3 ms·

>As an hybrid kernel I must ask, what exactly makes the current NT kernel a 'hybrid' kernel ?

• pjmlp 11y ago
  It still makes use of the original micro-kernel design,with kernel level RPC to separate modules. Thus still offering a micro-kernel cleanness in a monolithic space. Also since Windows Vista many drivers are now implemented in user space, with minimal kernel primitives.
  • nickpsecurity 11y ago
    Exactly. It gets the modularity and some fault isolation without the vastly-reduced attack surface of kernel mode. ;)
  • gillianseed 11y ago
    >with kernel level RPC to separate modules. Is this what is described as LPC ? Could you elaborate on how it separates the modules (as opposed to unix subsystems) ? >Thus still offering a micro-kernel cleanness in a monolithic space. What does this 'cleanness' provide, and how ? It's all in kernel space so if one module crashes the whole kernel crashes ?
    • pjmlp 11y ago
      First of all, yes memory corruption will still bring the whole thing down. Only pure micro-kernels can survive it. What Windows does, is that there aren't any direct calls between modules, only kernel level RPC calls. All parameters are packed into the RPC message, it is dispatched, unpacked, validated as much as possible on the receiving end, then processed. Messages and its validation introduce an indirection layer that improves safety. It is based on the original micro-kernel design Windows NT had, before they moved graphics back into the kernel. So the micro-kernel message passing is still there, but simplified since now everything runs on the same space. But as of Windows Vista, UDF was introduced for user space drivers. The "Inside Windows" book series go into great detail how everything works.