Windows® Internals, Sixth Edition, Part 2

Booting from iSCSI

Internet SCSI (iSCSI) devices are a kind of network-attached storage, in that remote physical disks are connected to an iSCSI Host Bus Adapter (HBA) or through Ethernet. These devices, however, are different from traditional network-attached storage (NAS) because they provide block-level access to disks, unlike the logical-based access over a network file system that NAS employs. Therefore, an iSCSI-connected disk appears as any other disk drive, both to the boot loader as well as to the OS, as long as the Microsoft iSCSI Initiator is used to provide access over an Ethernet connection. By using iSCSI-enabled disks instead of local storage, companies can save on space, power consumption, and cooling.

Although Windows has traditionally supported booting only from locally connected disks, or network booting through PXE, modern versions of Windows are also capable of natively booting from iSCSI devices through a mechanism called iSCSI Boot. The boot loader (Winload.exe) contains a minimalistic network stack conforming to the Universal Network Device Interface (UNDI) standard, which allows compatible NIC ROMs to respond to Interrupt 13h (the legacy BIOS disk I/O interrupt) and convert the requests to network I/O. On EFI systems, the network interface driver provided by the manufacturer is used instead, and EFI Device APIs are used instead of interrupts.

Finally, to know the location, path, and authentication information for the remote disk, the boot loader also reads an iSCSI Boot Firmware Table (iBFT) that must be present in physical memory (typically exposed through ACPI). Additionally, Windows Setup also has the capability of reading this table to determine bootable iSCSI devices and allow direct installation on such a device, such that no imaging is required. Combined with the Microsoft iSCSI Initiator, this is all that’s required for Windows to boot from iSCSI, as shown in Figure 13-3.

Figure 13-3. iSCSI boot architecture

Initializing the Kernel and Executive Subsystems

When Winload calls Ntoskrnl, it passes a data structure called the loader parameter block that contains the system and boot partition paths, a pointer to the memory tables Winload generated to describe the physical memory on the system, a physical hardware tree that is later used to build the volatile HARDWARE registry hive, an in-memory copy of the SYSTEM registry hive, and a pointer to the list of boot drivers Winload loaded, as well as various other information related to the boot processing performed until this point.

EXPERIMENT: Loader Parameter Block

While booting, the kernel keeps a pointer to the loader parameter block in the KeLoaderBlock variable. The kernel discards the parameter block after the first boot phase, so the only way to see the contents of the structure is to attach a kernel debugger before booting and break at the initial kernel debugger breakpoint. If you are able to do so, you can use the dt command to dump the block, as shown:0: kd> dt poi(nt!KeLoaderBlock) nt!_LOADER_PARAMETER_BLOCK +0x000 OsMajorVersion : 6 +0x004 OsMinorVersion : 1 +0x008 Size : 0x88 +0x00c Reserved : 0 +0x010 LoadOrderListHead : _LIST_ENTRY [ 0x8085b4c8 - 0x80869c70 ] +0x018 MemoryDescriptorListHead : _LIST_ENTRY [ 0x80a00000 - 0x80a00de8 ] +0x020 BootDriverListHead : _LIST_ENTRY [ 0x80860d10 - 0x8085eba0 ] +0x028 KernelStack : 0x88e7c000 +0x02c Prcb : 0 +0x030 Process : 0 +0x034 Thread : 0x88e64800 +0x038 RegistryLength : 0x2940000 +0x03c RegistryBase : 0x80adf000 Void +0x040 ConfigurationRoot : 0x8082d450 _CONFIGURATION_COMPONENT_DATA +0x044 ArcBootDeviceName : 0x8082d9a0 "multi(0)disk(0)rdisk(0)partition(4)" +0x048 ArcHalDeviceName : 0x8082d788 "multi(0)disk(0)rdisk(0)partition(4)" +0x04c NtBootPathName : 0x8082d828 "\Windows\" +0x050 NtHalPathName : 0x80826358 "\" +0x054 LoadOptions : 0x8080e1b0 "NOEXECUTE=ALWAYSON DEBUGPORT=COM1 BAUDRATE=115200" +0x058 NlsData : 0x808691e0 _NLS_DATA_BLOCK +0x05c ArcDiskInformation : 0x80821408 _ARC_DISK_INFORMATION +0x060 OemFontFile : 0x84a551d0 Void +0x064 Extension : 0x8082d9d8 _LOADER_PARAMETER_EXTENSION +0x068 u : +0x074 FirmwareInformation : _FIRMWARE_INFORMATION_LOADER_BLOCK