Understanding Windows XP System Components and Architecture

1. Windows XP In a nut shell

2. Outline • Goals • A little history • System components • Threads & CPU scheduling • Virtual memory • Environmental subsystems • File System: NTFS

3. Windows XP Goals • Preemptive multitasking • Goals: • Security, reliability, ease-of-use, Windows & POSIX application compatibility, high-performance, extensibility, portability, international language support • Commercial • “the layered architecture of the system … makes it so easy to use”

4. A little history • Windows NT • Adopted Windows 95 user interface and incorporated web-server & web-browser • User-interface routines and all graphics code were moved into the kernel to improve performance • Side effect: Decrease in system reliability

5. A little history (cont’) • Windows XP (Oct 2001) • Successor to Windows NT/2000, replacement for Windows 95/98 • Reliability requirement for Windows XP more stringent than Windows 2000 (which was the most reliable, stable system released by Microsoft) • “extensive manual and automatic code review to identify over 63,000 lines in the source [code] that might contain issues not detected by testing” and then set about a review & correction process

6. System Components

7. System Components - 2 • Microkernel: Executes in protected mode • HAL: Hardware abstraction layer • Some hardware independence • HAL provides memory mapping, configuring I/O buses, setting up DMA, motherboard specific facilities • Device drivers (I/O manager) can still work directly with hardware • Kernel • thread scheduling, interrupt & exception handling, CPU synchronization, power failure recovery • Never paged out, never preempted • User mode processes • Environmental subsystems • User mode operating systems (e.g., MS-DOS, OS/2, Win32, POSIX) • Logon systems • User applications

8. Processes & Threads • Processes • Virtual memory address space • Base priority • “affinity” (assignment) to one or more processors • One or more threads • Threads • Units of execution; dispatched by kernel • States: ready, standby, running, waiting, transition, terminated

9. CPU Scheduling - 1 • Priority-based, preemptive scheduling • 32 priority levels; each has a queue of threads • Variable class: 0-15 • Real-time: 16-31 • Higher numbers indicate higher priority • Scheduler traverses from highest to lowest priority queues • Round robin, combined with priority scheme

10. CPU Scheduling - 2 • Variation on standard round-robin CPU scheduling • When thread’s time quantum runs out • Variable class: priority lowered • unless already base priority • Returned to relevant priority level in queue, in ready state • Why lower the thread priority? Are there conditions under which a variable class thread will not have its priority lowered?

11. CPU Scheduling - 3 • When variable priority thread released from wait state • Dispatcher boosts priority, depending on type of wait • High boost: • Waiting for keyboard I/O • Thread associated with user’s active GUI window • Low boost: waiting for disk I/O

12. Virtual Memory • 32-bit processors • 4K page size • 12 bit page offset • 4GB virtual address space • Upper 1-2 GB of all processes, used by operating system in kernel mode • 64 bit processors • 8K page size • 13 bit page offset • 8 TB virtual address space

13. Virtual Memory (cont’) • Demand paging with clustering • Bring in neighboring pages on a page fault: “Prefetching” • Max/min working set size per process • Processes have initial working set size of 50 frames • If a process is at its working set maximum and a page fault occurs • Local page replacement • When number of free frames drops below a certain value • Automatic working-set trimming • memory manager removes pages from processes until processes at working set minimum • FIFO or variation of clock algorithm depending on hardware (p. 363)

14. Page tables: 32 bit Processor (without PAE) • 2-level page tables • Each process has a page directory (outer page table) • 1024 page-directory entries (PDE’s) • Size 4 bytes for each PDE • Each PDE points to a page table • Page table (inner page table) • 1024 page-table entries (PTE’s) • Size 4 bytes for each PTE • Each PTE points to a 4 KB frame of physical memory • Page tables are swapped out to disk when necessary • Total size of all page tables, per process: 4 MB Logical Address structure

15. Page tables

16. Page tables: Page Table Entries (PTE’s) • 20 bits for frame number • 12 bits remain to describe state of page • Accessed or written • Caching attributes • Access mode • Global • PTE valid

17. Windows XP Environmental Subsystems • Some implement user-level operating systems • Some implement services crucial to all user-level operating systems • E.g., GUI, security management • Win32 • Executes in unprotected mode • Provides all keyboard, mouse, graphical display • Other environmental subsystems use this • Separate processes with own input queues • Window manager dispatches input to input queue of appropriate process

18. MS-DOS Environment (VDM) • A user-level operating system • Executes in unprotected mode • Instruction execution unit: Emulates Intel 486 instructions • Routines to emulate DOS ROM BIOS & “Int 21” software interrupt services • Virtual device drivers: Screen, keyboard, comm. Ports • Partial support only: No direct h/w access

19. Client/server model - 1 • User-level operating systems considered to be “clients” • Kernel considered to be “server” • Communication between client and server provided by message passing • “Local procedure call” (LPC) facility • like Remote Procedure Calls • Message passing within a single computer • Used to implement system calls

20. Client/server model - 2 • Server (e.g., kernel) • Publishes a globally visible connection port object • Client (e.g., Win32), to obtain services provided by server • Opens a handle to server connection port • Sends connection request • Server creates channel & returns handle to client • Channel: pair of private communication ports • Client-to-server messages • Server-to-client messages • Some specifics dependent on message sizes • Small messages (e.g., up to a few hundred bytes) are copied from sender to receiver • Shared memory is used for larger messages

21. NTFS File System • Goals • data recovery, security, fault tolerance, large file & file system sizes, multiple data streams, UNICODE names, compression • NTFS is a journaling file system • It provides recovery of structure of file system (metadata) should there be a system failure • NTFS volumes can occupy a portion of a disk, an entire disk, or can span disks

22. NTFS: Files • In NTFS a file is not a simple stream of bytes as it is in some operating systems (e.g., Unix) • Rather, files are structured objects comprised of typed attributes • Some types of attributes • Conventional data of a file • Standard attributes: name, creation time, security descriptor • Examples of other uses of these typed attributes • Mac file resource fork on a Windows XP file server • Thumbnail of an image

23. NTFS: Clusters • Cluster: Unit of disk allocation • Allocates sectors on disk in contiguous groups • A number of 512 byte disk sectors (power of two size) • Example • Cluster size is 4096 bytes with disks > 4GB • If the (block) sector size on disk is 512 bytes, this means each cluster is going to be 8 (blocks) sectors

24. “How NTFS Works”, www.microsoft.com

25. Organization of a NTFS File System • MFT (Master file table) • Describes all files; file control block information (analogous to Unix inode information) • Partial copy of MFT • Log file • Temporary record of all metadata updates • Volume file • Name of volume, NTFS version, consistency bit • Attribute-definition table • Types of attributes used in volume & operations on types • Root directory: top-level in hierarchy • Bitmap file: free/used clusters on disk • Boot file: startup code for Windows XP • Bad-cluster file: Bad areas on volume

26. NTFS: MFT • MFT: Master file table • One or more records per file • Each record is 1-4 KB in size • Describes attributes of file • Resident attributes: small sized • data stored in MFT record • Nonresident attributes: larger sized • data stored in contiguous extents on disk • For small files, even the data of the file may be stored in the MFT record • Each file in NTFS volume has an ID-- its file reference • 48 bit file number, 16 bit sequence number • Directories: particular kinds of files; B+ tree rep’n

27. NTFS: Journaling • If a system failure (e.g., power failure) occurs when a file system is being written, can loose meta data (organization info) and/or file data • Metadata loss tends to be more difficult • In NTFS, all file-system data-structure (metadata) updates are performed in log file transactions • Before a data-structure is altered, transaction first writes a log record that contains redo and undo information • After the data structure has been changed, transaction writes a commit record to log to signify that transaction succeeded • After a crash, log file transactions that had not been committed can be undone