questions regards IRQL

I have number of questions regards IRQL.

  1. assume a Kernel thread which working at IRQL == DISPATCH_LEVEL is
    currently been served. meanwhile , an Interrupt as arrived and an ISR as
    been called. after the ISR as finish and the interrupt as been served, the
    O/S should return to DISPATCH_LEVEL (or there are other interrupts higher to
    serve) and continue running the Kernel thread I described. my questions is ,
    how a windows O/S manage to return back to the highest (non-interrupt) IRQL
    and serve back this thread ?

  2. This question as alittle bit more complicated :slight_smile:

By looking at KfRaiseIRQL (WIN XP SP2 HAL.dll) :

1 -> mov al, byte ptr [FFDFF024]
movzx ecx,al
2 -> cmp cl, 02
3 -> jbe 80011034
mov edx,eax
pushfd
cli
mov byte ptr[FFDFF024],cl
mov eax, dword ptr [4*ecx*800176EC]
or eax,dword ptr[FFDFF030]
4 -> out 21,al
shr eax, 08
out A1,al
popfd
mov eax,edx
ret
5-> 80011034 : mov byte ptr [FFDFF024],cl
ret

Step 1 : saving IRQL before change
Step 2 : verify if new IRQL as lower then 2(DISPATCH_LEVEL)
Step 3/5 : in case lower , change IRQL to new IRQL
Step 4 : in case higher then DISPATCH_LEVEL , change the IMR(Interrupt Mask
register) at the PIC to avoid receiving interrupts which are lower or equal
to the specific raised IRQL.

my question is , why is it possible to raise IRQL to higher then
DISPATCH_LEVEL , I was amazed to see a change of the IMR while a driver
raised IRQL.

Is there somthing I just dont understand here ? is there any reason that a
driver will raise the IRQL to an Hardware Interrupt level ?

Thanks in advance !

Alex Green wrote:

I have number of questions regards IRQL.

  1. assume a Kernel thread which working at IRQL == DISPATCH_LEVEL is
    currently been served. meanwhile , an Interrupt as arrived and an ISR
    as been called. after the ISR as finish and the interrupt as been
    served, the O/S should return to DISPATCH_LEVEL (or there are other
    interrupts higher to serve) and continue running the Kernel thread I
    described. my questions is , how a windows O/S manage to return back
    to the highest (non-interrupt) IRQL and serve back this thread ?

How? It does an “iret”.

  1. This question as alittle bit more complicated :slight_smile:

    my question is , why is it possible to raise IRQL to higher then
    DISPATCH_LEVEL , I was amazed to see a change of the IMR while a
    driver raised IRQL.

Is there somthing I just dont understand here ? is there any reason
that a driver will raise the IRQL to an Hardware Interrupt level ?

Sure. What if you have a spinlock protecting data that is shared with
your interrupt handler? Your interrupt handler runs at the hardware
IRQL. Unless my understanding is incorrect, this is exactly what
KeSynchronizeExecution and KeAcquire/KeReleaseInterruptSpinLock do.


Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

On 3/2/06, Tim Roberts wrote:
>
> Alex Green wrote:
>
> > I have number of questions regards IRQL.
> > 1. assume a Kernel thread which working at IRQL == DISPATCH_LEVEL is
> > currently been served. meanwhile , an Interrupt as arrived and an ISR
> > as been called. after the ISR as finish and the interrupt as been
> > served, the O/S should return to DISPATCH_LEVEL (or there are other
> > interrupts higher to serve) and continue running the Kernel thread I
> > described. my questions is , how a windows O/S manage to return back
> > to the highest (non-interrupt) IRQL and serve back this thread ?
>
>
> How? It does an “iret”.

I Understand that iret will return the EIP to the original location. but who
will return the IRQL to the original IRQL ?
is this done automaticlly ? or the OS resposiblity ?

> 2. This question as alittle bit more complicated :slight_smile:
> > …
> > my question is , why is it possible to raise IRQL to higher then
> > DISPATCH_LEVEL , I was amazed to see a change of the IMR while a
> > driver raised IRQL.
> >
> > Is there somthing I just dont understand here ? is there any reason
> > that a driver will raise the IRQL to an Hardware Interrupt level ?
>
>
> Sure. What if you have a spinlock protecting data that is shared with
> your interrupt handler? Your interrupt handler runs at the hardware
> IRQL. Unless my understanding is incorrect, this is exactly what
> KeSynchronizeExecution and KeAcquire/KeReleaseInterruptSpinLock do.

Yes you understand it correctly, I had this information missing probobly
because I was never shared resources with my interrupt handler and allways
register for DPC.

thanks for your strightforward answers.


> Tim Roberts, xxxxx@probo.com
> Providenza & Boekelheide, Inc.
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

The OS does it.

Peter
OSR

Alex Green wrote:

On 3/2/06, *Tim Roberts* > wrote:
>
>
> How? It does an “iret”.
>
>
> I Understand that iret will return the EIP to the original location.
> but who will return the IRQL to the original IRQL ?
> is this done automaticlly ? or the OS resposiblity ?

The kernel code that cleans up after interrupt handler will reset the
IRQL just before it does the iret.


Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

>how a windows O/S manage to return back to the highest (non-interrupt) IRQL

and serve back this thread ?

It saves the old IRQL somewhere on each IRQL raise.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

>I Understand that iret will return the EIP to the original location. but who

will return the IRQL to the original IRQL ?
is this done automaticlly ? or the OS resposiblity ?

Automatically, the ISR prolog and epilog in HAL will do the analogs of
KeRaise/LowerIrql

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com