3 ms·

It's 2015 and Microsoft still has a kernel space HTTP component, thus needing to run some part of the web server code paths in SYSTEM user's context! I am curi

It's 2015 and Microsoft still has a kernel space HTTP component, thus needing to run some part of the web server code paths in SYSTEM user's context! I am curious as to what the reasons are - what are the benefits of this that outweigh the huge risk (as demonstrated repeatedly by the various vulnerabilities) of running in HTTP code in the kernel? Only thing I can think of is they are trying to squeeze the last bit of performance / scalability but surely that could only mean that there are parts of the kernel (ctx switching overhead, threading scalability, page cache performance, etc.) that need to be fixed in order to not need these type of hacks in 2015?

ComputerGuru 12y ago
It's actually not "still has" - this was a major feature that brought significant performance improvements and something they pushed hard for: http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/a2a45c42-38bc-464c-a097-d7a202092a54.mspx?mfr=true http://www.microsoft.com/technet/prodtechnol/WindowsServer20... (Not saying I agree or disagree, just saying that this isn't so much an ancient artifact as it is a fairly recent and purposeful addition.)
- blinkingled 12y ago
  • Kernel-mode caching. Requests for cached responses are served without switching to user mode. -- NT is missing sendfile()? Also syscalls are fast on x86_64, most stuff is dynamic now a days and serving static files straight from page cache is fast enough. • Kernel-mode request queuing. Requests cause less overhead in context switching -- This one is somewhat valid but given you can ctx switch pretty fast on modern CPUs it is not clear how big the gains are. Yeah but there would be some gains - that's not deniable. Question is whether they are big enough to risk something like the vulnerability at hand.
  - enigmo 12y ago
    It has TransmitFile and TransmitPackets: https://msdn.microsoft.com/en-us/library/windows/desktop/ms740565(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/ms7... They were in use (at least TransmitFile was) by IIS long before http.sys was conceived.
kogir 12y ago
I imagine the thinking was similar to that behind FreeBSD's accf_http kernel module? https://www.freebsd.org/cgi/man.cgi?accf_http https://www.freebsd.org/cgi/man.cgi?accf_http HTTP.sys obviously does a lot more, but especially back in the Windows 2000 days, the performance difference was substantial.
- justincormack 12y ago
  Linux used to have in kernel httpd too, called tux[1]. [1] https://en.wikipedia.org/wiki/TUX_web_server https://en.wikipedia.org/wiki/TUX_web_server

ComputerGuru 12y ago

It's actually not "still has" - this was a major feature that brought significant performance improvements and something they pushed hard for: http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/a2a45c42-38bc-464c-a097-d7a202092a54.mspx?mfr=true http://www.microsoft.com/technet/prodtechnol/WindowsServer20... (Not saying I agree or disagree, just saying that this isn't so much an ancient artifact as it is a fairly recent and purposeful addition.)

blinkingled 12y ago
• Kernel-mode caching. Requests for cached responses are served without switching to user mode. -- NT is missing sendfile()? Also syscalls are fast on x86_64, most stuff is dynamic now a days and serving static files straight from page cache is fast enough. • Kernel-mode request queuing. Requests cause less overhead in context switching -- This one is somewhat valid but given you can ctx switch pretty fast on modern CPUs it is not clear how big the gains are. Yeah but there would be some gains - that's not deniable. Question is whether they are big enough to risk something like the vulnerability at hand.
- enigmo 12y ago
  It has TransmitFile and TransmitPackets: https://msdn.microsoft.com/en-us/library/windows/desktop/ms740565(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/ms7... They were in use (at least TransmitFile was) by IIS long before http.sys was conceived.

kogir 12y ago

I imagine the thinking was similar to that behind FreeBSD's accf_http kernel module? https://www.freebsd.org/cgi/man.cgi?accf_http https://www.freebsd.org/cgi/man.cgi?accf_http HTTP.sys obviously does a lot more, but especially back in the Windows 2000 days, the performance difference was substantial.

justincormack 12y ago
Linux used to have in kernel httpd too, called tux[1]. [1] https://en.wikipedia.org/wiki/TUX_web_server https://en.wikipedia.org/wiki/TUX_web_server