Kernel

Working very closely with the HAL is the Kernel, the heart of Windows NT. It schedules activities for the computer processor to perform. If the computer has multiple processors, the Kernel synchronizes activity among the processors to optimize performance.

The activities the Kernel schedules are called threads, the most basic entity in the system that can be scheduled. Threads are defined in the context of a process, (described more fully later in "Process Manager") which represents an address space, a set of objects visible to the process, and a set of threads that runs in the context of the process. Objects are resources that can be manipulated by the operating system. (These are discussed more fully in the "Object Manager" section.)

The Kernel dispatches threads in a way that ensures that the system's processors are always as busy as possible, processing the highest-priority threads first. (There are 32 priorities distributed across two priority classes — real-time and variable.) This helps make the operating system as efficient as possible.

Subcomponents at the Executive level, such as the I/O Manager and the Process Manager, use the Kernel to synchronize activities. They also rely on the Kernel for higher levels of abstraction, called Kernel objects, some of which are exported within user-level application programming interface (API) calls.

The Kernel manages two types of objects:

Dispatcher objects have a signal state (either signaled or nonsignaled) and control the dispatching and synchronization of system operations. Dispatcher objects include the following: events, mutants, mutexes, semaphores, threads, and timers.
Control objects are used to control the operation of the Kernel but do not affect dispatching. Control objects include the following: asynchronous procedure calls, interrupts, processes, and profiles.

Table 1.1 describes how the Executive uses each type of dispatcher object.

Table 1.1 Dispatcher Objects

Object type	Description
Event	Used to record the occurrence of an event and synchronize it with some action that is to be performed.
Mutant	One of two objects that the Kernel provides for controlling mutually exclusive access to a resource. This type of object is intended for use in providing a user-mode mutual exclusion mechanism that has ownership semantics. It can also be used in Kernel mode.
Mutex	The other of two objects that the Kernel provides for controlling mutually exclusive access to a resource. This type of object can only be used in Kernel mode and is intended to provide a deadlock-free mutual exclusion mechanism with ownership and other special system semantics.
Semaphore	Used to control access to a resource, but not necessarily in a mutually exclusive fashion. A semaphore object acts as a gate through which a variable number of threads may pass concurrently, up to a specified limit. The gate is open (signaled state) as long as there are resources available. When the number of resources specified by the limit are concurrently in use, the gate is closed (nonsignaled state).
Thread	The agent that runs program code and is dispatched to be run by the Kernel. Each thread is associated with a process object, which specifies the virtual address space mapping for the thread and accumulates thread run time. Several thread objects can be associated with a single process object, which enables the concurrent execution of multiple threads in a single address space (possibly simultaneous execution in a multiprocessor system).
Timer	Used to record the passage of time and to time out operations

Table 1.2 describes how the Executive uses each type of control object.

Table 1.2 Control Objects

Object type	Description
Asynchronous Procedure Call	Used to break into the execution of a specified thread and cause a procedure to be called in a specified processor mode.
Interrupt	Used to connect an interrupt source to an interrupt service routine via an entry in an Interrupt Dispatch Table (IDT). Each processor has an IDT that is used to dispatch interrupts that occur on that processor.
Process	Used to represent the virtual address space and control information necessary for the execution of a set of thread objects. A process object contains a pointer to an address map, a list of ready threads containing thread objects while the process is not in the balance set, a list of threads that belong to the process, the total accumulated time for all threads executing within the process, a base priority, and a default thread affinity. A process object must be initialized before any thread objects that specify the process as their parent can be initialized.
Profile	Used to measure the distribution of run time within a block of code. Both user and system code may be profiled.

Generally, the Kernel does not implement any policy since this is the responsibility of the Executive. However, the Kernel does make policy decisions about when it is appropriate to remove processes from memory.

The Kernel runs entirely in kernel mode and is nonpageable. Software within the Kernel is not preemptible and therefore cannot be context-switched, whereas much software outside the Kernel is almost always preemptible and can be context-switched.

The Kernel can run simultaneously on all processors in a multiprocessor configuration, synchronizing access to critical regions as appropriate.

The third and most intricate module that runs in Kernel mode is the Executive. The next several pages describe the functions of the Executive and its components.