNumber OPTIONAL, IN PIO_QUERY_DEVICE_ROUTINE CalloutRoutine, IN PVOID Context ); // end_ntddk end_ntosp // begin_ntifs NTSTATUS IoQueryFileDosDeviceName( IN PFILE_OBJECT FileObject, OUT POBJECT_NAME_INFORMATION *ObjectNameInformation ); NTKERNELAPI NTSTATUS IoQueryFileInformation( IN PFILE_OBJECT FileObject, IN FILE_INFORMATION_CLASS FileInformationClass, IN ULONG Length, OUT PVOID FileInformation, OUT PULONG ReturnedLength ); NTKERNELAPI NTSTATUS IoQueryVolumeInformation( IN PFILE_OBJECT FileObject, IN FS_INFORMATION_CLASS FsInformationClass, IN ULONG Length, OUT PVOID FsInformation, OUT PULONG ReturnedLength ); // begin_ntosp NTKERNELAPI VOID IoQueueThreadIrp( IN PIRP Irp ); // end_ntosp // begin_ntddk begin_nthal begin_ntosp NTKERNELAPI VOID IoRaiseHardError( IN PIRP Irp, IN PVPB Vpb OPTIONAL, IN PDEVICE_OBJECT RealDeviceObject ); NTKERNELAPI BOOLEAN IoRaiseInformationalHardError( IN NTSTATUS ErrorStatus, IN PUNICODE_STRING String OPTIONAL, IN PKTHREAD Thread OPTIONAL ); NTKERNELAPI BOOLEAN IoSetThreadHardErrorMode( IN BOOLEAN EnableHardErrors ); NTKERNELAPI VOID IoRegisterBootDriverReinitialization( IN PDRIVER_OBJECT DriverObject, IN PDRIVER_REINITIALIZE DriverReinitializationRoutine, IN PVOID Context ); NTKERNELAPI VOID IoRegisterDriverReinitialization( IN PDRIVER_OBJECT DriverObject, IN PDRIVER_REINITIALIZE DriverReinitializationRoutine, IN PVOID Context ); // end_ntddk end_nthal end_ntosp NTKERNELAPI VOID IoRegisterFileSystem( IN OUT PDEVICE_OBJECT DeviceObject ); NTKERNELAPI NTSTATUS IoRegisterFsRegistrationChange( IN PDRIVER_OBJECT DriverObject, IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine ); // begin_ntddk begin_nthal begin_ntosp NTKERNELAPI NTSTATUS IoRegisterShutdownNotification( IN PDEVICE_OBJECT DeviceObject ); NTKERNELAPI NTSTATUS IoRegisterLastChanceShutdownNotification( IN PDEVICE_OBJECT DeviceObject ); // begin_wdm NTKERNELAPI VOID IoReleaseCancelSpinLock( IN KIRQL Irql ); // end_ntddk end_nthal end_wdm end_ntosp NTKERNELAPI VOID IoReleaseVpbSpinLock( IN KIRQL Irql ); // begin_ntddk begin_nthal begin_ntosp NTKERNELAPI VOID IoRemoveShareAccess( IN PFILE_OBJECT FileObject, IN OUT PSHARE_ACCESS ShareAccess ); // end_ntddk end_ntifs end_ntosp NTKERNELAPI NTSTATUS IoReportHalResourceUsage( IN PUNICODE_STRING HalName, IN PCM_RESOURCE_LIST RawResourceList, IN PCM_RESOURCE_LIST TranslatedResourceList, IN ULONG ResourceListSize ); // begin_ntddk begin_ntifs begin_ntosp DECLSPEC_DEPRECATED_DDK // Use IoReportResourceForDetection NTKERNELAPI NTSTATUS IoReportResourceUsage( IN PUNICODE_STRING DriverClassName OPTIONAL, IN PDRIVER_OBJECT DriverObject, IN PCM_RESOURCE_LIST DriverList OPTIONAL, IN ULONG DriverListSize OPTIONAL, IN PDEVICE_OBJECT DeviceObject, IN PCM_RESOURCE_LIST DeviceList OPTIONAL, IN ULONG DeviceListSize OPTIONAL, IN BOOLEAN OverrideConflict, OUT PBOOLEAN ConflictDetected ); // begin_wdm //++ // // VOID // IoRequestDpc( // IN PDEVICE_OBJECT DeviceObject, // IN PIRP Irp, // IN PVOID Context // ) // // Routine Description: // // This routine is invoked by the device driver's interrupt service routine // to request that a DPC routine be queued for later execution at a lower // IRQL. // // Arguments: // // DeviceObject - Device object for which the request is being processed. // // Irp - Pointer to the current I/O Request Packet (IRP) for the specified // device. // // Context - Provides a general context parameter to be passed to the // DPC routine. // // Return Value: // // None. // //-- #define IoRequestDpc( DeviceObject, Irp, Context ) ( \ KeInsertQueueDpc( &(DeviceObject)->Dpc, (Irp), (Context) ) ) //++ // // PDRIVER_CANCEL // IoSetCancelRoutine( // IN PIRP Irp, // IN PDRIVER_CANCEL CancelRoutine // ) // // Routine Description: // // This routine is invoked to set the address of a cancel routine which // is to be invoked when an I/O packet has been canceled. // // Arguments: // // Irp - Pointer to the I/O Request Packet itself. // // CancelRoutine - Address of the cancel routine that is to be invoked // if the IRP is cancelled. // // Return Value: // // Previous value of CancelRoutine field in the IRP. // //-- #define IoSetCancelRoutine( Irp, NewCancelRoutine ) ( \ (PDRIVER_CANCEL) InterlockedExchangePointer( (PVOID *) &(Irp)->CancelRoutine, (PVOID) (NewCancelRoutine) ) ) //++ // // VOID // IoSetCompletionRoutine( // IN PIRP Irp, // IN PIO_COMPLETION_ROUTINE CompletionRoutine, // IN PVOID Context, // IN BOOLEAN InvokeOnSuccess, // IN BOOLEAN InvokeOnError, // IN BOOLEAN InvokeOnCancel // ) // // Routine Description: // // This routine is invoked to set the address of a completion routine which // is to be invoked when an I/O packet has been completed by a lower-level // driver. // // Arguments: // // Irp - Pointer to the I/O Request Packet itself. // // CompletionRoutine - Address of the completion routine that is to be // invoked once the next level driver completes the packet. // // Context - Specifies a context parameter to be passed to the completion // routine. // // InvokeOnSuccess - Specifies that the completion routine is invoked when the // operation is successfully completed. // // InvokeOnError - Specifies that the completion routine is invoked when the // operation completes with an error status. // // InvokeOnCancel - Specifies that the completion routine is invoked when the // operation is being canceled. // // Return Value: // // None. // //-- #define IoSetCompletionRoutine( Irp, Routine, CompletionContext, Success, Error, Cancel ) { \ PIO_STACK_LOCATION __irpSp; \ ASSERT( (Success) | (Error) | (Cancel) ? (Routine) != NULL : TRUE ); \ __irpSp = IoGetNextIrpStackLocation( (Irp) ); \ __irpSp->CompletionRoutine = (Routine); \ __irpSp->Context = (CompletionContext); \ __irpSp->Control = 0; \ if ((Success)) { __irpSp->Control = SL_INVOKE_ON_SUCCESS; } \ if ((Error)) { __irpSp->Control |= SL_INVOKE_ON_ERROR; } \ if ((Cancel)) { __irpSp->Control |= SL_INVOKE_ON_CANCEL; } } NTSTATUS IoSetCompletionRoutineEx( IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp, IN PIO_COMPLETION_ROUTINE CompletionRoutine, IN PVOID Context, IN BOOLEAN InvokeOnSuccess, IN BOOLEAN InvokeOnError, IN BOOLEAN InvokeOnCancel ); // end_ntddk end_wdm end_nthal end_ntosp NTKERNELAPI VOID IoSetDeviceToVerify( IN PETHREAD Thread, IN PDEVICE_OBJECT DeviceObject ); // begin_ntddk begin_nthal begin_ntosp NTKERNELAPI VOID IoSetHardErrorOrVerifyDevice( IN PIRP Irp, IN PDEVICE_OBJECT DeviceObject ); // end_ntddk end_nthal NTKERNELAPI NTSTATUS IoSetInformation( IN PFILE_OBJECT FileObject, IN FILE_INFORMATION_CLASS FileInformationClass, IN ULONG Length, IN PVOID FileInformation ); // end_ntosp // begin_ntddk begin_wdm begin_nthal begin_ntosp //++ // // VOID // IoSetNextIrpStackLocation ( // IN OUT PIRP Irp // ) // // Routine Description: // // This routine is invoked to set the current IRP stack location to // the next stack location, i.e. it "pushes" the stack. // // Arguments: // // Irp - Pointer to the I/O Request Packet (IRP). // // Return Value: // // None. // //-- #define IoSetNextIrpStackLocation( Irp ) { \ (Irp)->CurrentLocation--; \ (Irp)->Tail.Overlay.CurrentStackLocation--; } //++ // // VOID // IoCopyCurrentIrpStackLocationToNext( // IN PIRP Irp // ) // // Routine Description: // // This routine is invoked to copy the IRP stack arguments and file // pointer from the current IrpStackLocation to the next // in an I/O Request Packet (IRP). // // If the caller wants to call IoCallDriver with a completion routine // but does not wish to change the arguments otherwise, // the caller first calls IoCopyCurrentIrpStackLocationToNext, // then IoSetCompletionRoutine, then IoCallDriver. // // Arguments: // // Irp - Pointer to the I/O Request Packet. // // Return Value: // // None. // //-- #define IoCopyCurrentIrpStackLocationToNext( Irp ) { \ PIO_STACK_LOCATION __irpSp; \ PIO_STACK_LOCATION __nextIrpSp; \ __irpSp = IoGetCurrentIrpStackLocation( (Irp) ); \ __nextIrpSp = IoGetNextIrpStackLocation( (Irp) ); \ RtlCopyMemory( __nextIrpSp, __irpSp, FIELD_OFFSET(IO_STACK_LOCATION, CompletionRoutine)); \ __nextIrpSp->Control = 0; } //++ // // VOID // IoSkipCurrentIrpStackLocation ( // IN PIRP Irp // ) // // Routine Description: // // This routine is invoked to increment the current stack location of // a given IRP. // // If the caller wishes to call the next driver in a stack, and does not // wish to change the arguments, nor does he wish to set a completion // routine, then the caller first calls IoSkipCurrentIrpStackLocation // and the calls IoCallDriver. // // Arguments: // // Irp - Pointer to the I/O Request Packet. // // Return Value: // // None // //-- #define IoSkipCurrentIrpStackLocation( Irp ) { \ (Irp)->CurrentLocation++; \ (Irp)->Tail.Overlay.CurrentStackLocation++; } NTKERNELAPI VOID IoSetShareAccess( IN ACCESS_MASK DesiredAccess, IN ULONG DesiredShareAccess, IN OUT PFILE_OBJECT FileObject, OUT PSHARE_ACCESS ShareAccess ); // end_ntddk end_wdm end_nthal end_ntosp NTKERNELAPI VOID IoSetTopLevelIrp( IN PIRP Irp ); // end_ntifs // begin_ntddk begin_wdm begin_ntosp typedef struct _IO_REMOVE_LOCK_TRACKING_BLOCK * PIO_REMOVE_LOCK_TRACKING_BLOCK; typedef struct _IO_REMOVE_LOCK_COMMON_BLOCK { BOOLEAN Removed; BOOLEAN Reserved [3]; LONG IoCount; KEVENT RemoveEvent; } IO_REMOVE_LOCK_COMMON_BLOCK; typedef struct _IO_REMOVE_LOCK_DBG_BLOCK { LONG Signature; LONG HighWatermark; LONGLONG MaxLockedTicks; LONG AllocateTag; LIST_ENTRY LockList; KSPIN_LOCK Spin; LONG LowMemoryCount; ULONG Reserved1[4]; PVOID Reserved2; PIO_REMOVE_LOCK_TRACKING_BLOCK Blocks; } IO_REMOVE_LOCK_DBG_BLOCK; typedef struct _IO_REMOVE_LOCK { IO_REMOVE_LOCK_COMMON_BLOCK Common; #if DBG IO_REMOVE_LOCK_DBG_BLOCK Dbg; #endif } IO_REMOVE_LOCK, *PIO_REMOVE_LOCK; #define IoInitializeRemoveLock(Lock, Tag, Maxmin, HighWater) \ IoInitializeRemoveLockEx (Lock, Tag, Maxmin, HighWater, sizeof (IO_REMOVE_LOCK)) NTSYSAPI VOID NTAPI IoInitializeRemoveLockEx( IN PIO_REMOVE_LOCK Lock, IN ULONG AllocateTag, // Used only on checked kernels IN ULONG MaxLockedMinutes, // Used only on checked kernels IN ULONG HighWatermark, // Used only on checked kernels IN ULONG RemlockSize // are we checked or free ); // // Initialize a remove lock. // // Note: Allocation for remove locks needs to be within the device extension, // so that the memory for this structure stays allocated until such time as the // device object itself is deallocated. // #define IoAcquireRemoveLock(RemoveLock, Tag) \ IoAcquireRemoveLockEx(RemoveLock, Tag, __FILE__, __LINE__, sizeof (IO_REMOVE_LOCK)) NTSYSAPI NTSTATUS NTAPI IoAcquireRemoveLockEx ( IN PIO_REMOVE_LOCK RemoveLock, IN OPTIONAL PVOID Tag, // Optional IN PCSTR File, IN ULONG Line, IN ULONG RemlockSize // are we checked or free ); // // Routine Description: // // This routine is called to acquire the remove lock for a device object. // While the lock is held, the caller can assume that no pending pnp REMOVE // requests will be completed. // // The lock should be acquired immediately upon entering a dispatch routine. // It should also be acquired before creating any new reference to the // device object if there's a chance of releasing the reference before the // new one is done, in addition to references to the driver code itself, // which is removed from memory when the last device object goes. // // Arguments: // // RemoveLock - A pointer to an initialized REMOVE_LOCK structure. // // Tag - Used for tracking lock allocation and release. The same tag // specified when acquiring the lock must be used to release the lock. // Tags are only checked in checked versions of the driver. // // File - set to __FILE__ as the location in the code where the lock was taken. // // Line - set to __LINE__. // // Return Value: // // Returns whether or not the remove lock was obtained. // If successful the caller should continue with work calling // IoReleaseRemoveLock when finished. // // If not successful the lock was not obtained. The caller should abort the // work but not call IoReleaseRemoveLock. // #define IoReleaseRemoveLock(RemoveLock, Tag) \ IoReleaseRemoveLockEx(RemoveLock, Tag, sizeof (IO_REMOVE_LOCK)) NTSYSAPI VOID NTAPI IoReleaseRemoveLockEx( IN PIO_REMOVE_LOCK RemoveLock, IN PVOID Tag, // Optional IN ULONG RemlockSize // are we checked or free ); // // // Routine Description: // // This routine is called to release the remove lock on the device object. It // must be called when finished using a previously locked reference to the // device object. If an Tag was specified when acquiring the lock then the // same Tag must be specified when releasing the lock. // // When the lock count reduces to zero, this routine will signal the waiting // event to release the waiting thread deleting the device object protected // by this lock. // // Arguments: // // DeviceObject - the device object to lock // // Tag - The TAG (if any) specified when acquiring the lock. This is used // for lock tracking purposes // // Return Value: // // none // #define IoReleaseRemoveLockAndWait(RemoveLock, Tag) \ IoReleaseRemoveLockAndWaitEx(RemoveLock, Tag, sizeof (IO_REMOVE_LOCK)) NTSYSAPI VOID NTAPI IoReleaseRemoveLockAndWaitEx( IN PIO_REMOVE_LOCK RemoveLock, IN PVOID Tag, IN ULONG RemlockSize // are we checked or free ); // // // Routine Description: // // This routine is called when the client would like to delete the // remove-locked resource. This routine will block until all the remove // locks have released. // // This routine MUST be called after acquiring the lock. // // Arguments: // // RemoveLock // // Return Value: // // none // // end_ntddk end_wdm end_ntosp NTKERNELAPI VOID IoShutdownSystem( IN ULONG Phase ); // begin_ntddk begin_wdm begin_nthal begin_ntifs begin_ntosp //++ // // USHORT // IoSizeOfIrp( // IN CCHAR StackSize // ) // // Routine Description: // // Determines the size of an IRP given the number of stack locations // the IRP will have. // // Arguments: // // StackSize - Number of stack locations for the IRP. // // Return Value: // // Size in bytes of the IRP. // //-- #define IoSizeOfIrp( StackSize ) \ ((USHORT) (sizeof( IRP ) + ((StackSize) * (sizeof( IO_STACK_LOCATION ))))) // end_ntifs NTKERNELAPI VOID IoStartNextPacket( IN PDEVICE_OBJECT DeviceObject, IN BOOLEAN Cancelable ); NTKERNELAPI VOID IoStartNextPacketByKey( IN PDEVICE_OBJECT DeviceObject, IN BOOLEAN Cancelable, IN ULONG Key ); NTKERNELAPI VOID IoStartPacket( IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp, IN PULONG Key OPTIONAL, IN PDRIVER_CANCEL CancelFunction OPTIONAL ); VOID IoSetStartIoAttributes( IN PDEVICE_OBJECT DeviceObject, IN BOOLEAN DeferredStartIo, IN BOOLEAN NonCancelable ); // begin_ntifs NTKERNELAPI VOID IoStartTimer( IN PDEVICE_OBJECT DeviceObject ); NTKERNELAPI VOID IoStopTimer( IN PDEVICE_OBJECT DeviceObject ); // end_ntddk end_wdm end_nthal end_ntosp NTKERNELAPI NTSTATUS IoSynchronousPageWrite( IN PFILE_OBJECT FileObject, IN PMDL MemoryDescriptorList, IN PLARGE_INTEGER StartingOffset, IN PKEVENT Event, OUT PIO_STATUS_BLOCK IoStatusBlock ); // begin_ntosp NTKERNELAPI PEPROCESS IoThreadToProcess( IN PETHREAD Thread ); // end_ntosp NTKERNELAPI VOID IoUnregisterFileSystem( IN OUT PDEVICE_OBJECT DeviceObject ); NTKERNELAPI VOID IoUnregisterFsRegistrationChange( IN PDRIVER_OBJECT DriverObject, IN PDRIVER_FS_NOTIFICATION DriverNotificationRoutine ); // begin_ntddk begin_wdm begin_nthal begin_ntosp NTKERNELAPI VOID IoUnregisterShutdownNotification( IN PDEVICE_OBJECT DeviceObject ); // end_wdm NTKERNELAPI VOID IoUpdateShareAccess( IN PFILE_OBJECT FileObject, IN OUT PSHARE_ACCESS ShareAccess ); // end_ntddk end_nthal NTKERNELAPI NTSTATUS IoVerifyVolume( IN PDEVICE_OBJECT DeviceObject, IN BOOLEAN AllowRawMount ); NTKERNELAPI // ntddk wdm nthal VOID // ntddk wdm nthal IoWriteErrorLogEntry( // ntddk wdm nthal IN PVOID ElEntry // ntddk wdm nthal ); // ntddk wdm nthal // end_ntifs end_ntosp typedef BOOLEAN (*PIO_TRAVERSE_WORKER)( IN ULONG Level, IN PVOID DeviceNode, IN PDEVICE_OBJECT DeviceObject, IN PVOID Context ); typedef BOOLEAN (*PIO_LEVEL_END_WORKER)( IN ULONG Level, IN PVOID Context ); // // Used by PO to traverse DevNode tree // VOID IoTraverseDeviceTree( IN BOOLEAN Inverted, IN LONG CurrentLevel, IN PIO_TRAVERSE_WORKER WorkerFunction, IN PIO_LEVEL_END_WORKER LevelEndFunction, IN PVOID Context ); // begin_nthal begin_ntosp NTKERNELAPI NTSTATUS IoCreateDriver ( IN PUNICODE_STRING DriverName, OPTIONAL IN PDRIVER_INITIALIZE InitializationFunction ); NTKERNELAPI VOID IoDeleteDriver ( IN PDRIVER_OBJECT DriverObject ); // end_nthal end_ntosp #define _WMIKM_ // // This defines the codes used to define what a request must do // typedef enum tagWMIACTIONCODE { WmiGetAllData = IRP_MN_QUERY_ALL_DATA, WmiGetSingleInstance = IRP_MN_QUERY_SINGLE_INSTANCE, WmiChangeSingleInstance = IRP_MN_CHANGE_SINGLE_INSTANCE, WmiChangeSingleItem = IRP_MN_CHANGE_SINGLE_ITEM, WmiEnableEvents = IRP_MN_ENABLE_EVENTS, WmiDisableEvents = IRP_MN_DISABLE_EVENTS, WmiEnableCollection = IRP_MN_ENABLE_COLLECTION, WmiDisableCollection = IRP_MN_DISABLE_COLLECTION, WmiRegisterInfo = IRP_MN_REGINFO, WmiExecuteMethodCall = IRP_MN_EXECUTE_METHOD } WMIACTIONCODE; // // This is the prototype for the callback WMI will make to a data provider // typedef NTSTATUS (*WMIENTRY)( IN WMIACTIONCODE ActionCode, IN PVOID DataPath, IN ULONG BufferSize, IN OUT PVOID Buffer, IN PVOID Context, OUT PULONG Size ); #define WMIREG_FLAG_CALLBACK 0x80000000 // begin_wmikm // // The following is set for a KM provider who is considered private to // kernel tracing // #define WMIREG_FLAG_TRACE_PROVIDER 0x00010000 // // The following mask is to extract the trace callout class // #define WMIREG_FLAG_TRACE_NOTIFY_MASK 0x00F00000 // // We use 4 bits for the trace callout classes. // #define WMIREG_NOTIFY_DISK_IO 1 << 20 #define WMIREG_NOTIFY_TDI_IO 2 << 20 // end_wmikm // begin_ntddk begin_wdm begin_ntifs begin_ntosp begin_ntosp typedef struct _IO_WORKITEM *PIO_WORKITEM; typedef VOID (*PIO_WORKITEM_ROUTINE) ( IN PDEVICE_OBJECT DeviceObject, IN PVOID Context ); PIO_WORKITEM IoAllocateWorkItem( PDEVICE_OBJECT DeviceObject ); VOID IoFreeWorkItem( PIO_WORKITEM IoWorkItem ); VOID IoQueueWorkItem( IN PIO_WORKITEM IoWorkItem, IN PIO_WORKITEM_ROUTINE WorkerRoutine, IN WORK_QUEUE_TYPE QueueType, IN PVOID Context ); NTKERNELAPI NTSTATUS IoWMIRegistrationControl( IN PDEVICE_OBJECT DeviceObject, IN ULONG Action ); // // Action code for IoWMIRegistrationControl api // #define WMIREG_ACTION_REGISTER 1 #define WMIREG_ACTION_DEREGISTER 2 #define WMIREG_ACTION_REREGISTER 3 #define WMIREG_ACTION_UPDATE_GUIDS 4 #define WMIREG_ACTION_BLOCK_IRPS 5 // // Code passed in IRP_MN_REGINFO WMI irp // #define WMIREGISTER 0 #define WMIUPDATE 1 NTKERNELAPI NTSTATUS IoWMIAllocateInstanceIds( IN GUID *Guid, IN ULONG InstanceCount, OUT ULONG *FirstInstanceId ); NTKERNELAPI NTSTATUS IoWMISuggestInstanceName( IN PDEVICE_OBJECT PhysicalDeviceObject OPTIONAL, IN PUNICODE_STRING SymbolicLinkName OPTIONAL, IN BOOLEAN CombineNames, OUT PUNICODE_STRING SuggestedInstanceName ); NTKERNELAPI NTSTATUS IoWMIWriteEvent( IN PVOID WnodeEventItem ); #if defined(_WIN64) NTKERNELAPI ULONG IoWMIDeviceObjectToProviderId( PDEVICE_OBJECT DeviceObject ); #else #define IoWMIDeviceObjectToProviderId(DeviceObject) ((ULONG)(DeviceObject)) #endif NTKERNELAPI NTSTATUS IoWMIOpenBlock( IN GUID *DataBlockGuid, IN ULONG DesiredAccess, OUT PVOID *DataBlockObject ); NTKERNELAPI NTSTATUS IoWMIQueryAllData( IN PVOID DataBlockObject, IN OUT ULONG *InOutBufferSize, OUT /* non paged */ PVOID OutBuffer ); NTKERNELAPI NTSTATUS IoWMIQueryAllDataMultiple( IN PVOID *DataBlockObjectList, IN ULONG ObjectCount, IN OUT ULONG *InOutBufferSize, OUT /* non paged */ PVOID OutBuffer ); NTKERNELAPI NTSTATUS IoWMIQuerySingleInstance( IN PVOID DataBlockObject, IN PUNICODE_STRING InstanceName, IN OUT ULONG *InOutBufferSize, OUT /* non paged */ PVOID OutBuffer ); NTKERNELAPI NTSTATUS IoWMIQuerySingleInstanceMultiple( IN PVOID *DataBlockObjectList, IN PUNICODE_STRING InstanceNames, IN ULONG ObjectCount, IN OUT ULONG *InOutBufferSize, OUT /* non paged */ PVOID OutBuffer ); NTKERNELAPI NTSTATUS IoWMISetSingleInstance( IN PVOID DataBlockObject, IN PUNICODE_STRING InstanceName, IN ULONG Version, IN ULONG ValueBufferSize, IN PVOID ValueBuffer ); NTKERNELAPI NTSTATUS IoWMISetSingleItem( IN PVOID DataBlockObject, IN PUNICODE_STRING InstanceName, IN ULONG DataItemId, IN ULONG Version, IN ULONG ValueBufferSize, IN PVOID ValueBuffer ); NTKERNELAPI NTSTATUS IoWMIExecuteMethod( IN PVOID DataBlockObject, IN PUNICODE_STRING InstanceName, IN ULONG MethodId, IN ULONG InBufferSize, IN OUT PULONG OutBufferSize, IN OUT PUCHAR InOutBuffer ); typedef VOID (*WMI_NOTIFICATION_CALLBACK)( PVOID Wnode, PVOID Context ); NTKERNELAPI NTSTATUS IoWMISetNotificationCallback( IN PVOID Object, IN WMI_NOTIFICATION_CALLBACK Callback, IN PVOID Context ); NTKERNELAPI NTSTATUS IoWMIHandleToInstanceName( IN PVOID DataBlockObject, IN HANDLE FileHandle, OUT PUNICODE_STRING InstanceName ); NTKERNELAPI NTSTATUS IoWMIDeviceObjectToInstanceName( IN PVOID DataBlockObject, IN PDEVICE_OBJECT DeviceObject, OUT PUNICODE_STRING InstanceName ); // end_ntddk end_wdm end_ntifs end_ntosp NTKERNELAPI BOOLEAN WMIInitialize( ULONG Phase, PVOID LoaderBlock ); // // IoRemoteBootClient indicates whether the system was booted as a remote // boot client. // extern BOOLEAN IoRemoteBootClient; #if defined(REMOTE_BOOT) extern BOOLEAN IoCscInitializationFailed; #endif // defined(REMOTE_BOOT) // Used to convert a handle to a device stack. NTSTATUS IoGetRelatedTargetDevice( IN PFILE_OBJECT FileObject, OUT PDEVICE_OBJECT *DeviceObject ); // begin_ntosp NTKERNELAPI NTSTATUS IoSetIoCompletion ( IN PVOID IoCompletion, IN PVOID KeyContext, IN PVOID ApcContext, IN NTSTATUS IoStatus, IN ULONG_PTR IoStatusInformation, IN BOOLEAN Quota ); // end_ntosp // // Safeboot definitions - placeholder until a home can be found. // typedef struct _BOOT_LOG_RECORD { UNICODE_STRING LoadedString; UNICODE_STRING NotLoadedString; UNICODE_STRING LogFileName; UNICODE_STRING HeaderString; ERESOURCE Resource; ULONG NextKey; BOOLEAN FileLogging; } BOOT_LOG_RECORD, *PBOOT_LOG_RECORD; VOID IopCopyBootLogRegistryToFile( VOID ); VOID IopInitializeBootLogging( PLOADER_PARAMETER_BLOCK LoaderBlock, PCHAR HeaderString ); VOID IopBootLog( PUNICODE_STRING LogEntry, BOOLEAN Loaded ); NTSTATUS IopSetRegistryStringValue( IN HANDLE KeyHandle, IN PUNICODE_STRING ValueName, IN PUNICODE_STRING ValueData ); NTKERNELAPI NTSTATUS IoGetRequestorSessionId( IN PIRP Irp, OUT PULONG pSessionId ); NTSTATUS IoShutdownPnpDevices( VOID ); VOID IovFreeIrp( IN PIRP Irp ); PIRP IovAllocateIrp( IN CCHAR StackSize, IN BOOLEAN ChargeQuota ); VOID IoVerifierInit( IN ULONG VerifierFlags ); NTSTATUS FASTCALL IovCallDriver( IN PDEVICE_OBJECT DeviceObject, IN OUT PIRP Irp ); VOID FASTCALL IovCompleteRequest( IN PIRP Irp, IN CCHAR PriorityBoost ); PIRP IovBuildAsynchronousFsdRequest( IN ULONG MajorFunction, IN PDEVICE_OBJECT DeviceObject, IN OUT PVOID Buffer OPTIONAL, IN ULONG Length OPTIONAL, IN PLARGE_INTEGER StartingOffset OPTIONAL, IN PIO_STATUS_BLOCK IoStatusBlock OPTIONAL ); PIRP IovBuildDeviceIoControlRequest( IN ULONG IoControlCode, IN PDEVICE_OBJECT DeviceObject, IN PVOID InputBuffer OPTIONAL, IN ULONG InputBufferLength, OUT PVOID OutputBuffer OPTIONAL, IN ULONG OutputBufferLength, IN BOOLEAN InternalDeviceIoControl, IN PKEVENT Event, OUT PIO_STATUS_BLOCK IoStatusBlock ); NTSTATUS IovInitializeTimer( IN PDEVICE_OBJECT DeviceObject, IN PIO_TIMER_ROUTINE TimerRoutine, IN PVOID Context ); NTKERNELAPI PVOID IoAllocateGenericErrorLogEntry( IN UCHAR EntrySize ); VOID IoRetryIrpCompletions( VOID ); // begin_ntddk begin_wdm begin_ntifs begin_ntosp #if defined(_WIN64) BOOLEAN IoIs32bitProcess( IN PIRP Irp ); #endif // end_ntddk end_wdm end_ntifs end_ntosp // begin_ntosp NTKERNELAPI VOID FASTCALL IoAssignDriveLetters( PLOADER_PARAMETER_BLOCK LoaderBlock, PSTRING NtDeviceName, OUT PUCHAR NtSystemPath, OUT PSTRING NtSystemPathString ); // end_ntosp // begin_ntddk NTKERNELAPI VOID FASTCALL HalExamineMBR( IN PDEVICE_OBJECT DeviceObject, IN ULONG SectorSize, IN ULONG MBRTypeIdentifier, OUT PVOID *Buffer ); DECLSPEC_DEPRECATED_DDK // Use IoReadPartitionTableEx NTKERNELAPI NTSTATUS FASTCALL IoReadPartitionTable( IN PDEVICE_OBJECT DeviceObject, IN ULONG SectorSize, IN BOOLEAN ReturnRecognizedPartitions, OUT struct _DRIVE_LAYOUT_INFORMATION **PartitionBuffer ); DECLSPEC_DEPRECATED_DDK // Use IoSetPartitionInformationEx NTKERNELAPI NTSTATUS FASTCALL IoSetPartitionInformation( IN PDEVICE_OBJECT DeviceObject, IN ULONG SectorSize, IN ULONG PartitionNumber, IN ULONG PartitionType ); // begin_ntosp DECLSPEC_DEPRECATED_DDK // Use IoWritePartitionTableEx NTKERNELAPI NTSTATUS FASTCALL IoWritePartitionTable( IN PDEVICE_OBJECT DeviceObject, IN ULONG SectorSize, IN ULONG SectorsPerTrack, IN ULONG NumberOfHeads, IN struct _DRIVE_LAYOUT_INFORMATION *PartitionBuffer ); NTKERNELAPI NTSTATUS IoCreateDisk( IN PDEVICE_OBJECT DeviceObject, IN struct _CREATE_DISK* Disk ); NTKERNELAPI NTSTATUS IoReadPartitionTableEx( IN PDEVICE_OBJECT DeviceObject, IN struct _DRIVE_LAYOUT_INFORMATION_EX** DriveLayout ); NTKERNELAPI NTSTATUS IoWritePartitionTableEx( IN PDEVICE_OBJECT DeviceObject, IN struct _DRIVE_LAYOUT_INFORMATION_EX* DriveLayout ); NTKERNELAPI NTSTATUS IoSetPartitionInformationEx( IN PDEVICE_OBJECT DeviceObject, IN ULONG PartitionNumber, IN struct _SET_PARTITION_INFORMATION_EX* PartitionInfo ); NTKERNELAPI NTSTATUS IoUpdateDiskGeometry( IN PDEVICE_OBJECT DeviceObject, IN struct _DISK_GEOMETRY_EX* OldDiskGeometry, IN struct _DISK_GEOMETRY_EX* NewDiskGeometry ); NTKERNELAPI NTSTATUS IoVerifyPartitionTable( IN PDEVICE_OBJECT DeviceObject, IN BOOLEAN FixErrors ); typedef struct _DISK_SIGNATURE { ULONG PartitionStyle; union { struct { ULONG Signature; ULONG CheckSum; } Mbr; struct { GUID DiskId; } Gpt; }; } DISK_SIGNATURE, *PDISK_SIGNATURE; NTKERNELAPI NTSTATUS IoReadDiskSignature( IN PDEVICE_OBJECT DeviceObject, IN ULONG BytesPerSector, OUT PDISK_SIGNATURE Signature ); // end_ntosp // end_ntddk // begin_ntosp begin_ntifs begin_ntddk NTSTATUS IoVolumeDeviceToDosName( IN PVOID VolumeDeviceObject, OUT PUNICODE_STRING DosName ); // end_ntosp end_ntifs end_ntddk // begin_ntosp begin_ntifs NTSTATUS IoEnumerateDeviceObjectList( IN PDRIVER_OBJECT DriverObject, IN PDEVICE_OBJECT *DeviceObjectList, IN ULONG DeviceObjectListSize, OUT PULONG ActualNumberDeviceObjects ); PDEVICE_OBJECT IoGetLowerDeviceObject( IN PDEVICE_OBJECT DeviceObject ); PDEVICE_OBJECT IoGetDeviceAttachmentBaseRef( IN PDEVICE_OBJECT DeviceObject ); NTSTATUS IoGetDiskDeviceObject( IN PDEVICE_OBJECT FileSystemDeviceObject, OUT PDEVICE_OBJECT *DiskDeviceObject ); // end_ntosp end_ntifs // begin_ntosp begin_ntifs begin_ntddk NTSTATUS IoSetSystemPartition( PUNICODE_STRING VolumeNameString ); // begin_wdm VOID IoFreeErrorLogEntry( PVOID ElEntry ); // Cancel SAFE API set start // // The following APIs are to help ease the pain of writing queue packages that // handle the cancellation race well. The idea of this set of APIs is to not // force a single queue data structure but allow the cancel logic to be hidden // from the drivers. A driver implements a queue and as part of its header // includes the IO_CSQ structure. In its initialization routine it calls // IoInitializeCsq. Then in the dispatch routine when the driver wants to // insert an IRP into the queue it calls IoCsqInsertIrp. When the driver wants // to remove something from the queue it calls IoCsqRemoveIrp. Note that Insert // can fail if the IRP was cancelled in the meantime. Remove can also fail if // the IRP was already cancelled. // // There are typically two modes where drivers queue IRPs. These two modes are // covered by the cancel safe queue API set. // // Mode 1: // One is where the driver queues the IRP and at some later // point in time dequeues an IRP and issues the IO request. // For this mode the driver should use IoCsqInsertIrp and IoCsqRemoveNextIrp. // The driver in this case is expected to pass NULL to the irp context // parameter in IoInsertIrp. // // Mode 2: // In this the driver queues theIRP, issues the IO request (like issuing a DMA // request or writing to a register) and when the IO request completes (either // using a DPC or timer) the driver dequeues the IRP and completes it. For this // mode the driver should use IoCsqInsertIrp and IoCsqRemoveIrp. In this case // the driver should allocate an IRP context and pass it in to IoCsqInsertIrp. // The cancel API code creates an association between the IRP and the context // and thus ensures that when the time comes to remove the IRP it can ascertain // correctly. // // Note that the cancel API set assumes that the field DriverContext[3] is // always available for use and that the driver does not use it. // // // Bookkeeping structure. This should be opaque to drivers. // Drivers typically include this as part of their queue headers. // Given a CSQ pointer the driver should be able to get its // queue header using CONTAINING_RECORD macro // typedef struct _IO_CSQ IO_CSQ, *PIO_CSQ; #define IO_TYPE_CSQ_IRP_CONTEXT 1 #define IO_TYPE_CSQ 2 // // IRP context structure. This structure is necessary if the driver is using // the second mode. // typedef struct _IO_CSQ_IRP_CONTEXT { ULONG Type; PIRP Irp; PIO_CSQ Csq; } IO_CSQ_IRP_CONTEXT, *PIO_CSQ_IRP_CONTEXT; // // Routines that insert/remove IRP // typedef VOID (*PIO_CSQ_INSERT_IRP)( IN struct _IO_CSQ *Csq, IN PIRP Irp ); typedef VOID (*PIO_CSQ_REMOVE_IRP)( IN PIO_CSQ Csq, IN PIRP Irp ); // // Retrieves next entry after Irp from the queue. // Returns NULL if there are no entries in the queue. // If Irp is NUL, returns the entry in the head of the queue. // This routine does not remove the IRP from the queue. // typedef PIRP (*PIO_CSQ_PEEK_NEXT_IRP)( IN PIO_CSQ Csq, IN PIRP Irp, IN PVOID PeekContext ); // // Lock routine that protects the cancel safe queue. // typedef VOID (*PIO_CSQ_ACQUIRE_LOCK)( IN PIO_CSQ Csq, OUT PKIRQL Irql ); typedef VOID (*PIO_CSQ_RELEASE_LOCK)( IN PIO_CSQ Csq, IN KIRQL Irql ); // // Completes the IRP with STATUS_CANCELLED. IRP is guaranteed to be valid // In most cases this routine just calls IoCompleteRequest(Irp, STATUS_CANCELLED); // typedef VOID (*PIO_CSQ_COMPLETE_CANCELED_IRP)( IN PIO_CSQ Csq, IN PIRP Irp ); // // Bookkeeping structure. This should be opaque to drivers. // Drivers typically include this as part of their queue headers. // Given a CSQ pointer the driver should be able to get its // queue header using CONTAINING_RECORD macro // typedef struct _IO_CSQ { ULONG Type; PIO_CSQ_INSERT_IRP CsqInsertIrp; PIO_CSQ_REMOVE_IRP CsqRemoveIrp; PIO_CSQ_PEEK_NEXT_IRP CsqPeekNextIrp; PIO_CSQ_ACQUIRE_LOCK CsqAcquireLock; PIO_CSQ_RELEASE_LOCK CsqReleaseLock; PIO_CSQ_COMPLETE_CANCELED_IRP CsqCompleteCanceledIrp; PVOID ReservePointer; // Future expansion } IO_CSQ, *PIO_CSQ; // // Initializes the cancel queue structure. // NTSTATUS IoCsqInitialize( IN PIO_CSQ Csq, IN PIO_CSQ_INSERT_IRP CsqInsertIrp, IN PIO_CSQ_REMOVE_IRP CsqRemoveIrp, IN PIO_CSQ_PEEK_NEXT_IRP CsqPeekNextIrp, IN PIO_CSQ_ACQUIRE_LOCK CsqAcquireLock, IN PIO_CSQ_RELEASE_LOCK CsqReleaseLock, IN PIO_CSQ_COMPLETE_CANCELED_IRP CsqCompleteCanceledIrp ); // // The caller calls this routine to insert the IRP and return STATUS_PENDING. // VOID IoCsqInsertIrp( IN PIO_CSQ Csq, IN PIRP Irp, IN PIO_CSQ_IRP_CONTEXT Context ); // // Returns an IRP if one can be found. NULL otherwise. // PIRP IoCsqRemoveNextIrp( IN PIO_CSQ Csq, IN PVOID PeekContext ); // // This routine is called from timeout or DPCs. // The context is presumably part of the DPC or timer context. // If succesfull returns the IRP associated with context. // PIRP IoCsqRemoveIrp( IN PIO_CSQ Csq, IN PIO_CSQ_IRP_CONTEXT Context ); // Cancel SAFE API set end // end_ntosp end_ntifs end_ntddk end_wdm // begin_ntosp begin_ntifs NTSTATUS IoCreateFileSpecifyDeviceObjectHint( OUT PHANDLE FileHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes, OUT PIO_STATUS_BLOCK IoStatusBlock, IN PLARGE_INTEGER AllocationSize OPTIONAL, IN ULONG FileAttributes, IN ULONG ShareAccess, IN ULONG Disposition, IN ULONG CreateOptions, IN PVOID EaBuffer OPTIONAL, IN ULONG EaLength, IN CREATE_FILE_TYPE CreateFileType, IN PVOID ExtraCreateParameters OPTIONAL, IN ULONG Options, IN PVOID DeviceObject ); NTSTATUS IoAttachDeviceToDeviceStackSafe( IN PDEVICE_OBJECT SourceDevice, IN PDEVICE_OBJECT TargetDevice, OUT PDEVICE_OBJECT *AttachedToDeviceObject ); // end_ntosp NTKERNELAPI BOOLEAN IoIsFileOriginRemote( IN PFILE_OBJECT FileObject ); NTKERNELAPI NTSTATUS IoSetFileOrigin( IN PFILE_OBJECT FileObject, IN BOOLEAN Remote ); // end_ntifs PVOID IoGetFileObjectFilterContext( IN PFILE_OBJECT FileObject ); NTSTATUS IoChangeFileObjectFilterContext( IN PFILE_OBJECT FileObject, IN PVOID FilterContext, IN BOOLEAN Set ); BOOLEAN IoIsDeviceEjectable( IN PDEVICE_OBJECT ); NTSTATUS IoComputeDesiredAccessFileObject( IN PFILE_OBJECT FileObject, OUT PNTSTATUS DesiredAccess ); // begin_ntosp begin_ntifs begin_ntddk NTSTATUS IoValidateDeviceIoControlAccess( IN PIRP Irp, IN ULONG RequiredAccess ); // end_ntosp end_ntifs end_ntddk end_wdm #endif // _IO_