_FSRTL_ADVANCED_FCB_HEADER structure

The FSRTL_ADVANCED_FCB_HEADER structure contains context information that a file system maintains about a file.

Syntax

typedef struct _FSRTL_ADVANCED_FCB_HEADER {
  struct {
    FSRTL_COMMON_FCB_HEADER DUMMYSTRUCTNAME;
    PFAST_MUTEX             FastMutex;
    LIST_ENTRY              FilterContexts;
    EX_PUSH_LOCK            PushLock;
    PVOID                   *FileContextSupportPointer;
    union {
      OPLOCK Oplock;
      PVOID  ReservedForRemote;
    };
    PVOID                   ReservedContext;
  } _FSRTL_ADVANCED_FCB_HEADER;
  struct {
    LIST_ENTRY EofWaitLinks;
    KEVENT     Event;
  } _EOF_WAIT_BLOCK;
  NTKERNELAPI BOOLEAN         FsRtlCopyRead( PFILE_OBJECT     FileObject, PLARGE_INTEGER   FileOffset, ULONG            Length, BOOLEAN          Wait, ULONG            LockKey, PVOID            Buffer, PIO_STATUS_BLOCK IoStatus, PDEVICE_OBJECT   DeviceObject);
  NTKERNELAPI BOOLEAN         FsRtlCopyWrite( PFILE_OBJECT     FileObject, PLARGE_INTEGER   FileOffset, ULONG            Length, BOOLEAN          Wait, ULONG            LockKey, PVOID            Buffer, PIO_STATUS_BLOCK IoStatus, PDEVICE_OBJECT   DeviceObject);
  NTSTATUS                    FsRtlMdlReadEx( PFILE_OBJECT     FileObject, PLARGE_INTEGER   FileOffset, ULONG            Length, ULONG            LockKey, PMDL             *MdlChain, PIO_STATUS_BLOCK IoStatus);
  NTKERNELAPI BOOLEAN         FsRtlMdlReadDev( PFILE_OBJECT     FileObject, PLARGE_INTEGER   FileOffset, ULONG            Length, ULONG            LockKey, PMDL             *MdlChain, PIO_STATUS_BLOCK IoStatus, PDEVICE_OBJECT   DeviceObject);
  NTKERNELAPI BOOLEAN         FsRtlMdlReadCompleteDev( PFILE_OBJECT   FileObject, PMDL           MdlChain, PDEVICE_OBJECT DeviceObject);
  NTSTATUS                    FsRtlPrepareMdlWriteEx( PFILE_OBJECT     FileObject, PLARGE_INTEGER   FileOffset, ULONG            Length, ULONG            LockKey, PMDL             *MdlChain, PIO_STATUS_BLOCK IoStatus);
  NTKERNELAPI BOOLEAN         FsRtlPrepareMdlWriteDev( PFILE_OBJECT     FileObject, PLARGE_INTEGER   FileOffset, ULONG            Length, ULONG            LockKey, PMDL             *MdlChain, PIO_STATUS_BLOCK IoStatus, PDEVICE_OBJECT   DeviceObject);
  NTKERNELAPI BOOLEAN         FsRtlMdlWriteCompleteDev( PFILE_OBJECT   FileObject, PLARGE_INTEGER FileOffset, PMDL           MdlChain, PDEVICE_OBJECT DeviceObject);
  struct {
    PVOID Buffer;
    ULONG Length;
    ULONG Flags;
    PMDL  Mdl;
  } _FSRTL_AUXILIARY_BUFFER;
  NTKERNELAPI VOID            FsRtlAcquireFileExclusive( PFILE_OBJECT FileObject);
  NTKERNELAPI VOID            FsRtlReleaseFile( PFILE_OBJECT FileObject);
  NTSTATUS                    FsRtlGetFileSize( PFILE_OBJECT   FileObject, PLARGE_INTEGER FileSize);
  NTKERNELAPI BOOLEAN         FsRtlIsTotalDeviceFailure( NTSTATUS Status);
  struct {
    LARGE_INTEGER StartingByte;
    LARGE_INTEGER Length;
    BOOLEAN       ExclusiveLock;
    ULONG         Key;
    PFILE_OBJECT  FileObject;
    PVOID         ProcessId;
    LARGE_INTEGER EndingByte;
  } _FILE_LOCK_INFO;
  struct {
    PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine;
    PUNLOCK_ROUTINE            UnlockRoutine;
    BOOLEAN                    FastIoIsQuestionable;
    BOOLEAN                    SpareC[3];
    PVOID                      LockInformation;
    FILE_LOCK_INFO             LastReturnedLockInfo;
    PVOID                      LastReturnedLock;
    LONG                       LockRequestsInProgress;
  } _FILE_LOCK;
  NTKERNELAPI PFILE_LOCK      FsRtlAllocateFileLock( PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine, PUNLOCK_ROUTINE            UnlockRoutine);
  NTKERNELAPI VOID            FsRtlFreeFileLock( PFILE_LOCK FileLock);
  NTKERNELAPI VOID            FsRtlInitializeFileLock( PFILE_LOCK                 FileLock, PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine, PUNLOCK_ROUTINE            UnlockRoutine);
  NTKERNELAPI VOID            FsRtlUninitializeFileLock( PFILE_LOCK FileLock);
  NTKERNELAPI NTSTATUS        FsRtlProcessFileLock( PFILE_LOCK FileLock, PIRP       Irp, PVOID      Context);
  NTKERNELAPI BOOLEAN         FsRtlCheckLockForReadAccess( PFILE_LOCK FileLock, PIRP       Irp);
  NTKERNELAPI BOOLEAN         FsRtlCheckLockForWriteAccess( PFILE_LOCK FileLock, PIRP       Irp);
  NTKERNELAPI BOOLEAN         FsRtlCheckLockForOplockRequest( PFILE_LOCK     FileLock, PLARGE_INTEGER AllocationSize);
  NTKERNELAPI BOOLEAN         FsRtlFastCheckLockForRead( PFILE_LOCK     FileLock, PLARGE_INTEGER StartingByte, PLARGE_INTEGER Length, ULONG          Key, PFILE_OBJECT   FileObject, PVOID          ProcessId);
  NTKERNELAPI BOOLEAN         FsRtlFastCheckLockForWrite( PFILE_LOCK     FileLock, PLARGE_INTEGER StartingByte, PLARGE_INTEGER Length, ULONG          Key, PVOID          FileObject, PVOID          ProcessId);
  NTKERNELAPI PFILE_LOCK_INFO FsRtlGetNextFileLock( PFILE_LOCK FileLock, BOOLEAN    Restart);
  NTKERNELAPI BOOLEAN         FsRtlAreThereCurrentOrInProgressFileLocks( PFILE_LOCK FileLock);
  NTKERNELAPI BOOLEAN         FsRtlAreThereWaitingFileLocks( PFILE_LOCK FileLock);
  NTKERNELAPI NTSTATUS        FsRtlFastUnlockSingle( PFILE_LOCK     FileLock, PFILE_OBJECT   FileObject, LARGE_INTEGER  *FileOffset, PLARGE_INTEGER Length, PEPROCESS      ProcessId, ULONG          Key, PVOID          Context, BOOLEAN        AlreadySynchronized);
  NTKERNELAPI NTSTATUS        FsRtlFastUnlockAll( PFILE_LOCK   FileLock, PFILE_OBJECT FileObject, PEPROCESS    ProcessId, PVOID        Context);
  NTKERNELAPI NTSTATUS        FsRtlFastUnlockAllByKey( PFILE_LOCK   FileLock, PFILE_OBJECT FileObject, PEPROCESS    ProcessId, ULONG        Key, PVOID        Context);
  NTKERNELAPI BOOLEAN         FsRtlPrivateLock( PFILE_LOCK             FileLock, PFILE_OBJECT           FileObject, PLARGE_INTEGER         FileOffset, PLARGE_INTEGER         Length, PEPROCESS              ProcessId, ULONG                  Key, BOOLEAN                FailImmediately, BOOLEAN                ExclusiveLock, PIO_STATUS_BLOCK       Iosb, PIRP                   Irp, __drv_aliasesMem PVOID Context, BOOLEAN                AlreadySynchronized);
  struct {
    FAST_MUTEX       Mutex;
    PRTL_SPLAY_LINKS Cache;
    LIST_ENTRY       TimerQueue;
    USHORT           NumEntries;
  };
  NTKERNELAPI VOID            FsRtlInitializeTunnelCache( TUNNEL *Cache);
  NTKERNELAPI VOID            FsRtlAddToTunnelCache( TUNNEL         *Cache, ULONGLONG      DirectoryKey, UNICODE_STRING *ShortName, UNICODE_STRING *LongName, BOOLEAN        KeyByShortName, ULONG          DataLength, VOID           *Data);
  NTKERNELAPI BOOLEAN         FsRtlFindInTunnelCache( TUNNEL         *Cache, ULONGLONG      DirectoryKey, UNICODE_STRING *Name, UNICODE_STRING *ShortName, UNICODE_STRING *LongName, ULONG          *DataLength, VOID           *Data);
  NTKERNELAPI VOID            FsRtlDeleteKeyFromTunnelCache( TUNNEL    *Cache, ULONGLONG DirectoryKey);
  NTKERNELAPI VOID            FsRtlDeleteTunnelCache( TUNNEL *Cache);
  UCHAR const                 *LEGAL_ANSI_CHARACTER_ARRAY;
  PUSHORT                     NLS_OEM_LEAD_BYTE_INFO;
  NTKERNELAPI VOID            FsRtlDissectDbcs( ANSI_STRING  Path, PANSI_STRING FirstName, PANSI_STRING RemainingName);
  NTKERNELAPI BOOLEAN         FsRtlDoesDbcsContainWildCards( PANSI_STRING Name);
  NTKERNELAPI BOOLEAN         FsRtlIsDbcsInExpression( PANSI_STRING Expression, PANSI_STRING Name);
  NTKERNELAPI BOOLEAN         FsRtlIsFatDbcsLegal( ANSI_STRING DbcsName, BOOLEAN     WildCardsPermissible, BOOLEAN     PathNamePermissible, BOOLEAN     LeadingBackslashPermissible);
  NTKERNELAPI BOOLEAN         FsRtlIsHpfsDbcsLegal( ANSI_STRING DbcsName, BOOLEAN     WildCardsPermissible, BOOLEAN     PathNamePermissible, BOOLEAN     LeadingBackslashPermissible);
  NTKERNELAPI NTSTATUS        FsRtlNormalizeNtstatus( NTSTATUS Exception, NTSTATUS GenericException);
  NTKERNELAPI BOOLEAN         FsRtlIsNtstatusExpected( NTSTATUS Exception);
  NTKERNELAPI PERESOURCE      FsRtlAllocateResource( VOID );
  struct {
    ULONG  MaximumPairCount;
    ULONG  PairCount;
    USHORT PoolType;
    USHORT Flags;
    PVOID  Mapping;
  } _BASE_MCB;
  struct {
    PKGUARDED_MUTEX GuardedMutex;
    BASE_MCB        BaseMcb;
  } _LARGE_MCB;
  NTKERNELAPI VOID            FsRtlInitializeLargeMcb( PLARGE_MCB Mcb, POOL_TYPE  PoolType);
  NTKERNELAPI VOID            FsRtlUninitializeLargeMcb( PLARGE_MCB Mcb);
  NTKERNELAPI VOID            FsRtlResetLargeMcb( PLARGE_MCB Mcb, BOOLEAN    SelfSynchronized);
  NTKERNELAPI VOID            FsRtlTruncateLargeMcb( PLARGE_MCB Mcb, LONGLONG   Vbn);
  NTKERNELAPI BOOLEAN         FsRtlAddLargeMcbEntry( PLARGE_MCB Mcb, LONGLONG   Vbn, LONGLONG   Lbn, LONGLONG   SectorCount);
  NTKERNELAPI VOID            FsRtlRemoveLargeMcbEntry( PLARGE_MCB Mcb, LONGLONG   Vbn, LONGLONG   SectorCount);
  NTKERNELAPI BOOLEAN         FsRtlLookupLargeMcbEntry( PLARGE_MCB Mcb, LONGLONG   Vbn, PLONGLONG  Lbn, PLONGLONG  SectorCountFromLbn, PLONGLONG  StartingLbn, PLONGLONG  SectorCountFromStartingLbn, PULONG     Index);
  NTKERNELAPI BOOLEAN         FsRtlLookupLastLargeMcbEntry( PLARGE_MCB Mcb, PLONGLONG  Vbn, PLONGLONG  Lbn);
  NTKERNELAPI BOOLEAN         FsRtlLookupLastLargeMcbEntryAndIndex( PLARGE_MCB OpaqueMcb, PLONGLONG  LargeVbn, PLONGLONG  LargeLbn, PULONG     Index);
  NTKERNELAPI ULONG           FsRtlNumberOfRunsInLargeMcb( PLARGE_MCB Mcb);
  NTKERNELAPI BOOLEAN         FsRtlGetNextLargeMcbEntry( PLARGE_MCB Mcb, ULONG      RunIndex, PLONGLONG  Vbn, PLONGLONG  Lbn, PLONGLONG  SectorCount);
  NTKERNELAPI BOOLEAN         FsRtlSplitLargeMcb( PLARGE_MCB Mcb, LONGLONG   Vbn, LONGLONG   Amount);
  NTKERNELAPI VOID            FsRtlInitializeBaseMcb( PBASE_MCB Mcb, POOL_TYPE PoolType);
  BOOLEAN                     FsRtlInitializeBaseMcbEx( PBASE_MCB Mcb, POOL_TYPE PoolType, USHORT    Flags);
  NTKERNELAPI VOID            FsRtlUninitializeBaseMcb( PBASE_MCB Mcb);
  NTKERNELAPI VOID            FsRtlResetBaseMcb( PBASE_MCB Mcb);
  NTKERNELAPI VOID            FsRtlTruncateBaseMcb( PBASE_MCB Mcb, LONGLONG  Vbn);
  NTKERNELAPI BOOLEAN         FsRtlAddBaseMcbEntry( PBASE_MCB Mcb, LONGLONG  Vbn, LONGLONG  Lbn, LONGLONG  SectorCount);
  NTSTATUS                    FsRtlAddBaseMcbEntryEx( PBASE_MCB Mcb, LONGLONG  Vbn, LONGLONG  Lbn, LONGLONG  SectorCount);
  NTKERNELAPI BOOLEAN         FsRtlRemoveBaseMcbEntry( PBASE_MCB Mcb, LONGLONG  Vbn, LONGLONG  SectorCount);
  NTKERNELAPI BOOLEAN         FsRtlLookupBaseMcbEntry( PBASE_MCB Mcb, LONGLONG  Vbn, PLONGLONG Lbn, PLONGLONG SectorCountFromLbn, PLONGLONG StartingLbn, PLONGLONG SectorCountFromStartingLbn, PULONG    Index);
  NTKERNELAPI BOOLEAN         FsRtlLookupLastBaseMcbEntry( PBASE_MCB Mcb, PLONGLONG Vbn, PLONGLONG Lbn);
  NTKERNELAPI BOOLEAN         FsRtlLookupLastBaseMcbEntryAndIndex( PBASE_MCB OpaqueMcb, PLONGLONG LargeVbn, PLONGLONG LargeLbn, PULONG    Index);
  NTKERNELAPI ULONG           FsRtlNumberOfRunsInBaseMcb( PBASE_MCB Mcb);
  NTKERNELAPI BOOLEAN         FsRtlGetNextBaseMcbEntry( PBASE_MCB Mcb, ULONG     RunIndex, PLONGLONG Vbn, PLONGLONG Lbn, PLONGLONG SectorCount);
  NTKERNELAPI BOOLEAN         FsRtlSplitBaseMcb( PBASE_MCB Mcb, LONGLONG  Vbn, LONGLONG  Amount);
  struct {
    LARGE_MCB DummyFieldThatSizesThisStructureCorrectly;
  } _MCB;
  NTKERNELAPI VOID            FsRtlInitializeMcb( PMCB      Mcb, POOL_TYPE PoolType);
  NTKERNELAPI VOID            FsRtlUninitializeMcb( PMCB Mcb);
  NTKERNELAPI VOID            FsRtlTruncateMcb( PMCB Mcb, VBN  Vbn);
  NTKERNELAPI BOOLEAN         FsRtlAddMcbEntry( PMCB  Mcb, VBN   Vbn, LBN   Lbn, ULONG SectorCount);
  NTKERNELAPI VOID            FsRtlRemoveMcbEntry( PMCB  Mcb, VBN   Vbn, ULONG SectorCount);
  NTKERNELAPI BOOLEAN         FsRtlLookupMcbEntry( PMCB   Mcb, VBN    Vbn, PLBN   Lbn, PULONG SectorCount, PULONG Index);
  NTKERNELAPI BOOLEAN         FsRtlLookupLastMcbEntry( PMCB Mcb, PVBN Vbn, PLBN Lbn);
  NTKERNELAPI ULONG           FsRtlNumberOfRunsInMcb( PMCB Mcb);
  NTKERNELAPI BOOLEAN         FsRtlGetNextMcbEntry( PMCB   Mcb, ULONG  RunIndex, PVBN   Vbn, PLBN   Lbn, PULONG SectorCount);
  NTKERNELAPI NTSTATUS        FsRtlBalanceReads( PDEVICE_OBJECT TargetDevice);
  NTKERNELAPI VOID            FsRtlInitializeOplock( POPLOCK Oplock);
  NTKERNELAPI VOID            FsRtlUninitializeOplock( POPLOCK Oplock);
  NTKERNELAPI NTSTATUS        FsRtlOplockFsctrl( POPLOCK Oplock, PIRP    Irp, ULONG   OpenCount);
  NTKERNELAPI NTSTATUS        FsRtlCheckOplock( POPLOCK                       Oplock, PIRP                          Irp, PVOID                         Context, POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine, POPLOCK_FS_PREPOST_IRP        PostIrpRoutine);
  NTKERNELAPI NTSTATUS        FsRtlCheckOplockEx( POPLOCK                       Oplock, PIRP                          Irp, ULONG                         Flags, PVOID                         Context, POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine, POPLOCK_FS_PREPOST_IRP        PostIrpRoutine);
  NTSTATUS                    FsRtlCheckUpperOplock( POPLOCK                       Oplock, ULONG                         NewLowerOplockState, PVOID                         CompletionRoutineContext, POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine, POPLOCK_FS_PREPOST_IRP        PrePendRoutine, ULONG                         Flags);
  NTSTATUS                    FsRtlUpperOplockFsctrl( POPLOCK Oplock, PIRP    Irp, ULONG   OpenCount, ULONG   LowerOplockState, ULONG   Flags);
  NTKERNELAPI BOOLEAN         FsRtlOplockIsFastIoPossible( POPLOCK Oplock);
  NTKERNELAPI BOOLEAN         FsRtlCurrentBatchOplock( POPLOCK Oplock);
  NTKERNELAPI BOOLEAN         FsRtlCurrentOplock( POPLOCK Oplock);
  NTKERNELAPI NTSTATUS        FsRtlOplockBreakToNone( POPLOCK                       Oplock, PIO_STACK_LOCATION            IrpSp, PIRP                          Irp, PVOID                         Context, POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine, POPLOCK_FS_PREPOST_IRP        PostIrpRoutine);
  struct {
    GUID  OplockKey;
    ULONG Reserved;
  } _OPLOCK_KEY_ECP_CONTEXT;
  GUID                        GUID_ECP_OPLOCK_KEY;
  NTKERNELAPI BOOLEAN         FsRtlOplockIsSharedRequest( PIRP Irp);
  NTKERNELAPI NTSTATUS        FsRtlOplockBreakH( POPLOCK                       Oplock, PIRP                          Irp, ULONG                         Flags, PVOID                         Context, POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine, POPLOCK_FS_PREPOST_IRP        PostIrpRoutine);
  NTKERNELAPI BOOLEAN         FsRtlCurrentOplockH( POPLOCK Oplock);
  NTKERNELAPI NTSTATUS        FsRtlOplockBreakToNoneEx( POPLOCK                       Oplock, PIRP                          Irp, ULONG                         Flags, PVOID                         Context, POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine, POPLOCK_FS_PREPOST_IRP        PostIrpRoutine);
  NTKERNELAPI NTSTATUS        FsRtlOplockFsctrlEx( POPLOCK Oplock, PIRP    Irp, ULONG   OpenCount, ULONG   Flags);
  NTKERNELAPI BOOLEAN         FsRtlOplockKeysEqual( PFILE_OBJECT Fo1, PFILE_OBJECT Fo2);
  struct {
    GUID    ParentOplockKey;
    GUID    TargetOplockKey;
    BOOLEAN ParentOplockKeySet;
    BOOLEAN TargetOplockKeySet;
  } _DUAL_OPLOCK_KEY_ECP_CONTEXT;
  GUID                        GUID_ECP_DUAL_OPLOCK_KEY;
  NTKERNELAPI NTSTATUS        FsRtlNotifyVolumeEvent( PFILE_OBJECT FileObject, ULONG        EventCode);
  NTKERNELAPI NTSTATUS        FsRtlNotifyVolumeEventEx( PFILE_OBJECT                       FileObject, ULONG                              EventCode, PTARGET_DEVICE_CUSTOM_NOTIFICATION Event);
  struct                      _REAL_NOTIFY_SYNC;
  NTKERNELAPI VOID            FsRtlNotifyInitializeSync( PNOTIFY_SYNC *NotifySync);
  NTKERNELAPI VOID            FsRtlNotifyUninitializeSync( PNOTIFY_SYNC *NotifySync);
  NTKERNELAPI VOID            FsRtlNotifyFullChangeDirectory( PNOTIFY_SYNC               NotifySync, PLIST_ENTRY                NotifyList, PVOID                      FsContext, PSTRING                    FullDirectoryName, BOOLEAN                    WatchTree, BOOLEAN                    IgnoreBuffer, ULONG                      CompletionFilter, PIRP                       NotifyIrp, PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback, PSECURITY_SUBJECT_CONTEXT  SubjectContext);
  NTKERNELAPI VOID            FsRtlNotifyFilterChangeDirectory( PNOTIFY_SYNC               NotifySync, PLIST_ENTRY                NotifyList, PVOID                      FsContext, PSTRING                    FullDirectoryName, BOOLEAN                    WatchTree, BOOLEAN                    IgnoreBuffer, ULONG                      CompletionFilter, PIRP                       NotifyIrp, PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback, PSECURITY_SUBJECT_CONTEXT  SubjectContext, PFILTER_REPORT_CHANGE      FilterCallback);
  NTKERNELAPI VOID            FsRtlNotifyFilterReportChange( PNOTIFY_SYNC NotifySync, PLIST_ENTRY  NotifyList, PSTRING      FullTargetName, USHORT       TargetNameOffset, PSTRING      StreamName, PSTRING      NormalizedParentName, ULONG        FilterMatch, ULONG        Action, PVOID        TargetContext, PVOID        FilterContext);
  NTKERNELAPI VOID            FsRtlNotifyFullReportChange( PNOTIFY_SYNC NotifySync, PLIST_ENTRY  NotifyList, PSTRING      FullTargetName, USHORT       TargetNameOffset, PSTRING      StreamName, PSTRING      NormalizedParentName, ULONG        FilterMatch, ULONG        Action, PVOID        TargetContext);
  NTKERNELAPI VOID            FsRtlNotifyCleanup( PNOTIFY_SYNC NotifySync, PLIST_ENTRY  NotifyList, PVOID        FsContext);
  NTKERNELAPI VOID            FsRtlNotifyCleanupAll( PNOTIFY_SYNC NotifySync, PLIST_ENTRY  NotifyList);
  NTKERNELAPI VOID            FsRtlDissectName( UNICODE_STRING  Path, PUNICODE_STRING FirstName, PUNICODE_STRING RemainingName);
  NTKERNELAPI BOOLEAN         FsRtlDoesNameContainWildCards( PUNICODE_STRING Name);
  NTKERNELAPI BOOLEAN         FsRtlAreNamesEqual( PCUNICODE_STRING ConstantNameA, PCUNICODE_STRING ConstantNameB, BOOLEAN          IgnoreCase, PCWCH            UpcaseTable);
  NTKERNELAPI BOOLEAN         FsRtlIsNameInExpression( PUNICODE_STRING Expression, PUNICODE_STRING Name, BOOLEAN         IgnoreCase, PWCH            UpcaseTable);
  NTKERNELAPI BOOLEAN         FsRtlIsNameInUnUpcasedExpression( PUNICODE_STRING Expression, PUNICODE_STRING Name, BOOLEAN         IgnoreCase, PWCH            UpcaseTable);
  NTKERNELAPI VOID            FsRtlPostStackOverflow( PVOID                         Context, PKEVENT                       Event, PFSRTL_STACK_OVERFLOW_ROUTINE StackOverflowRoutine);
  NTKERNELAPI VOID            FsRtlPostPagingFileStackOverflow( PVOID                         Context, PKEVENT                       Event, PFSRTL_STACK_OVERFLOW_ROUTINE StackOverflowRoutine);
  NTKERNELAPI NTSTATUS        FsRtlRegisterUncProvider( PHANDLE          MupHandle, PCUNICODE_STRING RedirectorDeviceName, BOOLEAN          MailslotsSupported);
  NTSTATUS                    FsRtlRegisterUncProviderEx( PHANDLE                  MupHandle, PCUNICODE_STRING         RedirDevName, PDEVICE_OBJECT           DeviceObject, FSRTL_UNC_PROVIDER_FLAGS Flags);
  USHORT                      Version;
  union {
    FSRTL_UNC_PROVIDER_FLAGS ProviderFlags;
    struct {
      ULONG MailslotsSupported : 1;
      ULONG CscEnabled : 1;
      ULONG DomainSvcAware : 1;
      ULONG ContainersAware : 1;
    } DUMMYSTRUCTNAME;
  } DUMMYUNIONNAME;
  union {
    FSRTL_UNC_HARDENING_CAPABILITIES HardeningCapabilities;
    struct {
      ULONG SupportsMutualAuth : 1;
      ULONG SupportsIntegrity : 1;
      ULONG SupportsPrivacy : 1;
    } DUMMYSTRUCTNAME;
  } DUMMYUNIONNAME2;
  base_class                  FSRTL_COMMON_FCB_HEADER;
} FSRTL_ADVANCED_FCB_HEADER, FSRTL_UNC_PROVIDER_REGISTRATION, *PFSRTL_UNC_PROVIDER_REGISTRATION;

Members

NTKERNELAPI BOOLEAN FsRtlCopyRead( PFILE_OBJECT FileObject, PLARGE_INTEGER FileOffset, ULONG Length, BOOLEAN Wait, ULONG LockKey, PVOID Buffer, PIO_STATUS_BLOCK IoStatus, PDEVICE_OBJECT DeviceObject )

The FsRtlCopyRead routine copies data from a cached file to a user buffer.

NTKERNELAPI BOOLEAN FsRtlCopyWrite( PFILE_OBJECT FileObject, PLARGE_INTEGER FileOffset, ULONG Length, BOOLEAN Wait, ULONG LockKey, PVOID Buffer, PIO_STATUS_BLOCK IoStatus, PDEVICE_OBJECT DeviceObject )

The FsRtlCopyWrite routine copies data from a user buffer to a cached file.

NTSTATUS FsRtlMdlReadEx( PFILE_OBJECT FileObject, PLARGE_INTEGER FileOffset, ULONG Length, ULONG LockKey, PMDL *MdlChain, PIO_STATUS_BLOCK IoStatus )

The FsRtlMdlReadEx routine performs a fast cached MDL read. If the requested data is not cached, the routine reverts to an IRP based MDL read operation.

NTKERNELAPI BOOLEAN FsRtlMdlReadDev( PFILE_OBJECT FileObject, PLARGE_INTEGER FileOffset, ULONG Length, ULONG LockKey, PMDL *MdlChain, PIO_STATUS_BLOCK IoStatus, PDEVICE_OBJECT DeviceObject )

The FltFastIoMdlRead routine returns a memory descriptor list (MDL) that points directly to the specified byte range in the file cache.

NTKERNELAPI BOOLEAN FsRtlMdlReadCompleteDev( PFILE_OBJECT FileObject, PMDL MdlChain, PDEVICE_OBJECT DeviceObject )

The FltFastIoMdlReadComplete routine completes the read operation that the FltFastIoMdlRead routine initiated.

NTSTATUS FsRtlPrepareMdlWriteEx( PFILE_OBJECT FileObject, PLARGE_INTEGER FileOffset, ULONG Length, ULONG LockKey, PMDL *MdlChain, PIO_STATUS_BLOCK IoStatus )

The FsRtlPrepareMdlWriteEx routine returns a linked list of memory descriptor lists (MDLs) that point to the specified range of cached file data to write data directly to the cache. If the cache support for the write is not available, the routine reverts to an IRP based MDL write operation.

NTKERNELAPI BOOLEAN FsRtlPrepareMdlWriteDev( PFILE_OBJECT FileObject, PLARGE_INTEGER FileOffset, ULONG Length, ULONG LockKey, PMDL *MdlChain, PIO_STATUS_BLOCK IoStatus, PDEVICE_OBJECT DeviceObject )

The FltFastIoPrepareMdlWrite routine returns a linked list of memory descriptor lists (MDLs) that point to the specified range of cached file data to write data directly to the cache.

NTKERNELAPI BOOLEAN FsRtlMdlWriteCompleteDev( PFILE_OBJECT FileObject, PLARGE_INTEGER FileOffset, PMDL MdlChain, PDEVICE_OBJECT DeviceObject )

The FltFastIoMdlWriteComplete routine frees the resources that FltFastIoPrepareMdlWrite allocated.

NTKERNELAPI VOID FsRtlAcquireFileExclusive( PFILE_OBJECT FileObject )

The FsRtlAcquireFileExclusive routine is reserved for system use. Do not use this routine in your driver. See FsRtlRegisterFileSystemFilterCallbacks.

NTKERNELAPI VOID FsRtlReleaseFile( PFILE_OBJECT FileObject )

The FsRtlReleaseFile routine is reserved for system use. See FsRtlRegisterFileSystemFilterCallbacks.

NTSTATUS FsRtlGetFileSize( PFILE_OBJECT FileObject, PLARGE_INTEGER FileSize )

The FsRtlGetFileSize routine is used to get the size of a file.

NTKERNELAPI BOOLEAN FsRtlIsTotalDeviceFailure( NTSTATUS Status )

The FsRtlIsTotalDeviceFailure routine determines whether a media or other hardware failure has occurred.

NTKERNELAPI PFILE_LOCK FsRtlAllocateFileLock( PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine, PUNLOCK_ROUTINE UnlockRoutine )

The FsRtlAllocateFileLock routine allocates and initializes a new FILE_LOCK structure.

NTKERNELAPI VOID FsRtlFreeFileLock( PFILE_LOCK FileLock )

The FsRtlFreeFileLock routine uninitializes and frees a file lock structure.

NTKERNELAPI VOID FsRtlInitializeFileLock( PFILE_LOCK FileLock, PCOMPLETE_LOCK_IRP_ROUTINE CompleteLockIrpRoutine, PUNLOCK_ROUTINE UnlockRoutine )

The FsRtlInitializeFileLock routine initializes a FILE_LOCK structure.

NTKERNELAPI VOID FsRtlUninitializeFileLock( PFILE_LOCK FileLock )

The FsRtlUninitializeFileLock routine uninitializes a FILE_LOCK structure.

NTKERNELAPI NTSTATUS FsRtlProcessFileLock( PFILE_LOCK FileLock, PIRP Irp, PVOID Context )

The FsRtlProcessFileLock routine processes and completes an IRP for a file lock operation.

NTKERNELAPI BOOLEAN FsRtlCheckLockForReadAccess( PFILE_LOCK FileLock, PIRP Irp )

The FsRtlCheckLockForReadAccess routine determines whether the process associated with a given IRP has read access to a locked region of a file.

NTKERNELAPI BOOLEAN FsRtlCheckLockForWriteAccess( PFILE_LOCK FileLock, PIRP Irp )

The FsRtlCheckLockForWriteAccess routine determines whether the process associated with a given IRP has write access to a locked region of a file.

NTKERNELAPI BOOLEAN FsRtlCheckLockForOplockRequest( PFILE_LOCK FileLock, PLARGE_INTEGER AllocationSize )

The FsRtlCheckLockForOplockRequest routine checks for locks within the allocation size of a file. The file lock object is checked for the presence of byte range locks that would prevent an oplock request from being granted.

NTKERNELAPI BOOLEAN FsRtlFastCheckLockForRead( PFILE_LOCK FileLock, PLARGE_INTEGER StartingByte, PLARGE_INTEGER Length, ULONG Key, PFILE_OBJECT FileObject, PVOID ProcessId )

The FsRtlFastCheckLockForRead routine determines whether the specified process has read access to a locked byte range of a file.

NTKERNELAPI BOOLEAN FsRtlFastCheckLockForWrite( PFILE_LOCK FileLock, PLARGE_INTEGER StartingByte, PLARGE_INTEGER Length, ULONG Key, PVOID FileObject, PVOID ProcessId )

The FsRtlFastCheckLockForWrite routine determines whether the specified process has write access to a locked byte range of a file.

NTKERNELAPI PFILE_LOCK_INFO FsRtlGetNextFileLock( PFILE_LOCK FileLock, BOOLEAN Restart )

The FsRtlGetNextFileLock routine is used to enumerate the byte-range locks that currently exist for a specified file.

NTKERNELAPI BOOLEAN FsRtlAreThereCurrentOrInProgressFileLocks( PFILE_LOCK FileLock )

TheFsRtlAreThereCurrentOrInProgressFileLocks routine determines if there are byte range locks assigned to a file or any lock operations in progress for that file.

NTKERNELAPI BOOLEAN FsRtlAreThereWaitingFileLocks( PFILE_LOCK FileLock )

The FsRtlAreThereWaitingFileLocks routine checks a file lock queue for any waiting file locks.

NTKERNELAPI NTSTATUS FsRtlFastUnlockSingle( PFILE_LOCK FileLock, PFILE_OBJECT FileObject, LARGE_INTEGER *FileOffset, PLARGE_INTEGER Length, PEPROCESS ProcessId, ULONG Key, PVOID Context, BOOLEAN AlreadySynchronized )

The FsRtlFastUnlockSingle routine releases a byte-range lock that was acquired by the specified process, with the specified key value, file offset, and length, for a file.

NTKERNELAPI NTSTATUS FsRtlFastUnlockAll( PFILE_LOCK FileLock, PFILE_OBJECT FileObject, PEPROCESS ProcessId, PVOID Context )

The FsRtlFastUnlockAll routine releases all byte-range locks that were acquired by the specified process for a file.

NTKERNELAPI NTSTATUS FsRtlFastUnlockAllByKey( PFILE_LOCK FileLock, PFILE_OBJECT FileObject, PEPROCESS ProcessId, ULONG Key, PVOID Context )

The FsRtlFastUnlockAllByKey routine releases all byte-range locks that were acquired by the specified process, with the specified key value, for a file.

NTKERNELAPI BOOLEAN FsRtlPrivateLock( PFILE_LOCK FileLock, PFILE_OBJECT FileObject, PLARGE_INTEGER FileOffset, PLARGE_INTEGER Length, PEPROCESS ProcessId, ULONG Key, BOOLEAN FailImmediately, BOOLEAN ExclusiveLock, PIO_STATUS_BLOCK Iosb, PIRP Irp, __drv_aliasesMem PVOID Context, BOOLEAN AlreadySynchronized )

The FsRtlPrivateLock routine is obsolete, but is exported to support existing driver binaries. Use FsRtlFastLock instead.

NTKERNELAPI VOID FsRtlInitializeTunnelCache( TUNNEL *Cache )

The FsRtlInitializeTunnelCache routine initializes a new tunnel cache for a volume.

NTKERNELAPI VOID FsRtlAddToTunnelCache( TUNNEL *Cache, ULONGLONG DirectoryKey, UNICODE_STRING *ShortName, UNICODE_STRING *LongName, BOOLEAN KeyByShortName, ULONG DataLength, VOID *Data )

The FsRtlAddToTunnelCache routine caches a file name that is removed from a directory when a file is renamed or deleted.

NTKERNELAPI BOOLEAN FsRtlFindInTunnelCache( TUNNEL *Cache, ULONGLONG DirectoryKey, UNICODE_STRING *Name, UNICODE_STRING *ShortName, UNICODE_STRING *LongName, ULONG *DataLength, VOID *Data )

The FsRtlFindInTunnelCache routine searches for a matching entry in the tunnel cache that matches the specified name.

NTKERNELAPI VOID FsRtlDeleteKeyFromTunnelCache( TUNNEL *Cache, ULONGLONG DirectoryKey )

The FsRtlDeleteKeyFromTunnelCache routine deletes any tunnel cache entries for files in a directory that is being deleted.

NTKERNELAPI VOID FsRtlDeleteTunnelCache( TUNNEL *Cache )

The FsRtlDeleteTunnelCache routine deletes a tunnel cache.

NTKERNELAPI VOID FsRtlDissectDbcs( ANSI_STRING Path, PANSI_STRING FirstName, PANSI_STRING RemainingName )

Given an ANSI or double-byte character set (DBCS) pathname string, the FsRtlDissectDbcs routine returns two strings: one containing the first file name found in the string, the other containing the remaining unparsed portion of the pathname string.

NTKERNELAPI BOOLEAN FsRtlDoesDbcsContainWildCards( PANSI_STRING Name )

The FsRtlDoesDbcsContainWildCards routine determines whether an ANSI or double-byte character set (DBCS) string contains wildcard characters.

NTKERNELAPI BOOLEAN FsRtlIsDbcsInExpression( PANSI_STRING Expression, PANSI_STRING Name )

The FsRtlIsDbcsInExpression routine determines whether an ANSI or double-byte character set (DBCS) string matches the specified pattern.

NTKERNELAPI BOOLEAN FsRtlIsFatDbcsLegal( ANSI_STRING DbcsName, BOOLEAN WildCardsPermissible, BOOLEAN PathNamePermissible, BOOLEAN LeadingBackslashPermissible )

The FsRtlIsFatDbcsLegal routine determines whether the specified ANSI or double-byte character set (DBCS) string is a legal FAT file name.

NTKERNELAPI BOOLEAN FsRtlIsHpfsDbcsLegal( ANSI_STRING DbcsName, BOOLEAN WildCardsPermissible, BOOLEAN PathNamePermissible, BOOLEAN LeadingBackslashPermissible )

The FsRtlIsHpfsDbcsLegal routine determines whether the specified ANSI or double-byte character set (DBCS) string is a legal HPFS file name.

NTKERNELAPI NTSTATUS FsRtlNormalizeNtstatus( NTSTATUS Exception, NTSTATUS GenericException )

The FsRtlNormalizeNtstatus routine translates an arbitrary exception into a status value that is handled by the exception filter.

NTKERNELAPI BOOLEAN FsRtlIsNtstatusExpected( NTSTATUS Exception )

The FsRtlIsNtstatusExpected routine determines whether the specified exception is handled by the exception filter.

NTKERNELAPI PERESOURCE FsRtlAllocateResource( VOID )

The FsRtlAllocateResource routine is obsolete, but is exported to support existing driver binaries. Use ExAllocateFromNPagedLookasideList and ExInitializeResourceLite instead.

NTKERNELAPI VOID FsRtlInitializeLargeMcb( PLARGE_MCB Mcb, POOL_TYPE PoolType )

The FsRtlInitializeLargeMcb routine initializes a map control block (MCB) structure.

NTKERNELAPI VOID FsRtlUninitializeLargeMcb( PLARGE_MCB Mcb )

The FsRtlUninitializeLargeMcb routine uninitializes a large map-control block (MCB).

NTKERNELAPI VOID FsRtlResetLargeMcb( PLARGE_MCB Mcb, BOOLEAN SelfSynchronized )

The FsRtlResetLargeMcb routine truncates a map control block (MCB) structure to contain zero mapping pairs. It does not shrink the mapping pairs array.

NTKERNELAPI VOID FsRtlTruncateLargeMcb( PLARGE_MCB Mcb, LONGLONG Vbn )

The FsRtlTruncateLargeMcb routine truncates a large map control block (MCB).

NTKERNELAPI BOOLEAN FsRtlAddLargeMcbEntry( PLARGE_MCB Mcb, LONGLONG Vbn, LONGLONG Lbn, LONGLONG SectorCount )

The FsRtlAddLargeMcbEntry routine adds a new mapping to an existing map control block (MCB).

NTKERNELAPI VOID FsRtlRemoveLargeMcbEntry( PLARGE_MCB Mcb, LONGLONG Vbn, LONGLONG SectorCount )

The FsRtlRemoveLargeMcbEntry routine removes one or more mappings from a map control block (MCB).

NTKERNELAPI BOOLEAN FsRtlLookupLargeMcbEntry( PLARGE_MCB Mcb, LONGLONG Vbn, PLONGLONG Lbn, PLONGLONG SectorCountFromLbn, PLONGLONG StartingLbn, PLONGLONG SectorCountFromStartingLbn, PULONG Index )

Given a virtual block number (VBN) and a map control block (MCB), the FsRtlLookupLargeMcbEntry routine searches the MCB for mapping information corresponding to the specified VBN.

NTKERNELAPI BOOLEAN FsRtlLookupLastLargeMcbEntry( PLARGE_MCB Mcb, PLONGLONG Vbn, PLONGLONG Lbn )

The FsRtlLookupLastLargeMcbEntry routine retrieves the last mapping entry stored in the map control block (MCB).

NTKERNELAPI BOOLEAN FsRtlLookupLastLargeMcbEntryAndIndex( PLARGE_MCB OpaqueMcb, PLONGLONG LargeVbn, PLONGLONG LargeLbn, PULONG Index )

The FsRtlLookupLastLargeMcbEntryAndIndex routine retrieves the last mapping entry stored in a given map control block (MCB).

NTKERNELAPI ULONG FsRtlNumberOfRunsInLargeMcb( PLARGE_MCB Mcb )

The FsRtlNumberOfRunsInLargeMcb routine returns the number of runs in a map control block (MCB).

NTKERNELAPI BOOLEAN FsRtlGetNextLargeMcbEntry( PLARGE_MCB Mcb, ULONG RunIndex, PLONGLONG Vbn, PLONGLONG Lbn, PLONGLONG SectorCount )

The FsRtlGetNextLargeMcbEntry routine retrieves a mapping run from a map control block (MCB).

NTKERNELAPI BOOLEAN FsRtlSplitLargeMcb( PLARGE_MCB Mcb, LONGLONG Vbn, LONGLONG Amount )

The FsRtlSplitLargeMcb routine inserts a hole into the mappings in a map control block (MCB).

NTKERNELAPI VOID FsRtlInitializeBaseMcb( PBASE_MCB Mcb, POOL_TYPE PoolType )

This routine initializes a new map control block (MCB) structure. The caller must supply the memory for the Mcb structure. This call must precede all other calls that set/query the Mcb structure.

If pool is not available this routine will raise a status value indicating insufficient resources.

BOOLEAN FsRtlInitializeBaseMcbEx( PBASE_MCB Mcb, POOL_TYPE PoolType, USHORT Flags )

This routine initializes a new Mcb structure. The caller must supply the memory for the Mcb structure. This call must precede all other calls that set/query the Mcb structure.

If pool is not available this routine will raise a status value indicating insufficient resources or return false depending on the flags.

NTKERNELAPI VOID FsRtlUninitializeBaseMcb( PBASE_MCB Mcb )

The FsRtlUninitializeBaseMcb function uninitializes a map control block (MCB) structure. After calling this routine the input Mcb structure must be re-initialized before being used again.

NTSTATUS FsRtlAddBaseMcbEntryEx( PBASE_MCB Mcb, LONGLONG Vbn, LONGLONG Lbn, LONGLONG SectorCount )

The FsRtlAddBaseMcbEntryEx function is used to add a new mapping of virtual block numbers (VBN's) to logical block numbers (LBN's) to an existing map control block (MCB).

NTKERNELAPI BOOLEAN FsRtlRemoveBaseMcbEntry( PBASE_MCB Mcb, LONGLONG Vbn, LONGLONG SectorCount )

The FsRtlRemoveBaseMcbEntry function is the work routine for removing a large map control block (MCB) entry. It does so without taking out the mcb GuardedMutex.

NTKERNELAPI BOOLEAN FsRtlLookupBaseMcbEntry( PBASE_MCB Mcb, LONGLONG Vbn, PLONGLONG Lbn, PLONGLONG SectorCountFromLbn, PLONGLONG StartingLbn, PLONGLONG SectorCountFromStartingLbn, PULONG Index )

The FsRtlLookupBaseMcbEntry routine retrieves the mapping of a virtual block number (VBN) to a logical block number (LBN) from a map control block (MCB). It indicates if the mapping exists and the size of the run.

NTKERNELAPI VOID FsRtlInitializeMcb( PMCB Mcb, POOL_TYPE PoolType )

The FsRtlInitializeMcb routine is obsolete, but is exported to support existing driver binaries. Use FsRtlInitializeLargeMcb instead.

NTKERNELAPI VOID FsRtlUninitializeMcb( PMCB Mcb )

The FsRtlUninitializeMcb routine is obsolete, but is exported to support existing driver binaries. Use FsRtlUninitializeLargeMcb instead.

NTKERNELAPI VOID FsRtlTruncateMcb( PMCB Mcb, VBN Vbn )

The FsRtlTruncateMcb routine is obsolete, but is exported to support existing driver binaries. Use FsRtlTruncateLargeMcb instead.

NTKERNELAPI BOOLEAN FsRtlAddMcbEntry( PMCB Mcb, VBN Vbn, LBN Lbn, ULONG SectorCount )

The FsRtlAddMcbEntry routine is obsolete, but is exported to support existing driver binaries. Use FsRtlAddLargeMcbEntry instead.

NTKERNELAPI VOID FsRtlRemoveMcbEntry( PMCB Mcb, VBN Vbn, ULONG SectorCount )

The FsRtlRemoveMcbEntry routine is obsolete, but is exported to support existing driver binaries. Use FsRtlRemoveLargeMcbEntry instead.

NTKERNELAPI BOOLEAN FsRtlLookupMcbEntry( PMCB Mcb, VBN Vbn, PLBN Lbn, PULONG SectorCount, PULONG Index )

FsRtlLookupMcbEntry is obsolete, but is exported to support existing driver binaries. Use FsRtlLookupLargeMcbEntry instead.

NTKERNELAPI BOOLEAN FsRtlLookupLastMcbEntry( PMCB Mcb, PVBN Vbn, PLBN Lbn )

The FsRtlLookupLastMcbEntry routine is obsolete, but is exported to support existing driver binaries. Use FsRtlLookupLastLargeMcbEntry instead.

NTKERNELAPI ULONG FsRtlNumberOfRunsInMcb( PMCB Mcb )

The FsRtlNumberOfRunsInMcb routine is obsolete, but is exported to support existing driver binaries. Use FsRtlNumberOfRunsInLargeMcb instead.

NTKERNELAPI BOOLEAN FsRtlGetNextMcbEntry( PMCB Mcb, ULONG RunIndex, PVBN Vbn, PLBN Lbn, PULONG SectorCount )

The FsRtlGetNextMcbEntry routine is obsolete, but is exported to support existing driver binaries. Use FsRtlGetNextLargeMcbEntry instead.

NTKERNELAPI NTSTATUS FsRtlBalanceReads( PDEVICE_OBJECT TargetDevice )

The FsRtlBalanceReads routine signals to a fault-tolerant disk driver that it is now safe to start balancing reads from a mirrored drive.

NTKERNELAPI VOID FsRtlInitializeOplock( POPLOCK Oplock )

FsRtlInitializeOplock initializes an opportunistic lock (oplock) pointer.

NTKERNELAPI VOID FsRtlUninitializeOplock( POPLOCK Oplock )

FsRtlUninitializeOplock uninitializes an opportunistic lock (oplock) pointer.

NTKERNELAPI NTSTATUS FsRtlOplockFsctrl( POPLOCK Oplock, PIRP Irp, ULONG OpenCount )

FsRtlOplockFsctrl performs various opportunistic lock (oplock) operations on behalf of a file system or filter driver.

NTKERNELAPI NTSTATUS FsRtlCheckOplock( POPLOCK Oplock, PIRP Irp, PVOID Context, POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine, POPLOCK_FS_PREPOST_IRP PostIrpRoutine )

The FsRtlCheckOplock routine synchronizes the IRP for a file I/O operation with the file's current opportunistic lock (oplock) state.

NTKERNELAPI NTSTATUS FsRtlCheckOplockEx( POPLOCK Oplock, PIRP Irp, ULONG Flags, PVOID Context, POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine, POPLOCK_FS_PREPOST_IRP PostIrpRoutine )

The FsRtlCheckOplockEx routine synchronizes the IRP for a file I/O operation with the current opportunistic lock (oplock) state of the file.

NTSTATUS FsRtlCheckUpperOplock( POPLOCK Oplock, ULONG NewLowerOplockState, PVOID CompletionRoutineContext, POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine, POPLOCK_FS_PREPOST_IRP PrePendRoutine, ULONG Flags )

The FsRtlCheckUpperOplock routine provides opportunistic lock (oplock) checking in secondary, or layered, file systems when the oplocks they hold change state. Secondary file systems, such as network redirectors and clustering file services, call FsRtlCheckUpperOplock when an oplock held in a lower file system by the secondary file system, changes state. A state change can occur either by a break or an upgrade. FsRtlCheckUpperOplock will break the oplock of upper file system, if necessary, to confirm the new lower oplock state. The caller can also provide optional callbacks for notifications of break acknowledgment and pending status.

NTSTATUS FsRtlUpperOplockFsctrl( POPLOCK Oplock, PIRP Irp, ULONG OpenCount, ULONG LowerOplockState, ULONG Flags )

The FsRtlUpperOplockFsctrl routine processes opportunistic lock (oplock) requests and acknowledgments for secondary, or layered, file systems. The upper file system submits the state of the oplock held in the lower file system. FsRtlUpperOplockFsctrl will determine whether to grant or deny the upper file system oplock.

NTKERNELAPI BOOLEAN FsRtlOplockIsFastIoPossible( POPLOCK Oplock )

FsRtlOplockIsFastIoPossible checks a file's opportunistic lock (oplock) state to determine whether fast I/O can be performed on the file.

NTKERNELAPI BOOLEAN FsRtlCurrentBatchOplock( POPLOCK Oplock )

A file system or filter driver calls FsRtlCurrentBatchOplock to determine whether there are any batch or filter opportunistic locks (oplocks) on a file.

NTKERNELAPI BOOLEAN FsRtlCurrentOplock( POPLOCK Oplock )

A file system or filter driver calls FsRtlCurrentOplock to determine whether there are any opportunistic locks (oplocks) on a file.

NTKERNELAPI NTSTATUS FsRtlOplockBreakToNone( POPLOCK Oplock, PIO_STACK_LOCATION IrpSp, PIRP Irp, PVOID Context, POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine, POPLOCK_FS_PREPOST_IRP PostIrpRoutine )

The FsRtlOplockBreakToNone routine is obsolete, but is exported to support existing driver binaries. Use FsRtlOplockBreakToNoneEx instead.

NTKERNELAPI BOOLEAN FsRtlOplockIsSharedRequest( PIRP Irp )

The FsRtlOplockIsSharedRequest routine determines if a request for an opportunistic lock (oplock) wants a shared oplock.

NTKERNELAPI NTSTATUS FsRtlOplockBreakH( POPLOCK Oplock, PIRP Irp, ULONG Flags, PVOID Context, POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine, POPLOCK_FS_PREPOST_IRP PostIrpRoutine )

The FsRtlOplockBreakH routine breaks CACHE_HANDLE_LEVEL opportunistic locks (oplocks).

NTKERNELAPI BOOLEAN FsRtlCurrentOplockH( POPLOCK Oplock )

A file system or filter driver calls FsRtlCurrentOplockH to determine whether there are any CACHE_HANDLE_LEVEL opportunistic locks (oplocks) on a file.

NTKERNELAPI NTSTATUS FsRtlOplockBreakToNoneEx( POPLOCK Oplock, PIRP Irp, ULONG Flags, PVOID Context, POPLOCK_WAIT_COMPLETE_ROUTINE CompletionRoutine, POPLOCK_FS_PREPOST_IRP PostIrpRoutine )

The FsRtlOplockBreakToNoneEx routine breaks all opportunistic locks (oplocks) immediately without regard for any oplock key.

NTKERNELAPI NTSTATUS FsRtlOplockFsctrlEx( POPLOCK Oplock, PIRP Irp, ULONG OpenCount, ULONG Flags )

The FsRtlOplockFsctrlEx routine performs various opportunistic lock (oplock) operations on behalf of a file system or filter driver.

NTKERNELAPI BOOLEAN FsRtlOplockKeysEqual( PFILE_OBJECT Fo1, PFILE_OBJECT Fo2 )

The FsRtlOplockKeysEqual routine compares the opportunistic lock (oplock) keys that are stored in the file object extensions of two file objects.

NTKERNELAPI NTSTATUS FsRtlNotifyVolumeEvent( PFILE_OBJECT FileObject, ULONG EventCode )

The FsRtlNotifyVolumeEvent routine notifies any registered applications that a volume event is occurring.

NTKERNELAPI NTSTATUS FsRtlNotifyVolumeEventEx( PFILE_OBJECT FileObject, ULONG EventCode, PTARGET_DEVICE_CUSTOM_NOTIFICATION Event )

The FsRtlNotifyVolumeEventEx routine notifies any registered applications that a volume event is occurring. Volume events include the volume being locked, unlocked, mounted, or made read-only.

NTKERNELAPI VOID FsRtlNotifyInitializeSync( PNOTIFY_SYNC *NotifySync )

The FsRtlNotifyInitializeSync routine allocates and initializes a synchronization object for a notify list.

NTKERNELAPI VOID FsRtlNotifyUninitializeSync( PNOTIFY_SYNC *NotifySync )

The FsRtlNotifyUninitializeSync routine deallocates the synchronization object for a notify list.

NTKERNELAPI VOID FsRtlNotifyFullChangeDirectory( PNOTIFY_SYNC NotifySync, PLIST_ENTRY NotifyList, PVOID FsContext, PSTRING FullDirectoryName, BOOLEAN WatchTree, BOOLEAN IgnoreBuffer, ULONG CompletionFilter, PIRP NotifyIrp, PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback, PSECURITY_SUBJECT_CONTEXT SubjectContext )

The FsRtlNotifyFullChangeDirectory routine creates a notify structure for a notification request and adds it to the specified notify list.

NTKERNELAPI VOID FsRtlNotifyFilterChangeDirectory( PNOTIFY_SYNC NotifySync, PLIST_ENTRY NotifyList, PVOID FsContext, PSTRING FullDirectoryName, BOOLEAN WatchTree, BOOLEAN IgnoreBuffer, ULONG CompletionFilter, PIRP NotifyIrp, PCHECK_FOR_TRAVERSE_ACCESS TraverseCallback, PSECURITY_SUBJECT_CONTEXT SubjectContext, PFILTER_REPORT_CHANGE FilterCallback )

The FsRtlNotifyFilterChangeDirectory routine creates a notify structure for an IRP_MN_NOTIFY_CHANGE_DIRECTORY request and adds it to the specified notify list.

NTKERNELAPI VOID FsRtlNotifyFilterReportChange( PNOTIFY_SYNC NotifySync, PLIST_ENTRY NotifyList, PSTRING FullTargetName, USHORT TargetNameOffset, PSTRING StreamName, PSTRING NormalizedParentName, ULONG FilterMatch, ULONG Action, PVOID TargetContext, PVOID FilterContext )

FsRtlNotifyFilterReportChange completes IRP_MN_NOTIFY_CHANGE_DIRECTORY requests that are pending in the specified notify list.

NTKERNELAPI VOID FsRtlNotifyFullReportChange( PNOTIFY_SYNC NotifySync, PLIST_ENTRY NotifyList, PSTRING FullTargetName, USHORT TargetNameOffset, PSTRING StreamName, PSTRING NormalizedParentName, ULONG FilterMatch, ULONG Action, PVOID TargetContext )

The FsRtlNotifyFullReportChange routine completes pending notify change IRPs.

NTKERNELAPI VOID FsRtlNotifyCleanup( PNOTIFY_SYNC NotifySync, PLIST_ENTRY NotifyList, PVOID FsContext )

When the last handle to a file object is released, the FsRtlNotifyCleanup routine removes the file object's notify structure, if present, from the specified notify list.

NTKERNELAPI VOID FsRtlNotifyCleanupAll( PNOTIFY_SYNC NotifySync, PLIST_ENTRY NotifyList )

The FsRtlNotifyCleanupAll routine removes all members of the specified notification list.

NTKERNELAPI VOID FsRtlDissectName( UNICODE_STRING Path, PUNICODE_STRING FirstName, PUNICODE_STRING RemainingName )

Given a Unicode pathname string, the FsRtlDissectName routine returns two strings, one containing the first file name found in the string, the other containing the remaining unparsed portion of the pathname string.

NTKERNELAPI BOOLEAN FsRtlDoesNameContainWildCards( PUNICODE_STRING Name )

The FsRtlDoesNameContainWildCards routine determines whether a Unicode string contains wildcard characters.

NTKERNELAPI BOOLEAN FsRtlAreNamesEqual( PCUNICODE_STRING ConstantNameA, PCUNICODE_STRING ConstantNameB, BOOLEAN IgnoreCase, PCWCH UpcaseTable )

The FsRtlAreNamesEqual routine determines whether two Unicode strings are equal.

NTKERNELAPI BOOLEAN FsRtlIsNameInExpression( PUNICODE_STRING Expression, PUNICODE_STRING Name, BOOLEAN IgnoreCase, PWCH UpcaseTable )

The FsRtlIsNameInExpression routine determines whether a Unicode string matches the specified pattern.

NTKERNELAPI VOID FsRtlPostStackOverflow( PVOID Context, PKEVENT Event, PFSRTL_STACK_OVERFLOW_ROUTINE StackOverflowRoutine )

The FsRtlPostStackOverflow routine posts a stack overflow item to the stack overflow thread.

NTKERNELAPI VOID FsRtlPostPagingFileStackOverflow( PVOID Context, PKEVENT Event, PFSRTL_STACK_OVERFLOW_ROUTINE StackOverflowRoutine )

The FsRtlPostPagingFileStackOverflow routine posts a paging file stack overflow item to the stack overflow thread.

NTKERNELAPI NTSTATUS FsRtlRegisterUncProvider( PHANDLE MupHandle, PCUNICODE_STRING RedirectorDeviceName, BOOLEAN MailslotsSupported )

The FsRtlRegisterUncProvider routine registers a network redirector as a universal naming convention (UNC) provider with the system multiple UNC provider (MUP).

NTSTATUS FsRtlRegisterUncProviderEx( PHANDLE MupHandle, PCUNICODE_STRING RedirDevName, PDEVICE_OBJECT DeviceObject, FSRTL_UNC_PROVIDER_FLAGS Flags )

The FsRtlRegisterUncProviderEx routine registers a network redirector as a universal naming convention (UNC) provider with the system multiple UNC provider (MUP).

Remarks

The FSRTL_ADVANCED_FCB_HEADER structure is a superset of the FSRTL_COMMON_FCB_HEADER structure. File systems (including legacy filter and minifilter drivers, when applicable) must use the FSRTL_ADVANCED_FCB_HEADER structure.

File systems must use the FsRtlSetupAdvancedHeader macro or the FsRtlSetupAdvancedHeaderEx macro to initialize an FSRTL_ADVANCED_FCB_HEADER structure.

The following flags are set by the FsRtlSetupAdvancedHeader and FsRtlSetupAdvancedHeaderEx macros.

Flag Meaning
FSRTL_FLAG_ADVANCED_HEADER Set in the Flags member of the FSRTL_COMMON_FCB_HEADER structure, this flag indicates file system driver support for FSRTL_ADVANCED_FCB_HEADER structures. This flag should not be modified.
FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS Set in the Flags2 member of FSRTL_COMMON_FCB_HEADER, this flag indicates support for filter driver contexts. This flag can only be cleared for paging files (see information after the table).
FSRTL_FCB_HEADER_V1 Set in the Version member of FSRTL_COMMON_FCB_HEADER, this value indicates support for the PushLock and FilterContextPointer members. This flag should not be modified.
FSRTL_FCB_HEADER_V2 Set in the Version member of FSRTL_COMMON_FCB_HEADER, this value indicates support for the PushLock, FilterContextPointer, Oplock, and ReservedForRemote members. This flag should not be modified.

File systems must set the FsContext member of every file object to point to an FSRTL_ADVANCED_FCB_HEADER structure. This structure can be embedded inside of a context object structure that is specific to a file-system stream (the remainder of the structure is file-system–specific). Usually, this structure is a file control block (FCB). However, on some file systems that support multiple data streams, such as NTFS, it is a stream control block (SCB). Note that FCBs and SCBs for all classes of open requests, including volume open requests, must include this structure.

If the file is a paging file, the FSRTL_ADVANCED_FCB_HEADER structure must be allocated from a nonpaged pool. Otherwise, it can be allocated from a paged or nonpaged pool.

All Microsoft file systems disable stream context support for paging files by clearing the FSRTL_FLAG2_SUPPORTS_FILTER_CONTEXTS flag in the Flags2 member of FSRTL_COMMON_FCB_HEADER after they call FsRtlSetupAdvancedHeader. (See the FatCreateFcb function in Strucsup.c for the FASTFAT WDK sample.) You are strongly encouraged to do the same in your file system or systems so that the operating system will behave in a consistent manner across all file systems.

Requirements

   
Header ntifs.h (include Ntifs.h, Fltkernel.h)

See Also

FSRTL_COMMON_FCB_HEADER

FSRTL_PER_STREAM_CONTEXT

FsRtlInsertPerStreamContext

FsRtlLookupPerStreamContext

FsRtlRemovePerStreamContext

FsRtlSetupAdvancedHeader

FsRtlSetupAdvancedHeaderEx

FsRtlTeardownPerStreamContexts