第一部分：
1: kd> dt kTHREAD 8999c8a0
+0x02c State : 0x2 ''
+0x054 WaitBlockList : 0x8999c940 _KWAIT_BLOCK
第一个_KWAIT_BLOCK：
1: kd> dx -id 0,0,899a2278 -r1 ((CSRSRV!_KWAIT_BLOCK *)0x8999c940)
((CSRSRV!_KWAIT_BLOCK *)0x8999c940) : 0x8999c940 [Type: _KWAIT_BLOCK *]
+0x000\] WaitListEntry \[Type: _LIST_ENTRY
+0x008\] Thread : 0x8999c8a0 \[Type: _KTHREAD \*
+0x00c\]**Object : 0xf78fad78** \[Type: void \*
+0x010\] NextWaitBlock : 0x8999c958 \[Type: _KWAIT_BLOCK \*
+0x014\] WaitKey : 0x0 \[Type: unsigned short
+0x016\] WaitType : 0x1 \[Type: unsigned short
第二个_KWAIT_BLOCK：
1: kd> dx -id 0,0,899a2278 -r1 ((CSRSRV!_KWAIT_BLOCK *)0x8999c958)
((CSRSRV!_KWAIT_BLOCK *)0x8999c958) : 0x8999c958 [Type: _KWAIT_BLOCK *]
+0x000\] WaitListEntry \[Type: _LIST_ENTRY
+0x008\] Thread : 0x8999c8a0 \[Type: _KTHREAD \*
+0x00c\] Object : 0x80bf5c60 \[Type: void \*\] //80bf5c60 nt!ExpThreadSetManagerEvent = struct _KEVENT \[+0x010\] NextWaitBlock : 0x8999c970 \[Type: _KWAIT_BLOCK \*
+0x014\] WaitKey : 0x1 \[Type: unsigned short
+0x016\] WaitType : 0x1 \[Type: unsigned short
1: kd> x nt!ExpThreadSetManagerEvent
80bf5c60 nt!ExpThreadSetManagerEvent = struct _KEVENT
第三个_KWAIT_BLOCK：
1: kd> dx -id 0,0,899a2278 -r1 ((CSRSRV!_KWAIT_BLOCK *)0x8999c970)
((CSRSRV!_KWAIT_BLOCK *)0x8999c970) : 0x8999c970 [Type: _KWAIT_BLOCK *]
+0x000\] WaitListEntry \[Type: _LIST_ENTRY
+0x008\] Thread : 0x8999c8a0 \[Type: _KTHREAD \*
+0x00c\] Object : 0x80bf5c50 \[Type: void \*\] //80bf5c50 nt!ExpThreadSetManagerShutdownEvent = struct _KEVENT \[+0x010\] NextWaitBlock : 0x8999c940 \[Type: _KWAIT_BLOCK \*\] //返回到 NextWaitBlock : 0x8999c940结束 \[+0x014\] WaitKey : 0x2 \[Type: unsigned short
+0x016\] WaitType : 0x1 \[Type: unsigned short
1: kd> x nt!ExpThreadSetManagerShutdownEvent
80bf5c50 nt!ExpThreadSetManagerShutdownEvent = struct _KEVENT
第二部分：
1: kd> dt ktimer 0xf78fad78 //Object : 0xf78fad78
CSRSRV!KTIMER
+0x000 Header : _DISPATCHER_HEADER
+0x010 DueTime : _ULARGE_INTEGER 0x00002707`bbe04df6
+0x018 TimerListEntry : _LIST_ENTRY [ 0x0 - 0x0 ]
+0x020 Dpc : (null)
+0x024 Period : 0n0
1: kd> dx -id 0,0,899a2278 -r1 (*((CSRSRV!_DISPATCHER_HEADER *)0xf78fad78))
(*((CSRSRV!_DISPATCHER_HEADER *)0xf78fad78)) [Type: _DISPATCHER_HEADER]
+0x000\] Type : 0x8 \[Type: unsigned char
+0x001\] Absolute : 0x0 \[Type: unsigned char
+0x002\] Size : 0xa \[Type: unsigned char
+0x003\] Inserted : 0x0 \[Type: unsigned char
+0x003\] DebugActive : 0x0 \[Type: unsigned char
+0x000\] Lock : 655368 \[Type: long
[+0x004] SignalState : 1 [Type: long] //定时器到期SignalState : 1
+0x008\] WaitListHead \[Type: _LIST_ENTRY
DueTime.QuadPart = - THREAD_SET_INTERVAL;
#define THREAD_SET_INTERVAL (1 * 1000 * 1000 * 10)
1: kd> dt kevent 0x80bf5c60 80bf5c60 nt!ExpThreadSetManagerEvent = struct _KEVENT
CSRSRV!KEVENT
+0x000 Header : _DISPATCHER_HEADER
1: kd> dx -id 0,0,899a2278 -r1 (*((CSRSRV!_DISPATCHER_HEADER *)0x80bf5c60))
(*((CSRSRV!_DISPATCHER_HEADER *)0x80bf5c60)) [Type: _DISPATCHER_HEADER]
+0x000\] Type : 0x1 \[Type: unsigned char
+0x001\] Absolute : 0x0 \[Type: unsigned char
+0x002\] Size : 0x4 \[Type: unsigned char
+0x003\] Inserted : 0x0 \[Type: unsigned char
+0x003\] DebugActive : 0x0 \[Type: unsigned char
+0x000\] Lock : 262145 \[Type: long
+0x004\] SignalState : 0 \[Type: long
+0x008\] WaitListHead \[Type: _LIST_ENTRY
1: kd> dt kevent 0x80bf5c50 //80bf5c50 nt!ExpThreadSetManagerShutdownEvent = struct _KEVENT
CSRSRV!KEVENT
+0x000 Header : _DISPATCHER_HEADER
1: kd> dx -id 0,0,899a2278 -r1 (*((CSRSRV!_DISPATCHER_HEADER *)0x80bf5c50))
(*((CSRSRV!_DISPATCHER_HEADER *)0x80bf5c50)) [Type: _DISPATCHER_HEADER]
+0x000\] Type : 0x1 \[Type: unsigned char
+0x001\] Absolute : 0x0 \[Type: unsigned char
+0x002\] Size : 0x4 \[Type: unsigned char
+0x003\] Inserted : 0x0 \[Type: unsigned char
+0x003\] DebugActive : 0x0 \[Type: unsigned char
+0x000\] Lock : 262145 \[Type: long
+0x004\] SignalState : 0 \[Type: long
+0x008\] WaitListHead \[Type: _LIST_ENTRY
第三部分：
VOID
ExpWorkerThreadBalanceManager (
IN PVOID StartContext
)
{
KTIMER PeriodTimer;
LARGE_INTEGER DueTime;
PVOID WaitObjects[MaximumBalanceObject];
NTSTATUS Status;
PAGED_CODE();
UNREFERENCED_PARAMETER (StartContext);
//
// Raise the thread priority to just higher than the priority of the
// critical work queue.
//
KeSetBasePriorityThread (KeGetCurrentThread(),
CRITICAL_WORK_QUEUE_PRIORITY + 1);
//
// Initialize the periodic timer and set the manager period.
//
KeInitializeTimer (&PeriodTimer);
DueTime.QuadPart = - THREAD_SET_INTERVAL;
//
// Initialize the wait object array.
//
WaitObjects[TimerExpiration] = (PVOID)&PeriodTimer;
WaitObjects[ThreadSetManagerEvent] = (PVOID)&ExpThreadSetManagerEvent;
WaitObjects[ShutdownEvent] = (PVOID)&ExpThreadSetManagerShutdownEvent;
//
// Loop forever processing events.
//
while (TRUE) {
//
// Set the timer to expire at the next periodic interval.
//
KeSetTimer (&PeriodTimer, DueTime, NULL);
//
// Wake up when the timer expires or the set manager event is
// signalled.
//
Status = KeWaitForMultipleObjects (MaximumBalanceObject,
WaitObjects,
WaitAny,
Executive,
KernelMode,
FALSE,
NULL,
NULL);
switch (Status) {
case TimerExpiration:
//
// Periodic timer expiration - go see if any work queues
// are deadlocked.
//
ExpDetectWorkerThreadDeadlock ();
break;
case ThreadSetManagerEvent:
//
// Someone has asked us to check some metrics to determine
// whether we should create another worker thread.
//
ExpCheckDynamicThreadCount ();
break;
case ShutdownEvent:
//
// Time to exit...
//
KeCancelTimer (&PeriodTimer);
ASSERT (ExpLastWorkerThread);
//
// Wait for the last worker thread to terminate
//
KeWaitForSingleObject (ExpLastWorkerThread,
Executive,
KernelMode,
FALSE,
NULL);
ObDereferenceObject (ExpLastWorkerThread);
PsTerminateSystemThread(STATUS_SYSTEM_SHUTDOWN);
break;
}
//
// Special debugger support.
//
// This checks if special debugging routines need to be run on the
// behalf of the debugger.
//
if (ExpDebuggerWork == 1) {
ExInitializeWorkItem(&ExpDebuggerWorkItem, ExpDebuggerWorker, NULL);
ExpDebuggerWork = 2;
ExQueueWorkItem(&ExpDebuggerWorkItem, DelayedWorkQueue);
}
}
}
第四部分：case TimerExpiration:分支
#define STATUS_KERNEL_APC 0x100
//
// Define balance set wait object types.
//
typedef enum _BALANCE_OBJECT {
TimerExpiration,
ThreadSetManagerEvent,
ShutdownEvent,
MaximumBalanceObject
} BALANCE_OBJECT;
switch (Status) {
case TimerExpiration:
//
// Periodic timer expiration - go see if any work queues
// are deadlocked.
//
ExpDetectWorkerThreadDeadlock ();
break;
第五部分：ExpDetectWorkerThreadDeadlock
//
// Worker Thread
//
typedef enum _WORK_QUEUE_TYPE {
CriticalWorkQueue,
DelayedWorkQueue,
HyperCriticalWorkQueue,
MaximumWorkQueue
} WORK_QUEUE_TYPE;
1: kd> x nt!ExWorkerQueue
80bf5c80 nt!ExWorkerQueue = struct _EX_WORK_QUEUE [3]
80bf5c80 nt!ExWorkerQueue = struct _EX_WORK_QUEUE []
1: kd> dx -r1 (*((ntkrnlmp!_EX_WORK_QUEUE (*)[3])0x80bf5c80))
(*((ntkrnlmp!_EX_WORK_QUEUE (*)[3])0x80bf5c80)) [Type: _EX_WORK_QUEUE [3]]
0\] \[Type: _EX_WORK_QUEUE
1\] \[Type: _EX_WORK_QUEUE
2\] \[Type: _EX_WORK_QUEUE
1: kd> dx -r1 (*((ntkrnlmp!_EX_WORK_QUEUE *)0x80bf5c80))
(*((ntkrnlmp!_EX_WORK_QUEUE *)0x80bf5c80)) [Type: _EX_WORK_QUEUE]
+0x000\] WorkerQueue \[Type: _KQUEUE
+0x028\] DynamicThreadCount : 0x0 \[Type: unsigned long
+0x02c\] WorkItemsProcessed : 0x240 \[Type: unsigned long
+0x030\] WorkItemsProcessedLastPass : 0x23f \[Type: unsigned long
+0x034\] QueueDepthLastPass : 0x0 \[Type: unsigned long
+0x038\] Info \[Type: EX_QUEUE_WORKER_INFO
1: kd> dx -r1 (*((ntkrnlmp!_EX_WORK_QUEUE *)0x80bf5cbc))
(*((ntkrnlmp!_EX_WORK_QUEUE *)0x80bf5cbc)) [Type: _EX_WORK_QUEUE]
+0x000\] WorkerQueue \[Type: _KQUEUE
+0x028\] DynamicThreadCount : 0x0 \[Type: unsigned long
+0x02c\] WorkItemsProcessed : 0x16c \[Type: unsigned long
+0x030\] WorkItemsProcessedLastPass : 0x16a \[Type: unsigned long
+0x034\] QueueDepthLastPass : 0x0 \[Type: unsigned long
+0x038\] Info \[Type: EX_QUEUE_WORKER_INFO
1: kd> dx -r1 (*((ntkrnlmp!_EX_WORK_QUEUE *)0x80bf5cf8))
(*((ntkrnlmp!_EX_WORK_QUEUE *)0x80bf5cf8)) [Type: _EX_WORK_QUEUE]
+0x000\] WorkerQueue \[Type: _KQUEUE
+0x028\] DynamicThreadCount : 0x0 \[Type: unsigned long
+0x02c\] WorkItemsProcessed : 0x7a \[Type: unsigned long
+0x030\] WorkItemsProcessedLastPass : 0x79 \[Type: unsigned long
+0x034\] QueueDepthLastPass : 0x0 \[Type: unsigned long
+0x038\] Info \[Type: EX_QUEUE_WORKER_INFO