CSE 5343/7343 Fall 2006 Case StudiesCopyright Notice © 2000-2005 David A. Solomon and Mark RussinovichRoadmap for Section 2.1.Simplified OS ArchitectureOS ArchitectureKernel-Mode Components: Core OSKernel-Mode Components: DriversBackground System ProcessesPortabilityReentrant and Asynchronous OperationKey Windows System FilesKey System ComponentsMemory Protection Model32-bit x86 Address SpaceKernel-Mode vs User-Mode QuickSlice (qslice.exe)Task Manager: Processes vs Applications TabsWindows ArchitectureMicrokernel OS?ExecutiveKernelHAL - Hardware Abstraction LayerKernel-Mode Device DriversProcesses and ThreadsSystem ThreadsExamples of System ThreadsIdentifying System Threads: Process ExplorerProcess-Based Windows Code: System Startup ProcessesProcess-Based Windows Code: System Startup Processes (cont.)Where are Services Defined?Life of a ServiceProcess Explorer: Service InformationService ProcessesMapping Services to Service ProcessesService Control ToolsServices InfrastructureFurther ReadingWindows Operating System Internals - by David A. Solomon and Mark E. Russinovich with Andreas PolzeWindows Operating System Internals - by David A. Solomon and Mark E. Russinovich with Andreas PolzeCSE 5343/7343CSE 5343/7343Fall 2006Fall 2006Case StudiesCase StudiesWindows XP Windows XP Structure/ProcessesStructure/Processes2Copyright NoticeCopyright Notice© 2000-2005 David A. Solomon and Mark Russinovich© 2000-2005 David A. Solomon and Mark RussinovichThese materials are part of the These materials are part of the Windows Operating Windows Operating System Internals Curriculum Development Kit,System Internals Curriculum Development Kit, developed by David A. Solomon and Mark E. developed by David A. Solomon and Mark E. Russinovich with Andreas PolzeRussinovich with Andreas PolzeMicrosoft has licensed these materials from David Microsoft has licensed these materials from David Solomon Expert Seminars, Inc. for distribution to Solomon Expert Seminars, Inc. for distribution to academic organizations solely for use in academic academic organizations solely for use in academic environments (and not for commercial use)environments (and not for commercial use)3Roadmap for Section 2.1.Roadmap for Section 2.1.Architecture Overview Architecture Overview Program Execution EnvironmentProgram Execution EnvironmentKernel Mode ArchitectureKernel Mode ArchitectureSystem ThreadsSystem ThreadsSystem Processes / ServicesSystem Processes / Services4Simplified OS ArchitectureSimplified OS ArchitectureSystemsupportprocessesServiceprocessesUserapplicationsEnvironmentsubsystemsSubsystem DLLsExecutiveKernel Device driversHardware Abstraction Layer (HAL)Windowingand graphicsUserModeKernelMode5OS ArchitectureOS ArchitectureMultiple personality OS designMultiple personality OS designuser applications don't call the native Windows operating system user applications don't call the native Windows operating system services directlyservices directlySubsystem DLLs is to translate a documented function into the Subsystem DLLs is to translate a documented function into the appropriate internal (and undocumented) Windows system service calls. appropriate internal (and undocumented) Windows system service calls. Environment subsystem processesEnvironment subsystem processesManage client processes in their worldManage client processes in their worldImpose semantics such as process model, securityImpose semantics such as process model, securityOriginally three environment subsystems: Windows, POSIX, and OS/2Originally three environment subsystems: Windows, POSIX, and OS/2Windows 2000 only included Windows and POSIXWindows 2000 only included Windows and POSIXWindows XP only includes WindowsWindows XP only includes WindowsEnhanced POSIX subsystem available with Services for UnixEnhanced POSIX subsystem available with Services for UnixIncluded with Windows Server 2003 R2Included with Windows Server 2003 R26Kernel-Mode Kernel-Mode Components: Core OSComponents: Core OSExecutiveExecutive base operating system services, base operating system services, memory management, process and thread management, memory management, process and thread management, security, I/O, interprocess communication. security, I/O, interprocess communication. KernelKernel low-level operating system functions, low-level operating system functions, thread scheduling, interrupt and exception dispatching, thread scheduling, interrupt and exception dispatching, multiprocessor synchronization.multiprocessor synchronization.provides a set of routines and basic objects that the rest of the provides a set of routines and basic objects that the rest of the executive uses to implement higher-level constructs. executive uses to implement higher-level constructs. Both contained in file Ntoskrnl.exeBoth contained in file Ntoskrnl.exe7Device driversDevice drivers (*.sys) (*.sys)hardware device drivers translate user I/O function calls into hardware device drivers translate user I/O function calls into specific hardware device I/O requests specific hardware device I/O requests virtual devices - system volumes and network protocolsvirtual devices - system volumes and network protocolsWindowing and Graphics DriverWindowing and Graphics Driver (Win32k.sys) (Win32k.sys)graphical user interface (GUI) functions (USER and GDI)graphical user interface (GUI) functions (USER and GDI)windows, user interface controls, and drawingwindows, user interface controls, and drawingHardware Abstraction LayerHardware Abstraction Layer (Hal.dll) (Hal.dll) isolates the kernel, device drivers, and executive from hardwareisolates the kernel, device drivers, and executive from hardwareHides platform-specific hardware differences (motherboards)Hides platform-specific hardware differences (motherboards)Kernel-Mode Kernel-Mode Components: DriversComponents: Drivers8Background System Background System ProcessesProcessesCore system processes,Core system processes, logon process, the session manager, etc.logon process, the session manager, etc.not started by the service control managernot started by the service control managerService processesService processes Host Windows servicesHost Windows servicesi.e.; Task Scheduler and Spooler servicesi.e.; Task Scheduler and Spooler servicesMany Windows server applications, such as Microsoft Many Windows server applications, such as Microsoft SQL Server and Microsoft Exchange Server, also SQL Server and Microsoft Exchange Server, also include components