1. 计算机系 信息处理实验室 Lecture 4 System Mechanisms (2) xlanchen@03/18/2005

2. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 2 Contents Trap dispatching The executive object manager Synchronization System worker threads Local procedure calls (LPCs)

3. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 3 Object manager EXPERIMENT Exploring the Object Manager

4. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 4 Uniform approach towards: Object protection (C2 security) Charging Object naming Object retention and garbage collection Object access (via handles) Standard object attributes Standard object methods

5. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 5 Executive Objects Process Memory Section Event Timer Object directory Queues Thread File Semaphore Symbolic link Port (registry) key

6. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 6 Executive objects that contain kernel objects

7. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 7 Object Structure

8. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 8 Object properties OM deletes object when: #open handles drops to zero #knl refs drops to zero Obj names Support identification, finding, sharing Hierarchic (per machine) name space Symbolic links, e.g. “ C: ”

9. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 9 Type Objects Process objects and the process type object

10. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 10 EXPERIMENT Viewing the Type Objects

11. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 11 Type Object Attributes Type name Pool type Default quota Access types Generic access rights mapping Synchronization Methods

12. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 12 Object Methods Open--When an object handle is opened Close--When an object handle is closed Delete--Before the object manager deletes an object Query--name When a thread requests the name of an object, such as a file, that exists in a secondary object domain Parse--When the object manager is searching for an object name that exists in a secondary object domain Security--When a process reads or changes the protection of an object, such as a file, that exists in a secondary object domain

13. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 13 Object Handles & Process Handle Table

14. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 14 EXPERIMENT Viewing Open Handles with Nthandle

15. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 15 Structure of a handle table entry

16. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 16 EXPERIMENT Viewing the Handle Table with the Kernel Debugger

17. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 17 Handles and reference counts

18. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 18 Synchronization Mutual exclusion one, and only one, thread can access a particular resource at a time Critical sections

19. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 19 Kernel Synchronization Kernel critical sections For single-processor Simple operating systems: disable all interrupts 2K: raising the processor's IRQL For a multiprocessor spinlock

20. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 20 Using a spinlock

21. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 21 Executive Synchronization Dispatcher objects WaitForSingleObject WaitForMultipleObjects A thread in a Win32 application can synchronize with a Win32 process, thread, event, semaphore, mutex, waitable timer, I/O completion port, or file object Executive resources available only to kernel-mode code aren't accessible from the Win32 API

22. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 22 Waiting on a dispatcher object A thread can synchronize with a dispatcher object by waiting on the object's handle

23. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 23 Selected kernel dispatcher objects

24. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 24

25. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 25 Wait data structures

26. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 26 EXPERIMENT Looking at Wait Queues

27. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 27 System worker threads Three types Delayed worker threads Critical worker threads hypercritical worker threads

28. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 28 EXPERIMENT Listing System Worker Threads

29. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 29 Windows 2000 Global Flags NtGlobalFlag Initialize Gflags.exe allows you to view and change the system global flags

30. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 30 Local procedure calls (LPCs) An interprocess communication facility For high-speed message passing An internal mechanism available only to Windows 2000 operating system components

31. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 31 EXPERIMENT Viewing LPC Port Objects

32. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 32

33. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 33

34. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 34 “Internal” IPC between address spaces, e.g. Transport for local RPC Calls to Win32 subsystem Variants: n <= 256 bytes done inband n > 256 bytes via shmem section n > shmem section – addr-to-addr copy Typically client-server Client connects to servers well-known LPC port Server opens new port and tells client its address

35. 计算机系 信息处理实验室 xlanchen@03/18/2005Understanding the Inside of Windows2000 35 LPC 端口的使用