Windows Kernel Architecture
Kernel Mode
Fundamental part of a modern computer's Os.
Software which allow users to share computer
resources.
Directly controls the computer hardware.
Definition
kernel is a computer program that
manages input/output requests from software and
translates them into data processing instructions for
the central processing unit and other electronic
components of a computer.
Windows Kernel Architecture
Kernel Mode Components
HAL(Hardware Abstraction Layer)
Executive
Graphic Device Driver(Implements the graphical
user interface (GUI).
Hardware Abstraction Layer
Refers to a layer of software that deals directly with
your computer hardware.
It operates in between the hardware and the
Windows executive services.
Kernel Mode Executive
Object Manager
Process Manager
Security Reference Monitor
I/O Manager
Plug & Play Manager
Virtual Memory Manager
Local Procedure Call Facility
Object Manager
The Windows kernel-mode object manager
component manages objects. Files, devices,
synchronization mechanisms, registry keys, and so
on, are all represented as objects in kernel mode.
Each object has a header (containing information
about the object such as its name, type, and
location), and a body (containing data in a format
determined by each type of object).
Windows has more than 25 types of objects
Object Manager
Process Manager
A process is a program in execution
A process has resources (CPU time, files)
Management of processes includes:
Process control block(PCB)
Process Scheduling (priority, time management )
Creation/termination
Block/Unblock
Synchronization
Communication(IPC)
Deadlock handling
Process Control Block
It contains:
An ID number
Pointers
Register contents
States of various flags
Pointers to the upper and lower bounds of the memory
required for the process
A list of files opened by the process
The priority of the process
The status of all I/O devices needed by the process
Process Control Block
Process Control Block
Process Manager
I/O Manager
Framework through which I/O devices are accessible
to applications.
Manages the communication between applications
and the interfaces provided by device drivers.
Communication between the operating system and
device drivers is done through I/O request packets
(IRPs).
I/O Manager
Computer uses an I/O system bus
Each I/O device has controller attached to I/O
system bus
Security Reference Monitor
A kernel-mode component that performs access checks,
generates audit log entries, and manipulates user rights
(privileges)
All system calls go through reference monitor for
security checking.
System call is how a program requests a service
from an operating system's kernel
Plug & Play Manager
Determines which drivers are required to support a
particular device and loads those drivers
PnP requires support from device hardware, system
software, and drivers.
PnP requires:
1. Pnp Bios
2. Extended System Configuration Data (ESCD)
Local Procedure Call
High speed message based communication
mechanism between two user mode processes,
between a user mode process and a kernel mode
driver or between two kernel mode drivers
Provide Inter-process communication(IRP).
Enforces synchronous communication model
between the client and the server processes.
Virtual Memory Management
