Operating systems history

2. Operating systems history • Windows 3.11 • Windows 9x • Windows NT • Windows 2000 • Windows 2003

3. Windows 2000 Key requirements • 32 Bit OS • Demand Paged virtual memory • Multiple hardware architectures • Multiprocessor systems • Networking • Reliability and robustness • POSIX • Security

4. Fundamental concepts What is a Process? An instance of a running program

5. Fundamental concepts What is a Thread ? An unit of execution

6. Fundamental concepts Threads Share the process address space

7. Fundamental concepts Why have multiple threads ? Perceived user responsiveness

8. Fundamental concepts • 4GB Address space • 2GB process space • 2GB system space

10. Kernel mode (ring 0) • The privileged mode of operation in which code has direct access to all hardware and all memory addresses. • Can access hardware directly. • Can access all of the memory on the computer. • Cannot be moved to the virtual memory page file on the hard disk. • Is processed at a higher priority than user mode processes.

11. User Mode (ring 3) • A less privileged processor mode than kernel mode and has no direct access to hardware. • Code running in user mode can run only in its own address space. • It uses the Windows APIs to request system services. • User mode processes have no direct access to hardware.

12. Fundamental concepts • No process can corrupt other process memory • No process can corrupt system memory • Threads change from user to kernel mode on system calls

13. Architecture overview

14. Architecture overview מיפוי או תרגום של הפונקציות המתועדות (חשופות) של מערכת ההפעלה לפונקציות הפנימיות של מערכת ההפעלה (windows nt create file function > ntcreatefile)

15. Architecture overview Process & thread services I/O subsystem Inter process communication Undocumented – accessed through subsystem DLLS

16. Architecture overview Lowest level component of core OS Provides thread scheduling, interrupt dispatching, exception dispatching. Both executive and kernel are contained In NTOSKERNEL.EXE

17. Architecture overview Access to hardware devices. Translate user i/o functions to hardware specific i/o requests. Virtual device drivers – file system, network protocol.

18. Architecture overview Window management and graphic operations Win32k.sys Drawing, ui controls Prior nt4 was at user mode

19. Architecture overview Hardware abstraction layer Built for different hardware platforms. “Device driver for the motherboard”

20. Architecture overview Always on processes Idle process – fake process to account for idle cpu cycles System process – home for kernel mode system threads Smss.exe – session manager subsystem Csrss.exe – win32 subsystem Winlogon.exe – logon process Services.exe – service control manager Lsass.exe – local security authentication

21. Architecture overview • System process – home for kernel mode system threads • pieces of OS or driver code that run as independent threads • memory manager, swapper, file server driver • Created at boot time

22. Architecture overview Task scheduler Spooler Web server…

23. Architecture overview • All kernel components share a common address space. • Other 32 Bit OS have a similar design • Most OS and drivers are written in a portable language (C) • Kernel components use formal interfaces to interact with each other.

24. Symmetric multiprocessing • Everything is the same – no master/slave • Processors Share one memory space • A processor can reschedule what the other is doing

25. Environment subsystems • Subsystems DLLs • Translate documented system calls to internal undocumented NT system calls • Expose operating system calls • Posix, os/2 win32 • Ntdll.dll – interface to native system calls • Win32 is the primary subsystem • NT native API mapping of win32 www.sysinternals.com

26. Kernel mode components Contained in ntoskernel.exe Six variants of ntoskernel.exe

27. Kernel mode components • Key EXECUTIVE subsys components: • Process &threads manager • Memory manager • Security manager • i/o manager • Plug and play manager • Power manager • Cache manager • Accessed through subsystem DLLs

28. Kernel mode components • Key kernel subsys components: • Cpu abstraction • Context switching • Exception and interrupt dispatch

29. Management mechanisms • Registry • Win32 services • WMI

30. Management mechanisms • Registry • Windows Configuration database • Control drivers loading, process startup • System wide application settings • Per user settings • A window into in-memory system state • Remotely accessible

31. Management mechanisms • Registry • Read at: • Boot time • Logon time • Application startup • Changed at: • When you install software • System setting change • Regedt32, regedit

32. Management mechanisms • Registry • Read at: • Boot time • Logon time • Application startup • Changed at: • When you install software • System setting change

33. Management mechanisms • Win32 services • A service is • A process crested by the service control manager • Starts independent of user logon • Configured to start at boot time • No user interface

34. Management mechanisms Windows Management Instrumentation Works locally and remotely Bi-directional Extensible Natively scriptable

35. Processes and threads • Components of process • Private address space • Executable image • DLLs • Private storage • Working set – subset of virtual image • Access token • Table of open objects

36. Processes and threads • Components of thread • Execution context- (hardware state) • Two stacks – (user and kernel) • Scheduling state • Current and base priority • Current access mode • Thread access token

37. Processes and threads • Job object • Apply quotas and restriction to a group of processes. • Also useful to control a single process

38. Processes and threads • Controls of jobs • Total CPU time • Total active processes • Maximum priority for job • Which processors to run on • Security restrictions • Scheduling class

39. Processes exit and crashes • When does a process exit? • Call to exit process() • Last thread exits • Task manager demo

40. Processes and threads • Threads run, not processes • Most tools report current, not base priority

41. Processes and threads • Thread scheduling • No attempt to share processor(s) among processes • No guarantied execution period before preemption. • If higher than running thread, runs right away • If same or lower, waits its turn to run • Threads at the same priority each get a turn.

42. Processes and threads • Quantum – length of time a thread runs before another thread at the same priority gets a turn. • Length of quantum on server • 12 clock intervals • 120 ms if clock runs on 10 ms

43. Memory management • Memory manager features • Demand paged virtual memory • Supports up to 64 GB physical memory • Provides 4GB flat virtual address space • 3 states – commited, free, reserved • Shared memory • Mapped files • File mapping objects (in win32 API) • Bytes in file mapped to virtual address space

44. Memory management • Process address space (useraccessible) • Contains executable image (EXE) and dynamically linked libraries (DLLs) • Private storage • System address space (kernel mode) • Operating system image (NTOSKERNEL.exe) • HAL • Driver files • Kernel mode stacks • File system cache

45. Memory management • Virtual memory concepts • Applications reference “virtual address” • Page tables – hardware and software translators to physical address • Unit of protection and usage • Called page • X86 uses 4096 byte pages

46. Memory management • Methods for processes to share memory • Local procedure calls • Threads share address space • Process share memory sections • Called file mapping objects • Full NT security • Windows automatically shares sharable pages – code pages in .EXE • All win32 programs use common set of libraries (DLLs)

47. Memory management • Copy-on-write pages • Pages are originally set up as shared read only • Gives process a private copy upon write request • Saves physical memory, eliminates unnecessary copies.

49. How windows executes code The Windows operating system uses two modes to maintain operating system efficiency and integrity: user mode and kernel mode. The architecture of 80386 and higher processors defines four privilege levels, called rings, to protect system code and data from being overwritten inadvertently or maliciously by less privileged code. This is called the Intel Protection model.

50. How windows executes code Kernel mode (ring 0) is the privileged mode of operation in which code has direct access to all hardware and all memory addresses. Software that runs in kernel mode has the following attributes: It can access hardware directly. It can access all of the memory on the computer. It cannot be moved to the virtual memory page file on the hard disk. It is processed at a higher priority than user mode processes. User mode (ring 3) is a less privileged processor mode than kernel mode and has no direct access to hardware. Code running in user mode can run only in its own address space. It uses the Windows APIs to request system services. User mode processes: Have no direct access to hardware.