A while ago, there was a data structure called the _GROUP_AFFINITY, where the fields were quite confusing to me at first, however, I have found the answer to my question.
Using the _KTHREAD data structure with the address of a selected thread, we can see the _GROUP_AFFINITY data structure:
Using the same address of the thread, we can use it with the _GROUP_AFFINITY data structure, and gather the following output:
Processor Groups are only available on x64 versions of Windows 7, Windows 8, Windows Server 2008 R2 edition and Windows Server 2012 edition. Each physical processor usually has multiple cores, which provide multiple logical processors for the operating system to utilize.
The current definitions and differences are described below:
- Physical Processor – The physical CPU and socket.
- Logical Processor – One unit which can perform calculations and perform tasks.
- Core – One processor unit.
If a processor has 64 logical processors (x64), then these logical processors are considered to part of one group. The first group is numbered at 0, and if the processor has less than 64 logical processors the processor group will always be numbered 0. In Windows 7, the group numbers must range from 0 to 3. On x86, the maximum number of processors per a group is 32.
By default and at the beginning of a process’ lifetime, it is assigned to one processor group, and any subsequent threads belonging to that process are also assigned to the same group number.
On the other hand, if a process need to run across multiple processor groups, then it must set each thread to the correct processor affinity mask. Using the INHERIT_PARENT_AFFINITY flag to set a parent process, any child processes can be set to run on a particular affinity mask, or if the processor needs to remain in the same group but be able to spread across multiple processor groups, then GetProcessAffinityMask and SetProcessAffinityMask can be called to edit the affinity mask of the process and then threads.
The other field I would like to discuss is the Mask field, which was another confusing aspect for me, since at first I would it was referring to the number of cores for my processor, which would have been 2, but the value here is 6. The field refers to the number of logical processors within that processor group specified by the Group field, and which logical processors a thread can run on.
The _GROUP_AFFINITY data structure can also be used to set interrupt affinities, to restrict which processor groups can receive interrupts.
Processor Groups (Windows)
Windows Driver Kit Documentation