MODERN OPERATING SYSTEMS

Third Edition

ANDREW S. TANENBAUM

Case Study 2: Windows Vista

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 History of Vista

Figure 11-1. Major releases in the history of Microsoft operating

systems for desktop PCs.
Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 2000s: NT-based Windows (1)

Figure 11-2. DEC Operating Systems developed by Dave Cutler.

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 2000s: NT-based Windows (2)

Figure 11-3. The Win32 API allows programs to run

on almost all versions of Windows.
Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 2000s: NT-based Windows (3)

Figure 11-4. Split client and server releases of Windows.

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Windows Vista

Figure 11-5. Comparison of lines of code for selected

kernel-mode modules in Linux and Windows (from Mark
Russinovich, co-author of Microsoft Windows Internals).
Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Programming Windows Vista

Figure 11-6. The programming layers in Windows.

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Programming Windows Vista (2)

Figure 11-7. The components used to build NT subsystems.

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 The Native NT Application
Programming Interface (1)

Figure 11-8. Common categories of kernel-mode object types.

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 The Native NT Application
Programming Interface (2)

Figure 11-9. Examples of native NT API calls that use handles to

manipulate objects across process boundaries.
Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 The Win32 Application
Programming Interface

Figure 11-10. Examples of Win32 API calls and the

native NT API calls that they wrap.
Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 The Windows Registry (1)

Figure 11-11. The registry hives in Windows Vista. HKLM is a

short-hand for HKEY_LOCAL_MACHINE.
Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 The Windows Registry (2)

Figure 11-12. Some of the Win32 API calls for using the registry

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Operating System Structure

Figure 11-13. Windows kernel-mode organization.

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 The Kernel Layer

Figure 11-14. Some of the hardware functions the HAL manages.

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Dispatcher Objects

Figure 11-15. dispatcher_header data structure embedded in

many executive objects (dispatcher objects).
Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 The Device Drivers

Figure 11-16. Simplified depiction of device stacks for two NTFS

file volumes. I/O request packet passed from down the stack.
Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
Implementation of the Object Manager

Figure 11-17. The structure of an executive object

managed by the object manager.
Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Handles (1)

Figure 11-18. Handle table data structures for a minimal

table using a single page for up to 512 handles.

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Handles (2)

Figure 11-19. Handle table data structures for a

maximal table of up to 16 million handles.
Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 The Object Name Space (1)

Figure 11-20. The object procedures supplied

when specifying a new object type.
Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 The Object Name Space (2)

Figure 11-21. Some typical directories in the object name space.

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 The Object Name Space (3)

Figure 11-22. I/O and object manager steps for

creating/opening a file and getting back a file handle.
Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 The Object Name Space (4)

Figure 11-23. Some common executive object types

managed by object manager.
Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
Processes and Threads in Windows Vista (1)

Figure 11-24. The relationship between jobs, processes, threads

and fibers. Jobs and fibers are optional; not all processes are
in jobs or contain fibers.
Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
Processes and Threads in Windows Vista (2)

Figure 11-25. Basic concepts used for CPU

and resource management.
Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Job, Process, Thread, and Fiber
Management API Calls (1)
• Actual search path for finding program to execute buried in
library code for Win32, but managed more explicitly in UNIX.

• Current working directory is kernel-mode concept in UNIX but

user-mode string in Windows.

• UNIX parses command line and passes an array of

parameters, Win32 leaves argument parsing up to individual
program.

• Whether file descriptors can be inherited in UNIX is property of

handle. In Windows it is property of both handle and parameter
to process creation.

• Win32 is GUI-oriented, new processes directly passed

information about their primary window
Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Job, Process, Thread, and Fiber
Management API Calls (2)

• Windows has no SETUID bit as property of

executable, one process can create a process
that runs as a different user, as long as it can
obtain a token with that user’s credentials.
• Process and thread handle returned from
Windows can be used to modify the new
process/thread in many substantive ways.
UNIX just makes modifications to new process
between fork and exec calls.

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Synchronization

Figure 11-26. Some of the Win32 calls for

managing processes, threads, and fibers.
Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Scheduling (1)

The following conditions cause the currently

running thread to execute the scheduler code:

• The currently running thread blocks on a semaphore,

mutex, event, I/O, etc.
• The thread signals an object (e.g., does an up on a
semaphore or causes an event to be signaled).
• The quantum expires.

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Scheduling (2)

The scheduler is also called under two other

conditions:

• An I/O operation completes.

• A timed wait expires.

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Scheduling (3)

Figure 11-27. Mapping of Win32 priorities to Windows priorities.

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Scheduling (4)

Figure 11-28. Windows Vista supports 32 priorities for threads.

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Scheduling (5)

Figure 11-29. An example of priority inversion.

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Memory Management(1)

Figure 11-30. Virtual address space layout for three user

processes on the x86. The white areas are private per
process. The shaded areas are shared among all processes.
Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Memory Management (2)

Figure 11-30. Virtual address space layout for three user

processes on the x86. The white areas are private per
process. The shaded areas are shared among all
processes.
Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Memory Management (3)

Figure 11-30. Virtual address space layout for three user

processes on the x86. The white areas are private per
process. The shaded areas are shared among all processes.

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
Addressing Large Physical Memories

Figure 11-31. The principal Win32 API functions

for managing virtual memory in Windows.
Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Implementation of Memory Management

Figure 11-32. Mapped regions with their shadow pages on disk.

The lib.dll file mapped into two address spaces at same time.
Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Page Fault Handling (1)

Figure 11-33. A page table entry (PTE) for a mapped page on the
(a) Intel x86 and (b) AMD x64 architectures.
Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Page Fault Handling (2)

Each page fault can be considered as being in one

of five categories:

• The page referenced is not committed.

• Attempted access to a page in violation of the
permissions.
• A shared copy-on-write page was about to be
modified.
• The stack needs to grow.
• The page referenced is committed but not currently
mapped in.

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Page Fault Handling (3)

Figure 11-34. Windows self-map entry used to map the physical

pages of page tables and page directory into kernel virtual
addresses, for the x86.
Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 The Page Replacement Algorithm

• Three levels of activity by the working-set

manager

• Periodic based on a timer

New activity is added at each level:

• Lots of memory available
• Memory getting tight
• Memory is tight

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
Physical Memory Management (1)

Figure 11-35. Some of the major fields in the

page frame database for a valid page.
Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
Physical Memory Management (2)

Figure 11-36. The various page lists and the

transitions between them.
Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Input/Output API Calls

Figure 11-37. Native NT API calls for performing I/O.

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Device Drivers

Figure 11-38. A single level in a device stack.

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 I/O Request Packets

Figure 11-39. The major fields of an I/O Request Packet.

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Device Stacks

Figure 11-40. Windows allows drivers to be stacked to work

with a specific instance of a device. The stacking is
represented by device objects.
Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 File System Structure (1)

Figure 11-41. The NTFS master file table.

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 File System Structure (2)

Figure 11-42. The attributes used in MFT records.

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Storage Allocation (1)

Figure 11-43. An MFT record for a three-run, nine-block stream.

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Storage Allocation (2)

Figure 11-44. A file that requires three MFT

records to store all its runs.
Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Storage Allocation (3)

Figure 11-45. The MFT record for a small directory.

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 File Compression

Figure 11-46. (a) An example of a 48-block file being

compressed to 32 blocks. (b) The MFT
record for the file after compression.
Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Security in Windows Vista (1)

Security properties inherited from the original

security design of NT:

• Secure login with anti-spoofing measures.

• Discretionary access controls.
• Privileged access controls.
• Address space protection per process.
• New pages must be zeroed before being mapped in.
• Security auditing.

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Security in Windows Vista (2)

Figure 11-47. Structure of an access token.

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Security in Windows Vista (3)

Figure 11-48. An example security descriptor for a file.

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639
 Security API Calls

Figure 11-49. The principal Win32 API functions for security.

Tanenbaum, Modern Operating Systems 3 e, (c) 2008 Prentice-Hall, Inc. All rights reserved. 0-13-6006639