Packages sets and #SMT sets. Windows uses 5 fields in the KPRCB to determine correct scheduling decisions when dealing with logical processor topologies. The first field, #CoresPerPhysicalProcessor, determines wheter this logical processor is part of a multicore package. /1 It's computed from the CPUID returned by the processor and rounded to a power of 2. The 2nd field, #LogicalProcessorPerCore, determines wheter the logical processor is part of an SMT set, such as on an AMD with SMT, it is also queried through CPUID and rounded. /2

#ETW is an efficient kernel-level tracing facility that lets you log kernel or app-defined events to a log file (#ETL). You can consume the events in real time or from a log file and use them to debug an app or to determine where perf issues are occurring in the app. (1/17) ETW lets you enable or disable event tracing dynamically, allowing you to perform detailed tracing in a production environment without requiring computer or application restarts. (2/17)

#WindowsInternals #Drivers (1/7) Drivers are call back mechanisms to send or retrieve I/O between the operating system and devices such as NIC’s, Storage Controllers, and USB keyboards and mice.
They are typically loaded during the system boot sequence (after NTLDR but before Ctrl+Alt+Del presentation). (2/7)

Articles #WindowsInternals (1/6) Introduction to DPCs
msdn.microsoft.com/en-us/library/… (2/6)

#ContexSwitching #WindowsInternals (1/8) Until threads that are suspended or blocked become ready to run, the scheduler does not allocate any processor time to them, regardless of their priority (2/8)

CPU Scheduler #WindowsInternals (1/9) The system scheduler controls multitasking by determining which of the competing threads receives the next processor time slice. (2/9)

CPU Idle States #Cstates #WindowsInternals (1/6) C-states, also known as CPU Idle states, are states when the CPU has reduced or turned off selected functions. Different processors support different numbers of C-states in which various parts of the CPU are turned off. (2/6)

ISR vs DPCs #WindowsInternals #ProcessorDebug (1/5) ISR: A software routine that hardware invokes in response to an interrupt. ISRs examine an HARDWARE interrupt and determine how to handle it. (2/5)

Performance Counter Series #4 #WindowsInternals #Perfmon
Logman.exe create counter Perf-Counter-Log (1/4) -f bincirc –v mmddhhmm –max 512 - This part of the command specifies that we are creating a Binary Circular file, sets the versioning to the mmddhhmm format, and the maximum log size to 512MB (2/4)

Performance Counter Series #1 #WindowsInternals #Perfmon
Counter Structure: Performance Counter Series #2 #WindowsInternals #Perfmon
Counter Types:
Instantaneous - Displays the most recent measurement, Single observation, or Sample of the value right now - example: Memory\Available Bytes (1/4)