Slashdot Mirror


Inside the Windows Vista Kernel

Reader trparky recommends an article on Technet (which, be warned, is rather chaotically formatted). Mark Russinovich, whose company Winternals Software was recently bought by Microsoft, has published the first of a series of articles on what's new in the Vista kernel. Russinovich writes: "In this issue, I'll look at changes in the areas of processes and threads, and in I/O. Future installments will cover memory management, startup and shutdown, reliability and recovery, and security. The scope of this article comprises changes to the Windows Vista kernel only, specifically Ntoskrnl.exe and its closely associated components. Please remember that there are many other significant changes in Windows Vista that fall outside the kernel proper and therefore won't be covered."

22 of 298 comments (clear)

  1. Re:MMCSS by swissmonkey · · Score: 4, Informative

    Yet another (promised?) feature they could not deliver.

    ??? This is in Vista

    thought for a second that they required admin access to activate MMCSS; but upon a second reading, it looks like they've merely reimplemented nice with some kind of setuid root service.

    "nice" as you call it has been in NT since its conception.
    He's talking about multimedia specific scheduling related to I/O operations here, you might want to read this whole document a 3rd time, he's not talking about "regular" kernel scheduling of threads/processes, he's talking about scheduling based on I/O needs which is a whole different beast.

  2. Re:Finally... by cnettel · · Score: 5, Informative

    Cancelling I/O has been in Windows for long, "just" not always done properly. I have seen similar issues while killing processes in other OSes where they are stuck in some I/O. One reason for why this happens more frequently in Windows (in addition to bad drivers/a complicated driver model) is the fact that asynchronous I/O is so common. That way, you might not see the that the IO got stuck until you try to kill the process.

  3. Re:Soft links? by tuffy · · Score: 5, Informative

    The symlink(2) manpage mentions that they're also known as "soft links", as opposed to the hard links created by link(2). It's not a very common usage, though.

    --

    Ita erat quando hic adveni.

  4. Re:Soft links? by Moridineas · · Score: 3, Informative

    Absolutely. I guess "symbolic link" is the more common term, but soft link is hardly rare, and differentiates a link from a hard link. (think ln -s here)

    From wiki:

    Soft Link and Hard Link

  5. Re:Soft links? by NuShrike · · Score: 2, Informative

    Or a comparison with Google Trends

  6. Ideas borrowed from QNX. But bulkier by Animats · · Score: 3, Informative

    Much of this new stuff sounds like features of QNX. QNX has a "sporadic scheduler", for when you need things like 10ms of CPU every 100ms. QNX has had I/O cancellation for years. In QNX, you can set a timeout on any system call that blocks. If you set a 35ms timeout on a write, after 36 milliseconds, you'll have control back. Very useful in real-time systems where you're doing something less important, like logging, that should never take very long but, in some trouble condition, might. QNX has had prioritized I/O for years, too.

    It all works, too. I've done compiles on QNX while running a real time program on the same machine, without the real time program missing a deadline.

    Of course, in Vista, it's all more complicated.

  7. Re:OS classes will always be open OS based by dioscaido · · Score: 4, Informative

    True in theory, but Universities can license the source code of the windows kernel for academic purposes:

    http://www.microsoft.com/resources/sharedsource/Li censing/researchkernel.mspx

  8. Re:Bah! by Black+Acid · · Score: 5, Informative

    cfq/ionice is for reads only. "Due to the complex path writes take to get to the io scheduler there is no ionice support for writes yes so they are all treated equally." It'll happen...

  9. Re:Soft links? by Knuckles · · Score: 3, Informative

    Let's try it again with proper quotes. Amazing how often people get this wrong. It looks like some school in India has recently started using this term,

    --
    "When I first heard Daydream Nation it quite frankly scared the living shit out of me." -- Matthew Stearns
  10. Re:ntoskrnl.exe by Anonymous Coward · · Score: 3, Informative

    hey dumass, its because windows nt used to be distributed on fat16 (not vfat) floppy disks and you could use dos to copy their contents over to a hard drive for installation. it had to be 8.3 then, and there's no need to change it now. you can rename ntoskrnl.exe to anything you want and boot off it with the /kernel= boot.ini option.

  11. Re:OS classes will always be open OS based by Anonymous Coward · · Score: 1, Informative
    From the license:

    You may use any information in intangible form that you remember after accessing the software. However, this right does not grant you a license to any of Microsoft's copyrights or patents for anything you might create using such information.
    As long as later works don't specifically infringe on a copyright or patent, there's no problem. Although it might be a bit dangerous, I don't think 'contaminated' is the right word.
  12. Re:OS classes will always be open OS based by atsabig10fo · · Score: 3, Informative

    huh?

    "You may use any information in intangible form that you remember after accessing the software."
    http://www.microsoft.com/resources/sharedsource/li censingbasics/wrklicense.mspx/

  13. Re:ntoskrnl.exe by limecat4eva · · Score: 1, Informative

    Learn irony.

    --
    comma
  14. Re:Finally... by RAMMS+EIN · · Score: 5, Informative

    `` I have seen similar issues while killing processes in other OSes where they are stuck in some I/O.''

    Oh, the horrors! I've had this happen to me many times, as well, especially on Linux. Not even a kill -9 would get rid of the wedged process. Why is there even such a thing as "non-interruptible sleep"? If I don't need the process anymore, I should be able to get rid of it no matter what.

    And wedged drivers, too. I think you can still see this for yourself by doing I/O with some USB device, and then yanking it out while the I/O is in progress. You get at least one process that you can't kill (I guess the comatose state causes ethical issues), and probably a driver you can't unload (although maybe new kernels allow you to do that). If you're "lucky", you get a whole lot of hardware devices that you can't use anymore, and any program that tries to gets into the dreaded D state.

    --
    Please correct me if I got my facts wrong.
  15. Re:ntoskrnl.exe by spectecjr · · Score: 2, Informative

    That's because the ISO file system used on CDs limits you to 8.3 file names if you want to read them on all BIOSes.

    --
    Coming soon - pyrogyra
  16. Not quite... by supersat · · Score: 3, Informative

    Err... Not quite. Not all of the SysInternals tools were migrated, and NONE of the source code was. Microsoft's hiding behind some pretty lame excuses (e.g. "They're using undocumented APIs!" or "Hackers are using it to make spyware!") for not distributing the source code.

    The Winternals Administrator's Pak is also ">being discontinued, and have its functionality available only to those with Software Assurance agreements.

  17. Re:Is this the same as... by mobby_6kl · · Score: 2, Informative

    Look carefully at the RAM usage in task manager. Most of the "used" memory is cache - it will be freed immediately when needed. I'm running Vista with a 1gb of ram (and a 2.6 Northwood P4), and real memory usage is around 300mb. I did turn off the Defender and Sidebar, but didn't go through any serious service cleanup, so I probably saved 20-30 megs here.

    The NVIDIA drivers suck, but UT2004 and Warhammer 40000 Dawn of War work fine, if slower than in xp/2003. The old Ghost Recon and R6 games work ok too. Didn't have much time to test any other games yet.

  18. Re:But it IS broken by EXMSFT · · Score: 2, Informative

    He didn't say consumers. He said companies. VERY different. Enterprise companies DON'T want to throw away the 10 year old craptastic apps, the developers of which long since left the company. Ancient software is the key to Microsoft's stronghold. If everyone was willing to buy entirely new software (and throw away or completely rewrite what they have) just to run an entirely new OS with better features than the competition, the world would likely be running OS X already.

  19. The Tagging system for slashdot needs moderation by Froqen · · Score: 2, Informative

    I know that badvista.org has a campaign to mark products with DRM and defectivebydesign, but nothing in this story has anything to do with DRM; having these tags on the article is less then useful. Maybe the tags need the same type of moderation system that the comments get.

  20. Re:Finally... by ultranova · · Score: 5, Informative

    How much praise was adorned on Linux when it got an O(1) scheduler? NT has had it for over a decade.

    Yes. A round robin scheduler, which runs every task for exactly 2 clock ticks except for foreground tasks which are run for 6 (or is this an XP improvement ?) - assuming there's no interrupts occurring during those ticks, of course - and not paying any attention to whether the task is IO- or CPU-bound. It performs absolutely shitty if you have anything heavy running in the background (say, POV-Ray rendering an image while you try to browse the Net). Praising that to be "O(1) scheduler" is about the same as calling the Goatse picture "art": sure, it may be technically true, but...

    What Linux was praised was getting a scheduler that handles 40 priority levels, real-time tasks, and multiple CPUs (500+, in some cases) while retaining both interactivity and high throughput, and doing all this in O(1) time. No version of Windows has ever gotten even close.

    --

    Forget magic. Any technology distinguishable from divine power is insufficiently advanced.

  21. Re:Making Symlinks in GUI? by curious.corn · · Score: 2, Informative

    Nope... hard links are just the sting-to-inode entry in a directory map (that's why they can't cross mount points, inode IDs are unique only within a single filesystem). A file normally has one hard link and is "deleted" when there's no hard link left that points to it.

    Incidentally, now that Linux has the concept of UUID in filesystem structures, one could extend hard links to prefix an inode ID with the owning volume UUID and make cross-mount hard links possible.

    e

    --
    Mi domando chi à il mandante di tutte le cazzate che faccio - Altan
  22. Re:One "defect" is still there. by bkoehler · · Score: 2, Informative

    tasklist -svc (from cmd) will show you what services are contained within a svchost.exe PID.