Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


How's IRQL implemented in ARM64?

wc2023wc2023 Member Posts: 38

I know that the IRQL is implemented as a register in the Intel's x64 CPUs. But how is it implemented in ARM64?

Comments

  • Tim_RobertsTim_Roberts Member - All Emails Posts: 14,832

    The ARM architecture only has two interrupt signals, so IRQL is managed by the interrupt controller. The CPU doesn't really need the IRQL -- the interrupt controller does.

    Tim Roberts, [email protected]
    Software Wizard Emeritus

  • wc2023wc2023 Member Posts: 38
    edited February 1

    @Tim_Roberts hmm, interesting. So then what CPU instructions is KeRaiseIrql translated to?

  • Tim_RobertsTim_Roberts Member - All Emails Posts: 14,832

    The ARM architecture calls its tightly coupled peripherals "co-processors". The MCR and MRC instructions are used to communicate with the co-processors. I don't know the exact details of KeRaiseIrql; I've never had my hand on a Windows ARM system. If you have one, you could use windbg to disassemble it.

    Tim Roberts, [email protected]
    Software Wizard Emeritus

  • wc2023wc2023 Member Posts: 38

    @Tim_Roberts Yeah, it's interesting. Here's the disassembly.

    nt!KeGetCurrentIrql is the easiest:

    ldrb    w0, [xpr, #0x38]
    ret
    

    While nt!KfRaiseIrql is slightly more complex:

        uxtb   w1, w0
        ldrb    w0, [xpr, #0x38]
        cmp    w0, w1
        bhs      lbl_ret
        strb     w1, [xpr, #0x38]
        adrp    x8, PpmPolicyConfig ....
        ldr       w8, [x8, KiIrqlFlags]
        cbz      w8, bl_ret
        b          lbl_raise_proc_irql_flags
    lbl_ret:
        ret
    

    So it basically doesn't do much with it, and just reads or writes it into _KPCR::CurrentIrql. Am I seeing it correctly?

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 13-17 May 2024 Live, Online
Developing Minifilters 1-5 Apr 2024 Live, Online
Internals & Software Drivers 11-15 Mar 2024 Live, Online
Writing WDF Drivers 20-24 May 2024 Live, Online