Windows equivalent to Linux's readahead syscall?

Question

Is there a Windows equivalent to Linux's readahead syscall?

EDIT:

I would like a full function signature if possible, showing the equivalent offset/count parameters (or lower/upper).

Eg: The Linux function signature is:

ssize_t readahead(int fd, off64_t *offset, size_t count);

and an example of it's use is

readahead(file, 100, 500);

Where "file" is a file descriptor previously set by a function like mmap. This call is reading 500 bytes at index 100.

EDIT 2: Please read this if you are unsure what readahead does: http://linux.die.net/man/2/readahead

Answer 1

Yes. It is FileSystemControl FSCTL_FILE_PREFETCH.

It is used in Windows Vista and above for prefetching both when an application starts and at boot time.

It is also used by the SuperFetch technology that uses heuristics to load applications at approximately the times of day you generally use them.

FSCTL_FILE_PREFETCH itself is not documented on MSDN, but it is easy to figure out the parameter format by examining the DeviceIoControl calls made on app startup: Just start an application in the debugger that already has a .pf file in the c:\Windows\Prefetch directory and break on DeviceIoControl (or if you're using a kernel debugger, break when the NTFS driver receives its first FSCTL_FILE_PREFETCH). Examine the buffer passed in and compare it with the .pf file and the range actually used later. I did this once out of curiosity but didn't record the details.

In case you are unfamiliar with DeviceIoControl and IRP_MJ_FILESYSTEM_CONTROL, here are some links to look at:

• FileSystemControl at the IRP level IRP_MJ_FILESYSTEM_CONTROL
• DeviceIoControl, which is used to invoke FileSystemControl IRPs
• Structure of IO Control Codes