Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror
Windows Operating Systems Software IT

Inside the Windows Vista Kernel 298

Posted by kdawson
from the deep-tech dept.
Reader trparky recommends an article on Technet (which, be warned, is rather chaotically formatted). Mark Russinovich, whose company Winternals Software was recently bought by Microsoft, has published the first of a series of articles on what's new in the Vista kernel. Russinovich writes: "In this issue, I'll look at changes in the areas of processes and threads, and in I/O. Future installments will cover memory management, startup and shutdown, reliability and recovery, and security. The scope of this article comprises changes to the Windows Vista kernel only, specifically Ntoskrnl.exe and its closely associated components. Please remember that there are many other significant changes in Windows Vista that fall outside the kernel proper and therefore won't be covered."
This discussion has been archived. No new comments can be posted.

Inside the Windows Vista Kernel

Comments Filter:
  • Soft links? (Score:4, Interesting)

    by Libor Vanek (248963) <libor.vanek @ g m a il.com> on Saturday January 27, 2007 @02:19PM (#17784672) Homepage
    From the article: "...the symbolic file link (or as it's called in UNIX, the soft link) finally arrives in Windows Vista." - anybody heard "soft link"? Me (after 10 years of using Linux) never...
    • by Virak (897071)
      I've heard "soft link" a few times. While not as popular as symbolic link/symlink, it still sees a fair bit of usage [google.com].
    • Re:Soft links? (Score:5, Informative)

      by tuffy (10202) on Saturday January 27, 2007 @02:32PM (#17784768) Homepage Journal
      The symlink(2) manpage mentions that they're also known as "soft links", as opposed to the hard links created by link(2). It's not a very common usage, though.
    • Re:Soft links? (Score:4, Informative)

      by Moridineas (213502) on Saturday January 27, 2007 @02:33PM (#17784780) Journal
      Absolutely. I guess "symbolic link" is the more common term, but soft link is hardly rare, and differentiates a link from a hard link. (think ln -s here)

      From wiki:

      Soft Link [wikipedia.org] and Hard Link [wikipedia.org]
    • by NuShrike (561140)
      Since using BSD from 1999, plenty of times. Hard links (ln), soft links (ln -s) aka symbolic links. It's been pretty difficult not to know. Maybe the Linux man pages aren't as clear?
      • by Eideewt (603267)
        They're pretty clear:

        "A symbolic link (also known as a soft link) may point to an existing file or to a nonexistent one; the latter case is known as a dangling link."
    • by loconet (415875)
      I've heard them be called soft link many times. In fact, ln creates hardlinks by default and the -s switch makes it create "soft" ones.

      On the "symbolic file links finally arrives to Windows Vista.."

      Has it really arrived? really? Considering only Administrators have access to creating them by default?
    • Re: (Score:3, Insightful)

      by doshell (757915)

      The usage is established, but "symlink" or "symbolic link" are far more common:

      Wikipedia: Wikipedia article [wikipedia.org] (redirects to "Symbolic link" article)

      Google hits: ~1M hits for ("symbolic link" OR "symlink") unix [google.com] vs. ~419K hits for ("soft link" OR "softlink") unix [google.com] ("unix" appended to avoid potentially irrelevant matches)

      Ocurrences in manpages (my Gentoo Linux system):

      $ find /usr/share/man -type f -name '*.gz' | xargs zcat | grep -i "soft link" | wc -l
      27
      $ find /usr/share/man -type f -name '*.gz' | xa

      • by guruevi (827432)
        well, you forgot this IS slashdot so somebody else will find a shorter way to do this, it will look ugly, probably done in perl and thus unreadable. If you want to do it in shell script, you could have used zgrep (not all distro's have it) and/or used grep to count the lines and recurse through the files.
    • by donaldm (919619)
      Of course in Unix/Linux there are two types of links one is a hard link and the other a soft link and have been around in Unix since the early 1970's. There is another type of link that is called a context dependent symbolic link (Tru64 Unix or OSF1) which is a way of assigning a directory or file to a specific cluster member. Very useful in a clustered file-system since each cluster member may need its own log and configuration files or even specific directory that has identical names to those used by the
  • Finally... (Score:4, Insightful)

    by physicsnick (1031656) on Saturday January 27, 2007 @02:25PM (#17784716)
    Everytime I read anything about Vista's new features, I hear myself saying "fucking finally" like half a dozen times. Symlinks? Cancelling I/O? These are things other, better operating systems have had for over a decade. Anyone wanna start a pool for when they'll roll out a patent for symlinks?
    • Re:Finally... (Score:5, Informative)

      by cnettel (836611) on Saturday January 27, 2007 @02:28PM (#17784742)
      Cancelling I/O has been in Windows for long, "just" not always done properly. I have seen similar issues while killing processes in other OSes where they are stuck in some I/O. One reason for why this happens more frequently in Windows (in addition to bad drivers/a complicated driver model) is the fact that asynchronous I/O is so common. That way, you might not see the that the IO got stuck until you try to kill the process.
      • Re:Finally... (Score:5, Informative)

        by RAMMS+EIN (578166) on Saturday January 27, 2007 @05:22PM (#17785800) Homepage Journal
        `` I have seen similar issues while killing processes in other OSes where they are stuck in some I/O.''

        Oh, the horrors! I've had this happen to me many times, as well, especially on Linux. Not even a kill -9 would get rid of the wedged process. Why is there even such a thing as "non-interruptible sleep"? If I don't need the process anymore, I should be able to get rid of it no matter what.

        And wedged drivers, too. I think you can still see this for yourself by doing I/O with some USB device, and then yanking it out while the I/O is in progress. You get at least one process that you can't kill (I guess the comatose state causes ethical issues), and probably a driver you can't unload (although maybe new kernels allow you to do that). If you're "lucky", you get a whole lot of hardware devices that you can't use anymore, and any program that tries to gets into the dreaded D state.
        • by xenocide2 (231786)
          "Oh, the horrors! I've had this happen to me many times, as well, especially on Linux. Not even a kill -9 would get rid of the wedged process. Why is there even such a thing as "non-interruptible sleep"? If I don't need the process anymore, I should be able to get rid of it no matter what."

          I haven't yet read the internals of the linux kernel, but I understand that disk dma requests are a major source of non-interruptible sleep. I imagine it has to do with locking the RAM the disk is going to write to safe f
    • Re:Finally... (Score:4, Interesting)

      by Anonymous Coward on Saturday January 27, 2007 @02:56PM (#17784924)
      How much praise was adorned on Linux when it got an O(1) scheduler? NT has had it for over a decade.
      • Re:Finally... (Score:5, Informative)

        by ultranova (717540) on Sunday January 28, 2007 @04:20AM (#17788566)

        How much praise was adorned on Linux when it got an O(1) scheduler? NT has had it for over a decade.

        Yes. A round robin scheduler, which runs every task for exactly 2 clock ticks except for foreground tasks which are run for 6 (or is this an XP improvement ?) - assuming there's no interrupts occurring during those ticks, of course - and not paying any attention to whether the task is IO- or CPU-bound. It performs absolutely shitty if you have anything heavy running in the background (say, POV-Ray rendering an image while you try to browse the Net). Praising that to be "O(1) scheduler" is about the same as calling the Goatse picture "art": sure, it may be technically true, but...

        What Linux was praised was getting a scheduler that handles 40 priority levels, real-time tasks, and multiple CPUs (500+, in some cases) while retaining both interactivity and high throughput, and doing all this in O(1) time. No version of Windows has ever gotten even close.

    • by Animats (122034) on Saturday January 27, 2007 @02:59PM (#17784938) Homepage

      Much of this new stuff sounds like features of QNX. QNX has a "sporadic scheduler", for when you need things like 10ms of CPU every 100ms. QNX has had I/O cancellation for years. In QNX, you can set a timeout on any system call that blocks. If you set a 35ms timeout on a write, after 36 milliseconds, you'll have control back. Very useful in real-time systems where you're doing something less important, like logging, that should never take very long but, in some trouble condition, might. QNX has had prioritized I/O for years, too.

      It all works, too. I've done compiles on QNX while running a real time program on the same machine, without the real time program missing a deadline.

      Of course, in Vista, it's all more complicated.

    • by canuck57 (662392)

      Anyone wanna start a pool for when they'll roll out a patent for symlinks?

      They might! But it would be embarrassing for M$ if the judge to hear that Windows as the last OS to get them and that UNIX supplied the concept.

      But I am also amazed at how "excited" people are over new-4-Windows features like this. Might as well jump right into Linux/UNIX and get it all now. I will never forget when W98(?) said it would not check the disk on boot if it was previously shutdown nicely. UNIX has this for a decade

      • Re: (Score:3, Insightful)

        by dave562 (969951)
        But I am also amazed at how "excited" people are over new-4-Windows features like this. Might as well jump right into Linux/UNIX and get it all now.

        The longer operating systems are around for, the more heterogenuous they will become. Although Linux/UNIX might have a bunch of features that Microsoft is getting around to implementing, similar arguments can be made in the other direction as well. The fact of the matter is that computer users as a whole will demand certain things from their operating system

    • Re: (Score:3, Insightful)

      by drsmithy (35869)

      Everytime I read anything about Vista's new features, I hear myself saying "fucking finally" like half a dozen times.

      Funny, I think exactly the same thing almost every time I hear about the latest "innovation" in Linux or OS X.

  • by tgatliff (311583) on Saturday January 27, 2007 @02:28PM (#17784734)
    Isnt this like entering the belly of the beast? I will save you some time in reading the article.

    Proper care for your Vista "Beast"
    1) Feed it plenty of CPU cycles. Preferrably multiple cores.
    2) Give it obsene amounts of memory. 2.5G preferable.
    3) This one seems to really enjoy Video Ram as wll, probably it tastes better. 256M advised.
    4) Keep feeding it a constant supply of disk space. Interestingly enough, this version seems to consume HD space simply with doing nothing.

    Thats the basics folks. Give your Vista beast what it needs and you should have a kind of good experience. At least for at least 6 months or so... Then you must slay the beast and re-install.. :-)
    • Re: (Score:3, Interesting)

      by bwd234 (806660)
      Hell with all that...I'm sticking with my Windows 2000! Best M$ OS I've run yet. More stable than 95 or 98 and w/o all the wastefull eye candy of XP. If it does someday become totally obsolete, I guess I'll have to switch to Linux or whatever, but in the meantime it's 2k all the way!
    • by laffer1 (701823)
      You don't know how right you are. I'm running Vista Ultimate x64 RTM right now. Its peppy for regular tasks.

      AMD and NVIDIA are not shipping OpenGL drivers yet. NVIDIA's is very slow and you can not play most games like Enemy Territory (quake3 based). WoW works.

      Windows consumes half my ram on startup. I have 2.5GB of ram. Granted I have a NVIDIA 7300 GS w/ turbocache too.

      My system is:
      Pentium D 805 (dual core 2.6Ghz)
      2.5GB PC5300 DDR2
      SATA II Hitatchi disk.
      Intel DP965LT Motherboard
      NVIDIA Geforce 7300 GS 2
      • Re: (Score:2, Informative)

        by mobby_6kl (668092)
        Look carefully at the RAM usage in task manager. Most of the "used" memory is cache - it will be freed immediately when needed. I'm running Vista with a 1gb of ram (and a 2.6 Northwood P4), and real memory usage is around 300mb. I did turn off the Defender and Sidebar, but didn't go through any serious service cleanup, so I probably saved 20-30 megs here.

        The NVIDIA drivers suck, but UT2004 and Warhammer 40000 Dawn of War work fine, if slower than in xp/2003. The old Ghost Recon and R6 games work ok too. Di
    • I guess multiple cores are more than your "average core" [sorn.net]
  • Screenshot (Score:5, Funny)

    by Dirtside (91468) on Saturday January 27, 2007 @02:35PM (#17784796) Journal
    They actually have a screenshot of what it looks like inside the Vista kernel. [atari-spie...itungen.de]
  • Whoa (Score:5, Interesting)

    by Sloppy (14984) on Saturday January 27, 2007 @02:49PM (#17784888) Homepage Journal
    I think we've finally seen the very first actually interesting Slashdot story about Vista. About fucking time.
    • Re:Whoa (Score:5, Funny)

      by mobby_6kl (668092) on Saturday January 27, 2007 @03:23PM (#17785078)
      What, you don't find outrageous articles based on misinformation and speculation, full of FUD and pure lies, written by people who know nothing about what an OS consists of besides window decorations and shiny progress bars, interesting?

      What are still you doing here?
      • written by people who know nothing about what an OS consists of besides window decorations and shiny progress bars

        Are you kidding? You think that the design staff at Microsoft writes most of the Vista articles posted on Slashdot?
  • by GodWasAnAlien (206300) on Saturday January 27, 2007 @03:01PM (#17784952)
    Black box OS kernels like Windows can really never be disclosed. All you can really do is make some guesses or have an insider reveal some limited details.

    For this reason, OS classes in school will be based on Linux,BSD,Minux,or even ReactOS. With all of these, if want to really know how it works, there is the code.

    The secret-software-business is quite different that the shared discoveries of the scientific method that works well in education and science.

    Historically, the open ones will be the only ones that survive. In 50 years: You want to know how DOS worked in the 1980s? Well, no source is available. But freedos provides a good example of how it worked. You want to know how some random UNIX worked. Well the source to that specific one is not available, but BSD and Linux are a good examples of how it worked. You want to know how Windows-2000 worked? Well, no source code is available, but ReactOS provides a close approximation of how it worked.

    • by dioscaido (541037) on Saturday January 27, 2007 @03:37PM (#17785176)
      True in theory, but Universities can license the source code of the windows kernel for academic purposes:

      http://www.microsoft.com/resources/sharedsource/Li censing/researchkernel.mspx [microsoft.com]
      • Re: (Score:2, Interesting)

        And anybody at said university who looks at said source code for any length of time becomes 'contaminated' and can't contribute to any similar non-Microsoft project ever again.
      • by oglueck (235089)
        So if a prof wants to use the MS kernel for his lectures, he first needs to convince his university to license this beast. The Windows kernel is not exactly a small code base. To understand it the prof then needs to look at it for, say, a year before he can give any reasonable lecture. It's a high risk for the prof because he doesn't know what the kernel will look like and if it will be useful for him. Sorry, things just don't work that way.
        • Re: (Score:3, Interesting)

          by hughk (248126)

          I disagree. I have not had the dubious pleasure of seeing Windows source code but I have worked with older monolithic closed source kernels such as OpenVMS where at various points I had access. With a good book about the kernel, finding your way around wasn't a major issue. Some items were complex but you could easily extract, for example, material for a course on say lock management, I/O or scheduling.

          A prof would want a commercial system to counterpoint something like Linux. However, if I was teaching,

        • Re: (Score:3, Insightful)

          by nuzak (959558)
          > To understand it the prof then needs to look at it for, say, a year before he can give any reasonable lecture.

          Whereas professors are born knowing Linux, or magical documentation fairies just wave their little wands and give the professor knowledge about the subject.

          This might be a wild guess, but a professor teaching OS architecture might already know a thing or two about the OS architecture of the OS implemented by the source he's looking at.

    • by jadavis (473492) on Saturday January 27, 2007 @03:37PM (#17785180)
      The secret-software-business is quite different that the shared discoveries of the scientific method that works well in education and science.

      Although you're right about closed software, computer science as a whole is actually much more open in many respects than some other scientific fields. In particular, the medical and biological science fields are quite closed-off. Even physics is somewhat closed-off, not by design, but because the equipment required to perform experiments is so expensive.

      Few computer science experiments take more than a couple thousand in capital investment. Also, if you have questions, you can often discuss your experiments, ideas, data, findings, etc. with an expert (or even industry leader) simply by signing up to a mailing list or going on IRC.
    • Re: (Score:2, Insightful)

      by blackpaw (240313)
      Bollocks, the public windows DDK by its nature reveals the kernel architecture pretty explicitly. Driver writers cannot operate without good documentation on the kernel.
  • by jhines (82154) <john@jhines.org> on Saturday January 27, 2007 @03:06PM (#17784978) Homepage
    The subject line made me think instantly of the old Adventure game,

    "you are in a maze of twisty passages all alike"

    sent a shiver up the spine.
  • However, because not all applications may handle symbolic links correctly, creating a symbolic link requires the new Create Symbolic Link privilege that only administrators have by default.

    Why would they do this? Just make the default be the deletion of the symlink instead of the target. And why would you need this permission if you already have permission to modify the directory (to create the link) and the permission to read the target? Instead they go and take the ability of normal users (meaning most p

    • 99.9% of Windows users will not know what a symbolic link is, and even less will know how actually enable the feature for non-administrators. This means that no end-user application can ever use them. A lot of work for nothing - good job Microsoft.

      They should have added an API call to tell kernel32, "hey, I know how to use symbolic links, so let me use them".

      Melissa
    • by oglueck (235089)
      Why would they do this?
      For security probably. On Unix programmers are (should be) aware of the fact that any file can possibly by a symlink. Especially processes with higher privileges must check if a filename that is passed to them as user input is a symlink to a file that is not normally under control of that user. So introducing this feature and running code that isn't symlink safe introduces a security risk.
      • by nuzak (959558)
        Especially processes with higher privileges must check if a filename that is passed to them as user input is a symlink to a file that is not normally under control of that user.

        This has got to be the most succinct wording yet of the "confused deputy" problem. There's just no good reason that a process should be running with higher privileges if it has to constantly second-guess itself in order to not actually use them. Monolithic permission levels just suck.

      • by spitzak (4019)
        That is not exactly the problem. If a privledged program can take an arbitrary filenam, and does a stat to see if the user has access to the file, the test will work for symbolic links as well. If they don't do such a test they are broken and can be fooled without symbolic links.

        The problem is when the privledged program generates it's *own* filename that it assummes is going to be a new file or something owned by the user or nobody, but the user has cleverly set a symbolic link at the name he knows the pri
    • by spitzak (4019)
      The problem is that they didn't ever really support "hard" links either. In DOS if you tried to remove a directory that was not empty, you got an error. This stupid behavior persists even though they have long supported filesystems where unlinking is possible. So all the file management programs that want to delete a directory will recursively delete every file in it. This is probably not what is expected if the user tries to delete a symbolic link to a directory.

      There are plenty of other ways to fix this,
  • by Myria (562655) on Saturday January 27, 2007 @04:35PM (#17785576)
    The article doesn't mention that process startup is now quite different from the other versions of Windows NT.

    In previous versions of NT, process creation was quite different from systems such as UNIX. The system call NtCreateProcess creates a "blank" process with nothing in it but ntdll.dll and the new .exe file mapped into memory. No stack is allocated, and no threads are created. In normal process creation, the parent process actually uses the debugger API calls to allocate memory for the stack into the new process's address space, copies the command line and environment into the new memory, and creates the initial thread pointing at kernel32!BaseProcessStartupThunk. It resumes the thread and off it goes. (NT has no concept of environment or command line at the kernel level.)

    This changed in Vista for one reason: DRM. Microsoft made it so that certain processes, namely wmplayer.exe and halo2.exe, cannot be a target of the debugger API calls for obvious reasons. It ignores privilege level in blocking the API. If the old method of starting processes were used, then the parent process could start wmplayer.exe with patches to steal the DRM keys or dump decrypted data to disk. Vista's kernel now does the entire initialization for these processes to close this hole.

    By the way, Microsoft needs to change that web page so that it doesn't select Spanish over English if you have Spanish listed as an acceptable language in your browser, even if English is higher in the list. This happens for both IE7 and FF2.

    Melissa
  • by physicsnick (1031656) on Saturday January 27, 2007 @04:36PM (#17785578)
    Having symlinks in the Vista kernel is nice and all, but Vista doesn't seem to offer a way to create these in Explorer. Who wants to break open a command line just to create a symlink?

    Correct me if I'm wrong, but don't people criticize Linux all the time of a lack of GUI utilities in comparison to Windows? Yet when I drag a file somewhere in KDE, I can just click on "Link Here" and poof, I've got a symlink. Why have I not heard a single complaint about the lack of a user-friendly way to do this in Vista?

    Furthermore, you need to have Administrator access (or use Administrator to give yourself the priviledge) to create a symlink, "because not all applications may handle symbolic links correctly". Doesn't this seem broken to anyone? Or at the very least, worrysome?
    • Having symlinks in the Vista kernel is nice and all, but Vista doesn't seem to offer a way to create these in Explorer. Who wants to break open a command line just to create a symlink?

      That's how it works in OS X and everyone gets on just fine. Symlinks, unlike OS X's aliases, easily break. You don't want normal users creating them and then complaining when suddenly they don't work any more.
      • by Hes Nikke (237581)
        but normal users in the terminal can go right ahead with making symlinks... in fact, the command line doesn't even know what to do with aliases, yet the GUI handles symlinks fine...

        advantages:
        symlink - works in both GUI and terminal, works across platforms with linux, bsd, and anything else that supports symlinks
        alias - doesn't break as easily
        vista symlink - ????? (possibly cross platform)
        shortcut - attach command line parameters, keyboard shortcuts

        disadvantages:
        symlink - breaks easily
        alias - doesn't work i
    • Furthermore, you need to have Administrator access (or use Administrator to give yourself the priviledge) to create a symlink, "because not all applications may handle symbolic links correctly". Doesn't this seem broken to anyone? Or at the very least, worrysome?

      It's ultimately an application compatibility problem. You don't want some pre-Vista app to blow away the user's stuff because the app recursively deleted a folder that contained a user-created symbolic link. It's fine on Unix OSs because they've h

    • It certainly sounds broken to _me_. Why wouldn't all apps handle symlinks correctly?

      In Mac OS 9, and in 8, and 7... when did they add aliases (the Mac OS equivalent to symlinks) anyway, I think it was 7... all the standard file routines, including the "open file" and "save file" dialogs, automatically resolved aliases.

      A Mac application doesn't need to know anything about aliases to handle them "correctly." It is only a Mac application that needs to open an alias file directly as a file that needs to do some
  • Is it true? (Score:4, Funny)

    by BillGatesLoveChild (1046184) on Saturday January 27, 2007 @07:40PM (#17786706) Journal
    Is it true that every line in the source contains comments like this?

    ; Hah! Take that user!
    ; Oh nice try but we thought of that!
    ; Clearly they are trying to steal this.
    ; Thief! Thief!
    ; MP3s have no DRM. Refuse to play.
    ; Block association away from Windows Media Player
    ; SONY rootkit plugs in here
    ; Powered up. Now lets get today's authorization.
  • I dont think anyone can really know exactly what is in the Windows Kernel when it is closed source.
  • by gillbates (106458) on Saturday January 27, 2007 @11:04PM (#17787614) Homepage Journal

    Ok, I'm not trying to troll, but the latest CPU scheduling algorithm is just yet another example of how when it comes to Windows, the design is done more by the marketing department than by the engineers. At least we hope the engineers would have raised objections!

    I understand their CPU cycle counting is intended to improve fairness between applications, but the proposed scheme will have just the opposite effect. Consider, for example, that interrupts aren't counted against a process' cpu usage. All well and good in theory, but the practical result is that a process which is I/O intensive - that is, one which causes interrupts to occur - will actually run much longer than it would otherwise. So, the problem of one I/O intensive process locking out all of the other applications will only get worse in Vista.

    And the interesting thing is that this will actually give a subtle priority boost to multimedia applications, without them having to raise their priority level. IOTW, your multimedia app gets realtime priority whether you asked for it or not.

    Well intentioned, yes. But also naive.

Our policy is, when in doubt, do the right thing. -- Roy L. Ash, ex-president, Litton Industries

Working...