Download Win XP Process Handling

The 6 Blocks
Process
Executive
Process
Block
(EPROCESS)
Kernel
Process
Block
(KPROCESS)
Thread
Process
Environment
Block
(PEB)
Executive
Thread
Block
(ETHREAD)
Kernel
Thread
Block
(KTHREAD)
Thread
Environment
Block
(TEB)
EPROCESS Block
Stores information used by executive
components that are Process
using a process
•PID
•Pointer
to Process’s
Handle Table
Executive
Kernel
Process
Process
•Pointer
to accessProcess
token
Environment
Block
Block
Block
(EPROCESS)
(KPROCESS)
(PEB)
•Pointer
to Working
set information
Process
KPROCESS Block
Executive
Process
Block
(EPROCESS)
Kernel
Process
Block
(KPROCESS)
•Stores information used by
Microkernel
•Stores information about the different
threads
Process
Environment
Block
(PEB)
Process
PEB
Executive
Process
Block
(EPROCESS)
•Stored in Process’s address space
•Pointed to by the EPROCESS Block
•Stores information useful to user
process (i.e. linked DLL’s and
information about heap)
Kernel
Process
Block
(KPROCESS)
Process
Environment
Block
(PEB)
ETHREAD Block
Stores information used by
executive components that are
using threads
Thread
•ID of the thread’s process
•Start Address
Executive
Kernel
•Pending
I/O requests
Thread
Thread
Block
Block
•Points
to EPROCESS
Block
(ETHREAD)
(KTHREAD)
Thread
Environment
Block
(TEB)
Thread
KTHREAD Block
Executive
Thread
Block
(ETHREAD)
Used for Thread Scheduling and
Synchronization
•Base and current Priority
•Current state
•Any synchronization objects it is
waiting for
Kernel
Thread
Block
(KTHREAD)
Thread
Environment
Block
(TEB)
Thread
TEB
Executive
Thread
Block
(ETHREAD)
•Stored in thread access space
•Pointed to by KTHREAD Block
•Critical sections owned by thread
•Its ID
•Information about stack
•Points to PEB
Kernel
Thread
Block
(KTHREAD)
Thread
Environment
Block
(TEB)
TLS
Threads can maintain their own data in the
thread local storage (TLS)
 Thread receives an index that it can
use to store local data
(TLS
slot)


Common use – store data associated
with DLL
Threads can also store data on the
runtime stack
Processes Creation

For Windows processes, the parent (i.e., creating) process and
child (i.e., created) process are completely independent.
 The child process receives a completely new address space.
 The parent process can specify certain attributes that the child
process inherits (i.e., the child acquires a duplicate from the
parent), such as most types of handles, environment variables—
i.e., variables that define an aspect of the current settings. such
as the operating system version number—and the current
directory.

When the system initializes a process, the process creates a
primary thread. The primary thread acts as any other thread, and
any thread can create other threads belonging to that thread’s
process.
Process Termination

A process can terminate execution for a variety of
reasons:




If all of its threads terminates
Any of a process’s threads can explicitly terminate the
process at any time.
When a user logs off, all the processes running in the
user’s context are terminated.
Parent and child processes are independent of one
another so terminating a parent process has no affect on
its children and vice versa.
Jobs

A group of several processes grouped in one unit is
called a job.

A process can be a member of no more than one
job.

A job object allows developers to define rules and
set limits on a number of processes.

Allows the developer to terminate all the processes
of a group at once.
Job Attributes

The job object specifies such attributes as a base priority class, a
security context, a working set minimum and maximum size, a
virtual memory size limit and both a per-process and jobwide
processor time limit.

A process inherits attributes from its associated job (if the
process belongs to a job).

The system can terminate all processes in a job by terminating
the job.

Systems executing batch processes, such as data mining,
benefit from jobs. Developers can limit the amount of processor
time and memory
Fibers

Threads can create fibers

Major difference: a fiber is scheduled for execution by the thread
that creates it, rather than the microkernel.

Windows XP includes fibers to permit the porting of code written
for other operating systems to Windows XP.

A fiber executes in the context of the thread that creates the fiber
(and have their own storage)
Fibers in Windows XP

Each fiber maintains state information, such as the next instruction to
execute and the values in a processor’s registers. The thread itself is
also a unit of execution, and must convert itself into a fiber to separate
its own state information from other fibers executing in its context.

The Windows API forces a thread to convert itself into a fiber before
creating or scheduling other fibers.


The thread context remains, and all fibers associated with that
thread execute in that context.
Once a fiber obtains the processor, it executes until the thread in whose
context the fiber executes is preempted, or the fiber switches execution
to another fiber (either within the same thread or a fiber created by a
separate thread).
Fibers in Windows XP

If a fiber deletes (i.e. terminates) itself, its thread terminates.

Fibers permit Windows XP applications to write code executed using
the many-to-many mapping; typical Windows XP threads are
implemented with a one-to-one mapping

Fibers are user-level units of execution and invisible to the kernel. This
makes context switching between fibers of the same thread fast
because it is done in user mode.


A single threaded process with many fibers can simulate a multithreaded
process.
Windows XP schedules threads, not processes, so the single-threaded
processes receive less execution time (all else being equal).
Scheduling

The Dispatcher


Not specific to threads
Threads scheduled independently of parent
process



Same process with more threads will get more
execution time.
Pre-emptive scheduling
Based on thread’s priority
Eight State Diagram
Priority Queues

32 queues




16-31 for real-time
0-15 for dynamic
Highest queue runs first
Runs for max exec time, one quantum,
unless pre-empted

Pre-empted threads return to front of their queue
Priority cont’d

Priority goes up:



After it exits waiting state
If it receives input
If it has been waiting for a long time


Prevent priority inversion
Priority goes down if it runs until its quantum
expires

Never goes below base priority level
Multiprocessors

Ideal processor




Parallel execution (default)
Shared cache
Last processor
Preferred processor

Affinity mask
Synchronization



Guarantees threads will not be preempted
Restricts Functionality
2 Main Mechanisms


Dispatcher Objects
Kernel Locks
Dispatcher Objects



Kernel or User mode
Access shared data structures/files
2 states: signaled and unsignaled
Kernel Locks

Queued Spin Lock


FIFO ordering
Executive Resource Lock



Kernel mode only
Shared or Exclusive
Solves reader/writer problems