本书从操作系统原理的角度,详细解析了Windows如何实现现代操作系统的各个关键部件,包括进程、线程、物理内存和虚拟内存的管理,Windows中的同步和并发性支持,以及Windows的IO模型。在介绍这些关键部件时,本书直接以Windows的源代码(WRK,Windows
Research Kernel)为参照,因而读者可以了解像Windows这样的复杂操作系统是如何在x86处理器上运行的。
在内容选取方面,本书侧重于Windows内核中最基本的系统部件,同时也兼顾到作为一个操作系统的完整性,所以,本书也介绍了像存储体系、网络、Windows环境子系统等,这些虽然并不位于内核模块但却支撑整个Windows运行的重要部件。在本书最后,也介绍了Windows
Server 2003以后的内核发展和变化。
虽然书中有大量关于Windows代码实现的描述,但是本书并没有罗列WRK中的代码,即使读者不对照WRK的源代码,也可以从这些章节的描述中理解Windows的实现机理。在每一个技术专题的介绍中,本书几乎都提供了一个框架图,并且有关键细节的实现分析,这样做的意图是让读者既能够对一项技术有总体上的把握,也通晓关键的实现细节。
Windows操作系统已经有20年历史了,市面上有大量关于Windows技术的文档和书籍,但是,真正从源代码来诠释Windows底层机理的,本书还是第一次尝试。在本书覆盖的内容中,有相当一部分是第一次以文字形式披露出来的,期望这些内容能消除人们对于Windows的神秘感。
写作本书的目的是让对Windows有好奇心的人真正了解到Windows中的核心机理,让计算机专业的学生和老师,以及系统软件工程师可以快速地领略到Windows中先进的系统技术,以及在Windows上编写出更加高效的软件。本书也配备了一些小工具,通过这些小工具,读者可以查看内核中的静态或动态的信息,甚至观察系统的行为。
The Windows Operating System has been evolving, along with
the PC-based computer. Although systems based on UNIX have
dominated in the universities since the 1970s, Windows has
completely surpassed UNIX in commercial systems. Yet relatively
little information about the internals of Windows – the
architecture and code of the kernel – has been available outside of
Microsoft.
With the support of Microsoft’s executive management
particularly Rob Short, Jim Allchin, and Bill Gates, my
colleagues Arkady Retik, Chris Fagan, and I set out to make the
sources for the Windows kernel available to faculty, researchers,
and students throughout the world. We wanted them to have the
opportunity to examine the internals of the kernel and understand
its implementation and thus be able to decide for themselves what
is admirable about the Windows kernel – and what is not.
This project became the Windows Research Kernel WRK, and
is part of the Windows Academic Program WAP
www.microsoft.comWindowsAcademic. The WAP also includes a large
amount of teaching materials in the Curriculum Resource Kit CRK.
Effectively the WRK is the Windows kernel in source form, and the
CRK is the Windows kernel in PowerPoint with exercises,
experiments, projects, and other learning aids.
All along we knew that the WRK and CRK by themselves would
not make the Windows kernel as accessible as we wanted it to be. It
would take books like Understanding the Windows
Kernel to draw together and organize the ideas
in the kernel and explain the source code.
Our intention with the Windows Academic Program has never
been to advocate that Windows supplant UNIX in the teaching of
operating systems in universities. We believe that both the UNIX
and the Windows kernel should be taught, so that it is possible to
compare and contrast the architecture and design choices that are
evident in both systems.
As you will see from this book, Windows has made some very
different choices than UNIX. In large part this is because Windows
was developed to target a very different system and user
environment than UNIX did when it was created. Windows would run on
multiprocessors, so threads are the unit of scheduling rather than
processes. The systems would have at least 32 bits of pageable
virtual address space, so the Windows kernel had the opportunity to
build general purpose mechanisms such as the object manager and
stackable IO. Windows expected to run in a very dynamic
environment, so the object name space resides outside the file
system and is maintained by the kernel itself. Although not a
microkernel, Windows did incorporate the Mach idea of multiple
operating system personalities in user-mode “subsystem” processes,
initially supporting OS2, POSIX, and Win32 interfaces.
The internal architecture of the kernel reflects learning
from UNIX, Mach and VMS, Digital’s VAX operating system that was
also designed by Dave Cutler, the senior architect of the Windows
OS. There is a layer within the kernel which abstracts and
schedules the CPUs as threads, interrupts, traps, etc. This
“kernel of the kernel” layer is about 5% of the code. The rest of
the kernel is in the “executive” layer including the device
drivers, file systems, and network code which run outside of the
kernel proper. The executive is implemented as fairly ordinary
multithreaded code, which greatly simplifies the expertise required
by kernel-mode developers.
For those who learned operating systems by reading and
understanding only the ideas in UNIX, learning about Windows
creates a great opportunity to evaluate their own assumptions about
what an operating system should be. This is important because the
nature of computer systems continues to rapidly evolve. UNIX was
designed for 16-bit, low-memory, swapping systems. Windows for
32-bit systems with paged virtual addressing and megabytes of
physical memory. But contemporary systems are 64-bit with gigabytes
of memory, and many new features like virtualization hardware,
solid-state disks, and integrated computational and graphics
accelerators. Connectivity has evolved from the dial-up modems at
UNIX’s birth in 1969 to the 10 Mbps local Ethernet at Windows birth
in 1989. And now we have multiple Gbps networks interconnecting
computers around the world. Will a new operating system emerge
which targets these new hardware environments? Or will existing
systems just continue to evolve their capabilities? It is only by
having a broader understanding than either just UNIX or just
Windows that software engineers will be able to judge for
themselves.
Our colleague, Aimin Pan, is one of the bright stars in the
new generation of computer scientists teaching and researching some
of these important questions about the future of operating systems.
His presentation of the Windows kernel will be a great asset for
those who want to also participate in the evolving future of
operating systems, as well as those who are just simply curious, or
want to better understand the software architecture that they are
using daily.
Dave Probert, Ph.D.
compsci@microsoft.com
Windows Kernel Architect – Microsoft
Developer of the Windows Research Kernel
release
14 February 2010
序 二
Windows作为用户最多的主流操作系统,备受广大师生和工程技术人员的关注,大家希望能通过深入内核的实验和分析源代码的方式,来透彻地了解Windows操作系统。微软亚洲研究院认真地考虑了这一需求,并和微软Windows产品部的专家一起做了大量的努力,终于在2005年促成了微软公司面向教育界发布的Windows学术支持计划,其中就包括了为教育和科研提供Windows内核源代码的访问许可WRK(Windows
Research Kernel)。
我们围绕WRK进行了一系列的教师培训,大家认为WRK的发布是深入了解Windows操作系统内核的一个里程碑,但同时也反映出一个问题:WRK包含大量的源代码,如何阅读和分析它们,并将这些源代码与教学中的知识结构对应起来,是进一步使用WRK的瓶颈。
潘爱民博士写的《Windows内核原理与实现》这本书很好地解决了这一问题。潘博士采取将全局系统框图和关键实现分析相结合的方式,详细解析了Windows对现代操作系统的各个关键部件的实现。书中采用了Windows操作系统的真实数据结构,并将操作系统的实现机理与WRK中的源代码描述对应了起来。书中附带有很多分析工具,使读者可以方便地跟踪和观察操作系统内核的运行过程。
潘爱民博士是软件技术和操作系统方面的专家,他从2004年开始在微软亚洲研究院从事系统性能分析的研究工作,在Windows操作系统的内核优化方面有着丰富的知识和经验。潘博士承担了Windows Internals, 4th Edition一书中文版的翻译工作,他还参与了很多与操作系统有关的高校合作项目,通过教师培训和指导学生,对Windows操作系统在教学和科研中的实际需求有着深入的了解。