Dave Probert is a kernel architect at Microsoft who has over 13 years of experience working on Windows kernels. He helped design key aspects of Windows such as multi-core support and user-mode scheduling. Probert provided an overview of how the Windows kernel architecture has evolved over time from Windows NT to recent versions, focusing on changes made to improve scalability, security and energy efficiency. He also discussed Microsoft's Windows Academic Program which provides universities access to Windows kernel source code and curriculum materials.

1. Dave Probert, Ph.D. - Windows Kernel Architect Microsoft Windows Division Copyright Microsoft Corporation

3. UNIX vs NT Design Environments Copyright Microsoft Corporation Environment which influenced fundamental design decisions UNIX [1969] Windows (NT) [1989] 16-bit program address space Kbytes of physical memory Swapping system with memory mapping Kbytes of disk, fixed disks Uniprocessor State-machine based I/O devices Standalone interactive systems Small number of friendly users 32-bit program address space Mbytes of physical memory Virtual memory Mbytes of disk, removable disks Multiprocessor (4-way) Micro-controller based I/O devices Client/Server distributed computing Large, diverse user populations

4. Effect on OS Design Copyright Microsoft Corporation NT vs UNIX Although both Windows and Linux have adapted to changes in the environment, the original design environments (i.e. in 1989 and 1969) heavily influenced the design choices: Unit of concurrency: Process creation: I/O: Namespace root: Security: Threads vs processes CreateProcess() vs fork() Async vs sync Virtual vs Filesystem ACLs vs uid/gid Addr space, uniproc Addr space, swapping Swapping, I/O devices Removable storage User populations

6. Windows Architecture hardware interfaces (buses, I/O devices, interrupts, interval timers, DMA, memory cache control, etc., etc.) System Service Dispatcher Object Mgr. Windows USER, GDI File System Cache I/O Mgr Environment Subsystems System Processes Services Applications System Threads NTDLL.DLL Device & File Sys. Drivers Session Manager POSIX Windows DLLs Plug and Play Mgr. Power Mgr. Security Reference Monitor Virtual Memory Processes & Threads Local Procedure Call Graphics Drivers Kernel Hardware Abstraction Layer (HAL) (kernel mode callable interfaces) Configura- tion Mgr (registry) OS/2 Windows Copyright Microsoft Corporation Task Manager Explorer SvcHost.Exe WinMgt.Exe SpoolSv.Exe Service Control Mgr. LSASS User Application Subsystem DLLs User Mode Kernel Mode WinLogon Services.Exe

7. Kernel-mode Architecture of Windows Copyright Microsoft Corporation NT API stubs (wrap sysenter) -- system library (ntdll.dll) user mode kernel mode NTOS executive layer Trap/Exception/Interrupt Dispatch CPU mgmt: scheduling, synchr, ISRs/DPCs/APCs Drivers Devices, Filters, Volumes, Networking, Graphics Hardware Abstraction Layer (HAL): BIOS/chipset details firmware/ hardware CPU, MMU, APIC, BIOS/ACPI, memory, devices NTOS kernel layer Caching Mgr Security Procs/Threads Virtual Memory IPC glue I/O Object Mgr Registry Copyright Microsoft Corporation

13. MinWin Layering Shell, Graphics, Multimedia, Layered Services, Applets, Etc. Kernel, HAL, TCP/IP, File Systems, Drivers, Core System Services MinWin

22. User-Mode Scheduling (UMS) kernel user Thread Parking KT 0 KT 1 KT 2 UT Completion list Primary Thread UT 0 UT 1 UT 0 User-mode Scheduler trap code NTOS executive KT 0 blocks Only primary thread runs in user-mode Trap code switches to parked KT KT blocks  primary returns to user-mode KT unblocks & parks  queue UT completion Copyright Microsoft Corporation

25. Thread Scheduling vs UMS Core 2 Core 1 Core 2 Core 1 MarkRuss Thread 3 Non-running threads Thread 4 Thread 5 Thread 1 Thread 2 Thread 6 User Thread 2 Kernel Thread 2 User Thread 1 Kernel Thread 1 User Thread 3 Kernel Thread 3 User Thread 4 Kernel Thread 4 User Thread 5 Kernel Thread 5 User Thread 6 Kernel Thread 6

27. Futures: Master/Slave UMS? remote kernel Remote x86 Thread Parking KT 0 KT 1 KT 2 UT 2 UT 1 Remote Scheduler trap code NTOS executive Kernel-mode Scheduler Syscall Completion Queue Syscall Request Queue UT 0 x86 core UTs (can) run on accelerators or x86s KTs run on x86s, syscalls remoted/batched Pagefaults are just like syscalls Accelerator never “loses the CPU” (implicit primary) Copyright Microsoft Corporation

30. muchas gracias