在线程调度里可以看到，需要调用函数KiSwapContext来进行运行环境切换，由于每个cpu都是只能运行一个线程，而多个线程在运行过程中被中断了，那么就需要保存cpu所有寄存器，以便下一次恢复线程时可以接续运行。现在就来分析这个函数是怎么样实现这些工作的，代码如下：
#001 /*++
#002 * KiSwapContext
#003 *
#004 * The KiSwapContext routine switches context to another thread.
#005 *
#006 * Params:
#007 * TargetThread - Pointer to the KTHREAD to which the caller wishes to
#008 * switch to.
#009 *
#010 * Returns:
#011 * The WaitStatus of the Target Thread.
#012 *
#013 * Remarks:
#014 * This is a wrapper around KiSwapContextInternal which will save all the
#015 * non-volatile registers so that the Internal function can use all of
#016 * them. It will also save the old current thread and set the new one.
#017 *
#018 * The calling thread does not return after KiSwapContextInternal until
#019 * another thread switches to IT.
#020 *
#021 *--*/
#022 .globl @KiSwapContext@8
#023 .func @KiSwapContext@8,@KiSwapContext@8
#024 @KiSwapContext@8:
#025
保存寄存器的值，以便调用后返回。
#026 /* Save 4 registers */
#027 sub esp,4 * 4
#028
#029 /* Save all the non-volatile ones */
#030 mov [esp+12],ebx
#031 mov [esp+8],esi
#032 mov [esp+4],edi
#033 mov [esp+0],ebp
#034
获取处理器块KPCR，因为FS保存了KPCR的数据结构所在的段。
#035 /* Get the current KPCR */
#036 mov ebx,fs:[KPCR_SELF]
#037
获取当前线程指针。
#038 /* Get the Current Thread */
#039 mov edi,ecx
#040
获取下一个将要运行的线程指针。
#041 /* Get the New Thread */
#042 mov esi,edx
#043
获取当前的IRQL
#044 /* Get the wait IRQL */
#045 movzx ecx,byte ptr [edi+KTHREAD_WAIT_IRQL]
#046
调用函数KiSwapContextInternal来切换运行环境。
#047 /* Do the swap with the registers correctly setup */
#048 call @KiSwapContextInternal@0
#049
恢复调用前的寄存器值。
#050 /* Return the registers */
#051 mov ebp,[esp+0]
#052 mov edi,[esp+4]
#053 mov esi,[esp+8]
#054 mov ebx,[esp+12]
#055
#056 /* Clean stack */
#057 add esp,4 * 4
#058 ret
#059 .endfunc
这个函数主要把C函数调用修改为合适的函数KiSwapContextInternal调用。因此接着下来分析函数KiSwapContextInternal的代码，如下：
#001 /*++
#002 * KiSwapContextInternal
#003 *
#004 * The KiSwapContextInternal routine switches context to another thread.
#005 *
#006 * Params:
下一个将要运行的线程。
#007 * ESI - Pointer to the KTHREAD to which the caller wishes to
#008 * switch to.
当前运行的线程。
#009 * EDI - Pointer to the KTHREAD to which the caller wishes to
#010 * switch from.
#011 *
#012 * Returns:
#013 * None.
#014 *
#015 * Remarks:
#016 * Absolutely all registers except ESP can be trampled here for maximum code flexibility.
#017 *
#018 *--*/
#019 .globl @KiSwapContextInternal@0
#020 .func @KiSwapContextInternal@0,@KiSwapContextInternal@0
#021 @KiSwapContextInternal@0:
#022
保存IRQL。
#023 /* Save the IRQL */
#024 push ecx
#025
判断是否支持对称多核处理器。
#026 #ifdef CONFIG_SMP
#027 GetSwapLock:
#028 /* Acquire the swap lock */
#029 cmp byte ptr [esi+KTHREAD_SWAP_BUSY],0
#030 jz NotBusy
#031 pause
#032 jmp GetSwapLock
#033 #endif
#034 NotBusy:
#035 /* Increase context switches (use ES for lazy load) */
#036 inc dword ptr es:[ebx+KPCR_CONTEXT_SWITCHES]
#037
保存当前线程的运行环境到当前线程栈里。
#038 /* Save the Exception list */
#039 push [ebx+KPCR_EXCEPTION_LIST]
#040
#041 /* Check for WMI */
#042 cmp dword ptr [ebx+KPCR_PERF_GLOBAL_GROUP_MASK],0
#043 jnz WmiTrace
#044
#045 AfterTrace:
#046 #ifdef CONFIG_SMP
#047 #ifdef DBG
#048 /* Assert that we're on the right cpu */
#049 mov cl,[esi+KTHREAD_NEXT_PROCESSOR]
#050 cmp cl,[ebx+KPCR_PROCESSOR_NUMBER]
#051 jnz Wrongcpu
#052 #endif
#053 #endif
#054
#055 /* Get CR0 and save it */
#056 mov ebp,cr0
#057 mov edx,ebp
#058
#059 #ifdef CONFIG_SMP
#060 /* Check NPX State */
#061 cmp byte ptr [edi+KTHREAD_NPX_STATE],NPX_STATE_LOADED
#062 jz NpxLoaded
#063 #endif
#064
#065 SetStack:
保存当前线程的栈。
#066 /* Set new stack */
#067 mov [edi+KTHREAD_KERNEL_STACK],esp
#068
#069 /* Checking NPX,disable interrupts now */
#070 mov eax,[esi+KTHREAD_INITIAL_STACK]
#071 cli
#072
#073 /* Get the NPX State */
#074 movzx ecx,byte ptr [esi+KTHREAD_NPX_STATE]
#075
#076 /* Clear the other bits,merge in CR0,merge in FPU CR0 bits and compare */
#077 and edx,~(CR0_MP + CR0_EM + CR0_TS)
#078 or ecx,edx
#079 or ecx,[eax - (NPX_FRAME_LENGTH - FN_CR0_NPX_STATE)]
#080 cmp ebp,ecx
#081 jnz NewCr0
#082
#083 StackOk:
开中断，并切换到新的栈上。
#084 /* Enable interrupts and set the current stack */
#085 sti
#086 mov esp,[esi+KTHREAD_KERNEL_STACK]
#087
检查当前线程和下一个运行线程是否同一个进程空间。
#088 /* Check if address space switch is needed */
#089 mov ebp,[esi+KTHREAD_APCSTATE_PROCESS]
#090 mov eax,[edi+KTHREAD_APCSTATE_PROCESS]
#091 cmp ebp,eax
跳到同一个进程处理。
#092 jz SameProcess
#093
#094 #ifdef CONFIG_SMP
#095 /* Get the active processors and XOR with the process' */
#096 mov ecx,[ebx+KPCR_SET_MEMBER_COPY]
#097 lock xor [ebp+KPROCESS_ACTIVE_PROCESSORS],ecx
#098 lock xor [eax+KPROCESS_ACTIVE_PROCESSORS],ecx
#099
#100 /* Assert change went ok */
#101 #ifdef DBG
#102 test [ebp+KPROCESS_ACTIVE_PROCESSORS],ecx
#103 jz WrongActivecpu
#104 test [eax+KPROCESS_ACTIVE_PROCESSORS],ecx
#105 jz WrongActivecpu
#106 #endif
#107 #endif
#108
检查是否需要加载LDT。
#109 /* Check if we need an LDT */
#110 mov ecx,[ebp+KPROCESS_LDT_DESCRIPTOR0]
#111 or ecx,[eax+KPROCESS_LDT_DESCRIPTOR0]
#112 jnz LdtReload
#113
更新CR3寄存器，以便更新进程的地址空间。其实就是更新内存的页寄存目录。
#114 UpdateCr3:
#115 /* Switch address space */
#116 mov eax,[ebp+KPROCESS_DIRECTORY_TABLE_BASE]
#117 mov cr3,eax
#118
同一个进程地址空间。
#119 SameProcess:
#120
#121 #ifdef CONFIG_SMP
#122 /* Release swap lock */
#123 and byte ptr [edi+KTHREAD_SWAP_BUSY],0
#124 #endif
#125
#126 /* Clear gs */
#127 xor eax,eax
#128 mov gs,ax
#129
设置下一个线程运行的TEB。
#130 /* Set the TEB */
#131 mov eax,[esi+KTHREAD_TEB]
#132 mov [ebx+KPCR_TEB],eax
#133 mov ecx,[ebx+KPCR_GDT]
#134 mov [ecx+0x3A],ax
#135 shr eax,16
#136 mov [ecx+0x3C],al
#137 mov [ecx+0x3F],ah
#138
获取下一个线程的栈指针。
#139 /* Get stack pointer */
#140 mov eax,[esi+KTHREAD_INITIAL_STACK]
#141
计算下一个线程运行的栈空间大小。
#142 /* Make space for the NPX Frame */
#143 sub eax,NPX_FRAME_LENGTH
#144
检查是否为虚拟86的运行模式。
#145 /* Check if this isn't V86 Mode,so we can bias the Esp0 */
#146 test dword ptr [eax - KTRAP_FRAME_SIZE + KTRAP_FRAME_EFLAGS],EFLAGS_V86_MASK
#147 jnz NoAdjust
#148
#149 /* Bias esp */
#150 sub eax,KTRAP_FRAME_V86_GS - KTRAP_FRAME_SS
#151
#152 NoAdjust:
#153
设置下一个运行线程的任务段TSS。
#154 /* Set new ESP0 */
#155 mov ecx,[ebx+KPCR_TSS]
#156 mov [ecx+KTSS_ESP0],eax
#157
#158 /* Set current IOPM offset in the TSS */
#159 mov ax,[ebp+KPROCESS_IOPM_OFFSET]
#160 mov [ecx+KTSS_IOMAPBASE],ax
#161
#162 /* Increase context switches */
#163 inc dword ptr [esi+KTHREAD_CONTEXT_SWITCHES]
#164
从下一个线程的栈里获取将要运行的环境。
#165 /* Restore exception list */
#166 pop [ebx+KPCR_EXCEPTION_LIST]
#167
#168 /* Restore IRQL */
#169 pop ecx
#170
#171 /* DPC shouldn't be active */
#172 cmp byte ptr [ebx+KPCR_PRCB_DPC_ROUTINE_ACTIVE],0
#173 jnz BugCheckDpc
#174
#175 /* Check if kernel APCs are pending */
#176 cmp byte ptr [esi+KTHREAD_PENDING_KERNEL_APC],0
#177 jnz CheckApc
#178
如果没有异步调用APC，就直接返回。
#179 /* No APCs,return */
#180 xor eax,eax
#181 ret
#182
下面检查异步调用APC。
#183 CheckApc:
#184
#185 /* Check if they're disabled */
#186 cmp word ptr [esi+KTHREAD_SPECIAL_APC_DISABLE],0
#187 jnz ApcReturn
#188 test cl,cl
#189 jz ApcReturn
#190
#191 /* Request APC Delivery */
#192 mov cl,APC_LEVEL
#193 call @HalRequestSoftwareInterrupt@4
#194 or eax,esp
#195
#196 ApcReturn:
#197
#198 /* Return with APC pending */
#199 setz al
#200 ret
#201
需要重新加局部描述符表LDT。
#202 LdtReload:
#203 /* Check if it's empty */
#204 mov eax,[ebp+KPROCESS_LDT_DESCRIPTOR0]
#205 test eax,eax
#206 jz LoadLdt
#207
#208 /* Write the LDT Selector */
#209 mov ecx,[ebx+KPCR_GDT]
#210 mov [ecx+KGDT_LDT],eax
#211 mov eax,[ebp+KPROCESS_LDT_DESCRIPTOR1]
#212 mov [ecx+KGDT_LDT+4],eax
#213
#214 /* Write the INT21 handler */
#215 mov ecx,[ebx+KPCR_IDT]
#216 mov eax,[ebp+KPROCESS_INT21_DESCRIPTOR0]
#217 mov [ecx+0x108],eax
#218 mov eax,[ebp+KPROCESS_INT21_DESCRIPTOR1]
#219 mov [ecx+0x10C],eax
#220
#221 /* Save LDT Selector */
#222 mov eax,KGDT_LDT
#223
#224 LoadLdt:
#225 lldt ax
#226 jmp UpdateCr3
#227
需要重新计算CR0寄存器值。
#228 NewCr0:
#229
#230 #ifdef DBG
#231 /* Assert NPX State */
#232 test byte ptr [esi+KTHREAD_NPX_STATE],~(NPX_STATE_NOT_LOADED)
#233 jnz InvalidNpx
#234 test dword ptr [eax - (NPX_FRAME_LENGTH - FN_CR0_NPX_STATE)],~(CR0_PE + CR0_MP + CR0_EM + CR0_TS)
#235 jnz InvalidNpx
#236 #endif
#237
#238 /* Update CR0 */
#239 mov cr0,ecx
#240 jmp StackOk
#241
#242 #ifdef CONFIG_SMP
#243 NpxLoaded:
#244
#245 /* FIXME: TODO */
#246 int 3
#247
#248 /* Jump back */
#249 jmp SetStack
#250 #endif
#251
下面出错处理。
#252 WmiTrace:
#253
#254 /* No WMI support yet */
#255 int 3
#256
#257 /* Jump back */
#258 jmp AfterTrace
#259
#260 BugCheckDpc:
#261
#262 /* Bugcheck the machine,printing out the threads being switched */
#263 mov eax,[edi+KTHREAD_INITIAL_STACK]
#264 push 0
#265 push eax
#266 push esi
#267 push edi
#268 push ATTEMPTED_SWITCH_FROM_DPC
#269 call _KeBugCheckEx@20
#270
#271 #ifdef DBG
#272 InvalidNpx:
#273 int 3
#274 WrongActivecpu:
#275 int 3
#276 Wrongcpu:
#277 int 3
#278 #endif
#279 .endfunc
通过上面的函数分析，可以了解到线程的环境切换，主要就是线程的页面切换（CR3），线程的环境块切换（TEB），任务段切换ESP0（TSS）。
原文链接：https://www.f2er.com/react/308487.html