Windows Architecture

NOTE- No warranty is made as to technical accuracy.this article gives an overview of the architecture of the Windows operating system.

windows r divided in 2 categories:

1.windows 9x:The Windows 9x line will terminates with Windows 98

2.windows NT: all of us will be running a successor to Windows NT the first of which is called Windows 2000.

The word WINDOWS in this article refers to one of the 32-bit operating system.

APPLICATIONS:Windows consists of applications which are usefull for us for various tasks.Each such application is a collection of executable programs and support files. For instance, Microsoft Word is a well-known Windows application.

PROCESS: Apllications can work in various instances and each such running instance is called process . As we know we can handle more than one files at a time in ms word. Also certain operations can be done simultaneously which allows user to run multiple copies of the application at the same time. Thus each process, with its own memory space corresponding to its running instance.

more precisely, a process is defines as a running instance of an application, together with a set of resources that are allocated to the running application.

THREAD:A thread is time interval for the operation of processor allocated to object within a process that is allocated by the operating system in order to execute code. Thus threads are the heart of processes which execute program code.Hereby we declare that every process must have at least one thread. The threads allow a process to maintain more than one line of execution that is multiprocessing.

One difference between the operating systems windows 9x and windows NT is that in a multiprocessor environment (i.e. a computer having more than one CPU), Windows NT (but not Windows 9x) can assign different threads to different processors, providing true multiprocessing. In a single-processor environment, the CPU must divide time to each thread that is currently running on the system.

Basic Architecture of WINDOWS:

Figure 9-1 shows an overview of the Windows NT architecture. Let us review some of the items shown in this figure.

MODES OF OPERATING SYSTEM

Operating system can operate in two modes of operations

1.Kernel mode

2.User Mode

A intel microprocessor is having four belonging levels which are also known as rings controlling memory access and access to certain sensitive CPU instructions . Every thread executes at one of these belonging levels.

Ring 0 is the most privileged level, with complete access to all memory and CPU instructions. Ring 3 is the least privileged level.

It is analogus to a high level language and machine language. as we know low level language is directly understood by CPU without any interfaces so it is more privileged or belonged to CPU. On the other hand high level language provides the user interface.

We also have to maintain compatibility with non-Intel systems. So Windows operating systems is designed to support only two levels of privilege--Ring 0 and Ring 3

KERNEL MODE( ring 0):A process or thread running in Ring 0 is said to be in kernel mode. Low-level operating system code executes in kernel mode

USER MODE :When a process or thread is running in Ring 3, it is said to be in user mode, whereas, in general, user application code runs in user mode.

OPERATION AND BRANCHING OF MODES OF OPERATION :

Branching from user to kernel mode : When making certain API function calls that require a higher privilege level an application thread will switch from user mode to kernel mode as it occurs in case of accessing files or performing graphics-related functions. In fact, some user threads can spend more time in kernel mode than in user mode!

Branching from kernel to user mode : , the user thread is automatically switched back to user mode when the kernel mode code is completed. Thus programmer is not able to write instructions that run in kernel mode. However the programmer can call only system functions that run in kernel mode.

Experiment related to above explanations : If you are running Windows NT, you can see for yourself when a thread is running in user mode and when it is running in kernel mode. To do this go to control panel from start menu, switch to classic view and select administrative tools, start the Performance Monitor from the Administrative Tools . Select Add To Chart from the Edit menu. Then select add(control+I). Add % User Time and % Privileged Time from the Counters list. Then do some graphics-intensive things, such as opening Windows Paint. Figure 2 shows the results on my system at a particular moment.

Always keep in mind that device drivers run always in kernel mode which leads to two implications.

1. An errant device driver, unlike an errant application, can bring down the entire system because it has access to all system code and memory.

2. It is possible for an application programmer to "access" protected resources by writing a fake device driver, although writing device drivers is not an easy task.

Services

The term service is used in a variety of ways in the Windows environment.relevant to our discussion we’ll be following appropriate means

Subroutine or API service:

An API function is subroutine that performs an operating system "service," such as creating a file or drawing some graphics (a rectangle or line or filling colors). E.g. the CreateProcess API function is used to create a new Windows process.

System service

It is an undocumented function that is called from user mode. quite oftenly these functions are called by Win32 API functions to provide low-level services.

Example : For instance, the CreateProcess API function calls the NtCreateProcess system service to actually create the process.

Internal service

A subroutine that can be called only from kernel mode is called internal service routine. These subroutines lie in the lower-level portions of Windows: the Windows NT executive, kernel, or Hardware Abstraction Layer (HAL).

System Processes : these are the special processes supporting the operating system.Following are some system processes run all times on every widows system.All of these processes run in user mode but the system process run in kernel mode.these can be viewed by

Right click on task bar>select task manager>select processes

Some of them are:

The idle process, which contains a single thread that monitors the CPU's idle time

The system process (unfortunate choice of name), which is a special process that runs only in kernel mode. Its threads are called system threads

The Session Manager (SMSS.EXE ).

The Win32 subsystem (CSRSS.EXE ).

The WinLogon process (WINLOGON.EXE ).

Let us look briefly at some of these system processes:

The Session Manager process

It is the 1st process to be created when the operating system boots up. It is represented as “SMSS.EXE ’’.Important initialization functions are performed by it, it creates system environment variables, defines MS-DOS devices names such as LPT1 and COM1, loads the kernel mode portion of the Win32 subsystem , and starts the logon process WinLogon.

The WinLogon process

User logons and logoffs are handled by this service . This process handles the special Windows key combination Ctrl-Alt-Delete. WinLogon process is one who is responsible for starting the Windows shell (which is usually Windows Explorer).

preet's world

HAPPY NEW YEAR

Monday, December 31, 2007

HOW TO ACHIEVE FASTER STARTUP:

windows architechture