从hal!HalRequestSoftwareInterrupt到hal!HalpDispatchInterrupt到nt!_KiDispatchInterrupt和windbg扩展命令!irql原理
BOOLEAN
KeInsertQueueDpc (
IN PRKDPC Dpc,
IN PVOID SystemArgument1,
IN PVOID SystemArgument2
)
{
if ((Dpc->Importance != LowImportance) ||
(DpcData->DpcQueueDepth >= Prcb->MaximumDpcQueueDepth) ||
(Prcb->DpcRequestRate < Prcb->MinimumDpcRate)) {
Prcb->DpcInterruptRequested = TRUE;
KiRequestSoftwareInterrupt(DISPATCH_LEVEL);
1: kd> g
Breakpoint 16 hit
eax=ffdff994 ebx=ffdff120 ecx=ffdff902 edx=00000002 esi=ffdff980 edi=898d4608
eip=804ee4f8 esp=f78cdcbc ebp=f78cdcd4 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000202
hal!HalRequestSoftwareInterrupt:
804ee4f8 643a0d95000000 cmp cl,byte ptr fs:[95h] fs:0030:00000095=00
0: kd> kc
#
00 hal!HalRequestSoftwareInterrupt
01 nt!KeInsertQueueDpc
02 USBPORT!USBPORT_InterruptService
03 nt!KiInterruptDispatch
04 hal!WRITE_PORT_UCHAR
05 PCIIDEX!BmArm
06 atapi!IdeReadWrite
07 atapi!IdeSendCommand
08 atapi!AtapiStartIo
09 atapi!IdeStartIoSynchronized
0a nt!KeSynchronizeExecution
0b atapi!IdePortAllocateAccessToken
0c PCIIDEX!BmReceiveScatterGatherList
0d hal!HalBuildScatterGatherList
0e hal!HalGetScatterGatherList
0f PCIIDEX!BmSetup
10 atapi!IdePortStartIo
11 nt!IoStartPacket
12 atapi!IdePortDispatch
13 nt!IofCallDriver
14 CLASSPNP!SubmitTransferPacket
15 CLASSPNP!ServiceTransferRequest
16 CLASSPNP!ClassReadWrite
17 nt!IofCallDriver
18 PartMgr!PmReadWrite
19 nt!IofCallDriver
1a ftdisk!FtDiskReadWrite
1b nt!IofCallDriver
1c volsnap!VolSnapWrite
1d nt!IofCallDriver
1e Ntfs!NtfsSingleAsync
1f Ntfs!NtfsNonCachedIo
20 Ntfs!NtfsCommonWrite
21 Ntfs!NtfsFsdWrite
22 nt!IofCallDriver
23 nt!IoSynchronousPageWrite
24 nt!MiFlushSectionInternal
25 nt!MmFlushSection
26 nt!CcFlushCache
27 Ntfs!NtfsCheckpointVolume
28 Ntfs!NtfsCheckpointAllVolumes
29 nt!ExpWorkerThread
2a nt!PspSystemThreadStartup
2b nt!KiThreadStartup
0: kd> kv 5
# ChildEBP RetAddr Args to Child
00 f78cdcb8 80a36611 89620bb0 898d4608 105ee601 hal!HalRequestSoftwareInterrupt (FPO: [0,0,0]) [d:\srv03rtm\base\hals\halmps\i386\mpswint.asm @ 84]
01 f78cdcd4 baed5f37 018d4608 898d460c 00000000 nt!KeInsertQueueDpc+0x18d (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\base\ntos\ke\dpcobj.c @ 434]
02 f78cdcf0 80b003ed 89620bb0 898d4030 00010007 USBPORT!USBPORT_InterruptService+0x93 (FPO: [Non-Fpo]) (CONV: stdcall) [d:\srv03rtm\drivers\wdm\usb\hcd\usbport\int.c @ 106]
03 f78cdcf0 804f4d71 89620bb0 898d4030 00010007 nt!KiInterruptDispatch+0x8d (FPO: [0,2] TrapFrame @ f78cdd14) [d:\srv03rtm\base\ntos\ke\i386\intsup.asm @ 777]
04 f78cdd84 f73a91bb 000010c0 00000001 8948cf14 hal!WRITE_PORT_UCHAR+0x9 (FPO: [2,0,0]) [d:\srv03rtm\base\hals\halx86\i386\xxioacc.asm @ 241]
windbg> .open -a ffffffff80a36611
windbg> .open -a ffffffff804ee4f8
0: kd> r
eax=ffdff994 ebx=ffdff120 ecx=ffdff902 edx=00000002 esi=ffdff980 edi=898d4608
eip=804ee4f8 esp=f78cdcbc ebp=f78cdcd4 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000202
hal!HalRequestSoftwareInterrupt:
804ee4f8 643a0d95000000 cmp cl,byte ptr fs:[95h] fs:0030:00000095=00
0: kd> p
eax=ffdff994 ebx=ffdff120 ecx=ffdff902 edx=00000002 esi=ffdff980 edi=898d4608
eip=804ee4ff esp=f78cdcbc ebp=f78cdcd4 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000202
hal!HalRequestSoftwareInterrupt+0x7:
804ee4ff 7434 je hal!HalRequestSoftwareInterrupt+0x3d (804ee535) [br=0]
0: kd> p
eax=ffdff994 ebx=ffdff120 ecx=ffdff902 edx=00000002 esi=ffdff980 edi=898d4608
eip=804ee501 esp=f78cdcbc ebp=f78cdcd4 iopl=0 nv up ei pl nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000202
hal!HalRequestSoftwareInterrupt+0x9:
804ee501 33c0 xor eax,eax
0: kd> p
eax=00000000 ebx=ffdff120 ecx=ffdff902 edx=00000002 esi=ffdff980 edi=898d4608
eip=804ee503 esp=f78cdcbc ebp=f78cdcd4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
hal!HalRequestSoftwareInterrupt+0xb:
804ee503 8ac1 mov al,cl
0: kd> p
eax=00000002 ebx=ffdff120 ecx=ffdff902 edx=00000002 esi=ffdff980 edi=898d4608
eip=804ee505 esp=f78cdcbc ebp=f78cdcd4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
hal!HalRequestSoftwareInterrupt+0xd:
804ee505 33c9 xor ecx,ecx
0: kd> p
eax=00000002 ebx=ffdff120 ecx=00000000 edx=00000002 esi=ffdff980 edi=898d4608
eip=804ee507 esp=f78cdcbc ebp=f78cdcd4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
hal!HalRequestSoftwareInterrupt+0xf:
804ee507 8a88b8db4e80 mov cl,byte ptr hal!HalpIRQLtoTPR (804edbb8)[eax] ds:0023:804edbba=41
0: kd> x hal!HalpIRQLtoTPR
804edbb8 hal!HalpIRQLtoTPR = unsigned char [] ""
0: kd> db 804edbb8
804edbb8 00 3d 41 41 51 61 71 81-91 a1 b1 b1 b1 b1 b1 b1 .=AAQaq.........
804edbc8 b1 b1 b1 b1 b1 b1 b1 b1-b1 b1 b1 c1 d1 e1 ef ff ................
804edbd8 0f b6 d1 0f b6 8a b8 db-4e 80 a1 80 00 fe ff 89 ........N.......
804edbe8 0d 80 00 fe ff c1 e8 04-0f b6 80 1c a2 4f 80 c3 .............O..
804edbf8 8b 15 80 00 fe ff c7 05-80 00 fe ff 41 00 00 00 ............A...
804edc08 c1 ea 04 0f b6 82 1c a2-4f 80 c3 90 8b 15 80 00 ........O.......
804edc18 fe ff c7 05 80 00 fe ff-c1 00 00 00 c1 ea 04 0f ................
804edc28 b6 82 1c a2 4f 80 c3 90-33 c0 8a c1 8b 0d 80 00 ....O...3.......
0: kd> p
eax=00000002 ebx=ffdff120 ecx=00000041 edx=00000002 esi=ffdff980 edi=898d4608
eip=804ee50d esp=f78cdcbc ebp=f78cdcd4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
hal!HalRequestSoftwareInterrupt+0x15:
804ee50d 81c900000400 or ecx,40000h
0: kd> p
eax=00000002 ebx=ffdff120 ecx=00040041 edx=00000002 esi=ffdff980 edi=898d4608
eip=804ee513 esp=f78cdcbc ebp=f78cdcd4 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000206
hal!HalRequestSoftwareInterrupt+0x1b:
804ee513 9c pushfd
0: kd> p
eax=00000002 ebx=ffdff120 ecx=00040041 edx=00000002 esi=ffdff980 edi=898d4608
eip=804ee514 esp=f78cdcb8 ebp=f78cdcd4 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000206
hal!HalRequestSoftwareInterrupt+0x1c:
804ee514 fa cli
0: kd> p
eax=00000002 ebx=ffdff120 ecx=00040041 edx=00000002 esi=ffdff980 edi=898d4608
eip=804ee515 esp=f78cdcb8 ebp=f78cdcd4 iopl=0 nv up di pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000006
hal!HalRequestSoftwareInterrupt+0x1d:
804ee515 f7050003feff00100000 test dword ptr ds:[0FFFE0300h],1000h ds:0023:fffe0300=000c08e1
0: kd> p
eax=00000002 ebx=ffdff120 ecx=00040041 edx=00000002 esi=ffdff980 edi=898d4608
eip=804ee521 esp=f78cdcb8 ebp=f78cdcd4 iopl=0 nv up di pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000046
hal!HalRequestSoftwareInterrupt+0x29:
804ee521 890d0003feff mov dword ptr ds:[0FFFE0300h],ecx ds:0023:fffe0300=000c08e1
0: kd> p
eax=00000002 ebx=ffdff120 ecx=00040041 edx=00000002 esi=ffdff980 edi=898d4608
eip=804ee527 esp=f78cdcb8 ebp=f78cdcd4 iopl=0 nv up di pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000046
hal!HalRequestSoftwareInterrupt+0x2f:
804ee527 f7050003feff00100000 test dword ptr ds:[0FFFE0300h],1000h ds:0023:fffe0300=000c08e1
0: kd> p
eax=00000002 ebx=ffdff120 ecx=00040041 edx=00000002 esi=ffdff980 edi=898d4608
eip=804ee533 esp=f78cdcb8 ebp=f78cdcd4 iopl=0 nv up di pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000046
hal!HalRequestSoftwareInterrupt+0x3b:
804ee533 9d popfd
0: kd> p
eax=00000002 ebx=ffdff120 ecx=00040041 edx=00000002 esi=ffdff980 edi=898d4608
eip=804ee534 esp=f78cdcbc ebp=f78cdcd4 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000206
hal!HalRequestSoftwareInterrupt+0x3c:
804ee534 c3 ret
0: kd> !idt
Dumping IDT: 8003f400
37: 804ed194 hal!PicSpuriousService37
3d: 804ee7d8 hal!HalpApcInterrupt
41: 804ee618 hal!HalpDispatchInterrupt
50: 804ed26c hal!HalpApicRebootService
62: 8949d58c atapi!IdePortInterrupt (KINTERRUPT 8949d550)
63: 895eb044 NDIS!ndisMIsr (KINTERRUPT 895eb008)
73: 896048d4 USBPORT!USBPORT_InterruptService (KINTERRUPT 89604898)
82: 894e9214 atapi!IdePortInterrupt (KINTERRUPT 894e91d8)
83: 89620bec USBPORT!USBPORT_InterruptService (KINTERRUPT 89620bb0)
93: 894fe9b4 i8042prt!I8042KeyboardInterruptService (KINTERRUPT 894fe978)
a3: 89564bbc i8042prt!I8042MouseInterruptService (KINTERRUPT 89564b80)
b1: 899069a4 ACPI!ACPIInterruptServiceRoutine (KINTERRUPT 89906968)
c1: 804ed408 hal!HalpBroadcastCallService
d1: 804ec714 hal!HalpClockInterrupt
e1: 804ed83c hal!HalpIpiHandler
e3: 804ed650 hal!HalpLocalApicErrorService
fd: 804edde8 hal!HalpProfileInterrupt
fe: 804edfa0 hal!HalpPerfInterrupt
0: kd> bp hal!HalpDispatchInterrupt
0: kd> p
eax=00000002 ebx=ffdff120 ecx=00040041 edx=00000002 esi=ffdff980 edi=898d4608
eip=80a36611 esp=f78cdcc0 ebp=f78cdcd4 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000206
nt!KeInsertQueueDpc+0x18d:
80a36611 8b4df8 mov ecx,dword ptr [ebp-8] ss:0010:f78cdccc=ffdff988
0: kd> p
eax=00000002 ebx=ffdff120 ecx=ffdff988 edx=00000002 esi=ffdff980 edi=898d4608
eip=80a36619 esp=f78cdcc0 ebp=f78cdcd4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
nt!KeInsertQueueDpc+0x195:
80a36619 8a4dff mov cl,byte ptr [ebp-1] ss:0010:f78cdcd3=07
0: kd> p
eax=00000002 ebx=ffdff120 ecx=ffdff907 edx=00000002 esi=ffdff980 edi=898d4608
eip=80a3661c esp=f78cdcc0 ebp=f78cdcd4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
nt!KeInsertQueueDpc+0x198:
80a3661c ff150431a080 call dword ptr [nt!_imp_KfLowerIrql (80a03104)] ds:0023:80a03104={hal!KfLowerIrql (804edc30)}
0: kd> t
0: kd> !idt
Dumping IDT: 8003f400
37: 804ed194 hal!PicSpuriousService37
3d: 804ee7d8 hal!HalpApcInterrupt
41: 804ee618 hal!HalpDispatchInterrupt
0: kd> kc
#
00 hal!HalpDispatchInterrupt
WARNING: Frame IP not in any known module. Following frames may be wrong.
01 0x0
02 CLASSPNP!ServiceTransferRequest
03 CLASSPNP!ClassReadWrite
04 nt!IofCallDriver
05 PartMgr!PmReadWrite
06 nt!IofCallDriver
07 ftdisk!FtDiskReadWrite
08 nt!IofCallDriver
09 volsnap!VolSnapWrite
0a nt!IofCallDriver
;
; interrupt vector definitions for assembler
;
ZERO_VECTOR equ 000h ; IRQL 00 placeholder
APIC_SPURIOUS_VECTOR equ 01fh ; Vector used for spurious handler
APC_VECTOR equ 03Dh ; IRQL 01 APC
DPC_VECTOR equ 041h ; IRQL 02 DPC
APIC_REBOOT_VECTOR equ 050h ; Vector used to reboot
DEVICE_LEVEL1 equ 051h
DEVICE_LEVEL2 equ 061h
DEVICE_LEVEL3 equ 071h
DEVICE_LEVEL4 equ 081h
DEVICE_LEVEL5 equ 091h
DEVICE_LEVEL6 equ 0A1h
DEVICE_LEVEL7 equ 0B1h
APIC_GENERIC_VECTOR equ 0C1h ; IRQL 27 broadcast function call
APIC_CLOCK_VECTOR equ 0D1h ; IRQL 28 APIC INTI0 - CLOCK2_LEVEL
cPublicProc _HalpDispatchInterrupt ,0
;
; Save machine state on trap frame
;
ENTER_INTERRUPT hdpi_a, hdpi_t
mov eax, DPC_VECTOR
mov esi, dword ptr APIC[LU_TPR] ; get the old TPR
mov dword ptr APIC[LU_TPR], eax ; set the TPR
sti ; and allow interrupts
APICFIX edx
mov dword ptr APIC[LU_EOI], 0 ; send EOI to APIC local unit
APICFIX edx
;
; Go do Dispatch Interrupt processing
;
di10: stdCall _KiDispatchInterrupt
对应的汇编部分：省略：ENTER_INTERRUPT hdpi_a, hdpi_t
0: kd> p
eax=00000000 ebx=f78cdff8 ecx=8999e620 edx=00001002 esi=8948ccd0 edi=804edc60
eip=804ee6c4 esp=f78cdf6c ebp=f78cdf6c iopl=0 nv up di pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000046
hal!HalpDispatchInterrupt+0xac:
804ee6c4 b841000000 mov eax,41h
0: kd> p
eax=00000041 ebx=f78cdff8 ecx=8999e620 edx=00001002 esi=8948ccd0 edi=804edc60
eip=804ee6c9 esp=f78cdf6c ebp=f78cdf6c iopl=0 nv up di pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000046
hal!HalpDispatchInterrupt+0xb1:
804ee6c9 8b358000feff mov esi,dword ptr ds:[0FFFE0080h] ds:0023:fffe0080=000000ff
0: kd> p
eax=00000041 ebx=f78cdff8 ecx=8999e620 edx=00001002 esi=00000000 edi=804edc60
eip=804ee6cf esp=f78cdf6c ebp=f78cdf6c iopl=0 nv up di pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000046
hal!HalpDispatchInterrupt+0xb7:
804ee6cf a38000feff mov dword ptr ds:[FFFE0080h],eax ds:0023:fffe0080=000000ff
0: kd> p
eax=00000041 ebx=f78cdff8 ecx=8999e620 edx=00001002 esi=00000000 edi=804edc60
eip=804ee6d4 esp=f78cdf6c ebp=f78cdf6c iopl=0 nv up di pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000046
hal!HalpDispatchInterrupt+0xbc:
804ee6d4 fb sti
0: kd> p
eax=00000041 ebx=f78cdff8 ecx=8999e620 edx=00001002 esi=00000000 edi=804edc60
eip=804ee6d5 esp=f78cdf6c ebp=f78cdf6c iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
hal!HalpDispatchInterrupt+0xbd:
804ee6d5 c705b000feff00000000 mov dword ptr ds:[0FFFE00B0h],0 ds:0023:fffe00b0=00000000
0: kd> p
eax=00000041 ebx=f78cdff8 ecx=8999e620 edx=00001002 esi=00000000 edi=804edc60
eip=804ee6df esp=f78cdf6c ebp=f78cdf6c iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
hal!HalpDispatchInterrupt+0xc7:
804ee6df ff153cb04e80 call dword ptr [hal!_imp__KiDispatchInterrupt (804eb03c)] ds:0023:804eb03c={nt!KiDispatchInterrupt (80b00720)}
0: kd> t
eax=00000041 ebx=f78cdff8 ecx=8999e620 edx=00001002 esi=00000000 edi=804edc60
eip=80b00720 esp=f78cdf68 ebp=f78cdf6c iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000246
nt!KiDispatchInterrupt:
80b00720 648b1d1c000000 mov ebx,dword ptr fs:[1Ch] fs:0030:0000001c=ffdff000
0: kd> !irql
Debugger saved IRQL for processor 0x0 -- 2 (DISPATCH_LEVEL)
KIRQL
FORCEINLINE
KeGetCurrentIrql (
VOID
)
{
ULONG tprValue;
KIRQL currentIrql;
tprValue = *APIC_TPR;
currentIrql = HalpVectorToIRQL[ tprValue / 16 ];
return currentIrql;
}
0x41
100 0001
4
0: kd> x hal!HalpVectorToIRQL
804fa21c hal!HalpVectorToIRQL = unsigned char [] ""
0: kd> db 804fa21c
804fa21c 00 ff ff 0102ff 05 06-07 08 09 0a 1b 1c 1d 1e ................
804fa22c 00 00 00 00 00 00 00 00-08 10 00 00 00 00 00 00 ................
804fa23c 00 00 00 00 00 00 00 00-00 00 80 00 00 00 00 00 ................
00 0
ff 1
ff 2
01 3
02 4
0: kd> x hal!HalpIRQLTo*
804edbb8 hal!HalpIRQLtoTPR = unsigned char [] ""
0: kd> db 804edbb8
804edbb8 00 3d4141 51 61 71 81-91 a1 b1 b1 b1 b1 b1 b1 .=AAQaq.........
804edbc8 b1 b1 b1 b1 b1 b1 b1 b1-b1 b1 b1 c1 d1 e1 ef ff ................
804edbd8 0f b6 d1 0f b6 8a b8 db-4e 80 a1 80 00 fe ff 89 ........N.......
804edbe8 0d 80 00 fe ff c1 e8 04-0f b6 80 1c a2 4f 80 c3 .............O..
804edbf8 8b 15 80 00 fe ff c7 05-80 00 fe ff 41 00 00 00 ............A...
0: kd> !idt
Dumping IDT: 8003f400
37: 804ed194 hal!PicSpuriousService37
3d:804ee7d8 hal!HalpApcInterrupt APC对应的中断向量号为0x3d
41:804ee618 hal!HalpDispatchInterrupt DPC对应的中断向量号为0x41
50: 804ed26c hal!HalpApicRebootService
62: 8949d58c atapi!IdePortInterrupt (KINTERRUPT 8949d550)
63: 895eb044 NDIS!ndisMIsr (KINTERRUPT 895eb008)
73: 896048d4 USBPORT!USBPORT_InterruptService (KINTERRUPT 89604898)
0: kd> kc
#
00 nt!KiDispatchInterrupt
01 hal!HalpDispatchInterrupt
02 hal!KfLowerIrql
03 nt!IoStartPacket
04 atapi!IdePortDispatch
05 nt!IofCallDriver
06 CLASSPNP!SubmitTransferPacket
07 CLASSPNP!ServiceTransferRequest
08 CLASSPNP!ClassReadWrite
09 nt!IofCallDriver
0a PartMgr!PmReadWrite
0b nt!IofCallDriver
0c ftdisk!FtDiskReadWrite
0d nt!IofCallDriver
0e volsnap!VolSnapWrite
0f nt!IofCallDriver
10 Ntfs!NtfsSingleAsync
11 Ntfs!NtfsNonCachedIo
12 Ntfs!NtfsCommonWrite
13 Ntfs!NtfsFsdWrite
14 nt!IofCallDriver
15 nt!IoSynchronousPageWrite
16 nt!MiFlushSectionInternal
17 nt!MmFlushSection
18 nt!CcFlushCache
19 Ntfs!NtfsCheckpointVolume
1a Ntfs!NtfsCheckpointAllVolumes
1b nt!ExpWorkerThread
1c nt!PspSystemThreadStartup
1d nt!KiThreadStartup
