University of Baghdad
College of Engineering
Department of Computer
Windows Operating
System Architecture
By the undergraduate student:
Ghadeer Hayder Abood
Submitted to:
Dr. Hamid M. Ali
2020
Abstract
To troubleshoot issues on Windows Operating System (OS), you must be
recognizable with the essential architecture of the OS. But first, you should
understand the concepts of OS and take a look at windows OS.
Operating System
An operating system (OS) is a program that manages computer hardware. Figure 1.
shows the placement of the operating system. At the bottom is the hardware, which,
in many cases, is itself composed of two or more layers. The lowest level contains
physical devices, consisting of integrated circuit chips, wires, power supplies,
cathode ray tubes, and similar physical devices.
Figure 1. A computer system consists of hardware, system programs, and application
programs. [1]
Windows: An Overview
The roots of Windows reach back to the late 1980s. The original Windows was built
on extensions of the DOS codebase written for single-users running only a few
applications and lacked many standard OS features. Starting in 1988, Microsoft
began the development of a new codebase for Windows, called NT. When Windows
XP released in 2001, Microsoft moved to NT as its single version of Windows for
general-purpose computing and began to deprecate DOS-based Windows. [2]
Understanding the OS Architecture
The architecture of an OS characterizes how it works rather than what it can do. The
features characterize what it can do, but those features must work on beat of an
operational technique. This technique is the architecture. The current Windows OS
architecture is based on the initial architecture within the Windows NT OS, to begin
with, released in 1993. Windows 7, building on changes included within the less
prevalent Windows Vista, presents critical changes in a few regions of the
architecture.[3]
Windows Operating System Architecture
Notice the line dividing the user-mode and kernel-mode parts of the Windows OS.
The boxes above the line shows user-mode processes, and the components under the
line are kernel-mode operating system services. User-mode threads execute in a
protected process address space (although while they are executing in kernel mode,
they have access to system space). system support processes, service processes,
client applications, and environment subsystems each have their own private process
address space. [4]
Figure 2. The basic Windows architecture components. [3]
Figure 2. shows several components in addition to Kernel mode and User mode:
1- System support processes include system processes that do not run as services.
These include processes like the logon process (WINLOGON.EXE) and the
Session Manager subsystem (SMSS.EXE). The Session Manager is the first
User mode process that starts when the OS loads. The Session Manager
launches environment subsystems and the WINLOGON.EXE process. [3]
2- Service processes that host Windows services, such as the Task Scheduler and
Print Spooler services. Facilities generally have the requirement that they run
independently of user logons. Many Windows server applications, such as
Microsoft SQL Server and Microsoft Exchange Server, also include
components that run as services. [4]
3- User applications, which can be one of the following types: Windows 32-bit
or 64-bit, Windows 3.1 16-bit, MS-DOS 16-bit, or POSIX 32-bit or 64-bit.
Note that 16-bit applications can be run only on 32-bit Windows. [4]
4- The environment subsystems, and the subsystem dynamic link libraries
(DLLs), which are defined next, work together to allow different application
types to function on the system. For example, the Windows 32-bit
environment subsystem allows 32-bit Windows applications to work on a 64-
bit edition of Windows 7. This 32-bit environment subsystem will make calls
to subsystem DLLs, and the subsystem DLLs may also communicate back
with the environment subsystem if communication with the application is
necessary. [3]
5- Subsystem DLLs , The last User mode component, is the subsystem DLLs.
This translate application function calls into internal native system service
calls. The subsystem DLLs communicate with the Kernel-mode processes on
behalf of the applications and may communicate with the applications through
the environment subsystems as well. [3]
6- The Windows executive contains the base operating system services, such as
memory management, process and thread management, security, I/O,
networking, and interprocess communication. [4]
7- Kernel While the executive is in charge of process and thread management.
The kernel is in charge of thread scheduling. It decides which thread gets
processor time and on which processor it gets time at any moment. It is also
responsible for synchronization when multiple processors are used and for
interrupt handling through the interrupt objects, which work with the I/O
Manager. [3]
8- Device drivers are Kernel-mode components that provide a communication
interface between the I/O Manager within the executive and the actual
hardware for which they are written. Device drivers place calls to the
Hardware Abstraction Layer, described next, to communicate with the
hardware. Device drivers may be used to communicate with specific hardware
or with filesystems, networks, and other protocols. [3]
9- Hardware Abstraction Layer (HAL) The HAL does exactly what its name
implies. It abstracts or disconnects the OS from the core hardware, such as the
processor architecture. Because of the HAL, Windows can run on systems that
support 32-bit processing (x86) or 64-bit processing (x64). Additionally, with
the x86 processors, it can run on either Advanced Configuration and Power
Interface (ACPI) PCs or Advanced Programmable Interrupt Controller
(APIC) PCs. [3]
Table 1. lists the file names of the core Windows operating system components.
TABLE 1. Core Windows System Files [4]
Several files work together to provide the core functionality of the Windows OS.
These files include the following:
ADVAPI32.DLL One of the primary Windows subsystem DLLs providing access
to APIs for Registry access, system shutdowns and restarts, and management of user
accounts.
GDI32.DLL One of the primary Windows subsystem DLLs providing graphics
functions.
HAL.DLL The Hardware Abstraction Layer (HAL) DLL that allows the Windows
OS to run on different hardware platforms.
KERNEL32.DLL One of the primary Windows subsystem DLLs providing kernel
functions.
NTDLL.DLL The DLL that exposes many of the Windows native API functions to
User mode applications.
NTOSKRNL.EXE The kernel image for the Windows OS; the kernel is responsible
in part for process and memory management.
NTKRNLPA.EXE The same as NTOSKRNL.EXE, but used on systems with
Physical Address Extension (PAE) support.
USER32.DLL One of the primary Windows subsystem DLLs providing access to
the keyboard and mouse as well as window management (the actual application
windows as opposed to the OS name).
WIN32K.SYS The Kernel-mode portion of the Windows subsystem. [3]
Symmetric Multiprocessing
one of the designing goals of the key for Windows that it had to run really good on
multiprocessor computer systems. Windows is a symmetric multiprocessing (SMP)
OS. There is no master processor in the operating system, as well as user threads,
can be scheduled to run on any processor. Also, all the processors share just one
memory space. This model contrasts with asymmetric multiprocessing (ASMP), in
which the operating system typically selects one processor to execute OS kernel code
while other processors run only user code. The differences in the two
multiprocessing models are illustrated in Figure 3.
FIGURE 3. Symmetric vs. asymmetric multiprocessing. [4]
Now that we’ve looked at the high-level architecture of Windows let’s delve deeper
into the internal structure and the role each key operating system component plays.
Figure 4. is a more detailed and complete diagram of the core Windows system
architecture and components than was shown earlier in figure 2. Note that it still
does not show all parts (networking in particular). [4]
Environment Subsystems and Subsystem DLLs: The part of an environment
subsystem is to uncover a few subsets of the base Windows official system
administrations to application programs. Each subsystem can give get to diverse
subsets of the basic functions in Windows. This means that a few things can be done
from an application built on one subsystem that can’t be done by an application built
on another subsystem.
FIGURE 4. Windows architecture. [4]
When an application calls a function in a subsystem DLL, one of three things can
occur:
a- The work is completely executed in client mode interior the subsystem DLL.
In other words, no message is sent to the environment subsystem process, and
no Windows official system services are called.The function needs one or
more calls to the Windows executive.
b- The function requires a few works to be drained the environment subsystem
process. (running in user mode, The environment subsystem processes, are
mindful for keeping up the state of the client applications running beneath
their control.) In this case, a client/server request is made to the environment
subsystem by means of a message sent to the subsystem to perform a few
operations. The subsystem DLL at that point holds up for an answer sometime
recently returning to the caller.
Windows Subsystem
In spite of the fact that Windows was outlined to support multiple, independent
environment subsystems, from a commonsense point of view, having each
subsystem execute all the code to handle windowing and display I/O would result in
a huge sum of duplication of system functions that, eventually, would adversely
affect both system estimate and performance. The Windows subsystem consists of
the following major components:
• Creating and deleting processes and threads
• Parcels of the bolster for 16-bit DOS virtual machine (VDM) processes (32-bit
Windows only)
• Side-by-Side (SxS)/Fusion and manifest support
• Other miscellaneous functions—such as GetTempFile, DefineDosDevice,
ExitWindowsEx, and several natural language support functions
A kernel-mode device driver (Win32k.sys) that contains the following:
• The window manager, which controls window displays, manages screen output;
collects input from a keyboard, mouse, and other devices; and passes user messages
to applications.
• The Graphics Device Interface (GDI), that is a library of functions for graphics
output devices. It includes tasks for line, figure drawing and text and for graphics
manipulation.
• Wrappers for DirectX support that is implemented in another kernel driver
(Dxgkrnl.sys).
• The console host process (Conhost.exe), which provides support for console
(character cell) applications.
Subsystem DLLs (such as Kernel32.dll, Advapi32.dll, User32.dll, and Gdi32.dll)
that translate documented Windows API functions into the appropriate and mostly
undocumented kernel-mode system service calls in Ntoskrnl.exe and Win32k.sys.
Graphics device drivers for hardware-dependent graphics display drivers, printer
drivers, and video Miniport drivers.
Applications call the standard User functions to make user interface controls, such
as windows and buttons, on display. The window manager communicates these
demands to the GDI, which passes them to the design device drivers, where they are
designed for the display device. A display driver is combined with a video Miniport
driver to complete video show back.[4]
Windows Compared to Other OS
The architecture of Windows is exceptionally comparable to other operating
systems, counting Linux and Mac OS X. A key contrast is within the region of design
processing. Windows includes design capabilities within the Kernel mode of the OS,
which can possibly move forward illustrations performance. Linux does not
incorporate the design functions within the kernel, which expels those capacities
from the core OS and can possibly improve stability. The Mac OS X OS is based on
BSD Unix. This flavour of Unix has been around for a long time. In any case, the
hardware on which you run it nowadays isn't a long time ancient, and thus, the length
of improvement time does not automatically result in progressed stability. For
illustration, Windows has been created since the official Microsoft declaration in
1983. Hence, the length of advancement history is no diverse when comparing
Windows with any other OS. Apple gives an open-source version of its core OS
known as Darwin. Darwin is the most widely used open-source version of Darwin
is PureDarwin, which is available at [5]. [6][7]
Conclusion
The architecture allows a system to use multiple operating systems simultaneously,
and to use multi-core processors flexibly. This report presents windows operating
system architecture for future information appliances.
References
[1] A. S. Tanenbaum and A. S. Woodhull, Operating Systems Design and
Implementation (3rd Edition). .
[2] A. Polze and D. Probert, “Teaching Operating Systems : The Windows
Case,” pp. 298–302, 2003.
[3] T. Windows, “Windows Operating Systems Overview Discovering the
History of Windows Identifying Windows interfaces Understanding the OS
architecture,” pp. 1–22.
[4] M. Russinovich and D. A. S. A. Ionescu, Windows Internals, Sixth Edition,
Part 1, Sixth edit. Redmond, Washington 98052-6399: Microsoft Press A
Division of Microsoft Corporation One Microsoft Way.
[5] “PureDarwin | Moving the Darwin Community in the Right Direction!”
http://www.puredarwin.org/ (accessed Jul. 22, 2020).
[6] “Linux vs Windows (a comparison).”
https://www.michaelhorowitz.com/Linux.vs.Windows.php (accessed Jul. 22,
2020).
[7] “Windows vs. Linux vs. OS X | CIO.”
https://www.cio.com/article/2439265/windows-vs--linux-vs--os-x.html
(accessed Jul. 22, 2020).
