Windows Kernel Internals Object Manager David B Probert

Windows Kernel Internals Object Manager David B. Probert, Ph. D. Windows Kernel Development Microsoft Corporation © Microsoft Corporation 1

Kernel Object Manager (OB) • • • Provides underlying NT namespace Unifies kernel data structure referencing Unifies user-mode referencing via handles Simplifies resource charging Central facility for security protection © Microsoft Corporation 2

NT Name Space arcname Base. Named. Objects callback device Hard. Disk 0 dr 0 driver File. System ntfs Kernel. Objects Known. Dlls Object. Types RPC Control Windows apiport Sb. Api. Port Windows. Stations winsta 0 © Microsoft Corporation 3

Object. Types Adapter Callback Controller Debug. Object Desktop Device Directory Driver Event. Pair File Io. Completion Job Keyed. Event Mutant Port Process Profile Section © Microsoft Corporation Semaphore Symbolic. Link Thread Timer Token Type Waitable. Port Windows. Station WMIGuid 4

Object. Types Adapter Callback Controller Debug. Object Desktop Device Directory Driver Event. Pair File Io. Completion Job Keyed. Event Mutant Port Process Profile Section © Microsoft Corporation Semaphore Symbolic. Link Thread Timer Token Type Waitable. Port Windows. Station WMIGuid 5

OBJECT_HEADER © Microsoft Corporation 6

Generic object services • • • namespace ops: directories, symlinks Nt. Query. Object Nt. Query/Set. Security. Object Nt. Wait. For. Single/Multiple. Objects Ob. Open. Object. By. Name/Pointer Ob. Reference. Object. By. Name/Handle Nt. Duplicate. Object Nt. Close Ob. Dereference. Object © Microsoft Corporation 7

OBJECT_DIRECTORY © Microsoft Corporation 8

Obp. Lookup. Directory. Entry(p. D, s) object = NULL idx = HASH(s) p. E = p. D->Hash. Buckets[idx] Lock. Directory. Shared(p. D) while (p. E && !eqs(s, p. E->Object->Name)) p. E = p. E->p. Chain. Link if (p. E) Obp. Reference. Object(object = p. E->Object) Unlock. Directory(p. D) return object © Microsoft Corporation 9

Object Methods OPEN: Create/Open/Dup/Inherit handle CLOSE: Called when each handle closed DELETE: Called on last dereference PARSE: Called looking up objects by name SECURITY: Usually Se. Default. Object. Method QUERYNAME: Return object-specific name OKAYTOCLOSE: Give veto on handle close © Microsoft Corporation 10

Object Manager Types Directory - namespace object Implementation hardwired Symbolic. Link - namespace object Delete. Procedure = Obp. Delete. Symbolic. Link Parse. Procedure = Obp. Parse. Symbolic. Link Type - represent object types Delete. Procedure = Obp. Delete. Object. Type © Microsoft Corporation 11

Object Manager lookups Obp. Lookup. Object. Name(Name, Context) – Search a directory for specified object name – Use Obp. Lookup. Directory. Entry() on Directories – Otherwise call object-specific Parse. Procedure • Implements symbolic links (Symbolic. Link type) • Implements file systems (Device. Object type) © Microsoft Corporation 12

I/O Manager Types Adapter Controller Device - ADAPTER_OBJECT - CONTROLLER_OBJECT - DEVICE_OBJECT Parse. Procedure = Iop. Parse. Device Delete. Procedure = Iop. Delete. Device Security. Procedure = Iop. Get. Security. Object Driver - DRIVER_OBJECT Delete. Procedure = Iop. Delete. Driver Io. Completion - KQUEUE Delete. Procedure = Iop. Delete. Io. Completion © Microsoft Corporation 13

I/O Manager File Type File - FILE_OBJECT Close. Procedure = Iop. Close. File Delete. Procedure = Iop. Delete. File Parse. Procedure = Iop. Parse. File Security. Procedure = Iop. Get. Security. Object Query. Name. Procedure = Iop. Query. Name © Microsoft Corporation 14

Iop. Parse. Device (Device. Object, Context, Remaining. Name) – – – – – Call Se. Access. Check() If (!*Remaining. Name) direct. Device. Open = TRUE For file opens, get Volume from Device. Object Update references on Volume and Device. Object Construct an I/O Request Packet (IRP) File. Object = Ob. Create. Object(Io. File. Object. Type) Initialize File. Object Initiate I/O via Io. Call. Driver(Volume. Device, IRP) Wait for I/O to signal File. Object->Event Return the File. Object to caller © Microsoft Corporation 15

FILE_OBJECT © Microsoft Corporation 16

File Object (FO) flags FO_FILE_OPEN FO_SYNCHRONOUS_IO FO_ALERTABLE_IO FO_REMOTE_ORIGIN FO_WRITE_THROUGH FO_SEQUENTIAL_ONLY FO_CACHE_SUPPORTED FO_NAMED_PIPE FO_STREAM_FILE FO_MAILSLOT FO_FILE_MODIFIED FO_FILE_SIZE_CHANGED FO_CLEANUP_COMPLETE FO_TEMPORARY_FILE FO_DELETE_ON_CLOSE FO_OPENED_CASE_SENSITIVE FO_HANDLE_CREATED FO_FILE_FAST_IO_READ FO_RANDOM_ACCESS FO_FILE_OPEN_CANCELLED FO_VOLUME_OPEN FO_FILE_OBJECT_HAS_EXTENSION FO_NO_INTERMEDIATE_BUFFERING FO_GENERATE_AUDIT_ON_CLOSE FO_DIRECT_DEVICE_OPEN © Microsoft Corporation 17

Process/Thread Types Job - JOB Delete. Procedure = Psp. Job. Delete Close. Procedure = Psp. Job. Close Process - EPROCESS Delete. Procedure = Psp. Process. Delete Profile - EPROFILE Delete. Procedure = Exp. Profile. Delete Section - SECTION Delete. Procedure = Mi. Section. Delete Thread - ETHREAD Delete. Procedure = Psp. Thread. Delete Token - TOKEN © Microsoft Corporation Delete. Procedure = Sep. Token. Delete. Method 18

Job methods - Close Psp. Job. Close - called by OB when a handle is closed Return unless final close Mark Job as closed Acquire the job's lock If job marked PS_JOB_FLAGS_CLOSE_DONE Release the Job. Lock Call Psp. Terminate. All. Processes. In. Job() Reacquire the Job. Lock Acquire the job's Memory. Limits. Lock Remove any completion port from the job Release the Memory. Limits. Lock Release the Job. Lock Dereference the completion port © Microsoft Corporation 19

Job methods - Delete Psp. Job. Delete - called by OB at final dereference Holding the Joblock callout to ntuser Acquire the Psp. Job. List. Lock If part of a jobset then we are the job pinning the jobset t. Job = next job in set and remove current job Release the Psp. Job. List. Lock If (t. Job) Ob. Dereference. Object. Defer. Delete (t. Job) If (Job->Token) Ob. Dereference. Object (Job->Token) Free pool allocated for job filters Unlink our Job. Lock from the global list © Microsoft Corporation 20

Synchronization Types Event. Pair Keyed. Event Mutant - KEVENT - EEVENT_PAIR - KEYED_EVENT_OBJECT - KMUTANT Delete. Procedure = Exp. Delete. Mutant Port - LPCP_PORT_OBJECT Delete. Procedure = Lpcp. Delete. Port Close. Procedure = Lpcp. Close. Port Semaphore Timer - KSEMAPHORE - ETIMER Delete. Procedure = Exp. Delete. Timer © Microsoft Corporation 21

Win 32 k. sys Callback - CALLBACK_OBJECT Delete. Procedure = Exp. Delete. Callback Windows. Station, Desktop Close. Procedure = Exp. Win 32 Close. Procedure Delete. Procedure = Exp. Win 32 Delete. Procedure Okay. To. Close. Procedure = Exp. Win 32 Okay. To. Close. Procedure Parse. Procedure = Exp. Win 32 Parse. Procedure Open. Procedure = Exp. Win 32 Open. Procedure © Microsoft Corporation 22

Processes & Threads Access Token VAD Process Object VAD Virtual Address Space Descriptors Handle Table object Thread © Microsoft Corporation . . . Access Token

Handle Table (Executive) • • Efficient, scalable object index structure One per process containing ‘open’ objects Kernel handle table (system process) Also used to allocate process/thread IDs © Microsoft Corporation 24

Process Handle Tables © Microsoft Corporation 25

One level: (to 512 handles) © Microsoft Corporation 26

Two levels: (to 512 K handles) © Microsoft Corporation 27

Three levels: (to 16 M handles) © Microsoft Corporation 28

Handle Table Data Structure Table. Pointer/Level Points at handles Quota. Process Who to charge Unique. Process. Id Passed to callbacks Handle. Table. Locks[N] Locks for handles Handle. Table. List Global list of tables Handle. Contention. Event to block on Debug. Info Stacktraces Extra. Info. Pages Parallel table for audits First. Free/Last. Free The two handle free lists Next. Handle. Needing. Pool Handles w/ memory Handle. Count Handles in use © Microsoft Corporation 29

Handle Table Functions Ex. Create. Handle. Table – create non-process tables Ex. Dup. Handle. Table – called creating processes Ex. Sweep. Handle. Table – for process rundown Ex. Destroy. Handle. Table – called destroying processes Ex. Create. Handle – setup new handle table entry Ex. Change. Handle – used to set inherit and/or protect Ex. Destroy. Handle – implements Close. Handle Ex. Map. Handle. To. Pointer – reference underlying object Ex. Reference. Handle. Debug. Info – tracing handles Ex. Snap. Shot. Handle. Tables – handle searchers (oh. exe)30 © Microsoft Corporation

Ex. Create. Handle(table, entry) New. Handle. Table. Entry = Exp. Allocate. Handle. Table. Entry() Ke. Enter. Critical. Region. Thread() *New. Handle. Table. Entry = *Handle. Table. Entry Ex. Unlock. Handle. Table. Entry() Ke. Leave. Critical. Region. Thread() © Microsoft Corporation 31

Exp. Allocate. Handle. Table. Entry() while (1) { while (! (Old. Value = Table->First. Free)) { Ex. Acquire. Push. Lock. Exclusive(Table. Lock[0]); If (Old. Value = Table->First. Free) break; If (Old. Value = Exp. Move. Free. Handles()) break; Exp. Allocate. Handle. Table. Entry. Slow(); Ex. Release. Push. Lock. Exclusive(Table. Lock[0]); } Exp. Unlock. Handle. Table. Exclusive(); Handle. Value = (Old. Value & FREE_HANDLE_MASK); Entry = Exp. Lookup. Handle. Table. Entry(); © Microsoft Corporation 32

Idx = ((Handle. Value)>>2) % HANDLE_LOCKS; Ex. Acquire. Push. Lock. Exclusive(Table. Lock[idx]); if (Old. Value != *(volatile)&Table->First. Free) { Ex. Release. Push. Lock. Exclusive(Table. Lock[idx]); continue; } Ke. Memory. Barrier (); New. Value = *(volatile)&Entry->Next. Free. Table. Entry; Expected = Interlocked. Compare. Exchange (&Table>First. Free, New. Value, Old. Value); Ex. Release. Push. Lock. Exclusive(Lock[idx]); if (Expected == Old. Value) break; } Interlocked. Increment (Handle. Count); *p. Handle = Handle; © Microsoft Corporation 33

Exp. Lookup. Handle. Table. Entry If Handle. Value >= Next. Handle. Needing. Pool return NULL; Captured. Table = *(volatile)&Table->Table. Code; Captured. Table = Captured. Table - Table. Level; switch (Captured. Table & LEVEL_CODE_MASK) { … index into tables according to level … } return Entry; © Microsoft Corporation 34

Exp. Move. Free. Handles // Move all free entries from the delayed free list Old = Interlocked. Exchange (&Table->Last. Free, 0); Acquire and immediately release all the Table. Locks to synch if (! Strict. FIFO) { // If First. Free list is empty just stash the delayed list if (Interlocked. Compare. Exchange (&Table->First. Free, Old + Get. Next. Seq(), 0) == 0) return Old; } Reverse the chain to get: First. Entry -> … -> Last. Entry New = First. Entry + Get. Next. Seq(); while (1) { tmp = Table->Last. Free; Entry->Next. Free. Table. Entry = tmp; if (tmp == Interlocked. Compare. Exchange (Index, New, tmp)) break; } return Old; © Microsoft Corporation 35

Object Manager Summary • Manages the NT namespace • Common scheme for managing resources • Extensible method-based model for building system objects • Memory management based on reference counting • Uniform/centralized security model • Support handle-based access of system objects • Common, uniform mechanisms for using system resources © Microsoft Corporation 36

Discussion © Microsoft Corporation 37