windows内核原理与实现(国外英文资料).doc

windows内核原理与实现(国外英文资料) Windows USES a two-mode structure to protect the operating system itself to avoid being affected by the applications errors. The operating system core runs under the kernel mode (kernel mode), and the application code runs in user mode. Every time the application needs to use the expansion of the system kernel or the kernel module (kernel driver) service provided by the application through the hardware instruction switch from user mode to kernel mode, when the system kernel after finished the requested service, control returns to user mode code. In Windows, the user code and the kernel code have their own operating environment, and the memory space they can access is different. In 32 for the system, the kernel code can access the current process of the 4 gb virtual address space, and the user code can only access at the bottom of the 2 gb virtual addresses (or 3 gb, if you open the kernel start switch / 3 gb). The user mode code can only access 2GB of virtual memory address space, and more than 2GB is more system address space. In fact, there is a special 64KB address space between the two, which is located at 0x7fff0000-0x7fffffff. Windows kernel is divided into three layers, dealing directly with the hardware of this layer is called the hardware abstraction layer (HAL), or all the code associated with hardware logic isolation into a special module, so that the level of the above as possible independent of the hardware platform. HAL above is the kernel layer, also known as the microkernel (micro - kernel), this layer contains the basic operating principle and features, such as the county and process, thread scheduling, interrupt and exception handling, synchronization objects and various synchronization mechanism. At the kernel level, intelligence is the executive body layer, which provides some functionality that can be called directly from the top application or kernel driver. The execution body of the Windows kernel contains an object man