© Microsoft Corporation1 Windows Kernel Internals Windows Service Processes David B. Probert, Ph.D. Windows Kernel Development Microsoft Corporation.

Slides:



Advertisements
Similar presentations
Advanced Troubleshooting with Debug Diagnostics on IIS 6
Advertisements

Impact of Cloud Computing on Enterprise Architecture Perspectives, Best Practices, & Pitfalls David March 2009.
CSC 360- Instructor: K. Wu Overview of Operating Systems.
Lectures on File Management
Microsoft® Windows® Rights Management Services (RMS) Deployment and Usage, Step-by-Step.
© 2004 IBM Corporation | February 5, 2004 John Arthorne, Eclipse Platform Core Jean-Michel Lemieux, Eclipse Platform Team Writing responsive UIs using.
Mutual Exclusion.
VIRUS AND SPY PROTECTION ARCHITECTURE. Page 2 Agenda In this module Processes and services Product components Message flow during various scan operations.
Slow Control LHCf Catania Meeting - July 04-06, 2009 Lorenzo Bonechi.
Operating-System Structures
Dr. Fabrizio Gala Dipartimento di Scienze di Base e Applicate Per l’Ingegneria – Sezione di Fisica Via Scarpa Rome, Italy 1.
IT Systems Multiprocessor System EN230-1 Justin Champion C208 –
Network Operating Systems Users are aware of multiplicity of machines. Access to resources of various machines is done explicitly by: –Logging into the.
IT Systems Operating System EN230-1 Justin Champion C208 –
70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment Chapter 8: Implementing and Managing Printers.
70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment, Enhanced Chapter 8: Implementing and Managing Printers.
70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment Chapter 8: Implementing and Managing Printers.
PRASHANTHI NARAYAN NETTEM.
INPUT/OUTPUT ORGANIZATION INTERRUPTS CS147 Summer 2001 Professor: Sin-Min Lee Presented by: Jing Chen.
1 Threads Chapter 4 Reading: 4.1,4.4, Process Characteristics l Unit of resource ownership - process is allocated: n a virtual address space to.
NovaBACKUP 10 xSP Technical Training By: Nathan Fouarge
FileSecure Implementation Training Patch Management Version 1.1.
Chapter 51 Threads Chapter 5. 2 Process Characteristics  Concept of Process has two facets.  A Process is: A Unit of resource ownership:  a virtual.
Host and Application Security Lesson 4: The Win32 Boot Process.
Rensselaer Polytechnic Institute CSCI-4210 – Operating Systems David Goldschmidt, Ph.D.
WINDOWS SERVICES. Introduction You often need programs that run continuously in the background Examples: – servers –Print spooler You often need.
© Microsoft Corporation1 Windows Kernel Internals I/O Architecture *David B. Probert, Ph.D. Windows Kernel Development Microsoft Corporation.
Threading Models in Visual Basic Language Student Name: Danyu Xu Student ID:98044.
9 Chapter Nine Compiled Web Server Programs. 9 Chapter Objectives Learn about Common Gateway Interface (CGI) Create CGI programs that generate dynamic.
Chapter 2: Operating-System Structures. 2.2 Silberschatz, Galvin and Gagne ©2005 Operating System Concepts Chapter 2: Operating-System Structures Operating.
Operating Systems Lecture 2 Processes and Threads Adapted from Operating Systems Lecture Notes, Copyright 1997 Martin C. Rinard. Zhiqing Liu School of.
Lecture 3 Process Concepts. What is a Process? A process is the dynamic execution context of an executing program. Several processes may run concurrently,
Debugging in Java. Common Bugs Compilation or syntactical errors are the first that you will encounter and the easiest to debug They are usually the result.
Some Design Notes Iteration - 2 Method - 1 Extractor main program Runs from an external VM Listens for RabbitMQ messages Starts a light database engine.
Operating Systems David Goldschmidt, Ph.D. Computer Science The College of Saint Rose CIS 432.
CS 346 – Chapter 4 Threads –How they differ from processes –Definition, purpose Threads of the same process share: code, data, open files –Types –Support.
Operating-System Structures. Operating System Services Operating systems provide an environment for execution of programs and services to programs and.
© 2004, D. J. Foreman 1 Implementing Processes and Threads.
Lecture 8 Page 1 CS 111 Online Other Important Synchronization Primitives Semaphores Mutexes Monitors.
Deadlock Detection and Recovery
Process Architecture Process Architecture - A portion of a program that can run independently of and concurrently with other portions of the program. Some.
Chapter 5 Introduction To Form Builder. Lesson A Objectives  Display Forms Builder forms in a Web browser  Use a data block form to view, insert, update,
Thread basics. A computer process Every time a program is executed a process is created It is managed via a data structure that keeps all things memory.
Lecture 4 Mechanisms & Kernel for NOSs. Mechanisms for Network Operating Systems  Network operating systems provide three basic mechanisms that support.
Chapter 3 Operating Systems. © 2005 Pearson Addison-Wesley. All rights reserved 3-2 Chapter 3 Operating Systems 3.1 The Evolution of Operating Systems.
SPI NIGHTLIES Alex Hodgkins. SPI nightlies  Build and test various software projects each night  Provide a nightlies summary page that displays all.
COMP091 – Operating Systems 1 Memory Management. Memory Management Terms Physical address –Actual address as seen by memory unit Logical address –Address.
Internet Information Server 6.0 & new management features.
CHAPTER 3 Router CLI Command Line Interface. Router User Interface User and privileged modes User mode --Typical tasks include those that check the router.
CPS110: Implementing threads on a uni-processor Landon Cox January 29, 2008.
Troubleshooting Windows Vista Lesson 11. Skills Matrix Technology SkillObjective DomainObjective # Troubleshooting Installation and Startup Issues Troubleshoot.
OPERATING SYSTEM CONCEPT AND PRACTISE
Chapter Objectives In this chapter, you will learn:
Memory Caches & TLB Virtual Memory
CHAPTER 14 - DEBUGGING WINDOWS SERVICES
Chapter 2: System Structures
Implementing Processes and Threads
LCGAA nightlies infrastructure
Introduction to Operating System (OS)
Senior Software Engineering Student Robertas Sys
Threads Chapter 4.
Implementing Processes and Threads
Chapter 2: Operating-System Structures
Chapter 4: Threads.
Microsoft SQL Server 2014 for Oracle DBAs Module 1
Operating System Concepts
Operating System Concepts
Message Passing Systems Version 2
Message Passing Systems
Presentation transcript:

© Microsoft Corporation1 Windows Kernel Internals Windows Service Processes David B. Probert, Ph.D. Windows Kernel Development Microsoft Corporation

© Microsoft Corporation2 What are services? Processes that run without needing an interactive logon –Services run without anybody logging on –Allow headless operation of machine Windows equivalent of UNIX daemons

© Microsoft Corporation3 NT Service Architecture The Service Controller Started early in boot by Winlogon Responsible for enforcing service load order and dependencies Spawns all service processes Manages/watches all services on the local machine –Allows access to services via API calls –Guards access to services via access checks

© Microsoft Corporation4 NT Service Architecture Service Processes Processes that host/implement one or more services Configured to run under a certain account –Can run interactively as LocalSystem Examples: –spoolsv.exe (Spooler, LocalSystem, interactive) –svchost.exe (generic host, any account) –services.exe (Eventlog, PlugPlay)

© Microsoft Corporation5 NT Service Architecture Services Have a service name and display name –e.g., “PlugPlay” vs. “Plug and Play” Config info stored under …\CCS\Services\ Follows service programming model –Implements ServiceMain and Handler(Ex) routine –Multiple services in-proc  each one implements a ServiceMain and Handler(Ex) routine

© Microsoft Corporation6 NT Service Architecture Service Control Programs (SCPs) Programs that call Service Controller APIs to manipulate services –Services MMC snap-in –sc.exe –net.exe (somewhat – provides start/stop only) SCPs call into the Service Controller, not the individual service processes

© Microsoft Corporation7 NT Service Architecture How the pieces fit together services.exe Service Controller creates a service process inetinfo.exe Service process connects to per-process named pipeService Controller tells service to start via pipe ServiceMain Service finishes starting and waits for service controls Listen on pipe Service Controller starts more services spoolsv.exe Listen on pipe svchost.exe Listen on pipe User invokes SCP to control a service (stop Spooler) Services snap-in (mmc.exe) SCP RPCs into services.exe (via ControlService)SCM sends control to appropriate service process Service process routes control to appropriate handler Handler(Ex) Service processes control and returns from handler Listen on pipe Services may have their own RPC interfaces/clients RPC client

© Microsoft Corporation8 The Service Controller Starting services Service controller auto-starts services in group order –List at …\CCS\Control\ServiceGroupOrder –Service may be configured as part of a group or ungrouped –Ungrouped services started last Service controller manages dependencies –Services may depend on other services or service groups –If dependent service (or service group) fails to start, SCM will fail start of service with ERROR_SERVICE_DEPENDENCY_FAIL Service Controller holds a critsec through entire auto-start process –Acquires/holds same critsec for each demand-start request –Allows SCM to enforce load-ordering –Means calls to StartService block until auto-start is complete

© Microsoft Corporation9 The Service Controller Starting services and hang detection SCM waits for service to start if it is an auto-start service (being started as part of auto-start) or if it is a service on which a service being demand-started depends Service sets its dwWaitHint and dwCheckPoint via SetServiceStatus calls during its ServiceMain –dwCheckPoint  Current “stage” of service initialization –dwWaitHint  Estimated time to get to next checkpoint SCM uses a hang-detection scheme when waiting for a service to start (i.e., move out of the SERVICE_START_PENDING state) –Service gets 80 seconds plus its dwWaitHint to update its dwCheckPoint. If it doesn’t, SCM assumes service is hung and stops waiting for it (and kills the process if possible)

© Microsoft Corporation10 The Service Controller Starting services (miscellaneous) Debugging service start –Configure the service process to start under the debugger piped out to the kd –Debugging using local debugger only (e.g., “ntsd” without “-d”) is difficult since the SCM will kill the service process if it takes more than 30 seconds to connect. Auto-start services have a significant performance effect –Many services starting up at boot leads to lots of I/O requests and contention over global resources (e.g., registry lock) –Can have a significant effect on boot time –If you can avoid making your service auto-start, do so

© Microsoft Corporation11 svchost.exe How it works Individual services are configured to run in a particular instance of svchost.exe –Done through binary path associated with service (set when service is created or reconfigured) –Use “%SystemRoot%\system32\svchost.exe –k ” The list of services that can run in a particular process is static so list of services that run in an instance of svchost.exe must be well- known –Lists live at HKLM\Software\Microsoft\Windows NT\Svchost When svchost.exe starts up, it reads the list of services for the instance and sets a generic ServiceMain for each service Generic ServiceMain loads service DLL and then calls service’s actual ServiceMain routine (configured under the service’s Parameters key)

© Microsoft Corporation12 Writing a Service Picking an account Win2K and earlier – service runs as LocalSystem with client LIB/DLL –Problem is that LocalSystem is too powerful Windows XP and beyond – service runs in new LocalService or NetworkService accounts –Greatly reduced privilege set –Have authenticated user access to objects (for the most part) –LocalService goes off-machine anonymously –NetworkService goes off-machine as machine account –Already instances of svchost.exe that run in these accounts (“LocalService” and “NetworkService” instances) –Configure account name of “NT AUTHORITY”\LocalService or “NT AUTHORITY”\NetworkService and empty password

© Microsoft Corporation13 Writing a Service Performance Considerations Every process on the machine has a cost in memory (800K minimum working set vs. ~150K) –Rather than creating a new EXE for your service, run inside of a pre-existing instance of svchost.exe New threads have a cost in memory (each thread has stack pages that use up working set) –Rather than calling CreateThread for work items, use the NT thread pool APIs Avoid making your service auto-start if possible

© Microsoft Corporation14 Writing a Service Being a good shared-process citizen Avoid APIs with process-wide effects –ExitProcess, ExitThread, TerminateThread –CoInitializeSecurity, RpcMgmt* APIs, etc. Avoid scary thread pool tricks –Blocking indefinitely during a work item –Returning pool thread in a different state Don’t unload your own service DLL (FreeLibraryAndExitThread) Don’t rely on running in a particular host process or instance of svchost

© Microsoft Corporation15 Writing a Service Common Bugs During Service Start “Update” thread during service start –Service spins up a thread to loop while calling SetServiceStatus w/updated dwCheckPoint –If the ServiceMain hangs for real, no way for SCM to know. Boot hangs. Inaccurate dwWaitHint –Service may be killed when it’s not actually hung (hint too small) or take too long to time out if actually hung (hint too large)

© Microsoft Corporation16 Writing a Service Common Bugs During Service Start Trying to start another service from inside the ServiceMain –SCM holds global critsec when it waits for a service to start –StartService call needs that same critsec –Deadlock until service “times out” Implicitly depending on another service –Service polls for another service to be up and running in its ServiceMain –If load-ordering isn’t quite right (or is changed), the condition may never be met (e.g., polling on a service in a later load-order group) –If polling logic isn’t 100% correct (and it almost never is), other problems show up

© Microsoft Corporation17 Writing a Service Common Bugs During Service Stop Service does clean-up after stopping –Service calls SetServiceStatus with SERVICE_STOPPED and then does some cleanup –As soon as the service reports that status, the SCM can start up a new instance of it. If the new instance starts while the old instance is still cleaning up, mayhem ensues

© Microsoft Corporation18 Writing a Service Common bugs during Service Stop Shared-process service doesn’t clean up globals on stop or reinit globals on restart –Service runs in a process that doesn’t unload the service DLL when it stops (e.g., svchost) –Service is stopped/restarted. On restart, state of service based on stale globals is misleading. Service process does work after StartServiceCtrlDispatcher returns –Once last service in the process stops, SCM waits 30 seconds for process to exit before killing it

© Microsoft Corporation19 Writing a Service Other Common Bugs Service takes too long in its control handler –One handler thread shared among all services in a process –SCM only waits 30 seconds for calls into the handler to return –If service wedges in its handler, handler thread is wedged for the entire process Modifying service config info in the registry directly –All service config info is stored in a known registry location, so app tweaks that info directly –The SCM doesn’t watch the service keys for changes – it reads/writes data to/from those keys at different times in response to API calls –Much more likely that this will hose the service rather than reconfigure it – use the SCM APIs

© Microsoft Corporation20 Discussion