Lesson 8 - Interrupt and Exception Handling

Archived content. No warranty is made as to technical accuracy. Content may contain URLs that were valid when originally published, but now link to sites or pages that no longer exist.
On This Page

What You Will Learn
Thinking Ahead
What To Do
Before Going On
Speaking The Language
To Learn More

What You Will Learn

By the end of this lesson, you should be able to do the following:

  • Explain the difference between interrupts and exceptions and explain how Windows NT handles each.

  • Explain why Windows NT's interrupt and exception handling is portable and the basic strategy of how it achieves that.

  • Explain structured exceptions handling and its benefits.

Using knowledge learned in this module, you'll be able to explain the following:

  • How an application program can override system behavior for various types of exceptions.

  • Why Windows NT interrupt and exception handling is consistent across different platforms.

Thinking Ahead

What To Do

The Core Of The Windows NT Executive

A component of the Windows NT executive called the kernel controls many major aspects of the operating system's structure and capabilities, including:

  • Thread scheduling.

  • Interrupt and exception dispatching.

  • Thread Synchronization Across Multiple Processors.

The kernel is treated specially: It can not be paged to disk and can not be preempted. For these reasons, the kernel is kept very compact and fast.

Separation of Mechanism and Policy

It's said that the Windows NT kernel represents mechanism but no policy. This is because the services provided by the kernel are very generic in form. They determine how things should be done, but leave decisions about what should be done, and when it should be done, to other Windows NT components.

Components in the Windows NT Executive use the generic kernel services as building bocks from which they contruct more specialized services. In this way the executive enforces the first layer of policies. However, executive objects and services must remain generic enough to accomodate the needs of all environment subsystems.

For example, the kernel provides a set of generic objects called kernel objects . Two such objects are kernel process objects and kernel thread objects. These objects contain the basic attributes and services that the kernel needs to manage processes and threads. Components of the Windows NT Executive construct their own, more specialized objects called executive objects . The executive's process manager constructs its own process and thread objects that contain the corresponding kernel objects, along with an extra layer of attributes and services. This extra layer allows the process manager to, for example, track the object handles associated with each process. In the terminology of object oriented design, the executive components superclasses the more primitive kernel objects to tailor them to its own needs.

Similarly, the environment subsystems use the executives's relatively generic services to implement the operating system functions, and associated policies, that their clients expect.

A Portable Interrupt Mechanism

Interrupts can be issued by either hardware or software. Computers differ in the types of interrupts that they support and the mechanisms by which they respond to them. To make Windows NT portable, an interrupt management scheme was designed to hide these interrupt processing differences. The kernel treats interrupts on all machines in a similar way by virtualizing the interrupt processing mechanism. The hardware abstraction layer (HAL) is responsible for providing a virtual interrupt mechanism to the kernel.

The Kernel's Trap Handler

The kernel's trap handler mediates handling of interrupts, exceptions, system service calls, and virtual memory management.

The difference between interrupts and exceptions is that interrupts occur asynchronously (for instance, when hardware peripheral devices needs processor attention), and exceptions occur as a part of standard application execution (for instance, when a math overflow occurs). So, exceptions are generally reproducable, but interrupts involve timing relationships that are difficult to reproduce.

Interrupt Request Levels

Some interrupts are more important, or higher priority, than others. For example, timer (system clock) interrupts are central to many of Windows NT's functions including preemptive multitasking. As a result, timer interrupts are treated as having higher interrupt request level (IRQL) and therefore a higher priority than interrupts caused by peripheral devices such as printers and modems.

Note that thread dispatching is sometimes (but not always) handled by sending a special interrupt called a deferred procedure call (DPC). Both DPC's and asynchronous procedure calls (APC) are like bookmarks: they tell the processor to do the task requested when it has no higher-priority interrupts. Only when there are no interrupts at all does a thread actually execute.

Interrupt Service Routines

When an interrupt occurs, it is handled (serviced) by a function called an interrupt service routine (ISR) . Data structures called an interrupt dispatch tables (IDT) track which interrupt service routine(s) will handle the interrupts occuring at each IRQL. A separate interrupt dispatch table is associated with each processor (Figure 4). Because of this, each processor can potentially associate different interrupt service routines with the same IRQL, or one processor can be asked to handle all interrupts.

Associating Interrupt Service Routines With IRQLs

The kernel supplies the interrupt service routines for many system interrupts such clock ticks, power failure, and thread dispatching. Other interrupt service routines are provided by the device drivers that manage peripheral hardware devices such as network adapters, keyboards, pens, and disk drives.

A device driver associates its interrupt service routine with an IRQL by constructing an interrupt object and passing it to the kernel. The kernel then connects the interrupt object to the appropriate interrupt dispatch table entry. When an interrupt occurs at the devce's IRQL, the kernel locates the device driver's interrupt service routine using the interrupt object. More than one interrupt object can be associated with each IRQL, so multiple devices could potentially share the same IRQL. When a device driver is unloaded, it simply asks the kernel to disconnect its interrupt objects from the interrupt dispatch table. Interrupt objects increase device driver portability by providing a way to connect and disconnect interrupt service routines without needing direct access to the kernel's interrupt dispatch table.

Interrupt Masking

In some operating systems, interrupts at all IRQLs are blocked, or masked , while an interrupt is processed. The Windows NT kernel uses a less drastic technique for masking interrupts. Each processor has an independently adjustable IRQL mask. When an interrupt occurs at one IRQL, all interrupts at or below that IRQL are masked. If an interrupt occurs at a higher IRQL, then the higher priority interrupt is serviced immediately.

Synchronization of Multiple Threads

In the lesson on multitasking, we discussed why programs need synchronization objects in order to access shared data. But we did not discuss how those objects are implemented.

The kernel is responsible for creating, maintaining, and signaling synchronization objects. Although the Executive creates a number of complex synchroniztion objects, each of these contains at least one kernel synchroniztion object.

When a process waits on a synchronization object, the kernel changes its dispatcher state from running to waiting. When the object finally becomes unlocked, the kernel changes the dispatcher state of the process that was waiting from waiting to ready. Note that NO processor time is spent polling the object in a loop; the process that's waiting doesn't execute at all until the object is unlocked. All of this is handled by the kernel.

The kernel also has a type of lock called a spin lock which does loop until it becomes unlocked. However, spin locks are only used in very special cases in the kernel and in device drivers.


Windows NT manages exceptions using a technique called structured exception handling .

Structured exception handling is a mechanism used to make code:

  • More robust--errors are caught even if the programmer forgets to check error codes.

  • Easier to write and maintain--programmer isolates error handling rather than checking EVERY error code.

A procedure call can provide a handler that describes what to do when an exception occurs. For instance, your application might catch and handle the error that would occur if you tried to write to a diskette when the door was open. Your exception handler would put a dialog box up and prompt the user to close the door.

When an exception occurs the kernel checks for an exception handler in the current procedure. If one is found it is executed. If none is found then the kernel looks for a handler in the procedure that called the current procedure. This process of unwinding continues until a handler is found. If no handler is found, then the process that generated the exception is terminated.

Before Going On

Before you go on, make sure you can answer the following questions:

  1. What does the Windows NT kernel do?

  2. What is the difference between interrupts and exceptions? How does the kernel handle each?

  3. What do we mean when we say that the Windows NT Kernel represents mechanism rather than policy? How does Windows NT allow each subsystem to provide a different process structure to its clients?

  4. Can the kernel be preempted? Paged?

  5. What does the part of the kernel called the trap handler do?

  6. How are interrupt masks different under Windows NT than under Windows 3.1?

  7. What are the advantages of using of interrupt objects as the means to add new interrupt service routines (ISRs) to the kernel's interrupt dispatch table (IDT)?

  8. How can Windows NT operating system code to execute on one or more processors at the same time yet not corrupt shared resources?

  9. What is structured exception handling? How does structured exception handling benefit developers and users? What happens an exception occurs and the program didn't register an exception handler? If it registered more than one?

Speaking The Language

This lesson introduced terms that it is important for you to understand. Please look through the list and verify that you understand the meaning of each term:

  • Kernel

  • Kernel objects

  • Executive objects

  • Superclassing

  • Virtualized interrupts

  • Trap handler

  • Interrupt request level (IRQL)

  • Deferred procedure call (DPC)

  • Asynchronous procedure call (APC)

  • Interrupt service routine (ISR)

  • Interrupt dispatch table (IDT)

  • Interrupt object

  • Interrupt mask

  • Structured exception handling

  • Unwinding

To Learn More

If you're interested in learning more about this topic, you may find the following esources useful:

  • Inside Windows NT, Chapter 7.