Windows® Internals, Sixth Edition, Part 2

TT states (processors), Thresholds and Policy Settings, Performance CheckT10 SPC4 specification, Multipath I/O (MPIO) Driverstable of contents area (LDM), The LDM DatabaseTag value, The Start Valuetags, The Start Value, Monitoring Pool Usage, Heap Debugging Featuresheap debugging, Heap Debugging Featurespool allocation, Monitoring Pool Usageprecedence, The Start Valuetail checking, Heap Debugging Features, Pageheaptamper-resistant processors, Trusted Platform Module (TPM)target computers, When There Is No Crash Dump–When There Is No Crash Dump, When There Is No Crash Dump, When There Is No Crash Dumptarget portals (iSCSI), iSCSI Driverstargetname element, The BIOS Boot Sector and Bootmgr, The BIOS Boot Sector and Bootmgrtask gates, 0x7F - UNEXPECTED_KERNEL_MODE_TRAPTask Manager, Examining Memory Usage–Examining Memory Usage, Examining Memory Usage, Commit Charge and Page File Size–Commit Charge and Page File Size, Commit Charge and Page File Size, Cache Physical Sizecache values, Cache Physical Sizememory information, Examining Memory Usage–Examining Memory Usage, Examining Memory Usagepage file usage, Commit Charge and Page File Size–Commit Charge and Page File Size, Commit Charge and Page File SizeTask Scheduler, I/O PrioritiesTBS (TPM Base Services), Trusted Platform Module (TPM), BitLocker ManagementTbssvc.dll, BitLocker Drive EncryptionTCG (Trusted Computing Group), Trusted Platform Module (TPM)TCP/IP, User-Mode Driver Framework (UMDF), iSCSI DriversTEB allocations, Allocation Granularity, User Address Space Layouttemporal locality (cache), Cache Manager’s Read-Ahead Threadtemporary files, Disabling Lazy Writing for a File, Smss, Csrss, and Wininittemporary page states, Page Frame Number DatabaseTerminal Services notifications, Container Notificationstermination, I/O Cancellation for Thread Termination–I/O Completion Ports, I/O Completion Ports, I/O Completion Portsthreads, I/O Cancellation for Thread Termination–I/O Completion Ports, I/O Completion Ports, I/O Completion Portstest-signing mode, The BIOS Boot Sector and BootmgrTestLimit utility, Reserving and Committing Pages–Reserving and Committing Pages, Reserving and Committing Pages, x86 Address Space Layouts, 64-Bit Address Space Layouts, Dynamic System Virtual Address Space Management, Stacks, Page List Dynamics, Page List Dynamics, Page List Dynamics, Page Prioritycreating handles, Dynamic System Virtual Address Space Managementleaking memory, x86 Address Space Layouts, Page Priorityprivate pages, Page List Dynamics, Page List Dynamics, Page List Dynamicsreserved or committed pages, Reserving and Committing Pages–Reserving and Committing Pages, Reserving and Committing Pagesreserving address space, 64-Bit Address Space Layoutsthread creation, StacksTestLimit64.exe utility, User Stackstestsigning element, The BIOS Boot Sector and BootmgrTFAT (Transaction-Safe FAT), exFATTFTP (Trivial FTP), The BIOS Boot Sector and Bootmgrthaws, VSS writers and, Volume Shadow Copy Service, VSS Architecturethinly provisioned virtual hard disks, Virtual Hard Disk Supportthird-party drivers, Monitoring Pool Usage, Crash Dump Filesthird-party RAM optimization software, Robust Performance–Robust Performance, Robust Performance, Robust Performancethread environment block (TEB) allocations, User Address Space Layoutthread stacks, No Execute Page Protection, User Address Space Layout, User Address Space Layout, Stack Randomizationthread thrashing, I/O Cancellation for Thread Terminationthread-agnostic I/O, Opening Devices, IRP Stack Locations, Thread Agnostic I/O, Using Completion Portsthread-scheduling core, Memory Manager Componentsthreaded boosts, I/O Priority Inversion Avoidance (I/O Priority Inheritance)threads, The I/O Manager, Typical I/O Processing, Opening Devices, I/O Processing–Synchronous and Asynchronous I/O, Synchronous and Asynchronous I/O, IRP Stack Locations, Completing an I/O Request, Synchronization, I/O Cancellation, I/O Cancellation for Thread Termination, I/O Cancellation for Thread Termination, The IoCompletion Object, Using Completion Ports, I/O Completion Port Operation, I/O Completion Port Operation, I/O Priority Boosts and Bumps, I/O Priority Boosts and Bumps, No Execute Page Protection, Heap Synchronization, User Address Space Layout, User Address Space Layout, Stacks, User Stacks, Kernel Stacks, Kernel Stacks, Page Priority and Rebalancing, Cache Manager’s Read-Ahead Thread–Process Monitor, Process Monitor, Shutdown, Shutdown, Crash Dump Files, Verbose Analysis–Verbose Analysis, Verbose Analysis, Verbose Analysis, Advanced Crash Dump Analysis, Hung or Unresponsive Systems, Hung or Unresponsive Systemsasynchronous and synchronous I/O, I/O Processing–Synchronous and Asynchronous I/O, Synchronous and Asynchronous I/Ocompletion ports, The IoCompletion Object, I/O Completion Port Operationconcurrency value, Using Completion Portscurrent, Crash Dump Files, Advanced Crash Dump Analysisdeadlocks, Hung or Unresponsive Systemsheap synchronization, Heap Synchronizationhigher-priority, SynchronizationI/O completion, Completing an I/O RequestI/O requests, The I/O ManagerIDs, User Address Space Layoutinactive, I/O Completion Port Operationmaximum number, User Stacksoutstanding IRPs, IRP Stack Locationspreempting windowing system driver, Hung or Unresponsive Systemspriorities, I/O Priority Boosts and Bumps, I/O Priority Boosts and Bumps, Page Priority and Rebalancingread-ahead, Cache Manager’s Read-Ahead Thread–Process Monitor, Process Monitorshutdown process, Shutdown, Shutdownstack trace analysis, Verbose Analysis–Verbose Analysis, Verbose Analysis, Verbose Analysisstacks, No Execute Page Protection, User Address Space Layout, Stacks, Kernel Stacks, Kernel Stackssynchronizing access to shareable resources, Opening Devicestermination, I/O Cancellation, I/O Cancellation for Thread Termination, I/O Cancellation for Thread Terminationvirtual files, Typical I/O Processingthresholds, Thresholds and Policy Settings–Thresholds and Policy Settings, Thresholds and Policy Settingsthrottle states (processors), Thresholds and Policy Settings, Performance Checkthrottling (write throttling), Write Throttling–Write Throttling, Write Throttling, Write Throttlingthroughput, I/O Priority Boosts and Bumps–Bandwidth Reservation (Scheduled File I/O), Bandwidth Reservation (Scheduled File I/O), Bandwidth Reservation (Scheduled File I/O)time (BIOS information), The BIOS Boot Sector and Bootmgrtime command, Advanced Crash Dump Analysistime segments (Superfetch), Page Priority and Rebalancingtime stamps, POSIX Support, File Records, The Change Journal Filechange journal, The Change Journal Filefile attributes, File RecordsPOSIX standard, POSIX Supporttime-check intervals (processors), Thresholds and Policy Settingstime-slice expiration, SynchronizationTimeout element, The BIOS Boot Sector and Bootmgrtimeouts, The I/O Manager, Driver Power OperationI/O manager, The I/O Managerpower options, Driver Power Operationtimers, KMDF Data Model, Initializing the Kernel and Executive Subsystems, Initializing the Kernel and Executive Subsystemsexpiration, Initializing the Kernel and Executive SubsystemsKMDF objects, KMDF Data Modelobject types, Initializing the Kernel and Executive Subsystemstiming requirements (UMDF), User-Mode Driver Framework (UMDF)TLB (translation look-aside buffer), Large and Small Pages, Translation Look-Aside Buffer, Translation Look-Aside Buffer, The BIOS Boot Sector and Bootmgrtoolsdisplayorder element, The BIOS Boot Sector and Bootmgrtop dirty page threshold, Write Throttlingtorn writes, Owner Pagestotal memory, displaying, Examining Memory Usagetotal process working sets, Working Set Managementtotal virtual address space, Commit Charge and the System Commit LimitTPM (Trusted Platform Module), BitLocker Drive Encryption, BitLocker Drive Encryption, Encryption Keys, Trusted Platform Module (TPM), Trusted Platform Module (TPM), The BIOS Boot Sector and BootmgrBitLocker, BitLocker Drive EncryptionBoot Entropy policy, The BIOS Boot Sector and Bootmgrencrypting volume master keys, Encryption KeysMMC snap-in, BitLocker Drive Encryption, Trusted Platform Module (TPM)Windows support, Trusted Platform Module (TPM)TPM Base Services (TBS), BitLocker Drive Encryption, Trusted Platform Module (TPM), Trusted Platform Module (TPM), Trusted Platform Module (TPM), BitLocker ManagementTPM chips, Trusted Platform Module (TPM), Trusted Platform Module (TPM), BitLocker ManagementTPM MMC snap-in, BitLocker Drive Encryption, Trusted Platform Module (TPM), Trusted Platform Module (TPM)Tpm.sys driver, BitLocker Drive Encryptiontpmbootentropy element, The BIOS Boot Sector and Bootmgrtrace collector and processor, Componentstrace file names, Logical Prefetcher, Logical Prefetchertrace information (ReadyBoot), ReadyBoottracer mechanism (Superfetch), Componentstraces, Tracing and Logging, Page Priority and Rebalancing, Process Monitor Troubleshooting Techniquesprebuilt traces, Page Priority and RebalancingProcess Monitor, Process Monitor Troubleshooting TechniquesSuperfetch service, Tracing and Loggingtraditionalksegmappings element, The BIOS Boot Sector and Bootmgrtraining Superfetch, Page Priority and RebalancingTransactdemo.exe tool, Isolation–Transactional APIs, Isolation, Transactional APIstransacted APIs, Transaction Supporttransaction isolation directory (, Master File Tabletransaction log (, Master File Table, Resource Managerstransaction log (CLFS), Marshallingtransaction log (LDM), The LDM Database, The LDM Database, The LDM Databasetransaction log records, Recoverable File System Support, Log File Servicetransaction manager, Initializing the Kernel and Executive Subsystems, Initializing the Kernel and Executive Subsystemstransaction parameter blocks, Opening Devicestransaction parameters, Opening Devicestransaction repair directory (, Master File Tabletransaction semantics, NTFS, Common Log File Systemtransaction tables, Recovery Implementation, Log Record Types, RecoveryTransaction-Safe FAT (TFAT), exFATtransactional APIs, Transactional APIs–Resource Managers, Resource Managers, Resource Managerstransactional NTFS library, Transaction Supporttransactions, Recoverability, Recoverability, Isolation–Transactional APIs, Isolation, Transactional APIs–Resource Managers, Transactional APIs, Resource Managers–On-Disk Implementation, Resource Managers, Resource Managers, On-Disk Implementation–Logging Implementation, On-Disk Implementation, Logging Implementation–NTFS Recovery Support, Logging Implementation, Logging Implementation, Recovery Implementation, Recovery Implementation, Recovery Implementation, NTFS Recovery Support, NTFS Recovery Support, Log Record Types, Log Record Typesafter system failures, NTFS Recovery SupportAPIs, Transactional APIs–Resource Managers, Resource Managers, Resource Managersatomic, Recoverability, Recoverabilitycommitted, Log Record Typesisolation, Isolation–Transactional APIs, Isolation, Transactional APIslogged information, Log Record Typeslogging implementation, Logging Implementation–NTFS Recovery Support, Recovery Implementation, NTFS Recovery Supporton-disk implementation, On-Disk Implementation–Logging Implementation, Logging Implementation, Logging Implementationrecovery implementation, Recovery Implementationrecovery process, Recovery Implementationresource managers, Resource Managers–On-Disk Implementation, On-Disk Implementationtransition pages, PFN Data StructuresTransition PFN state, Page Frame Number Database, Page Frame Number Databasetransition PTEs, PFN Data Structurestransition, pages in, Invalid PTEs, Prototype PTEstranslation, Protecting Memory, Management Policiestranslation look-aside buffer (TLB), Large and Small Pages, Hardware vs. Software Write Bits in Page Table Entries, Translation Look-Aside Buffer, Translation Look-Aside Buffertranslation-not-valid handler, Memory Manager Componentstransport layer, When There Is No Crash Dumptransport parameters, Hung or Unresponsive Systemstransportable shadow copies, VSS Operationtrap command, 0xD1 - DRIVER_IRQL_NOT_LESS_OR_EQUAL–0x8E - KERNEL_MODE_EXCEPTION_NOT_HANDLED, 0xD1 - DRIVER_IRQL_NOT_LESS_OR_EQUAL, 0x8E - KERNEL_MODE_EXCEPTION_NOT_HANDLEDtrap frames, 0xD1 - DRIVER_IRQL_NOT_LESS_OR_EQUAL, 0x7F - UNEXPECTED_KERNEL_MODE_TRAP, 0x7F - UNEXPECTED_KERNEL_MODE_TRAP, 0xC5 - DRIVER_CORRUPTED_EXPOOLtrap handler, Servicing an Interrupttrap to debugger instruction, 0x8E - KERNEL_MODE_EXCEPTION_NOT_HANDLEDtraps, Causes of Windows Crashes, 0x7F - UNEXPECTED_KERNEL_MODE_TRAP–0xC5 - DRIVER_CORRUPTED_EXPOOL, 0xC5 - DRIVER_CORRUPTED_EXPOOLtraversal permissions, POSIX Supporttriage dumps (minidumps), Crash Dump Files, Crash Dump FilesTriage.ini file, Basic Crash Dump Analysis–Verbose Analysis, Verbose Analysis, Verbose Analysistrim command, File Deletion and the Trim Command–File Deletion and the Trim Command, File Deletion and the Trim Commandtrimmed private data, Physical Address Extension (PAE)trimmed working sets, Modified Page Writer, PFN Data Structurestrimming, Page Files, Driver Verifier, Working Set Management, Balance Set Manager and Swapper, System Working Sets, Page Priority and Rebalancingpage files, Page Filespretraining Superfetch, Page Priority and Rebalancingsystem working set, Driver Verifierworking sets, Working Set Management, Balance Set Manager and Swapper, System Working Setstriple faults, When There Is No Crash DumpTrivial FTP (TFTP), The BIOS Boot Sector and Bootmgrtroubleshooting, Driver Verifier, Driver Verifier, Driver Verifier, NAND-Type Flash Memory, Large and Small Pages, Heap Security Features–Pageheap, Heap Debugging Features, Pageheap, Driver Verifier, Driver Verifier, Driver Verifier, Driver Verifier, Driver Verifier, Process Reflection–Process Reflection, Process Reflection, Troubleshooting File System Problems–Common Log File System, Process Monitor Troubleshooting Techniques, Common Log File System, Troubleshooting Boot and Startup Problems–Windows Recovery Environment (WinRE), Safe Mode, Driver Loading in Safe Mode, Driver Loading in Safe Mode, Boot Logging in Safe Mode, Windows Recovery Environment (WinRE), Windows Recovery Environment (WinRE)–MBR Corruption, Windows Recovery Environment (WinRE), MBR Corruption, MBR Corruption, The Blue Screen, When There Is No Crash DumpDriver Verifier, Driver Verifier, Driver Verifier, Driver Verifier, Driver Verifier, Driver Verifier, Driver Verifier, Driver Verifier, Driver Verifierheap, Heap Security Features–Pageheap, Heap Debugging Features, Pageheaplarge page allocation failures, Large and Small PagesProcess Monitor, Troubleshooting File System Problems–Common Log File System, Process Monitor Troubleshooting Techniques, Common Log File Systemprocesses, Process Reflection–Process Reflection, Process Reflectionsafe mode, Troubleshooting Boot and Startup Problems–Windows Recovery Environment (WinRE), Safe Mode, Driver Loading in Safe Mode, Driver Loading in Safe Mode, Boot Logging in Safe Mode, Windows Recovery Environment (WinRE), Windows Recovery Environment (WinRE)SSDs, NAND-Type Flash Memorystop code help files, The Blue ScreenWindows Recovery Environment, Windows Recovery Environment (WinRE)–MBR Corruption, MBR Corruption, MBR Corruptionwithout crash dumps, When There Is No Crash Dumptroubleshooting user menus, The BIOS Boot Sector and Bootmgrtruncatememory element, The BIOS Boot Sector and Bootmgrtruncating data, The Change Journal Filetrusted applications, Smss, Csrss, and WininitTrusted Computing Group (TCG), Trusted Platform Module (TPM)try/except blocks, IRP Buffer Management, Explicit File I/Otunneling cache, File NamesTxF (transactional NTFS), Shadow Copy Provider, Master File Table, Master File Table, File Records, The Change Journal File, Transaction Support, Transactional APIs–Resource Managers, Resource Managers–On-Disk Implementation, Resource Managers, Resource Managers, Resource Managers, On-Disk Implementation, Logging Implementation–NTFS Recovery Support, Recovery Implementation, NTFS Recovery Support, DesignAPIs, Transactional APIs–Resource Managers, Resource Managers, Resource Managersbackward compatibility, Transaction Supportbase log file, Master File Tablechange journal, The Change Journal Filefile attributes, File Recordslog files, Resource Managerslog records, Logging Implementation–NTFS Recovery Support, Recovery Implementation, NTFS Recovery Supportlog stream, Master File Tablerecovery, Designresource managers, Resource Managers–On-Disk Implementation, On-Disk Implementationsnapshot device operations, Shadow Copy ProviderTxF file ID (TxID), On-Disk Implementation–Logging Implementation, On-Disk Implementation, Logging ImplementationTxF log files (, Master File Table, Transaction Support, Resource ManagersTxF old page stream (, Master File TableTxfLog stream, Master File Table, Resource ManagersTxfw32.dll library, Transaction SupportTxID (TxF file ID), On-Disk Implementation–Logging Implementation, On-Disk Implementation, Logging Implementation