4 * HPFS structures by Chris Smith, 1993
6 * a little bit modified by Mikulas Patocka, 1998-1999
12 Design goals and implementation of the new High Performance File System
13 Microsoft Systems Journal Sept 1989 v4 n5 p1(13)
15 describes what HPFS looked like when it was new, and it is the source
16 of most of the information given here. The rest is conjecture.
18 For definitive information on the Duncan paper, see it, not this file.
19 For definitive information on HPFS, ask somebody else -- this is guesswork.
20 There are certain to be many mistakes. */
22 #if !defined(__LITTLE_ENDIAN) && !defined(__BIG_ENDIAN)
28 typedef u32 secno; /* sector number, partition relative */
30 typedef secno dnode_secno; /* sector number of a dnode */
31 typedef secno fnode_secno; /* sector number of an fnode */
32 typedef secno anode_secno; /* sector number of an anode */
34 typedef u32 time32_t; /* 32-bit time_t type */
38 /* The boot block is very like a FAT boot block, except that the
39 29h signature byte is 28h instead, and the ID string is "HPFS". */
41 #define BB_MAGIC 0xaa55
43 struct hpfs_boot_block
47 u8 bytes_per_sector[2]; /* 512 */
48 u8 sectors_per_cluster;
49 u8 n_reserved_sectors[2];
51 u8 n_rootdir_entries[2];
54 __le16 sectors_per_fat;
55 __le16 sectors_per_track;
57 __le32 n_hidden_sectors;
58 __le32 n_sectors_l; /* size of partition */
64 u8 sig_hpfs[8]; /* "HPFS " */
66 __le16 magic; /* aa55 */
72 /* The super block has the pointer to the root directory. */
74 #define SB_MAGIC 0xf995e849
76 struct hpfs_super_block
78 __le32 magic; /* f995 e849 */
79 __le32 magic1; /* fa53 e9c5, more magic? */
80 u8 version; /* version of a filesystem usually 2 */
81 u8 funcversion; /* functional version - oldest version
82 of filesystem that can understand
85 __le32 root; /* fnode of root directory */
86 __le32 n_sectors; /* size of filesystem */
87 __le32 n_badblocks; /* number of bad blocks */
88 __le32 bitmaps; /* pointers to free space bit maps */
90 __le32 badblocks; /* bad block list */
92 __le32 last_chkdsk; /* date last checked, 0 if never */
93 __le32 last_optimize; /* date last optimized, 0 if never */
94 __le32 n_dir_band; /* number of sectors in dir band */
95 __le32 dir_band_start; /* first sector in dir band */
96 __le32 dir_band_end; /* last sector in dir band */
97 __le32 dir_band_bitmap; /* free space map, 1 dnode per bit */
98 u8 volume_name[32]; /* not used */
99 __le32 user_id_table; /* 8 preallocated sectors - user id */
100 u32 zero6[103]; /* 0 */
106 /* The spare block has pointers to spare sectors. */
108 #define SP_MAGIC 0xf9911849
110 struct hpfs_spare_block
112 __le32 magic; /* f991 1849 */
113 __le32 magic1; /* fa52 29c5, more magic? */
115 #ifdef __LITTLE_ENDIAN
116 u8 dirty: 1; /* 0 clean, 1 "improperly stopped" */
117 u8 sparedir_used: 1; /* spare dirblks used */
118 u8 hotfixes_used: 1; /* hotfixes used */
119 u8 bad_sector: 1; /* bad sector, corrupted disk (???) */
120 u8 bad_bitmap: 1; /* bad bitmap */
121 u8 fast: 1; /* partition was fast formatted */
122 u8 old_wrote: 1; /* old version wrote to partion */
123 u8 old_wrote_1: 1; /* old version wrote to partion (?) */
125 u8 old_wrote_1: 1; /* old version wrote to partion (?) */
126 u8 old_wrote: 1; /* old version wrote to partion */
127 u8 fast: 1; /* partition was fast formatted */
128 u8 bad_bitmap: 1; /* bad bitmap */
129 u8 bad_sector: 1; /* bad sector, corrupted disk (???) */
130 u8 hotfixes_used: 1; /* hotfixes used */
131 u8 sparedir_used: 1; /* spare dirblks used */
132 u8 dirty: 1; /* 0 clean, 1 "improperly stopped" */
135 #ifdef __LITTLE_ENDIAN
136 u8 install_dasd_limits: 1; /* HPFS386 flags */
137 u8 resynch_dasd_limits: 1;
138 u8 dasd_limits_operational: 1;
139 u8 multimedia_active: 1;
140 u8 dce_acls_active: 1;
141 u8 dasd_limits_dirty: 1;
145 u8 dasd_limits_dirty: 1;
146 u8 dce_acls_active: 1;
147 u8 multimedia_active: 1;
148 u8 dasd_limits_operational: 1;
149 u8 resynch_dasd_limits: 1;
150 u8 install_dasd_limits: 1; /* HPFS386 flags */
156 __le32 hotfix_map; /* info about remapped bad sectors */
157 __le32 n_spares_used; /* number of hotfixes */
158 __le32 n_spares; /* number of spares in hotfix map */
159 __le32 n_dnode_spares_free; /* spare dnodes unused */
160 __le32 n_dnode_spares; /* length of spare_dnodes[] list,
161 follows in this block*/
162 __le32 code_page_dir; /* code page directory block */
163 __le32 n_code_pages; /* number of code pages */
164 __le32 super_crc; /* on HPFS386 and LAN Server this is
165 checksum of superblock, on normal
167 __le32 spare_crc; /* on HPFS386 checksum of spareblock */
168 __le32 zero1[15]; /* unused */
169 __le32 spare_dnodes[100]; /* emergency free dnode list */
170 __le32 zero2[1]; /* room for more? */
173 /* The bad block list is 4 sectors long. The first word must be zero,
174 the remaining words give n_badblocks bad block numbers.
175 I bet you can see it coming... */
179 /* The hotfix map is 4 sectors long. It looks like
181 secno from[n_spares];
184 The to[] list is initialized to point to n_spares preallocated empty
185 sectors. The from[] list contains the sector numbers of bad blocks
186 which have been remapped to corresponding sectors in the to[] list.
187 n_spares_used gives the length of the from[] list. */
190 /* Sectors 18 and 19 are preallocated and unused.
191 Maybe they're spares for 16 and 17, but simple substitution fails. */
194 /* The code page info pointed to by the spare block consists of an index
195 block and blocks containing uppercasing tables. I don't know what
196 these are for (CHKDSK, maybe?) -- OS/2 does not seem to use them
197 itself. Linux doesn't use them either. */
199 /* block pointed to by spareblock->code_page_dir */
201 #define CP_DIR_MAGIC 0x494521f7
203 struct code_page_directory
205 __le32 magic; /* 4945 21f7 */
206 __le32 n_code_pages; /* number of pointers following */
209 __le16 ix; /* index */
210 __le16 code_page_number; /* code page number */
211 __le32 bounds; /* matches corresponding word
213 __le32 code_page_data; /* sector number of a code_page_data
214 containing c.p. array */
215 __le16 index; /* index in c.p. array in that sector*/
216 __le16 unknown; /* some unknown value; usually 0;
217 2 in Japanese version */
218 } array[31]; /* unknown length */
221 /* blocks pointed to by code_page_directory */
223 #define CP_DATA_MAGIC 0x894521f7
225 struct code_page_data
227 __le32 magic; /* 8945 21f7 */
228 __le32 n_used; /* # elements used in c_p_data[] */
229 __le32 bounds[3]; /* looks a bit like
230 (beg1,end1), (beg2,end2)
232 __le16 offs[3]; /* offsets from start of sector
233 to start of c_p_data[ix] */
235 __le16 ix; /* index */
236 __le16 code_page_number; /* code page number */
237 __le16 unknown; /* the same as in cp directory */
238 u8 map[128]; /* upcase table for chars 80..ff */
245 /* Free space bitmaps are 4 sectors long, which is 16384 bits.
246 16384 sectors is 8 meg, and each 8 meg band has a 4-sector bitmap.
247 Bit order in the maps is little-endian. 0 means taken, 1 means free.
249 Bit map sectors are marked allocated in the bit maps, and so are sectors
250 off the end of the partition.
252 Band 0 is sectors 0-3fff, its map is in sectors 18-1b.
253 Band 1 is 4000-7fff, its map is in 7ffc-7fff.
254 Band 2 is 8000-ffff, its map is in 8000-8003.
255 The remaining bands have maps in their first (even) or last (odd) 4 sectors
256 -- if the last, partial, band is odd its map is in its last 4 sectors.
258 The bitmap locations are given in a table pointed to by the super block.
259 No doubt they aren't constrained to be at 18, 7ffc, 8000, ...; that is
260 just where they usually are.
262 The "directory band" is a bunch of sectors preallocated for dnodes.
263 It has a 4-sector free space bitmap of its own. Each bit in the map
264 corresponds to one 4-sector dnode, bit 0 of the map corresponding to
265 the first 4 sectors of the directory band. The entire band is marked
266 allocated in the main bitmap. The super block gives the locations
267 of the directory band and its bitmap. ("band" doesn't mean it is
268 8 meg long; it isn't.) */
271 /* dnode: directory. 4 sectors long */
273 /* A directory is a tree of dnodes. The fnode for a directory
274 contains one pointer, to the root dnode of the tree. The fnode
275 never moves, the dnodes do the B-tree thing, splitting and merging
276 as files are added and removed. */
278 #define DNODE_MAGIC 0x77e40aae
281 __le32 magic; /* 77e4 0aae */
282 __le32 first_free; /* offset from start of dnode to
283 first free dir entry */
284 #ifdef __LITTLE_ENDIAN
285 u8 root_dnode: 1; /* Is it root dnode? */
286 u8 increment_me: 7; /* some kind of activity counter? */
287 /* Neither HPFS.IFS nor CHKDSK cares
288 if you change this word */
290 u8 increment_me: 7; /* some kind of activity counter? */
291 /* Neither HPFS.IFS nor CHKDSK cares
292 if you change this word */
293 u8 root_dnode: 1; /* Is it root dnode? */
296 __le32 up; /* (root dnode) directory's fnode
297 (nonroot) parent dnode */
298 __le32 self; /* pointer to this dnode */
299 u8 dirent[2028]; /* one or more dirents */
303 __le16 length; /* offset to next dirent */
305 #ifdef __LITTLE_ENDIAN
306 u8 first: 1; /* set on phony ^A^A (".") entry */
308 u8 down: 1; /* down pointer present (after name) */
309 u8 last: 1; /* set on phony \377 entry */
310 u8 has_ea: 1; /* entry has EA */
311 u8 has_xtd_perm: 1; /* has extended perm list (???) */
312 u8 has_explicit_acl: 1;
313 u8 has_needea: 1; /* ?? some EA has NEEDEA set
314 I have no idea why this is
315 interesting in a dir entry */
317 u8 has_needea: 1; /* ?? some EA has NEEDEA set
318 I have no idea why this is
319 interesting in a dir entry */
320 u8 has_explicit_acl: 1;
321 u8 has_xtd_perm: 1; /* has extended perm list (???) */
322 u8 has_ea: 1; /* entry has EA */
323 u8 last: 1; /* set on phony \377 entry */
324 u8 down: 1; /* down pointer present (after name) */
326 u8 first: 1; /* set on phony ^A^A (".") entry */
329 #ifdef __LITTLE_ENDIAN
330 u8 read_only: 1; /* dos attrib */
331 u8 hidden: 1; /* dos attrib */
332 u8 system: 1; /* dos attrib */
333 u8 flag11: 1; /* would be volume label dos attrib */
334 u8 directory: 1; /* dos attrib */
335 u8 archive: 1; /* dos attrib */
336 u8 not_8x3: 1; /* name is not 8.3 */
340 u8 not_8x3: 1; /* name is not 8.3 */
341 u8 archive: 1; /* dos attrib */
342 u8 directory: 1; /* dos attrib */
343 u8 flag11: 1; /* would be volume label dos attrib */
344 u8 system: 1; /* dos attrib */
345 u8 hidden: 1; /* dos attrib */
346 u8 read_only: 1; /* dos attrib */
349 __le32 fnode; /* fnode giving allocation info */
350 __le32 write_date; /* mtime */
351 __le32 file_size; /* file length, bytes */
352 __le32 read_date; /* atime */
353 __le32 creation_date; /* ctime */
354 __le32 ea_size; /* total EA length, bytes */
355 u8 no_of_acls; /* number of ACL's (low 3 bits) */
356 u8 ix; /* code page index (of filename), see
357 struct code_page_data */
358 u8 namelen, name[1]; /* file name */
359 /* dnode_secno down; btree down pointer, if present,
360 follows name on next word boundary, or maybe it
361 precedes next dirent, which is on a word boundary. */
365 /* B+ tree: allocation info in fnodes and anodes */
367 /* dnodes point to fnodes which are responsible for listing the sectors
368 assigned to the file. This is done with trees of (length,address)
369 pairs. (Actually triples, of (length, file-address, disk-address)
370 which can represent holes. Find out if HPFS does that.)
371 At any rate, fnodes contain a small tree; if subtrees are needed
372 they occupy essentially a full block in anodes. A leaf-level tree node
373 has 3-word entries giving sector runs, a non-leaf node has 2-word
374 entries giving subtree pointers. A flag in the header says which. */
376 struct bplus_leaf_node
378 __le32 file_secno; /* first file sector in extent */
379 __le32 length; /* length, sectors */
380 __le32 disk_secno; /* first corresponding disk sector */
383 struct bplus_internal_node
385 __le32 file_secno; /* subtree maps sectors < this */
386 __le32 down; /* pointer to subtree */
391 BP_fnode_parent = 0x20,
392 BP_binary_search = 0x40,
397 u8 flags; /* bit 0 - high bit of first free entry offset
398 bit 5 - we're pointed to by an fnode,
399 the data btree or some ea or the
400 main ea bootage pointer ea_secno
401 bit 6 - suggest binary search (unused)
402 bit 7 - 1 -> (internal) tree of anodes
403 0 -> (leaf) list of extents */
405 u8 n_free_nodes; /* free nodes in following array */
406 u8 n_used_nodes; /* used nodes in following array */
407 __le16 first_free; /* offset from start of header to
408 first free node in array */
410 struct bplus_internal_node internal[0]; /* (internal) 2-word entries giving
412 struct bplus_leaf_node external[0]; /* (external) 3-word entries giving
417 static inline bool bp_internal(struct bplus_header *bp)
419 return bp->flags & BP_internal;
422 static inline bool bp_fnode_parent(struct bplus_header *bp)
424 return bp->flags & BP_fnode_parent;
427 /* fnode: root of allocation b+ tree, and EA's */
429 /* Every file and every directory has one fnode, pointed to by the directory
430 entry and pointing to the file's sectors or directory's root dnode. EA's
431 are also stored here, and there are said to be ACL's somewhere here too. */
433 #define FNODE_MAGIC 0xf7e40aae
435 enum {FNODE_anode = cpu_to_le16(2), FNODE_dir = cpu_to_le16(256)};
438 __le32 magic; /* f7e4 0aae */
439 __le32 zero1[2]; /* read history */
440 u8 len, name[15]; /* true length, truncated name */
441 __le32 up; /* pointer to file's directory fnode */
446 u8 zero2; /* history bit count */
447 __le32 ea_size_l; /* length of disk-resident ea's */
448 __le32 ea_secno; /* first sector of disk-resident ea's*/
449 __le16 ea_size_s; /* length of fnode-resident ea's */
451 __le16 flags; /* bit 1 set -> ea_secno is an anode */
452 /* bit 8 set -> directory. first & only extent
454 struct bplus_header btree; /* b+ tree, 8 extents or 12 subtrees */
456 struct bplus_leaf_node external[8];
457 struct bplus_internal_node internal[12];
460 __le32 file_size; /* file length, bytes */
461 __le32 n_needea; /* number of EA's with NEEDEA set */
462 u8 user_id[16]; /* unused */
463 __le16 ea_offs; /* offset from start of fnode
464 to first fnode-resident ea */
465 u8 dasd_limit_treshhold;
469 u8 ea[316]; /* zero or more EA's, packed together
470 with no alignment padding.
471 (Do not use this name, get here
472 via fnode + ea_offs. I think.) */
475 static inline bool fnode_in_anode(struct fnode *p)
477 return (p->flags & FNODE_anode) != 0;
480 static inline bool fnode_is_dir(struct fnode *p)
482 return (p->flags & FNODE_dir) != 0;
486 /* anode: 99.44% pure allocation tree */
488 #define ANODE_MAGIC 0x37e40aae
492 __le32 magic; /* 37e4 0aae */
493 __le32 self; /* pointer to this anode */
494 __le32 up; /* parent anode or fnode */
496 struct bplus_header btree; /* b+tree, 40 extents or 60 subtrees */
498 struct bplus_leaf_node external[40];
499 struct bplus_internal_node internal[60];
502 __le32 fill[3]; /* unused */
506 /* extended attributes.
508 A file's EA info is stored as a list of (name,value) pairs. It is
509 usually in the fnode, but (if it's large) it is moved to a single
510 sector run outside the fnode, or to multiple runs with an anode tree
513 The value of a single EA is stored along with the name, or (if large)
514 it is moved to a single sector run, or multiple runs pointed to by an
515 anode tree, pointed to by the value field of the (name,value) pair.
517 Flags in the EA tell whether the value is immediate, in a single sector
518 run, or in multiple runs. Flags in the fnode tell whether the EA list
519 is immediate, in a single run, or in multiple runs. */
521 enum {EA_indirect = 1, EA_anode = 2, EA_needea = 128 };
522 struct extended_attribute
524 u8 flags; /* bit 0 set -> value gives sector number
525 where real value starts */
526 /* bit 1 set -> sector is an anode
527 that points to fragmented value */
528 /* bit 7 set -> required ea */
529 u8 namelen; /* length of name, bytes */
530 u8 valuelen_lo; /* length of value, bytes */
531 u8 valuelen_hi; /* length of value, bytes */
534 u8 name[namelen]; ascii attrib name
535 u8 nul; terminating '\0', not counted
536 u8 value[valuelen]; value, arbitrary
537 if this.flags & 1, valuelen is 8 and the value is
538 u32 length; real length of value, bytes
539 secno secno; sector address where it starts
540 if this.anode, the above sector number is the root of an anode tree
541 which points to the value.
545 static inline bool ea_indirect(struct extended_attribute *ea)
547 return ea->flags & EA_indirect;
550 static inline bool ea_in_anode(struct extended_attribute *ea)
552 return ea->flags & EA_anode;