Inside Microsoft Windows 2000, Third Edition

by Solomon, David A.; Russinovich, Mark E.

• ISBN13: 9780735610217
• ISBN10: 0735610215
• Edition: 3rd
• Format: Paperback
• Copyright: 2000-09-16
• Publisher: Microsoft Pr

Summary

This newly updated, official guide to the Microsoft "RM" Windows 2000 core architecture and internals provides the key to help readers unlock the full power of Microsoft's premier operating system. Written in full partnership with the Microsoft Windows 2000 product development team, this book takes developers, technical managers, and IS professionals deep into the core components of Windows 2000. Along the way, it provides abundant information and perspective that readers can quickly apply for better design, debugging, performance, and troubleshooting. It's packed with up-to-the-minute information -- and unrivaled programming insights -- about topics such as Plug and Play, power management, the Windows Driver Model, security, 64-bit extended addressing support, job objects, new priority classes, NTFS extensions, kernel streaming and kernel code, and registry internals. In short, this is the must-have text for anyone who wants to get the most out of Microsoft Windows 2000.

Table of Contents

Historical Perspective	xv
Foreword	xvii
Acknowledgments	xix
Introduction	xxv
Concepts and Tools	1	(26)
Foundation Concepts and Terms	1	(16)
Win32 API	2	(1)
Services, Functions, and Routines	3	(1)
Processes, Threads, and Jobs	4	(3)
Virtual Memory	7	(2)
Kernel Mode vs. User Mode	9	(5)
Objects and Handles	14	(1)
Security	15	(1)
Registry	16	(1)
Unicode	17	(1)
Digging into Windows 2000 Internals	17	(10)
Tools on the Companion CD	19	(1)
Performance Tool	20	(1)
Windows 2000 Support Tools	20	(1)
Windows 2000 Resource Kits	21	(1)
Kernel Debugging Tools	21	(3)
Platform Software Development Kit (SDK)	24	(1)
Device Driver Kit (DDK)	24	(1)
Systems Internals Tools	25	(2)
System Architecture	27	(62)
Requirements and Design Goals	27	(3)
Operating System Model	30	(5)
Portability	32	(1)
Symmetric Multiprocessing	33	(2)
Scalability	35	(1)
Architecture Overview	35	(3)
Windows 2000 Product Packaging	38	(8)
Checked Build	41	(1)
Multiprocessor-Specific System Files	42	(4)
Key System Components	46	(43)
Environment Subsystems and Subsystem DLLs	47	(13)
Ntdll.dll	60	(1)
Executive	60	(3)
Kernel	63	(3)
Hardware Abstraction Layer	66	(1)
Device Drivers	67	(4)
Peering into Undocumented Interfaces	71	(3)
System Processes	74	(15)
System Mechanisms	89	(88)
Trap Dispatching	89	(36)
Interrupt Dispatching	91	(22)
Exception Dispatching	113	(8)
System Service Dispatching	121	(4)
Object Manager	125	(28)
Executive Objects	128	(2)
Object Structure	130	(23)
Synchronization	153	(12)
Kernel Synchronization	154	(4)
Executive Synchronization	158	(7)
System Worker Threads	165	(3)
Windows 2000 Global Flags	168	(3)
Local Procedure Calls (LPCs)	171	(6)
Startup and Shutdown	177	(38)
Boot Process	177	(19)
Preboot	177	(3)
The Boot Sector and Ntldr	180	(10)
Initializing the Kernel and Executive Subsystems	190	(4)
Smss, Csrss, and Winlogon	194	(2)
Safe Mode	196	(5)
Driver Loading in Safe Mode	197	(2)
Safe-Mode-Aware User Programs	199	(1)
Boot Logging in Safe Mode	200	(1)
Recovery Console	201	(3)
Shutdown	204	(2)
System Crashes	206	(9)
Why Does Windows 2000 Crash?	206	(1)
The Blue Screen	207	(3)
Crash Dump Files	210	(5)
Management Mechanisms	215	(62)
The Registry	215	(21)
Registry Data Types	216	(1)
Registry Logical Structure	217	(7)
Registry Internals	224	(12)
Services	236	(29)
Service Applications	237	(7)
Service Accounts	244	(3)
The Service Control Manager	247	(4)
Service Startup	251	(4)
Startup Errors	255	(1)
Accepting the Boot and Last Known Good	256	(2)
Service Failures	258	(1)
Service Shutdown	259	(1)
Shared Service Processes	260	(4)
Service Control Programs	264	(1)
Windows Management Instrumentation	265	(12)
WMI Architecture	266	(2)
Providers	268	(1)
The Common Information Model and the Managed Object Format Language	269	(3)
The WMI Namespace	272	(1)
Class Association	273	(2)
WMI Implementation	275	(1)
WMI Security	275	(2)
Processes, Threads, and Jobs	277	(102)
Process Internals	277	(27)
Data Structures	277	(16)
Kernel Variables	293	(1)
Performance Counters	293	(1)
Relevant Functions	294	(1)
Relevant Tools	295	(9)
Flow of CreateProcess	304	(13)
Opening the Image to Be Executed	306	(3)
Creating the Windows 2000 Executive Process Object	309	(5)
Creating the Initial Thread and Its Stack and Context	314	(1)
Notifying the Win32 Subsystem About the New Process	314	(2)
Starting Execution of the Initial Thread	316	(1)
Performing Process Initialization in the Context of the New Process	316	(1)
Thread Internals	317	(16)
Data Structures	317	(12)
Kernel Variables	329	(1)
Performance Counters	329	(1)
Relevant Functions	330	(1)
Relevant Tools	331	(2)
Flow of Create Thread	333	(4)
Thread Scheduling	337	(37)
Overview of Windows 2000 Scheduling	337	(4)
Priority Levels	341	(2)
Win32 Scheduling APIs	343	(1)
Relevant Tools	344	(2)
Real-Time Priorities	346	(1)
Interrupt Levels vs. Priority Levels	347	(1)
Thread States	348	(1)
Quantum	349	(4)
Scheduling Data Structures	353	(2)
Scheduling Scenarios	355	(4)
Context Switching	359	(1)
Idle Thread	359	(1)
Priority Boosts	360	(14)
Job Objects	374	(5)
Memory Management	379	(108)
Memory Manager Components	380	(9)
Configuring the Memory Manager	382	(3)
Examining Memory Usage	385	(4)
Services the Memory Manager Provides	389	(14)
Reserving and Committing Pages	390	(2)
Locking Memory	392	(1)
Allocation Granularity	392	(1)
Shared Memory and Mapped Files	393	(2)
Protecting Memory	395	(3)
Copy-on-Write	398	(2)
Heap Functions	400	(1)
Address Windowing Extensions	401	(2)
System Memory Pools	403	(14)
Look-Aside Lists	411	(2)
Driver Verifier	413	(4)
Address Space Layout	417	(12)
User Address Space Layout	420	(4)
System Address Space Layout	424	(5)
Address Translation	429	(14)
Translating a Virtual Address	431	(2)
Page Directories	433	(2)
Process and System Page Tables	435	(1)
Page Table Entries	436	(2)
Byte Within Page	438	(1)
Translation Look-Aside Buffer	439	(3)
Physical Address Extension	442	(1)
Page Fault Handling	443	(9)
Invalid PTEs	445	(1)
Prototype PTEs	446	(2)
In-Paging I/O	448	(1)
Collided Page Faults	449	(1)
Page Files	450	(2)
Virtual Address Descriptors	452	(3)
Working Sets	455	(10)
Paging Policies	455	(2)
Working Set Management	457	(5)
Balance Set Manager and Swapper	462	(1)
System Working Set	463	(2)
Page Frame Number Database	465	(13)
Page List Dynamics	469	(3)
Modified Page Writer	472	(2)
PFN Data Structures	474	(4)
Section Objects	478	(9)
Security	487	(40)
Security Ratings	487	(3)
Security System Components	490	(4)
Protecting Objects	494	(21)
Access Checks	494	(3)
Security Identifiers	497	(2)
Tokens	499	(5)
Impersonation	504	(2)
Restricted Tokens	506	(1)
Security Descriptors and Access Control	507	(8)
Security Auditing	515	(6)
Logon	521	(6)
Winlogon Initialization	522	(1)
User Logon Steps	523	(4)
I/O System	527	(80)
Design Goals	527	(1)
I/O System Components	528	(25)
The I/O Manager	531	(1)
Device Drivers	532	(9)
The Plug and Play (PnP) Manager	541	(5)
The Power Manager	546	(7)
I/O Data Structures	553	(20)
File Objects	554	(2)
Driver Objects and Device Objects	556	(6)
I/O Request Packets	562	(8)
I/O Completion Ports	570	(3)
Driver Loading, Initialization, and Installation	573	(13)
The Start Value	574	(1)
Device Enumeration	575	(4)
Devnodes	579	(2)
Devnode Driver Loading	581	(2)
Driver Installation	583	(3)
I/O Processing	586	(21)
Types of I/O	587	(3)
I/O Request to a Single-Layered Driver	590	(7)
I/O Requests to Layered Drivers	597	(5)
I/O Completion Port Operation	602	(2)
Synchronization	604	(3)
Storage Management	607	(38)
The Evolution of Windows 2000 Storage	607	(2)
Partitioning	609	(8)
Basic Partitioning	610	(1)
Dynamic Partitioning	611	(6)
Storage Drivers	617	(7)
Disk Drivers	618	(1)
Device Naming	619	(1)
Basic Disk Management	620	(1)
Dynamic Disk Management	621	(3)
Disk Performance Monitoring	624	(1)
Multipartition Volume Management	624	(10)
Spanned Volumes	625	(1)
Striped Volumes	626	(1)
Mirrored Volumes	627	(3)
RAID-5 Volumes	630	(2)
Volume I/O Operations	632	(2)
The Volume Namespace	634	(11)
The Mount Manager	634	(2)
Mount Points	636	(3)
Volume Mounting	639	(6)
Cache Manager	645	(38)
Key Features of the Windows 2000 Cache Manager	645	(6)
Single, Centralized System Cache	646	(1)
The Memory Manager	646	(1)
Cache Coherency	647	(2)
Virtual Block Caching	649	(1)
Stream-Based Caching	650	(1)
Recoverable File System Support	650	(1)
Cache Structure	651	(3)
Cache Size	654	(5)
Cache Virtual Size	654	(1)
Cache Physical Size	655	(4)
Cache Data Structures	659	(6)
Systemwide Cache Data Structures	660	(1)
Per-File Cache Data Structures	661	(4)
Cache Operation	665	(10)
Write-Back Caching and Lazy Writing	665	(4)
Intelligent Read-Ahead	669	(2)
System Threads	671	(1)
Fast I/O	672	(3)
Cache Support Routines	675	(8)
Copying to and from the Cache	675	(2)
Caching with the Mapping and Pinning Interfaces	677	(2)
Caching with the Direct Memory Access Interfaces	679	(1)
Write Throttling	680	(3)
File Systems	683	(96)
Windows 2000 File System Formats	684	(6)
CDFS	685	(1)
UDF	685	(1)
FAT12, FAT16, and FAT32	685	(4)
NTFS	689	(1)
File System Driver Architecture	690	(10)
Local FSDs	690	(2)
Remote FSDs	692	(2)
File System Operation	694	(6)
NTFS Design Goals and Features	700	(13)
High-End File System Requirements	700	(2)
Advanced Features of NTFS	702	(11)
NTFS File System Driver	713	(4)
NTFS On-Disk Structure	717	(29)
Volumes	717	(1)
Clusters	717	(1)
Master File Table	718	(7)
File Reference Numbers	725	(1)
File Records	726	(3)
Filenames	729	(3)
Resident and Nonresident Attributes	732	(3)
Indexing	735	(2)
Data Compression and Sparse Files	737	(6)
Reparse Points	743	(1)
The Change Journal File	743	(2)
Object IDs	745	(1)
Quota Tracking	745	(1)
Consolidated Security	745	(1)
NTFS Recovery Support	746	(15)
Evolution of File System Design	746	(3)
Logging	749	(7)
Recovery	756	(5)
NTFS Bad-Cluster Recovery	761	(5)
Encrypting File System Security	766	(13)
Registering Callbacks	769	(1)
Encrypting a File for the First Time	769	(6)
The Decryption Process	775	(2)
Backing Up Encrypted Files	777	(2)
Networking	779	(66)
The OSI Reference Model	780	(4)
OSI Layers	781	(1)
Windows 2000 Networking Components	782	(2)
Networking APIs	784	(30)
Named Pipes and Mailslots	785	(8)
Windows Sockets	793	(5)
Remote Procedure Call	798	(5)
Common Internet File System (CIFS)	803	(4)
NetBIOS	807	(4)
Other Networking APIs	811	(3)
Network-Resource Name Resolution	814	(5)
Multiple Provider Router	814	(3)
Multiple UNC Provider	817	(2)
Domain Name System	819	(1)
Protocol Drivers	819	(4)
NDIS Drivers	823	(9)
Variations on the NDIS Miniport	828	(1)
Connection-Oriented NDIS	829	(3)
Binding	832	(2)
Layered Network Services	834	(11)
Remote Access	834	(1)
Active Directory	835	(2)
Network Load Balancing	837	(1)
File Replication Service	838	(1)
Distributed File System	839	(1)
TCP/IP Extensions	840	(5)
Glossary	845	(28)
Index	873