Getting to the Kernel: Is NT Still Safe?

To improve NT 4.0's performance, Microsoft moved some of the OS's most critical processes closer to the unprotected code of the microprocessor. Now NT's Graphical Device Interface (GDI) -- which handles all writing to the screen -- is in the NT Executive; this gives it Ring 0 status and potential access to important system-data structures. Ring 0 is one of the Intel processors' four protection modes, in which OSes typically run trusted or performance-sensitive kernel-level processes, such as file management and keyboard input.

This move raised concern that NT would be less stable and more likely to crash. We seriously considered trying to prove or disprove the poin t by trying to "break" NT 4.0 with older video cards and drivers. But we quickly realized that such tests would take a lo t of work to prove what we already know from analysis: NT 4.0's stability will not be substantially affected by the Ring 0 change.

The real issue is -- and always has been -- unruly or buggy device drivers. Essentially, they have always been part of the OS and have had low-level control of the CPU. Bad ones will crash NT 4.0, just as they've brought all its predecessors to their knees. Microsoft is trying to steer people away from risky behavior by telling them to use only hardware that's on a Microsoft-approved list. A product's placement on the list means that Microsoft has written and debugged its device driver.

Admittedly, this smacks of a smug solution that serves to place the onus on users while requiring them, in some cases, to buy new hardware when they upgrade to NT 4.0. But again, the same was true with previous versions of NT. We think mo st corporate buyers of NT are not likely to stumble blindly into hardware conflicts, especially with their mission-critical servers.

It's true that when NT's GDI wasn't in the kernel's memory space, a crash theoretically was more likely to freeze only the screen, leaving background processes intact. We haven't heard of this ever happening, however. Besides, rebooting would be inevitable, since at some point the user would need access to screen output.

Finally, some nervousness about the GDI move to the NT kernel derives from a misunderstanding about what Ring 0 status means. It does not mean that a process has carte blanche to write anywhere in memory that it pleases. Rules exist, but poorly written or malicious drivers have always been able to ignore them.