Submitted by Mark Russinovich has started a series of articles regarding Vista’s/Longhorn’s kernel changes. “This is the first part of a series on what’s new in the Windows Vista kernel. In this issue, I’ll look at changes in the areas of processes and threads, and in I/O. Future installments will cover memory management, startup and shutdown, reliability and recovery, and security.”
There truly are some changes/refinements in vista.
But i still wont be using it, because i see now more than ever how Microsoft is tightening the grip on their platform using DRM+TPM.
It will have to be XP until it dies, and than GNU/Linux from there on end.
EDIT: and lets not forget their proven API lockin technique
Edited 2007-01-25 13:15
Linux is no saint when it comes to TPM either. They have TPM modules in the kernel source. Granted you don’t have to compile it or install it but it is there.
“””Linux is no saint when it comes to TPM either. They have TPM modules in the kernel source. Granted you don’t have to compile it or install it but it is there.”””
There is nothing inherently evil about TPM. Like any technology, it’s about how it is used.
I do imagine some people might want to use that crypto hardware for legitimate purposes.
[quote=”TaterSalad”]Linux is no saint when it comes to TPM either. They have TPM modules in the kernel source. Granted you don’t have to compile it or install it but it is there.[/quote]
Enabling the use of a TPM microcontroller in itself means nothing.
I’m sure many people will read your statement as an implication of this being the same as the DRM/TPM setup in Vista, but its far from it.
I’ve been using vista for several months now and I really haven’t noticed much in the way of intrusive DRM. Could someone please explain how Vista’s setup is structured and how it will affect me? I really haven’t noticed anything yet, despite Guttmann’s claims.
You didn’t read Gutman’s claims very well did you?
1.) The kernel is locked down. Anyone can still write drivers, but only user-mode drivers. Kernel mode drivers require special permission from Microsoft. This is done so that the kernel’s memory can be considered safe from cracking.
2.) The kernel goes through extra processes to ensure “safe” operating. Not watching if hardware is failing, but more watching if it is being tampered with.
3.) Internal system traffic is often encrypted when HD video is playing in order to keep you from pulling the video off that.
4.) HDMI support. If you want high def video you’d better have:
a.) A graphics card that fully supports it.
b.) A display that is considered “safe.”
-This isn’t all Microsoft’s fault, but they’re not helping it either and it does mean more money for you on a system that isn’t very reliable about establishing that it has a safe place to transmit video.
The biggest thing to take away from all this is that you’re being locked out of your PC. Not crackers, but you. You’re told what you can and can’t stick into kernel space. It’s not little technical bumps designed to keep kids from installing every driver they find, no, it’s an effort to keep system administrators from installing their own drivers.
To some this is no big deal. They don’t care about these abilities and they see no problem in losing them. To others this is an attack upon the nature of the PC. It’s telling them what they can do with their von Neumann machine.
And to others it’s Microsoft getting into their computer and setting rules they can’t change.
Kernel driver signing requirements only apply to x64 Vista or to computers hoping to play HD content. If you’re running on x86 and not doing HD, nothing is really different.
Corporate system administrators don’t want to install unsigned drivers in most cases and average users really shouldn’t.
RE: cost of hardware -> due to the nature of large-scale VLSI manufacturing, it really costs nothing to include check bits on hardware. In terms of software complexity, there is a cost but I am pretty confident that tilt bits would not he implemented by hardware manufacturers in a very finicky way (no one will be measuring bus voltages).
Nothing in the TC spec prevents you from writing your own OS (or running Linux). Windows kernel is not a user-serviceable component, so it’s not like you have a right to change the way it works and distribute what you’ve made. Furthermore, the whole point of a kernel is to tell you what can’t be done with the machine. (“no, you really can’t write to that piece of memory from your app.”)
I read Gutman’s claims the same way you did. I just don’t believe his interpretation because Microsoft has long kept their system open to third parties to write apps and drivers. They would not be as successful if they had been more closed off.
“I just don’t believe his interpretation because Microsoft has long kept their system open to third parties to write apps and drivers. They would not be as successful if they had been more closed off.”
But they *are* closing there system up from 3rd party players more with vista. The Macfee, Symantec, Norton vs MS squabble is only one of many that have occurred over vista and 3rd party vendors.
Mcafee and Symantic do not write drivers, they write security software, and crappy security software at that. They were angry because MS locked them out from dynamically hooking into the kernel using undocumented or potentially dangerous ways. They were offered a proper API for kernel access and they bitched about that. The real problem is that they see Vista as a threat to thier bottom line, because if it is actually more secure, then people don’t need their bloated crap.
MS is not closing up thier system to 3rd party driver developers either. By moving the graphics and uudio subsystems out of the kernel, it removes a major source of instability and BSODs from Vista, misbehaving drivers. you can still write a driver, but by running in userspace, it just means that the driver crashes, NOT the OS. Just seems like common sense to me.
But what if you want to run the 64-bit version and don’t give a crap about so called “premium content”, shouldn’t you be able to install any drive you want?
Perhaps:
see http://www.alex-ionescu.com/?p=23
But Microsoft wants to discourage corporations (and rootkit creators) from doing this.
NO. A kernel does not exist to tell you what can be done with your machine.
A kernel exists to manage resources. The management, like so much of software, is configurable in ways that make sense within its design.
Vista is following this perfectly. And in the case of HD content and x64 it’s designed to keep you out. This goes against pretty much everything I value in a PC, and I imagine I’m not the only one.
1.) The kernel is locked down. Anyone can still write drivers, but only user-mode drivers. Kernel mode drivers require special permission from Microsoft. This is done so that the kernel’s memory can be considered safe from cracking.
….
You’re told what you can and can’t stick into kernel space. It’s not little technical bumps designed to keep kids from installing every driver they find, no, it’s an effort to keep system administrators from installing their own drivers.
You can disable signed driver checking at boot time by pressing F8.
I don’t think MS would think it wise to permanently disable unsigned driver loading like you suggest because that would hurt third party developers–even if these HW developers would in end opt for the paid certificate, it would hamper their own development and would prevent them from releasing beta drivers or quick fixes which MS knows customers want from their vendors.
For example, a growing number of pro audio card vendors are now offering unsigned Vista drivers or beta Vista drivers.
That’s a good point. Do you know what all they disable when you shut off driver signing? Is it just HD video?
//I’ve been using vista for several months now and I really haven’t noticed much in the way of intrusive DRM. Could someone please explain how Vista’s setup is structured and how it will affect me? I really haven’t noticed anything yet, despite Guttmann’s claims.//
The DRM might not affect you right now, but think a few months or years down the track.
Here is one persons examination of where it might easily lead: http://www.jethrocarr.com/index.php?cms=blog:20070124
An example that is given: “Microsoft will have the ability disable drivers at will! “Once a weakness is found in a particular driver or device, that driver will have its signature revoked by Microsoft, which means that it will cease to function” – so if you have a piece of hardware that gets it’s driver DRM cracked, Microsoft can release an update to disable it.
This is bad enough, but where it becomes REALLY bad, is when you consider vendors who might not release a newer version of the driver to fix the problem – eg: for an old video card, a vendor might not care about fixing the driver, so Microsoft can re-release it. Fancy having to buy new hardware without warning? Not me.”
The article also talks about a scenario where the DRM provisions are deliberately triggered to make a Vista computer not work properly. The scenario used is security video camera … but I would have thought straight blackmail and holding Vista computer owners to ransom would have been more likely.
Edited 2007-01-26 12:08
If it’s GPL’d, anyone can change the source to remove it, then compile it again. The spirit of the GPL isn’t *against* DRM, it’s against DRM you can’t remove (eg., not providing the keys for modding, as in Tivoization…)
BTW unsigned drivers are actually a good thing in lots of cases. Omega drivers for ATI cards for one, and in Vista, the reasons you stated are correct, but another reason for not having unsigned drivers is so that they can’t use any of the protected paths, bypassing the DRM. (means less functionality)
Edited 2007-01-25 18:15
Your comment is not relevant to the article. Enough comments about DRM has been said allready.
There are a lot of improvements into Vista kernel, such as the memory managment and the stack/heap and kernel data, read these:
http://en.wikipedia.org/w/index.php?title=Features_new_to_Windows_V…
http://en.wikipedia.org/wiki/Security_and_safety_features_new_to_Wi…
And tons of improvements into Vista architecture are outside of kernel
Edited 2007-01-26 13:40
Mark Russinovich is brillant. That guy knows everything about the Windows kernel. His books are awesome. I like that guy!
I was going to post something similiar but no need to repeat what you said because that pretty much sums it up. The guy is crazy smart. I’m hoping he’s teaching some of the people at Microsoft a thing or two.
agreed, this is an excellent article, well worth reading regardless of which OS you prefer the most.
Sometimes technical articles are a good change of pace from the Linux Vs. Microsoft ethical debates.
“””Sometimes technical articles are a good change of pace from the Linux Vs. Microsoft ethical debates.”””
*Anything* is a good change of pace from the Linux Vs. Microsoft ethical debates!
I’m on the Linux side, BTW. But I think that being sick of the war is something we can *all* agree upon.
We should have a party! 😉
I’ll buy the first round!
Holy crap, no more locking up when browsing the network? It’s as if we’ve entered the 21’s century! Actually, I don’t know how if that behavior was in fact retarded in OSland, but it sure was annoying.
And prioritized I/O sounds like a godsend. Totally needed.
Oh yeah, can someone compare any of this to Unix/Linux/MacOS? I’m quite curious to know the differences and futures of each.
UNIX has had symbolic links since its BSD days, maybe late 1970’s?
In human terms, this is like Vista being evolved until it can now walk upright.
The Linux scheduler uses the Time Stamp Counter (TSC) for fine-grained scheduling calculations, and has for at least two years. While the system clock ticks at, maybe 1000 HZ, Linux can schedule more accurately than that because the TSC is checked at every hardware interrupt, regardless of source, and the precise time calculated by adding the TSC delta since the last system clock tick.
In human terms, Vista has gained the power of speech.
Non-blocking DNS lookup? Gee, I don’t know. Did UNIX/Linux ever block here? I think not. However, UNIX/Linux DNS lookup has been single-threaded from time to time.
In human terms, Vista has invented Play-Doh
haha really good comment,
but…
there is one mistake! “In human terms, Vista has gained the power of speech.” — Vista has gained the power to make strange sounds. For speech and language is some intelligence needed. But Vista doesn’t got that…
😉 just offtopic
that there are not that much in deep information, I mean it’s not close to the excellent book on OS X “Mac OS X internals” by sir Amit Singh. Not only that book is THE reference for anything related to Darwin/OS X but it’s also a reference for technical book writer.
Plus the fact that this book is written by a very talented non-apple person gives it more credibility.
Back to the topic, I think it’s too bad that this Microsoft article is too superficial for a so called technical article
GStepper: “that there are not that much in deep information. [It’s] not close to the excellent book on OS X, ‘Mac OS X internals'”
There is a difference between a book and magazine article, in which the latter has space constraints. This was published as the latter for TechNet Magazine. Unless you wanted to increase the magazine page count by 400 pages and dump the other articles from that issue, then yeah, you’re right.
Russinovich’s Windows Internals contains the level of detail you are requesting. It is probably much of the info you need to clone The NT kernel.
Russinovich’s Windows Internals contains the level of detail you are requesting. It is probably much of the info you need to clone The NT kernel.
Do you mean that a 1000 pages book (without ANY source code available) is enough is to clone a multi-millions lines of code piece of software ???
Do you mean that a 1000 pages book (without ANY source code available) is enough is to clone a multi-millions lines of code piece of software ???
Its enough to give you the blueprint to write a kernel that mimicks the NT kernel if functionality.
If you are talking about windows as a whole OS then I’d just join the ReactOS team and start learning from there!
The I/O completion, cancellation, and I/O priority features seem pretty unique to vista AFAIK
“The I/O completion, cancellation, and I/O priority features seem pretty unique to vista AFAIK”
Well, completion and cancellation seem to be vista-specific, but only in the details. Linux either has something similar, or its design doesn’t have the same problems that Microsoft wanted to solve with these “features” (the only event that seems to hang a process waiting for i/o are dead disks or dead disk controllers that force the kernel to wait for hardware timeouts).
As for i/o priority, Linux has had this for a long time now. And with the “cfq” i/o scheduler (elevator) these priorities are user controlled via the “ionice” command. cfq is the default elevator since 2.6.18, and can be used on earlier kernels with the “elevator=cfq” option in the kernel command-line.
I/O completions in general are a mechanism for doing asynchronous I/O in Windows. It’s a pretty good design, but Linux’s AIO subsystem has supported cancellation for awhile now, given appropriate driver support.
I/O completions in general are a mechanism for doing asynchronous I/O in Windows. It’s a pretty good design, but Linux’s AIO subsystem has supported cancellation for awhile now, given appropriate driver support.
Yes, the standard *NIX AIO interfaces have a cancel call.. however without explicit kernel support, I don’t think they aren’t cancelled at the driver/device level. However, I didn’t know linux has added AIO at the kernel/driver level now, with cancellation, which is good to hear (it wasn’t in 2.4 no?)
But from what I understand here, is that I/O cancellation in Vista also applies to synchronous I/O (i.e. a SIGINT received by an application during a read operation is propageted down to the driver) and is standard part of their new device driver interface.
WRT to I/O completion framework, while the general design remain the same, from what has been said about Vista’s differences compared with XP (and 2k/NT) is that there are some implementation changes that reduces context switching and scheduling overhead and allows for what seems like the coalescing or queuing of servicing multiple completions so that a single kernel-user mode switch need be done for multiple user requests. I could be wrong, but it seems like this same I/O framework is also used to implement their synchronous I/O calls as well which is I guess how they are able to do cancellation on them. (where as on *nix, sync and async I/O are 2 distinct mechanisms)
As for i/o priority, Linux has had this for a long time now. And with the “cfq” i/o scheduler (elevator) these priorities are user controlled via the “ionice” command. cfq is the default elevator since 2.6.18, and can be used on earlier kernels with the “elevator=cfq” option in the kernel command-line.
The CFQ scheduler is only related to disks, Vista’s I/O framework along with the MMCSS scheduling framework is more general purpose and allows things like bandwidth reservation (which is similar to isochronous I/O the USB spec provides, but again this is more general) and automatic driver tuning:
“A media player application asks the I/O system to guarantee it the ability to read data at a specified rate and, if the device can deliver data at the requested rate and existing reservations allow it, it gives the app guidance as to how fast it should issue I/Os and how large the I/Os should be. The I/O system won’t service other I/Os unless it can satisfy the requirements of apps that have made reservations on the target storage device.”
(Aside being only limited to disks) I might be wrong, but I don’t think the CFQ scheduler reserves bandwidth nor negotiates I/O rates with the device’s driver.
I take back what some of I stated about I/O negotiation at the driver level. Having not seen the actual Vista DDI interfaces yet, (but only read about the descriptions) I think I have misunderstood at what level the “flow control” is occuring. Reading more of it, it seems to be more at the higher framework level, transparent to the driver rather than at the device level itself (i.e. between the kernel’s I/O framework and the user application).
I take back what some of I stated about I/O negotiation at the driver level. Having not seen the actual Vista DDI interfaces yet, (but only read about the descriptions) I think I have misunderstood at what level the “flow control” is occuring. Reading more of it, it seems to be more at the higher framework level, transparent to the driver rather than at the device level itself (i.e. between the kernel’s I/O framework and the user application).
Actually the different aspects of prioritized IO occur in different places. The most fundamental aspects of IO prioritization are implemented in the top level (Microsoft provided) storage class driver, which prioritizes IO based on the IO request packets (IRP) priority hint (the data structure that indicates the priority of the IO) since this driver works with the device agnostic representation of IO in the NT system (the IRP). As the IO works its way through the IO driver stack (through device specific class drivers, such as those used by a raid controller), the port driver and eventually all the way to lowest level miniport driver, options with regards to how best service IO priority can be implemented (or ignored). For example, implementing IO priority aware NCQ.
In the case of IO Bandwidth reservation, this is implemented at a lower level in the specific (Microsoft provided) port drivers (current usbport and ataport) as bandwidth reservation requires a lower-level (e.g. native) understanding of the IO model for that particular type of storage in order to be effective.
The thing to keep in mind is while these features are implemented at different layers in the stack, there is a high degree of visibility to these features up and down the stack.
For a good demonstration of how effective just the core IO priority scheme is, kick off a Defender scan in XP and then do the same in Vista. In XP, the system will exhibit pretty significant IO contention with any other foreground disk intensive apps. In Vista the impact is negligible to foreground IO.
Try aio_read/aio_write/aio_cancel/aio_XXX
– Gilboa
I have to say too… I’ve been using Vista on my Laptop since it was released to VL Users. I haven’t seen ANYTHING that makes me cringe in the way of DRM. I am able to play all my media. I was able to rip tracks, move them to another computer and play them the same. Maybe in the coming months this will show more of it’s ugly head, but at this time.. nothing. As for the Kernel, On the whole it actually runs quite smooth. it automatically scales the eye candy to your systems capabilities. My laptop is a Core Duo with 2GB and a Nvidia 7800 and it tears it up. I have a test desktop that is an Athlon XP 2500+ with 512MB and an ATI 9550 and it runs just as smooth for the most part. Everyone said the same things about XP.
I have to say too… I’ve been using Vista on my Laptop since it was released to VL Users. I haven’t seen ANYTHING that makes me cringe in the way of DRM. I am able to play all my media. I was able to rip tracks, move them to another computer and play them the same. Maybe in the coming months this will show more of it’s ugly head, but at this time.. nothing.
You probably have nothing there that could trigger all DRM related code, but wait till you add some DRM-enabled devices to your setup (like HD graphics card)…
http://www.osnews.com/permalink.php?news_id=17054&comment_id=205574
Exacly. If we want to see movies outside the cinema, there is no question this is needed. They (the big companies) need to protect their intellectual property, and it works (well, maybe not against the few that know how to circumvent it, but they dont really matter in the big picture). Its another thing that some movie-companies are bitching all the time, but that aint be microsofts fault.
They just do what is needed (what would happen if microsoft did not do this? No movies and music on Vista). If you dont want to support DRM, stop buying the movies and the music. Try looking into what BillG said recently about what he thinks about DRM.
Enough about that 😉
Microsoft implemented this DRM in Vista not the anonymous Big Companies.
If you disagree don’t buy Vista, and you can never have enough of the truth.
No, Microsoft chose to support HD-DVD and BlueRay, in order to support these you have to have this DRM in place.
If memory serves ‘nslookup’ is the command for DNS lookup on Windows. The net use command is related to SMB and is used to make a connection to a computer or a resource on that computer.
If I remember correctly, NTFS has been technically capable of symlinks since NT4. This was required for the POSIX subsystem. It’s just that WIN32 has never used it.
I agree with the gist of your comment tho’. I quite often find myself reading about technology in the Linux space and thinking I wish I could get that on Windows!
I’ll be using Vista in anger on my home PC shortly. I wonder how often I’ll be using it once Feisty ships… I already prefer the Kubuntu desktop experience.
My scanner and webcam work on 64-bit too! (OOB, I might add)
Not sure about symlinks but I remeber You can use hardlinks on 2000/XP ntfs, all You need fsutil hardlink on cmd.