Case study 1
Windows 7
Sources and extra reading
Silberschatz, Galvin, Gagne. Operating System Concepts
Essentials. 8th Edition.
ISBN: 978-0-470-88920-6
A. Tanenbaum. Modern Operating Systems. 3rd Edition.
ISBN: 0136006639
Topics covered in this session
 History of Windows 7
 Windows 7 Design principles
 Threads and Scheduling.
 Process Manager
 Virtual Memory Manager
 Windows 7 file system.
 OS Security features
 Programmer Interface for Windows 7 (Win32 API).
 Windows Registry
 Exercises
History of Windows 7
 Windows 3.0 used the Win16 API which became
increasingly popular.
 XP brought support for 64-bit versions
 Vista released in 2006, not very popular.
 Windows 7 released in 2009
 Windows 8 released in late 2012.
Windows 7 Design Principles
Key Goals:
 Security
 Reliability
 Extensibility
 Portability
 International Support
 Energy Efficiency
 Dynamic device support
Security
 Use of Access Control Lists (ACLs) for permissions to files,
registry settings and kernel objects.
 Address space layout randomization (ASLR).
 Bitlocker (encryption) allows encryption of removable
media.
 Code integrity module to ensure modules in the kernel
have valid signatures.
Extensibility
 An operating systems capacity to keep up with advances
in computing technology.
 Modular structure allows additional environmental
subsystems to be added without affecting the executive
 Portability —Windows 7 can be moved from one
hardware platform to another with relatively few changes
 Written in C and C++
 Platform-dependent code is isolated in a dynamic link library
(DLL) called the “hardware abstraction layer” (HAL)
Compatibility
 Applications that follow the IEEE 1003.1 (POSIX) standard
can be complied to run on Windows without changing
the source code. Applications created for previous
versions of Windows run using various virtual machine
techniques
International Support
 Supports different locales via the national language
support (NLS) API.
 Supports UNICODE.
 Facilities for differences in date formats, currency etc.
Windows 7 Architecture
The Windows Kernel
 Foundation for the executive and the subsystems
 Never paged out of memory; execution is never preempted
 Four main responsibilities:




thread scheduling
interrupt and exception handling
low-level processor synchronization
recovery after a power failure
 Kernel is object-oriented, uses two sets of objects
 dispatcher objects control dispatching and synchronization (events,
mutexes, semaphores, threads and timers)
 control objects (asynchronous procedure calls, interrupts, power notify,
process and profile objects)
The Executive - Threads and Scheduling
 Each process has one or more thread.
 Each thread has it’s own scheduling state:
 Ready – Thread is waiting to run.
 Standby – highest priority thread which is waiting to run (next to
run).
 Running – currently executing on the processor (Until pre-empted
by a higher priority thread).
 Waiting – Waiting for dispatcher object to be signalled.
 Transition – While it waits for resources necessary for execution.
(e.g waiting for its kernel stack to be swapped from disk).
 Terminated – Thread has finished execution.
Threads and scheduling continued
 Real-time threads are given preferential access to the
CPU; but Windows 7 does not guarantee that a real-time
thread will start to execute within any particular time limit.
 This is known as soft real-time.
 The process manager provides services for creating,
deleting and using threads and processes.
The Executive - Object Manager
 Windows Objects == logical view of resources
 Windows 7 uses objects for all its services and entities; the
object manager supervises the use of all the objects
 Objects are manipulated by a standard set of methods,
namely create, open, close, delete, query-name,
parse and security.
The Executive — Naming Objects
 The Windows executive allows any object to be given a
name.
 Object names are structured like file path names in UNIX.
 Windows implements a symbolic link object, which is similar to
symbolic links in UNIX that allow multiple nicknames or aliases
to refer to the same object.
 Each object is protected by an access control list.
 The executive name space is extensible to allow naming of
files, registry keys, and other objects with their own special
semantics.
The Executive — Virtual Memory Manager
 The design of the VM manager assumes that the
underlying hardware supports virtual to physical
mapping, a paging mechanism, transparent cache
coherence on multiprocessor systems, and virtual
address aliasing.
 The VM manager in Windows uses a page-based
management scheme with a page size of 4 KB for both
x86 and x64.
 A physical page can be in one of six states: valid,
zeroed, free, standby, modified and bad.
Virtual-Memory Layout (32-bit)
Top-level Page Directory Table
0
pagedirectory
entry
0
pagetable entry
0
4K page
page
table
0
Page
Directory
…
1
2
3
pagedirectory
entry 511
pagetable entry
511
pagetable entry
0
4K page
4K page
…
page
table
511
…
pagetable entry
511
4K page
Virtual-to-Physical Address Translation
0
31
T
O
P
PDE
PTE
page offset
Translation for a 32-bit Virtual Address to a Physical Address
 2 bit index into top-level page directory to get page directory
 9 bit index into page directory to get page directory entry for page
table
 9 bit index into page table to get page table entry for physical page
 12 bits for byte offset within physical page
 So we have a 3 level hierarchy for Win32
 For 64 bit, it is a 4 level hierarchy
The Executive — I/O Manager
 The I/O manager is responsible for
 file systems
 cache management
 device and network drivers
 Works with VM Manager to provide memory-mapped
file I/O.
 Interfaces with the Windows cache manager, which
handles caching for the entire I/O system.
 The cache manager memory-maps files into the kernel memory
 Also tries to predict the future reading models
 Flush cache contents for writes: write-back cache, accumulates writes for 4-5 seconds,
then writes them
Windows 7 File System
 Uses NTFS (New Technology File System).
 Max file size (16TB) – Bigger than most readily available
drives.
 4kb clusters default for drives over 2GB.
 NTFS uses logical cluster numbers LCN as disk addresses.
 NTFS makes use of access control lists (ACL).
 Also supports FAT for portability (e.g Flash Drives).
File I/O
The Executive — Security Reference Monitor
 The object-oriented nature of the Windows kernel
enables the use of a uniform mechanism to
perform runtime access validation and audit
checks for every entity in the system.
 Whenever a process opens a handle to an
object, the security reference monitor checks the
process’s security token and the object’s access
control list to see whether the process has the
necessary rights.
The Executive – PnP and Power Managers
 PnP (Plug-and-Play) manager is used to recognize and
adapt to changes in the hardware configuration.
 The power manager controls energy use of by the CPU
and devices.
Windows 7 Architecture (Revisited)
Programmer Interface (Win32)
Five main aspects of Win32 API
 Access to Kernel Objects
 Sharing of objects between processes
 Process management
 Interprocess communication
 Memory Management
Programmer Interface (Win32) Continued
- Job, Process & Thread Management
Programmer Interface (Win32) Continued
- File System API Calls
 Second column gives nearest UNIX equivalent
Programmer Interface (Win32) Continued
- File System API Calls
 Second column gives nearest UNIX equivalent
Windows 7 Registry
 Kernel can make
use of registry, as
well as third party
applications.
 Registry has been
used since
Windows 3.1
 Contains keys
and values.
 Stores information
in hives.