Operating systems historyOperating systems history•Windows 3.11Windows 3.11

•Windows 9xWindows 9x

•Windows NTWindows NT

•Windows 2000Windows 2000

•Windows 2003Windows 2003

Windows 2000 Key requirementsWindows 2000 Key requirements

•32 Bit OS32 Bit OS

•Demand Paged virtual memoryDemand Paged virtual memory

•Multiple hardware architecturesMultiple hardware architectures

•Multiprocessor systemsMultiprocessor systems

•NetworkingNetworking

•Reliability and robustnessReliability and robustness

•POSIXPOSIX

•SecuritySecurity

What is a Process?What is a Process?An instance of a running programAn instance of a running program

Fundamental conceptsFundamental concepts

What is a Thread ?What is a Thread ?An unit of executionAn unit of execution

Fundamental conceptsFundamental concepts

ThreadsThreadsShare the process address spaceShare the process address space

Fundamental conceptsFundamental concepts

Why have multiple threads ?Why have multiple threads ?Perceived user responsivenessPerceived user responsiveness

Fundamental conceptsFundamental concepts

4GB Address space4GB Address space•2GB process space2GB process space

•2GB system space2GB system space

Fundamental conceptsFundamental concepts

The privileged mode of operation in which The privileged mode of operation in which code has direct access to all hardware and code has direct access to all hardware and all memory addresses.all memory addresses.•Can access hardware directly. Can access hardware directly. •Can access all of the memory on the Can access all of the memory on the computer. computer. •Cannot be moved to the virtual memory Cannot be moved to the virtual memory page file on the hard disk. page file on the hard disk. •Is processed at a higher priority than user Is processed at a higher priority than user mode processes. mode processes.

Kernel mode (ring 0)Kernel mode (ring 0)

A less privileged processor mode than A less privileged processor mode than kernel mode and has no direct access kernel mode and has no direct access to hardware. to hardware.

•Code running in user mode can run Code running in user mode can run only in its own address space. only in its own address space. •It uses the Windows APIs to request It uses the Windows APIs to request system services. system services. •User mode processes have no direct User mode processes have no direct access to hardware. access to hardware.

User Mode (ring 3)User Mode (ring 3)

•No process can corrupt other process No process can corrupt other process memorymemory

•No process can corrupt system memoryNo process can corrupt system memory

•Threads change from user to kernel mode Threads change from user to kernel mode on system callson system calls

Fundamental conceptsFundamental concepts

Architecture overviewArchitecture overview

Architecture overviewArchitecture overview

מיפוי או תרגום של הפונקציות המתועדות מיפוי או תרגום של הפונקציות המתועדות (חשופות) של מערכת ההפעלה לפונקציות (חשופות) של מערכת ההפעלה לפונקציות

הפנימיות של מערכת ההפעלההפנימיות של מערכת ההפעלה) windows nt create file function > ntcreatefile(

Architecture overviewArchitecture overviewProcess & thread servicesProcess & thread servicesI/O subsystemI/O subsystemInter process communicationInter process communicationUndocumented – accessed through subsystem Undocumented – accessed through subsystem DLLSDLLS

Architecture overviewArchitecture overviewLowest level component of core OSLowest level component of core OSProvides thread scheduling, interrupt Provides thread scheduling, interrupt dispatching, exception dispatching.dispatching, exception dispatching.Both executive and kernel are contained In Both executive and kernel are contained In NTOSKERNEL.EXENTOSKERNEL.EXE

Architecture overviewArchitecture overviewAccess to hardware devices.Access to hardware devices.Translate user i/o functions to hardware Translate user i/o functions to hardware specific i/o requests.specific i/o requests.Virtual device drivers – file system, network Virtual device drivers – file system, network protocol.protocol.

Architecture overviewArchitecture overviewWindow management and graphic Window management and graphic operationsoperationsWin32k.sysWin32k.sysDrawing, ui controlsDrawing, ui controlsPrior nt4 was at user modePrior nt4 was at user mode

Architecture overviewArchitecture overviewHardware abstraction layerHardware abstraction layerBuilt for different hardware platforms.Built for different hardware platforms.““Device driver for the motherboard”Device driver for the motherboard”

Architecture overviewArchitecture overviewAlways on processes Always on processes Idle process – fake process to account for idle cpu cyclesIdle process – fake process to account for idle cpu cyclesSystem process – home for kernel mode system threadsSystem process – home for kernel mode system threadsSmss.exe – session manager subsystemSmss.exe – session manager subsystem

Csrss.exe – win32 subsystemCsrss.exe – win32 subsystemWinlogon.exe – logon processWinlogon.exe – logon process

Services.exe – service control managerServices.exe – service control managerLsass.exe – local security authenticationLsass.exe – local security authentication

Architecture overviewArchitecture overviewSystem process – home for kernel mode system threadsSystem process – home for kernel mode system threads

• pieces of OS or driver code that run as pieces of OS or driver code that run as independent threadsindependent threads

• memory manager, swapper, file server drivermemory manager, swapper, file server driver• Created at boot timeCreated at boot time

Architecture overviewArchitecture overviewTask schedulerTask schedulerSpoolerSpoolerWeb server…Web server…

•All kernel components share a common All kernel components share a common address space.address space.

•Other 32 Bit OS have a similar designOther 32 Bit OS have a similar design

•Most OS and drivers are written in a Most OS and drivers are written in a portable language (C)portable language (C)

•Kernel components use formal interfaces Kernel components use formal interfaces to interact with each other.to interact with each other.

Architecture overviewArchitecture overview

•Everything is the same – no master/slaveEverything is the same – no master/slave

•Processors Share one memory spaceProcessors Share one memory space

•A processor can reschedule what the other A processor can reschedule what the other is doingis doing

Symmetric multiprocessingSymmetric multiprocessing

Environment subsystemsEnvironment subsystems

Subsystems DLLsSubsystems DLLs•Translate documented system calls to Translate documented system calls to internal undocumented NT system callsinternal undocumented NT system calls

•Expose operating system callsExpose operating system calls

•Posix, os/2 win32Posix, os/2 win32

•Ntdll.dll – interface to native system callsNtdll.dll – interface to native system calls

•Win32 is the primary subsystemWin32 is the primary subsystemNT native API mapping of win32 www.sysinternals.com

Kernel mode componentsKernel mode components

Contained in ntoskernel.exeContained in ntoskernel.exe

Six variants of ntoskernel.exeSix variants of ntoskernel.exe

Kernel mode componentsKernel mode components

Key EXECUTIVE subsys components:Key EXECUTIVE subsys components:•Process &threads managerProcess &threads manager•Memory managerMemory manager•Security managerSecurity manager•i/o manageri/o manager•Plug and play managerPlug and play manager•Power managerPower manager•Cache managerCache manager

Accessed through subsystem DLLsAccessed through subsystem DLLs

Kernel mode componentsKernel mode components

Key kernel subsys components:Key kernel subsys components:•Cpu abstractionCpu abstraction•Context switchingContext switching•Exception and interrupt dispatchException and interrupt dispatch

Management mechanismsManagement mechanisms

•RegistryRegistry•Win32 servicesWin32 services•WMIWMI

Management mechanismsManagement mechanisms

RegistryRegistry•Windows Configuration databaseWindows Configuration database

•Control drivers loading, process startupControl drivers loading, process startup•System wide application settingsSystem wide application settings•Per user settingsPer user settings

•A window into in-memory system stateA window into in-memory system state•Remotely accessibleRemotely accessible

Management mechanismsManagement mechanisms

RegistryRegistryRead at:Read at:

•Boot timeBoot time•Logon timeLogon time•Application startupApplication startup

Changed at:Changed at:•When you install softwareWhen you install software•System setting changeSystem setting change

Regedt32, regeditRegedt32, regedit

Management mechanismsManagement mechanisms

RegistryRegistryRead at:Read at:

•Boot timeBoot time•Logon timeLogon time•Application startupApplication startup

Changed at:Changed at:•When you install softwareWhen you install software•System setting changeSystem setting change

Management mechanismsManagement mechanisms

Win32 servicesWin32 servicesA service is A service is

•A process crested by the service control A process crested by the service control managermanager•Starts independent of user logonStarts independent of user logon•Configured to start at boot timeConfigured to start at boot time•No user interfaceNo user interface

Management mechanismsManagement mechanisms

WWindows indows MManagement anagement IInstrumentationnstrumentationWorks locally and remotelyWorks locally and remotelyBi-directionalBi-directionalExtensibleExtensibleNatively scriptableNatively scriptable

Processes and threadsProcesses and threads

Components of process Components of process •Private address spacePrivate address space

•Executable imageExecutable image•DLLsDLLs•Private storagePrivate storage

•Working set – subset of virtual imageWorking set – subset of virtual image•Access tokenAccess token•Table of open objectsTable of open objects

Processes and threadsProcesses and threads

Components of thread Components of thread •Execution context- (hardware state)Execution context- (hardware state)•Two stacks – (user and kernel)Two stacks – (user and kernel)•Scheduling stateScheduling state•Current and base priorityCurrent and base priority•Current access modeCurrent access mode•Thread access tokenThread access token

Processes and threadsProcesses and threads

Job objectJob object•Apply quotas and restriction to a group of Apply quotas and restriction to a group of processes. processes. •Also useful to control a single processAlso useful to control a single process

Processes and threadsProcesses and threads

Controls of jobsControls of jobs•Total CPU timeTotal CPU time•Total active processesTotal active processes•Maximum priority for jobMaximum priority for job•Which processors to run onWhich processors to run on•Security restrictionsSecurity restrictions•Scheduling classScheduling class

Processes exit and crashesProcesses exit and crashes

When does a process exit?When does a process exit?•Call to exit process()Call to exit process()•Last thread exitsLast thread exitsTask manager demoTask manager demo

•Threads run, not processesThreads run, not processes•Most tools report current, not base priorityMost tools report current, not base priority

Processes and threadsProcesses and threads

Processes and threadsProcesses and threads

Thread schedulingThread scheduling•No attempt to share processor(s) among No attempt to share processor(s) among processes processes •No guarantied execution period before No guarantied execution period before preemption.preemption.•If higher than running thread, runs right awayIf higher than running thread, runs right away•If same or lower, waits its turn to runIf same or lower, waits its turn to run•Threads at the same priority each get a turn.Threads at the same priority each get a turn.

Processes and threadsProcesses and threads

Quantum – length of time a thread runs Quantum – length of time a thread runs before another thread at the same before another thread at the same priority gets a turn.priority gets a turn.Length of quantum on server Length of quantum on server •12 clock intervals12 clock intervals•120 ms if clock runs on 10 ms120 ms if clock runs on 10 ms

Memory managementMemory management

Memory manager featuresMemory manager features•Demand paged virtual memoryDemand paged virtual memory•Supports up to 64 GB physical memorySupports up to 64 GB physical memory•Provides 4GB flat virtual address spaceProvides 4GB flat virtual address space•3 states – commited, free, reserved3 states – commited, free, reserved•Shared memoryShared memory•Mapped filesMapped files

•File mapping objects (in win32 API)File mapping objects (in win32 API)•Bytes in file mapped to virtual address Bytes in file mapped to virtual address spacespace

Memory managementMemory management

Process address space Process address space (user(user accessible)accessible)•Contains executable image (EXE) and Contains executable image (EXE) and dynamically linked libraries (DLLs)dynamically linked libraries (DLLs)•Private storagePrivate storageSystem address space (kernel mode)System address space (kernel mode)•Operating system image (Operating system image (NTOSKERNEL.exe)NTOSKERNEL.exe)•HALHAL•Driver filesDriver files•Kernel mode stacksKernel mode stacks•File system cacheFile system cache

Memory managementMemory managementVirtual memory conceptsVirtual memory concepts•Applications reference “virtual address”Applications reference “virtual address”•Page tables – hardware and software Page tables – hardware and software translators to physical addresstranslators to physical address•Unit of protection and usageUnit of protection and usage

•Called pageCalled page•X86 uses 4096 byte pagesX86 uses 4096 byte pages

Memory managementMemory managementMethods for processes to share Methods for processes to share memorymemory•Local procedure callsLocal procedure calls•Threads share address spaceThreads share address spaceProcess share memory sectionsProcess share memory sections•Called file mapping objectsCalled file mapping objects•Full NT securityFull NT securityWindows automatically shares Windows automatically shares sharable pages – code pages in .EXEsharable pages – code pages in .EXEAll win32 programs use common set of All win32 programs use common set of libraries (DLLs)libraries (DLLs)

Memory managementMemory managementCopy-on-write pagesCopy-on-write pages•Pages are originally set up as shared read Pages are originally set up as shared read onlyonly•Gives process a private copy upon write Gives process a private copy upon write requestrequest•Saves physical memory, eliminates Saves physical memory, eliminates unnecessary copies.unnecessary copies.

How windows executes codeThe Windows operating system uses two modes to maintain operating system efficiency and integrity: user mode and kernel mode. The architecture of 80386 and higher processors defines four privilege levels, called rings, to protect system code and data from being overwritten inadvertently or maliciously by less privileged code. This is called the Intel Protection model.

How windows executes code

Kernel mode (ring 0) is the privileged mode of operation in which code has direct access to all hardware and all memory addresses. Software that runs in kernel mode has the following attributes: It can access hardware directly. It can access all of the memory on the computer. It cannot be moved to the virtual memory page file on the hard disk. It is processed at a higher priority than user mode processes.

User mode (ring 3) is a less privileged processor mode than kernel mode and has no direct access to hardware. Code running in user mode can run only in its own address space. It uses the Windows APIs to request system services. User mode processes: Have no direct access to hardware.

multitasking

• Multitasking is the ability of an operating system to run more than one program, or task, at the same time. Multitasking contrasts with single tasking, where one process must be completed before another can begin. MS-DOS is a single-tasking environment, while Windows 95 and Windows NT are both multitasking environments.

Memory Management