Data structures of a Windows thread

Windows implements the Windows API, which is the primary API for the family of Microsoft operating systems (Windows 98, NT, 2000, XP, and Windows 7). A Windows application runs as a separate process, and each process may contain one or more threads. Additionally, Windows uses the one-to-one mapping, where each user-level thread maps to an associated kernel thread.

Components of a Windows Thread

The general components of a thread include −

• A thread ID uniquely identifying the thread

• A set of registers representing the status of the processor

• A user stack, employed when the thread is running in user mode, and a kernel stack, employed when the thread is running in kernel mode

• A private storage area used by various run-time libraries and dynamic link libraries (DLLs)

The register set, stacks, and private storage area are known as the context of the thread.

Primary Data Structures

Windows threads are implemented using three primary data structures that work together to manage thread execution and state −

• ETHREAD − Executive Thread Block

• KTHREAD − Kernel Thread Block

• TEB − Thread Environment Block

ETHREAD (Executive Thread Block)

The ETHREAD contains essential components including a pointer to the process to which the thread belongs and the address of the routine where the thread starts control. The ETHREAD also contains a pointer to the corresponding KTHREAD structure.

KTHREAD (Kernel Thread Block)

The KTHREAD includes scheduling and synchronization information for the thread. It contains the kernel stack (used when the thread runs in kernel mode) and a pointer to the TEB. This structure handles low-level thread management operations.

TEB (Thread Environment Block)

The TEB is a user-space data structure accessed when the thread runs in user mode. It contains the thread identifier, a user-mode stack, and an array for thread-local storage. Among other fields, the TEB provides thread-specific information accessible to user-mode applications.

Key Characteristics

The ETHREAD and KTHREAD exist entirely in kernel space, meaning only the kernel can access them. This design ensures proper separation between kernel-level thread management and user-level thread operations.

Conclusion

Windows thread architecture uses a three-layer approach with ETHREAD, KTHREAD, and TEB structures to provide comprehensive thread management. This design separates executive functions, kernel scheduling, and user-mode operations while maintaining efficient one-to-one thread mapping between user and kernel levels.