Section 4: Window Manager and DWM

The Big Picture: Who Draws the Pictures?

Section 3 said that each window has an identity and a procedure. But who puts the pixels on the screen, and who makes sure a window in front hides the one behind? Two parts of Windows share that job:

A good analogy is a magazine. Each program is an author who prepares one page. The window manager is the editor who knows where each page goes. The DWM is the printer who lays all pages together into the finished sheet.

4.1 The Window Manager: USER, GDI and win32k

What it is: Windows has two old, classic subsystems for the user interface:

Their heavy work runs in the kernel, in a group of files commonly named win32k (win32k.sys, and in newer versions win32kbase.sys, win32kfull.sys and related files). They need to be in the kernel because they keep shared state for the whole session: all windows, the cursor, the input queues. The exact file names and split change between versions, so treat them as "the win32k family".

Program ──► user32.dll / gdi32.dll ──► (system call) ──► win32k family
 (user)         (user mode)                                  (kernel)

This is the same pattern you saw in Chapter 23: a DLL in user mode offers friendly functions, then makes a system call into the kernel to do the protected work.

Before Windows Vista, programs drew directly on the screen. If window A was in front of window B and you moved A, Windows told B: "part of you was uncovered, repaint it". If B was busy, you saw ugly smears of leftover pictures. Remember "Not Responding" from Section 3? On old Windows, a hung window left trails when you dragged another window over it.

4.2 DWM: The Desktop Window Manager (dwm.exe)

What it is: The Desktop Window Manager is a program, dwm.exe, that Windows starts for each interactive session. Its job is composition.

How it works, in two steps:

1. Each window draws into its own private off-screen picture (a buffer in memory, sometimes called a "redirection surface" or "back buffer"). A program never draws straight onto the shared screen.
2. DWM takes all those pictures and composes the final image, then hands it to the display.

 Notepad draws ──►  [ picture of Notepad ]  ─┐
 Chrome draws  ──►  [ picture of Chrome  ]  ─┼──► DWM  ──► ONE final frame ──► monitor
 Explorer draws──►  [ picture of desktop ]  ─┘
 (each in its own memory)       (composes them all, back to front)

Think of transparent sheets (overhead-projector slides). Each program draws on its own sheet. DWM stacks the sheets in z-order and takes one photo of the stack. If the front sheet is semi-transparent, the sheets behind show through.

What composition makes possible:

Because DWM has the last picture of a hung window, Windows can draw the "Not Responding" look and still let you move and close it. You are really moving a picture.

Can you turn it off? In Windows Vista and 7 you could switch to a "basic" theme without composition. Since Windows 8, DWM is always on and cannot be switched off in normal use. (Details may differ for special configurations, so treat this as the normal rule.) If dwm.exe crashes, Windows restarts it. The screen may flicker for a moment, but your programs normally carry on.

Is it a security feature? DWM is not mainly one, but it helps: programs cannot easily read what other windows are showing on the screen without using the proper screen-capture APIs.

4.3 GPU Acceleration of Composition

What it is: Composing many full-screen pictures 60 times per second (or 120, 144 or more) is a lot of repetitive pixel work. That is exactly what a GPU (Graphics Processing Unit, see Chapter 32 — Display and GPU) is built for.

DWM uses the GPU through Direct3D (the graphics part of DirectX). It treats each window's picture as a texture (an image the GPU can paint onto shapes) and tells the GPU: "draw this texture here, this one there, in this order, with this transparency."

┌───────────┐     ┌──────────────┐     ┌──────────────┐     ┌──────────┐
│ Windows'  │     │ dwm.exe      │     │ GPU          │     │ Monitor  │
│ pictures  │────►│ tells GPU    │────►│ blends and   │────►│ shows    │
│ (textures)│     │ how to stack │     │ makes frame  │     │ the frame│
└───────────┘     └──────────────┘     └──────────────┘     └──────────┘

Where does the picture memory live? On a PC with a separate graphics card, in the card's own fast memory (VRAM). On a PC with only the CPU's built-in graphics (see the integrated GPU in Chapter 2's die photo), it uses a part of normal RAM. Either way, the CPU is freed from pixel-pushing, so a normal desktop uses very little CPU for all those effects.

Frame timing. DWM aims to produce one new frame for every refresh of the monitor. It works together with the display driver (Chapter 13) so that it presents a finished frame at the right moment. This avoids tearing, the ugly split-image look you get when the screen is updated halfway through a frame.

What about games and video? A full-screen game can sometimes bypass composition and send frames more directly, which saves a little time. Modern Windows does this in several ways depending on the game and driver, so the details vary. Windowed games and videos go through DWM like everything else.

See it for yourself: In Task Manager → Performance → GPU, you can view a small graph called 3D, Copy, Video Decode and so on. In the Details tab you can add the columns GPU and GPU engine. dwm.exe normally shows a small GPU use that rises when you drag windows quickly. The Practical Lab shows how.

Summary