[Autogenerated] next let's discuss the kernel stack.
The kernel stack is a stack in kernel space and obviously
kernel space is only accessible to kernel mode code and is
inaccessible to user mode.
The question is why do we need a kernel mode stack or
kernel space stack for user mode threads.
And they are in fact a couple of reasons for that.
One of them is that when you call a system call
invoke one of these anti functions, for example,
from user mode going into the kernel some arguments as discussed earlier
are passed on the stack and so the actual system call on the kernel side
of things has to access those parameters.
Those arguments do something with it,
so to make sure that using mode code perhaps another thread in the same
process that might garble those uh those parameters,
those arguments,
the invocation of the system call also copies the parameters at the time from
the user stack to the kernel stack for that same threat.
And then the system call can work on those arguments
from the kernel side of things.
And because that's part of kernel space,
this is completely inaccessible to use the mode cause nobody
can can garble or do anything with these parameters while
the system call is in progress.
The second reason is the fact that interrupt or hard to
interrupt can happen at any time.
This might finish writing something,
some packet could arrive on a network card and so on.
When that something like this happens interrupt is raised and an
appropriate device driver needs to execute its interrupt service
routine to handle that interrupt.
And so this could happen at any point in time while the
thread running on that particular processor might be
running user mode code or kernel code.
There's really no way to tell.
And interrupt is completely asynchronous.
And the thing is that once the interrupt service routine gets control,
it needs a stack to work on and the stack always has to be in
kernel space because it's a function running kernel space and it
can't have any kind of interruptions and so it can't have any user
mode code mingling with the stack.
Now the kernel stack is relatively small as we see later.
The using Woodstock can be as big as you want.
But the kernel stack for threats is relatively small.
It's only 12 kilobytes on 32 bit systems.
24 kilobytes on 64-bit systems.
This is really small.
And one of the reasons for that is historical because in the early windows.
Nt days, the RAM sizes that we had in those days were much,
much smaller than there are today.
So that, That was kind of expensive to have.
And one thing to note is that the kernel stack is always in
physical memory now because the stack is small.
It's very easy to _____ the system from the Kernel side of things.
For example, if I allocate an array of 10,000 integers,
for example on the stack.
That's it.
That's going to be a typical blue screen because I'm trying to allocate
40,000 bites but there's no the stack is not that big.
So Colonel driver developers know to be careful there and if they
need the big data structures or lots of memory,
they should be allocating that on some heap instead of using the
stack and holding just a pointer on the stack pointing to a big
memory in one of the memory pools.
And as I mentioned, the kernel stack is always in physical memory.
One of the reasons for that is when interrupts occur.
The interrupt service routine runs in something called the high interrupt
request level a concept we might discuss in the future course.
And this means that you can't access page memory from this kind of high R Q L.
So the the kernel stack is always in physical memory when the threat is
in the ready standby and running states we've seen in the previous module
that when the threat is in a waiting state,
it is possible that the colonel will remove the kernel stack of that
thread from ram and page it out to the page file.
But then once the thread gets whatever it was waiting for,
it can't go into the real estate immediately but goes through a
temporary state where the uh the transition state where the kernel
stack is being pulled back from the page file back to Rome because
when that threat gets CPU time.
The kernel stack has to be in physical memory because it
interrupts can occur at any given point in time.