366.7 KB - Evernote

Special Vs. Regular Kernel APCs
On the subject of how regular APCs are limited, nt!KiDeliverApc has the final say: it is this function
which decides when such an APC will be delivered.
The function enforces the following rules:
• When the NormalRoutine of a regular APC is in progress, (ApcState.KernelApcInProgress !=
0), other regular APCs are not delivered to the same thread. Even if the thread catches an
APC interrupt and enters nt!KiDeliverApc.
• When ApcState.KernelApcDisable !=0, regular APCs are not delivered.
If nt!KiDeliverApc is called with ApcState.KernelApcDisable != 0, KernelApcPending is left
zeroed, which prevents further calls to the function on context switches. nt!KiDeliverApc will
be called again when KernelApcPending is set, perhaps by queuing another APC.
• Regular APCs have both a KernelRoutine and a NormalRoutine. The first is called at APC
IRQL, the second at PASSIVE.
The KernelRoutine is called first and can change the address of the NormalRoutine that will
be invoked or avoid the call altogether, by zeroing the NormalRoutine pointer.
Furthermore, the logic of nt!KiInsertQueueApc implies that:
• When a regular APC is queued to a wating thread, the thread is not awakened if:
o The NormalRoutine of another regular APC is in progress on the thread
(ApcState.KernelApcInProgress != 0)
This implies that the NormalRoutine can enter a wating state and know for sure that
the thread will not service other regular APCs during the wait.
o KernelApcDisable has a non-zero value.
It is interesting to note how the DDK states that the conditions under which a waiting thread receives
regular APCs are:
“thread not already in an APC, thread not in a critical section”
Thus, “in a critical section” KernelApcDisable is set to a non-zero value.
User Mode APCs
This section analyzes the scheduling and delivery of user mode APCs.
The main difference between these APCs and kernel mode ones is that their NormalRoutine is
executed in user mode, so the APC implementation has to switch to ring 3 before calling
NormalRoutine.
Scheduling
As for kernel mode APCs, the scheduling performed by nt!KiInsertQueueApc can be split into two
main steps: linking the _KAPC to a list of pending APCs and updating control variables for the target
thread so that it will process the waiting APC, when the right conditions apply.
23