1. Recitation summary What you should know for the exam
Operating Systems
Recitation summary
What you should know for the exam

2. You should know
System/API calls and their parameters discussed at the class or used in hw assignments
(e.g. CreateFile creates/opens file depending on a parameter)
Some details on Windows system internals we discussed
(e.g. object reference counting, memory management, file system)
Windows Networking Tools
(e.g. use ipconfig to find out my ip address)
Purpose and capabilities of networking protocols we have discussed
(e.g. Dns protocol is used to resolve symbolic name into numeric ip)

3. System Calls No need to memorize exact details
But ,you are expected to know
Approximate name (exact for important function)
What it does (behavior)
Effect of most important parameters
Usage Pattern

4. Subjects Win32 Types and Objects, Unicode Strings Files Processes
Threads
Process/Thread Synchronization
Virtual Memory
Memory Mapped Files
Dynamic Link Libraries
Networking and Windows Net Utilities
Sockets Programming
Windows Security
Structured Exception Handling

5. 1. Win32 types, objects, Unicode
Reference Counting and CloseHandle
Handle Permissions and Security
Signaled State of an object
LPTSTR, TCHAR, DWORD
L”aa”, _T(“aa”)
GetLastError()

6. 1.1 Handles, Pointers, and Objects
System Space
Process A
handles
HandleCount = 1
ReferenceCount = 1
Event Object
Handle Table
index
Handle to a kernel object is an index into the process handle table, and hence is invalid in any other process
Handle table entry contains the system-space address (8xxxxxxx or above) of the data structure; this address is the same regardless of process context
Although handle table is per-process, it is actually in system address space (hence protected)
Handle Table
Process B

7. 1.1 Handles, Pointers, and Reference Count
Process A
System Space
handles
DuplicateHandle
HandleCount = 3
ReferenceCount = 0
HandleCount = 2
ReferenceCount = 0
Handle Table
HandleCount = 1
ReferenceCount = 0
Event Object
HandleCount = 3
ReferenceCount = 4
Thread
(in a wait state
for the event)
Note: there is actually another data structure, a “wait block”, “between” the thread and the object it’s waiting for
index
Handle Table
Process B

8. 2.Files CreateFile ReadFile WriteFile SetFilePointer FindFirstFile
FindNextFile
CloseHandle/FindClose
GetFileSize

9. 2.1 CreateFile HANDLE WINAPI CreateFile( __in LPCTSTR lpFileName,
__in DWORD dwDesiredAccess,
__in DWORD dwShareMode,
__in_opt LPSECURITY_ATTRIBUTES lpSecurityAttributes,
__in DWORD dwCreationDisposition,
__in DWORD dwFlagsAndAttributes,
__in_opt HANDLE hTemplateFile );

10. 2.1 CreateFile Argument Sample Values pFileName _T(“c:\\a.txt”)
dwDesiredAccess
GENERIC_READ | GENERIC_WRITE
wShareMode
FILE_SHARE_READ|FILE_SHARE_WRITE
pSecurityAttributes
NULL
wCreationDisposition
CREATE_ALWAYS, OPEN_EXISTING
dwFlagsAndAttributes
FILE_ATTRIBUTE_READONLY, FILE_ATTRIBUTE_HIDDEN
FILE_FLAG_SEQUENTIAL_SCAN
FILE_FLAG_RANDOM_ACCESS

11. 2.2 SetFilePointer DWORD WINAPI SetFilePointer( __in HANDLE hFile,
__in LONG lDistanceToMove,
__inout_opt PLONG lpDistanceToMoveHigh,
__in DWORD dwMoveMethod );

12. 2.2 SetFilePointer Argument Sample Value dwMoveMethod
FILE_BEGIN, FILE_CURRENT, FILE_END
lDistanceToMove
1000
hFile
handle

13. 3.Processes BOOL WINAPI CreateProcess(
__in_opt LPCTSTR lpApplicationName,
__inout_opt LPTSTR lpCommandLine,
__in_opt LPSECURITY_ATTRIBUTES lpProcessAttributes,
__in_opt LPSECURITY_ATTRIBUTES lpThreadAttributes,
__in BOOL bInheritHandles,
__in DWORD dwCreationFlags,
__in_opt LPVOID lpEnvironment,
__in_opt LPCTSTR lpCurrentDirectory,
__in LPSTARTUPINFO lpStartupInfo,
__out LPPROCESS_INFORMATION lpProcessInformation );

14. 3.Processes CreateProcess GetProcessExitCode TerminateProcess
WaitForSingleObject

15. 3.1 CreateProcess Argument Value lpApplicationName _T(“Program.exe”)
pCommandLine
_T(“program.exe 1”)
pProcessAttributes
NULL
lpThreadAttributes
dwCreationFlags
CREATE_NO_WINDOW
lpProcessInformation
&pi

16. 4. Threads
CreateThread
TerminateThread
WaitForSingleObject

17. 4.Threads HANDLE WINAPI CreateThread(
__in_opt LPSECURITY_ATTRIBUTES lpThreadAttributes,
__in SIZE_T dwStackSize,
__in LPTHREAD_START_ROUTINE lpStartAddress,
__in_opt LPVOID lpParameter,
__in DWORD dwCreationFlags,
__out_opt LPDWORD lpThreadId );

18. Single and Multithreaded Processes
code
data
files
code
data
files
registers
stack
registers
registers
registers
stack
stack
stack
Thread
Thread
Thread
Thread
single-threaded
multi-threaded

19. Thread States Five-state diagram for thread scheduling:
init: The thread is being created
ready: The thread is waiting to be assigned to a CPU
running: The thread’s instructions are being executed
waiting: The thread is waiting for some event to occur
terminated: The thread has finished execution
interrupt quantum expired
init
terminated
Newly created threads start there live in “init” state. After appropriate data structures are initialized (thread control block - TCB), the thread’s state is changed to “ready”. From “ready” state, a thread may get selected for execution and its state is changed by the scheduler to “running”. For a given system, there is exactly one thread in “running” state per processing unit (note that a CPU might have multiple processing units - multicore/hyperthreading).
When the “running” thread issues an I/O request, it might block and change its state into “waiting”. Alternatively, a “running” thread’s time slice (quantum) may expire, in which case the thread’s state is changed back to “ready”. A “waiting” thread can move into “ready” state once the reason for its blocking disappears (I.e.; the I/O operation completes). Finally, a “running” thread might execute its last instruction - in which case its state changes to “terminated”.
Operating systems often use heuristics to determine which one of the threads in “ready” state to select for execution. The Windows OS uses a priority-based scheme and maintains 32 ready queues of different priorities.
admitted
scheduler dispatch
exit
ready
running
waiting
I/O or event completion
waiting for
I/O or event

20. 4.1 CreateThread Argument Value pThreadAttributes NULL dwStackSize
lpStartAddress
pfThreadFunc
lpParameter
(LPVOID)a

21. Process Control Block (PCB)
Process ID (PID)
This is an abstract view
Windows implementation of PCB is split in multiple data structures
Parent PID …
Next Process Block
PCB
List of open files
Handle Table
Image File Name
Thread Control Block (TCB)
List of Thread Control Blocks
Next TCB
Program Counter …
Registers …

22. CPU Switch from Thread to Thread
Interrupt or system call
executing
Save state into TCB1
ready or waiting
Reload state from TCB2
Interrupt or system call
ready or waiting
executing
Save state into TCB2
From a processor’s point of view, it executes instructions load from memory dictated by the changing values of the program counter. Over time, the program counter may refer to code in different programs. Each of these programs in execution forms a process with one or multiple threads.
When a thread whose state was “running” is interrupted, the current values of program counter and processor registers are saved in the corresponding thread control block and the the state of the thread is changed to “waiting” or “ready”. The OS is now free to put some other thread in the running state. The program counter and context data for this thread are loaded into the processor register and the thread begins execution.
There might be extra processing required if a context switch happens between threads in different processes. In this case, the mapping of virtual to physical addresses has to updated - which means that the memory management unit (MMU) has to be re-programmed.
Reload state from TCB1
ready or waiting
executing

23. 5.Synchronization CreateEvent/SetEvent CreateMutex/ReleaseMutex
CreateSemaphore/ ReleaseSemaphore
InitializeCriticalSection/DeleteCriticalSection
WaitForSingleObject/WautForMultipleObjects
GetLastError()

24. 5.1 Events HANDLE WINAPI CreateEvent( BOOL WINAPI SetEvent(
__in_opt LPSECURITY_ATTRIBUTES lpEventAttributes,
__in BOOL bManualReset,
__in BOOL bInitialState,
__in_opt LPCTSTR lpName );
BOOL WINAPI SetEvent(
__in HANDLE hEvent );

25. 5.2 Mutex HANDLE WINAPI CreateMutex( BOOL WINAPI ReleaseMutex(
__in_opt LPSECURITY_ATTRIBUTES lpMutexAttributes,
__in BOOL bInitialOwner,
__in_opt LPCTSTR lpName );
BOOL WINAPI ReleaseMutex(
__in HANDLE hMutex );
If a thread already owns a mutex =>WaitForSingleObject does not block

26. 5.3 Semaphores HANDLE CreateSemaphore( BOOL ReleaseSemaphore(
LPSECURITY_ATTRIBUTES lpSemaphoreAttributes,
LONG lInitialCount,
LONG lMaximumCount,
LPCTSTR lpName );
BOOL ReleaseSemaphore(
HANDLE hSemaphore,
LONG lReleaseCount,
LPLONG lpPreviousCount );

27. 5.4 Critical Section
void WINAPI InitializeCriticalSection( __out LPCRITICAL_SECTION lpCriticalSection );
void WINAPI EnterCriticalSection( __inout LPCRITICAL_SECTION lpCriticalSection );
void WINAPI LeaveCriticalSection( __inout LPCRITICAL_SECTION lpCriticalSection );
void WINAPI DeleteCriticalSection( __inout LPCRITICAL_SECTION lpCriticalSection );

28. 6. Virtual Memory VirualAlloc/VirtualFree VirtualLock/VirtualUnlock
SetProcessWorkingSetSize

29. 6.1 Allocation LPVOID WINAPI VirtualAlloc( BOOL WINAPI VirtualFree(
__in_opt LPVOID lpAddress,
__in SIZE_T dwSize,
__in DWORD flAllocationType,
__in DWORD flProtect );
BOOL WINAPI VirtualFree(
__in LPVOID lpAddress,
__in DWORD dwFreeType );

30. x86 Virtual Address Translation
PFN 0 1 2
Page table
selector
Page table
entry selector
Byte within page 3
index
index 4
CR3 5
physical
address
physical
page number
(“page frame
number” or “PFN”) 6 7 8 9 10 11 12
Page Tables
(up to 512 per process,
plus up to 512 system-wide)
Page Directory
(1024 entries)
Physical Pages
(up to 2^20)

31. Virtual Address Translation
The hardware converts each valid virtual address to a physical address
virtual address
Page
Directory
Virtual page number
Byte within page
Address translation (hardware)
Page
Tables
if page
not valid...
page fault
(exception,
handled by
software)
Translation
Lookaside
Buffer
Physical page number
Byte within page
a cache of recently-
used page table entries
physical address

32. 6.1 Allocation Argument Value wSize 4096 lAllocationType
MEM_COMMIT|MEM_RESERVE
flProtect
PAGE_EXECUTE |PAGE_READWRITE

33. 6.2 Lock Memory BOOL WINAPI VirtualLock( BOOL WINAPI VirtualUnlock(
__in LPVOID lpAddress,
__in SIZE_T dwSize );
BOOL WINAPI VirtualUnlock(

34. 7.Memory mapped Files
CreateFileMapping
MapViewOfFile/UnmapViewOfFile

35. Shared and Private Pages
Process A
Process B
Physical
Memory
7FFFFFFF C
For shared pages, multiple processes’ PTEs point to same physical pages C
FFFFFFFF

36. 7.1 CreateFileMapping HANDLE WINAPI CreateFileMapping(
__in HANDLE hFile,
__in_opt LPSECURITY_ATTRIBUTES lpAttributes,
__in DWORD flProtect,
__in DWORD dwMaximumSizeHigh,
__in DWORD dwMaximumSizeLow,
__in_opt LPCTSTR lpName );

37. 7.1 CreateFileMapping Argument hFile INVALID_HANDLE_VALUE,
lpAttributes
NULL
flProtect
PAGE_READWRITE
lpName
_T(“MyMapping.1”)

38. 7.2 MapViewOfFile LPVOID WINAPI MapViewOfFile(
__in HANDLE hFileMappingObject,
__in DWORD dwDesiredAccess,
__in DWORD dwFileOffsetHigh,
__in DWORD dwFileOffsetLow,
__in SIZE_T dwNumberOfBytesToMap );
BOOL WINAPI UnmapViewOfFile(
__in LPCVOID lpBaseAddress );

39. 8.Dynamic Link Libraries
LoadLibrary/FreeLibrary
GetProcAddress
__declspec(dllexport), __declspec(dllimport)
DllMain

40. Address Binding Addresses in source programs are symbolic
Compiler binds symbolic to relocatable addresses
Loader binds relocatable addresses to absolute addresses
Binding can be done at any step:
i.e., compiler may generate absolute code (as for MS-DOS .COM programs)
other object modules
Compiler or assembler
Compile time
Object module
System libraries
Linkage editor
load time
Load module
dynamically loaded system libraries
loaderr
Usually, a program resides on disk as a binary executable file. The program must be brought into memory and placed within a process for it to be executed. Depending on the memory management in use, the process may be moved between disk and memory during its execution.
In-memory binary memory image
execution time (run time)

41. 8.1 Run-Time HMODULE WINAPI LoadLibrary(
__in LPCTSTR lpFileName );
FARPROC WINAPI GetProcAddress(
__in HMODULE hModule,
__in LPCSTR lpProcName );

42. 9.Net Utilities
Ipconfig
Ping
Tracert
Route
Arp
Nslookup
Netstat

43. 9. Opening Browser Plug Network Cable->Broadcast DHCP to config
Type address->use dns server to translate
Have destination IP->use routing table to find next hop
Have IP of next hop->use arp table/protocol to translate destination IP into MAC address
Connect on TCP port 80 and send HTTP GET request
Wait for ack, resend if needed
Obtain HTML content , disconnect and show to a user

44. 10.Sockets Programming Socket Bind Listen Accept Connect Send/Recv
Closesocket

45. 10. Socket Functions Function bind
function associates a local address with a socket.
listen
places a socket in a state in which it is listening for an incoming connection
accept
permits an incoming connection attempt on a socket
connect
establishes a connection to a specified socket
send
sends data on a connected socket
recv
receives data from a connected socket

47. 11.Security OpenProcessToken LookupAccountSid GetTokenInformation
ACL/ACE format/purpose

48. 11. OpenProcessToken
BOOL WINAPI OpenProcessToken( __in HANDLE ProcessHandle, __in DWORD DesiredAccess, __out PHANDLE TokenHandle ); BOOL WINAPI GetTokenInformation( __in HANDLE TokenHandle, __in TOKEN_INFORMATION_CLASS TokenInformationClass, __out_opt LPVOID TokenInformation, __in DWORD TokenInformationLength, __out PDWORD ReturnLength );

49. 11. ACL/ACE

50. 12.Structured Exception Handling
__try
__except
GetExceptionCode()

51. 12.1 Try-except
__try { //guarded code } __except ( expression ) //exception handler code

52. 12.2 Filter Expression Value Effect EXCEPTION_CONTINUE_EXECUTION
Exception is dismissed. Continue execution at the point where the exception occurred
EXCEPTION_CONTINUE_SEARCH
Exception is not recognized. Continue to search up the stack for a handler
EXCEPTION_EXECUTE_HANDLER
Exception is recognized. Transfer control to the exception handler by executing the __except compound statement, then continue execution after the __except block.

53. In additional to system calls you have to understand
Threads vs. Processes
Context switch/Scheduling and related bugs
Choice of synchronization mechanisms
Compile-time vs. Run-time binding of DLL
Physical vs. Virtual Addresses
Virtual Memory Performance Issues
Build IPC using MMF and sockets
Build/explain ACL structure
Build/explain exception handling