1. 计算机系 信息处理实验室 Lecture 3 System Mechanisms (1) xlanchen@03/11/2005

2. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 2 Contents Trap dispatching The executive object manager Synchronization System worker threads Local procedure calls (LPCs)

3. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 3 Trap dispatching Interrupt & exception Divert the processor to code outside the normal flow of control Trap: A processor's mechanism for 1.Capturing an executing thread when an exception or an interrupt occurs 2.Transferring control to a fixed location in the operating system

4. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 4 Trap handler a function specific to a particular interrupt or exception

5. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 5 Interrupts vs. exceptions Either hardware or software can generate exceptions and interrupts Interrupt An asynchronous event that is unrelated to what the processor is executing can occur at any time I/O devices, processor clocks, … can be enabled (turned on) or disabled (turned off)

6. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 6 Interrupts vs. exceptions Exception A synchronous condition that results from the execution of a particular instruction Can be reproduced Memory access violations, certain debugger instructions, divide-by-zero errors,… Additionally: System service calls

7. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 7 Stop and continue, how? Trap frame Created by the processor on the kernel stack of the interrupted thread Used to store the execution state of the thread Usually a subset of a thread's complete context

8. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 8 Trap dispatching Front-end trap handling functions Perform general trap handling tasks before and after transferring control to other functions that field the trap Example: The kernel hardware interrupt trap handler The general system service trap handler Unexpected trap handler (KeBugCheckEx)

9. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 9 Trap dispatching Interrupt dispatching Exception dispatching System service call dispatching

10. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 10 Interrupt Dispatching I/O control methods? Polling, interrupt, DMA Interrupt-driven device Allow the operating system to get the maximum use out of the processor by overlapping central processing with I/O operations Example: pointing devices, printers, keyboards, disk drives, and network cards

11. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 11 Interrupt time line for a single process doing output

12. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 12 Interrupt dispatching Interrupt trap handlers For device interrupt --|----> External routine, ISR | (Provided by device drivers) | |---> Internal kernel routine (Provided by kernel)

13. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 13 Hardware Interrupt Processing On x86 systems IRQ interrupt request  interrupt number IDT interrupt dispatch table filled at system boot time OS 8259 M 8259 S device CPU

14. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 14 EXPERIMENT Viewing the IDT

15. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 15 Hardware Interrupt Processing PIC: Programmable Interrupt Controller i8259A for uniprocessor systems (IBM PC) <=15 APIC: Advanced Programmable Interrupt Controller i82489 for multiprocessor systems Most new computers <=256

16. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 16 EXPERIMENT Viewing the PIC

17. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 17 IRQL (Interrupt request levels) Windows 2000 own interrupt priority scheme Interrupt numbers  IRQL Using IRQL Raise & lower

18. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 18 EXPERIMENT Viewing the IRQL

19. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 19 Lazy IRQL: a performance optimization Accessing a PIC is relatively slow Lazy IRQL The changing of the interrupt mask is delayed until a lower-priority interrupt occurs the lower-priority interrupt is postponed until the IRQL is lowered

20. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 20 Mapping interrupts to IRQLs HAL function HalpGetSystemInterruptVector On a uniprocessor system IRQL for Device = 27- interrupt vector

21. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 21 Important restriction Can't wait on an object at DPC/dispatch level or above Only nonpaged memory can be accessed at IRQL DPC/dispatch level or higher If violated, the system crashes with an IRQL_NOT_LESS_OR_EQUAL crash code.

22. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 22 Interrupt objects Contains the information about a device ISR, including the address of the ISR, the IRQL, the entry in the kernel's IDT

23. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 23 Software interrupts Including: Initiating thread dispatching Non-time-critical interrupt processing Handling timer expiration Asynchronously executing a procedure in the context of a particular thread Supporting asynchronous I/O operations

24. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 24 DPC Interrupt routines should exit asap and some knl activity easier when current code has unwound NT uses DPC to schedule non-immediate code, e.g. I/O drivers queue DPCs to complete I/O Knl uses DPC to handle timer expiration Knl uses DPC to reschedule when thread quantum expires Adding DPC to DPC queue causes dispatch/DPC interrupt Dispatch/DPC has low IRQL – deferred if IRQL higher Limits soft real-time capability of NT

25. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 25 Delivering a DPC

26. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 26 EXPERIMENT Monitoring Interrupt and DPC Activity

27. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 27 APC (Asynchronous procedure call) interrupts a way for user programs and system code to execute in the context of a particular user thread run at an IRQL less than 2 An APC routine can acquire resources (objects), wait on object handles, incur page faults, and call system services

28. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 28 Kernel mode vs. user mode Kernel mode APC Executive & device driver User mode APC Win32 APIs: ReadFileEx, WriteFileEx, and QueueUserAPC

29. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 29 Exception Dispatching Structured exception handling allows applications to gain control when exceptions occur The application can fix the condition and return, or declare back to the system that the exception isn't recognized The system should continue searching for an exception handler that might process the exception.

30. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 30 X86 Interrupt NumberException 0Divide Error 1DEBUG TRAP 2NMI/NPX Error 3Breakpoint 4Overflow 5BOUND/Print Screen 6Invalid Opcode 7Opcode7NPX Not Available 8Double Exception 9NPX Segment Overrun AInvalid Task State Segment (TSS) BSegment Not Present CStack Fault DDGeneral Protection EEPage Fault FIntel Reserved 10Floating Point 11Alignment Check

31. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 31 Exception dispatcher To find an exception handler that can "dispose of" the exception Some exceptions transparently are handled by kernel A few exceptions are allowed to filter back, untouched, to user mode kernel-mode exceptions If unhandled, are considered fatal operating system errors

32. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 32 Dispatching an exception

33. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 33 EXPERIMENT Viewing the Real User Start Address for Win32 Threads

34. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 34 EXPERIMENT Unhandled Exceptions

35. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 35 System Service Dispatching On X86 int 0x2e NtWriteFile: mov eax,0x0E; mov ebx,esp; int 0x2E; ret 0x2C;

36. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 36 System service exceptions

37. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 37 System service number to system service translation

38. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 38 System service dispatching

39. 计算机系 信息处理实验室 xlanchen@03/11/2005Understanding the Inside of Windows2000 39 EXPERIMENT Viewing System Service Activity