Understanding Processor: Processor State

Processor utilization can be further broken down into time spent executing in user mode (Intel Ring 3) or in privileged mode (Ring 0), two mutually exclusive states. Applications typically run in the more restricted user mode, while operating system functions run in privileged mode. Whenever, an application implicitly or explicitly calls an OS service (e.g. to allocate or free memory, or perform some operation on a file), a context switch occurs as the system transitions from user to privileged mode and back again. The portion of time that a tread is executing in user mode is captured as % User Time; privileged mode execution time is captured in the % Privileged Time counter. Read the rest of this entry »

Understanding Processor: Processor Basics

Windows is a multiprogramming OS, which means that it manages and selects among multiple programs that can all be active in various stages of execution at the same time. The displaceable unit in Windows, representing the application or system code to be executed, is the thread. The Scheduler running inside the Windows OS kernel keeps track of each thread in the system and points the processor hardware to threads that are ready to run. Read the rest of this entry »

Understanding Memory: System Working Set

Windows OS functions also consumes RAM, so the system has a working set that needs to be controlled and managed like any other process. In this section we discuss the components of the system working set and look at how it is managed. Read the rest of this entry »

Understanding Memory: LRU

LRU maintains an ordering of resident virtual memory pages from Most Recently Referenced to Least Recently Used. When real memory is full and an executing program references a pages that is not currently resident in memory (i.e. a page fault occurs), the Least Recently Used page in real memory is replaced with the current Most Recently Referenced page. Older pages, by inference, are less likely to by referenced again soon by executing programs, so they are the best candidates for page replacement. Older pages selected for replacements are effectively removed from memory – the next time they are referenced they must be retrieved from a paging file. If the page in memory was modified, the OS must first update the copy on the paging file before it is definitely removed. Read the rest of this entry »

Understanding Memory: Available Bytes

You can watch real memory filling up by monitoring Available Bytes, which represents free, unallocated RAM. Available Bytes counts the number of free pages in RAM at any particular time; it is the all-important buffer of free pages the OS maintains in order to resolve page faults quickly. The Available Bytes counter, like all the real memory allocation counters, report the amount of RAM currently not allocated to any process in bytes.

Read the rest of this entry »