计算机系 信息处理实验室 Lecture 3 System Mechanisms (1)

计算机系 信息处理实验室 the Inside of Windows Contents Trap dispatching The executive object manager Synchronization System worker threads Local procedure calls (LPCs)

计算机系 信息处理实验室 the Inside of Windows Trap dispatching Interrupt & exception Divert the processor to code outside the normal flow of control Trap: A processor's mechanism for 1.Capturing an executing thread when an exception or an interrupt occurs 2.Transferring control to a fixed location in the operating system

计算机系 信息处理实验室 the Inside of Windows Trap handler a function specific to a particular interrupt or exception

计算机系 信息处理实验室 the Inside of Windows Interrupts vs. exceptions Either hardware or software can generate exceptions and interrupts Interrupt An asynchronous event that is unrelated to what the processor is executing can occur at any time I/O devices, processor clocks, … can be enabled (turned on) or disabled (turned off)

计算机系 信息处理实验室 the Inside of Windows Interrupts vs. exceptions Exception A synchronous condition that results from the execution of a particular instruction Can be reproduced Memory access violations, certain debugger instructions, divide-by-zero errors,… Additionally: System service calls

计算机系 信息处理实验室 the Inside of Windows Stop and continue, how? Trap frame Created by the processor on the kernel stack of the interrupted thread Used to store the execution state of the thread Usually a subset of a thread's complete context

计算机系 信息处理实验室 the Inside of Windows Trap dispatching Front-end trap handling functions Perform general trap handling tasks before and after transferring control to other functions that field the trap Example: The kernel hardware interrupt trap handler The general system service trap handler Unexpected trap handler (KeBugCheckEx)

计算机系 信息处理实验室 the Inside of Windows Trap dispatching Interrupt dispatching Exception dispatching System service call dispatching

计算机系 信息处理实验室 the Inside of Windows Interrupt Dispatching I/O control methods? Polling, interrupt, DMA Interrupt-driven device Allow the operating system to get the maximum use out of the processor by overlapping central processing with I/O operations Example: pointing devices, printers, keyboards, disk drives, and network cards

计算机系 信息处理实验室 the Inside of Windows Interrupt time line for a single process doing output

计算机系 信息处理实验室 the Inside of Windows Interrupt dispatching Interrupt trap handlers For device interrupt --|----> External routine, ISR | (Provided by device drivers) | |---> Internal kernel routine (Provided by kernel)

计算机系 信息处理实验室 the Inside of Windows Hardware Interrupt Processing On x86 systems IRQ interrupt request  interrupt number IDT interrupt dispatch table filled at system boot time OS 8259 M 8259 S device CPU

计算机系 信息处理实验室 the Inside of Windows EXPERIMENT Viewing the IDT

计算机系 信息处理实验室 the Inside of Windows Hardware Interrupt Processing PIC: Programmable Interrupt Controller i8259A for uniprocessor systems (IBM PC) <=15 APIC: Advanced Programmable Interrupt Controller i82489 for multiprocessor systems Most new computers <=256

计算机系 信息处理实验室 the Inside of Windows EXPERIMENT Viewing the PIC

计算机系 信息处理实验室 the Inside of Windows IRQL (Interrupt request levels) Windows 2000 own interrupt priority scheme Interrupt numbers  IRQL Using IRQL Raise & lower

计算机系 信息处理实验室 the Inside of Windows EXPERIMENT Viewing the IRQL

计算机系 信息处理实验室 the Inside of Windows Lazy IRQL: a performance optimization Accessing a PIC is relatively slow Lazy IRQL The changing of the interrupt mask is delayed until a lower-priority interrupt occurs the lower-priority interrupt is postponed until the IRQL is lowered

计算机系 信息处理实验室 the Inside of Windows Mapping interrupts to IRQLs HAL function HalpGetSystemInterruptVector On a uniprocessor system IRQL for Device = 27- interrupt vector

计算机系 信息处理实验室 the Inside of Windows Important restriction Can't wait on an object at DPC/dispatch level or above Only nonpaged memory can be accessed at IRQL DPC/dispatch level or higher If violated, the system crashes with an IRQL_NOT_LESS_OR_EQUAL crash code.

计算机系 信息处理实验室 the Inside of Windows Interrupt objects Contains the information about a device ISR, including the address of the ISR, the IRQL, the entry in the kernel's IDT

计算机系 信息处理实验室 the Inside of Windows Software interrupts Including: Initiating thread dispatching Non-time-critical interrupt processing Handling timer expiration Asynchronously executing a procedure in the context of a particular thread Supporting asynchronous I/O operations

计算机系 信息处理实验室 the Inside of Windows DPC Interrupt routines should exit asap and some knl activity easier when current code has unwound NT uses DPC to schedule non-immediate code, e.g. I/O drivers queue DPCs to complete I/O Knl uses DPC to handle timer expiration Knl uses DPC to reschedule when thread quantum expires Adding DPC to DPC queue causes dispatch/DPC interrupt Dispatch/DPC has low IRQL – deferred if IRQL higher Limits soft real-time capability of NT

计算机系 信息处理实验室 the Inside of Windows Delivering a DPC

计算机系 信息处理实验室 the Inside of Windows EXPERIMENT Monitoring Interrupt and DPC Activity

计算机系 信息处理实验室 the Inside of Windows APC (Asynchronous procedure call) interrupts a way for user programs and system code to execute in the context of a particular user thread run at an IRQL less than 2 An APC routine can acquire resources (objects), wait on object handles, incur page faults, and call system services

计算机系 信息处理实验室 the Inside of Windows Kernel mode vs. user mode Kernel mode APC Executive & device driver User mode APC Win32 APIs: ReadFileEx, WriteFileEx, and QueueUserAPC

计算机系 信息处理实验室 the Inside of Windows Exception Dispatching Structured exception handling allows applications to gain control when exceptions occur The application can fix the condition and return, or declare back to the system that the exception isn't recognized The system should continue searching for an exception handler that might process the exception.

计算机系 信息处理实验室 the Inside of Windows X86 Interrupt NumberException 0Divide Error 1DEBUG TRAP 2NMI/NPX Error 3Breakpoint 4Overflow 5BOUND/Print Screen 6Invalid Opcode 7Opcode7NPX Not Available 8Double Exception 9NPX Segment Overrun AInvalid Task State Segment (TSS) BSegment Not Present CStack Fault DDGeneral Protection EEPage Fault FIntel Reserved 10Floating Point 11Alignment Check

计算机系 信息处理实验室 the Inside of Windows Exception dispatcher To find an exception handler that can "dispose of" the exception Some exceptions transparently are handled by kernel A few exceptions are allowed to filter back, untouched, to user mode kernel-mode exceptions If unhandled, are considered fatal operating system errors

计算机系 信息处理实验室 the Inside of Windows Dispatching an exception

计算机系 信息处理实验室 the Inside of Windows EXPERIMENT Viewing the Real User Start Address for Win32 Threads

计算机系 信息处理实验室 the Inside of Windows EXPERIMENT Unhandled Exceptions

计算机系 信息处理实验室 the Inside of Windows System Service Dispatching On X86 int 0x2e NtWriteFile: mov eax,0x0E; mov ebx,esp; int 0x2E; ret 0x2C;

计算机系 信息处理实验室 the Inside of Windows System service exceptions

计算机系 信息处理实验室 the Inside of Windows System service number to system service translation

计算机系 信息处理实验室 the Inside of Windows System service dispatching

计算机系 信息处理实验室 the Inside of Windows EXPERIMENT Viewing System Service Activity