Executive:
- Services:
- Object Manager:
manages objects such as directories,
symbolic links, semaphores, event objects, process and thread objects,
port objects and file objects
- standardized interface with the following methods:
- open method returns a handle to object
- create
- close
- delete
- query name - give name from object (e.g. get filename back)
- parse - find object from name
- security - change protection
- Naming
- Global naming in a directory
- Can be permanent or temporary
- Structured like path names
- Handles
- Open
- Create
- Receive a duplicate from some other process
- Inherit from a parent
- Authentication
- User gets an access-token object at login
- The access-token object contains IDs, privileges and a default
access control list
- each object has an access control list
- access is authenticated when object is opened so NT services
that use pointers rather than handles bypass security
- Virtual-Memory Manager
- Page-based 4 KB page size
- 32-bit address space (upper 2 GB for kernel)
- Two-step process:
- Reserve memory
- Commit allocation
- Shared memory
- Parent can reserve right to access VM of child
- Process share memory by getting a handle to same memory space
- Section object - block of shared memory, process only needs
to map a portion called a view -- allows a process to access an
object too large to fit into memory.
- Multilevel page table:
- 1024 entry page directory
- Each entry in page directory is a ponter to a page table of
1024 entries
- Each PTE points to a 4KB page
- Low 12 bits of PTE (5 bits of protection, 4 bits specify which paging file,
3 bits specify page state)
- Page state:
- valid - in use by active process
- free - not referenced in a PTE
- zeroed - free page that is zeroed out
- standby - page that has been removed from process working set
- modified - has been written by not modified
- bad - unusable because of a hardware error
- Replacement
- Takes first from from free list and replaces it
- Also faults adjacent pages
- If no frames on free list, uses per-process FIFO
- Processes start with default working set of 30 pages
- NT periodically tells a valid page if if no faults occur,
working set reduced by 1
- Processes with a lot of faults may get allocation increased.
- Process Manager - doesn't keep parent-child relationships
- Local Procedure Call (LPC)
- uses message passing
- server publishes visible connection-port object
- client opens handle to port and sends a connection request
- server creates a channel and returns a handle
- channel consists of pair of ports for two way communication
- accept callbacks so that they can take requests rather than replies
- three types of messages:
- small (upto 256 bytes) - uses ports message queue for storage
- larger - shared memory object is created and message contains
pointer to memory object
- quick LPC
- used for Win32 subsystem
- server ents up dedicated thread, 64 KB section object and
event-pair object to notify server when client has copied a message
or vice versa.
Skill: Have a basic overview of NT design
Revised 4/24/98