news 2026/8/6 10:18:40

nt!KiReadyThread函数分析和紧随其后的nt!KiProcessDeferredReadyList函数

作者头像

张小明

前端开发工程师

1.2k 24
文章封面图
nt!KiReadyThread函数分析和紧随其后的nt!KiProcessDeferredReadyList函数

nt!KiReadyThread函数分析和紧随其后的nt!KiProcessDeferredReadyList函数


0: kd> kc
#
00 nt!KiReadyThread
01 nt!KiUnwaitThread
02 nt!KeSetEvent
03 USBPORT!USBPORT_SignalWorker
04 USBPORT!USBPORT_InvalidateEndpoint
05 USBPORT!USBPORTSVC_InvalidateEndpoint
06 usbuhci!UhciInterruptDpc
07 USBPORT!USBPORT_IsrDpc
08 nt!KiRetireDpcList
09 nt!KiIdleLoop
0: kd> dv
Thread = 0x899475c8

FORCEINLINE
VOID
FASTCALL
KiInsertDeferredReadyList (
IN PKTHREAD Thread
)
{

//
// On the MP system, insert the specified thread in the deferred ready
// list. On the UP system, ready the thread immediately.
//

#if defined(NT_UP)

Thread->State = DeferredReady;
Thread->DeferredProcessor = 0;
KiDeferredReadyThread(Thread);

#else

PKPRCB Prcb;

Prcb = KeGetCurrentPrcb();
Thread->State = DeferredReady;
Thread->DeferredProcessor = Prcb->Number;
PushEntryList(&Prcb->DeferredReadyListHead,
&Thread->SwapListEntry);

#endif

return;
}


0: kd> dx -id 0,0,ffffffff80b20320 -r1 ((ntkrnlmp!_KPRCB *)0xffdff120)
((ntkrnlmp!_KPRCB *)0xffdff120) : 0xffdff120 [Type: _KPRCB *]
[+0x000] MinorVersion : 0x1 [Type: unsigned short]
[+0x002] MajorVersion : 0x1 [Type: unsigned short]
[+0x004] CurrentThread : 0x80b200c0 [Type: _KTHREAD *]
[+0x008] NextThread : 0x89dc62a0 [Type: _KTHREAD *]

[+0x928] ReadySummary : 0x0 [Type: unsigned long]
[+0x92c] SelectNextLast : 0x0 [Type: unsigned long]
[+0x930] DispatcherReadyListHead [Type: _LIST_ENTRY [32]]
[+0xa30] DeferredReadyListHead [Type: _SINGLE_LIST_ENTRY]

0: kd> dv
Thread = 0x899475c8
0: kd> dx -id 0,0,ffffffff80b20320 -r1 (*((ntkrnlmp!_SINGLE_LIST_ENTRY *)0xffdffb50))
(*((ntkrnlmp!_SINGLE_LIST_ENTRY *)0xffdffb50)) [Type: _SINGLE_LIST_ENTRY]
[+0x000] Next : 0x0 [Type: _SINGLE_LIST_ENTRY *]


0: kd> p
eax=ffdffb50 ebx=00000000 ecx=89a7fe00 edx=00000000 esi=89a7fda0 edi=899475c8
eip=80a42d21 esp=80b14570 ebp=80b1457c iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KiReadyThread+0xb5:
80a42d21 c3 ret
0: kd> dx -id 0,0,ffffffff80b20320 -r1 (*((ntkrnlmp!_SINGLE_LIST_ENTRY *)0xffdffb50))
(*((ntkrnlmp!_SINGLE_LIST_ENTRY *)0xffdffb50)) [Type: _SINGLE_LIST_ENTRY]
[+0x000] Next : 0x89a7fe00 [Type: _SINGLE_LIST_ENTRY *]

0: kd> dt kthread 0x89a7fe00-60
ntdll!KTHREAD
+0x000 Header : _DISPATCHER_HEADER
+0x010 MutantListHead : _LIST_ENTRY [ 0x89a7fdb0 - 0x89a7fdb0 ]
+0x018 InitialStack : 0xf76f7000 Void
+0x01c StackLimit : 0xf76f4000 Void
+0x020 KernelStack : 0xf76f6ce0 Void
+0x024 ThreadLock : 0
+0x028 ContextSwitches : 0x2693f
+0x02c State : 0x7 ''
+0x02d NpxState : 0xa ''
+0x02e WaitIrql : 0 ''
+0x02f WaitMode : 0 ''


0: kd> kc
#
00 nt!KiProcessDeferredReadyList
01 nt!KiExitDispatcher
02 nt!KeSetEvent
03 USBPORT!USBPORT_SignalWorker
04 USBPORT!USBPORT_InvalidateEndpoint
05 USBPORT!USBPORTSVC_InvalidateEndpoint
06 usbuhci!UhciInterruptDpc
07 USBPORT!USBPORT_IsrDpc
08 nt!KiRetireDpcList
09 nt!KiIdleLoop


0: kd> kv
# ChildEBP RetAddr Args to Child
00 80b14568 80a4002e 899475c0 899470e8 4f444648 nt!KiProcessDeferredReadyList (FPO: [0,0,0]) (CONV: fastcall) [d:\srv03rtm\base\ntos\ke\thredsup.c @ 825]
01 80b1458c 80a342fd 00000000 80b145c4 bae2ac25 nt!KiExitDispatcher+0x42 (FPO: [Non-Fpo]) (CONV: fastcall) [d:\srv03rtm\base\ntos\ke\waitsup.c @ 80]
02 80b14598 bae2ac25 029475c0 00000001 00000000 nt!KeSetEvent+0xf7 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\ntos\ke\eventobj.c @ 443]
03 80b145c4 bae3516e 89947030 10000001 89947030 USBPORT!USBPORT_SignalWorker+0xe3 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\drivers\wdm\usb\hcd\usbport\thread.c @ 330]
04 80b145f0 bae35215 89947030 89b2c440 00000002 USBPORT!USBPORT_InvalidateEndpoint+0x558 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\drivers\wdm\usb\hcd\usbport\core.c @ 2586]
05 80b14608 f757e550 899478e4 00000000 899470e8 USBPORT!USBPORTSVC_InvalidateEndpoint+0x47 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\drivers\wdm\usb\hcd\usbport\core.c @ 2625]
06 80b14624 bae776f4 00002080 6b6c5001 ffdff980 usbuhci!UhciInterruptDpc+0x58 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\drivers\wdm\usb\hcd\miniport\usbuhci\int.c @ 272]
07 80b14648 80a41432 89947608 89947030 00000000 USBPORT!USBPORT_IsrDpc+0x19e (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\drivers\wdm\usb\hcd\usbport\int.c @ 320]
08 80b146a0 80b00ab2 00000000 0000000e 00000000 nt!KiRetireDpcList+0xd6 (FPO: [Non-Fpo]) (CONV: fastcall) [d:\srv03rtm\base\ntos\ke\dpcsup.c @ 1076]
09 80b146a4 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x5e (FPO: [0,0,0]) [d:\srv03rtm\base\ntos\ke\i386\ctxswap.asm @ 1436]

0: kd> bp nt!KiDeferredReadyThread
0: kd> g
Breakpoint 18 hit
eax=0000001b ebx=00000000 ecx=89a7fda0 edx=00000000 esi=00000000 edi=ffdff120
eip=80a41c28 esp=80b1455c ebp=80b1458c iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KiDeferredReadyThread:
80a41c28 55 push ebp
0: kd> kc
#
00 nt!KiDeferredReadyThread
01 nt!KiProcessDeferredReadyList
02 nt!KiExitDispatcher
03 nt!KeSetEvent
04 USBPORT!USBPORT_SignalWorker
05 USBPORT!USBPORT_InvalidateEndpoint
06 USBPORT!USBPORTSVC_InvalidateEndpoint
07 usbuhci!UhciInterruptDpc
08 USBPORT!USBPORT_IsrDpc
09 nt!KiRetireDpcList
0a nt!KiIdleLoop


do {
Processor = Thread->IdealProcessor;
IdleSet = KiIdleSummary & Affinity;
if (IdleSet != 0) {

+0x10e IdealProcessor : 0x1 ''

+0x120 Affinity : 3

0: kd> x nt!KiIdleSummary
80b16e80 nt!KiIdleSummary = 2 1号处理器闲置。


Thread->State = Standby;
Thread->NextProcessor = (UCHAR)Processor;
KiClearIdleSummary(AFFINITY_MASK(Processor));

ASSERT((TargetPrcb->NextThread == NULL) ||
(TargetPrcb->NextThread == TargetPrcb->IdleThread));

TargetPrcb->NextThread = Thread;


0: kd> dx -id 0,0,ffffffff80b20320 -r1 ((ntkrnlmp!_KPRCB *)0xf7737120)
((ntkrnlmp!_KPRCB *)0xf7737120) : 0xf7737120 [Type: _KPRCB *]
[+0x000] MinorVersion : 0x1 [Type: unsigned short]
[+0x002] MajorVersion : 0x1 [Type: unsigned short]
[+0x004] CurrentThread : 0xf7739fa0 [Type: _KTHREAD *]
[+0x008] NextThread : 0x0 [Type: _KTHREAD *]


[+0x928] ReadySummary : 0x0 [Type: unsigned long]
[+0x92c] SelectNextLast : 0x0 [Type: unsigned long]
[+0x930] DispatcherReadyListHead [Type: _LIST_ENTRY [32]]

0: kd> dx -id 0,0,ffffffff80b20320 -r1 (*((ntkrnlmp!_SINGLE_LIST_ENTRY *)0xf7737b50))
(*((ntkrnlmp!_SINGLE_LIST_ENTRY *)0xf7737b50)) [Type: _SINGLE_LIST_ENTRY]
[+0x000] Next : 0x0 [Type: _SINGLE_LIST_ENTRY *]


0: kd> dx -id 0,0,ffffffff80b20320 -r1 ((ntkrnlmp!_KTHREAD *)0xf7739fa0)
((ntkrnlmp!_KTHREAD *)0xf7739fa0) : 0xf7739fa0 [Type: _KTHREAD *]
[+0x000] Header [Type: _DISPATCHER_HEADER]
[+0x010] MutantListHead [Type: _LIST_ENTRY]
[+0x018] InitialStack : 0xf78ab000 [Type: void *]
[+0x01c] StackLimit : 0xf78a8000 [Type: void *]
[+0x020] KernelStack : 0xf78aad4c [Type: void *]
[+0x024] ThreadLock : 0x0 [Type: unsigned long]
[+0x028] ContextSwitches : 0x1073ea [Type: unsigned long]
[+0x02c] State : 0x2 [Type: unsigned char]

0: kd> dv Preempted
Preempted = 0x00 ''


do {
Processor = Thread->IdealProcessor;
IdleSet = KiIdleSummary & Affinity;
if (IdleSet != 0) {

0: kd> dv IdleSet
IdleSet = 2


TargetPrcb = KiProcessorBlock[Processor];
KiAcquireTwoPrcbLocks(CurrentPrcb, TargetPrcb);
if (((KiIdleSummary & TargetPrcb->SetMember) != 0) &&
((Thread->Affinity & TargetPrcb->SetMember) != 0)) {

//
// Set the thread state to standby, set the processor
// number the thread is being assigned to, and clear the
// associated bit in idle summary.
//

Thread->State = Standby;
Thread->NextProcessor = (UCHAR)Processor;
KiClearIdleSummary(AFFINITY_MASK(Processor));


0: kd> dv Processor
Processor = 1

KiClearIdleSummary(AFFINITY_MASK(Processor));


0: kd> x nt!KiIdleSummary
80b16e80 nt!KiIdleSummary = 0


TargetPrcb->NextThread = Thread;

0: kd> dx -id 0,0,ffffffff80b20320 -r1 ((ntkrnlmp!_KPRCB *)0xf7737120)
((ntkrnlmp!_KPRCB *)0xf7737120) : 0xf7737120 [Type: _KPRCB *]
[+0x000] MinorVersion : 0x1 [Type: unsigned short]
[+0x002] MajorVersion : 0x1 [Type: unsigned short]
[+0x004] CurrentThread : 0xf7739fa0 [Type: _KTHREAD *]
[+0x008] NextThread : 0x89a7fda0 [Type: _KTHREAD *]
[+0x00c] IdleThread : 0xf7739fa0 [Type: _KTHREAD *]


0: kd> g
Breakpoint 19 hit
eax=f7737538 ebx=899475c0 ecx=89a7fda0 edx=f7737120 esi=89a7fda0 edi=89a7fe40
eip=80a43ac4 esp=f76f6d34 ebp=f76f6d64 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
nt!KiSwapThread:
80a43ac4 55 push ebp
1: kd> kc
#
00 nt!KiSwapThread
01 nt!KeWaitForSingleObject
02 USBPORT!USBPORT_WorkerThread
03 nt!PspSystemThreadStartup
04 nt!KiThreadStartup
1: kd> kv
# ChildEBP RetAddr Args to Child
00 f76f6d30 80a35ea9 80a30b6a 899470e8 4f444648 nt!KiSwapThread (FPO: [Non-Fpo]) (CONV: fastcall) [d:\srv03rtm\base\ntos\ke\thredsup.c @ 1698]
01 f76f6d64 bae2bf7b 899475c0 00000005 00000000 nt!KeWaitForSingleObject+0x2d7 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\ntos\ke\wait.c @ 1161]
02 f76f6dac 80d391f0 89947030 00000000 00000000 USBPORT!USBPORT_WorkerThread+0x57 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\drivers\wdm\usb\hcd\usbport\thread.c @ 106]
03 f76f6ddc 80b00d52 bae2bf24 89947030 00000000 nt!PspSystemThreadStartup+0x2e (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\ntos\ps\create.c @ 2213]
04 00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16 [d:\srv03rtm\base\ntos\ke\i386\threadbg.asm @ 81]

1: kd> dx -id 0,0,ffffffff80b20320 -r1 ((ntkrnlmp!_KPRCB *)0xf7737120)
((ntkrnlmp!_KPRCB *)0xf7737120) : 0xf7737120 [Type: _KPRCB *]
[+0x000] MinorVersion : 0x1 [Type: unsigned short]
[+0x002] MajorVersion : 0x1 [Type: unsigned short]
[+0x004] CurrentThread : 0x89a7fda0 [Type: _KTHREAD *]
[+0x008] NextThread : 0x0 [Type: _KTHREAD *]
[+0x00c] IdleThread : 0xf7739fa0 [Type: _KTHREAD *]

版权声明: 本文来自互联网用户投稿，该文观点仅代表作者本人，不代表本站立场。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如若内容造成侵权/违法违规/事实不符，请联系邮箱：809451989@qq.com进行投诉反馈，一经查实，立即删除！
网站建设 2026/8/6 16:08:17

2025 IT 行业就业全景：26 届及以后考生，计算机专业仍值得报考吗？

收藏！不想35岁被淘汰？网络安全或许是程序员的最佳转型方向 计算机专业虽进入分化阶段，但网络安全人才缺口达300万，高端领域供不应求。高校扩招与市场需求脱节导致供需失衡，未来"计算机行业"的复合型人才更具…

作者头像 李华
网站建设 2026/8/7 2:52:45

色选机：基于光学原理的自动分选设备，工作流程大揭秘

色选机，是一种基于光学原理的自动分选设备，于现代工农业生产里，起着极为关键的作用。它借助物料表面颜色或者光学特性的不同，借由高分辨率相机抓拍图像，运用智能识别系统予以分析，最终经高速喷阀把异色颗粒…

作者头像 李华
网站建设 2026/8/5 2:30:10

26、Linux脚本编程与账户安全基础

Linux脚本编程与账户安全基础 1. 条件表达式的使用 脚本语言支持多种类型的条件表达式，这些表达式能让脚本根据特定条件（通常是变量的值）执行不同的操作。常见的使用条件表达式的命令是 if ，它能让系统根据某个条件是否为真来执行两个操作中的一个。 if 关键字后的条…

作者头像 李华
网站建设 2026/8/6 16:18:01

SQL必会必知整理-10-汇总函数

10.1 聚集函数 聚集函数是运行在行组上，计算和返回单个值的函数。 SQL聚集函数 函数 说明 AVG() 返回某列的平均值 COUNT() 返回某列的行数 MAX() 返回某列的最大值 MIN() 返回某列的最小值 SUM() 返回某列值之和 10.1.1 AVG()函数： AVG(…

作者头像 李华
网站建设 2026/8/7 0:12:10

PocoEmit遥遥领先于AutoMapper之循环引用

一、什么是循环引用循环引用就是类型相互依赖1. 比如A类有B类的属性,B类也有A类的属性这有什么问题呢?编写生成A的代码需要遍历A的所有属性构造B类型属性是A代码的一部分,B代码又含有A类型属性这就是一个编译死循环2. 其他循环引用的例子链表结构只有一个类型也是类型循环引用…

作者头像 李华
网站建设 2026/8/7 2:14:09

如何设计大数据数仓中的 Code Reference

在大数据数据仓库（Data Warehouse）的建设过程中，Code Reference（代码参考表或编码映射表） 是一个常被忽视但极为关键的组件。它用于统一管理业务系统中使用的各类编码、枚举值和状态码，确保数据在不同系统之…

作者头像 李华