Windows NT File System Internals

Windows NT File System Internals presents the details of the NT I/O Manager, the Cache Manager, and the Memory Manager from the perspective of a software developer writing a file system driver or implementing a kernel-mode filter driver. The book provides numerous code examples included on diskette, as well as the source for a complete, usable filter driver.This book appeals to a wide audience: system programmers implementing kernel-mode code such as file systems, device drivers, network redirectors, or filter drivers; system administrators who simply want to learn more about the systems they manage; software engineers interested in NT internals; and computer science students examining the intricacies of file system technology.Topics covered in the book include:

• An introduction to NT system components
• The NT I/O Manager
• The NT Virtual Memory Manager
• The NT Cache Manager
• Structured driver development under Windows NT
• Writing a file system driver
Writing a filter driver

 Table of Contents
Preface  

I. Overview

1. Windows NT System Components
The Windows NT Kernel
The Windows NT Executive

2. File System Driver Development
What Are File System Drivers?
What Are Filter Drivers?
Common Driver Development Issues
Windows NT Object Name Space
Filename Handling for Network Redirectors

3. Structured Driver Development
Exception Dispatching Support
Structured Exception Handling (SEH)
Event Logging
Driver Synchronization Mechanisms
Supporting Routines (RTLs)

II. The Managers

4. The NT I/O Manager
The NT I/O Subsystem
Common Data Structures
I/O Requests: A Discussion
System Boot Sequence

5. The NT Virtual Memory Manager
Functionality
Process Address Space
Physical Memory Management
Virtual Address Support
Shared Memory and Memory-Mapped File Support
Modified and Mapped Page Writer
Page Fault Handling
Interactions with File System Drivers

6. The NT Cache Manager I
Functionality
File Streams
Virtual Block Caching
Caching During Read and Write Operations
Cache Manager Interfaces
Cache Manager Clients
Some Important Data Structures
File Size Considerations

7. The NT Cache Manager II
Cache Manager Structures
Interaction with Clients (File Systems and Network Redirectors)
Cache Manager Interfaces

8. The NT Cache Manager III
Flushing the Cache
Termination of Caching
Miscellaneous File Stream Manipulation Functions
Interactions with the VMM
Interactions with the I/O Manager
The Read-Ahead Module
Lazy-Write Functionality

III. The Drivers

9. Writing a File System Driver I
File System Design
Registry Interaction
Data Structures
Dispatch Routine: Driver Entry
Dispatch Routine: Create
Dispatch Routine: Read
Dispatch Routine: Write

10. Writing A File System Driver II
I/O Revisited: Who Called?
Asynchronous I/O Processing
Dispatch Routine: File Information
Dispatch Routine: Directory Control
Dispatch Routine: Cleanup
Dispatch Routine: Close

11. Writing a File System Driver III
Handling Fast I/O
Callback Example
Dispatch Routine: Flush File Buffers
Dispatch Routine: Volume Information
Dispatch Routine: Byte-Range Locks
Opportunistic Locking
Dispatch Routine: File System and Device Control
File System Recognizers

12. Filter Drivers
Why Use Filter Drivers?
Basic Steps in Filtering
Some Dos and Don'ts in Filtering

IV. The Appendixes
A. Windows NT System Services
B. MPR Support
C. Building Kernel-Mode Drivers
D. Debugging Support
E. Recommended Readings and References
F. Additional Sources for Help

Index