4 * HPFS structures by Chris Smith, 1993
6 * a little bit modified by Mikulas Patocka, 1998-1999
12 Design goals and implementation of the new High Performance File System
13 Microsoft Systems Journal Sept 1989 v4 n5 p1(13)
15 describes what HPFS looked like when it was new, and it is the source
16 of most of the information given here. The rest is conjecture.
18 For definitive information on the Duncan paper, see it, not this file.
19 For definitive information on HPFS, ask somebody else -- this is guesswork.
20 There are certain to be many mistakes. */
24 typedef unsigned secno; /* sector number, partition relative */
26 typedef secno dnode_secno; /* sector number of a dnode */
27 typedef secno fnode_secno; /* sector number of an fnode */
28 typedef secno anode_secno; /* sector number of an anode */
32 /* The boot block is very like a FAT boot block, except that the
33 29h signature byte is 28h instead, and the ID string is "HPFS". */
35 #define BB_MAGIC 0xaa55
37 struct hpfs_boot_block
40 unsigned char oem_id[8];
41 unsigned char bytes_per_sector[2]; /* 512 */
42 unsigned char sectors_per_cluster;
43 unsigned char n_reserved_sectors[2];
45 unsigned char n_rootdir_entries[2];
46 unsigned char n_sectors_s[2];
47 unsigned char media_byte;
48 unsigned short sectors_per_fat;
49 unsigned short sectors_per_track;
50 unsigned short heads_per_cyl;
51 unsigned int n_hidden_sectors;
52 unsigned int n_sectors_l; /* size of partition */
53 unsigned char drive_number;
55 unsigned char sig_28h; /* 28h */
56 unsigned char vol_serno[4];
57 unsigned char vol_label[11];
58 unsigned char sig_hpfs[8]; /* "HPFS " */
59 unsigned char pad[448];
60 unsigned short magic; /* aa55 */
66 /* The super block has the pointer to the root directory. */
68 #define SB_MAGIC 0xf995e849
70 struct hpfs_super_block
72 unsigned magic; /* f995 e849 */
73 unsigned magic1; /* fa53 e9c5, more magic? */
74 /*unsigned huh202;*/ /* ?? 202 = N. of B. in 1.00390625 S.*/
75 char version; /* version of a filesystem usually 2 */
76 char funcversion; /* functional version - oldest version
77 of filesystem that can understand
79 unsigned short int zero; /* 0 */
80 fnode_secno root; /* fnode of root directory */
81 secno n_sectors; /* size of filesystem */
82 unsigned n_badblocks; /* number of bad blocks */
83 secno bitmaps; /* pointers to free space bit maps */
84 unsigned zero1; /* 0 */
85 secno badblocks; /* bad block list */
86 unsigned zero3; /* 0 */
87 time_t last_chkdsk; /* date last checked, 0 if never */
88 /*unsigned zero4;*/ /* 0 */
89 time_t last_optimize; /* date last optimized, 0 if never */
90 secno n_dir_band; /* number of sectors in dir band */
91 secno dir_band_start; /* first sector in dir band */
92 secno dir_band_end; /* last sector in dir band */
93 secno dir_band_bitmap; /* free space map, 1 dnode per bit */
94 char volume_name[32]; /* not used */
95 secno user_id_table; /* 8 preallocated sectors - user id */
96 unsigned zero6[103]; /* 0 */
102 /* The spare block has pointers to spare sectors. */
104 #define SP_MAGIC 0xf9911849
106 struct hpfs_spare_block
108 unsigned magic; /* f991 1849 */
109 unsigned magic1; /* fa52 29c5, more magic? */
111 unsigned dirty: 1; /* 0 clean, 1 "improperly stopped" */
112 /*unsigned flag1234: 4;*/ /* unknown flags */
113 unsigned sparedir_used: 1; /* spare dirblks used */
114 unsigned hotfixes_used: 1; /* hotfixes used */
115 unsigned bad_sector: 1; /* bad sector, corrupted disk (???) */
116 unsigned bad_bitmap: 1; /* bad bitmap */
117 unsigned fast: 1; /* partition was fast formatted */
118 unsigned old_wrote: 1; /* old version wrote to partion */
119 unsigned old_wrote_1: 1; /* old version wrote to partion (?) */
120 unsigned install_dasd_limits: 1; /* HPFS386 flags */
121 unsigned resynch_dasd_limits: 1;
122 unsigned dasd_limits_operational: 1;
123 unsigned multimedia_active: 1;
124 unsigned dce_acls_active: 1;
125 unsigned dasd_limits_dirty: 1;
127 unsigned char mm_contlgulty;
128 unsigned char unused;
130 secno hotfix_map; /* info about remapped bad sectors */
131 unsigned n_spares_used; /* number of hotfixes */
132 unsigned n_spares; /* number of spares in hotfix map */
133 unsigned n_dnode_spares_free; /* spare dnodes unused */
134 unsigned n_dnode_spares; /* length of spare_dnodes[] list,
135 follows in this block*/
136 secno code_page_dir; /* code page directory block */
137 unsigned n_code_pages; /* number of code pages */
138 /*unsigned large_numbers[2];*/ /* ?? */
139 unsigned super_crc; /* on HPFS386 and LAN Server this is
140 checksum of superblock, on normal
142 unsigned spare_crc; /* on HPFS386 checksum of spareblock */
143 unsigned zero1[15]; /* unused */
144 dnode_secno spare_dnodes[100]; /* emergency free dnode list */
145 unsigned zero2[1]; /* room for more? */
148 /* The bad block list is 4 sectors long. The first word must be zero,
149 the remaining words give n_badblocks bad block numbers.
150 I bet you can see it coming... */
154 /* The hotfix map is 4 sectors long. It looks like
156 secno from[n_spares];
159 The to[] list is initialized to point to n_spares preallocated empty
160 sectors. The from[] list contains the sector numbers of bad blocks
161 which have been remapped to corresponding sectors in the to[] list.
162 n_spares_used gives the length of the from[] list. */
165 /* Sectors 18 and 19 are preallocated and unused.
166 Maybe they're spares for 16 and 17, but simple substitution fails. */
169 /* The code page info pointed to by the spare block consists of an index
170 block and blocks containing uppercasing tables. I don't know what
171 these are for (CHKDSK, maybe?) -- OS/2 does not seem to use them
172 itself. Linux doesn't use them either. */
174 /* block pointed to by spareblock->code_page_dir */
176 #define CP_DIR_MAGIC 0x494521f7
178 struct code_page_directory
180 unsigned magic; /* 4945 21f7 */
181 unsigned n_code_pages; /* number of pointers following */
184 unsigned short ix; /* index */
185 unsigned short code_page_number; /* code page number */
186 unsigned bounds; /* matches corresponding word
188 secno code_page_data; /* sector number of a code_page_data
189 containing c.p. array */
190 unsigned short index; /* index in c.p. array in that sector*/
191 unsigned short unknown; /* some unknown value; usually 0;
192 2 in Japanese version */
193 } array[31]; /* unknown length */
196 /* blocks pointed to by code_page_directory */
198 #define CP_DATA_MAGIC 0x894521f7
200 struct code_page_data
202 unsigned magic; /* 8945 21f7 */
203 unsigned n_used; /* # elements used in c_p_data[] */
204 unsigned bounds[3]; /* looks a bit like
205 (beg1,end1), (beg2,end2)
207 unsigned short offs[3]; /* offsets from start of sector
208 to start of c_p_data[ix] */
210 unsigned short ix; /* index */
211 unsigned short code_page_number; /* code page number */
212 unsigned short unknown; /* the same as in cp directory */
213 unsigned char map[128]; /* upcase table for chars 80..ff */
214 unsigned short zero2;
216 unsigned char incognita[78];
220 /* Free space bitmaps are 4 sectors long, which is 16384 bits.
221 16384 sectors is 8 meg, and each 8 meg band has a 4-sector bitmap.
222 Bit order in the maps is little-endian. 0 means taken, 1 means free.
224 Bit map sectors are marked allocated in the bit maps, and so are sectors
225 off the end of the partition.
227 Band 0 is sectors 0-3fff, its map is in sectors 18-1b.
228 Band 1 is 4000-7fff, its map is in 7ffc-7fff.
229 Band 2 is 8000-ffff, its map is in 8000-8003.
230 The remaining bands have maps in their first (even) or last (odd) 4 sectors
231 -- if the last, partial, band is odd its map is in its last 4 sectors.
233 The bitmap locations are given in a table pointed to by the super block.
234 No doubt they aren't constrained to be at 18, 7ffc, 8000, ...; that is
235 just where they usually are.
237 The "directory band" is a bunch of sectors preallocated for dnodes.
238 It has a 4-sector free space bitmap of its own. Each bit in the map
239 corresponds to one 4-sector dnode, bit 0 of the map corresponding to
240 the first 4 sectors of the directory band. The entire band is marked
241 allocated in the main bitmap. The super block gives the locations
242 of the directory band and its bitmap. ("band" doesn't mean it is
243 8 meg long; it isn't.) */
246 /* dnode: directory. 4 sectors long */
248 /* A directory is a tree of dnodes. The fnode for a directory
249 contains one pointer, to the root dnode of the tree. The fnode
250 never moves, the dnodes do the B-tree thing, splitting and merging
251 as files are added and removed. */
253 #define DNODE_MAGIC 0x77e40aae
256 unsigned magic; /* 77e4 0aae */
257 unsigned first_free; /* offset from start of dnode to
258 first free dir entry */
259 unsigned root_dnode:1; /* Is it root dnode? */
260 unsigned increment_me:31; /* some kind of activity counter?
261 Neither HPFS.IFS nor CHKDSK cares
262 if you change this word */
263 secno up; /* (root dnode) directory's fnode
264 (nonroot) parent dnode */
265 dnode_secno self; /* pointer to this dnode */
266 unsigned char dirent[2028]; /* one or more dirents */
270 unsigned short length; /* offset to next dirent */
271 unsigned first: 1; /* set on phony ^A^A (".") entry */
273 unsigned down: 1; /* down pointer present (after name) */
274 unsigned last: 1; /* set on phony \377 entry */
275 unsigned has_ea: 1; /* entry has EA */
276 unsigned has_xtd_perm: 1; /* has extended perm list (???) */
277 unsigned has_explicit_acl: 1;
278 unsigned has_needea: 1; /* ?? some EA has NEEDEA set
279 I have no idea why this is
280 interesting in a dir entry */
281 unsigned read_only: 1; /* dos attrib */
282 unsigned hidden: 1; /* dos attrib */
283 unsigned system: 1; /* dos attrib */
284 unsigned flag11: 1; /* would be volume label dos attrib */
285 unsigned directory: 1; /* dos attrib */
286 unsigned archive: 1; /* dos attrib */
287 unsigned not_8x3: 1; /* name is not 8.3 */
289 fnode_secno fnode; /* fnode giving allocation info */
290 time_t write_date; /* mtime */
291 unsigned file_size; /* file length, bytes */
292 time_t read_date; /* atime */
293 time_t creation_date; /* ctime */
294 unsigned ea_size; /* total EA length, bytes */
295 unsigned char no_of_acls : 3; /* number of ACL's */
296 unsigned char reserver : 5;
297 unsigned char ix; /* code page index (of filename), see
298 struct code_page_data */
299 unsigned char namelen, name[1]; /* file name */
300 /* dnode_secno down; btree down pointer, if present,
301 follows name on next word boundary, or maybe it
302 precedes next dirent, which is on a word boundary. */
306 /* B+ tree: allocation info in fnodes and anodes */
308 /* dnodes point to fnodes which are responsible for listing the sectors
309 assigned to the file. This is done with trees of (length,address)
310 pairs. (Actually triples, of (length, file-address, disk-address)
311 which can represent holes. Find out if HPFS does that.)
312 At any rate, fnodes contain a small tree; if subtrees are needed
313 they occupy essentially a full block in anodes. A leaf-level tree node
314 has 3-word entries giving sector runs, a non-leaf node has 2-word
315 entries giving subtree pointers. A flag in the header says which. */
317 struct bplus_leaf_node
319 unsigned file_secno; /* first file sector in extent */
320 unsigned length; /* length, sectors */
321 secno disk_secno; /* first corresponding disk sector */
324 struct bplus_internal_node
326 unsigned file_secno; /* subtree maps sectors < this */
327 anode_secno down; /* pointer to subtree */
332 unsigned hbff: 1; /* high bit of first free entry offset */
337 unsigned fnode_parent: 1; /* ? we're pointed to by an fnode,
338 the data btree or some ea or the
339 main ea bootage pointer ea_secno */
340 /* also can get set in fnodes, which
341 may be a chkdsk glitch or may mean
342 this bit is irrelevant in fnodes,
343 or this interpretation is all wet */
344 unsigned binary_search: 1; /* suggest binary search (unused) */
345 unsigned internal: 1; /* 1 -> (internal) tree of anodes
346 0 -> (leaf) list of extents */
347 unsigned char fill[3];
348 unsigned char n_free_nodes; /* free nodes in following array */
349 unsigned char n_used_nodes; /* used nodes in following array */
350 unsigned short first_free; /* offset from start of header to
351 first free node in array */
353 struct bplus_internal_node internal[0]; /* (internal) 2-word entries giving
355 struct bplus_leaf_node external[0]; /* (external) 3-word entries giving
360 /* fnode: root of allocation b+ tree, and EA's */
362 /* Every file and every directory has one fnode, pointed to by the directory
363 entry and pointing to the file's sectors or directory's root dnode. EA's
364 are also stored here, and there are said to be ACL's somewhere here too. */
366 #define FNODE_MAGIC 0xf7e40aae
370 unsigned magic; /* f7e4 0aae */
371 unsigned zero1[2]; /* read history */
372 unsigned char len, name[15]; /* true length, truncated name */
373 fnode_secno up; /* pointer to file's directory fnode */
374 /*unsigned zero2[3];*/
377 unsigned short acl_size_s;
379 char zero2; /* history bit count */
380 unsigned ea_size_l; /* length of disk-resident ea's */
381 secno ea_secno; /* first sector of disk-resident ea's*/
382 unsigned short ea_size_s; /* length of fnode-resident ea's */
385 unsigned ea_anode: 1; /* 1 -> ea_secno is an anode */
392 unsigned dirflag: 1; /* 1 -> directory. first & only extent
402 struct bplus_header btree; /* b+ tree, 8 extents or 12 subtrees */
404 struct bplus_leaf_node external[8];
405 struct bplus_internal_node internal[12];
408 unsigned file_size; /* file length, bytes */
409 unsigned n_needea; /* number of EA's with NEEDEA set */
410 char user_id[16]; /* unused */
411 unsigned ea_offs; /* offset from start of fnode
412 to first fnode-resident ea */
413 char dasd_limit_treshhold;
414 char dasd_limit_delta;
417 /*unsigned zero5[2];*/
418 unsigned char ea[316]; /* zero or more EA's, packed together
419 with no alignment padding.
420 (Do not use this name, get here
421 via fnode + ea_offs. I think.) */
425 /* anode: 99.44% pure allocation tree */
427 #define ANODE_MAGIC 0x37e40aae
431 unsigned magic; /* 37e4 0aae */
432 anode_secno self; /* pointer to this anode */
433 secno up; /* parent anode or fnode */
435 struct bplus_header btree; /* b+tree, 40 extents or 60 subtrees */
437 struct bplus_leaf_node external[40];
438 struct bplus_internal_node internal[60];
441 unsigned fill[3]; /* unused */
445 /* extended attributes.
447 A file's EA info is stored as a list of (name,value) pairs. It is
448 usually in the fnode, but (if it's large) it is moved to a single
449 sector run outside the fnode, or to multiple runs with an anode tree
452 The value of a single EA is stored along with the name, or (if large)
453 it is moved to a single sector run, or multiple runs pointed to by an
454 anode tree, pointed to by the value field of the (name,value) pair.
456 Flags in the EA tell whether the value is immediate, in a single sector
457 run, or in multiple runs. Flags in the fnode tell whether the EA list
458 is immediate, in a single run, or in multiple runs. */
460 struct extended_attribute
462 unsigned indirect: 1; /* 1 -> value gives sector number
463 where real value starts */
464 unsigned anode: 1; /* 1 -> sector is an anode
465 that points to fragmented value */
471 unsigned needea: 1; /* required ea */
472 unsigned char namelen; /* length of name, bytes */
473 unsigned short valuelen; /* length of value, bytes */
474 unsigned char name[0];
476 unsigned char name[namelen]; ascii attrib name
477 unsigned char nul; terminating '\0', not counted
478 unsigned char value[valuelen]; value, arbitrary
479 if this.indirect, valuelen is 8 and the value is
480 unsigned length; real length of value, bytes
481 secno secno; sector address where it starts
482 if this.anode, the above sector number is the root of an anode tree
483 which points to the value.