Chapter 22 Windows XP

22 CHAPTER Windows XP The Microsoft Windows XP operating system is a 32/64-bit preemptive multitasking operating system for AMD K6/K7, Intel IA32/IA64 and later microprocessors. The successor to Windows NT/2000, Windows XP is also intended to replace the MS-DOS operating system. Key goals for the system are security, reliability, ease of use, Windows and POSIX application compatibility, high performance, extensibility, portability and international support. This chapter discusses the key goals for Windows XP, the layered architecture of the system that makes it so easy to use, the file system, networks, and the programming interface. Windows XP serves as an excellent case study as an example operating system. Exercises 22.1 Under what circumstances would one use the deferred procedure calls facility in Windows XP? Answer: Deferred procedure calls are used to postpone interrupt processing in situations where the processing of device interrupts can be broken into a critical portion that is used to unblock the device and a non-critical portion that can be scheduled later at a lower priority. The non-critical section of code is scheduled for later execution by queuing a deferred procedure call. 22.2 What is a handle, and how does a process obtain a handle? Answer: User-mode code can access kernel-mode objects by using a reference value called a handle. An object handle is thus an identifier (unique to a process) that allows access and manipulation of a system resource. When a user-mode process wants to use an object it calls the object manager’s open method. A reference to the object is inserted in the process’s object table and a handle is returned. Processes can obtain handles by creating an object, opening an existing object, receiving a 145 146 Chapter 22 Windows XP duplicated handle from another process, or by inheriting a handle from a parent process. 22.3 Describe the management scheme of the virtual memory manager. How does the VM manager improve performance? Answer: The VM Manager uses a page based management scheme. Pages of data allocated to a process that are not in physical memory are stored in either paging files on disk or mapped to a regular file on a local or remote file system. To improve performance of this scheme, a privileged process is allowed to lock selected pages in physical memory preventing those pages from being paged out. Furthermore, since when a page is used, adjacent pages will likely be used in the near future, adjacent pages are prefetched to reduce the total number of page faults. 22.4 Describe an useful application of the no-access page facility provided in Windows XP? Answer: When a process accesses a no-access page, an exception is raised. This feature is used to check whether a faulty program accesses beyond the end of an array. The array needs to be allocated in a manner such that it appears at the end of a page, so that buffer overruns would cause exceptions. 22.5 The IA64 processors contain registers that can be used to address a 64-bit address space. However, Windows XPlimits the address space of user programs to 8-TB, which corresponds to 43 bits’ worth. Why was this decision made? Answer: Each page table entry is 64 bits wide and each page is 8 KB on the IA64. Consequently, each pagecan contain 1024 page table entries. The virtual memory system therefore requires three levels of page tables to translate a virtual address to a physical address in order to address a 8-TB virtual address space. (The first level page table is indexed using the first 10 bits of the virtual address, the second level page table using the next 10 bits, and the third level page table is indexed using the next 10 bits, with the remaining 13 bits used to index into the page.) If the virtual address space is bigger, more levels would be required in the page table organization, and therefore more memory references would be required to translate a virtual address to the corresponding physical address during a TLB fault. The decision regarding the 43-bit address space represents a trade-off between the size of the virtual address space and the cost of performing an address translation. 22.6 Describe the three techniques used for communicating data in a local procedure call. What different settings are most conducive for the application of the different message passing techniques? Answer: Data is communicated using one of the following three facilities: 1) messages are simply copied from one process to the other, 2) a shared memory segment is created and messages simply contain a pointer into the shared memory segment, thereby avoiding copies between processes, 3) a process directly writes into the other process’s virtual space. 22.7 What manages cache in Windows XP? How is cache managed? Exercises 147 Answer: In contrast to other operating systems where caching is done by the file system, Windows XP provides a centralized cache manager which works closely with the VM manager to provide caching services for all components under control of the I/O manager. The size of the cache changes dynamically depending upon the free memory available in the system. The cache manager maps files into the upper half of the system cache address space. This cache is divided into blocks which can each hold a memory-mapped region of a file. 22.8 What is the purpose of the Windows16 execution environment? What limitations are imposed on the programs executing inside this environment? What are the protection guarantees provided between different applications executing inside the Windows16 environment? What are the protection guarantees provided between an application executing inside the Windows16 environment and a 32-bit application? Answer: Windows 16 execution environment provides a virtual environment for executing 16-bit applications that use the Window 3.1 kernel interface. The interface is supported in software using stub routines that call the appropriate Win32 API subroutines by converting 16-bit addresses into 32-bit addresses. This allows the system to run legacy applications. The environment can multitask with other processes on Windows XP. It can contain multiple Windows16 applications, but all applications share the same address space and the same input queue. Also one can execute only one Windows16 application at a given point in time. A Windows16 application can therefore crash other Windows16 applications by corrupting the address space but they cannot corrupt the address spaces of Win32 applications. Multiple Windows16 execution environments could also coexist. 22.9 Describe two user-mode processes that Windows XP provides to enable it to run programs developed for other operating systems. Answer: Environmental subsystems are user-mode processes layered over the native executable services to enable Windows XP to run programs developed for other operating systems. (1) A Win32 application called the virtual DOS machine (VDM) is provided as a user-mode process to run MSDOS applications. The VDM can execute or emulate Intel 486 instructions and also provides routines to emulate MSDOS BIOS services and provides virtual drivers for screen, keyboard, and communication ports. (2) Windows-on-windows (WOW32) provides kernel and stub routines for Windows 3.1 functions. The stub routines call the appropriate Win32 subroutines, converting the 16-bit addresses into 32-bit addresses. 22.10 How does the NTFS directory structure differ from the directory structure used in Unix operating systems? Answer: The NTFS namespace is organized as a hierarchy of directories where each directory uses a B+ tree data structure to store an index of the filenames in that directory. The index root of a directory contains the top level of the B+ tree. Each entry in the directory contains the name and file reference of the file as well as the update timestamp and file size. The Unix operating system simply stores a table of en- 148 Chapter 22 Windows XP tries mapping names to i-node numbers in a directory file. Lookups and updates require a linear scan of the directory structure in Unix systems. 22.11 What is a process, and how is it managed in Windows XP? Answer: A process is an executing instance of an application containing one or more threads. Threads are the units of code that are scheduled by the operating system. A process is started when some other process calls the CreateProcess routine, which loads any dynamic link libraries used by the process, resulting in a primary thread. Additional threads can also be created. Each thread is created with its own stack with a wrapper function providing thread synchronization. 22.12 What is the fiber abstraction provided by Windows XP? How does it differ from the threads abstraction? Answer: A fiber is a sequential stream of execution within a process. A process can have multiple fibers in it, but unlike threads, only one fiber at a time is permitted to execute. The fiber mechanism is used to support legacy applications written for a fiber-execution model.