Windows 2000 Windows 2000 Course SummaryCourse Summary

Computing Department,Computing Department,

Lancaster University, UKLancaster University, UK

OverviewOverview

• GoalsGoals– Provide a summary of the whole courseProvide a summary of the whole course– Highlight key areas of importanceHighlight key areas of importance

System Architecture (1)System Architecture (1)

• What is Windows 2000?What is Windows 2000?– Features overviewFeatures overview– Design objectivesDesign objectives

• How these differ from Win9xHow these differ from Win9x– Product PackagingProduct Packaging

• Key ConceptsKey Concepts– Win32 APIWin32 API– Processes, Thread and JobsProcesses, Thread and Jobs– Virtual MemoryVirtual Memory– Kernel Mode vs. User ModeKernel Mode vs. User Mode– RegistryRegistry

System Architecture (2)System Architecture (2)

• Windows 2000 Architecture ComponentsWindows 2000 Architecture Components– ExecutiveExecutive– KernelKernel– HALHAL– Device DriversDevice Drivers– Win32 User/GDIWin32 User/GDI

• In further detail:In further detail:– The role of each componentThe role of each component– Interaction between componentsInteraction between components

System Architecture (3)System Architecture (3)

• Environment SubsystemsEnvironment Subsystems– Subsystem Components and their RoleSubsystem Components and their Role

• Overview of OS/2, POSIX and Win32 subsystemsOverview of OS/2, POSIX and Win32 subsystems

• Subsystem Function PathsSubsystem Function Paths

– Image Headers (Subsystem Type/Native Image Headers (Subsystem Type/Native Images)Images)

– POSIX ExperimentationPOSIX Experimentation

System Architecture (4)System Architecture (4)

• OS Kernel FunctionalityOS Kernel Functionality– NTOSKRNL.EXENTOSKRNL.EXE– Internal Naming ConventionInternal Naming Convention

• Listing Undocumented FunctionsListing Undocumented Functions

– Mechanism for Invoking System Functions from Mechanism for Invoking System Functions from User ModeUser Mode

– Differences between Win32 and NtDll.DllDifferences between Win32 and NtDll.Dll– Location of Operating System codeLocation of Operating System code

• System ProcessesSystem Processes– Processed-Based Windows 2000 CodeProcessed-Based Windows 2000 Code– Process Creation HierarchyProcess Creation Hierarchy– System Start-up ProcessesSystem Start-up Processes

System Mechanisms (1)System Mechanisms (1)

• Objects and HandlesObjects and Handles– Introduction to objectsIntroduction to objects– Benefits of using objectsBenefits of using objects– Different types of Win32 objectsDifferent types of Win32 objects

• Kernel objects, GDI objects and User objectsKernel objects, GDI objects and User objects

– Handles and Reference CountsHandles and Reference Counts– SecuritySecurity– Object Manager FunctionalityObject Manager Functionality

System Mechanisms (2)System Mechanisms (2)

• Kernel Mode Programming Kernel Mode Programming EnvironmentEnvironment– Invoking Kernel-Mode RoutinesInvoking Kernel-Mode Routines– Trap DispatchingTrap Dispatching– Interrupts and ExceptionsInterrupts and Exceptions

•How interrupts/exceptions are generatedHow interrupts/exceptions are generated•Dispatching of InterruptsDispatching of Interrupts• Interrupt Precedence via IRQLsInterrupt Precedence via IRQLs•Software InterruptsSoftware Interrupts•Hardware Interrupt Processing on x86Hardware Interrupt Processing on x86

Overview of Windows 2000 Overview of Windows 2000 Management MechanismsManagement Mechanisms• The registryThe registry

– ContentsContents– OrganisationOrganisation– AccessAccess

• ServicesServices– General conceptsGeneral concepts– ComponentsComponents– ExamplesExamples

• Windows Management InstrumentationWindows Management Instrumentation– Windows 2000 WMI-enabled toolsWindows 2000 WMI-enabled tools

Processes, Threads and Processes, Threads and Scheduling (1)Scheduling (1)• What are processes, threads and jobs?What are processes, threads and jobs?

– In further detail:In further detail:• What each process has associated with itWhat each process has associated with it• Viewing process informationViewing process information• What each thread has associated with itWhat each thread has associated with it• Viewing thread informationViewing thread information

• FibersFibers– General concepts / implementation General concepts / implementation

“environment”“environment”• Win32 process and thread APIsWin32 process and thread APIs• Exiting of processesExiting of processes

– Different API calls usedDifferent API calls used

Processes, Threads and Processes, Threads and Scheduling (2)Scheduling (2)• General scheduling conceptsGeneral scheduling concepts

– Views of prioritiesViews of priorities• The Win32 point of viewThe Win32 point of view• The Windows 2000 scheduler point of viewThe Windows 2000 scheduler point of view• Win32 priorities versus kernel prioritiesWin32 priorities versus kernel priorities

– Manual process priority adjustmentsManual process priority adjustments– Win32 scheduling-related APIsWin32 scheduling-related APIs

• Thread schedulingThread scheduling– General Windows 2000 scheduler conceptsGeneral Windows 2000 scheduler concepts– Multiprocessor issuesMultiprocessor issues– Scheduling scenarios: preemption, voluntary switch, Scheduling scenarios: preemption, voluntary switch,

running thread experiences quantum endrunning thread experiences quantum end

Processes, Threads and Processes, Threads and Scheduling (3)Scheduling (3)• Thread scheduling (cont.)Thread scheduling (cont.)

– Quantum detailsQuantum details– Thread scheduling statesThread scheduling states– Watching the schedulerWatching the scheduler– Priority adjustmentsPriority adjustments

• Applicable classesApplicable classes• Non applicable classesNon applicable classes• BoostingBoosting

– Conditions for boostingConditions for boosting– General conceptsGeneral concepts

• CPU starvationCPU starvation– Balance Set ManagerBalance Set Manager

Processes, Threads and Processes, Threads and Scheduling (4)Scheduling (4)

• Thread scheduling (cont.)Thread scheduling (cont.)– Multiprocessor supportMultiprocessor support

•Concept of soft affinityConcept of soft affinity

•Concept of hard affinityConcept of hard affinity

•Hard affinity exampleHard affinity example

Memory Management (1)Memory Management (1)

• Virtual memoryVirtual memory– General principlesGeneral principles– Application’s viewApplication’s view– Mapping virtual memory to physical memory Mapping virtual memory to physical memory

pagespages

• Virtual address spaceVirtual address space– Windows 2000 memory managerWindows 2000 memory manager– Virtual address space allocationVirtual address space allocation

• Different regionsDifferent regions

• Page sizes within NT and 2000Page sizes within NT and 2000

Memory Management (2)Memory Management (2)

• Virtual address space (cont.)Virtual address space (cont.)– Division between Division between process space process space and and system system

spacespace• Process space - unique per process, user accessibleProcess space - unique per process, user accessible

– ContentsContents

• System space - system wide, kernel mode accessibleSystem space - system wide, kernel mode accessible– ContentsContents

– Windows 9x virtual address spaceWindows 9x virtual address space• Additional user-mode shared memory - system wideAdditional user-mode shared memory - system wide

– Virtual address translationVirtual address translation

Memory Management (3)Memory Management (3)

• Physical memoryPhysical memory– Maximum memory supportMaximum memory support

• Under NTUnder NT

• Under 2000 via extended addressing support - “PAE”Under 2000 via extended addressing support - “PAE”

• Increased limits under 64-bit Windows 2000Increased limits under 64-bit Windows 2000

– Page filesPage files• SizeSize

• Events when page file space runs lowEvents when page file space runs low

• Who is consuming space?Who is consuming space?

• Page faultsPage faults

Memory Management (4)Memory Management (4)

• Physical memory (cont.)Physical memory (cont.)– Working setWorking set

• General conceptsGeneral concepts• Working set limitWorking set limit• Page replacement algorithmPage replacement algorithm• System servicesSystem services

– Adjust size, self-initiated trimmingAdjust size, self-initiated trimming

– System working setSystem working set– Accounting for physical memory usageAccounting for physical memory usage

• Memory management informationMemory management information– General, process and physical memory General, process and physical memory

informationinformation

Windows Networking (1)Windows Networking (1)

• OSI model and Windows 2000 networking OSI model and Windows 2000 networking componentscomponents– OSI reference model overviewOSI reference model overview– Mapping of components against OSI layersMapping of components against OSI layers

• What each component does, and what layer it fits What each component does, and what layer it fits intointo

– Networking APIsNetworking APIs– Transport Driver Interface (TDI) clientsTransport Driver Interface (TDI) clients– TDI transports (also known as TDI transports (also known as protocol driversprotocol drivers))– NDIS libraryNDIS library– NDIS miniport driversNDIS miniport drivers

Windows Networking (2)Windows Networking (2)

• Windows 2000 networking stack: Windows 2000 networking stack: – ServicesServices

• Remote accessRemote access• Active directoryActive directory• File replication serviceFile replication service• Network load balancingNetwork load balancing

– Networking APIsNetworking APIs• Windows Sockets (Winsock)Windows Sockets (Winsock)• Named pipes and mailslotsNamed pipes and mailslots• Remote procedure call (RPC)Remote procedure call (RPC)• NetBIOSNetBIOS• OtherOther

– Telephony API, DCOM, message queuingTelephony API, DCOM, message queuing

Windows Networking (3)Windows Networking (3)

• Windows 2000 networking stack: Windows 2000 networking stack: (cont.)(cont.)– Protocol driversProtocol drivers

•PurposePurpose

•Drivers natively supported by Windows 2000Drivers natively supported by Windows 2000

•Other driver supportOther driver support

– NDIS driversNDIS drivers•PurposePurpose

•NDIS 5 featuresNDIS 5 features

Windows Networking (4)Windows Networking (4)

• Winsock2Winsock2– Basic conceptsBasic concepts– Overview of main featuresOverview of main features– Simultaneous access to multiple transport Simultaneous access to multiple transport

protocolsprotocols• Winsock2 API / SPI separationWinsock2 API / SPI separation• Winsock2 DLLWinsock2 DLL

– Winsock1.1 backward compatibilityWinsock1.1 backward compatibility• Source code compatibilitySource code compatibility• Binary compatibilityBinary compatibility

– Layered protocol architectureLayered protocol architecture• Layered Layered protocols and protocols and base base protocolsprotocols• Protocol chainsProtocol chains

I/O System, Cache Manager, I/O System, Cache Manager, File Systems (1)File Systems (1)

• I/O SystemI/O System– Design goalsDesign goals– ComponentsComponents– I/O operationsI/O operations

• Flow of a typical I/O requestFlow of a typical I/O request

– Types of device driverTypes of device driver• Including user-mode drivers…Including user-mode drivers…

– Win32 I/O APIsWin32 I/O APIs• Device-independent APIsDevice-independent APIs• Device-type-dependent APIsDevice-type-dependent APIs

I/O System, Cache Manager, I/O System, Cache Manager, File Systems (2)File Systems (2)• Cache ManagerCache Manager

– OverviewOverview• File system types supportedFile system types supported• Types of data to be cachedTypes of data to be cached

– Key featuresKey features– Interaction between cache and memory managerInteraction between cache and memory manager

• File SystemsFile Systems– OthersOthers

• CDFS, UDF, FAT12, FAT16 and FAT32CDFS, UDF, FAT12, FAT16 and FAT32– NTFSNTFS

• OverviewOverview• Advanced featuresAdvanced features