Windows administration At a glance: Thread priority and scheduling File-based symbolic links Cancelling I/O operations Inside the Windows Vista kernel: Part 1 Mark Russinovich This is the first part The scope of this article comprises changes to the Windows Vista kernel only, specifi- of a series on what’s cally Ntoskrnl.exe and its closely associated components. Please remember that there are new in the Windows many other significant changes in Windows Vista that fall outside the kernel proper and Vista kernel. In this therefore won’t be covered. This includes improvements to the shell (such as integrat- issue, I’ll look at ed desktop search), networking (like the new IPv6 stack and two-way firewall), and the next- changes in the areas of generation graphics model (such as Aero™ Glass, Windows Presentation Foundation, processes and threads, the Desktop Window Manager, and the new graphics driver model). Also not covered are and in I/O. Future the new Windows User-Mode and Kernel- Mode Driver Frameworks (UMDF and instalments will cover KMDF) since these are back-level installable on earlier versions of Windows. memory management, CPU cycle counting startup and shutdown, Windows Vista includes a number of en- hancements in the area of processes and reliability and recovery, threads that include use of the CPU cycle counter for fairer CPU allocation and the and security. new Multimedia Class Scheduler Service 14 To get your FREE copy of TechNet Magazine subscribe at: www.microsoft.com/uk/technetmagazine 14_19_Vista_UK.desFIN.indd 14 27/3/07 13:49:49 Threads A and B Threads A and B become ready to run become ready to run Thread A Interrupt Idle Thread B Idle Thread A Thread B Interrupt Interval � Interval � Interval � Interval � Interval � Figure 1 Unfair thread scheduling Figure 2 Windows Vista cycle-based scheduling (MMCSS) that helps media applications de- terval, it can more accurately dole out turns liver glitch-free playback. on the CPU. In addition, the Windows Vista All versions of Windows NT® up to and scheduler does not count interrupt execu- including Windows Vista program an inter- tion against a thread’s turn. This means that val-timer interrupt routine to execute ap- on Windows Vista a thread will always get proximately every 10 or 15 ms (milliseconds), at least its turn on the CPU and never more depending on the hardware platform. The than an extra clock interval of execution, re- routine looks at what thread it interrupted sulting in greater fairness and more deter- and updates the thread’s CPU usage statis- ministic app behaviour. Figure 2 shows how tics as if that thread had run for the entire in- Windows Vista responds to the scenario terval, while in reality the thread might have shown in Figure 1 by giving both threads at started executing just before the interval’s least one time slice interval of execution. end. Further, the thread might have been technically assigned the CPU, but didn’t get a chance to run because hardware and soft- ware interrupt routines executed instead. While clock-based time accounting might Watching process CPU usage be OK for diagnostic tools that report thread You can see the inaccuracy of the Windows standard clock-based time and process CPU usage, use of that meth- accounting using the Process Explorer utility from Sysinternals (micro- od by the thread scheduler can cause unfair soft.com/technet/sysinternals). Run Process Explorer on a Windows Vista CPU allocation. By default, on client versions system and add the Cycles Delta column to the process view. Cycles of Windows threads are permitted to run Delta shows the number of cycles the threads of each process execute up to 2 clock ticks (6 if in the foreground). between Process Explorer updates. Because CPU time accounting is still However, the thread might get virtually no based on the interval timer, if you also add the CPU Time column, then time on the CPU or up to 6 ticks (18 if in the you’ll see many processes that have threads consuming millions of CPU foreground), depending on its behaviour and cycles and yet don’t have their CPU time updated and don’t show up in other activity on the system. the CPU usage column. Figure 1 shows the unfairness that can oc- cur when two threads that have the same pri- ority become ready to run at the same time. Thread A runs until the next time-slice inter- val expiration when the scheduler assumes it has run for the entire interval and so decides that Thread A’s turn is finished. Furthermore, Thread A gets unfairly charged for the inter- rupt that occurred during its turn. At the next interval, the scheduler picks Thread B to take over and it runs for a full interval. In Windows Vista, the scheduler uses the cycle counter register of modern processors to track precisely how many CPU cycles a thread executes. By estimating how many Figure A Viewing CPU time and Cycles Delta in Process Explorer cycles the CPU can execute in a clock in- TechNet Magazine April 2007 15 14_19_Vista_UK.desFIN.indd 15 27/3/07 13:49:50 Windows administration MMCSS, which is implemented in %SystemRoot%\System32\Mmcss.dll and runs in a Service Host (Svchost.exe) process, has a priority-management thread that runs at priority 27. (Thread priorities in Windows range from 0 to 31.) This thread boosts the priority of registered multimedia threads into the range associated with the Scheduling Category value of their task’s registry key as listed in Figure 4. In Windows, thread priori- ties 16 and higher are in the real-time prior- Figure 3 Multimedia Class Scheduler audio task definition ity range and higher than all other threads on a system (with the exception of the kernel’s The ‘Watching process CPU usage’ side- Memory Manager worker threads, which run bar illustrates how you can monitor pro- at priorities 28 and 29). Only administrative cess CPU cycle usage for yourself using the accounts, like the Local System account in Process Explorer utility. which MMCSS executes, have the Increase Priority privilege that’s required to set real- Multimedia Class Scheduler Service time thread priorities. Users expect multimedia applications, in- When you play an audio file, Windows cluding music and video players, to offer a Media Player registers Audio task threads, seamless playback experience. However, de- and when you play a video, it registers Play- mand for the CPU by other concurrently back task threads. The MMCSS service running applications, like antivirus, content boosts all threads that have indicated that indexing, or even the mail client, can result they are delivering a stream at the same time in unpleasant hiccups. To provide a better when they are running in the process that playback experience, Windows Vista intro- owns the foreground window and when duces MMCSS to manage the CPU priorities they have the BackgroundOnly value set to of multimedia threads. True in their task’s definition key. A multimedia app like Windows Media® But while MMCSS wants to help multi- Player 11 registers with MMCSS using new media threads get the CPU time they need, APIs that indicate its multimedia character- it also wants to ensure that other threads get istics, which must match one of those listed at least some CPU time so that the system by name under the following registry key: and other applications remain responsive. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\ MMCSS therefore reserves a percentage of Currentversion\Multimedia\SystemProfile\Tasks CPU time for other activity, specified in the The various task keys specify how much following registry value: preference threads associated with different HKLM\Software\Microsoft\Windows NT\Currentversion\ Multimedia\SystemProfile\SystemResponsiveness multimedia types get for CPU and graphics processor resources (though graphics proces- By default, this is 20 percent; MMCSS sor resource management is not implement- monitors CPU usage to ensure that multi- ed in Windows Vista). Figure 3 shows the media threads aren’t boosted for more than 8 contents of one of the task registry keys after ms over a 10 ms period if other threads want a clean Windows Vista installation, though the CPU. To get the multimedia threads out third-party developers can add their own of the way for the remaining 2 ms, the sched- task definitions. uler drops their priorities into the 1-7 range. You can see how MMCSS boosts thread priority by reading the ‘Watching MMCSS Figure 4 MMCSS thread priorities priority boosting’ sidebar. Scheduling Category Boosted thread priority High 23-26 File-based symbolic links Medium 16-23 The Windows Vista I/O-related chang- es include file-based symbolic links, more 16 To get your FREE copy of TechNet Magazine subscribe at: www.microsoft.com/uk/technetmagazine 14_19_Vista_UK.desFIN.indd 16 27/3/07 13:49:50 efficient I/O completion processing, com- prehensive support for I/O cancellation and prioritised I/O. Watching MMCSS priority boosting A file system feature many have considered You can witness the thread boosting that the MMCSS service applies to missing from NTFS, the symbolic file link (or Windows Media Player threads by playing a video or audio clip, running as it’s called in UNIX, the soft link) finally ar- the Performance Monitor, setting the graph scale to 31 (the highest Win- rives in Windows Vista. The Windows 2000 dows thread priority), and adding the Priority Current counter for all version of NTFS introduced symbolic direc- instances of the Windows Media Player (Wmplayer.exe) thread objects to tory links, called directory junctions, which the display. One or more threads will run at priority 21.