1. January 2010 Boston Area Windows Server User Group Tim Mangan Kahuna, TMurgent Technologies

2.  What is an OS?  What is in Microsoft’s OS?  CPU  Memory  Cache  New Stuff  Hyper-V Part 2

3. 1. Software that provides an abstraction of the hardware, and 2. Provides a set of services to higher layers (applications)

4. Process Thread Memory CPU

5. instr Instr … Instr Read kbd Instr … If Call Program Jump top instr Instr … Instr Read kbd Instr … If not done, Jump return Instr … EOI DOS APPLICATION Int Instr … Ret TSR Call TSR

6.  Interrupt, or Process/Thread swap  Current contents of CPU registers, program counters (current instruction address), etc must be saved (in memory)  Contents are later restored to resume processing

7. instr … Instr Call Task 1 Call Task 2 Call Task 3 Instr … Housekeeping Jump top instr … Complicated stuff …. Instr … Yield Purpose-Built OS Task 3 instr … Read Port A Instr … Yield Task 1 Instr … EOI Int Non Pre-emptive instr … Read Port B Instr … Yield Task 2 1ms 3ms

8. instr Instr … Instr App Ready? Instr … Housekeeping … Jump top instr … Instr Read port … Instr Jump Windows 16-bit APPLICATION (LP) instr … Instr Move Data Instr … If not done Jump Exit APPLICATION (HP) Instr … EOI Int Pre-emptive Swap App?

9. Memory CPU Application

10.  Separate OS and Applications into separate modes  CPU support or “run levels” (or “rings”)  If not in right level/ring, can’t do some things  Only OS code can change level/ring

11. Memory CPU Ring 0 “Kernel Mode” or “Supervisor Mode” Ring 1 “User Mode”

12.  Decouple Actual RAM from a Managed View Abstraction  Provide different “software entities” different views Kernel Memory Only Write in Ring Zero User Memory

13. A page of a virtual memory may be: In RAM In Page File Both, Neither Virtual Memory RAM Page File

14.  Different Views for Different Processes  View typically has unused pages  All processes see same kernel mem (but can’t touch) Kernel Memory Only Write in Ring Zero User Memory Physical Memory Process “A” Process “B”

15. A page of a process memory may be Private or shared In RAM, Page File, both, or neither In ram Ram+Page Paged Reserved Virtual Memory Page Table Mapping RAM Page File Process (virtual) memory spaces Process “A” Process “B” Process “C”

16.  Much of the previous is not really specific to Microsoft  Hardware allows OS’s to Advance 808616-bit,20-bit address spaceDos 80186New fast instructions 80286Protected Mode, 24-bit addrWindows 16-bit 8038632-bit, 32-bit addr, MMU PagingWindows 32-bit 80486FPU, L1 Cache Pentium64-bit data busPAE P-ProL2 Cache P464-bit supportX64 OS Xeon,Core 2,…Hyper-threading, Multi-core

17. Kernel Mode Memory Subsystem User Mode Cache Subsystem I/O Subsystem FS Drivers Task Executive Object Manager Local Procedure Call Registry Security Kernel32.dll Kernelbase.dll Filters Task Executive Task Executive

18. Windows Calculator

19. Show TM

20. System Idle (zero page) thread(s) Idle threads Below Normal threads Normal threads Above Normal threads High threads

22. Waiting threads P8P10P8P9P15

23. Tim Mangan tmangan@tmurgent.com www.tmurgent.com