Odd Ringstad

Experiences from a Windows NT Filesystem Seminar held by Open System Resources in Boston, USA.

Odd Ringstad , TORDIVEL AS
28. October 1996

Open System resources is a consulting company with expertise in the Windows NT internals. They publish "The NT Insider", a small magazine dedicated to discussion on the NT internals. A free subscribtion may be yours if you ask for it.

First of all: this is a Windows NT course, not a Win32 course. The distinction is necessary since the Win32 subsystem is only one of several possible subsystems of Windows NT.

Today Win32 is the single most important subsystem, but the arcitechture of Windows NT distinguishes itself from its subsystems by having its own API. The native Windows NT API is not accessible for normal applications development, but deveopers of kernel moded device drivers are exposed to it. In many instances the Win32 API functions are mirroring the native Windows NT API, thus giving a very small overhead in the calls.

The seminar is divided into three modules. The first, lasting about one day is describing the Windows NT internal architecture. The second, lasting about two days deals with kernel mode device drivers, and the last module deals with the complexities of Windows NT file systems.

Part 1 Windows NT kernel mode architecture

This part discussed the layered model of the driver architecture, with the I/O manager and I/O Request Packages (IRP's) among the most import components.

Part 2 Windows NT kernel mode drivers

The structure and duties of kernel mode device drivers were discussed, including communication using IRP's, I/O Request Levels (IRQL's) and Defered Procedure Calls (DFC's).

This module also gave information and recommendation on needed equipment and setup for actually developing kernel mode device drivers.

Part 3 Windows NT filesystem drivers

Filesystem drivers are software modules that implements functionality like Create,Open, Close, Delete, Lock etc. on top of local or remote storage.

Filesystem filter drivers are software modules that implements added functionality on top of one or more filesystem drivers. This added functionality may include security features, fault tolerance features (like FTDisk), clustering of CD's in a jukebox etc..

The complexity of Windows NT filesystem drivers is partly due to the following:

- The file system is tightly integrated with the virtual memory system, due to caching and the paging file.

- The network model of Windows NT is not purely Client/Server, it is Peer to Peer. This implies that the path of a file access request is different depending on the origin of the request. If the request came from an application executing locally on the computer directly attached to the storage medium, it will follow a different path through the system than a request comming in through the network system.

- Originally Windows NT was/is designed to run on computers with less than a P5 CPU, and with less than 32 MB of RAM. This has lead to different kinds of optimizations, with bad results on the encapsulation part of the original object oriented design.

Conclusion

The conclusion of the seminar is that filesystem driver development for Windows NT is difficult. There is currently no supported development kit from Microsoft. The main reason is the complexity of the issue and the support burden associated with an SDK.

Attendees

Attendees of the seminar were people from important companies like Novell, Banyan, HP, Sony, Octopus Technology (and TORDIVEL). Some of these companies have licenced the NT source code, with very strict licence conditions and large amounts of money, indicating both the importance and the complexities of the task.

More information on Open System Resources :

email : info@osr.com
Web http://www.osr.com