Introducing NTFSplus – because just one NTFS driver for Linux is never enough

Dev unveils a faster, modernized take on Microsoft's file system for penguin-powered PCs

Just under four years after the Linux kernel gained built-in read-write access to Windows drives, an alternative option has appeared.

The code patch containing the new ntfsplus driver was submitted by kernel developer Namjae Jeon. He's one of the top kernel file system boffins – three years ago, he wrote the code that added the ability to repair exFAT volumes to Linux.

NTFSplus is an unexpected development because for about four years now, the Linux kernel has contained a read-write NTFS driver. It's called ntfs3 and it appeared in kernel 5.15 back in November 2021. It's called NTFS3 because it effectively replaced the old ntfs driver, which just offered read-only support, and ntfs-3g which works via FUSE – meaning that it runs as an ordinary, unprivileged userspace program, which imposes performance and other limitations.

The GPL ntfs3 driver was donated to the kernel by Konstantin Komarov, whose company Paragon Software sells multiple commercial drive management tools, including drivers to allow read-write access to pretty much any combination of Mac, Linux, and Windows drives from Windows, Linux, or macOS. In other words, he has a demanding day job – and six months after NTFS3 was merged, concerns emerged that Komarov wasn't able to maintain it. One of the people who responded then was Namjae Jeon, who said:

I'm currently working write support on read-only NTFS(fs/ntfs) with the goal of being released in a few months. And after that, I am planning to start working fsck in ntfsprogs in ntfs-3g to solve the current lack of utility issue.

Rather than "a few months," it took a few years – but here it is. It modernizes the old read-only driver in several important ways. It replaces the old driver's use of buffer heads with the more modern iomap mechanism, and it operates on folios instead of memory pages. However, it's not yet fully complete. For instance, it doesn't yet support NTFS journaling, only journal-replay, and that doesn't yet work correctly. (Journal replay is what happens when a journalled volume is mounted that wasn't cleanly unmounted last time – for instance, if the physical medium was disconnected without ejecting it, or the computer crashed.) Saying that, supporting only journal replay looks like it also applies to both ntfs3 and ntfs-3g.

Namjae says that NTFSplus already outperforms ntfs3, which may well be thanks to the folio support – it made ext4 in kernel 6.16 faster.

We can't see any way to interpret some of the comments in the patch as anything other than criticisms of the existing code:

ntfs3 still has many problems and is poorly maintained.

And:

The old read-only ntfs code is much cleaner, with extensive comments, offers readability that makes understanding NTFS easier.

To those not used to how FOSS development works, it may at first glance look ungrateful. Konstantin Komarov says that the GPL2 NTFS code he donated – after some difficulties getting it accepted – was unrelated to Paragon's commercial NTFS tools. Developing a new driver, submitting it, and then extensively restructuring it to get it accepted was a lot of work... and now, it might be thrown out, supplanted by a modernized version of the code it replaced?

Well, it could be. This has happened before, more than once. The first time that The Reg FOSS desk remembers was the original 1996 Linux kernel USB subsystem – a driver called UUSBD by Iñaky Pérez González. It was discarded in favour of a new, modular stack by Linus himself, with little left except a message of thanks. ®