Windows Kernel Internal Overview
Windows Kernel Internal Overview
Windows Kernel Internal Overview
Overview
David B. Probert, Ph.D.
Windows Kernel Development
Microsoft Corporation
© Microsoft Corporation 1
Contributors
Neill Clift Landy Wang
Adrian Marinescu David Solomon
Nar Ganapathy Ben Leis
Jake Oshins Brian Andrew
Andrew Ritz Jason Zions
Jonathan Schwartz Gerardo Bermudez
Mark Lucovsky Dragos Sambotin
Samer Arafeh Arun Kishan
Dan Lovinger Adrian Oney
© Microsoft Corporation 2
Windows History
• Team formed in November 1988
• Less than 20 people
• Build from the ground up
– Advanced Operating System
– Designed for desktops and servers
– Secure, scalable SMP design
– All new code
• Rigorous discipline – developers wrote very detailed
design docs, reviewed/discussed each others docs and
wrote unit tests
© Microsoft Corporation 3
Goals of the NT System
• Reliability – Nothing should be able to crash the
OS. Anything that crashes the OS is a bug and
we won’t ship until it is fixed
• Security – Built into the design from day one
• Portability – Support more than one processor,
avoid assembler, abstract HW dependencies.
• Extensibility – Ability to extend the OS over time
• Compatibility – Apps must run
• Performance – All of the above are more
important than raw speed!
© Microsoft Corporation 4
Windows Server 2003 Architecture
System Processes Applications Environment
Service Services Subsystems
Controller Alerter
User Interix
WinLogon RPC
Session Event Application
User
Manager Win32
Mode Logger Subsystem DLLs
System NTDLL.DLL
Threads
© Microsoft Corporation 6
Windows Kernel
• Lower layers of the operating system
– Implements processor-dependent functions (x86 vs. Alpha vs.
etc.)
– Also implements many processor-independent functions that are
closely associated with processor-dependent functions
• Main services
– Thread waiting, scheduling & context switching
– Exception and interrupt dispatching
– Operating system synchronization primitives (different for MP vs.
UP)
– A few of these are exposed to user mode
• Not a classic “microkernel”
– shares address space with rest of
kernel components
© Microsoft Corporation 7
HAL - Hardware Abstraction Layer
© Microsoft Corporation 8
Kernel Mode Execution
Code is run in kernel mode for one of three reasons:
1. Requests from user mode (system calls)
– Via the system service dispatch mechanism
– Kernel-mode code runs in the context of the requesting thread
2. Interrupts from external devices
– Interrupts (like all traps) are handled in kernel mode
– NT-supplied interrupt dispatcher invokes the interrupt service routine
– ISR runs in the context of the interrupted thread (so-called “arbitrary
thread context”)
– ISR often requests the execution of a “DPC routine”, which also runs in
kernel mode
3. Dedicated kernel-mode threads
– Some threads in the system stay in kernel mode at all times (mostly in
the “System” process)
– Scheduled, preempted, etc., like any other threads
© Microsoft Corporation 9
Processes & Threads
Access Token
Handle Table
object
object
.Net Framework
Window w = new Window();
w.Text = "Main Window";
w.Show();
© Microsoft Corporation 14
.Net: Unify Programming Models
Consistent API availability regardless of
language and programming model
.NET Framework
RAD, Subclassing, Stateless,
Composition, Power, Code embedded
Delegation Expressiveness in HTML pages
Windows API
© Microsoft Corporation 15
.Net: API Organization
System.Web System.Windows.Forms
Services UI Design ComponentModel
Description HtmlControls
Discovery WebControls
Protocols System.Drawing
Caching Security Drawing2D Printing
Configuration SessionState Imaging Text
System.Data System.Xml
ADO SQL XSLT Serialization
Design SQLTypes XPath
System
Collections IO Security Runtime
Configuration Net ServiceProcess InteropServices
Diagnostics Reflection Text Remoting
Globalization Resources © Microsoft Corporation
Threading Serialization 16
.Net: Languages
The Managed Platform is Language Neutral
¾ All languages are first class players
¾ You can leverage your existing skills
Common Language Specification
¾ Set of features guaranteed to be in all languages
¾ C# enforcement: [assembly:CLSCompliant(true)]
We are providing
¾ VB, C++, C#, J#, JScript
Third-parties are building
¾ APL, COBOL, Pascal, Eiffel, Haskell, ML, Oberon,
Perl, Python, Scheme, Smalltalk…
© Microsoft Corporation 17
Unmanaged vs. Managed
Unmanaged Code Managed Code
Binary standard Type standard
Type libraries Assemblies
Immutable Resilient bind
Reference counting Garbage collection
Type unsafe Type safe
Interface based Object based
HRESULTs Exceptions
GUIDs Strong names
© Microsoft Corporation 18
University of Tokyo
Windows Kernel Internals
Lectures
• Object Manager • Windows Services
• Virtual Memory • System Bootstrap
• Thread Scheduling • Traps / Ints / Exceptions
• Synchronization • Processes
• I/O Manager • Adv. Virtual Memory
• I/O Security • Cache Manager
• Power Management • User-mode heap
• NT File System • Win32k.sys
• Registry • WoW64
• Lightweight Proc Calls • Common Errors
© Microsoft Corporation 19
University of Tokyo
Windows Kernel Internals
Projects
Device Drivers and Registry Hooking
Dragos Sambotin – Polytech. Inst. of Bucharest
Using LPC to build native client/server apps
Adrian Marinescu – University of Bucharest
Threads and Fibers
Arun Kishan – Stanford University
Doing virtual memory experiments from user-mode
Arun Kishan – Stanford University
© Microsoft Corporation 20
Discussion
© Microsoft Corporation 21