Talk:Architecture of Windows NT

Note: One should avoid excessive duplication between this article and other related articles such as Windows 2000, Windows XP.

Microkernel

Win2k (and all versions of windows AFAIK) are NOT microkernel based operating systems. According to Windows Internals 4th ed: "Windows isn't a microkernel-based operating system in the classic definition of microkernels, where the principal operating system components ... run as separate processes in their own private address space". Windows Internals is written by Mark Russinovich and David Solomon (and considered to be authoritative). I'm going to try to reword the article, and perhaps expand on the issue at a later time. Consider the fact that the filesystem and much of GDI runs in kernel-mode.Timbatron 17:48, 7 November 2005 (UTC)

Those things run in Ring 0 with the kernel, but they aren't part of the kernel. NTOS certainly isn't monolithic either. Careful with the re-wording. SchmuckyTheCat 00:40, 8 November 2005 (UTC)

Ok, good point. It's not completely monolithic, but it certainly isn't microkernel either. I'm still contemplating how the best way is to word it. I think I'm going to write a brief section "Monolithic vs. Microkernel", and change the use of "microkernel" to "kernel", since this is the wording that Russinovich uses. Timbatron 16:13, 8 November 2005 (UTC)

As the current wording states hybrid and microkernel, and there is no disagreement to the above written some time ago, I will now make the change, tentatively. I have also proposed a change to the hybrid kernel page, and diagram, which are all inconsistent to say the least. --Widefox 19:09, 22 July 2006 (UTC)

I briefly explained the concept in the "kernel" section, hope that clears it up. Basically, what is called "kernel" is the microkernel, and the "executive" subsystems are what in a proper microkernel would be user-mode processes, communicating through the never-implemented "channel" objects. It's clear that the microkernel design was scrapped very early, before any development, but its overall shape and vestigial remains are visible everywhere --KJK::Hyperion 10:16, 21 December 2006 (UTC)

Privilege levels

Does the kernel mode take up 3 privilege levels of the μp?  =Nichalp (Talk)= 13:32, Jun 5, 2005 (UTC)

Not rightly sure. I found the following article, which states that:

X86_SELECTOR represents a 16-bit segment selector, as stored in the segment registers CS, DS, ES, FS, GS, and SS. In Figure 1, selectors are depicted as the upper-third of a logical 48-bit address, serving as an index into a descriptor table. For computational convenience, the 16-bit selector value is extended to 32-bits, with the upper half marked "reserved". Note that the X86_SELECTOR structure is a union of two structures. The first one specifies the selector value as a packed 16-bit WORD named wValue, while the second breaks it up into bit-fields. The RPL field specifies the Requested Privilege Level, which is either 0 (kernel-mode) or 3 (user-mode) on Windows 2000. The TI bit switches between the Global and Local Descriptor Tables (GDT/LDT).

Furthermore, I found the following site (specific to I/O ports) that states:

Under Windows NT, there are only two I/O privilege levels used, level 0 & level 3. Usermode programs will run in privilege level 3, while device drivers and the kernel will run in privilege level 0, commonly referred to as ring 0. This allows the trusted operating system and drivers running in kernel mode to access the ports, while preventing less trusted usermode processes from touching the I/O ports and causing conflicts. All usermode programs should talk to a device driver which arbitrates access.

HTH. - Ta bu shi da yu 02:42, 6 Jun 2005 (UTC)

Thanks for the info. Could you see to it that it is included in the text?  =Nichalp (Talk)= 07:28, Jun 6, 2005 (UTC)

Will see what I can do. - Ta bu shi da yu 08:03, 6 Jun 2005 (UTC)

Sorry this is taking so long... very busy and don't use the Internet at home. - Ta bu shi da yu 05:07, 15 Jun 2005 (UTC)

Move to Architecture of Windows NT

I propose that this article is moved to Architecture of Windows NT, as it applies equally well to NT and XP as to 2000 and Windows NT is often used to refer to any one of NT/2K/XP. --R.Koot 22:48, 20 November 2005 (UTC)

• Support. --R.Koot 22:48, 20 November 2005 (UTC)

I second that -- in common usage, "NT" refers to the whole family from NT 3.1 through Windows 2000, XP, and Server 2003. Similarly, 9x usually refers to non-NT releases of Windows -- Windows 95, Windows 98, and Windows ME.

As for the privilege level question, NT uses only two privileges today -- user mode and kernel mode. On the x86 family of processors, those modes use code privilege level (sometimes called "ring") 3 and CPL 0 respectively.

In that case, may I suggest that we move it to Architecture of the Windows NT operating system line? There are some things here that are specific to Windows 2000, like layered file system drivers. - Ta bu shi da yu 07:57, 25 November 2005 (UTC)

It's a bit long, but I wouldn't object. Specific changes made in 2000 or XP could also be mentioned here. Great article btw. —R. Koot 13:54, 25 November 2005 (UTC)

Thanks! - Ta bu shi da yu 02:16, 8 December 2005 (UTC)

Actually, it should just be "Architecture of Microsoft Windows". WinNT is a historical product and few people use NT to refer to Windows since 2000. Wikipedia uses common names and NT isn't. Win9x and Win3x are historical and a dab link to point to their architectures would do fine. SchmuckyTheCat 20:41, 25 November 2005 (UTC)

I entirely do not agree with that, to say it without using many words. —R. Koot 17:27, 27 November 2005 (UTC)

Agree with R. Koot. Windows 95/9x use an entirely different architecture, to say otherwise would be misleading. - Ta bu shi da yu 02:25, 8 December 2005 (UTC)

Move to NT-based operating systems and merge of NT-based

I think there is a big problem with the new name "Architecture of Windows NT". It is factually incorrect, due to the whole line being discussed, and worse than that in software terms, it sounds obsolete. The discussion above did *not* reach consensus, and I like the others have no easy answer: Bad names:

• "Architecture of recent Microsoft Windows" seems limp, as do
• "Architecture of modern Microsoft Windows" also
• "Architecture of contemporary Microsoft Windows" so do
• "Architecture of Microsoft Windows NT and later" not pretty.
• "Architecture of Windows 2000" (original title)
• "Architecture of NT-based operating systems" - long
• "NT-based operating system"

Luckily, now that W98 will be is unsupported 2007 Q3 2006, that leaves the obvious:

• "Architecture of Microsoft Windows" (used with caveats - not applying to W98/95/3) is best. Widefox 01:08, 30 October 2006 (UTC) Support Widefox 01:11, 30 October 2006 (UTC)

• "NT-based Architecture" (see article NT-based, which I propose is merged into this article) Support Widefox 23:13, 31 October 2006 (UTC)

• "NT-based operating system" (and merge of NT-based into this article)

Support Widefox 17:56, 1 November 2006 (UTC)

Actually, 98SE/ME dropped off this year or last. Win2K is unsupported as of last summer as well, except for the occasional security update. I would actually have suggested "Architecture of the Windows NT product line" if anyone has information on WinNT 3/3.51, then 4, 2000 (which was developed as 5.0), XP (5.1) and Server '03 (5.2). --JohnDBuell 01:22, 30 October 2006 (UTC)

(W98 July 11, 2006) Widefox 15:00, 30 October 2006 (UTC)

"Windows NT" and "Windows NT operating system line" are exactly the same, aren't they? I mean, there is no "Windows NT" other than it being a line of operating systems. Wikipedia doesn't have "operating system" in any article names unless it's a disambiguation. -/- Warren 01:38, 30 October 2006 (UTC)

If I'm understanding the past discussions correctly, the point is that the article applies to NT 3.x and all later versions, not JUST the versions that were called "Windows NT". --JohnDBuell 01:46, 30 October 2006 (UTC)

"Windows NT operating system line" is something different. NTOS is an architectural foundation of many Microsoft products, like the Xbox, that have nothing to do with Windows (or this article). A title without NT is better off as the NTOS part of current Windows is deprecated (in marketing and common usage) going on 7 years. It's there because Microsoft has managed to consolidate so many code-bases but nobody still calls it "NT". This article doesn't need to worry about Win9x (dead) anymore than it needs to worry about Windows Mobile. An architecture article on Win9x or WinCE may be useful, but not confused with the mainstay desktop OS. SchmuckyTheCat 04:03, 30 October 2006 (UTC)

Hi, I was the one who moved the page a few days ago. I thought that User:JohnDBuell was giving me the impression that he thought the current title would be a good one; apparently I misunderstood what he was saying. I don't mind what the title ends up as. Thanks. Andrew Levine 04:24, 30 October 2006 (UTC)

No, I wasn't. I was under the impression that one of your objections to a current FAC had to do with long article names, and pointed out this FA as having had one. Please don't post misleading information and attribute it to me. Any further discussion of this should be between Andrew and myself, and not on article talk pages. Thanks! --JohnDBuell 18:48, 30 October 2006 (UTC)

This article was originally called Architecture of Windows 2000. Perhaps that's what it should be called? If you read through the contents of the article (ignoring the first couple of sentences), that's precisely what it describes. I'm not happy with calling it "Architecture of Windows NT" either, because there's information in here that doesn't apply to NT 3, 3.5, 4, or 6. It'd also need some work to effectively cover 5.1 and 5.2 (the OS/2 and POSIX subsystems aren't included by default in 5.1 and later, e.g.). We might be better off creating separate articles for the architectural details of major versions of Windows; Vista has a lot of new details in it that would really weigh down this article if we tried to integrate them in. Likewise if we tried to separate out the new stuff in Windows 2000 from NT 4. -/- Warren 05:58, 30 October 2006 (UTC)

Please vote for name above, the caveats can cover all concerns above. Call me a pragmatist, but if we have maintenance issues with the 1 article, more will be worse. If I remember correctly, Vista information is in the article, and more should be added to keep it alive. If it gets too big, sure then split. Please compare with the situation at Netscape#Browser Netscape (web browser) . I think it's best to avoid that, just by having the evolution in the article. Widefox 15:00, 30 October 2006 (UTC)

Widefox: How about "Architecture of NT-based operating systems"? I'd really prefer to keep the "Aspect of subject" style of naming we've been using in most other Microsoft articles. -/- Warren 05:27, 1 November 2006 (UTC)

bit long - what about the compromise above - if we are merging NT-based, we should drop the Architecture and then everyone might be happy... Widefox 17:56, 1 November 2006 (UTC)

the article NT-Based should just be deleted as unsourced. NT should not be in the title unless you plan on including things like the xbox kernel. The subject matter here is the mainstream Windows architecture and it's evolution, not the myriad other msft projects that take the kernel and build something new. NT was the name of the OS in the past, now it's the name of an internal piece of the OS. It shouldn't be in the title. SchmuckyTheCat 19:28, 1 November 2006 (UTC)

Just calling it "Windows architecture" would be an extremely bad idea. There have been several distinct Windows architectures, only one of which is built on the NT kernel. Never mind this hooie about what the "mainstream" kernel in use today is; that's not important. The naming should accurately reflect what the article describes, and right now that's the kernel & executive architecture of Windows 2000 -- nothing older, and nothing newer. If nobody disagrees with this point, I'll rename the article to "Architecture of Windows 2000", and anybody who wants to expand the article to include other versions of Windows can make the effort to do so, and rename the article at that time. -/- Warren 20:11, 1 November 2006 (UTC)

I strongly disagree with this name. I originally called it that, but this article encompasses the NT-line products. - Ta bu shi da yu 00:40, 21 November 2006 (UTC)

I don't agree at all. I believe wikipedia wants the articles to remain contemporary. Being as there is no other architecture article, it must evolve. The desire to have a W2K article is understandable (especially due to the current state of this article), but results in no current article. The alternative is to make a split at this point, and concentrate on the new article, but it involves more work. Widefox 23:56, 1 November 2006 (UTC)

ReactOS

It might be worth while mentioning ReactOS as it is attempting to reimplement the NT architecture.

Vulnerabilities

On November 16, 2006 Microsft announced that there was an vulnerability in the workstation service and that exploit code had been created to attack vulnerable machines.

- Ta bu shi da yu 00:39, 21 November 2006 (UTC)

off topic --KJK::Hyperion 10:07, 21 December 2006 (UTC)

Why are there multiple HALs for the same platform?

See[1]. I understand that different drivers would be needed for ACPI or non-ACPI systems, but why is it so fundamental that they need a different HAL? Grouse 15:47, 8 December 2006 (UTC)

To give you an example I'm familiar with, when ReactOS was ported to the Xbox, exactly three things needed porting: the boot loader, the VFAT driver, and the HAL. The Xbox HAL did three things differently from the standard x86 HAL: it reimplemented basic video output (think BSOD), it parsed the non-standard partition table and it blacklisted a PCI device that would crash the machine upon access. There is no value in detecting such differences at runtime, as it has to be done exactly once, very early, so there is no value in putting all functionality at once in an universal HAL - in fact, adding another layer of indirection could slow things down. Instead, what is done in peculiar environments such as installation/recovery CDs is using a special boot loader that scans the hardware and determines the correct combination of kernel+HAL to load --KJK::Hyperion 10:32, 21 December 2006 (UTC)

Removed from HAL section

As irrelevant and outdated:

Windows 2000 was designed to support the 64-bit DEC Alpha. After Compaq announced they would discontinue support of the processor, Microsoft stopped releasing tests build of Windows 2000 for AXP to the public, stopping with beta 3. Development of Windows on the Alpha continued internally in order to continue to have a 64-bit architecture development model ready until the wider availability of the Intel Itanium IA-64 architecture. The HAL now only supports hardware that is compatible with the Intel x86 architecture.

Preserved here because the information is factual and could be used elsewhere --KJK::Hyperion 10:07, 21 December 2006 (UTC)

POV concerns

Recent edits introduce phrases like "blah-blah-blah is a kludge which...." This is clearly POV. You may be right ... but the article needs to be unbiased, balanced, and without any sermonizing or judgement. Please have a cuppa tea and find more neutral ways to describe the details. If you can describe what's good and bad about the design, the user can draw his/her own conclusions. David Spalding (☎ ✉ ✍) 02:41, 26 December 2006 (UTC)

Ain't that great, I've finally fallen victim to Wikipedia tagsoup nazism. No worries kind mister, I'll reword faster than you could type "WP:OR" --KJK::Hyperion 00:53, 29 December 2006 (UTC)

How I will make this article better

The current structure isn't that great. The division between kernel and user mode components feels very artificial to me, as several kernel-mode components depend (for "everyday use") from user-mode components, and certain subsystems (like Win32) are divided between user mode and kernel mode more out of practical concerns (read: security) than by design. Also, Win32 has its own, parallel architecture, and the rest of the system can and does live fine without it.

In general, the article doesn't do justice to Windows NT's unique architecture and philosophy - no mention of features, like callbacks, that would make UNIX-heads' hair curl, turn gray and then fall. The article fails to bite.

So I will, sooner or later, reorganize it in a better structure, that makes the article less about "architecture" (actually more than it is now) and more about "philosophy":

• Core architecture

• Kernel general info + breakdown by primitive
• Executive breakdown by subsystem
• Balance set manager
• Hardware Abstraction Layer (HAL)
• Structured Exception Handling (SEH)
• Runtime Library (RTL)
• Loader (LDR)

• Interfacing user mode and kernel mode

• System services
• Callbacks
• User-mode Asynchronous Procedure Calls (APCs)
• Thread Environment Block (TEB) and Process Environment Block (PEB)
• NT Layer DLL (ntdll)
• Special LPC ports
• Special objects

• Process management what is a process, how processes are started, jobs, etc.
• Thread scheduling algorithms, priorities, boosting, idle threads, real-time scheduling, etc.
• Security model and architecture

• Security model SDs, tokens, access control, privileges, MIC, etc.
• Auditing
• Local Security Authority (LSA) Subsystem (LSASS) logon sessions, SSPs, APs, etc.
• Security Support Provider Interface (SSPI)
• Kernel Security Device Driver (KSecDD)
• winlogon omitted intentionally because it's part of Win32

• Networking

• Network Driver Interface Specification (NDIS)
• Transport Device Interface (TDI)
• Winsock Ancillary Function Driver (AFD)
• also an overly complex architecture to control protocol bindings whose name escapes me now

• Device drivers

• Architecture DriverEntry, Dispatch, Unload, DOs, FOs, etc.
• PnP support AddDevice, StartIo, etc.
• Windows Driver Model (WDM)
• Driver Verifier
• lots more - NDIS, HID, WIA, KS, bus support, etc. - probably too much, in fact

• Filesystem drivers

• Architecture FCBs, CCBs, VCBs, etc.
• Filesystem Runtime Library (FSRTL)
• Multiple UNC Provider (MUP)

• Plug and Play (PnP) I'm no expert, sadly
• Windows Management Infrastructure (WMI)
• Interoperability services

• NT Virtual DOS Machine (NTVDM)
• POSIX support
• OS/2 support
• Windows on Win64 (WOW64)
• Windows x86 emulation (WX86) if I can find enough information, it's an Alpha thing

• Debugging services

• Debugging Kernel & Debugging Subsystem
• Kernel Debugger
• Bugchecking and dumping

• Boot environment

• OS Loader (NTLDR)
• System startup

--KJK::Hyperion 04:07, 29 December 2006 (UTC)

On a second look, that looks like it would make for a bloody long article. Bravo to me if I can pull it off without going "War and Peace" --KJK::Hyperion 04:14, 29 December 2006 (UTC)

We have a variety of articles floating around that cover several of the areas you've listed here. Windows Management Instrumentation, NTVDM, Windows NT Startup Process, WOW64, NDIS, Local Security Authority Subsystem Service, Security Support Provider, and so on. If anything, this article should briefly summarise how these components fit into the bigger picture, reserving the deeper details for the articles themselves. Also, be aware that the text that's here now really only describes the architecture of Windows 2000, not what came before or after it. While that makes the article interesting and relevant for people interested in that particular piece of Windows history, it means we aren't covering the present very well -- NT6 is quite a bit different than NT5 in many areas, and apart from Features new to Windows Vista and a few other areas like Kernel Transaction Manager, we've done nothing to address that yet. -/- Warren 04:28, 29 December 2006 (UTC)

Agree on the "bigger picture". With regards to NT 6, no, it didn't change the architecture significantly. All existing applications and all existing drivers (except those based on deprecated bus/class/port drivers) still work, all assumptions still hold. I/O is still packet-driven, the cache is still based on memory-mapping, the scheduler is still a RR thread scheduler, etc. --KJK::Hyperion 03:20, 31 December 2006 (UTC)

Cites

This article seems sorely lacking in citations. Maybe some of the new eyes from it being featured will be able to give it a hand? --Falcorian ^(talk) 00:41, 19 August 2007 (UTC)

What statements do you think require specific citations? Christopher Parham (talk) 01:30, 19 August 2007 (UTC)

As many as can be. FA should have many more citations than 10. --Falcorian ^(talk) 03:45, 19 August 2007 (UTC)

The requirement in the FA criteria is that statements which are likely to be challenged carry citations (along with any specific quotations). There is no numerical minimum. Christopher Parham (talk) 03:52, 19 August 2007 (UTC)

While there is no numerical minimum, there certainly is an expectation that it is adequately cited. This article has whole sections without any references at all. --Falcorian ^(talk) 05:53, 19 August 2007 (UTC)

There is no requirement that every section include an inline citation. The relevant policy that is that citations should be provided for material that is challenged or is likely to be challenged, as well as for quotations. Christopher Parham (talk) 06:26, 19 August 2007 (UTC)

FA status though requires 'Claims are supported with specific evidence and external citations;', and although WP:V does not require citations for much of this article, those same parts of the article do not fall under the 'When a source may not be needed' guidelines, leaving it in a grey area. Because it is a FA article, I would argue that these should be cited, as it should meet a higher standard. --Falcorian ^(talk) 18:45, 20 August 2007 (UTC)

OK, I wrote this article. Please tell me what statements need referencing, or please, forever hold you peace! Unless you can tell me where the problems are, I can't improve the article. - Ta bu shi da yu 13:12, 21 August 2007 (UTC)

Would it be OK if we did this by placing { { citationneeded } } tags in the text? That's quite an efficient way of helping to show which statements need referencing, which I've seen used elsewhere. SP-KP 18:21, 21 August 2007 (UTC)

Fine with me :-) Go for it! Ta bu shi da yu 22:06, 21 August 2007 (UTC)

Thanks. I'll make a start. If you're not sure about any specific examples, start a new section below and I'll happily give my reasons as to why I think a reference is needed. SP-KP 22:26, 21 August 2007 (UTC)

Whoever added those citation tags seems to have gone a little over the top. There are some statements are are so well accepted that to cite them is fussy to say the least. For instance: "The Windows NT hardware abstraction layer, or HAL, is a layer between the physical hardware of the computer and the rest of the operating system. It was designed to hide differences in hardware and therefore provide a consistent platform on which the kernel is run. [citation needed]" This is the very definition of a hardware abstraction layer - if it needs to be cited then it should be done so in the HAL article, not here. Can I suggest some of the more obvious requests for citation be removed? Straussian 01:17, 22 August 2007 (UTC)

Excessive capitalization

Congratulations on the well deserved FA status. I don't understand what appears to be excessive capitalization (title case) of common nouns. The fact that a common noun has an all caps acronym does not elevate the common noun to title case. Capitalization is justified for a registered trademark (in which case a registered trademark symbol should be added), but not otherwise. I am referring to terms like cache controller, memory manager, local procedure call, and many more. Am I missing something here? I don't want to go hacking away at an FA (I'm not that WP:BOLD), but I don't see a justification for this. If Microsoft capitalizes these terms in its own literature, that is not justification. Could someone please explain? Thanks. Finell (Talk) 04:02, 19 August 2007 (UTC)

Well... if it is a name given by Microsoft, I suppose that we follow their conventions. If it is just a name, then we should probably change them to lower caps. Go for you life :-) - Ta bu shi da yu 06:11, 19 August 2007 (UTC)

I think that the difference is usually that Microsoft likes to give names to implementations of common techniques. We should respect that. For example, the Local Procedure Call is a piece of software made by Microsoft, just like Word or Excel, and they have every right to give their software a specific name. There's no LPC in Unix or Linux or any other system, so it's not anything like a common technique or software procedure. It should be capitalized like any other piece of software, I think, because I can see no difference between the exemplified software and any other piece of software. —msikma (user, talk) 08:51, 19 August 2007 (UTC)

WMI, DBGK?

At the top of the Executive paragraph, the following comment appears:

<! -- TODO: WMI, DBGK -- >

It seems that this article is FA now, but these things aren't mentioned. At some point, some editors felt that these two things (Windows Management Instrumentation and Kernel User-Mode Debugging Support) should be discussed, but it seems that nobody ever got around to writing about them. Was this taken into account during the FA process? Perhaps these things need to be edited in anyway? After-all, these two things are part of the kernel. —msikma (user, talk) 08:42, 19 August 2007 (UTC)

Wow

Who was bored enough to write this? 81.153.125.209 21:54, 19 August 2007 (UTC)

In reality, not just one person has written this article. Many different people have. If I had to guess, though, I'd say that whoever helped out must be interested in computer science. I guess you aren't. Thankfully, there's lots of other articles, too... :) —msikma (user, talk) 18:46, 20 August 2007 (UTC)

Incorrect lead

Can someone familiar with this article please correct the lead ? WP:LEAD:

• The article's subject should be mentioned at the earliest natural point in the prose in the first sentence, and should appear in bold face. Avoid links in the bold title words.

SandyGeorgia (Talk) 22:02, 19 August 2007 (UTC)

Referencing

I'm concerned about the sparseness of references in this article; this aspect seems out of line with the article's featured status (although other aspects of the article all seem good). The date it was promoted to FA status probably provides the explanation - the standards for referencing were much looser two years ago than they are now. I plan to nominate this at FAR soon (the article is currently ineligible as it featured in the main page recently). The purpose of this note is to gives editors some advance warning, to seek views on which sections are most in need of referencing, and to encourage suggestions on appropriate references. SP-KP 16:54, 20 August 2007 (UTC)

I agree with your concern, and we're actually already discussing it above. Maybe you'd care to join in? --Falcorian ^(talk) 18:46, 20 August 2007 (UTC)