You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Yeah, I remember worrying about this when elevating the thread priority.
Maybe KeShouldYieldProcessor should periodically (randomly?) return TRUE to require threads/DPCs cooperate to lower IRQL, allowing the timer threadpool to fire.
This would be subtly different from kernel mode, where timers fire at IRQL > dispatch and queue a DPC, but we should be able to detect broken code in user mode by requiring the yields.
We may also want to put a Sleep(0) into KeLowerIrql while in a ShouldYieldProcessor window. Sleep(0) is the equivalent of sched_yield on Linux, and would prod the scheduler to let the ready thread in the timer threadpool run.
Emulated DPC threads running at thread priority time critical which starves the thread pool timer threads resulting in the timers not firing.
This breaks the eBPF for Windows epoch cleanup code which requires a timer to initiate.
The text was updated successfully, but these errors were encountered: