The 6 Blocks

1. The 6 Blocks

2. EPROCESS Block • Stores information used by executive components that are using a process • PID • Pointer to Process’s Handle Table • Pointer to access token • Pointer to Working set information

3. KPROCESS Block • Stores information used by Microkernel • Stores information about the different threads

4. PEB • Stored in Process’s address space • Pointed to by the EPROCESS Block • Stores information useful to user process (i.e. linked DLL’s and information about heap)

5. ETHREAD Block • Stores information used by executive components that are using threads • ID of the thread’s process • Start Address • Pending I/O requests • Points to EPROCESS Block

6. KTHREAD Block • Used for Thread Scheduling and Synchronization • Base and current Priority • Current state • Any synchronization objects it is waiting for

7. TEB • Stored in thread access space • Pointed to by KTHREAD Block • Critical sections owned by thread • Its ID • Information about stack • Points to PEB

8. TLS Threads can maintain their own data in the thread local storage (TLS) • Thread receives an index that it can use to store local data (TLS slot) • Common use – store data associated with DLL • Threads can also store data on the runtime stack

9. Processes Creation • For Windows processes, the parent (i.e., creating) process and child (i.e., created) process are completely independent. • The child process receives a completely new address space. • The parent process can specify certain attributes that the child process inherits (i.e., the child acquires a duplicate from the parent), such as most types of handles, environment variables—i.e., variables that define an aspect of the current settings. such as the operating system version number—and the current directory. • When the system initializes a process, the process creates a primary thread. The primary thread acts as any other thread, and any thread can create other threads belonging to that thread’s process.

10. Process Termination • A process can terminate execution for a variety of reasons: • If all of its threads terminates • Any of a process’s threads can explicitly terminate the process at any time. • When a user logs off, all the processes running in the user’s context are terminated. • Parent and child processes are independent of one another so terminating a parent process has no affect on its children and vice versa.

11. Jobs • A group of several processes grouped in one unit is called a job. • A process can be a member of no more than one job. • A job object allows developers to define rules and set limits on a number of processes. • Allows the developer to terminate all the processes of a group at once.

12. Job Attributes • The job object specifies such attributes as a base priority class, a security context, a working set minimum and maximum size, a virtual memory size limit and both a per-process and jobwide processor time limit. • A process inherits attributes from its associated job (if the process belongs to a job). • The system can terminate all processes in a job by terminating the job. • Systems executing batch processes, such as data mining, benefit from jobs. Developers can limit the amount of processor time and memory

13. Fibers • Threads can create fibers • Major difference: a fiber is scheduled for execution by the thread that creates it, rather than the microkernel. • Windows XP includes fibers to permit the porting of code written for other operating systems to Windows XP. • A fiber executes in the context of the thread that creates the fiber (and have their own storage)

14. Fibers in Windows XP • Each fiber maintains state information, such as the next instruction to execute and the values in a processor’s registers. The thread itself is also a unit of execution, and must convert itself into a fiber to separate its own state information from other fibers executing in its context. • The Windows API forces a thread to convert itself into a fiber before creating or scheduling other fibers. • The thread context remains, and all fibers associated with that thread execute in that context. • Once a fiber obtains the processor, it executes until the thread in whose context the fiber executes is preempted, or the fiber switches execution to another fiber (either within the same thread or a fiber created by a separate thread).

15. Fibers in Windows XP • If a fiber deletes (i.e. terminates) itself, its thread terminates. • Fibers permit Windows XP applications to write code executed using the many-to-many mapping; typical Windows XP threads are implemented with a one-to-one mapping • Fibers are user-level units of execution and invisible to the kernel. This makes context switching between fibers of the same thread fast because it is done in user mode. • A single threaded process with many fibers can simulate a multithreaded process. • Windows XP schedules threads, not processes, so the single-threaded processes receive less execution time (all else being equal).

16. Scheduling • The Dispatcher • Not specific to threads • Threads scheduled independently of parent process • Same process with more threads will get more execution time. • Pre-emptive scheduling • Based on thread’s priority

17. Eight State Diagram

18. Priority Queues • 32 queues • 16-31 for real-time • 0-15 for dynamic • Highest queue runs first • Runs for max exec time, one quantum, unless pre-empted • Pre-empted threads return to front of their queue

19. Priority cont’d • Priority goes up: • After it exits waiting state • If it receives input • If it has been waiting for a long time • Prevent priority inversion • Priority goes down if it runs until its quantum expires • Never goes below base priority level

20. Multiprocessors • Ideal processor • Parallel execution (default) • Shared cache • Last processor • Preferred processor • Affinity mask

21. Synchronization • Guarantees threads will not be preempted • Restricts Functionality • 2 Main Mechanisms • Dispatcher Objects • Kernel Locks

22. Dispatcher Objects • Kernel or User mode • Access shared data structures/files • 2 states: signaled and unsignaled

23. Kernel Locks • Queued Spin Lock • FIFO ordering • Executive Resource Lock • Kernel mode only • Shared or Exclusive • Solves reader/writer problems