4 * HPFS structures by Chris Smith, 1993
6 * a little bit modified by Mikulas Patocka, 1998-1999
12 Design goals and implementation of the new High Performance File System
13 Microsoft Systems Journal Sept 1989 v4 n5 p1(13)
15 describes what HPFS looked like when it was new, and it is the source
16 of most of the information given here. The rest is conjecture.
18 For definitive information on the Duncan paper, see it, not this file.
19 For definitive information on HPFS, ask somebody else -- this is guesswork.
20 There are certain to be many mistakes. */
22 #if !defined(__LITTLE_ENDIAN) && !defined(__BIG_ENDIAN)
28 typedef u32 secno; /* sector number, partition relative */
30 typedef secno dnode_secno; /* sector number of a dnode */
31 typedef secno fnode_secno; /* sector number of an fnode */
32 typedef secno anode_secno; /* sector number of an anode */
34 typedef u32 time32_t; /* 32-bit time_t type */
38 /* The boot block is very like a FAT boot block, except that the
39 29h signature byte is 28h instead, and the ID string is "HPFS". */
41 #define BB_MAGIC 0xaa55
43 struct hpfs_boot_block
47 u8 bytes_per_sector[2]; /* 512 */
48 u8 sectors_per_cluster;
49 u8 n_reserved_sectors[2];
51 u8 n_rootdir_entries[2];
55 u16 sectors_per_track;
58 u32 n_sectors_l; /* size of partition */
64 u8 sig_hpfs[8]; /* "HPFS " */
72 /* The super block has the pointer to the root directory. */
74 #define SB_MAGIC 0xf995e849
76 struct hpfs_super_block
78 u32 magic; /* f995 e849 */
79 u32 magic1; /* fa53 e9c5, more magic? */
80 u8 version; /* version of a filesystem usually 2 */
81 u8 funcversion; /* functional version - oldest version
82 of filesystem that can understand
85 fnode_secno root; /* fnode of root directory */
86 secno n_sectors; /* size of filesystem */
87 u32 n_badblocks; /* number of bad blocks */
88 secno bitmaps; /* pointers to free space bit maps */
90 secno badblocks; /* bad block list */
92 time32_t last_chkdsk; /* date last checked, 0 if never */
93 time32_t last_optimize; /* date last optimized, 0 if never */
94 secno n_dir_band; /* number of sectors in dir band */
95 secno dir_band_start; /* first sector in dir band */
96 secno dir_band_end; /* last sector in dir band */
97 secno dir_band_bitmap; /* free space map, 1 dnode per bit */
98 u8 volume_name[32]; /* not used */
99 secno user_id_table; /* 8 preallocated sectors - user id */
100 u32 zero6[103]; /* 0 */
106 /* The spare block has pointers to spare sectors. */
108 #define SP_MAGIC 0xf9911849
110 struct hpfs_spare_block
112 u32 magic; /* f991 1849 */
113 u32 magic1; /* fa52 29c5, more magic? */
115 #ifdef __LITTLE_ENDIAN
116 u8 dirty: 1; /* 0 clean, 1 "improperly stopped" */
117 u8 sparedir_used: 1; /* spare dirblks used */
118 u8 hotfixes_used: 1; /* hotfixes used */
119 u8 bad_sector: 1; /* bad sector, corrupted disk (???) */
120 u8 bad_bitmap: 1; /* bad bitmap */
121 u8 fast: 1; /* partition was fast formatted */
122 u8 old_wrote: 1; /* old version wrote to partion */
123 u8 old_wrote_1: 1; /* old version wrote to partion (?) */
125 u8 old_wrote_1: 1; /* old version wrote to partion (?) */
126 u8 old_wrote: 1; /* old version wrote to partion */
127 u8 fast: 1; /* partition was fast formatted */
128 u8 bad_bitmap: 1; /* bad bitmap */
129 u8 bad_sector: 1; /* bad sector, corrupted disk (???) */
130 u8 hotfixes_used: 1; /* hotfixes used */
131 u8 sparedir_used: 1; /* spare dirblks used */
132 u8 dirty: 1; /* 0 clean, 1 "improperly stopped" */
135 #ifdef __LITTLE_ENDIAN
136 u8 install_dasd_limits: 1; /* HPFS386 flags */
137 u8 resynch_dasd_limits: 1;
138 u8 dasd_limits_operational: 1;
139 u8 multimedia_active: 1;
140 u8 dce_acls_active: 1;
141 u8 dasd_limits_dirty: 1;
145 u8 dasd_limits_dirty: 1;
146 u8 dce_acls_active: 1;
147 u8 multimedia_active: 1;
148 u8 dasd_limits_operational: 1;
149 u8 resynch_dasd_limits: 1;
150 u8 install_dasd_limits: 1; /* HPFS386 flags */
156 secno hotfix_map; /* info about remapped bad sectors */
157 u32 n_spares_used; /* number of hotfixes */
158 u32 n_spares; /* number of spares in hotfix map */
159 u32 n_dnode_spares_free; /* spare dnodes unused */
160 u32 n_dnode_spares; /* length of spare_dnodes[] list,
161 follows in this block*/
162 secno code_page_dir; /* code page directory block */
163 u32 n_code_pages; /* number of code pages */
164 u32 super_crc; /* on HPFS386 and LAN Server this is
165 checksum of superblock, on normal
167 u32 spare_crc; /* on HPFS386 checksum of spareblock */
168 u32 zero1[15]; /* unused */
169 dnode_secno spare_dnodes[100]; /* emergency free dnode list */
170 u32 zero2[1]; /* room for more? */
173 /* The bad block list is 4 sectors long. The first word must be zero,
174 the remaining words give n_badblocks bad block numbers.
175 I bet you can see it coming... */
179 /* The hotfix map is 4 sectors long. It looks like
181 secno from[n_spares];
184 The to[] list is initialized to point to n_spares preallocated empty
185 sectors. The from[] list contains the sector numbers of bad blocks
186 which have been remapped to corresponding sectors in the to[] list.
187 n_spares_used gives the length of the from[] list. */
190 /* Sectors 18 and 19 are preallocated and unused.
191 Maybe they're spares for 16 and 17, but simple substitution fails. */
194 /* The code page info pointed to by the spare block consists of an index
195 block and blocks containing uppercasing tables. I don't know what
196 these are for (CHKDSK, maybe?) -- OS/2 does not seem to use them
197 itself. Linux doesn't use them either. */
199 /* block pointed to by spareblock->code_page_dir */
201 #define CP_DIR_MAGIC 0x494521f7
203 struct code_page_directory
205 u32 magic; /* 4945 21f7 */
206 u32 n_code_pages; /* number of pointers following */
210 u16 code_page_number; /* code page number */
211 u32 bounds; /* matches corresponding word
213 secno code_page_data; /* sector number of a code_page_data
214 containing c.p. array */
215 u16 index; /* index in c.p. array in that sector*/
216 u16 unknown; /* some unknown value; usually 0;
217 2 in Japanese version */
218 } array[31]; /* unknown length */
221 /* blocks pointed to by code_page_directory */
223 #define CP_DATA_MAGIC 0x894521f7
225 struct code_page_data
227 u32 magic; /* 8945 21f7 */
228 u32 n_used; /* # elements used in c_p_data[] */
229 u32 bounds[3]; /* looks a bit like
230 (beg1,end1), (beg2,end2)
232 u16 offs[3]; /* offsets from start of sector
233 to start of c_p_data[ix] */
236 u16 code_page_number; /* code page number */
237 u16 unknown; /* the same as in cp directory */
238 u8 map[128]; /* upcase table for chars 80..ff */
245 /* Free space bitmaps are 4 sectors long, which is 16384 bits.
246 16384 sectors is 8 meg, and each 8 meg band has a 4-sector bitmap.
247 Bit order in the maps is little-endian. 0 means taken, 1 means free.
249 Bit map sectors are marked allocated in the bit maps, and so are sectors
250 off the end of the partition.
252 Band 0 is sectors 0-3fff, its map is in sectors 18-1b.
253 Band 1 is 4000-7fff, its map is in 7ffc-7fff.
254 Band 2 is 8000-ffff, its map is in 8000-8003.
255 The remaining bands have maps in their first (even) or last (odd) 4 sectors
256 -- if the last, partial, band is odd its map is in its last 4 sectors.
258 The bitmap locations are given in a table pointed to by the super block.
259 No doubt they aren't constrained to be at 18, 7ffc, 8000, ...; that is
260 just where they usually are.
262 The "directory band" is a bunch of sectors preallocated for dnodes.
263 It has a 4-sector free space bitmap of its own. Each bit in the map
264 corresponds to one 4-sector dnode, bit 0 of the map corresponding to
265 the first 4 sectors of the directory band. The entire band is marked
266 allocated in the main bitmap. The super block gives the locations
267 of the directory band and its bitmap. ("band" doesn't mean it is
268 8 meg long; it isn't.) */
271 /* dnode: directory. 4 sectors long */
273 /* A directory is a tree of dnodes. The fnode for a directory
274 contains one pointer, to the root dnode of the tree. The fnode
275 never moves, the dnodes do the B-tree thing, splitting and merging
276 as files are added and removed. */
278 #define DNODE_MAGIC 0x77e40aae
281 u32 magic; /* 77e4 0aae */
282 u32 first_free; /* offset from start of dnode to
283 first free dir entry */
284 #ifdef __LITTLE_ENDIAN
285 u8 root_dnode: 1; /* Is it root dnode? */
286 u8 increment_me: 7; /* some kind of activity counter? */
287 /* Neither HPFS.IFS nor CHKDSK cares
288 if you change this word */
290 u8 increment_me: 7; /* some kind of activity counter? */
291 /* Neither HPFS.IFS nor CHKDSK cares
292 if you change this word */
293 u8 root_dnode: 1; /* Is it root dnode? */
296 secno up; /* (root dnode) directory's fnode
297 (nonroot) parent dnode */
298 dnode_secno self; /* pointer to this dnode */
299 u8 dirent[2028]; /* one or more dirents */
303 u16 length; /* offset to next dirent */
305 #ifdef __LITTLE_ENDIAN
306 u8 first: 1; /* set on phony ^A^A (".") entry */
308 u8 down: 1; /* down pointer present (after name) */
309 u8 last: 1; /* set on phony \377 entry */
310 u8 has_ea: 1; /* entry has EA */
311 u8 has_xtd_perm: 1; /* has extended perm list (???) */
312 u8 has_explicit_acl: 1;
313 u8 has_needea: 1; /* ?? some EA has NEEDEA set
314 I have no idea why this is
315 interesting in a dir entry */
317 u8 has_needea: 1; /* ?? some EA has NEEDEA set
318 I have no idea why this is
319 interesting in a dir entry */
320 u8 has_explicit_acl: 1;
321 u8 has_xtd_perm: 1; /* has extended perm list (???) */
322 u8 has_ea: 1; /* entry has EA */
323 u8 last: 1; /* set on phony \377 entry */
324 u8 down: 1; /* down pointer present (after name) */
326 u8 first: 1; /* set on phony ^A^A (".") entry */
329 #ifdef __LITTLE_ENDIAN
330 u8 read_only: 1; /* dos attrib */
331 u8 hidden: 1; /* dos attrib */
332 u8 system: 1; /* dos attrib */
333 u8 flag11: 1; /* would be volume label dos attrib */
334 u8 directory: 1; /* dos attrib */
335 u8 archive: 1; /* dos attrib */
336 u8 not_8x3: 1; /* name is not 8.3 */
340 u8 not_8x3: 1; /* name is not 8.3 */
341 u8 archive: 1; /* dos attrib */
342 u8 directory: 1; /* dos attrib */
343 u8 flag11: 1; /* would be volume label dos attrib */
344 u8 system: 1; /* dos attrib */
345 u8 hidden: 1; /* dos attrib */
346 u8 read_only: 1; /* dos attrib */
349 fnode_secno fnode; /* fnode giving allocation info */
350 time32_t write_date; /* mtime */
351 u32 file_size; /* file length, bytes */
352 time32_t read_date; /* atime */
353 time32_t creation_date; /* ctime */
354 u32 ea_size; /* total EA length, bytes */
355 u8 no_of_acls; /* number of ACL's (low 3 bits) */
356 u8 ix; /* code page index (of filename), see
357 struct code_page_data */
358 u8 namelen, name[1]; /* file name */
359 /* dnode_secno down; btree down pointer, if present,
360 follows name on next word boundary, or maybe it
361 precedes next dirent, which is on a word boundary. */
365 /* B+ tree: allocation info in fnodes and anodes */
367 /* dnodes point to fnodes which are responsible for listing the sectors
368 assigned to the file. This is done with trees of (length,address)
369 pairs. (Actually triples, of (length, file-address, disk-address)
370 which can represent holes. Find out if HPFS does that.)
371 At any rate, fnodes contain a small tree; if subtrees are needed
372 they occupy essentially a full block in anodes. A leaf-level tree node
373 has 3-word entries giving sector runs, a non-leaf node has 2-word
374 entries giving subtree pointers. A flag in the header says which. */
376 struct bplus_leaf_node
378 u32 file_secno; /* first file sector in extent */
379 u32 length; /* length, sectors */
380 secno disk_secno; /* first corresponding disk sector */
383 struct bplus_internal_node
385 u32 file_secno; /* subtree maps sectors < this */
386 anode_secno down; /* pointer to subtree */
391 #ifdef __LITTLE_ENDIAN
392 u8 hbff: 1; /* high bit of first free entry offset */
394 u8 fnode_parent: 1; /* ? we're pointed to by an fnode,
395 the data btree or some ea or the
396 main ea bootage pointer ea_secno */
397 /* also can get set in fnodes, which
398 may be a chkdsk glitch or may mean
399 this bit is irrelevant in fnodes,
400 or this interpretation is all wet */
401 u8 binary_search: 1; /* suggest binary search (unused) */
402 u8 internal: 1; /* 1 -> (internal) tree of anodes
403 0 -> (leaf) list of extents */
405 u8 internal: 1; /* 1 -> (internal) tree of anodes
406 0 -> (leaf) list of extents */
407 u8 binary_search: 1; /* suggest binary search (unused) */
408 u8 fnode_parent: 1; /* ? we're pointed to by an fnode,
409 the data btree or some ea or the
410 main ea bootage pointer ea_secno */
411 /* also can get set in fnodes, which
412 may be a chkdsk glitch or may mean
413 this bit is irrelevant in fnodes,
414 or this interpretation is all wet */
416 u8 hbff: 1; /* high bit of first free entry offset */
419 u8 n_free_nodes; /* free nodes in following array */
420 u8 n_used_nodes; /* used nodes in following array */
421 u16 first_free; /* offset from start of header to
422 first free node in array */
424 struct bplus_internal_node internal[0]; /* (internal) 2-word entries giving
426 struct bplus_leaf_node external[0]; /* (external) 3-word entries giving
431 /* fnode: root of allocation b+ tree, and EA's */
433 /* Every file and every directory has one fnode, pointed to by the directory
434 entry and pointing to the file's sectors or directory's root dnode. EA's
435 are also stored here, and there are said to be ACL's somewhere here too. */
437 #define FNODE_MAGIC 0xf7e40aae
441 u32 magic; /* f7e4 0aae */
442 u32 zero1[2]; /* read history */
443 u8 len, name[15]; /* true length, truncated name */
444 fnode_secno up; /* pointer to file's directory fnode */
449 u8 zero2; /* history bit count */
450 u32 ea_size_l; /* length of disk-resident ea's */
451 secno ea_secno; /* first sector of disk-resident ea's*/
452 u16 ea_size_s; /* length of fnode-resident ea's */
454 #ifdef __LITTLE_ENDIAN
456 u8 ea_anode: 1; /* 1 -> ea_secno is an anode */
460 u8 ea_anode: 1; /* 1 -> ea_secno is an anode */
464 #ifdef __LITTLE_ENDIAN
465 u8 dirflag: 1; /* 1 -> directory. first & only extent
470 u8 dirflag: 1; /* 1 -> directory. first & only extent
474 struct bplus_header btree; /* b+ tree, 8 extents or 12 subtrees */
476 struct bplus_leaf_node external[8];
477 struct bplus_internal_node internal[12];
480 u32 file_size; /* file length, bytes */
481 u32 n_needea; /* number of EA's with NEEDEA set */
482 u8 user_id[16]; /* unused */
483 u16 ea_offs; /* offset from start of fnode
484 to first fnode-resident ea */
485 u8 dasd_limit_treshhold;
489 u8 ea[316]; /* zero or more EA's, packed together
490 with no alignment padding.
491 (Do not use this name, get here
492 via fnode + ea_offs. I think.) */
496 /* anode: 99.44% pure allocation tree */
498 #define ANODE_MAGIC 0x37e40aae
502 u32 magic; /* 37e4 0aae */
503 anode_secno self; /* pointer to this anode */
504 secno up; /* parent anode or fnode */
506 struct bplus_header btree; /* b+tree, 40 extents or 60 subtrees */
508 struct bplus_leaf_node external[40];
509 struct bplus_internal_node internal[60];
512 u32 fill[3]; /* unused */
516 /* extended attributes.
518 A file's EA info is stored as a list of (name,value) pairs. It is
519 usually in the fnode, but (if it's large) it is moved to a single
520 sector run outside the fnode, or to multiple runs with an anode tree
523 The value of a single EA is stored along with the name, or (if large)
524 it is moved to a single sector run, or multiple runs pointed to by an
525 anode tree, pointed to by the value field of the (name,value) pair.
527 Flags in the EA tell whether the value is immediate, in a single sector
528 run, or in multiple runs. Flags in the fnode tell whether the EA list
529 is immediate, in a single run, or in multiple runs. */
531 struct extended_attribute
533 #ifdef __LITTLE_ENDIAN
534 u8 indirect: 1; /* 1 -> value gives sector number
535 where real value starts */
536 u8 anode: 1; /* 1 -> sector is an anode
537 that points to fragmented value */
539 u8 needea: 1; /* required ea */
541 u8 needea: 1; /* required ea */
543 u8 anode: 1; /* 1 -> sector is an anode
544 that points to fragmented value */
545 u8 indirect: 1; /* 1 -> value gives sector number
546 where real value starts */
548 u8 namelen; /* length of name, bytes */
549 u8 valuelen_lo; /* length of value, bytes */
550 u8 valuelen_hi; /* length of value, bytes */
553 u8 name[namelen]; ascii attrib name
554 u8 nul; terminating '\0', not counted
555 u8 value[valuelen]; value, arbitrary
556 if this.indirect, valuelen is 8 and the value is
557 u32 length; real length of value, bytes
558 secno secno; sector address where it starts
559 if this.anode, the above sector number is the root of an anode tree
560 which points to the value.