The Windows NT operating system family's architecture consists of two layers (user mode and kernel mode), with many different modules within both of these layers. In Computer engineering, computer architecture is the conceptual design and fundamental operational structure of a Computer system "kernel space" redirects here For mathematical definition see Null space.

Windows NT 3.1, Windows NT 3.5, Windows NT 3.51, Windows NT 4.0, Windows 2000, Windows XP, Windows Server 2003, Windows Vista and Windows Server 2008 are all part of the Windows NT family of computer operating systems produced by Microsoft. Windows NT 31 is the first release of Microsoft 's Windows NT line of server and business desktop Operating systems and was released to Windows NT 35 is the second release of the Microsoft Windows NT Operating system. Windows NT 351 is the third release of Microsoft 's Windows NT line of Operating systems It was released on May 30 1995, nine months Windows NT 40 is a preemptive, graphical and business-oriented Operating system designed to work with either Uniprocessor or symmetric Windows 2000 (also referred to as Win2K) is a preemptive, interruptible graphical and business-oriented Operating system designed to work with Windows XP is a family of 32-bit and 64-bit Operating systems produced by Microsoft for use on Personal computers including home and Windows Server 2003 (also referred to as Win2K3 is a server Operating system produced by Microsoft. Windows Vista (ˈvɪstə is a line of Operating systems developed by Microsoft for use on Personal computers including home and business desktops Windows Server 2008 is the most recent release of Microsoft Windows ' server line of Operating systems Released to manufacturing on 4 February Windows NT is a family of Operating systems produced by Microsoft, the first version of which was released in July 1993 A computer is a Machine that manipulates data according to a list of instructions. An operating system (commonly abbreviated OS and O/S) is the software component of a Computer system that is responsible for the management and coordination Microsoft Corporation is an American multinational Computer technology Corporation, which rose to dominate the Home computer They are all preemptive, reentrant operating systems, which have been designed to work with either uniprocessor or symmetrical multi processor (SMP)-based computers. Pre-emption or preemption in Computing is the act of temporarily interrupting a task being carried out by a computer system, without requiring A uniprocessor system is a Computer system with a single Central processing unit. In Computing, symmetric multiprocessing or SMP involves a Multiprocessor computer-architecture where two or more identical processors can connect to a single To process input/output (I/O) requests it uses packet-driven I/O, which utilizes I/O request packets (IRPs) and asynchronous I/O. In Computing, input/output, or I/O, refers to the communication between an Information processing system (such as a Computer) and the outside I/O request packets (IRPs are kernel mode structures that are used by Windows Driver Model (WDM and Windows NT Device drivers to communicate with each Asynchronous I/O, or non-blocking I/O, is a form of Input/output processing that permits other processing to continue before the transmission has finished Starting with Windows XP, Microsoft began making 64-bit versions of Windows available—before this, these operating systems supported only 32-bit processors. '64-bit' CPUs have existed in Supercomputers since the 1960s and in RISC -based workstations and servers since the early 1990s. The range of Integer values that can be stored in 32 bits is 0 through 4294967295 or −2147483648 through 2147483647 using Two's complement encoding

The architecture of Windows NT is highly modular and consists of two main layers: components that run in user mode and components that run in kernel mode. In Computer engineering, computer architecture is the conceptual design and fundamental operational structure of a Computer system "kernel space" redirects here For mathematical definition see Null space. Programs and subsystems in user mode are limited in terms of what system resources they have access to, while the kernel mode has unrestricted access to the system memory and external devices. The kernels of the operating systems in this line are all known as hybrid kernel, although this term is disputed, with the claim that the kernel is essentially a monolithic kernel that is structured somewhat like a microkernel. In Computer science, the kernel is the central component of most computer Operating systems (OS Hybrid kernel is a kernel architecture based on combining aspects of Microkernel and Monolithic kernel architectures used in Computer A monolithic kernel is a kernel architecture where the entire kernel is run in Kernel space in Supervisor mode. A microkernel is a minimal Computer Operating system kernel which in its purest form provides no operating-system services at all only the The architecture comprises a hybrid kernel, hardware abstraction layer (HAL), drivers, and a range of services (collectively named Executive), which all exist in kernel mode. A hardware abstraction layer ( HAL) is an Abstraction layer, implemented in software between the physical hardware of a Computer and ^[1]

User mode in the Windows NT line is made of subsystems capable of passing I/O requests to the appropriate kernel mode software drivers by using the I/O manager. In computing a device driver or software driver is a Computer program allowing higher-level computer programs to interact with a Hardware device Two subsystems make up the user mode layer of Windows NT: the Environment subsystem (which runs applications written for many different types of operating systems), and the Integral subsystem (operates system specific functions on behalf of the environment subsystem). Kernel mode in Windows NT has full access to the hardware and system resources of the computer. The kernel mode stops user mode services and applications from accessing critical areas of the operating system that they should not have access to.

The Executive interfaces with all the user mode subsystems. It deals with I/O, object management, security and process management. The kernel sits between the Hardware Abstraction Layer and the Executive to provide multiprocessor synchronization, thread and interrupt scheduling and dispatching, and trap handling and exception dispatching. The kernel is also responsible for initializing device drivers at bootup. Kernel mode drivers exist in three levels: highest level drivers, intermediate drivers and low level drivers. Windows Driver Model (WDM) exists in the intermediate layer and was mainly designed to be binary and source compatible between Windows 98 and Windows 2000. In Computing, the Windows Driver Model ( WDM) &mdash also known at one point as the Win32 Driver Model &mdash is a framework for Device drivers Windows 98 ( codenamed Memphis) is a graphical Operating system released on 25 June 1998 by Microsoft and the successor to Windows 95 Windows 2000 (also referred to as Win2K) is a preemptive, interruptible graphical and business-oriented Operating system designed to work with The lowest level drivers are either legacy Windows NT device drivers that control a device directly or can be a PnP hardware bus. Plug-and-play is a computer feature that allows the addition of a new device normally a Peripheral, without requiring reconfiguration or manual installation of Device

User mode

The user mode is made up of subsystems which can pass I/O requests to the appropriate kernel mode drivers via the I/O manager (which exists in kernel mode). Two subsystems make up the user mode layer of Windows NT: the Environment subsystem and the Integral subsystem.

The environment subsystem was designed to run applications written for many different types of operating systems. None of the environment subsystems can directly access hardware, and must request access to memory resources through the Virtual Memory Manager that runs in kernel mode. Also, applications run at a lower priority than kernel mode processes.

There are three main environment subsystems: the Win32 subsystem, an OS/2 subsystem and a POSIX subsystem. The Windows API, informally WinAPI, is Microsoft's core set of Application programming interfaces (APIs available in the Microsoft Windows Operating OS/2 is a computer Operating system, initially created by Microsoft and IBM, then later developed by IBM exclusively POSIX (ˈpɒzɪks or "Portable Operating System Interface" is the collective name of a family of related standards specified by the IEEE to define ^[2]

• The Win32 environment subsystem can run 32-bit Windows applications. It contains the console as well as text window support, shutdown and hard-error handling for all other environment subsystems. It also supports Virtual DOS Machines (VDMs), which allow MS-DOS and 16-bit Windows (Win16) applications to run on Windows NT. Virtual DOS machine (VDM is Microsoft 's technology that allows running legacy MS-DOS and 16-bit Windows programs on Intel 80386 or higher computers MS-DOS (short for M icro' s' oft D isk O perating S ystem is an Operating system commercialized by Microsoft. The Windows API, informally WinAPI, is Microsoft's core set of Application programming interfaces (APIs available in the Microsoft Windows Operating There is a specific MS-DOS VDM which runs in its own address space and which emulates an Intel 80486 running MS-DOS 5. The Intel 486, otherwise known as the 80486 i486 or just 486 was the first tightly pipelined X86 design 0. Win16 programs, however, run in a Win16 VDM. Each program, by default, runs in the same process, thus using the same address space, and the Win16 VDM gives each program its own thread to run on. A thread in Computer science is short for a thread of execution. However, Windows NT does allow users to run a Win16 program in a separate Win16 VDM, which allows the program to be preemptively multitasked as Windows NT will pre-empt the whole VDM process, which only contains one running application. The Win32 environment subsystem process (csrss. exe) also includes the window management functionality, sometimes referred to as a "window manager. " It handles input events (such as from the keyboard and mouse), then passes messages to the applications that need to receive this input. Each application is responsible for drawing or refreshing its own windows and menus, in response to these messages.
• The OS/2 environment subsystem supports 16-bit character-based OS/2 applications and emulates OS/2 1. x, but not 32-bit or graphical OS/2 applications as used with OS/2 2. x or later.
• The POSIX environment subsystem supports applications that are strictly written to either the POSIX. 1 standard or the related ISO/IEC standards. The POSIX subsystem has been an area of recent active development and is a major feature of Windows Compute Cluster Server 2003. Windows Server 2003 (also referred to as Win2K3 is a server Operating system produced by Microsoft.

The integral subsystem looks after operating system specific functions on behalf of the environment subsystem. It consists of a security subsystem, a workstation service and a server service. The security subsystem deals with security tokens, grants or denies access to user accounts based on resource permissions, handles login requests and initiates login authentication, and determines which system resources need to be audited by Windows NT. It also looks after Active Directory. Active Directory ( AD) is a technology created by Microsoft that provides a variety of network services including LDAP -like Directory The workstation service is an API to the network redirector, which provides the computer access to the network. The server service is an API that allows the computer to provide network services.

Kernel mode

Windows NT kernel mode has full access to the hardware and system resources of the computer and runs code in a protected memory area. It controls access to scheduling, thread prioritization, memory management and the interaction with hardware. The kernel mode stops user mode services and applications from accessing critical areas of the operating system that they should not have access to; user mode processes must ask the kernel mode to perform such operations on their behalf.

While the x86 architecture supports four different privilege levels (numbered 0 to 3), only the two extreme privilege levels are used. See also X86 assembly language The generic term x86 refers to the most commercially successful Instruction set architecture in the history of Personal Usermode programs are run with CPL 3, and the kernel runs with CPL 0. These two levels are often referred to as "ring 3" and "ring 0", respectively. Such a design decision had been done to achieve code portability to RISC platforms that only support two privilege levels^[3], but is most likely also contributed to the fact that even "ring 2" is already powerful enough to allow for privilege escalation to "ring 0" (for example by modifying I/O bitmaps).

Kernel mode consists of executive services, which is itself made up on many modules that do specific tasks, kernel drivers, a kernel and a Hardware Abstraction Layer, or HAL. In Computer science, the kernel is the central component of most computer Operating systems (OS

Executive

The Executive interfaces with all the user mode subsystems. It deals with I/O, object management, security and process management. It's informally divided into several subsystems, among which Cache Manager, Configuration Manager, I/O Manager, Local Procedure Call (LPC), Memory Manager, Object Manager, Process Structure and Security Reference Monitor (SRM). The local procedure call ( LPC) facility is a service provided by the Microsoft Windows NT kernel for light weight Message queue between Object Manager (internally called Ob) is a subsystem implemented as part of Windows Executive which manages Windows resources. Grouped together, the components can be called Executive services (internal name Ex). System Services (internal name Nt), i. e. , system calls, are implemented at this level, too, except very few that call directly into the kernel layer for better performance. In Computing, a system call is the mechanism used by an application program to request service from the Kernel.

The term "service" in this context generally refers to a callable routine, or set of callable routines. This is distinct from the concept of a "service process," which is a user mode component somewhat analogous to a daemon in Unix-like operating systems. In Unix and other computer multitasking Operating systems a daemon (ˈdiːmən or /ˈdeɪmən/ is a Computer program that runs in the background

Each object in Windows NT exists in a global namespace. A namespace is an abstract container or environment created to hold a logical grouping of unique identifiers (i This is a screenshot from SysInternals WinObj. A screenshot, screen capture, or screen dump is an Image taken by the Computer to record the visible items displayed on the monitor

Object Manager

The Object Manager (internal name Ob) is an executive subsystem that all other executive subsystems, especially system calls, must pass through to gain access to Windows NT resources—essentially making it a resource management infrastructure service. Object Manager (internally called Ob) is a subsystem implemented as part of Windows Executive which manages Windows resources. ^[4] The object manager is used to reduce the duplication of object resource management functionality in other executive subsystems, which could potentially lead to bugs and make development of Windows NT harder. ^[5] To the object manager, each resource is an object, whether that resource is a physical resource (such as a file system or peripheral) or a logical resource (such as a file). Each object has a structure or object type that the object manager must know about.

Object creation is a process in two phases, creation and insertion. Creation causes the allocation of an empty object and the reservation of any resources required by the object manager, such as an (optional) name in the namespace. If creation was successful, the subsystem responsible for the creation fills in the empty object. ^[6] Finally, if the subsystem deems the initialization successful, it instructs the object manager to insert the object, which makes it accessible through its (optional) name or a cookie called a handle. A magic cookie or just cookie for short is a token or short packet of data passed between communicating programs where the data is typically not meaningful to the recipient ^[7] From then on, the lifetime of the object is handled by the object manager, and it's up to the subsystem to keep the object in a working condition until being signaled by the object manager to dispose of it. ^[8]

Handles are similar in purpose to UNIX file descriptors, in that each represents a reference to a kernel resource through an opaque value. In computer programming a file descriptor is an abstract key for accessing a file Similarly, opening an object through its name is subject to security checks, but acting through an existing, open handle is only limited to the level of access requested when the object was opened or created.

Object types define the object procedures and any data specific to the object. In this way, the object manager allows Windows NT to be an object oriented operating system, as object types can be thought of as polymorphic classes that define objects. Object-oriented programming (OOP is a Programming paradigm that uses " objects " and their interactions to design applications and computer programs In Object-oriented programming, a class is a Programming language construct that is used as a blueprint to create objects This blueprint includes attributes In its simplest embodiment an object is an allocated region of storage Most subsystems, though, with a notable exception in the I/O Manager, rely on the default implementation for all object type procedures.

Each instance of an object that is created stores its name, parameters that are passed to the object creation function, security attributes and a pointer to its object type. The object also contains an object close procedure and a reference count to tell the object manager how many other objects in the system reference that object and thereby determines whether the object can be destroyed when a close request is sent to it. ^[9] Every named object exists in a hierarchical object namespace. A namespace is an abstract container or environment created to hold a logical grouping of unique identifiers (i

Cache Controller

Closely coordinates with the Memory Manager, I/O Manager and I/O drivers to provide a common cache for regular file I/O. Uniquely, the Windows Cache Manager operates on file blocks (rather than device blocks), for consistent operation between local and remote files, and ensures a certain degree of coherency with memory-mapped views of files, since cache blocks are a special case of memory-mapped views and cache misses a special case of page faults.

Configuration Manager

Implements the Windows registry. The Windows registry is a directory which stores settings and options for the Operating system for Microsoft Windows 32-bit versions 64-bit versions and

I/O Manager

Allows devices to communicate with user-mode subsystems. It translates user-mode read and write commands into read or write IRPs which it passes to device drivers. It accepts file system I/O requests and translates them into device specific calls, and can incorporate low-level device drivers that directly manipulate hardware to either read input or write output. In Computing, a file system (often also written as filesystem) is a method for storing and organizing Computer files and the data they contain to make It also includes a cache manager to improve disk performance by caching read requests and write to the disk in the background.

Local Procedure Call (LPC)

Provides inter-process communication ports with connection semantics. LPC ports are used by user-mode subsystems to communicate with their clients, by Executive subsystems to communicate with user-mode subsystems, and as the basis for the local transport for MSRPC. MSRPC ( Microsoft Remote Procedure Call) is a modified version of DCE/RPC.

Memory Manager

Manages virtual memory, controlling memory protection and the paging of memory in and out of physical memory to secondary storage, and implements a general-purpose allocator of physical memory. Virtual memory is a Computer system technique which gives an application program the impression that it has contiguous working memory while in fact it may be physically In Computer Operating systems that have their Main memory divided into pages, paging (sometimes called swapping) is a transfer It also implements a parser of PE executables that lets an executable be mapped or unmapped in a single, atomic step.

Starting from Windows NT Server 4. 0, Terminal Server Edition, the memory manager implements a so-called session space, a range of kernel-mode memory that is subject to context switching just like user-mode memory. This lets multiple instances of the kernel-mode Win32 subsystem and GDI drivers run side-by-side, despite shortcomings in their initial design. Each session space is shared by several processes, collectively referred to as a "session".

To ensure a degree of isolation between sessions without introducing a new object type, the association between processes and sessions is handled by the Security Reference Monitor, as an attribute of a security subject (token), and it can only be changed while holding special privileges.

The relatively unsophisticated and ad-hoc nature of sessions is due to the fact they weren't part of the initial design, and had to be developed, with minimal disruption to the main line, by a third party (Citrix) as a prerequisite for their terminal server product for Windows NT, called WinFrame. Citrix Systems ( is an American Multinational corporation with a focus on Software and services specialized in Virtualization and remote access A terminal server is a specialized computer which aggregates multiple communication channels together WinFrame was a Multi-user version of Windows NT 351 which was fully repackaged by Citrix Systems. Starting with Windows Vista, though, sessions finally became a proper aspect of the Windows architecture. No longer a memory manager construct that creeps into user mode indirectly through Win32, they were expanded into a pervasive abstraction affecting most Executive subsystems. As a matter of fact, regular use of Windows Vista always results in a multi-session environment. ^[10]

Process Structure

Handles process and thread creation and termination, and it implements the concept of Job, a group of processes that can be terminated as a whole, or be placed under shared restrictions (such a total maximum of allocated memory, or CPU time). In computing a process is an instance of a Computer program that is being sequentially executed by a computer system that has the ability to run several computer A thread in Computer science is short for a thread of execution.

PnP Manager

Handles Plug and Play and supports device detection and installation at boot time. Plug-and-play is a computer feature that allows the addition of a new device normally a Peripheral, without requiring reconfiguration or manual installation of Device It also has the responsibility to stop and start devices on demand—this can happen when a bus (such as USB or FireWire) gains a new device and needs to have a device driver loaded to support it. The IEEE 1394 interface is a serial bus Interface standard for high-speed communications and Isochronous real-time data transfer frequently Its bulk is actually implemented in user mode, in the Plug and Play Service, which handles the often complex tasks of installing the appropriate drivers, notifying services and applications of the arrival of new devices, and displaying GUI to the user.

Power Manager

Deals with power events (power-off, stand-by, hibernate, etc. ) and notifies affected drivers with special IRPs (Power IRPs).

Security Reference Monitor (SRM)

The primary authority for enforcing the security rules of the security integral subsystem. ^[11] It determines whether an object or resource can be accessed, via the use of access control lists (ACLs), which are themselves made up of access control entries (ACEs). In Computer security, an access control list ( ACL) is a list of permissions attached to an object ACEs contain a security identifier (SID) and a list of operations that the ACE gives a select group of trustees—a user account, group account, or login session^[12]—permission (allow, deny, or audit) to that resource. ^[13][14]

GDI

The Graphics Device Interface is responsible for tasks such as drawing lines and curves, rendering fonts and handling palettes. Windows 2000 introduced native alpha blending into the GDI. In Computer graphics, alpha compositing is the process of combining an image with a background to create the appearance of partial transparency

Kernel

The kernel sits between the HAL and the Executive and provides multiprocessor synchronization, thread and interrupt scheduling and dispatching, and trap handling and exception dispatching; it is also responsible for initializing device drivers at bootup that are necessary to get the operating system up and running. That is, the kernel performs almost all the tasks of a traditional microkernel; the strict distinction between Executive and Kernel is the most prominent remnant of the original microkernel design, and historical design documentation consistently refers to the kernel component as "the microkernel".

The kernel often interfaces with the process manager. ^[15] The level of abstraction is such that the kernel never calls into the process manager, only the other way around (save for a handful of corner cases, still never to the point of a functional dependence).

Kernel-mode drivers

Windows NT uses kernel-mode device drivers to enable it to interact with hardware devices. In computing a device driver or software driver is a Computer program allowing higher-level computer programs to interact with a Hardware device Typical PC hardware A typical Personal computer consists of a case or chassis in a tower shape (desktop and the following parts Motherboard Each of the drivers has well defined system routines and internal routines that it exports to the rest of the operating system. All devices are seen by user mode code as a file object in the I/O manager, though to the I/O manager itself the devices are seen as device objects, which it defines as either file, device or driver objects. Kernel mode drivers exist in three levels: highest level drivers, intermediate drivers and low level drivers. The highest level drivers, such as file system drivers for FAT and NTFS, rely on intermediate drivers. Templateinfobox filesystem whilst covering all 3 file systems please make any style changes to both at the same time NTFS (New Technology File System Is the standard File system of Windows NT, including its later versions Windows 2000, Windows XP, Windows Intermediate drivers consist of function drivers—or main driver for a device—that are optionally sandwiched between lower and higher level filter drivers. The function driver then relies on a bus driver—or a driver that services a bus controller, adapter, or bridge—which can have an optional bus filter driver that sits between itself and the function driver. Intermediate drivers rely on the lowest level drivers to function. The Windows Driver Model (WDM) exists in the intermediate layer. In Computing, the Windows Driver Model ( WDM) &mdash also known at one point as the Win32 Driver Model &mdash is a framework for Device drivers The lowest level drivers are either legacy Windows NT device drivers that control a device directly or can be a PnP hardware bus. These lower level drivers directly control hardware and do not rely on any other drivers.

Hardware abstraction layer

The Windows NT hardware abstraction layer, or HAL, is a layer between the physical hardware of the computer and the rest of the operating system. A hardware abstraction layer ( HAL) is an Abstraction layer, implemented in software between the physical hardware of a Computer and It was designed to hide differences in hardware and therefore provide a consistent platform on which the kernel is run. The HAL includes hardware-specific code that controls I/O interfaces, interrupt controllers and multiple processors. A Programmable Interrupt Controller ( PIC) is a device which allows priority levels to be assigned to its interrupt outputs

However, despite its purpose and designated place within the architecture, the HAL isn't a layer that sits entirely below the kernel, the way the kernel sits below the Executive: all known HAL implementations depend in some measure on the kernel, or even the Executive. In practice, this means that kernel and HAL variants come in matching sets that are specifically engineered to work together.

In particular, hardware abstraction does not involve abstracting the instruction set, which generally falls under the wider concept of portability. Abstracting the instruction set, when necessary (such as for handling the several revisions to the x86 instruction set, or emulating a missing math coprocessor), is performed by the kernel, or via platform virtualization. See also X86 assembly language The generic term x86 refers to the most commercially successful Instruction set architecture in the history of Personal

Notes and references

Notes

References

See also

• Windows NT
• MinWin

External links

• Microsoft's official Windows 2000 site
• Windows 2000 Plug and Play architecture