Windows® Internals, Sixth Edition, Part 1

Table 1-2. Mode-Related Performance Counters

Object: Counter

Function

Processor: % Privileged Time

Percentage of time that an individual CPU (or all CPUs) has run in kernel mode during a specified interval

Processor: % User Time

Percentage of time that an individual CPU (or all CPUs) has run in user mode during a specified interval

Process: % Privileged Time

Percentage of time that the threads in a process have run in kernel mode during a specified interval

Process: % User Time

Percentage of time that the threads in a process have run in user mode during a specified interval

Thread: % Privileged Time

Percentage of time that a thread has run in kernel mode during a specified interval

Thread: % User Time

Percentage of time that a thread has run in user mode during a specified interval

EXPERIMENT: Kernel Mode vs. User Mode

You can use the Performance Monitor to see how much time your system spends executing in kernel mode vs. in user mode. Follow these steps:

Run the Performance Monitor by opening the Start menu and selecting All Programs /Administrative Tools/Performance Monitor. Select the Performance Monitor node under Performance/Monitoring Tools on the left-side tree.

Click the Add button (+) on the toolbar.

Expand the Processor counter section, click the % Privileged Time counter and, while holding down the Ctrl key, click the % User Time counter.

Click Add, and then click OK.

Open a command prompt, and do a directory scan of your C drive over the network by typing dir \\%computername%\c$ /s.

When you’re finished, just close the tool.

You can also quickly see this by using Task Manager. Just click the Performance tab, and then select Show Kernel Times from the View menu. The CPU usage bar will show total CPU usage in green and kernel-mode time in red.

To see how the Performance Monitor itself uses kernel time and user time, run it again, but add the individual Process counters % User Time and % Privileged Time for every process in the system:

If it’s not already running, run the Performance Monitor again. (If it is already running, start with a blank display by right-clicking in the graph area and selecting Remove All Counters.)

Click the Add button (+) on the toolbar.

In the available counters area, expand the Process section.

Select the % Privileged Time and % User Time counters.

Select a few processes in the Instance box (such as mmc, csrss, and Idle).

Click Add, and then click OK.

Move the mouse rapidly back and forth.

Press Ctrl+H to turn on highlighting mode. This highlights the currently selected counter in black.

Scroll through the counters at the bottom of the display to identify the processes whose threads were running when you moved the mouse, and note whether they were running in user mode or kernel mode.

You should see the Performance Monitor process (by looking in the Instance column for the mmc process) kernel-mode and user-mode time go up when you move the mouse because it is executing application code in user mode and calling Windows functions that run in kernel mode. You’ll also notice kernel-mode thread activity in a process named csrss when you move the mouse. This activity occurs because the Windows subsystem’s kernel-mode raw input thread, which handles keyboard and mouse input, is attached to this process. (See Chapter 2 for more information about system threads.) Finally, the process named Idle that you see spending nearly 100 percent of its time in kernel mode isn’t really a process—it’s a fake process used to account for idle CPU cycles. As you can observe from the mode in which the threads in the Idle process run, when Windows has nothing to do, it does it in kernel mode.

Terminal Services and Multiple Sessions

Terminal Services refers to the support in Windows for multiple interactive user sessions on a single system. With Windows Terminal Services, a remote user can establish a session on another machine, log in, and run applications on the server. The server transmits the graphical user interface to the client (as well as other configurable resources such as audio and clipboard), and the client transmits the user’s input back to the server. (Similar to the X Window System, Windows permits running individual applications on a server system with the display remoted to the client instead of remoting the entire desktop.)

The first session is considered the services session, or session zero, and contains system service hosting processes (explained in further detail in Chapter 4). The first login session at the physical console of the machine is session one, and additional sessions can be created through the use of the remote desktop connection program (Mstsc.exe) or through the use of fast user switching (described later).