User Mode versus Kernel Mode
In Windows (and most OSs), there is a distinction between code that is running in user mode, and code that is running in kernel mode, because if all programs ran in kernel mode, they would be able to overwrite each others' memory and possibly bring down the entire system when they crashed.
This distinction has roots in lower levels; for example Intel CPUs have modes of operation called rings which specify the type of instructions and memory available to the running code:
• Ring 0 (kernel mode) full access to every resource, used by the Windows kernel
• Rings 1 and 2: customized levels of access, generally used by VMs
• Ring 3 (user mode) restricted access to resources
Virtual Memory
Each process has its own "virtual" memory space and resources. Its memory is "virtual" because the process thinks it has a large range of contiguous addresses; but in reality this is implemented by dividing RAM into chunks called pages (4 KB on x86 systems) and having its active pages scattered around RAM and inactive pages stored on disk. The CPU has a transparent mechanism for translating virtual addresses to physical addresses through a page table which the OS sets up. Virtual memory is useful because:
• A process cannot access the memory of other processes
• Each page can have different protection settings (read-only, read-write, kernel-mode-only, etc.)
• Inactive pages can be paged out to disk and retrieved when needed. This is also done when the system is low on RAM.
User Mode
In this mode, programs cannot modify pages directly and so have no way of affecting other processes except through their API. Programs in thismode also cannot interfere with interrupts and context switching.
Kernel Mode
When Windows is first loaded, the Windows kernel is started. It runs in kernel mode and sets up paging, virtual memory, interrupt handlers. Except System which runs in kernel mode, every other process runs in user mode. The kernel then creates some system processes in user mode, but switches back to kernel mode when it is interrupted by interrupts (events such as timers, keyboard, hard disk I/O). Whenever an interrupt occurs, the CPU stops executing the currently running program, switches to kernel mode, and executes the interrupt handler. The handler saves the state of the CPU, performs some processing relevant to that event, and restores the state of the CPU (possibly switching back to user mode) so the CPU can resume execution of the program.
Interrupts
When a program calls a Windows API function, that itself calls a different API: the Native API. Then it either triggers an interrupt or executes instructions such as
Context Switching
Programs may let the OS to switch to another program because they are waiting for something (human input, hard disk). These programs are known as unrunnable programs, and since they make calls to the kernel to wait for something, the kernel knows to perform context switching to allow another program to run. This is done by:
1. saving the state of the current program (including registers)
2. deciding which program to run next
3. restoring the state of that program
Preemption
It is setting a timed interrupt that will invoke context switching so that if a process (or thread) runs for more than a certain period of time (a process time slice or thread quantum), the OS will switch the context to another program. The time slice that is used may be different for each process.
📚 Summary of: Windows Programming » User Mode versus Kernel Mode
#Windows #Windows_Programming
In Windows (and most OSs), there is a distinction between code that is running in user mode, and code that is running in kernel mode, because if all programs ran in kernel mode, they would be able to overwrite each others' memory and possibly bring down the entire system when they crashed.
This distinction has roots in lower levels; for example Intel CPUs have modes of operation called rings which specify the type of instructions and memory available to the running code:
• Ring 0 (kernel mode) full access to every resource, used by the Windows kernel
• Rings 1 and 2: customized levels of access, generally used by VMs
• Ring 3 (user mode) restricted access to resources
Virtual Memory
Each process has its own "virtual" memory space and resources. Its memory is "virtual" because the process thinks it has a large range of contiguous addresses; but in reality this is implemented by dividing RAM into chunks called pages (4 KB on x86 systems) and having its active pages scattered around RAM and inactive pages stored on disk. The CPU has a transparent mechanism for translating virtual addresses to physical addresses through a page table which the OS sets up. Virtual memory is useful because:
• A process cannot access the memory of other processes
• Each page can have different protection settings (read-only, read-write, kernel-mode-only, etc.)
• Inactive pages can be paged out to disk and retrieved when needed. This is also done when the system is low on RAM.
User Mode
In this mode, programs cannot modify pages directly and so have no way of affecting other processes except through their API. Programs in thismode also cannot interfere with interrupts and context switching.
Kernel Mode
When Windows is first loaded, the Windows kernel is started. It runs in kernel mode and sets up paging, virtual memory, interrupt handlers. Except System which runs in kernel mode, every other process runs in user mode. The kernel then creates some system processes in user mode, but switches back to kernel mode when it is interrupted by interrupts (events such as timers, keyboard, hard disk I/O). Whenever an interrupt occurs, the CPU stops executing the currently running program, switches to kernel mode, and executes the interrupt handler. The handler saves the state of the CPU, performs some processing relevant to that event, and restores the state of the CPU (possibly switching back to user mode) so the CPU can resume execution of the program.
Interrupts
When a program calls a Windows API function, that itself calls a different API: the Native API. Then it either triggers an interrupt or executes instructions such as
sysenter and sysexit (x86). Both cause the CPU to switch to ring 0 (kernel mode) and begin executing the desired API function which is the interrupt handler set up by the OS. When the API function has finished processing, it switches back to user mode and resumes execution of the program. This is because API functions like ReadProcessMemory cannot work in user mode; the program can't access other programs' memory. In kernel mode, however, the API function can read any memory region without restriction.Context Switching
Programs may let the OS to switch to another program because they are waiting for something (human input, hard disk). These programs are known as unrunnable programs, and since they make calls to the kernel to wait for something, the kernel knows to perform context switching to allow another program to run. This is done by:
1. saving the state of the current program (including registers)
2. deciding which program to run next
3. restoring the state of that program
Preemption
It is setting a timed interrupt that will invoke context switching so that if a process (or thread) runs for more than a certain period of time (a process time slice or thread quantum), the OS will switch the context to another program. The time slice that is used may be different for each process.
📚 Summary of: Windows Programming » User Mode versus Kernel Mode
#Windows #Windows_Programming