Windows系统的线程调度与软件中断分发

在Windows操作系统内核把软件中断分为三个中断级别：DISPATCH_LEVEL，APC_LEVEL，PASSVIE_LEVEL。同时他们与线程的调试相关，WINDOWS内核中没有一个专门的程序来做线程的调度工作，它是散落在系统各个部分的。总结一下主要以下几种情况。

当空闲线程运行时粗略讲是1.先检查当前处理的DPC例程队列，分发DPC调用。2.检查NextThread是否为空，如果存在不为空就切换到这个线程，若为空进行第三步3.执行线程的调试算法。

当HalpDispatchSoftwareInterrupt被调用时。这个函数主要流程还是比较简单的，判断了第一个参数是否为1（APC_LEVEL）如果是调用KiDeliverApc来分发APC例程。若不是接看是否为2(DISPATCH_LEVEL)，是的话就调用KiDispatchInterrupt。KiDispatchInterrupt这个函数内容较多，不过流程上跟空闲进程差不多。只是它检查了当前处理器的QuantumEnd标记，若不为0就执行KiQuantumEnd，KiQuantumEnd这个函数进行了线程的调试。

hal!HalpDispatchSoftwareInterrupt:

83c1f8c6 8bff            mov     edi,edi

83c1f8c8 55              push    ebp

83c1f8c9 8bec            mov     ebp,esp

83c1f8cb51              push    ecx

83c1f8cc53              push    ebx

83c1f8cd56              push    esi

83c1f8ce 9c              pushfd

83c1f8cf58              pop     eax

83c1f8d08945fc          mov     dword ptr [ebp-4],eax

83c1f8d38b75fc          mov     esi,dword ptr [ebp-4]

83c1f8d681e600020000    and     esi,200h

83c1f8dc 8a4508          mov     al,byte ptr [ebp+8]

83c1f8df 64a224000000    mov    byte ptr fs:[00000024h],al

83c1f8e57501            jne     hal!HalpDispatchSoftwareInterrupt+0x22 (83c1f8e8)

hal!HalpDispatchSoftwareInterrupt+0x21:

83c1f8e7fb              sti

hal!HalpDispatchSoftwareInterrupt+0x22:

83c1f8e833db            xor     ebx,ebx

83c1f8ea381dbd6ac383    cmp    byte ptr [hal!HalpEnableIrqlAudit (83c36abd)],bl

83c1f8f0 7405            je      hal!HalpDispatchSoftwareInterrupt+0x31 (83c1f8f7)

hal!HalpDispatchSoftwareInterrupt+0x2c:

83c1f8f2e8e9feffff      call    hal!HalpValidatePendingInterrupts (83c1f7e0)

hal!HalpDispatchSoftwareInterrupt+0x31:

83c1f8f7807d0801        cmp     byte ptr [ebp+8],1

83c1f8fb7514            jne     hal!HalpDispatchSoftwareInterrupt+0x4b (83c1f911)

hal!HalpDispatchSoftwareInterrupt+0x37:

83c1f8fdff750c          push    dword ptr [ebp+0Ch]

83c1f90064881d96000000  mov     byte ptr fs:[96h],bl

83c1f90753              push    ebx

83c1f90853              push    ebx

83c1f909ff15e4b0c183    call   dword ptr [hal!_imp__KiDeliverApc (83c1b0e4)]

83c1f90f eb1e            jmp     hal!HalpDispatchSoftwareInterrupt+0x69 (83c1f92f)

hal!HalpDispatchSoftwareInterrupt+0x4b:

83c1f911807d0802        cmp     byte ptr [ebp+8],2

83c1f915 750f            jne     hal!HalpDispatchSoftwareInterrupt+0x60 (83c1f926)

hal!HalpDispatchSoftwareInterrupt+0x51:

83c1f91764881d97000000  mov     byte ptr fs:[97h],bl

83c1f91eff15e0b0c183    call   dword ptr [hal!_imp__KiDispatchInterrupt (83c1b0e0)]

83c1f924eb09            jmp     hal!HalpDispatchSoftwareInterrupt+0x69 (83c1f92f)

hal!HalpDispatchSoftwareInterrupt+0x60:

83c1f926381dbd6ac383    cmp    byte ptr [hal!HalpEnableIrqlAudit (83c36abd)],bl

83c1f92c 7401            je      hal!HalpDispatchSoftwareInterrupt+0x69 (83c1f92f)

hal!HalpDispatchSoftwareInterrupt+0x68:

83c1f92ecc              int     3

hal!HalpDispatchSoftwareInterrupt+0x69:

83c1f92f 3bf3            cmp     esi,ebx

83c1f9317501            jne     hal!HalpDispatchSoftwareInterrupt+0x6e (83c1f934)

hal!HalpDispatchSoftwareInterrupt+0x6d:

83c1f933fa              cli

hal!HalpDispatchSoftwareInterrupt+0x6e:

83c1f934381dbd6ac383    cmp    byte ptr [hal!HalpEnableIrqlAudit (83c36abd)],bl

83c1f93a 7411            je      hal!HalpDispatchSoftwareInterrupt+0x87 (83c1f94d)

hal!HalpDispatchSoftwareInterrupt+0x76:

83c1f93c 64a024000000    mov    al,byte ptr fs:[00000024h]

83c1f942 3a4508          cmp     al,byte ptr [ebp+8]

83c1f9457401            je      hal!HalpDispatchSoftwareInterrupt+0x82 (83c1f948)

hal!HalpDispatchSoftwareInterrupt+0x81:

83c1f947cc              int     3

hal!HalpDispatchSoftwareInterrupt+0x82:

83c1f948e893feffff      call    hal!HalpValidatePendingInterrupts (83c1f7e0)

hal!HalpDispatchSoftwareInterrupt+0x87:

83c1f94d5e              pop     esi

83c1f94e5b              pop     ebx

83c1f94f c9              leave

83c1f950 c20800          ret     8

还有一种情况是当执行了一些等锁或事件等函数时，这时会发生线程切换。这里有一个特殊情况是(Thread->ApcState.KernelApcPending &&            (Thread->SpecialApcDisable == 0)&& (Thread->WaitIrql < APC_LEVEL))时会进入KiExitDispatcher流程；基本上是先Thread->WaitIrql = KeRaiseIrqlToSynchLevel();InitializeDelayExecution();最后通过KiUnlockDispatcherDatabase(Thread->WaitIrql);调入KiExitDispatcher（\*Thread->WaitIrql*\）中。

8aed3c5883cbe403 00000000 86a3e240ffffffff nt!KiSwapThread+0x254

8aed3c8083cbe0e1 86a3e240 86a3e300 00000044nt!KiCommitThreadWait+0x1df

8aed3cd8 83e826ed 00000201 00000000 8aed3cfcnt!KeDelayExecutionThread+0x2aa

8aed3d24 83c9442a 00000000 00f5f79000f5f7b4 nt!NtDelayExecution+0x8d

8aed3d24 771864f400000000 00f5f790 00f5f7b4 nt!KiFastCallEntry+0x12a (FPO: [0,3] TrapFrame @ 8aed3d34)

00f5f748 77184c1c 753f187600000000 00f5f790 ntdll!KiFastSystemCallRet (FPO: [0,0,0])

00f5f74c 753f187600000000 00f5f790 53ddb789 ntdll!ZwDelayExecution+0xc (FPO:[2,0,0])

00f5f7b4 753f1818 00000064 00000000 00f5f800KERNELBASE!SleepEx+0x65 (FPO: [Non-Fpo])

00f5f7c4 70586be7 00000064 52194086 00000000KERNELBASE!Sleep+0xf (FPO: [Non-Fpo])

00f5f800 70587824 00f5f81476971174 001cea40 MSDTCPRX!CConnectionManager::TimerProcForNonGuardedUser+0x72(FPO: [Non-Fpo])

00f5f808 76971174001cea40 00f5f854 7719b3f5MSDTCPRX!CConnectionManager::TimerProc+0x1e (FPO: [Non-Fpo])

00f5f814 7719b3f5 001cea40 77d42614 00000000kernel32!BaseThreadInitThunk+0xe (FPO: [Non-Fpo])

00f5f854 7719b3c8 70587806 001cea40 00000000ntdll!__RtlUserThreadStart+0x70 (FPO: [Non-Fpo])

00f5f86c 00000000 70587806 001cea40 00000000ntdll!_RtlUserThreadStart+0x1b (FPO: [Non-Fpo])

PKTHREAD CurrentThread;

PKTHREAD NewThread;

BOOLEAN Pending;

PKPRCB Prcb;

ASSERT(KeGetCurrentIrql() == SYNCH_LEVEL);

//

// Process the deferred ready list if the list is not empty.

//

Prcb = KeGetCurrentPrcb();

#if !defined(NT_UP)

if (Prcb->DeferredReadyListHead.Next != NULL) {

KiProcessDeferredReadyList(Prcb);

}

#endif

//

// If the old IRQL is less than dispatch level, then a new thread can

// be dispatcher immediately.

//

if (OldIrql < DISPATCH_LEVEL) {

//

// If there is a new thread selected for execution, then switch

// context to the new thread.

//

if (Prcb->NextThread != NULL) {

KiAcquirePrcbLock(Prcb);

NewThread = Prcb->NextThread;

CurrentThread =Prcb->CurrentThread;

KiSetContextSwapBusy(CurrentThread);

Prcb->NextThread = NULL;

Prcb->CurrentThread = NewThread;

NewThread->State = Running;

KxQueueReadyThread(CurrentThread,Prcb);

CurrentThread->WaitIrql =OldIrql;

Pending =KiSwapContext(CurrentThread, NewThread);

if (Pending != FALSE) {

KeLowerIrql(APC_LEVEL);

KiDeliverApc(KernelMode, NULL,NULL);

ASSERT(OldIrql == 0);

}

}

} else if ((Prcb->NextThread != NULL) &&

(Prcb->DpcRoutineActive ==FALSE)) {

KiRequestSoftwareInterrupt(DISPATCH_LEVEL);

}

//

// Lower IRQL to its previous level.

//

KeLowerIrql(OldIrql);

return;

HalpDispatchSoftwareInterrupt是调用那这么几种情况：hal!KfLowerIrql调用的时候，有INT3和其它一些中断发现的时候。所以这里有一个问题对HalpDispatchSoftwareInterrupt下一个断点的话，系统的栈溢出了。

可以看出软件中断，基本上是在空闲线程、KiExitDispatcher和HalpDispatchSoftwareInterrupt分被分发的。还有线程切换是DPC级别的，若在DPC级别长时间逗留，会影响线程的切换。