Windows® Internals, Sixth Edition, Part 1

To view the contents of the interrupt object associated with the interrupt, execute dt nt!_kinterrupt with the address following KINTERRUPT:lkd> dt nt!_KINTERRUPT fffffa80045bad80 +0x000 Type : 22 +0x002 Size : 160 +0x008 InterruptListEntry : _LIST_ENTRY [ 0x00000000'00000000 - 0x0 ] +0x018 ServiceRoutine : 0xfffff880'0356ca04 unsigned char i8042prt!I8042KeyboardInterruptService+0 +0x020 MessageServiceRoutine : (null) +0x028 MessageIndex : 0 +0x030 ServiceContext : 0xfffffa80'02c839f0 +0x038 SpinLock : 0 +0x040 TickCount : 0 +0x048 ActualLock : 0xfffffa80'02c83b50 -> 0 +0x050 DispatchAddress : 0xfffff800'01a7db90 void nt!KiInterruptDispatch+0 +0x058 Vector : 0x81 +0x05c Irql : 0x8 '' +0x05d SynchronizeIrql : 0x9 '' +0x05e FloatingSave : 0 '' +0x05f Connected : 0x1 '' +0x060 Number : 0 +0x064 ShareVector : 0 '' +0x065 Pad : [3] "" +0x068 Mode : 1 ( Latched ) +0x06c Polarity : 0 ( InterruptPolarityUnknown ) +0x070 ServiceCount : 0 +0x074 DispatchCount : 0 +0x078 Rsvd1 : 0 +0x080 TrapFrame : 0xfffff800'0185ab00 _KTRAP_FRAME +0x088 Reserved : (null) +0x090 DispatchCode : [4] 0x8d485550

In this example, the IRQL that Windows assigned to the interrupt is 8. Although there is no direct mapping between an interrupt vector and an IRQ, Windows does keep track of this translation when managing device resources through what are called arbiters. For each resource type, an arbiter maintains the relationship between virtual resource usage (such as an interrupt vector) and physical resources (such as an interrupt line). As such, you can query either the root IRQ arbiter (on systems without ACPI) or the ACPI IRQ arbiter and obtain this mapping. Use the !apciirqarb command to obtain information on the ACPI IRQ arbiter:lkd> !acpiirqarb Processor 0 (0, 0): Device Object: 0000000000000000 Current IDT Allocation: ... 0000000000000081 - 0000000000000081 D fffffa80029b4c20 (i8042prt) A:0000000000000000 IRQ:0 ...

If you don’t have an ACPI system, you can use !arbiter 4 (4 tells the debugger to display only IRQ arbiters):lkd> !arbiter 4 DEVNODE fffffa80027c6d90 (HTREE\ROOT\0) Interrupt Arbiter "RootIRQ" at fffff80001c82500 Allocated ranges: 0000000000000081 - 0000000000000081 Owner fffffa80029b4c20 (i8042prt)

In both cases, you will be given the owner of the vector, in the type of a device object. You can then use the !devobj command to get information on the i8042prt device in this example (which corresponds to the PS/2 driver):lkd> !devobj fffffa80029b4c20 Device object (fffffa80029b4c20) is for: 00000061 \Driver\ACPI DriverObject fffffa8002888e70 Current Irp 00000000 RefCount 1 Type 00000032 Flags 00003040 Dacl fffff9a100096a41 DevExt fffffa800299f740 DevObjExt fffffa80029b4d70 DevNode fffffa80029b54b0 The device object is associated to a device node, which stores all the device's physical resources. You can now dump these resources with the !devnode command, and using the 6 flag to ask for resource information: lkd> !devnode fffffa80029b54b0 6 DevNode 0xfffffa80029b54b0 for PDO 0xfffffa80029b4c20 Parent 0xfffffa800299b390 Sibling 0xfffffa80029b5230 Child 0000000000 InstancePath is "ACPI\PNP0303\4&17aa870d&0" ServiceName is "i8042prt" ... CmResourceList at 0xfffff8a00185bf40 Version 1.1 Interface 0xf Bus #0 Entry 0 - Port (0x1) Device Exclusive (0x1) Flags (0x11) - PORT_MEMORY PORT_IO 16_BIT_DECODE Range starts at 0x60 for 0x1 bytes Entry 1 - Port (0x1) Device Exclusive (0x1) Flags (0x11) - PORT_MEMORY PORT_IO 16_BIT_DECODE Range starts at 0x64 for 0x1 bytes Entry 2 - Port (0x1) Device Exclusive (0x1) Flags (0x11) - PORT_MEMORY PORT_IO 16_BIT_DECODE Range starts at 0x62 for 0x1 bytes Entry 3 - Port (0x1) Device Exclusive (0x1) Flags (0x11) - PORT_MEMORY PORT_IO 16_BIT_DECODE Range starts at 0x66 for 0x1 bytes Entry 4 - Interrupt (0x2) Device Exclusive (0x1) Flags (0x01) - LATCHED Level 0x1, Vector 0x1, Group 0, Affinity 0xffffffff

The device node tells you that this device has a resource list with 4 entries, one of which is an interrupt entry corresponding to IRQ 1. (The level and vector numbers represent the IRQ vector, not the interrupt vector.) IRQ 1 is the traditional PC/AT IRQ number associated with the PS/2 keyboard device, so this is the expected value. (A USB keyboard would have a different interrupt.)