Windows is often reduced to the desktop that appears after login. OS questions and technical interviews go deeper: where does an application end, when does a request cross into privileged code, what does a thread execute, and how do virtual memory, I/O and access checks fit together? Exact I/O, scheduling, synchronization, paging and access-check traces connect those layers to the calculations a reader must perform. Round-robin scheduling and virtual-memory paging are teaching models; Windows' internal policies vary by version.
Windows Operating System Architecture: From Applications to Hardware
Start at the top with user applications. They call the Windows API through user-mode libraries. When a request needs privileged work, it crosses a controlled system-service boundary into kernel mode. Executive components there manage objects and handles, processes and threads, virtual memory, I/O, security and inter-process coordination. The kernel and hardware abstraction layer coordinate low-level execution, while device drivers communicate with hardware.
User mode and kernel mode differ mainly in privilege and fault containment. An ordinary application cannot directly perform every privileged operation, and its failure should be contained more tightly than a failure in kernel-mode code. This does not mean all operating-system code sits in one layer. The desktop shell, for example, is a user-facing component, not the entire OS. This vocabulary also supports the architecture questions found across GATE CS Exam Preparation.
One Concrete Windows API-to-Kernel I/O Trace
Consider an illustrative trace, not a claim about a particular Windows build. Process PID 4120 opens C:\Study\os.txt, which contains exactly 10,240 bytes. It calls CreateFileW and receives H1, a per-process handle to a managed object. The handle is not the file's bytes.
Next, the program calls ReadFile(H1, buffer, 10240, ...) from offset 0. The user-mode API reaches the protected system-service boundary. The I/O manager creates and routes the request, and the file-system and storage-driver path satisfies it from cache or storage. The successful call reports 10,240 bytes. Finally, CloseHandle(H1) releases PID 4120's reference.
Using 4 KiB teaching chunks, the calculation is:
10,240 = 4,096 + 4,096 + 2,048 bytes.
The request therefore covers two full chunks and half of a third. This split explains the arithmetic only. It does not reveal the file's physical allocation.
Windows Processes and Threads, with Services and Sessions Distinguished
A program image contains executable code. A process is a running resource container with a private virtual address space and handles. A thread is a schedulable execution unit inside that process. A service is long-running managed work, not a special kind of CPU entity. A session groups an interactive logon environment.
Suppose PID 4120 has T1, T2 and T3. The three threads share the process's code, heap and handle H1, but each has its own instruction pointer, register state and stack. If T2 blocks while waiting for I/O, T1 and T3 can remain runnable. If T2 terminates, PID 4120 continues while T1 or T3 remains. This corrects a common interview error: the dispatcher chooses among runnable threads, not whole processes treated as indivisible execution units.
Worked Scheduling and Synchronization Examples
Round robin as a teaching model
Use a GATE-style round-robin model, not a complete description of the Windows dispatcher. T1, T2 and T3 all arrive at time 0, need 5 ms, 4 ms and 2 ms, and use quantum q = 2 ms.
Thread | Execution slices | Completion and turnaround | Waiting time |
|---|---|---|---|
T1 |
|
|
|
T2 |
|
|
|
T3 |
|
|
|
The exact order is T1, T2, T3, T1, T2, T1. Since every arrival time is zero, turnaround equals completion time. Average waiting time is (6 + 6 + 4) / 3 = 16 / 3 = 5.33 ms.
Semaphore and signalling choices
Now give a semaphore capacity 2 and assume FIFO wake-up only for this exercise. At t=0, T1 and T2 acquire it. T3 arrives at t=1; T4 arrives at t=2. T1 releases at t=3, so T3 enters after 3 - 1 = 2 ms. T2 releases at t=5, so T4 enters after 5 - 2 = 3 ms. T3 and T4 release at t=7. Concurrency never exceeds two.
A mutex represents ownership by one thread, a semaphore controls a count of available entries, and an event signals that a condition has occurred. The FIFO assumption above is not a universal Windows fairness guarantee. For the broader concepts, study Process Synchronization and Semaphores.
Windows Virtual Memory and a Worked Address Translation
Reservation, commitment and residency answer different questions. Reserving selects a virtual address range. Committing promises backing under the operating system's rules. Residency tells us whether a referenced page is currently in physical memory. A TLB caches recent translations. A TLB miss means the translation must be found elsewhere, while a valid page fault may bring a committed page into memory. An invalid access is different, and not every page fault is a crash.
Take a generic 32-bit example with 4 KiB = 0x1000 byte pages. For virtual address 0x12345, a 4 KiB page gives a 12-bit offset. Split the address:
Offset:
0x345 = 837.Virtual page number:
0x12 = 18.Page-table mapping: page
0x12to frame0x25 = 37.
The offset stays unchanged. Therefore:
(0x25 x 0x1000) + 0x345 = 0x25345 = 152,389.
The routine is always: infer offset bits from page size, split page number and offset, look up the physical frame, then retain the offset. Real Windows page-table layouts and address-width limits vary by architecture and version, so this is a concept model.
Windows Files, Handles and the Security Model
Named files, sockets and other managed resources share a useful pattern. A path names a file, while a handle is the process's opened reference and carries granted access. File-system drivers, cache paths, asynchronous operations and network I/O can all participate in routed I/O requests without making the named resource and its handle the same thing.
For a simplified access check, define teaching masks READ = 0x1 and WRITE = 0x2. These are not real Windows access-mask constants. Aditi's token contains user Aditi and group Interns. The ordered DACL contains:
Deny
InternsWRITE (0x2).Allow
AditiREAD|WRITE (0x3).
A READ (0x1) request passes the first ACE and is granted by the second. A combined READ|WRITE (0x3) request encounters the deny for WRITE, so it is denied. The token identifies the requester; the security descriptor contains protection information; the DACL holds ordered ACEs. Least privilege means granting only what the task needs. Neither a file extension nor administrator status automatically bypasses an access check.
How GATE-Style Questions and Interviews Test Windows OS
Windows OS questions span design and architecture, core services and sessions, file and network services, and programming and memory interfaces. Common formats ask you to identify an architecture layer, distinguish a process from a thread, trace a handle or service request, translate an address, choose a synchronization primitive, or reason through a simplified access check.
Trap | Correct model |
|---|---|
Windows is just its GUI | The shell is one user-facing component in a layered system. |
A process is the smallest schedulable unit | Runnable threads are scheduling units. |
A handle is the underlying object | It is a process's reference to a managed object. |
A TLB miss is automatically a page fault | The translation may still be available through the page table. |
Round robin fully describes Windows scheduling | It is a textbook model used to test scheduling arithmetic. |
Use Operating Systems for GATE to place these ideas in the wider subject map, then use OS Basics MCQs for architecture practice.
The Short Version and the Next Practice Step
Windows separates ordinary user work from privileged kernel work.
Threads execute inside processes and share process resources.
Handles are references to managed objects, not the objects themselves.
Virtual-to-physical translation preserves the page offset.
Security tokens are checked against ordered access rules.
Before moving on, recompute the three-thread average waiting time and recover 5.33 ms. Then translate 0x12345 through frame 0x25 and recover 0x25345 without looking above.
For structured, interview-focused revision of operating systems and the other core CS subjects, use CS Fundamentals for Placements by Sanchit Sir.
