roma tre university maurizio pizzonia windows 1 © 2011 maurizio pizzonia – operating systems – roma tre university, italy Microsoft Press Server 2008 andWindows Vista 5 Windows® Internals: IncludingWindows M. Russinovich, D.A.Solomon references th ed. 2 © 2011 maurizio pizzonia – operating systems – roma tre university, italy • • • • several “system processes” several support access syscalls never services directly and applications user ismode graphics in kernel word overloaded kernel: – – use “subsystems DLLs” that goes with “environment subsystems” “environment “subsystemsuse thatwith DLLs” goes mode inkernel to runs MS according of it part what a is only architecture overview 3 3 © 2011 maurizio pizzonia – operating systems – roma tre university, italy • • • • needs besides, usesWindows kernel threads for its own that so... tree is only informative, Windows does not rely on if the parent dies the info is not updated in the child processes “usually” form a tree – – the parent is the creator of the process parent information is not reliable windows processes 4 4 © 2011 maurizio pizzonia – operating systems – roma tre university, italy architecture details: user mode 5 © 2011 maurizio pizzonia – operating systems – roma tre university, italy • • • syscalls are never directly performed by by syscalls performed processes are directly never are subsystems really subsystemsare needed? really os/2posix, subystems: windows, – – – – – syscalls are not documented not are syscalls my impression is that subsystems are a “legacy” feature “legacy” a are subsystems isthat impression my process supporting + DLLs are OS from underlying processes user decouple layers decoupling • • • • • relationships with Windows update a“localupdate state” subsystemDLLs maycall supporting Ntdll.dll,just process or interactwith supportingprocess:see “environment subsystem” software ofunix porting “easy” allows e.g. askWindowsto something) way DLLs substystem (preferred Ntdll.dll(documented) user user processes and 6 © 2011 maurizio pizzonia – operating systems – roma tre university, italy • • • • kernel parts environmentsubsystem process: DLLs a particular subsystem – – – – – graphics: win32k.sys graphics: applications) (console almost empty it is now stuffof (graphics) lot a itcontained NT in 3.51 system chrashes) whole (otherwise running always be it should Gdi32.dll User32.dll Advapi32.dll, kernel32.dll, • • • graphic rendering (rendering of text, drawing, etc.) drawing, text, of (rendering rendering graphic etc.) handling, message graphic (mouse, windows, manager window on-demand run others one, only the windows subsystem csrss.exe 7 © 2011 maurizio pizzonia – operating systems – roma tre university, italy • • • • windows subsystemwindows ... service control manager (scm) session manager – – – services.exe, services.exe, svchost.exe winint.exe smss.exe, winlogon.exe, csrss.exe typical system processes 8 © 2011 maurizio pizzonia – operating systems – roma tre university, italy • • • smss is the first process created at boot licensing to have more sessions you need “terminal server” and proper smss also waits for new session requests, and for each session... – – – – – starts new csrss.exe new starts dialog password (thewinlogon.exe startsbox) wininit.exe it starts Autochk (filesystemit starts check) subsystem isnotstarted yet! windows smss process istheonly directlysinceto use syscalls • • • when a logona happensexplorer.exe when starts (indirectly) it allconfiguredstarts and services.exe services which starts csrss.exe which sessions manager andboot – which loads win32k.sys (and the video switches to correct resolution) video the (and loadswhich win32k.sys 9 © 2011 maurizio pizzonia – operating systems – roma tre university, italy • • • • • • services.exe) (scm, manager service control the by managed e.g. names three serviceshave have processes such a it is in charge of starting/stopping/ of isincharge it – – – – – – – – single process can host more services more host can process single EventLog, TaskScheduler, Spooler, etc. etc. Spooler, TaskScheduler, EventLog, configuration the etc. service, aguest start pause, start-up, correct notify e.g. DLLs as implemented are hosted services case this in svchost.exe service: host generic standard the Services → Tool →Admin panel Control by edited registry the in configured is scm executable started by started utilities , the name in the the in name , the wininit.exe specific APIs specific services registry pausing to interact with the control manager control the with interact to , the name shown by the the by shown , name the services 10 © 2011 maurizio pizzonia – operating systems – roma tre university, italy executive architecture details kernel mode 11 11 © 2011 maurizio pizzonia – operating systems – roma tre university, italy • • • hal executive kernel – – – – – security, I/O, communication,etc. security, inter-process networking, management, real process/thread management, memory objects executive I/Ono handling interrupt synchronization, scheduler, processes and threads basic differences motherboards handle architecture details kernel mode 12 12 © 2011 maurizio pizzonia – operating systems – roma tre university, italy • • • • • resources, objects, andhandles mostAPI parameters are handles objectmanager handles in userspace, executiveobjects are represented by anexecutive object is storedin kernel space object any – – – – keep a a keep executive of part handles them through use processes etc. session, a process, a file, open an e.g. • resources it contains handle that the process processhandle table is view bya process isview as an foreach process can use executive 13 © 2011 maurizio pizzonia – operating systems – roma tre university, italy Symbolic link Symbolic WindowStation Clipboard Desktop Key Timer Semaphore/Mutex Event token Access object mapping File File Job Thread Process type executive objects types executive The access rights for aprocess mappedA to region afile. of memory Anopen file or an I/O device. A collectionof processes. Anentity containing code in execution, inside aprocess. A collectionof executable threads along with virtualaddressing and control information. A reference to other objects, via which the referred object canbeused. Anobject containing a group of Desktop objects, one Clipboard and other user objects. repositoryA temporary forother objects. A logical display surface to contain GUI elements. A registry key. Anobjects which notifies processes at fixed intervals. Objects which serialize access to other resources. Anobject which encapsulates informationto be notified to aprocesses of something. Description 14 14 © 2011 maurizio pizzonia – operating systems – roma tre university, italy • • • • objects canbe shared among processes there system exists ofdirectory some are named some are “anonymous” – – – not persistent string is a pathname identifieda string by • it exists only in memory in only it exists object sharing 15 © 2011 maurizio pizzonia – operating systems – roma tre university, italy • • • • • • • kernelspace/user space processaddress space contains shared kernelspace copy-on-write kernelspacetwo heaps processheap managed kernelin mode mappedmemory files and disk cache virtual – – – – – posix envirnoment uses it for implementing fork fork operations it for implementing uses envirnoment posix paged is one paged not is one 6TB/8TB systems: 64bit 2GB/2GB (config. 1GB/3GB) systems: 32bit • memory windows keepwindows a lot of data, it needs paging also in kernel space memory management 16 © 2011 maurizio pizzonia – operating systems – roma tre university, italy • • • • disk cache (page file)swap page bufferingpages)terminology: stand by (MS balance set manager – – – – – – – – cachepart usingfilesof mappingmemory onekernel thread changeto sizeits onekernel thread forzeroing the pages kernel two threadfor cleaning pagesthe alsopart kernelof space can be evicted kernel thread,runonce per second evictionstrategy:aging decideresident set forprocesses • • new empty pages are always given a zeroed frame frame zeroed a given always are pages empty new set working terminology: MS memory management components 17 © 2011 maurizio pizzonia – operating systems – roma tre university, italy page framespage states • solomon fromrussinovich, 18 © 2011 maurizio pizzonia – operating systems – roma tre university, italy • • • caches part of files set size of cache changes along with system resident two kinds of blocks – – – balance manager can change it dynamically it change can manager balance files mapped memory read/write regular • • • mapped on process address space address process mapped on the filesystem and processes between middleact as a layer system mapped on space address disk cache 19 © 2011 maurizio pizzonia – operating systems – roma tre university, italy • • • • at user level: 5 priority levels priority) (base priority 5 levels at user level: preemption has its queue level each level priority 32 internally: – – – – – within a range of 5 internal priority levels priority of internal 5 range a within assigned dynamically priority internal an of each them have normal, idle normal, below above high, thread) 0: systempage zeroing (the dynamic 15-1: time”“real 31-16: cpu scheduling 20 © 2011 maurizio pizzonia – operating systems – roma tre university, italy priority levels 21 © 2011 maurizio pizzonia – operating systems – roma tre university, italy • • windows increaseswindows internal process beingscheduled aftera long time in ready state without forpriority afterwaiting – –