diff --git a/tsk/fs/fs_open.c b/tsk/fs/fs_open.c
index 0e477f81eea72d0aa405cffb1f1d36c835f827ae..c4105f84ea2118152278dcfd955e961e0bdac1da 100644
--- a/tsk/fs/fs_open.c
+++ b/tsk/fs/fs_open.c
@@ -305,12 +305,12 @@ tsk_fs_close(TSK_FS_INFO * a_fs)
if ((a_fs == NULL) || (a_fs->tag != TSK_FS_INFO_TAG))
return;
- // each file system is supposed to call tsk_fs_free()
+ // each file system is supposed to call tsk_fs_free()
a_fs->close(a_fs);
}
-/* tsk_fs_malloc - init lock after tsk_malloc
+/* tsk_fs_malloc - init lock after tsk_malloc
* This is for fs module and all it's inheritances
*/
TSK_FS_INFO *
@@ -327,7 +327,7 @@ tsk_fs_malloc(size_t a_len)
return fs_info;
}
-/* tsk_fs_free - deinit lock before free memory
+/* tsk_fs_free - deinit lock before free memory
* This is for fs module and all it's inheritances
*/
void
@@ -338,9 +338,9 @@ tsk_fs_free(TSK_FS_INFO * a_fs_info)
a_fs_info->list_inum_named = NULL;
}
- /* we should probably get the lock, but we're
+ /* we should probably get the lock, but we're
* about to kill the entire object so there are
- * bigger problems if another thread is still
+ * bigger problems if another thread is still
* using the fs */
if (a_fs_info->orphan_dir) {
tsk_fs_dir_close(a_fs_info->orphan_dir);
diff --git a/tsk/fs/fs_types.c b/tsk/fs/fs_types.c
index f183739e0455bfcdc2bb1b1c8486f189f0f44f57..41eaa2a7b0a52fd0081787aac1fbc8cf969dae27 100644
--- a/tsk/fs/fs_types.c
+++ b/tsk/fs/fs_types.c
@@ -1,12 +1,12 @@
/*
** fs_types
-** The Sleuth Kit
+** The Sleuth Kit
**
** Identify the type of file system being used
**
** Brian Carrier [carrier <at> sleuthkit [dot] org]
** Copyright (c) 2006-2011 Brian Carrier, Basis Technology. All Rights reserved
-** Copyright (c) 2003-2005 Brian Carrier. All rights reserved
+** Copyright (c) 2003-2005 Brian Carrier. All rights reserved
**
** TASK
** Copyright (c) 2002 Brian Carrier, @stake Inc. All rights reserved
@@ -168,7 +168,7 @@ tsk_fs_type_toname(TSK_FS_TYPE_ENUM ftype)
/**
* \ingroup fslib
- * Return the supported file system types.
+ * Return the supported file system types.
* @returns The bit in the return value is 1 if the type is supported.
*/
TSK_FS_TYPE_ENUM
diff --git a/tsk/fs/tsk_xfs.h b/tsk/fs/tsk_xfs.h
index 4f4ea04f0f62a6f2840cdd0b8e1e18cb166992c5..a3779469e2affb17e5dba8b0191d8ac64e5791fe 100644
--- a/tsk/fs/tsk_xfs.h
+++ b/tsk/fs/tsk_xfs.h
@@ -9,33 +9,12 @@
extern "C" {
#endif
-// from: http://www.doc.ic.ac.uk/~svb/oslab/Minix/usr/include/sys/stat.h / https://unix.superglobalmegacorp.com/NetBSD-0.8/newsrc/sys/stat.h.html
-
-/* MODE */
-#define XFS_IN_FMT 0170000
-#define XFS_IN_SOCK 0140000
-#define XFS_IN_LNK 0120000
-#define XFS_IN_REG 0100000
-#define XFS_IN_BLK 0060000
-#define XFS_IN_DIR 0040000
-#define XFS_IN_CHR 0020000
-#define XFS_IN_FIFO 0010000
-
-#define XFS_IN_ISUID 0004000
-#define XFS_IN_ISGID 0002000
-#define XFS_IN_ISVTX 0001000
-#define XFS_IN_IRUSR 0000400
-#define XFS_IN_IWUSR 0000200
-#define XFS_IN_IXUSR 0000100
-#define XFS_IN_IRGRP 0000040
-#define XFS_IN_IWGRP 0000020
-#define XFS_IN_IXGRP 0000010
-#define XFS_IN_IROTH 0000004
-#define XFS_IN_IWOTH 0000002
-#define XFS_IN_IXOTH 0000001
+/*
+ * Generic data types
+ */
typedef uint64_t xfs_ino_t;
-typedef uint32_t xfs_agino_t; // inode # within allocation grp (from https://github.com/torvalds/linux/blob/master/fs/xfs/libxfs/xfs_types.h#L23)
+typedef uint32_t xfs_agino_t;
typedef int64_t xfs_off_t;
typedef int64_t xfs_daddr_t;
typedef uint32_t xfs_agnumber_t;
@@ -49,204 +28,69 @@ typedef uint64_t xfs_drfsbno_t;
typedef uint64_t xfs_drtbno_t;
typedef uint64_t xfs_dfiloff_t;
typedef uint64_t xfs_dfilblks_t;
+typedef int64_t xfs_lsn_t;
+typedef int64_t xfs_fsize_t;
+typedef int16_t xfs_aextnum_t;
+typedef uint64_t xfs_fsblock_t; /* blockno in filesystem (agno|agbno) */
+typedef uint64_t xfs_rfsblock_t; /* blockno in filesystem (raw) */
+typedef uint64_t xfs_rtblock_t; /* extent (block) in realtime area */
+typedef uint64_t xfs_fileoff_t; /* block number in a file */
+typedef uint64_t xfs_filblks_t; /* number of blocks in a file */
-// from https://github.com/torvalds/linux/blob/master/fs/xfs/libxfs/xfs_types.h#L23
-typedef int64_t xfs_lsn_t; /* log sequence number */
-
-/* from libuuid */
#define UUID_SIZE 16
typedef struct {
uint8_t b[UUID_SIZE];
} xfs_uuid_t;
-// from https://github.com/torvalds/linux/blob/master/fs/xfs/libxfs/xfs_format.h
+
/*
- * There are two words to hold XFS "feature" bits: the original
- * word, sb_versionnum, and sb_features2. Whenever a bit is set in
- * sb_features2, the feature bit XFS_SB_VERSION_MOREBITSBIT must be set.
- *
- * These defines represent bits in sb_features2.
+/* Blocks
*/
-#define XFS_SB_VERSION2_RESERVED1BIT 0x00000001
-#define XFS_SB_VERSION2_LAZYSBCOUNTBIT 0x00000002 /* Superblk counters */
-#define XFS_SB_VERSION2_RESERVED4BIT 0x00000004
-#define XFS_SB_VERSION2_ATTR2BIT 0x00000008 /* Inline attr rework */
-#define XFS_SB_VERSION2_PARENTBIT 0x00000010 /* parent pointers */
-#define XFS_SB_VERSION2_PROJID32BIT 0x00000080 /* 32 bit project id */
-#define XFS_SB_VERSION2_CRCBIT 0x00000100 /* metadata CRCs */
-#define XFS_SB_VERSION2_FTYPE 0x00000200 /* inode type in dir */
-
-#define XFS_SB_VERSION2_OKBITS \
- (XFS_SB_VERSION2_LAZYSBCOUNTBIT | \
- XFS_SB_VERSION2_ATTR2BIT | \
- XFS_SB_VERSION2_PROJID32BIT | \
- XFS_SB_VERSION2_FTYPE)
+typedef enum {
+ XFS_EXT_NORM, XFS_EXT_UNWRITTEN,
+} xfs_exntst_t;
-// from https://github.com/torvalds/linux/blob/master/fs/xfs/libxfs/xfs_format.h#L243
-#define XFS_SB_FEAT_RO_COMPAT_FINOBT (1 << 0) /* free inode btree */
-#define XFS_SB_FEAT_RO_COMPAT_RMAPBT (1 << 1) /* reverse map btree */
-#define XFS_SB_FEAT_RO_COMPAT_REFLINK (1 << 2) /* reflinked files */
-
-#define XFS_SB_FEAT_INCOMPAT_FTYPE (1 << 0) /* filetype in dirent */
-#define XFS_SB_FEAT_INCOMPAT_SPINODES (1 << 1) /* sparse inode chunks */
-#define XFS_SB_FEAT_INCOMPAT_META_UUID (1 << 2) /* metadata UUID */
-
-
-// from xfs_format.h
-#define XFS_SB_VERSION_NUMBITS 0x000f
-#define XFS_SB_VERSION_NUM(sbp) ((sbp)->sb_versionnum & XFS_SB_VERSION_NUMBITS)
-
+ /*
+ * Bmap btree record and extent descriptor.
+ * l0:63 is an extent flag (value 1 indicates non-normal).
+ * l0:9-62 are startoff.
+ * l0:0-8 and l1:21-63 are startblock.
+ * l1:0-20 are blockcount.
+ */
+#define BMBT_EXNTFLAG_BITLEN 1
+#define BMBT_STARTOFF_BITLEN 54
+#define BMBT_STARTBLOCK_BITLEN 52
+#define BMBT_BLOCKCOUNT_BITLEN 21
-/*
-** Super Block
-*/
-typedef struct xfs_sb
+typedef struct xfs_bmbt_irec
{
- uint32_t sb_magicnum;
- uint32_t sb_blocksize;
- xfs_drfsbno_t sb_dblocks;
- xfs_drfsbno_t sb_rblocks;
- xfs_drtbno_t sb_rextents;
- xfs_uuid_t sb_uuid;
- xfs_dfsbno_t sb_logstart;
- xfs_ino_t sb_rootino;
- xfs_ino_t sb_rbmino;
- xfs_ino_t sb_rsumino;
- xfs_agblock_t sb_rextsize;
- xfs_agblock_t sb_agblocks;
- xfs_agnumber_t sb_agcount;
- xfs_extlen_t sb_rbmblocks;
- xfs_extlen_t sb_logblocks;
- uint16_t sb_versionnum;
- uint16_t sb_sectsize;
- uint16_t sb_inodesize;
- uint16_t sb_inopblock;
- char sb_fname[12];
- uint8_t sb_blocklog;
- uint8_t sb_sectlog;
- uint8_t sb_inodelog;
- uint8_t sb_inopblog;
- uint8_t sb_agblklog;
- uint8_t sb_rextslog;
- uint8_t sb_inprogress;
- uint8_t sb_imax_pct;
- uint64_t sb_icount;
- uint64_t sb_ifree;
- uint64_t sb_fdblocks;
- uint64_t sb_frextents;
- xfs_ino_t sb_uquotino;
- xfs_ino_t sb_gquotino;
- uint16_t sb_qflags;
- uint8_t sb_flags;
- uint8_t sb_shared_vn;
- xfs_extlen_t sb_inoalignmt;
- uint32_t sb_unit;
- uint32_t sb_width;
- uint8_t sb_dirblklog;
- uint8_t sb_logsectlog;
- uint16_t sb_logsectsize;
- uint32_t sb_logsunit;
- uint32_t sb_features2;
- uint32_t sb_bad_features2;
-
- /* version 5 superblock fields start here */
- uint32_t sb_features_compat;
- uint32_t sb_features_ro_compat;
- uint32_t sb_features_incompat;
- uint32_t sb_features_log_incompat;
- uint32_t sb_crc;
- xfs_extlen_t sb_spino_align;
- xfs_ino_t sb_pquotino;
- xfs_lsn_t sb_lsn;
- xfs_uuid_t sb_meta_uuid;
- xfs_ino_t sb_rrmapino;
-} xfs_sb_t;
-
-
-typedef uint32_t __be32;
-typedef uint16_t __be16;
-
-#define XFS_BTNUM_AGF 2
-
-typedef struct xfs_agf {
- __be32 agf_magicnum;
- __be32 agf_versionnum;
- __be32 agf_seqno;
- __be32 agf_length;
- __be32 agf_roots[XFS_BTNUM_AGF];
- __be32 agf_spare0;
- __be32 agf_levels[XFS_BTNUM_AGF];
- __be32 agf_spare1;
- __be32 agf_flfirst;
- __be32 agf_fllast;
- __be32 agf_flcount;
- __be32 agf_freeblks;
- __be32 agf_longest;
- __be32 agf_btreeblks;
-} xfs_agf_t;
-
-
-#define XFS_AGFL_SIZE 36
-
-typedef struct xfs_agfl {
- __be32 agfl_magicnum;
- __be32 agfl_seqno;
- xfs_uuid_t agfl_uuid;
- uint64_t agfl_lsn;
- __be32 agfl_crc;
-} xfs_agfl_t;
+ xfs_fileoff_t br_startoff; /* starting file offset */
+ xfs_fsblock_t br_startblock; /* starting block number */
+ xfs_filblks_t br_blockcount; /* number of blocks */
+ xfs_exntst_t br_state; /* extent state */
+} xfs_bmbt_irec_t;
typedef struct xfs_btree_sblock {
- __be32 bb_magic;
- __be16 bb_level;
- __be16 bb_numrecs;
- __be32 bb_leftsib;
- __be32 bb_rightsib;
+ uint32_t bb_magic;
+ uint16_t bb_level;
+ uint16_t bb_numrecs;
+ uint32_t bb_leftsib;
+ uint32_t bb_rightsib;
} xfs_btree_sblock_t;
typedef struct xfs_alloc_rec {
- __be32 ar_startblock;
- __be32 ar_blockcount;
+ uint32_t ar_startblock;
+ uint32_t ar_blockcount;
} xfs_alloc_rec_t, xfs_alloc_key_t;
-typedef __be32 xfs_alloc_ptr_t;
-
-typedef struct xfs_agi {
- __be32 agi_magicnum;
- __be32 agi_versionnum;
- __be32 agi_seqno;
- __be32 agi_length;
- __be32 agi_count;
- __be32 agi_root;
- __be32 agi_level;
- __be32 agi_freecount;
- __be32 agi_newino;
- __be32 agi_dirino;
- __be32 agi_unlinked[64];
-
- /*
- * v5 filesystem fields start here; this marks the end of logging region 1
- * and start of logging region 2.
- * /
- xfs_uuid_t agi_uuid;
- __be32 agi_crc;
- __be32 agi_pad32;
- __be64 agi_lsn;
- __be32 agi_free_root;
- __be32 agi_free_level;
- */
-} xfs_agi_t;
-
-
+typedef uint32_t xfs_alloc_ptr_t;
/*
/* Inodes
*/
-
-// from: https://github.com/torvalds/linux/blob/master/fs/xfs/libxfs/xfs_format.h
/*
* Values for di_flags
*/
@@ -290,36 +134,90 @@ typedef struct xfs_agi {
XFS_DIFLAG_PROJINHERIT | XFS_DIFLAG_NOSYMLINKS | XFS_DIFLAG_EXTSIZE | \
XFS_DIFLAG_EXTSZINHERIT | XFS_DIFLAG_NODEFRAG | XFS_DIFLAG_FILESTREAM)
+/* Values for di_mode */
+#define XFS_IN_FMT 0170000
+#define XFS_IN_SOCK 0140000
+#define XFS_IN_LNK 0120000
+#define XFS_IN_REG 0100000
+#define XFS_IN_BLK 0060000
+#define XFS_IN_DIR 0040000
+#define XFS_IN_CHR 0020000
+#define XFS_IN_FIFO 0010000
+
+#define XFS_IN_ISUID 0004000
+#define XFS_IN_ISGID 0002000
+#define XFS_IN_ISVTX 0001000
+#define XFS_IN_IRUSR 0000400
+#define XFS_IN_IWUSR 0000200
+#define XFS_IN_IXUSR 0000100
+#define XFS_IN_IRGRP 0000040
+#define XFS_IN_IWGRP 0000020
+#define XFS_IN_IXGRP 0000010
+#define XFS_IN_IROTH 0000004
+#define XFS_IN_IWOTH 0000002
+#define XFS_IN_IXOTH 0000001
+
+typedef struct xfs_btree_sblock xfs_inobt_block_t;
-// from https://github.com/torvalds/linux/blob/master/fs/xfs/libxfs/xfs_types.h
+typedef struct xfs_inobt_rec {
+ uint32_t ir_startino;
+ uint32_t ir_freecount;
+ uint64_t ir_free;
+} xfs_inobt_rec_t;
-typedef uint64_t xfs_fsblock_t; /* blockno in filesystem (agno|agbno) */
-typedef uint64_t xfs_rfsblock_t; /* blockno in filesystem (raw) */
-typedef uint64_t xfs_rtblock_t; /* extent (block) in realtime area */
-typedef uint64_t xfs_fileoff_t; /* block number in a file */
-typedef uint64_t xfs_filblks_t; /* number of blocks in a file */
+typedef struct xfs_inobt_key {
+ uint32_t ir_startino;
+} xfs_inobt_key_t;
+typedef uint32_t xfs_inobt_ptr_t;
-typedef enum {
- XFS_EXT_NORM, XFS_EXT_UNWRITTEN,
-} xfs_exntst_t;
+typedef struct xfs_timestamp {
+ int32_t t_sec;
+ int32_t t_nsec;
+} xfs_timestamp_t;
-typedef struct xfs_bmbt_irec
-{
- xfs_fileoff_t br_startoff; /* starting file offset */
- xfs_fsblock_t br_startblock; /* starting block number */
- xfs_filblks_t br_blockcount; /* number of blocks */
- xfs_exntst_t br_state; /* extent state */
-} xfs_bmbt_irec_t;
+typedef enum xfs_dinode_fmt {
+ XFS_DINODE_FMT_DEV,
+ XFS_DINODE_FMT_LOCAL,
+ XFS_DINODE_FMT_EXTENTS,
+ XFS_DINODE_FMT_BTREE,
+ XFS_DINODE_FMT_UUID,
+ XFS_DINODE_FMT_RMAP,
+} xfs_dinode_fmt_t;
+
+typedef struct xfs_dinode_core {
+ uint16_t di_magic;
+ uint16_t di_mode;
+ int8_t di_version;
+ int8_t di_format;
+ uint16_t di_onlink;
+ uint32_t di_uid;
+ uint32_t di_gid;
+ uint32_t di_nlink;
+ uint16_t di_projid;
+ uint16_t di_projid_hi;
+ uint8_t di_pad[6];
+ uint16_t di_flushiter;
+ xfs_timestamp_t di_atime;
+ xfs_timestamp_t di_mtime;
+ xfs_timestamp_t di_ctime;
+ xfs_fsize_t di_size;
+ xfs_drfsbno_t di_nblocks;
+ xfs_extlen_t di_extsize;
+ xfs_extnum_t di_nextents;
+ xfs_aextnum_t di_anextents;
+ uint8_t di_forkoff;
+ int8_t di_aformat;
+ uint32_t di_dmevmask;
+ uint16_t di_dmstate;
+ uint16_t di_flags;
+ uint32_t di_gen;
+} xfs_dinode_core_t;
-/*
- * Bmap root header, on-disk form only.
- */
typedef struct xfs_bmdr_block {
- __be16 bb_level; /* 0 is a leaf */
- __be16 bb_numrecs; /* current # of data records */
+ uint16_t bb_level; /* 0 is a leaf */
+ uint16_t bb_numrecs; /* current # of data records */
} xfs_bmdr_block_t;
-
typedef struct xfs_btree_lblock xfs_bmbt_block_t;
typedef struct xfs_btree_lblock {
uint32_t bb_magic;
@@ -329,13 +227,10 @@ typedef struct xfs_btree_lblock {
uint64_t bb_rightsib;
} xfs_btree_lblock_t;
-
typedef struct xfs_bmbt_key {
xfs_dfiloff_t br_startoff;
} xfs_bmbt_key_t, xfs_bmdr_key_t;
-
-// From linux/v2.6.28/source/fs/xfs/xfs_bmap_btree.h
typedef struct xfs_bmbt_rec_32
{
uint32_t l0, l1, l2, l3;
@@ -345,11 +240,9 @@ typedef struct xfs_bmbt_rec_64
uint64_t l0, l1;
} xfs_bmbt_rec_64_t;
-typedef uint64_t xfs_bmbt_rec_base_t; /* use this for casts */
+typedef uint64_t xfs_bmbt_rec_base_t;
typedef xfs_bmbt_rec_64_t xfs_bmbt_rec_t, xfs_bmdr_rec_t;
-
-// from http://www.dubeiko.com/development/FileSystems/XFS/xfs_filesystem_structure.pdf
-
+
typedef struct { uint8_t i[8]; } xfs_dir2_ino8_t;
typedef struct { uint8_t i[4]; } xfs_dir2_ino4_t;
typedef union {
@@ -359,42 +252,8 @@ typedef union {
typedef uint16_t xfs_dir2_sf_off_t;
-
-
typedef xfs_fsblock_t xfs_bmbt_ptr_t, xfs_bmdr_ptr_t;
-
-
-
-
-
-
-
-
-// from https://github.com/torvalds/linux/blob/master/fs/xfs/libxfs/xfs_format.h#L849
-
-#define XFS_DADDR_TO_FSB(mp,d) XFS_AGB_TO_FSB(mp, \
- xfs_daddr_to_agno(mp,d), xfs_daddr_to_agbno(mp,d))
-#define XFS_FSB_TO_DADDR(mp,fsbno) XFS_AGB_TO_DADDR(mp, \
- XFS_FSB_TO_AGNO(mp,fsbno), XFS_FSB_TO_AGBNO(mp,fsbno))
-
-
-// from https://github.com/torvalds/linux/blob/master/fs/xfs/libxfs/xfs_format.h#L849
-/*
- * Bmap btree record and extent descriptor.
- * l0:63 is an extent flag (value 1 indicates non-normal).
- * l0:9-62 are startoff.
- * l0:0-8 and l1:21-63 are startblock.
- * l1:0-20 are blockcount.
- */
-#define BMBT_EXNTFLAG_BITLEN 1
-#define BMBT_STARTOFF_BITLEN 54
-#define BMBT_STARTBLOCK_BITLEN 52
-#define BMBT_BLOCKCOUNT_BITLEN 21
-
-
-
-
typedef struct xfs_dir2_sf_entry {
uint8_t namelen;
xfs_dir2_sf_off_t offset;
@@ -407,75 +266,15 @@ typedef struct xfs_dir2_sf_hdr {
uint8_t i8count;
xfs_dir2_inou_t parent;
} xfs_dir2_sf_hdr_t;
+
typedef struct xfs_dir2_sf {
xfs_dir2_sf_hdr_t hdr;
xfs_dir2_sf_entry_t list[1];
} xfs_dir2_sf_t;
-
-typedef int64_t xfs_fsize_t;
-typedef int16_t xfs_aextnum_t; /* # extents in an attribute fork */
-
-typedef struct xfs_btree_sblock xfs_inobt_block_t;
-
-typedef struct xfs_inobt_rec {
- uint32_t ir_startino;
- uint32_t ir_freecount;
- uint64_t ir_free;
-} xfs_inobt_rec_t;
-
-typedef struct xfs_inobt_key {
- __be32 ir_startino;
-} xfs_inobt_key_t;
-typedef __be32 xfs_inobt_ptr_t;
-
-
-typedef struct xfs_timestamp {
- int32_t t_sec;
- int32_t t_nsec;
-} xfs_timestamp_t;
-
-typedef enum xfs_dinode_fmt {
- XFS_DINODE_FMT_DEV,
- XFS_DINODE_FMT_LOCAL,
- XFS_DINODE_FMT_EXTENTS,
- XFS_DINODE_FMT_BTREE,
- XFS_DINODE_FMT_UUID,
- XFS_DINODE_FMT_RMAP,
-} xfs_dinode_fmt_t;
-
-typedef struct xfs_dinode_core {
- uint16_t di_magic;
- uint16_t di_mode;
- int8_t di_version;
- int8_t di_format;
- uint16_t di_onlink;
- uint32_t di_uid;
- uint32_t di_gid;
- uint32_t di_nlink;
- uint16_t di_projid;
- uint16_t di_projid_hi;
- uint8_t di_pad[6];
- uint16_t di_flushiter;
- xfs_timestamp_t di_atime;
- xfs_timestamp_t di_mtime;
- xfs_timestamp_t di_ctime;
- xfs_fsize_t di_size;
- xfs_drfsbno_t di_nblocks;
- xfs_extlen_t di_extsize;
- xfs_extnum_t di_nextents;
- xfs_aextnum_t di_anextents;
- uint8_t di_forkoff;
- int8_t di_aformat;
- uint32_t di_dmevmask;
- uint16_t di_dmstate;
- uint16_t di_flags;
- uint32_t di_gen;
-} xfs_dinode_core_t;
-
typedef struct xfs_attr_shortform {
struct xfs_attr_sf_hdr {
- __be16 totsize;
+ uint16_t totsize;
uint8_t count;
} hdr;
struct xfs_attr_sf_entry {
@@ -490,7 +289,7 @@ typedef struct xfs_dinode
{
xfs_dinode_core_t di_core;
- uint32_t di_next_unlinked;/* agi unlinked list ptr */
+ uint32_t di_next_unlinked;/* agi unlinked list ptr */
/* version 5 filesystem (inode version 3) fields start here */
uint32_t di_crc;
@@ -508,7 +307,7 @@ typedef struct xfs_dinode
xfs_bmbt_rec_t di_bmx[1]; /* extent list */
xfs_dir2_sf_t di_dir2sf; /* shortform directory v2 */
char di_c[1]; /* local contents */
- __be32 di_dev; /* device for S_IFCHR/S_IFBLK */
+ uint32_t di_dev; /* device for S_IFCHR/S_IFBLK */
xfs_uuid_t di_muuid; /* mount point value */
char di_symlink[1]; /* local symbolic link */
} di_u;
@@ -519,27 +318,21 @@ typedef struct xfs_dinode
} di_a;
} xfs_dinode_t;
-
/*
* Size of the core inode on disk. Version 1 and 2 inodes have
* the same size, but version 3 has grown a few additional fields.
*/
static inline uint8_t xfs_dinode_size(int version)
{
- // The inode’s core is 96 bytes on a V4 filesystem and 176 bytes on a V5 filesystem. It contains information about the
- // file itself including most stat data information about data and attribute forks after the core within the inode. It uses
- // the following structure:
-
if (version == 3)
{
- //return sizeof(struct xfs_dinode);
- return 176; // hardcode for now
+ return 176;
}
+ else
+ {
+ return 100;
- return 100; // hardcode for now
- //sizeof(xfs_dinode_core_t) + sizeof(uint32_t);
- // offsetof(struct xfs_dinode, di_next_unlinked) + sizeof(uint32_t); // hacky
- //96;
+ }
}
/*
@@ -582,29 +375,17 @@ static inline uint8_t xfs_dinode_size(int version)
#define XFS_DFORK_PTR(dip,w) \
((w) == XFS_DATA_FORK ? XFS_DFORK_DPTR(dip) : XFS_DFORK_APTR(dip))
-
-
-/*
- * Directories
- */
-
-// from https://github.com/torvalds/linux/blob/master/fs/xfs/libxfs/xfs_types.h#L23
/*
* XFS_MAXNAMELEN is the length (including the terminating null) of
* the longest permissible file (component) name.
*/
#define XFS_MAXNAMELEN 256
-
-// from https://github.com/torvalds/linux/blob/master/fs/xfs/libxfs/xfs_da_format.h
-
/*
* Byte offset in data block and shortform entry.
*/
typedef uint16_t xfs_dir2_data_off_t;
-#define XFS_DIR2_DATA_FD_COUNT 3
-
/*
* Describe a free area in the data block.
*
@@ -615,10 +396,9 @@ typedef struct xfs_dir2_data_free {
uint16_t length; /* length of freespace */
} xfs_dir2_data_free_t;
+#define XFS_DIR2_DATA_FD_COUNT 3
/*
* Header for the data blocks.
- *
- * The code knows that XFS_DIR2_DATA_FD_COUNT is 3.
*/
typedef struct xfs_dir2_data_hdr {
uint32_t magic; /* XFS_DIR2_DATA_MAGIC or */
@@ -626,7 +406,6 @@ typedef struct xfs_dir2_data_hdr {
xfs_dir2_data_free_t bestfree[XFS_DIR2_DATA_FD_COUNT];
} xfs_dir2_data_hdr_t;
-
/*
* Active entry in a data block.
*
@@ -643,7 +422,7 @@ typedef struct xfs_dir2_data_entry {
uint8_t namelen; /* name length */
/* __u8 name[]; /* name bytes, no null */
/* __u8 filetype; */ /* type of inode we point to */
- /* __be16 tag; */ /* starting offset of us */
+ /* uint16_t tag; */ /* starting offset of us */
} xfs_dir2_data_entry_t;
typedef struct xfs_dir2_data_unused {
@@ -654,13 +433,11 @@ typedef struct xfs_dir2_data_unused {
#define XFS_DIR2_DATA_UNUSED_SIZE 6
-
typedef struct xfs_dir2_block_tail {
uint32_t count;
uint32_t stale;
} xfs_dir2_block_tail_t;
-
typedef uint32_t xfs_dahash_t;
typedef uint32_t xfs_dir2_dataptr_t;
typedef struct xfs_dir2_leaf_entry {
@@ -668,8 +445,6 @@ typedef struct xfs_dir2_leaf_entry {
xfs_dir2_dataptr_t address;
} xfs_dir2_leaf_entry_t;
-// https://github.com/torvalds/linux/blob/master/fs/xfs/libxfs/xfs_da_format.h#L418
-
#define XFS_DIR2_DATA_ALIGN_LOG 3 /* i.e., 8 bytes */
#define XFS_DIR2_SPACE_SIZE (1ULL << (32 + XFS_DIR2_DATA_ALIGN_LOG))
#define XFS_DIR2_LEAF_SPACE 1
@@ -677,6 +452,160 @@ typedef struct xfs_dir2_leaf_entry {
#define XFS_DIR2_FREE_SPACE 2
#define XFS_DIR2_FREE_OFFSET (XFS_DIR2_FREE_SPACE * XFS_DIR2_SPACE_SIZE)
+
+/*
+** Super Block and related definitions
+*/
+
+/*
+ * There are two words to hold XFS "feature" bits: the original
+ * word, sb_versionnum, and sb_features2. Whenever a bit is set in
+ * sb_features2, the feature bit XFS_SB_VERSION_MOREBITSBIT must be set.
+ *
+ * These defines represent bits in sb_features2.
+ */
+#define XFS_SB_VERSION2_RESERVED1BIT 0x00000001
+#define XFS_SB_VERSION2_LAZYSBCOUNTBIT 0x00000002 /* Superblk counters */
+#define XFS_SB_VERSION2_RESERVED4BIT 0x00000004
+#define XFS_SB_VERSION2_ATTR2BIT 0x00000008 /* Inline attr rework */
+#define XFS_SB_VERSION2_PARENTBIT 0x00000010 /* parent pointers */
+#define XFS_SB_VERSION2_PROJID32BIT 0x00000080 /* 32 bit project id */
+#define XFS_SB_VERSION2_CRCBIT 0x00000100 /* metadata CRCs */
+#define XFS_SB_VERSION2_FTYPE 0x00000200 /* inode type in dir */
+
+#define XFS_SB_VERSION2_OKBITS \
+ (XFS_SB_VERSION2_LAZYSBCOUNTBIT | \
+ XFS_SB_VERSION2_ATTR2BIT | \
+ XFS_SB_VERSION2_PROJID32BIT | \
+ XFS_SB_VERSION2_FTYPE)
+
+#define XFS_SB_FEAT_RO_COMPAT_FINOBT (1 << 0) /* free inode btree */
+#define XFS_SB_FEAT_RO_COMPAT_RMAPBT (1 << 1) /* reverse map btree */
+#define XFS_SB_FEAT_RO_COMPAT_REFLINK (1 << 2) /* reflinked files */
+
+#define XFS_SB_FEAT_INCOMPAT_FTYPE (1 << 0) /* filetype in dirent */
+#define XFS_SB_FEAT_INCOMPAT_SPINODES (1 << 1) /* sparse inode chunks */
+#define XFS_SB_FEAT_INCOMPAT_META_UUID (1 << 2) /* metadata UUID */
+
+#define XFS_SB_VERSION_NUMBITS 0x000f
+#define XFS_SB_VERSION_NUM(sbp) ((sbp)->sb_versionnum & XFS_SB_VERSION_NUMBITS)
+
+#define XFS_BTNUM_AGF 2
+typedef struct xfs_agf {
+ uint32_t agf_magicnum;
+ uint32_t agf_versionnum;
+ uint32_t agf_seqno;
+ uint32_t agf_length;
+ uint32_t agf_roots[XFS_BTNUM_AGF];
+ uint32_t agf_spare0;
+ uint32_t agf_levels[XFS_BTNUM_AGF];
+ uint32_t agf_spare1;
+ uint32_t agf_flfirst;
+ uint32_t agf_fllast;
+ uint32_t agf_flcount;
+ uint32_t agf_freeblks;
+ uint32_t agf_longest;
+ uint32_t agf_btreeblks;
+} xfs_agf_t;
+
+#define XFS_AGFL_SIZE 36
+typedef struct xfs_agfl {
+ uint32_t agfl_magicnum;
+ uint32_t agfl_seqno;
+ xfs_uuid_t agfl_uuid;
+ uint64_t agfl_lsn;
+ uint32_t agfl_crc;
+} xfs_agfl_t;
+
+typedef struct xfs_agi {
+ uint32_t agi_magicnum;
+ uint32_t agi_versionnum;
+ uint32_t agi_seqno;
+ uint32_t agi_length;
+ uint32_t agi_count;
+ uint32_t agi_root;
+ uint32_t agi_level;
+ uint32_t agi_freecount;
+ uint32_t agi_newino;
+ uint32_t agi_dirino;
+ uint32_t agi_unlinked[64];
+
+ /*
+ * v5 filesystem fields start here; this marks the end of logging region 1
+ * and start of logging region 2.
+ * /
+ xfs_uuid_t agi_uuid;
+ uint32_t agi_crc;
+ uint32_t agi_pad32;
+ uint64_t agi_lsn;
+ uint32_t agi_free_root;
+ uint32_t agi_free_level;
+ */
+} xfs_agi_t;
+
+typedef struct xfs_sb
+{
+ uint32_t sb_magicnum;
+ uint32_t sb_blocksize;
+ xfs_drfsbno_t sb_dblocks;
+ xfs_drfsbno_t sb_rblocks;
+ xfs_drtbno_t sb_rextents;
+ xfs_uuid_t sb_uuid;
+ xfs_dfsbno_t sb_logstart;
+ xfs_ino_t sb_rootino;
+ xfs_ino_t sb_rbmino;
+ xfs_ino_t sb_rsumino;
+ xfs_agblock_t sb_rextsize;
+ xfs_agblock_t sb_agblocks;
+ xfs_agnumber_t sb_agcount;
+ xfs_extlen_t sb_rbmblocks;
+ xfs_extlen_t sb_logblocks;
+ uint16_t sb_versionnum;
+ uint16_t sb_sectsize;
+ uint16_t sb_inodesize;
+ uint16_t sb_inopblock;
+ char sb_fname[12];
+ uint8_t sb_blocklog;
+ uint8_t sb_sectlog;
+ uint8_t sb_inodelog;
+ uint8_t sb_inopblog;
+ uint8_t sb_agblklog;
+ uint8_t sb_rextslog;
+ uint8_t sb_inprogress;
+ uint8_t sb_imax_pct;
+ uint64_t sb_icount;
+ uint64_t sb_ifree;
+ uint64_t sb_fdblocks;
+ uint64_t sb_frextents;
+ xfs_ino_t sb_uquotino;
+ xfs_ino_t sb_gquotino;
+ uint16_t sb_qflags;
+ uint8_t sb_flags;
+ uint8_t sb_shared_vn;
+ xfs_extlen_t sb_inoalignmt;
+ uint32_t sb_unit;
+ uint32_t sb_width;
+ uint8_t sb_dirblklog;
+ uint8_t sb_logsectlog;
+ uint16_t sb_logsectsize;
+ uint32_t sb_logsunit;
+ uint32_t sb_features2;
+ uint32_t sb_bad_features2;
+
+ /* version 5 superblock fields start here */
+ uint32_t sb_features_compat;
+ uint32_t sb_features_ro_compat;
+ uint32_t sb_features_incompat;
+ uint32_t sb_features_log_incompat;
+ uint32_t sb_crc;
+ xfs_extlen_t sb_spino_align;
+ xfs_ino_t sb_pquotino;
+ xfs_lsn_t sb_lsn;
+ xfs_uuid_t sb_meta_uuid;
+ xfs_ino_t sb_rrmapino;
+} xfs_sb_t;
+
+
/*
* Structure of an xfs file system handle.
*/
diff --git a/tsk/fs/xfs.cpp b/tsk/fs/xfs.cpp
index f244b79e4b09ed6e73caaf1a11ca58bf5e9d8aaa..23ed14dfeac651a88f20810725a9767dfc59be35 100644
--- a/tsk/fs/xfs.cpp
+++ b/tsk/fs/xfs.cpp
@@ -323,13 +323,11 @@ xfs_dinode_load(XFSFS_INFO * xfsfs, TSK_INUM_T dino_inum,
return 0;
}
-// from https://github.com/torvalds/linux/blob/master/fs/xfs/libxfs/xfs_bit.h#L24
static inline uint64_t xfs_mask64lo(int n)
{
return ((uint64_t)1 << (n)) - 1;
}
-// from https://github.com/torvalds/linux/blob/master/fs/xfs/libxfs/xfs_bmap_btree.c#L63
void
xfs_bmbt_disk_get_all(
xfs_bmbt_rec_t *rec,
diff --git a/tsk/img/img_open.cpp b/tsk/img/img_open.cpp
index 296bc1587b1e8619ca464d1482e05af652d3cc2f..2b72d2da51967a0eda47d87e6d59403a80c82543 100644
--- a/tsk/img/img_open.cpp
+++ b/tsk/img/img_open.cpp
@@ -393,8 +393,8 @@ tsk_img_open_utf8(int num_img,
/**
* \ingroup imglib
* Opens an an image of type TSK_IMG_TYPE_EXTERNAL. The void pointer parameter
- * must be castable to a TSK_IMG_INFO pointer. It is up to
- * the caller to set the tag value in ext_img_info. This
+ * must be castable to a TSK_IMG_INFO pointer. It is up to
+ * the caller to set the tag value in ext_img_info. This
* method will initialize the cache lock.
*
* @param ext_img_info Pointer to the partially initialized disk image