Slashdot Mirror


Inside the Windows Vista Kernel

Reader trparky recommends an article on Technet (which, be warned, is rather chaotically formatted). Mark Russinovich, whose company Winternals Software was recently bought by Microsoft, has published the first of a series of articles on what's new in the Vista kernel. Russinovich writes: "In this issue, I'll look at changes in the areas of processes and threads, and in I/O. Future installments will cover memory management, startup and shutdown, reliability and recovery, and security. The scope of this article comprises changes to the Windows Vista kernel only, specifically Ntoskrnl.exe and its closely associated components. Please remember that there are many other significant changes in Windows Vista that fall outside the kernel proper and therefore won't be covered."

25 of 298 comments (clear)

  1. Re:MMCSS by swissmonkey · · Score: 4, Informative

    Yet another (promised?) feature they could not deliver.

    ??? This is in Vista

    thought for a second that they required admin access to activate MMCSS; but upon a second reading, it looks like they've merely reimplemented nice with some kind of setuid root service.

    "nice" as you call it has been in NT since its conception.
    He's talking about multimedia specific scheduling related to I/O operations here, you might want to read this whole document a 3rd time, he's not talking about "regular" kernel scheduling of threads/processes, he's talking about scheduling based on I/O needs which is a whole different beast.

  2. Finally... by physicsnick · · Score: 4, Insightful

    Everytime I read anything about Vista's new features, I hear myself saying "fucking finally" like half a dozen times. Symlinks? Cancelling I/O? These are things other, better operating systems have had for over a decade. Anyone wanna start a pool for when they'll roll out a patent for symlinks?

    1. Re:Finally... by cnettel · · Score: 5, Informative

      Cancelling I/O has been in Windows for long, "just" not always done properly. I have seen similar issues while killing processes in other OSes where they are stuck in some I/O. One reason for why this happens more frequently in Windows (in addition to bad drivers/a complicated driver model) is the fact that asynchronous I/O is so common. That way, you might not see the that the IO got stuck until you try to kill the process.

    2. Re:Finally... by Anonymous Coward · · Score: 4, Interesting

      How much praise was adorned on Linux when it got an O(1) scheduler? NT has had it for over a decade.

    3. Re:Finally... by RAMMS+EIN · · Score: 5, Informative

      `` I have seen similar issues while killing processes in other OSes where they are stuck in some I/O.''

      Oh, the horrors! I've had this happen to me many times, as well, especially on Linux. Not even a kill -9 would get rid of the wedged process. Why is there even such a thing as "non-interruptible sleep"? If I don't need the process anymore, I should be able to get rid of it no matter what.

      And wedged drivers, too. I think you can still see this for yourself by doing I/O with some USB device, and then yanking it out while the I/O is in progress. You get at least one process that you can't kill (I guess the comatose state causes ethical issues), and probably a driver you can't unload (although maybe new kernels allow you to do that). If you're "lucky", you get a whole lot of hardware devices that you can't use anymore, and any program that tries to gets into the dreaded D state.

      --
      Please correct me if I got my facts wrong.
    4. Re:Finally... by ultranova · · Score: 5, Informative

      How much praise was adorned on Linux when it got an O(1) scheduler? NT has had it for over a decade.

      Yes. A round robin scheduler, which runs every task for exactly 2 clock ticks except for foreground tasks which are run for 6 (or is this an XP improvement ?) - assuming there's no interrupts occurring during those ticks, of course - and not paying any attention to whether the task is IO- or CPU-bound. It performs absolutely shitty if you have anything heavy running in the background (say, POV-Ray rendering an image while you try to browse the Net). Praising that to be "O(1) scheduler" is about the same as calling the Goatse picture "art": sure, it may be technically true, but...

      What Linux was praised was getting a scheduler that handles 40 priority levels, real-time tasks, and multiple CPUs (500+, in some cases) while retaining both interactivity and high throughput, and doing all this in O(1) time. No version of Windows has ever gotten even close.

      --

      Forget magic. Any technology distinguishable from divine power is insufficiently advanced.

  3. Is this the same as... by tgatliff · · Score: 5, Funny

    Isnt this like entering the belly of the beast? I will save you some time in reading the article.

    Proper care for your Vista "Beast"
    1) Feed it plenty of CPU cycles. Preferrably multiple cores.
    2) Give it obsene amounts of memory. 2.5G preferable.
    3) This one seems to really enjoy Video Ram as wll, probably it tastes better. 256M advised.
    4) Keep feeding it a constant supply of disk space. Interestingly enough, this version seems to consume HD space simply with doing nothing.

    Thats the basics folks. Give your Vista beast what it needs and you should have a kind of good experience. At least for at least 6 months or so... Then you must slay the beast and re-install.. :-)

  4. Re:Soft links? by tuffy · · Score: 5, Informative

    The symlink(2) manpage mentions that they're also known as "soft links", as opposed to the hard links created by link(2). It's not a very common usage, though.

    --

    Ita erat quando hic adveni.

  5. Screenshot by Dirtside · · Score: 5, Funny

    They actually have a screenshot of what it looks like inside the Vista kernel.

    --
    "Destroy science and religion. Science would re-emerge exactly the same; but not religion." - Penn Jillette, paraphrased
    1. Re:Screenshot by bl8n8r · · Score: 4, Funny

      whew.. for a minute there I thought that was a link to goatse

      --
      boycott slashdot February 10th - 17th check out: altSlashdot.org
    2. Re:Screenshot by typobox43 · · Score: 5, Funny

      Don't worry, there's plenty of gaping holes in the kernel too.

  6. Re:MMCSS by Tim+C · · Score: 4, Insightful

    Classic: multimedia apps take precedence over anti-virus.

    Yes, as it should. If the AV activity is a scheduled full system scan, then it can indeed wait those few tenths of seconds extra, as if you're already infected, they won't make any difference. If it's a real time scan on a file you're accessing, then it can definitely wait, as the file won't be opened/executed until the scan has completed anyway.

    So what exactly is the problem with giving a multimedia app a higher priority on the processor than your AV software? We're not talking about killing the AV soft, just lowering the priority; it's still running.

    they've merely reimplemented nice

    You've been able to set process priority through the Task Manager since at least NT4 (the earliest I remember it being available; it may have been in earlier versions too, I just don't remember seeing it personally).

  7. Whoa by Sloppy · · Score: 4, Interesting

    I think we've finally seen the very first actually interesting Slashdot story about Vista. About fucking time.

    --
    As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
    1. Re:Whoa by mobby_6kl · · Score: 4, Funny

      What, you don't find outrageous articles based on misinformation and speculation, full of FUD and pure lies, written by people who know nothing about what an OS consists of besides window decorations and shiny progress bars, interesting?

      What are still you doing here?

  8. OS classes will always be open OS based by GodWasAnAlien · · Score: 5, Insightful

    Black box OS kernels like Windows can really never be disclosed. All you can really do is make some guesses or have an insider reveal some limited details.

    For this reason, OS classes in school will be based on Linux,BSD,Minux,or even ReactOS. With all of these, if want to really know how it works, there is the code.

    The secret-software-business is quite different that the shared discoveries of the scientific method that works well in education and science.

    Historically, the open ones will be the only ones that survive. In 50 years: You want to know how DOS worked in the 1980s? Well, no source is available. But freedos provides a good example of how it worked. You want to know how some random UNIX worked. Well the source to that specific one is not available, but BSD and Linux are a good examples of how it worked. You want to know how Windows-2000 worked? Well, no source code is available, but ReactOS provides a close approximation of how it worked.

    1. Re:OS classes will always be open OS based by dioscaido · · Score: 4, Informative

      True in theory, but Universities can license the source code of the windows kernel for academic purposes:

      http://www.microsoft.com/resources/sharedsource/Li censing/researchkernel.mspx

    2. Re:OS classes will always be open OS based by jadavis · · Score: 5, Insightful

      The secret-software-business is quite different that the shared discoveries of the scientific method that works well in education and science.

      Although you're right about closed software, computer science as a whole is actually much more open in many respects than some other scientific fields. In particular, the medical and biological science fields are quite closed-off. Even physics is somewhat closed-off, not by design, but because the equipment required to perform experiments is so expensive.

      Few computer science experiments take more than a couple thousand in capital investment. Also, if you have questions, you can often discuss your experiments, ideas, data, findings, etc. with an expert (or even industry leader) simply by signing up to a mailing list or going on IRC.

      --
      Social scientists are inspired by theories; scientists are humbled by facts.
  9. Inside the Windows Vista Kernel by jhines · · Score: 4, Funny

    The subject line made me think instantly of the old Adventure game,

    "you are in a maze of twisty passages all alike"

    sent a shiver up the spine.

  10. Re:MMCSS by timeOday · · Score: 5, Insightful

    You've been able to set process priority through the Task Manager since at least NT4
    Forget CPU sheduling priority, that is indeed old hat. What I saw in this article that really makes me jealous, as a Linux user, is I/O priority. Why have the systems people iterated for decades on CPU scheduling, and sorely neglected scheduling more precious resources like the network and disk? I can "nice" my system backup script, but what difference does it make when it's hogging the disk so much I can hardly load a new application? Process priorities should by default apply not only to the CPU, but to the disk and outbound network queues.
  11. Re:MMCSS by vadim_t · · Score: 4, Insightful

    That's complete nonsense.

    There are basically two options here:

    1. Antivirus hooks into the OS, and scans every program BEFORE it gets executed. In that case, the scanner's priority doesn't matter, it gets run before the program starts anyway.

    2. You run the antivirus scanning every file on disk, as a normal process. This would be what the priority adjustments affect, but doing things this way you can't really detect a new virus in real time. You can just find it during the scan, and the priority only determines how fast it will proceed when something else wants CPU time.

  12. Re:Bah! by Black+Acid · · Score: 5, Informative

    cfq/ionice is for reads only. "Due to the complex path writes take to get to the io scheduler there is no ionice support for writes yes so they are all treated equally." It'll happen...

  13. Re:MMCSS by QuickFox · · Score: 4, Insightful

    may need more I/O than WMP11 but will not get any because it's tagged Low in advance. You have misunderstood resource scheduling. If WMP doesn't need the cycles, they will be available for the Low Priority processes. No matter how low their priority, they will get the cycles that WMP doesn't need. WMP will preempt them only if and when it needs the cycles.

    Unfortunately many programmers seem to misunderstand this. Usually you can give user-interface processes very high priority, even if they are far less important than some of the background processes. Very often user-interface processes consume only limited amounts of processor cycles. When this happens, no matter how high their priority, they will leave plenty of cycles for the other processes.

    It doesn't matter if a virus-scanning process gets delayed a few additional seconds, because there's no person waiting for it and getting impatient. It does matter if a web browser or text editor gets delayed, because there is a human waiting for them.
    --
    Terrorists can't threaten a country's freedom and democracy. Only lawmakers and voters can do that.
  14. Re:MMCSS by Tim+C · · Score: 4, Insightful

    Perhaps you need to learn how AV software works. I said "If it's a real time scan on a file you're accessing, then it can definitely wait, as the file won't be opened/executed until the scan has completed anyway" because any anti-virus software worth using scans every single file you attempt to access before that access takes place. As such, it doesn't matter what the virus claims to be, the AV software will have scanned it before it tells the OS.

    The general sequence of events is:

    1 user double-clicks a file
    2 the AV soft's real-time scanner is invoked to scan it
    3a the file is clean, access is granted
    3b the file is dirty, access is denied

    It doesn't matter how long step 2 takes, or what other apps get to use cycles while it's suspended - it will complete before either of steps 3a or 3b.

  15. Making Symlinks in GUI? by physicsnick · · Score: 4, Insightful

    Having symlinks in the Vista kernel is nice and all, but Vista doesn't seem to offer a way to create these in Explorer. Who wants to break open a command line just to create a symlink?

    Correct me if I'm wrong, but don't people criticize Linux all the time of a lack of GUI utilities in comparison to Windows? Yet when I drag a file somewhere in KDE, I can just click on "Link Here" and poof, I've got a symlink. Why have I not heard a single complaint about the lack of a user-friendly way to do this in Vista?

    Furthermore, you need to have Administrator access (or use Administrator to give yourself the priviledge) to create a symlink, "because not all applications may handle symbolic links correctly". Doesn't this seem broken to anyone? Or at the very least, worrysome?

  16. Re:Soft links? by wirelessbuzzers · · Score: 5, Funny

    Does anyone else find it amusing that Wikipedia's page on soft links is a redirect?

    --
    I hereby place the above post in the public domain.