none
Affinity for not-running processes in Windows 7 RRS feed

  • Question

  • Hello,

    Is it possible to write application or just to set affinity for all processes in the Windows 7 and for not-running executables and not-running processes also? Or if it is possible we need to set property for every process in the system with affinity to be executed on some core of CPU.

    We need to free one core in our system for using in Kernel mode.

    --

    Kind regards,

    Alexey Kisliy



    • Edited by Oleksii Kyslyi Thursday, July 25, 2013 4:20 PM Added one point
    Thursday, July 25, 2013 4:14 PM

Answers

  • the OS doesn't work this way. you will not have exclusive access to a core and you can't always control the context in which you execute in your driver.

    d -- This posting is provided "AS IS" with no warranties, and confers no rights.

    Thursday, July 25, 2013 4:50 PM

All replies

  • the OS doesn't work this way. you will not have exclusive access to a core and you can't always control the context in which you execute in your driver.

    d -- This posting is provided "AS IS" with no warranties, and confers no rights.

    Thursday, July 25, 2013 4:50 PM
  • Hmm, I'm not so sure.

    You can certainly prevent threads and interrupts from using a particular core. The only thing you cannot prevent from running on a core are DPC routines. Now that I think about it, you could use PsSetCreateProcessNotifyRoutineEx to cause a callback routine to be called each time a process is created, then when it is called you could change the process's affinity. Threads in protected processes may be difficult, but most real-time systems wouldn't likely use them.

    For system threads, obviously you can change the affinity of any thread currently running. I wonder if you changed the process affinity of the System process, whether the system threads would inherit that mask. If not, you could use PsSetCreateThreadNotifyRoutine to cause a callback routine to be called each time a thread is created, and if it is a system thread, change its affinity.

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting.

    Thursday, July 25, 2013 10:42 PM
    Moderator
  • You can't control isr and work item context either. Technically you can affinitize your isr when you connect it, but that limits scaling up

    d -- This posting is provided "AS IS" with no warranties, and confers no rights.

    Friday, July 26, 2013 1:23 AM
  • Tell me, please, is it possible to set affinity for system processes in Windows 7?

    And also is interesting, whether we can set affinity for Windows 7 services.

    Active and not active. Running and not running.

    --

    Kind regards,

    Alexey Kisliy

    Friday, July 26, 2013 7:05 AM
  • What do you mean by "System Processes"? That is an imprecise term.

    There is not a supported way to set the affinity of a service that will take effect when it starts. However, you can set the affinity for services (or any other process) using the methods I described earlier. You can even use Task Manager or PowerShell, as well.  You can also use the START command with the /AFFINITY switch to start a program with the specified affinity.

    "Active and not active. Running and not running." Is there a question in there somewhere?

    By the way, I just ran across this, which you might find interesting. I have no knowledge of whether this works: http://bitsum.com/processlasso/

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting.


    Friday, July 26, 2013 7:45 AM
    Moderator
  • What do you mean by "System Processes"? That is an imprecise term.

    "Active and not active. Running and not running." Is there a question in there somewhere?

    By the way, I just ran across this, which you might find interesting. I have no knowledge of whether this works: http://bitsum.com/processlasso/

     -Brian

    Under system processes I meant processes, which are part of Windows.

    About active and not active, running and not running - there was question, whether we can set affinity for active and not active services, running and not running processes.

    I spoke yesterday already with developer from bitsum.com. He can not help me to find solution. The most expirienced guys are here on the current forum.

    --

    Kind regards,

    Alexey Kisliy

    Friday, July 26, 2013 8:17 AM
  • As I wrote, there is not a supported mechanism for specifying the affinity of services, so you'll have to use one of the methods I've given you (personally, I'd write a boot-start driver and use the PsXxx callbacks). As for setting the affinity of ISRs, you'll have to write a bus filter for the PCI bus that will modify the START_DEVICE IRPs on the way up each DevStack and remove a particular CPU from the interrupt resource's affinity mask, which you will find extraordinarily difficult because Microsoft doesn't document how to write bus filters (hint: you cannot use KMDF, it has to be done using WDM).

    As Doron indicated, this is well outside of what can be considered "normal", and it skirts the edge of not only supportability but also what can be considered reasonable because Windows really wasn't designed for real-time work. Yes, most, or all, of what you want to do is possible, but the question is, "is it worth the expense?", because it will definitely be expensive not only to write, but also to maintain.

    I hope this helps

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting.

    Friday, July 26, 2013 8:56 AM
    Moderator
  • Now that I think about it, you could use PsSetCreateProcessNotifyRoutineEx to cause a callback routine to be called each time a process is created, then when it is called you could change the process's affinity.

     -Brian


    Hi, Brian,

    Can use these PsSetCreateProcessNotifyRoutine or PsSetCreateProcessNotifyRoutineEx functions in any kernel mode driver to catch newly started process in the system?

    Thank you in advance.

    --

    Kind regards,

    Alexey Kisliy

    Wednesday, July 31, 2013 12:06 PM
  • Yes, pretty much; those APIs are exported by NTOSKRNL

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting.

    Wednesday, July 31, 2013 6:24 PM
    Moderator