/******************************Module*Header*******************************\ * Module Name: hmgrapi.cxx * * Handle manager API entry points * * Created: 08-Dec-1989 23:03:03 * Author: Donald Sidoroff [donalds] * * Copyright (c) 1989-1999 Microsoft Corporation \**************************************************************************/ #include "precomp.hxx" // // Synchronization of the handle manager // HSEMAPHORE ghsemHmgr; PDEVCAPS gpGdiDevCaps = NULL; // // Points to shared memory including handle table and cfont cache // PGDI_SHARED_MEMORY gpGdiSharedMemory; // // Points to handle array // ENTRY *gpentHmgr=NULL; // // Free List of handles // HOBJ ghFreeHmgr; // // Max handle alloced so far // ULONG gcMaxHmgr; // // Look aside list headers and maximum allowed entry-size array PPAGED_LOOKASIDE_LIST pHmgLookAsideList[MAX_TYPE + 1]; ULONG laSize[MAX_TYPE + 1]; #define HMG_LAL_TAG '0alG' // // // extern "C" { HFASTMUTEX ghfmMemory; } PVOID gpHmgrSharedHandleSection; // // 10 millisecond wait value // // We only have a pointer to it since it must be allocated out of Non-paged // pool // PLARGE_INTEGER gpLockShortDelay; // // Hydra session flag // // Note that this only has bearing on whether process is a hydra session // or not. It is possible to not be a hydra session, but still be a // a hydra server (check gIsTerminalServer for that information). // // Value is TRUE if not a hydra session. // Value is FALSE if a hydra session. // extern BOOL G_fConsole; // // Short term temporary buffer that can be used to put large // objects for which we have no place in the stack. // // The value should only be used through the Alloc\FreeTmpBuffer functions // #define TMP_GLOBAL_BUFFER_SIZE 0x1000 PVOID *gpTmpGlobalFree; PVOID gpTmpGlobal = NULL; // Number of DCATTR blocks in 1 page #define ULNUMDC ((PAGE_SIZE)/sizeof(DC_ATTR)) // Number of OBJECTATTR blocks in 1 page #define ULNUMBRUSH ((PAGE_SIZE)/sizeof(OBJECTATTR)) typedef struct _DCAFLISTENTRY { LIST_ENTRY listEntry; ULONG cFree; PDC_ATTR* a[ULNUMDC]; } DCAFLISTENTRY, *PDCAFLISTENTRY; typedef struct _OBAFLISTENTRY { LIST_ENTRY listEntry; ULONG cFree; POBJECTATTR* a[ULNUMBRUSH]; } OBAFLISTENTRY, *POBAFLISTENTRY; // // Prototype for a handy debugging routine. // #if DBG extern "C" VOID HmgPrintBadHandle( HOBJ hobj, OBJTYPE objt ); #else #define HmgPrintBadHandle(hobj, objt) #endif // // During initialization, some things which are really really bad // (like not being able to allocate the handle manager table) and // we RIP because we cannot proceed and its completely unexpected. // // However, on a Hydra system, some of these are things we need // to expect. So what would be a RIP on a non-Hydra system can // be treated as a WARNING on a Hydra system // #if DBG #define NONHYDRA_RIP(a) \ { \ if (G_fConsole) \ RIP(a); \ else \ WARNING(a); \ } #else #define NONHYDRA_RIP(a) #endif /**************************************************************************\ * * Fast tempporary memory allocator * \**************************************************************************/ PVOID AllocFreeTmpBuffer( ULONG size) { PVOID tmpPtr = NULL; if (size <= TMP_GLOBAL_BUFFER_SIZE) { tmpPtr = (PVOID) InterlockedExchangePointer((PVOID *)gpTmpGlobalFree, 0); } if (!tmpPtr) { tmpPtr = AllocThreadBufferWithTag(size,'pmTG'); } return tmpPtr; } VOID FreeTmpBuffer( PVOID pv) { if (pv == gpTmpGlobal) { ASSERTGDI(*gpTmpGlobalFree == NULL, "GRE: gpTmpGlobalFree is inconsistent\n"); *gpTmpGlobalFree = pv; } else { FreeThreadBufferWithTag(pv); } } /**************************************************************************\ * * Thread specific memory allocator. Memory is added to tracking list in * the thread and cleaned up if its still in the list when the thread dies. * \**************************************************************************/ PVOID AllocThreadBufferWithTag( ULONG size, ULONG tag) { PVOID tmpPtr = NULL; if (size < MAXULONG - sizeof(LIST_ENTRY)) { tmpPtr = PALLOCNOZ(size + sizeof(LIST_ENTRY),tag); if (tmpPtr) { PW32THREAD pThread = W32GetCurrentThread(); ASSERTGDI(pThread, "GRE: AllocThreadBuffer W32Thread is NULL\n"); if (pThread) { PLIST_ENTRY pEntry = (PLIST_ENTRY)tmpPtr; InsertHeadList(&pThread->GdiTmpAllocList, pEntry); tmpPtr = (PVOID)(pEntry + 1); } } } return tmpPtr; } VOID FreeThreadBufferWithTag( PVOID pv) { PW32THREAD pThread = W32GetCurrentThread(); ASSERTGDI(pThread, "GRE: FreeThreadBuffer W32Thread is NULL\n"); if (pThread) { PLIST_ENTRY pFree = (PLIST_ENTRY)pv; RemoveEntryList(pFree-1); VFREEMEM(pFree-1); } } /**************************************************************************\ * * Performance, hit rate, memory size statistics * \**************************************************************************/ #if DBG #define GDI_PERF 1 #endif #if GDI_PERF extern "C" { // these must be extern "C" so the debugger extensions can see them ULONG HmgCurrentNumberOfObjects[MAX_TYPE + 1]; ULONG HmgMaximumNumberOfObjects[MAX_TYPE + 1]; ULONG HmgCurrentNumberOfLookAsideObjects[MAX_TYPE + 1]; ULONG HmgMaximumNumberOfLookAsideObjects[MAX_TYPE + 1]; ULONG HmgNumberOfObjectsAllocated[MAX_TYPE + 1]; ULONG HmgNumberOfLookAsideHits[MAX_TYPE + 1]; ULONG HmgCurrentNumberOfHandles[MAX_TYPE + 1]; ULONG HmgMaximumNumberOfHandles[MAX_TYPE + 1]; ULONG HmgNumberOfHandlesAllocated[MAX_TYPE + 1]; }; #endif /*****************************Exported*Routine*****************************\ * HmgCreate() * * Initializes a new handle manager. * * History: * * Mon 14-Apr-1997 -by- Dan Almosnino [danalm] * Modified Lookaside initialization to use DaveC S-Lists * and set the allowable object size on the list based on memory model * * Wed 29-Apr-1992 -by- Patrick Haluptzok [patrickh] * Change to mutex for exclusion, init event here. * * Mon 21-Oct-1991 -by- Patrick Haluptzok [patrickh] * Reserve memory for the handle table so unlock doesn't need semaphore. * * Mon 08-Jul-1991 -by- Patrick Haluptzok [patrickh] * make 0 an invalid handle * * Sun 20-Jun-1991 -by- Patrick Haluptzok [patrickh] * The hheap has gone away, the correct error codes are logged. * * 30-Nov-1989 -by- Donald Sidoroff [donalds] * Wrote it. \**************************************************************************/ BOOL HmgCreate() { ULONG ulType; ULONG Size; BOOL LargeSystemSize = FALSE; #if 0 KdPrint((" MASK CBITS SHIFT\n")); KdPrint(("INDEX = 0x%8.8lx, %3d %3d \n",INDEX_MASK ,INDEX_BITS ,INDEX_SHIFT)); KdPrint(("TYPE = 0x%8.8lx, %3d %3d \n",TYPE_MASK ,TYPE_BITS ,TYPE_SHIFT )); KdPrint(("ALTTYPE = 0x%8.8lx, %3d %3d \n",ALTTYPE_MASK ,ALTTYPE_BITS ,ALTTYPE_SHIFT )); KdPrint(("STOCK = 0x%8.8lx, %3d %3d \n",STOCK_MASK ,STOCK_BITS ,STOCK_SHIFT )); KdPrint(("UNIQUE = 0x%8.8lx, %3d %3d \n",UNIQUE_MASK ,UNIQUE_BITS ,UNIQUE_SHIFT )); KdPrint(("LOTYPE = 0x%8.8lx, %3d %3d \n",LOTYPE_MASK ,LOTYPE_BITS ,LOTYPE_SHIFT )); KdPrint(("FULLTYPE = 0x%8.8lx, %3d %3d \n",FULLTYPE_MASK ,FULLTYPE_BITS ,FULLTYPE_SHIFT )); KdPrint(("FULLUNIQUE = 0x%8.8lx, %3d %3d \n",FULLUNIQUE_MASK,FULLUNIQUE_BITS,FULLUNIQUE_SHIFT )); KdPrint(("\n")); #endif // // Initialize exclusion stuff. // if ((ghsemHmgr = GreCreateSemaphore()) == NULL) return FALSE; // // Initialize the handle manager allocation database. // ghFreeHmgr = 0; // No free handles gcMaxHmgr = HMGR_HANDLE_BASE; // Initialize with handle index base // // Initialize the allocation of lookaside lists for selected objects. // // Initialize the maximum allowed entry-size for each object to zero if (MmMediumSystem <= MmQuerySystemSize()) LargeSystemSize = TRUE; for (ulType = 0; ulType < MAX_TYPE + 1; ulType++) { laSize[ulType] = 0; } // Now Initialize the Lookaside lists Size = (LargeSystemSize == TRUE)? HMG_DC_MAX : HMG_DC_SIZE; if (HmgInitializeLookAsideList(DC_TYPE, Size, HMG_LAL_TAG, HMG_DC_OBJECTS) == FALSE) return FALSE; Size = (ULONG)((LargeSystemSize == TRUE)? HMG_RGN_MAX : HMG_RGN_SIZE); if (HmgInitializeLookAsideList(RGN_TYPE, Size, HMG_LAL_TAG, HMG_RGN_OBJECTS) == FALSE) return FALSE; Size = (ULONG)((LargeSystemSize == TRUE)? HMG_SURF_MAX : HMG_SURF_SIZE); if (HmgInitializeLookAsideList(SURF_TYPE, Size, HMG_LAL_TAG, HMG_SURF_OBJECTS) == FALSE) return FALSE; Size = (ULONG)((LargeSystemSize == TRUE)? HMG_PAL_MAX : HMG_PAL_SIZE); if (HmgInitializeLookAsideList(PAL_TYPE, Size, HMG_LAL_TAG, HMG_PAL_OBJECTS) == FALSE) return FALSE; Size = (ULONG)((LargeSystemSize == TRUE)? HMG_BRUSH_MAX : HMG_BRUSH_SIZE); if (HmgInitializeLookAsideList(BRUSH_TYPE, Size, HMG_LAL_TAG, HMG_BRUSH_OBJECTS) == FALSE) return FALSE; Size = (ULONG)((LargeSystemSize == TRUE)? HMG_LFONT_MAX : HMG_LFONT_SIZE); if (HmgInitializeLookAsideList(LFONT_TYPE, Size, HMG_LAL_TAG, HMG_LFONT_OBJECTS) == FALSE) return FALSE; Size = (ULONG)((LargeSystemSize == TRUE)? HMG_RFONT_MAX : HMG_RFONT_SIZE); if (HmgInitializeLookAsideList(RFONT_TYPE, Size, HMG_LAL_TAG, HMG_RFONT_OBJECTS) == FALSE) return FALSE; // // // Init mutex // // allocate and initialize memory fast mutex from non-paged pool // ghfmMemory = GreCreateFastMutex(); if (ghfmMemory == NULL) { NONHYDRA_RIP("HmgCreate failed to create ghfmMemory"); return(FALSE); } // // Create section for shared GDI handle table // #if defined(_GDIPLUS_) { // // NOTE: _GDIPLUS_ is some work in progress code. // // // This should probably be a reserve-and-commit // We ceed to fix clean-up case, too // gpGdiSharedMemory = (GDI_SHARED_MEMORY*) PALLOCMEM(sizeof(GDI_SHARED_MEMORY), ' thG'); if (gpGdiSharedMemory == NULL) { RIP("Invalid handle table."); } } #else { NTSTATUS Status; OBJECT_ATTRIBUTES ObjectAttributes; UNICODE_STRING UnicodeString; LARGE_INTEGER MaximumSize; HANDLE hHmgrSharedHandleTable; ACCESS_MASK DesiredAccess = SECTION_MAP_READ | SECTION_MAP_WRITE; ULONG SectionPageProtection = PAGE_READWRITE; ULONG AllocationAttributes = SEC_COMMIT | SEC_NO_CHANGE; MaximumSize.HighPart = 0; MaximumSize.LowPart = sizeof(GDI_SHARED_MEMORY); ASSERTGDI((gpHmgrSharedHandleSection == NULL), "gpHmgrSharedHandleSection MUST be NULL"); Status = Win32CreateSection(&gpHmgrSharedHandleSection, DesiredAccess, NULL, &MaximumSize, SectionPageProtection, AllocationAttributes, NULL, NULL, TAG_SECTION_HMGR); if (!NT_SUCCESS(Status)) { KdPrint(("Error in HmgCreate: Win32CreateSection returns %lx\n",Status)); NONHYDRA_RIP("Can't continue without shared handle section"); return(FALSE); } else { SIZE_T ViewSize = 0; #ifdef _HYDRA_ // // MmMapViewInSessionSpace is internally promoted to // MmMapViewInSystemSpace on non-Hydra systems. // // Win32MapViewInSessionSpace is included for tracking // Section objects. It's promoted to MmMapViewInSessionSpace // after the tracking code. // Status = Win32MapViewInSessionSpace( gpHmgrSharedHandleSection, (PVOID*)&gpGdiSharedMemory, &ViewSize); #else Status = MmMapViewInSystemSpace( gpHmgrSharedHandleSection, (PVOID*)&gpGdiSharedMemory, &ViewSize); #endif if (!NT_SUCCESS(Status)) { KdPrint(("Error in HmgCreate: MmMapViewInSystemSpace returns %lx\n",Status)); NONHYDRA_RIP("Can't continue without shared handle section"); return(FALSE); } } } #endif gpentHmgr = gpGdiSharedMemory->aentryHmgr; gpGdiDevCaps = &(gpGdiSharedMemory->DevCaps); // // Allocate the handle table and commit the initial allocation. // // N.B. Committed memory is demand zero. // // if (gpentHmgr == NULL) { NONHYDRA_RIP("Hmgr-bInit failed to reserve the handle table memory\n"); return(FALSE); } // // allocate and initialize the timeout lock for the handle manager. // gpLockShortDelay = (PLARGE_INTEGER) GdiAllocPoolNonPaged(sizeof(LARGE_INTEGER), 'iniG'); if (gpLockShortDelay == NULL) { NONHYDRA_RIP("Hmgr-could not allocate memory for delay lock\n"); return(FALSE); } gpLockShortDelay->LowPart = (ULONG) -100000; gpLockShortDelay->HighPart = -1; // // Create a short term temporary buffer that can be used to put large // objects for which we have no place in the stack. // // We actually have to allocate the pointer to the buffer in non-paged // pool so that we can do an Interlocked exchange safely on it // gpTmpGlobal = (PVOID)PALLOCNOZ(TMP_GLOBAL_BUFFER_SIZE, 'blgG'); gpTmpGlobalFree = (PVOID *)GdiAllocPoolNonPaged(sizeof(PVOID), 'iniG'); if ((gpTmpGlobal == NULL) || (gpTmpGlobalFree == NULL)) { NONHYDRA_RIP("Can't allocate process list entry"); return(FALSE); } *gpTmpGlobalFree = gpTmpGlobal; return(TRUE); } /******************************Public*Routine******************************\ * InitializeLookAsideList * * Initializes a LookAside List for a selected object * Uses DaveC's S-Lists * * History: * 14-Apr-1997 -by- Dan Almosnino danalm * Wrote it \**************************************************************************/ PVOID StubGdiAlloc( POOL_TYPE PoolType, SIZE_T uBytes, ULONG iTag) { return GdiAllocPool((ULONG)uBytes, iTag); UNREFERENCED_PARAMETER(PoolType); } // Does anyone want to change this to #define ? if so please do so after win2000. // // #define StubGdiFree(p) GdiFreePool((p)) VOID StubGdiFree( PVOID p) { GdiFreePool(p); } BOOL HmgInitializeLookAsideList( ULONG ulType, ULONG Size, ULONG dwTag, USHORT Number ) { #if !defined(_GDIPLUS_) ULONG Flags = 0; // Modify tag using type. dwTag += ulType << 24; // Set the maximum allowed entry-size for this object laSize[ulType] = Size; // Allocate space for the List headers from Non-Paged pool (Otherwise bugcheck occurs // if Kernel tries to access them for modification of list-depth if they are paged out) pHmgLookAsideList[ulType] = (PPAGED_LOOKASIDE_LIST)GdiAllocPoolNonPagedNS( sizeof(PAGED_LOOKASIDE_LIST), dwTag); if (pHmgLookAsideList[ulType] == (PPAGED_LOOKASIDE_LIST)NULL) { WARNING1("HmgCreate failed to allocate memory for pHmgLookAsideList\n"); return(FALSE); } // Now Initialize the Lookaside list #ifdef _HYDRA_ if (gIsTerminalServer) { Flags |= gSessionPoolMask; } #endif ExInitializePagedLookasideList(pHmgLookAsideList[ulType], StubGdiAlloc, StubGdiFree, Flags, Size, dwTag, Number); #endif return (TRUE); } /******************************Public*Routine******************************\ * IncProcessHandleCount - inc process handle count if under limit or * flag specifies no check. * * Arguments: * * Return Value: * * TRUE if count is incremented. * * History: * * 30-Apr-1996 -by- Mark Enstrom [marke] * \**************************************************************************/ BOOL HmgIncProcessHandleCount( W32PID w32pid, OBJTYPE objt ) { BOOL bRet = TRUE; #if !defined(_GDIPLUS_) // // maintain handle count but don't limit quota // for DCs // --> changed it to limit quota for DCs. The fact that // USER create DCs for menu's and borders on behalf of the // app should not be that bad to prevent us from limiting DCs // end user can always use 'close' or task manager to kill a bad app. // If we don't limit DCs, the whole system will be affected. // [lingyunw] // if ((w32pid != OBJECT_OWNER_PUBLIC) && (w32pid != OBJECT_OWNER_NONE)) { // // is the PID the current PID // if (w32pid == W32GetCurrentPID()) { PW32PROCESS pw32Current = W32GetCurrentProcess(); // // if the w32 process is not NULL then use // the current value, otherwise the process // has no W32PROCESS, so don't track handle quota // if (pw32Current) { // // increment handle count unless call specifies check quota and // process is already at or above limit. // if (pw32Current->GDIHandleCount >= gProcessHandleQuota) { WARNING1("GDI Handle Limit reached\n"); bRet = FALSE; } else { InterlockedIncrement(&pw32Current->GDIHandleCount); } } } else { PW32PROCESS pw32; PEPROCESS Process; NTSTATUS Status; Status = PsLookupProcessByProcessId(LongToHandle(w32pid), &Process); if (NT_SUCCESS(Status)) { if (pw32 = (PW32PROCESS)(PsGetProcessWin32Process(Process))) { if (pw32->GDIHandleCount >= gProcessHandleQuota) { WARNING1("GDI Handle Limit reached\n"); bRet = FALSE; } else { InterlockedIncrement(&pw32->GDIHandleCount); } } ObDereferenceObject(Process); } else { WARNING1("HmgIncProcessGDIHandleCount: Couldn't find PID owner\n"); } } } #endif return(bRet); } /******************************Public*Routine******************************\ * HmgDecProcessHandleCount - dec process handle count * * Arguments: * * none * * Return Value: * * nont * * History: * * 6-May-1996 -by- Mark Enstrom [marke] * \**************************************************************************/ VOID HmgDecProcessHandleCount( W32PID w32pid ) { #if !defined(_GDIPLUS_) if ((w32pid != OBJECT_OWNER_PUBLIC) && (w32pid != OBJECT_OWNER_NONE)) { if (w32pid == W32GetCurrentPID()) { PW32PROCESS pw32Current = W32GetCurrentProcess(); if (pw32Current) { // // use current process // InterlockedDecrement(&pw32Current->GDIHandleCount); if (pw32Current->GDIHandleCount < 0) { WARNING("GDI process handle count: decremented below zero"); } } } else { PW32PROCESS pw32; PEPROCESS Process; NTSTATUS Status; Status = PsLookupProcessByProcessId(LongToHandle(w32pid), &Process); if (NT_SUCCESS(Status)) { if (pw32 = (PW32PROCESS)(PsGetProcessWin32Process(Process))) { InterlockedDecrement(&pw32->GDIHandleCount); if (pw32->GDIHandleCount < 0) { WARNING("GDI process handle count: decremented below zero"); } } ObDereferenceObject(Process); } else { WARNING1("HmgDeccProcessGDIHandleCount: Couldn't find PID owner\n"); } } } #endif } /******************************Public*Routine******************************\ * HmgValidHandle * * Returns TRUE if the handle is valid, FALSE if not. * * Note we don't need to lock the semaphore, we aren't changing anything, * we are just peeking in. * * History: * 08-Jul-1991 -by- Patrick Haluptzok patrickh * Wrote it. \**************************************************************************/ BOOL HmgValidHandle( HOBJ hobj, OBJTYPE objt) { PENTRY pentTmp; UINT uiIndex = (UINT) (UINT) HmgIfromH(hobj); if ((uiIndex < gcMaxHmgr) && ((pentTmp = &gpentHmgr[uiIndex])->Objt == objt) && (pentTmp->FullUnique == HmgUfromH(hobj))) { ASSERTGDI(pentTmp->einfo.pobj != (POBJ) NULL, "ERROR how can it be NULL"); return(TRUE); } else { return(FALSE); } } /******************************Public*Routine******************************\ * HmgInsertObject * * This inserts an object into the handle table, returning the handle * associated with the pointer. * * History: * 13-Oct-1993 -by- Patrick Haluptzok patrickh * Wrote it. \**************************************************************************/ HOBJ HmgInsertObject( PVOID pv, FLONG flags, // flags can be a combination of the following : // HMGR_MAKE_PUBLIC - Allow object to be lockable by // any process // HMGR_ALLOC_LOCK - Do an HmgLock on the object and // return a pointer instead of handle // HMGR_ALLOC_ALT_LOCK - Do an HmgShareLock on the object // and return a pointer instead of // handle OBJTYPE objt) { ASSERTGDI(pv != (PVOID) NULL, "Invalid address"); ASSERTGDI(objt != (OBJTYPE) DEF_TYPE, "objt is bad"); HOBJ h = 0; BOOL bHandleQuota = TRUE; W32PID W32Pid = W32GetCurrentPID(); #if defined(_WIN64) PW32THREAD pW32Thread = W32GetCurrentThread(); PRINTCLIENTID *pClientID = pW32Thread ? (PRINTCLIENTID*)pW32Thread->pClientID : 0; W32Pid = pClientID ? pClientID->clientPid : W32Pid; #endif // // need the HMGR lock held while getting the handle // { MLOCKFAST mo; if (!(flags & HMGR_MAKE_PUBLIC)) { // // Inc handle count for non-public objects. DC objects // can be allocated above process limit // bHandleQuota = HmgIncProcessHandleCount(W32Pid,objt); } if (bHandleQuota) { h = hGetFreeHandle((OBJTYPE) objt); if (h == 0) { WARNING1("HmgInsert failed hGetFreeHandle\n"); // // decrement handle count in case of failure // if (!(flags & HMGR_MAKE_PUBLIC)) { HmgDecProcessHandleCount(W32Pid); } } else { // WINBUG #345863 3-17-2001 jasonha Hold ghsemHmgr thru out insert ((ENTRYOBJ *) &(gpentHmgr[HmgIfromH(h)]))->vSetup((POBJ) pv, objt, (FSHORT) flags); ((OBJECT *) pv)->hHmgr = (HANDLE) h; } } else { WARNING1("HmgInsertObject failed due to handle quota\n"); } } return(h); } /******************************Public*Routine******************************\ * HmgRemoveObject * * Removes an object from the handle table if certain conditions are met. * * History: * 13-Oct-1993 -by- Patrick Haluptzok patrickh * Wrote it. \**************************************************************************/ PVOID HmgRemoveObject( HOBJ hobj, LONG cExclusiveLock, LONG cShareLock, BOOL bIgnoreUndeletable, OBJTYPE objt) { POBJ pobj; UINT uiIndex = (UINT) HmgIfromH(hobj); if (uiIndex < gcMaxHmgr) { // // Must acquire hmgr lock before handle lock // GreAcquireHmgrSemaphore(); // // lock handle // PENTRY pentTmp = &gpentHmgr[uiIndex]; HANDLELOCK HandleLock(pentTmp,TRUE); if (HandleLock.bValid()) { // // verify objt and unique // if ((pentTmp->Objt == objt) && (pentTmp->FullUnique == HmgUfromH(hobj))) { pobj = pentTmp->einfo.pobj; if ((pobj->cExclusiveLock == (USHORT)cExclusiveLock) && (pobj->ulShareCount == (ULONG)cShareLock)) { if (bIgnoreUndeletable || (!(pentTmp->Flags & HMGR_ENTRY_UNDELETABLE))) { // // The undeletable flag is not set or else we are ignoring it. // #if GDI_PERF HmgCurrentNumberOfHandles[objt]--; #endif // // set the handle in the object to NULL // to prevent/catch accidental decrement of the // shared reference count // pobj->hHmgr = NULL; // // free the handle // ((ENTRYOBJ *) pentTmp)->vFree(uiIndex); } else { WARNING1("HmgRemove failed object is undeletable\n"); pobj = NULL; } } else { // // object is busy // // WARNING1("HmgRemove failed - object busy elsewhere\n"); pobj = NULL; } } else { WARNING1("HmgRemove: bad objt or unique\n"); pobj = NULL; } HandleLock.vUnlock(); } else { WARNING1("HmgRemove: failed to lock handle\n"); pobj = NULL; } // // free hmgr lock // GreReleaseHmgrSemaphore(); } else { WARNING1("HmgRemove failed invalid index\n"); pobj = NULL; } return((PVOID)pobj); } /******************************Public*Routine******************************\ * HmgReplace * * Change the object pointer. Note this is callable only under very precise * circumstances: * * 1> When the object is exclusively locked. * * History: * Tue 14-Dec-1993 -by- Patrick Haluptzok [patrickh] * Seperate out lock counts from object structure. * * 18-Oct-1993 -by- Eric Kutter [erick] * Wrote it. \**************************************************************************/ POBJ HmgReplace( HOBJ hobj, POBJ pobjNew, FLONG flags, LONG cLock, OBJTYPE objt) { // // We assume everything is valid, that the handle being replaced is exclusively // locked and valid. // // Note that currently "exclusively locked" can mean that we call this under // OBJLOCK control which doesn't set the cExclusiveLock // POBJ pobj = NULL; UINT uiIndex = (UINT) HmgIfromH(hobj); ASSERTGDI(uiIndex != 0, "HmgReplace invalid handle 0"); ASSERTGDI(uiIndex < gcMaxHmgr, "HmgReplace invalid handle"); PENTRY pentTmp = &gpentHmgr[uiIndex]; ASSERTGDI(pentTmp->Objt == objt, "HmgReplace invalid object type"); ASSERTGDI(pentTmp->FullUnique == HmgUfromH(hobj), "HmgReplace invalid uniqueness"); ASSERTGDI((OBJECTOWNER_PID(pentTmp->ObjectOwner) == OBJECT_OWNER_PUBLIC) || (OBJECTOWNER_PID(pentTmp->ObjectOwner) == W32GetCurrentPID()), "HmgReplace invalid PID owner"); HANDLELOCK HandleLock(pentTmp,TRUE); if (HandleLock.bValid()) { // // Return the old value. We have to be under the mutex here since the // counts live in the objects and if we do the switch while someone is // looking at the old object and the old object gets deleted after this // call before the original thread gets to run again he may fault or // wrongly succeed to lock it down. // pobj = pentTmp->einfo.pobj; pentTmp->einfo.pobj = pobjNew; HandleLock.vUnlock(); } return((POBJ) pobj); } /******************************Public*Routine******************************\ * AllocateObject * * Allocates an object through a look a side buffer if possible else just * allocates out of the heap. * * History: * 14-Apr-1997 -by- Dan Almosnino danalm * Modify to use DaveC's S-Lists mechanism for Lookaside Lists * 12-Oct-1993 -by- Patrick Haluptzok patrickh * Based on DaveC's HmgAlloc look-aside code \**************************************************************************/ // // This struct and the following union can be thrown away // when someone fixes the BASEOBJECT cExclusiveLock and BaseFlags sharing // the same DWORD. // struct SplitLockAndFlags { USHORT c_cExclusiveLock; USHORT c_BaseFlags; }; union SplitOrCombinedLockAndFlags { SplitLockAndFlags S; ULONG W; }; PVOID AllocateObject( ULONG cBytes, ULONG ulType, BOOL bZero) { PVOID pvReturn = NULL; ASSERTGDI(ulType != DEF_TYPE, "AllocateObject ulType is bad"); ASSERTGDI(cBytes >= sizeof(BASEOBJECT), "AllocateObject cBytes is bad"); // // Debug check to avoid assert in ExAllocatePool // #if DBG if (cBytes >= (PAGE_SIZE * 10000)) { WARNING("AllocateObject: cBytes >= 10000 pages"); return(NULL); } #endif // // If the object type has a lookaside list and the list contains a // free entry and the requested size is less than or equal to the // lookaside list size, then attempt to allocate memory from the // lookaside list. // #if !defined(_GDIPLUS_) if (laSize[ulType] >= (ULONG)cBytes) { if((pvReturn = ExAllocateFromPagedLookasideList(pHmgLookAsideList[ulType])) != NULL) { if (bZero) { RtlZeroMemory(pvReturn, (UINT) cBytes); } else { // // At least the BASEOBJECT should be initialized. // RtlZeroMemory(pvReturn, (UINT) sizeof(BASEOBJECT)); } // // This code is really hideous. // This is one of a very few places where it is necessary to know // that the BaseFlags entry in BASEOBJECT is actually the upper // 16 bits of the DWORD containing the cExclusiveLock. // If the layout of BASEOBJECT ever changes separating the cExclusiveLock // and the BaseFlags then this code _WILL_ break. // // The InterlockedExchange is required because it inserts appropriate // memory barriers on Alpha preventing other processors from seeing // the write delayed. // // Using the InterlockedExchange here is probably not necessary // Before anyone else can access this data it has to be put in the // Handle table and the code that does that should have the appropriate // mb instruction. However, just to be safe... // SplitOrCombinedLockAndFlags M; M.S.c_cExclusiveLock = ((BASEOBJECT *)pvReturn)->cExclusiveLock; M.S.c_BaseFlags = ((BASEOBJECT *)pvReturn)->BaseFlags | HMGR_LOOKASIDE_ALLOC_FLAG; InterlockedExchange( (LONG *)& (((BASEOBJECT *)pvReturn)->cExclusiveLock), M.W ); // // This is the code without the InterlockedExchange. // If BaseFlags is removed from the DWORD containing the cExclusiveLock, the code // can be restored to this (provided all code that puts the object // in the handle table uses the HANDLELOCK): // //((BASEOBJECT *)pvReturn)->BaseFlags |= HMGR_LOOKASIDE_ALLOC_FLAG; //Set Base Object Lookaside Flag // #if GDI_PERF HmgNumberOfLookAsideHits[ulType] += 1; HmgCurrentNumberOfLookAsideObjects[ulType] += 1; if (HmgCurrentNumberOfLookAsideObjects[ulType] > HmgMaximumNumberOfLookAsideObjects[ulType]) { HmgMaximumNumberOfLookAsideObjects[ulType] = HmgCurrentNumberOfLookAsideObjects[ulType]; } #endif } } #endif if (pvReturn == NULL) { // // The attempted allocation from Look-Aside failed // (or the object is too big for the lookaside). // Attempt to allocate the object from the heap. // ULONG ulTag = '00hG'; ulTag += ulType << 24; // Inject the Session Id into the tag // Sessions with Id's from 0 to 78 will use an ascii character // from '0' to '~', respectively. Sessions with higher Id's will // all have a ' '. ULONG ulSessionId = PsGetCurrentProcessSessionId(); if (ulSessionId > '~' - '0') { ulSessionId = ' ' - '0'; } ulTag += ulSessionId << 16; // // Note: not necessary to clear the HMGR_LOOKASIDE_ALLOC_FLAG // in BaseFlags since the BASEOBJECT is always zero-initialized. // if (bZero) { pvReturn = PALLOCMEM(cBytes, ulTag); } else { pvReturn = PALLOCNOZ(cBytes, ulTag); // // At least the BASEOBJECT should be initialized. // if (pvReturn) { RtlZeroMemory(pvReturn, (UINT) sizeof(BASEOBJECT)); } } // // If the allocation failed again, then set the extended // error status and return an invalid handle. // if (!pvReturn) { KdPrint(("GDISRV:AllocateObject failed alloc of %lu bytes\n", (cBytes))); SAVE_ERROR_CODE(ERROR_NOT_ENOUGH_MEMORY); return NULL; } } #if GDI_PERF // // Increment the object performance counters. // HmgCurrentNumberOfObjects[ulType] += 1; HmgNumberOfObjectsAllocated[ulType] += 1; if (HmgCurrentNumberOfObjects[ulType] > HmgMaximumNumberOfObjects[ulType]) { HmgMaximumNumberOfObjects[ulType] = HmgCurrentNumberOfObjects[ulType]; } #endif return(pvReturn); } /******************************Public*Routine******************************\ * HmgAlloc * * Allocate an object from Handle Manager. * * WARNING: * -------- * * If the object is share-lockable via an API, you MUST use HmgInsertObject * instead. If the object is only exclusive-lockable via an API, you MUST * either use HmgInsertObject or specify HMGR_ALLOC_LOCK. * * (This is because if you use HmgAlloc, a malicious multi-threaded * application could guess the handle and cause it to be dereferenced * before you've finished initializing it, possibly causing an access * violation.) * * History: * 23-Sep-1991 -by- Patrick Haluptzok patrickh * Rewrite to be flat, no memory management under semaphore. * * 08-Dec-1989 -by- Donald Sidoroff [donalds] * Wrote it. \**************************************************************************/ HOBJ HmgAlloc( ULONGSIZE_T cb, OBJTYPE objt, FSHORT fs) // fs can be a combination of the following: // HMGR_NO_ZERO_INIT - Don't zero initialize // HMGR_MAKE_PUBLIC - Allow object to be lockable by // any process // HMGR_ALLOC_LOCK - Do an HmgLock on the object and // return a pointer instead of handle // HMGR_ALLOC_ALT_LOCK - Do an HmgShareLock on the object // and return a pointer instead of // handle { HOBJ Handle; PVOID pv; ASSERTGDI(objt != (OBJTYPE) DEF_TYPE, "HmgAlloc objt is bad"); ASSERTGDI(cb >= 8, "ERROR hmgr writes in first 8 bytes"); // // Allocate a pointer. // pv = AllocateObject(cb, (ULONG) objt, ((fs & HMGR_NO_ZERO_INIT) == 0)); if (pv != (PVOID) NULL) { BOOL bHandleQuota = TRUE; W32PID W32Pid = W32GetCurrentPID(); #if defined(_WIN64) PW32THREAD pW32Thread = W32GetCurrentThread(); PRINTCLIENTID *pClientID = pW32Thread ? (PRINTCLIENTID*)pW32Thread->pClientID : 0; W32Pid = pClientID ? pClientID->clientPid : W32Pid; #endif // // Allocate a handle. We need the mutex to access the free list // GreAcquireHmgrSemaphore(); if (!(fs & HMGR_MAKE_PUBLIC)) { // // increment handle quota on non public objects. DC objects // can be allocated over a process quota limit. // bHandleQuota = HmgIncProcessHandleCount(W32Pid, objt); } if (bHandleQuota) { Handle = hGetFreeHandle(objt); if (Handle != (HOBJ) 0) { // // Store a pointer to the object in the entry corresponding to the // allocated handle and initialize the handle data. // ((ENTRYOBJ *) &(gpentHmgr[HmgIfromH(Handle)]))->vSetup((POBJ) pv, objt, fs); // // Store the object handle at the beginning of the object memory. // ((OBJECT *)pv)->hHmgr = (HANDLE)Handle; GreReleaseHmgrSemaphore(); return ((fs & (HMGR_ALLOC_ALT_LOCK | HMGR_ALLOC_LOCK)) ? (HOBJ)pv : Handle); } else { // // decrement process handle count if not public // (while lock is still held) // if (!(fs & HMGR_MAKE_PUBLIC)) { HmgDecProcessHandleCount(W32Pid); } // // We just failed a handle allocation. Release the memory. // GreReleaseHmgrSemaphore(); FreeObject(pv,(ULONG) objt); } } else { WARNING("Failed HmgAlloc due to handle quota\n"); GreReleaseHmgrSemaphore(); FreeObject(pv,(ULONG) objt); } } return((HOBJ) 0); } /******************************Public*Routine******************************\ * FreeObject * * Frees the object from where it was allocated. * * History: * * 14-Apr-1997 -by- Dan Almosnino danalm * Modified to use DaveC's S-List mechanism for Lookaside lists * * 12-Oct-1993 -by- Patrick Haluptzok patrickh * Wrote it. \**************************************************************************/ VOID FreeObject(PVOID pvFree, ULONG ulType) { #if GDI_PERF HmgCurrentNumberOfObjects[ulType] -= 1; #endif // Find if the object originates from a lookaside allocation, // if so, return it to the free list. if( ((BASEOBJECT *)pvFree)->BaseFlags & HMGR_LOOKASIDE_ALLOC_FLAG ) { #if !defined(_GDIPLUS_) ExFreeToPagedLookasideList(pHmgLookAsideList[ulType],pvFree); #endif #if GDI_PERF HmgCurrentNumberOfLookAsideObjects[ulType] -= 1; #endif } else { // If the object memory was allocated from the general heap, then // release the memory to the heap. VFREEMEM(pvFree); } } /******************************Public*Routine******************************\ * HmgFree * * Free an object from the handle manager. * * History: * 23-Sep-1991 -by- Patrick Haluptzok patrickh * Rewrite to be flat, no memory management under semaphore. * * 08-Dec-1989 -by- Donald Sidoroff [donalds] * Wrote it. \**************************************************************************/ VOID HmgFree(HOBJ hobj) { UINT uiIndex = (UINT) HmgIfromH(hobj); POBJ pobjTmp; OBJTYPE objtTmp; ASSERTGDI(uiIndex != 0, "ERROR HmgFree invalid 0 handle"); if (uiIndex < gcMaxHmgr) { PENTRY pentTmp = &gpentHmgr[uiIndex]; // // Acquire the handle manager lock and decrement the count of objects of // the specfied type. // GreAcquireHmgrSemaphore(); // // lock handle // HANDLELOCK HandleLock(pentTmp,FALSE); if (HandleLock.bValid()) { #if GDI_PERF HmgCurrentNumberOfHandles[pentTmp->Objt]--; #endif pobjTmp = pentTmp->einfo.pobj; objtTmp = pentTmp->Objt; // // Free the object handle // ((ENTRYOBJ *) pentTmp)->vFree(uiIndex); HandleLock.vUnlock(); } GreReleaseHmgrSemaphore(); if (pobjTmp) { FreeObject((PVOID)pobjTmp, (ULONG) objtTmp); } } else { WARNING1("HmgFree: bad handle index"); } } /******************************Public*Routine******************************\ * HmgSetOwner - set new object owner * * Arguments: * hobj - handle of object * objt - type of object * usCurrent - OBJECT_OWNER flag for current owner * pw32Current - PW32PROCESS of current owner if not current w32process * usNew - OBJECT_OWNER flag for new owner * pw32New - PW32PROCESS of new owner if not current w32process * * Return Value: * * Status * * History: * * 15-May-1996 -by- Mark Enstrom [marke] * \**************************************************************************/ BOOL HmgSetOwner( HOBJ hobj, W32PID W32PidNew, OBJTYPE objt ) { PENTRY pentTmp; UINT uiIndex = (UINT) HmgIfromH(hobj); BOOL bStatus = FALSE; W32PID W32PidCurrent; #if defined(_WIN64) KERNEL_PVOID pclientID; PW32THREAD pW32thread; BOOL bWOW64 = FALSE; #endif if (W32PidNew == OBJECT_OWNER_CURRENT) { W32PidNew = W32GetCurrentPID(); } if (uiIndex < gcMaxHmgr) { pentTmp = &gpentHmgr[uiIndex]; HANDLELOCK HandleLock(pentTmp,FALSE); if (HandleLock.bValid()) { // // verify objt and unique // if ((pentTmp->Objt == objt) && (pentTmp->FullUnique == HmgUfromH(hobj))) { POBJ pobj = pentTmp->einfo.pobj; #if defined(_WIN64) pW32thread = W32GetCurrentThread(); // // Set the handle owner pid to the wow64 print client pid if // the the PRINTCLIENTID pointer in W32TREAD is non zero. // In this case, we are doing WOW64 printing via LPC. // pclientID = pW32thread ? pW32thread->pClientID : 0; if(pclientID) bWOW64 = TRUE; #endif if ((pobj->cExclusiveLock == 0) || (pobj->Tid == (PW32THREAD)PsGetCurrentThread()) #if defined(_WIN64) || (bWOW64) #endif ) { bStatus = TRUE; // // determine current W32PID // W32PidCurrent = HandleLock.Pid(); #if defined(_WIN64) if (bWOW64) { W32PidNew = ((PRINTCLIENTID*)pclientID)->clientPid; } #endif if (W32PidCurrent != W32PidNew) { bStatus = HmgIncProcessHandleCount(W32PidNew,objt); if (bStatus) { HmgDecProcessHandleCount(W32PidCurrent); // // set new owner // HandleLock.Pid(W32PidNew); } else { WARNING1("HmgSetOwner: Failed to set owner due to handle quota\n"); } } } else { WARNING1("HmgSetOwner, Object is exclusively locked\n"); } } else { WARNING1("HmgSetOwner, object type or unique mismach\n"); } HandleLock.vUnlock(); } } else { WARNING1("HmgSetOwner: bad index\n"); } return(bStatus); } /*****************************Exported*Routine*****************************\ * GreGetObjectOwner * * Get the owner of an object * * Arguments: * * hobj - handle to object * objt - handle type for verification * * History: * * 27-Apr-1994 -by- Johnc * Dupped from SetOwner. \**************************************************************************/ W32PID GreGetObjectOwner( HOBJ hobj, DWORD objt) { W32PID pid = OBJECT_OWNER_ERROR; UINT uiIndex = (UINT) HmgIfromH(hobj); if (uiIndex < gcMaxHmgr) { PENTRY pentTmp = &gpentHmgr[uiIndex]; if ((pentTmp->Objt == objt) && (pentTmp->FullUnique == HmgUfromH(hobj))) { pid = OBJECTOWNER_PID(pentTmp->ObjectOwner); } else { WARNING1("GreGetObjectOwner failed - object type of unique mismatch\n"); } } else { WARNING1("GreGetObjectOwner failed - invalid handle index\n"); } return(pid); } /******************************Public*Routine******************************\ * * HmgSwapHandleContents locks both handles and verifies lock counts. * The handle contents for each element are then swapped. * * Arguments: * * hobj1 - handle to object 1 * cShare1 - share count object 1 must have after handle is locked * hobj2 - handle to object 2 * cShare1 - share count object 2 must have after handle is locked * objt - type that both handles must be * * Return Value: * * BOOL status * * History: * * 24-Jul-1995 -by- Mark Enstrom [marke] * \**************************************************************************/ BOOL HmgSwapHandleContents( HOBJ hobj1, ULONG cShare1, HOBJ hobj2, ULONG cShare2, OBJTYPE objt) { // // acquire hmgr resource for this operation to // make sure we don't deadlock with two threads // trying to swap the same handles in reverse // order // MLOCKFAST mo; return( HmgSwapLockedHandleContents( hobj1, cShare1, hobj2, cShare2, objt) ); } /******************************Public*Routine******************************\ * * HmgSwapLockedHandleContents locks both handles and verifies lock counts. * The handle contents for each element are then swapped. HmgrResource must * be owned to prevent deadlock. * * Arguments: * * hobj1 - handle to object 1 * cShare1 - share count object 1 must have after handle is locked * hobj2 - handle to object 2 * cShare1 - share count object 2 must have after handle is locked * objt - type that both handles must be * * Return Value: * * BOOL status * * History: * * 24-Jul-1995 -by- Mark Enstrom [marke] * \**************************************************************************/ BOOL HmgSwapLockedHandleContents( HOBJ hobj1, ULONG cShare1, HOBJ hobj2, ULONG cShare2, OBJTYPE objt) { UINT uiIndex1 = (UINT) HmgIfromH(hobj1); UINT uiIndex2 = (UINT) HmgIfromH(hobj2); BOOL bResult = FALSE; ASSERTGDI(objt != (OBJTYPE) DEF_TYPE, "Bad type"); // // Acquire handle lock on both objects // PENTRY pentry1 = &gpentHmgr[uiIndex1]; PENTRY pentry2 = &gpentHmgr[uiIndex2]; HANDLELOCK HandleLock1(pentry1,FALSE); if (HandleLock1.bValid()) { HANDLELOCK HandleLock2(pentry2,FALSE); if (HandleLock2.bValid()) { // // Verify share lock counts and object types // if ((HandleLock1.ShareCount() == (USHORT)cShare1) && (pentry1->Objt == objt)) { if ((HandleLock2.ShareCount() == (USHORT)cShare2) && (pentry2->Objt == objt)) { POBJ pobjTemp; PVOID pvTmp; // // swap pobj in handle table // pobjTemp = pentry1->einfo.pobj; pentry1->einfo.pobj = pentry2->einfo.pobj; pentry2->einfo.pobj = pobjTemp; // // swap puser in handle table // pvTmp = pentry1->pUser; pentry1->pUser = pentry2->pUser; pentry2->pUser = pvTmp; // // swap BASEOBJECTS // BASEOBJECT obj; obj = *pentry1->einfo.pobj; *pentry1->einfo.pobj = *pentry2->einfo.pobj; *pentry2->einfo.pobj = obj; // // unswap the BASEOBJECT.BaseFlags // // The BaseFlags field contains information about how // the object was allocated (and therefore, how it must // be deallocated). Thus, it represents state associated // with the actual memory, not the object, and should not // be swapped. // // See comments regarding BASEOBJECT in inc\hmgshare.h // for more details. Also, there is swapping code in // RGNOBJ::bSwap (rgnobj.cxx). // USHORT usTemp; usTemp = pentry1->einfo.pobj->BaseFlags; pentry1->einfo.pobj->BaseFlags = pentry2->einfo.pobj->BaseFlags; pentry2->einfo.pobj->BaseFlags = usTemp; bResult = TRUE; } else { WARNING1("HmgSwapHandleContents: wrong share count or objt for hobj2"); } } else { WARNING1("HmgSwapHandleContents: wrong share count or objt for hobj1"); } HandleLock2.vUnlock(); } HandleLock1.vUnlock(); } return(bResult); } /*****************************Exported*Routine*****************************\ * HOBJ HmgNextOwned(hmgr, hobj, pid) * * Report the next object owned by specified process * * History: * 08-Dec-1989 -by- Donald Sidoroff [donalds] * Wrote it. \**************************************************************************/ HOBJ FASTCALL HmgNextOwned( HOBJ hobj, W32PID pid) { MLOCKFAST mo; return(HmgSafeNextOwned(hobj, pid)); } /*****************************Exported*Routine*****************************\ * HOBJ HmgSafeNextOwned * * Report the next object owned by specified process * * History: * Sat 11-Dec-1993 -by- Patrick Haluptzok [patrickh] * Remove function wrapper. * * 08-Dec-1989 -by- Donald Sidoroff [donalds] * Wrote it. \**************************************************************************/ HOBJ FASTCALL HmgSafeNextOwned( HOBJ hobj, W32PID pid) { PENTRYOBJ pentTmp; UINT uiIndex = (UINT) HmgIfromH(hobj); // // If we are passed 0 we inc to 1 because 0 can never be valid. // If we are passed != 0 we inc 1 to find the next one valid. // uiIndex++; while (uiIndex < gcMaxHmgr) { pentTmp = (PENTRYOBJ) &gpentHmgr[uiIndex]; if (pentTmp->bOwnedBy(pid)) { return((HOBJ) MAKE_HMGR_HANDLE(uiIndex, pentTmp->FullUnique)); } // // Advance to next object // uiIndex++; } // // No objects found // return((HOBJ) 0); } /*****************************Exported*Routine*****************************\ * HOBJ HmgSafeNextObjt * * Report the next object of a certain type. * * History: * Tue 19-Apr-1994 -by- Patrick Haluptzok [patrickh] * Wrote it. \**************************************************************************/ POBJ FASTCALL HmgSafeNextObjt( HOBJ hobj, OBJTYPE objt) { PENTRYOBJ pentTmp; UINT uiIndex = (UINT) HmgIfromH(hobj); // // If we are passed 0 we inc to 1 because 0 can never be valid. // If we are passed != 0 we inc 1 to find the next one valid. // uiIndex++; while (uiIndex < gcMaxHmgr) { pentTmp = (PENTRYOBJ) &gpentHmgr[uiIndex]; if (pentTmp->Objt == objt) { return(pentTmp->einfo.pobj); } // // Advance to next object // uiIndex++; } // // no objects found // return((POBJ) 0); } /*******************************Routine************************************\ * HmgLockAllOwners * * Description: * * Acquire an exclusive lock on an object. Note that this routine is * different than HmgLock in that the PID owner doesn't need to match the * current PID. This is useful in GreRestoreDC where we need to get a lock * on the saved DC in order to to copy its information to the primary DC, but * don't want to fail if the process has already reached its handle quota * because this saved DC is about to be deleted anyway. See bug #223129 * for details. * * WARNING: Do not call this routine outside of the above scenario unless * there's a very good reason! * * Arguments: * * hobj - Handle to lock * objt - Check to make sure handle is of expected type * * Return Value: * * Pointer to object or NULL * \**************************************************************************/ POBJ FASTCALL HmgLockAllOwners( HOBJ hobj, OBJTYPE objt ) { POBJ pobj = (POBJ)NULL; UINT uiIndex = (UINT)HmgIfromH(hobj); if (uiIndex < gcMaxHmgr) { PENTRY pentry = &gpentHmgr[uiIndex]; // // Passing FALSE as the second argument to the HANDLELOCK constructor // allows us to obtain a lock regardless of the PID owner of the object. // HANDLELOCK HandleLock(pentry,FALSE); if (HandleLock.bValid()) { if ((pentry->Objt != objt) || (pentry->FullUnique != HmgUfromH(hobj))) { HmgPrintBadHandle(hobj, objt); } else { pobj = pentry->einfo.pobj; if ((pobj->cExclusiveLock == 0) || (pobj->Tid == (PW32THREAD)PsGetCurrentThread())) { pobj->cExclusiveLock++; pobj->Tid = (PW32THREAD)PsGetCurrentThread(); } else { WARNING1("HmgLock: object already locked by another thread"); pobj = (POBJ)NULL; } } HandleLock.vUnlock(); } else { HmgPrintBadHandle(hobj, objt); } } else { HmgPrintBadHandle(hobj, objt); } return(pobj); } #if !defined(_X86_) || defined(_GDIPLUS_) /*******************************Routine************************************\ * HmgLock * * Description: * * Acquire an exclusive lock on an object, PID owner must match current PID * or be a public. * * Arguments: * * hobj - Handle to lock * objt - Check to make sure handle is of expected type * * Return Value: * * Pointer to object or NULL * \**************************************************************************/ POBJ FASTCALL HmgLock( HOBJ hobj, OBJTYPE objt ) { POBJ pobj = (POBJ)NULL; UINT uiIndex = (UINT)HmgIfromH(hobj); if (uiIndex < gcMaxHmgr) { PENTRY pentry = &gpentHmgr[uiIndex]; HANDLELOCK HandleLock(pentry,TRUE); if (HandleLock.bValid()) { if ((pentry->Objt != objt) || (pentry->FullUnique != HmgUfromH(hobj))) { HmgPrintBadHandle(hobj, objt); } else { pobj = pentry->einfo.pobj; if ((pobj->cExclusiveLock == 0) || (pobj->Tid == (PW32THREAD)PsGetCurrentThread())) { pobj->cExclusiveLock++; pobj->Tid = (PW32THREAD)PsGetCurrentThread(); } else { WARNING1("HmgLock: object already locked by another thread"); pobj = (POBJ)NULL; } } HandleLock.vUnlock(); } else { HmgPrintBadHandle(hobj, objt); } } else { HmgPrintBadHandle(hobj, objt); } return(pobj); } /*******************************Routine************************************\ * HmgShareCheckLock * * Description: * * Acquire a share lock on an object, PID owner must match current PID * or be a public. * * Arguments: * * hobj - Handle to lock * objt - Check to make sure handle is of expected type * * Return Value: * * Pointer to object or NULL * \**************************************************************************/ POBJ FASTCALL HmgShareCheckLock( HOBJ hobj, OBJTYPE objt ) { POBJ pobj = (POBJ)NULL; UINT uiIndex = (UINT) HmgIfromH(hobj); if (uiIndex < gcMaxHmgr) { PENTRY pentry = &gpentHmgr[uiIndex]; HANDLELOCK HandleLock(pentry,TRUE); if (HandleLock.bValid()) { if ((pentry->Objt == objt) && (pentry->FullUnique == HmgUfromH(hobj))) { pobj = pentry->einfo.pobj; pobj->ulShareCount++; } else { HmgPrintBadHandle(hobj, objt); } HandleLock.vUnlock(); } else { HmgPrintBadHandle(hobj, objt); } } else { HmgPrintBadHandle(hobj, objt); } return(pobj); } /*******************************Routine************************************\ * HmgShareLock * * Description: * * Acquire a share lock on an object, don't check PID owner * * Arguments: * * hobj - Handle to lock * objt - Check to make sure handle is of expected type * * Return Value: * * Pointer to object or NULL * \**************************************************************************/ POBJ FASTCALL HmgShareLock( HOBJ hobj, OBJTYPE objt ) { POBJ pobj = (POBJ)NULL; UINT uiIndex = (UINT) HmgIfromH(hobj); if (uiIndex < gcMaxHmgr) { PENTRY pentry = &gpentHmgr[uiIndex]; HANDLELOCK HandleLock(pentry,FALSE); if (HandleLock.bValid()) { if ((pentry->Objt == objt) && (pentry->FullUnique == HmgUfromH(hobj))) { pobj = pentry->einfo.pobj; pobj->ulShareCount++; } else { HmgPrintBadHandle(hobj, objt); } HandleLock.vUnlock(); } else { HmgPrintBadHandle(hobj, objt); } } else { HmgPrintBadHandle(hobj, objt); } return(pobj); } #endif /*******************************Routine************************************\ * HmgShareCheckLockIgnoreStockBit * * Description: * * Acquire a share lock on an object, PID owner must match current PID * or be a public. We ignore the stock bit. * * Arguments: * * hobj - Handle to lock * objt - Check to make sure handle is of expected type * * Return Value: * * Pointer to object or NULL * \**************************************************************************/ POBJ FASTCALL HmgShareCheckLockIgnoreStockBit( HOBJ hobj, OBJTYPE objt ) { POBJ pobj = (POBJ)NULL; UINT uiIndex = (UINT) HmgIfromH(hobj); if (uiIndex < gcMaxHmgr) { PENTRY pentry = &gpentHmgr[uiIndex]; HANDLELOCK HandleLock(pentry,TRUE); if (HandleLock.bValid()) { if ((pentry->Objt == objt) && ((pentry->FullUnique & ~FULLUNIQUE_STOCK_MASK) == (HmgUfromH(hobj) & ~FULLUNIQUE_STOCK_MASK))) { pobj = pentry->einfo.pobj; pobj->ulShareCount++; } else { HmgPrintBadHandle(hobj, objt); } HandleLock.vUnlock(); } else { HmgPrintBadHandle(hobj, objt); } } else { HmgPrintBadHandle(hobj, objt); } return(pobj); } /*******************************Routine************************************\ * HmgShareLockIgnoreStockBit * * Description: * * Acquire a share lock on an object, don't check PID owner. Ignore stock * bit. * * Arguments: * * hobj - Handle to lock * objt - Check to make sure handle is of expected type * * Return Value: * * Pointer to object or NULL * \**************************************************************************/ POBJ FASTCALL HmgShareLockIgnoreStockBit( HOBJ hobj, OBJTYPE objt ) { POBJ pobj = (POBJ)NULL; UINT uiIndex = (UINT) HmgIfromH(hobj); if (uiIndex < gcMaxHmgr) { PENTRY pentry = &gpentHmgr[uiIndex]; HANDLELOCK HandleLock(pentry,FALSE); if (HandleLock.bValid()) { if ((pentry->Objt == objt) && ((pentry->FullUnique & ~FULLUNIQUE_STOCK_MASK) == (HmgUfromH(hobj) & ~FULLUNIQUE_STOCK_MASK))) { pobj = pentry->einfo.pobj; pobj->ulShareCount++; } else { HmgPrintBadHandle(hobj, objt); } HandleLock.vUnlock(); } else { HmgPrintBadHandle(hobj, objt); } } else { HmgPrintBadHandle(hobj, objt); } return(pobj); } /******************************Public*Routine******************************\ * HmgShareUnlock * * Make this a macro once it is debugged * * Arguments: * * pobj - pointer to share-locked object * * Return Value: * * None * \**************************************************************************/ VOID HmgShareUnlock( POBJ pobj ) { PENTRY pentry; // // decrement shared reference count to object, Handle checks // are not done. // UINT uiIndex = (UINT) HmgIfromH(pobj->hHmgr); pentry = &gpentHmgr[uiIndex]; HANDLELOCK HandleLock(pentry,FALSE); if (HandleLock.bValid()) { // // decrement use count // pobj->ulShareCount--; HandleLock.vUnlock(); } } /*******************************Routine************************************\ * HmgReferenceCheckLock * * Description: * * The routine validates the hanlde passed in and returns a pointer to * the object. This routine must only be called when the HmgrReource is * held and the pointer to the object is only valid while the Resource * is held. No unlock is neccessary since the object is not reference- * counted. * * Arguments: * * hobj - Handle to lock * objt - Check to make sure handle is of expected type * * Return Value: * * Pointer to object or NULL * \**************************************************************************/ POBJ FASTCALL HmgReferenceCheckLock( HOBJ hobj, OBJTYPE objt, BOOL bDebugPrint ) { PENTRY pentry; POBJ pobj = (POBJ)NULL; UINT uiIndex = (UINT) HmgIfromH(hobj); if (uiIndex < gcMaxHmgr) { pentry = &gpentHmgr[uiIndex]; if ((pentry->Objt == objt) && (pentry->FullUnique == HmgUfromH(hobj))) { pobj = pentry->einfo.pobj; } else { if (bDebugPrint) { HmgPrintBadHandle(hobj, objt); } } } else { if (bDebugPrint) { HmgPrintBadHandle(hobj, objt); } } return(pobj); } #if !defined(_X86_) || defined(_GDIPLUS_) /******************************Public*Routine******************************\ * HmgIncrementShareReferenceCount * * interlocked increment shared reference count * * Arguments: * * pObj - pointer to valid object * * Return Value: * * none * * History: * * 6-Jun-1995 -by- Mark Enstrom [marke] * \**************************************************************************/ VOID FASTCALL HmgIncrementShareReferenceCount( POBJ pObj ) { HANDLELOCK HandleLock(PENTRY_FROM_POBJ(pObj), FALSE); if (HandleLock.bValid()) { pObj->ulShareCount++; HandleLock.vUnlock(); } else { HmgPrintBadHandle((HOBJ)pObj->hHmgr, PENTRY_FROM_POBJ(pObj)->Objt); } } /******************************Public*Routine******************************\ * HmgDecrementShareReferenceCount * * interlocked increment shared reference count * * Arguments: * * pObj - pointer to valid object * * Return Value: * * previous lock count * * History: * * 6-Jun-1995 -by- Mark Enstrom [marke] * \**************************************************************************/ ULONG FASTCALL HmgDecrementShareReferenceCount( POBJ pObj ) { ULONG ulOrigShareCount=0; HANDLELOCK HandleLock(PENTRY_FROM_POBJ(pObj), FALSE); if (HandleLock.bValid()) { ulOrigShareCount = pObj->ulShareCount; pObj->ulShareCount--; HandleLock.vUnlock(); } else { HmgPrintBadHandle((HOBJ)pObj->hHmgr, PENTRY_FROM_POBJ(pObj)->Objt); } return ulOrigShareCount; } #endif /******************************Public*Routine******************************\ * HmgMarkDeletable * * Mark an object as deletable. * * History: * 11-Jun-1993 -by- Patrick Haluptzok patrickh * Wrote it. \**************************************************************************/ BOOL FASTCALL HmgMarkDeletable( HOBJ hobj, OBJTYPE objt) { PENTRY pentry; UINT uiIndex = (UINT) HmgIfromH(hobj); BOOL bStatus = FALSE; if (uiIndex < gcMaxHmgr) { pentry = &gpentHmgr[uiIndex]; HANDLELOCK HandleLock(pentry,FALSE); if (HandleLock.bValid()) { if ((pentry->Objt == objt) && (pentry->FullUnique == HmgUfromH(hobj))) { pentry->Flags &= ~HMGR_ENTRY_UNDELETABLE; bStatus = TRUE; } else { WARNING1("HmgMarkDeletable: bad objt or unique"); } HandleLock.vUnlock(); } else { WARNING1("HmgMarkDeletable failed: not object owner\n"); } } else { WARNING1("HmgMarkDeletable failed: index out of range\n"); } return(bStatus); } /******************************Public*Routine******************************\ * HmgMarkUndeletable * * Mark an object as undeletable. * * History: * 11-Jun-1993 -by- Patrick Haluptzok patrickh * Wrote it. \**************************************************************************/ BOOL FASTCALL HmgMarkUndeletable(HOBJ hobj, OBJTYPE objt) { PENTRY pentry; UINT uiIndex = (UINT) HmgIfromH(hobj); BOOL bStatus = FALSE; if (uiIndex < gcMaxHmgr) { pentry = &gpentHmgr[uiIndex]; HANDLELOCK HandleLock(pentry,TRUE); if (HandleLock.bValid()) { if ((pentry->Objt == objt) && (pentry->FullUnique == HmgUfromH(hobj))) { pentry->Flags |= HMGR_ENTRY_UNDELETABLE; bStatus = TRUE; } else { WARNING1("HmgMarkUndeletable: bad objt or unique"); } HandleLock.vUnlock(); } else { WARNING1("HmgMarkUndeletable failed: not object owner\n"); } } else { WARNING1("HmgMarkUndeletable failed: index out of range\n"); } return(bStatus); } /******************************Public*Routine******************************\ * BOOL HmgSetLock * * Set the lock count of the object. * This is currently used by process cleanup code to reset object lock count. * * History: * Wed May 25 15:24:33 1994 -by- Hock San Lee [hockl] * Wrote it. \**************************************************************************/ BOOL FASTCALL HmgSetLock(HOBJ hobj, ULONG cLock) { PENTRY pentTmp; UINT uiIndex = (UINT) HmgIfromH(hobj); if (uiIndex < gcMaxHmgr) { pentTmp = &gpentHmgr[uiIndex]; if (pentTmp->FullUnique == HmgUfromH(hobj)) { POBJ pobj = pentTmp->einfo.pobj; // // This code is really hideous. // This is one of a very few places where it is necessary to know // that the BaseFlags entry in BASEOBJECT is actually the upper // 16 bits of the DWORD containing the cExclusiveLock. // If the layout of BASEOBJECT ever changes separating the cExclusiveLock // and the BaseFlags then this code _WILL_ break. // // Also this code only works because nobody actually sets BaseFlags after // object allocation. If this fact ever changes then this code needs to // be changed to an InterlockedCompareExchange loop and should probably be // protected by the HandleLock. Also the BaseFlags modification code // would then also require an InterlockedCompareExchange too. // // The only reason we actually entertain this mess is because this code // is only ever used in cleanup. It's bad enough that the code stomps the // lock without checking it anyway. // // The InterlockedExchange is required because it inserts appropriate // memory barriers on Alpha preventing other processors from seeing // the write delayed. // SplitOrCombinedLockAndFlags M; // // get a pointer to the cExclusiveLock, make it a ULONG * and then // dereference it getting 32bits from the beginning of the 16bit // cExclusiveLock. This will include the BaseFlags which we know won't // change (see above and BASEOBJECT). // M.W = *(ULONG *)&(pobj->cExclusiveLock); M.S.c_cExclusiveLock = (USHORT)cLock; InterlockedExchange((LONG *)&(pobj->cExclusiveLock), M.W); } else { pentTmp = (PENTRY) NULL; WARNING1("HmgSetLock failed - Uniqueness does not match\n"); } } else { pentTmp = (PENTRY) NULL; WARNING1("HmgSetLock failed - invalid handle index or object type\n"); } return((BOOL) (ULONG_PTR)pentTmp); } /******************************Public*Routine******************************\ * HmgQueryLock * * This returns the number of times an object has been Locked. * * Expects: A valid handle. The handle should be validated and locked * before calling this. * * Returns: The number of times the object has been locked. * * History: * 28-Jun-1991 -by- Patrick Haluptzok patrickh * Wrote it. \**************************************************************************/ ULONG FASTCALL HmgQueryLock(HOBJ hobj) { UINT uiIndex = (UINT) HmgIfromH(hobj); // Note we don't need to grab the semaphore because this call assumes the // handle has already been locked down and we are just reading memory. ASSERTGDI(uiIndex < gcMaxHmgr, "HmgQueryLock invalid handle"); return(gpentHmgr[uiIndex].einfo.pobj->cExclusiveLock); } /******************************Public*Routine******************************\ * HmgQueryAltLock * * This returns the number of times an object has been Alt-Locked. * * Expects: A valid handle. The handle should be validated and locked * before calling this. * * Returns: The number of times the object has been locked. * * History: * 28-Jun-1991 -by- Patrick Haluptzok patrickh * Wrote it. \**************************************************************************/ ULONG FASTCALL HmgQueryAltLock(HOBJ hobj) { UINT uiIndex = (UINT) HmgIfromH(hobj); // Note we don't need to grab the semaphore because this call assumes the // handle has already been locked down and we are just reading memory. ASSERTGDI(uiIndex < gcMaxHmgr, "HmgQueryAltLock invalid handle"); return((ULONG) gpentHmgr[uiIndex].einfo.pobj->ulShareCount); } /******************************Public*Routine******************************\ * HOBJ hGetFreeHandle() * * Get the next available handle. * * History: * Mon 21-Oct-1991 -by- Patrick Haluptzok [patrickh] * Make pent commit memory as needed, add logging of error codes. * * Sun 20-Oct-1991 -by- Patrick Haluptzok [patrickh] * add uniqueness to the handle when getting it. * * 12-Dec-1989 -by- Donald Sidoroff [donalds] * Wrote it. \**************************************************************************/ HOBJ hGetFreeHandle( OBJTYPE objt ) { #if GDI_PERF HmgCurrentNumberOfHandles[objt]++; HmgNumberOfHandlesAllocated[objt]++; if (HmgCurrentNumberOfHandles[objt] > HmgMaximumNumberOfHandles[objt]) HmgMaximumNumberOfHandles[objt]++; #endif LONG_PTR uiIndex; if (ghFreeHmgr != (HOBJ) 0) { PENTRYOBJ pentTmp; uiIndex = HmgIfromH(ghFreeHmgr); pentTmp = (PENTRYOBJ) &gpentHmgr[uiIndex]; ghFreeHmgr = pentTmp->einfo.hFree; pentTmp->FullUnique = USUNIQUE(pentTmp->FullUnique,objt); uiIndex = (LONG_PTR)MAKE_HMGR_HANDLE(uiIndex,pentTmp->FullUnique); return((HOBJ) uiIndex); } if (gcMaxHmgr >= MAX_HANDLE_COUNT) { WARNING("Hmgr hGetFreeHandle failed to grow\n"); return ((HOBJ) 0); } // // Allocate a new handle table entry and set the uniqueness value. // // N.B. All newly committed memory is zeroed. // uiIndex = USUNIQUE(UNIQUE_INCREMENT,objt); gpentHmgr[gcMaxHmgr].FullUnique = (USHORT) uiIndex; uiIndex = (LONG_PTR)MAKE_HMGR_HANDLE(gcMaxHmgr,uiIndex); gcMaxHmgr++; return((HOBJ) uiIndex); } /******************************Public*Routine******************************\ * HmgModifyHandleUniqueness() * * The handle passed in has already been updated to the new handle. * * This routine adds bits to the uniquess, updating both the handle entry * and and the handle in the object it self. This routine assumes that it is * safe to be playing with the handle. This means that the handle is locked * or it is during initialization and setting the stock bit. * * * History: * 18-Nov-1994 -by- Eric Kutter [erick] * Wrote it. \**************************************************************************/ HOBJ HmgModifyHandleType( HOBJ h ) { PENTRY pent = &gpentHmgr[HmgIfromH(h)]; USHORT usUnique = HmgUfromH(h); ASSERTGDI((((ULONG_PTR)pent->einfo.pobj->hHmgr ^ (ULONG_PTR)h) & (UNIQUE_MASK | TYPE_MASK)) == 0, "HmgModifyHandleType bad handle\n"); ASSERTGDI((pent->einfo.pobj->cExclusiveLock > 0) || (pent->einfo.pobj->ulShareCount > 0) || HmgStockObj(h), "HmgModifyHandleType not safe\n"); pent->FullUnique = usUnique; pent->einfo.pobj->hHmgr = h; return(h); } /******************************Public*Routine******************************\ * HmgLockAndModifyHandleType() * * The handle passed in has already been updated to the new handle. * * The Handle is locked assuming owned by OBJECT_OWNER_CURRENT * or ObJECT_OWNER_PUBLIC. * * Then this routine adds bits to the uniquess, updating both the handle entry * and and the handle in the object it self. * * History: * 31-Oct-2000 -by- Pravin Santiago [pravins] * Wrote it. \**************************************************************************/ BOOL HmgLockAndModifyHandleType( HOBJ h ) { PENTRY pent = &gpentHmgr[HmgIfromH(h)]; HANDLELOCK HandleLock(pent,TRUE); if (HandleLock.bValid()) { HmgModifyHandleType(h); HandleLock.vUnlock(); return(TRUE); } return(FALSE); } /******************************Public*Routine******************************\ * HmgIncUniqueness() * * Modify the handle uniqueness * * This is implemented for the brush/pen caching and lazy deletion to make sure: * * a)a handle will not be cached twice (changing the handle uniqueness gurantees this) * * b)a handle will not be cached if it is a lazy deletion (cShareLock == 0) * * History: * 8-May-1995 -by- Lingyun Wang [lingyunw] * \**************************************************************************/ HOBJ HmgIncUniqueness( HOBJ hobj, OBJTYPE objt ) { PENTRY pentry; USHORT usUnique = HmgUfromH(hobj); POBJ pobj; UINT uiIndex= (UINT) HmgIfromH(hobj); HOBJ hNew = NULL; if (uiIndex < gcMaxHmgr) { pentry = &gpentHmgr[uiIndex]; HANDLELOCK HandleLock(pentry,FALSE); if (HandleLock.bValid()) { // // validate objt and uniqueness, increment unique if correct // if ( (pentry->FullUnique == usUnique) && (OBJECTOWNER_PID(pentry->ObjectOwner) == W32GetCurrentPID()) && ((pentry = &gpentHmgr[uiIndex])->Objt == objt) ) { pentry->FullUnique += UNIQUE_INCREMENT; hNew = (HOBJ)MAKE_HMGR_HANDLE(uiIndex, pentry->FullUnique); pentry->einfo.pobj->hHmgr = hNew; } HandleLock.vUnlock(); } } return(hNew); } /******************************Public*Routine******************************\ * int NtGdiGetStats(HANDLE,int,int,PVOID,UINT) * * This function returns information from the handle manager about * the gdi objects that are existing. * * Parameters: * hProcess - handle to the process to query for information about * iIndex - type of information to return * iPidType - whether to query for just the process pointed * to by hProcess, or ALL gdi objects or PUBLIC gdi objects * pResults - Pointer to the buffer to fill the data into * cjResultSize - Size of the buffer to fill * * The user buffer is expected to be zero'd. Memory trashing * may occur if the size parameter is incorrect. * * returns: Success state * * History: * Wed 7-Jun-1995 -by- Andrew Skowronski [t-andsko] * Wrote it. \**************************************************************************/ #define OBJECT_OWNER_IGNORE (0x0001) NTSTATUS APIENTRY NtGdiGetStats( HANDLE hProcess, int iIndex, int iPidType, PVOID pResults, UINT cjResultSize ) { DWORD * pdwRes = (DWORD *) pResults; //Pointer to the result buffer W32PID pid; PENTRY pHmgEntry; //Pointer to current entry in the handle manager table ULONG ulLoop; NTSTATUS iRet = STATUS_SUCCESS; // // Check permissions flag // #if !defined(_GDIPLUS_) if (!( RtlGetNtGlobalFlags() & FLG_POOL_ENABLE_TAGGING)) { iRet = STATUS_ACCESS_DENIED; } #endif // // Validate buffer size // switch(iIndex) { case (GS_NUM_OBJS_ALL) : if (cjResultSize < ((MAX_TYPE+1)*sizeof(ULONG))) iRet = STATUS_BUFFER_TOO_SMALL; break; #if DBG case (GS_HANDOBJ_CURRENT) : case (GS_HANDOBJ_MAX) : case (GS_HANDOBJ_ALLOC) : case (GS_LOOKASIDE_INFO) : if (cjResultSize < ((MAX_TYPE+1)*sizeof(ULONG)*2)) iRet = STATUS_BUFFER_TOO_SMALL; break; #else // This info is not available in non-checked builds case (GS_HANDOBJ_CURRENT) : case (GS_HANDOBJ_MAX) : case (GS_HANDOBJ_ALLOC) : case (GS_LOOKASIDE_INFO) : break; #endif default : iRet = STATUS_NOT_IMPLEMENTED; break; } if (NT_SUCCESS(iRet)) { __try { ProbeForWrite(pResults, cjResultSize, sizeof(UCHAR)); switch(iIndex) { case (GS_NUM_OBJS_ALL) : // // Determine the search key. // if (iPidType == (int) OBJECT_OWNER_CURRENT) { pid = (W32PID) ((ULONG) ((ULONG_PTR)hProcess & PID_BITS)); } else { // // This takes care of OBJECT_OWNER_PUBLIC // and OBJECT_OWNER_IGNORE // pid = (W32PID) iPidType; } // // Scan through the handle manager table and // pick out the relevant objects // for (ulLoop = 0; ulLoop < gcMaxHmgr; ulLoop++) { pHmgEntry = &(gpentHmgr[ulLoop]); if ((pid == OBJECT_OWNER_IGNORE) || (pid == OBJECTOWNER_PID(pHmgEntry->ObjectOwner))) { // // Now, depending on the iIndex value we // analyse the results // switch (iIndex) { case (GS_NUM_OBJS_ALL) : pdwRes[pHmgEntry->Objt]++; break; default : iRet = STATUS_NOT_IMPLEMENTED; break; } } } break; #if DBG case (GS_HANDOBJ_CURRENT) : RtlCopyMemory(pdwRes, HmgCurrentNumberOfHandles, (MAX_TYPE+1)*sizeof(ULONG)); RtlCopyMemory(&(pdwRes[MAX_TYPE + 1]), HmgCurrentNumberOfObjects, (MAX_TYPE+1)*sizeof(ULONG)); break; case (GS_HANDOBJ_MAX) : RtlCopyMemory(pdwRes, HmgMaximumNumberOfHandles, (MAX_TYPE+1)*sizeof(ULONG)); RtlCopyMemory(&(pdwRes[MAX_TYPE + 1]), HmgMaximumNumberOfObjects, (MAX_TYPE+1)*sizeof(ULONG)); break; case (GS_HANDOBJ_ALLOC) : RtlCopyMemory(pdwRes, HmgNumberOfHandlesAllocated, (MAX_TYPE+1)*sizeof(ULONG)); RtlCopyMemory(&(pdwRes[MAX_TYPE + 1]), HmgNumberOfObjectsAllocated, (MAX_TYPE+1)*sizeof(ULONG)); break; case (GS_LOOKASIDE_INFO) : RtlCopyMemory(pdwRes, HmgNumberOfLookAsideHits, (MAX_TYPE+1)*sizeof(ULONG)); RtlCopyMemory(&(pdwRes[MAX_TYPE + 1]), HmgNumberOfObjectsAllocated, (MAX_TYPE+1)*sizeof(ULONG)); break; #else // This info is not available in non-checked builds case (GS_HANDOBJ_CURRENT) : case (GS_HANDOBJ_MAX) : case (GS_HANDOBJ_ALLOC) : case (GS_LOOKASIDE_INFO) : break; #endif default : iRet = STATUS_NOT_IMPLEMENTED; break; } } __except (EXCEPTION_EXECUTE_HANDLER) { iRet = STATUS_ACCESS_VIOLATION; } } return iRet; } /******************************Public*Routine******************************\ * HmgAllocateSecureUserMemory * * Allocate and lock 1 page, add as free DC_ATTRs * * Arguments: * * None * * Return Value: * * Status * * History: * * 15-May-1995 -by- Mark Enstrom [marke] * \**************************************************************************/ PVOID HmgAllocateSecureUserMemory(HANDLE *phSecure) { PVOID pvRet = NULL; NTSTATUS NtStatus; // // allocate 1 page of user mode memory // SIZE_T ViewSize = PAGE_SIZE; NtStatus = ZwAllocateVirtualMemory( NtCurrentProcess(), &pvRet, 0L, &ViewSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE ); if (NT_SUCCESS(NtStatus)) { // // secure virtual memory // HANDLE hSecure = *phSecure = MmSecureVirtualMemory(pvRet, ViewSize, PAGE_READWRITE); if (hSecure != NULL) { RtlZeroMemory((PVOID)pvRet,ViewSize); } else { // // free memory // ZwFreeVirtualMemory( NtCurrentProcess(), (PVOID*)&pvRet, &ViewSize, MEM_RELEASE); pvRet = NULL; } } return(pvRet); } /******************************Public*Routine******************************\ * HmgFreeSecureUserMemory * * unlock 1 page, and free it * * Arguments: * * None * * Return Value: * * Status * * History: * * 30-Oct-2001 -by- Pravin Santiago[pravins] * \**************************************************************************/ VOID HmgFreeAllocateSecureUserMemory(PVOID pvAttr, HANDLE hSecure) { SIZE_T ViewSize = PAGE_SIZE; MmUnsecureVirtualMemory(hSecure); ZwFreeVirtualMemory(NtCurrentProcess(), &pvAttr, &ViewSize, MEM_RELEASE); return; } /******************************Public*Routine******************************\ * HmgAllocateDcAttr * * Look first for free DC_ATTR block on thread, else look on process * free list. If none is available, try to allocate user-mode memory. * * Arguments: * * None * * Return Value: * * pDC_ATTR or NULL * * History: * * 24-Aug-1995 -by- Mark Enstrom [marke] * \**************************************************************************/ PDC_ATTR HmgAllocateDcAttr() { PW32THREAD pThread = W32GetCurrentThread(); PDC_ATTR pDCAttr = NULL; #if defined(_GDIPLUS_) pDCAttr = (DC_ATTR*) PALLOCMEM(sizeof(DC_ATTR), 'zzzG'); #else // // look on thread for free dcattr // if (pThread->pgdiDcattr) { pDCAttr = (PDC_ATTR)pThread->pgdiDcattr; pThread->pgdiDcattr = NULL; } else { PW32PROCESS Process = W32GetCurrentProcess(); GreAcquireHmgrSemaphore(); // // look on process list for free dcattr, if none are // available then allocate 1 page of memory and add // to list. // PDC_ATTR *pdcaFreeList = 0; PDCAFLISTENTRY pFreeList = 0; // If the free list empty try to allocate one: if (Process->pDCAttrList == NULL) { ASSERTGDI(IsListEmpty(&Process->GDIDcAttrFreeList), "HmgAllocateDcAttr pDCAttrList is NULL but GDIDcAttrFreeList is not empty\n"); HANDLE hSecure; PDC_ATTR pdca = (PDC_ATTR)HmgAllocateSecureUserMemory(&hSecure); if (pdca != (PDC_ATTR)NULL) { ULONG ulIndex; pFreeList = (PDCAFLISTENTRY)PALLOCNOZ(sizeof(DCAFLISTENTRY), 'fcdG'); if (pFreeList == 0) { HmgFreeAllocateSecureUserMemory(pdca, hSecure); GreReleaseHmgrSemaphore(); return 0; } InsertHeadList(&Process->GDIDcAttrFreeList, (PLIST_ENTRY)pFreeList); pFreeList->cFree = ULNUMDC; pdcaFreeList = (PDC_ATTR *)(&pFreeList->a[0]); // // set the new free list pointing to the new dcattrs allocated // in user mode memory. // Process->pDCAttrList = (PVOID)&pdca[ULNUMDC-1]; for (ulIndex=0;ulIndexpDCAttrList != NULL) { ASSERTGDI(!IsListEmpty(&Process->GDIDcAttrFreeList), "HmgAllocateDcAttr pDCAttrList != NULL but GDIDcAttrFreeList is empty\n"); pFreeList = (PDCAFLISTENTRY)Process->GDIDcAttrFreeList.Flink; pdcaFreeList = (PDC_ATTR *)(&pFreeList->a[0]); ASSERTGDI(Process->pDCAttrList == (PVOID)(pdcaFreeList[pFreeList->cFree-1]), "HmgAllocateDcAttr pdcAttrList and pdcaFreeList entries dont match\n"); // // get dcattr and remove from list // pDCAttr = (PDC_ATTR)Process->pDCAttrList; pFreeList->cFree--; // If pFreeList has no more free entries remove it from the process // free list. Else adjust the free list pointer to next available // attr. if (pFreeList->cFree == 0) { RemoveEntryList((PLIST_ENTRY)pFreeList); VFREEMEM(pFreeList); // If the process free list is not empty, update free list // pointer to the next available entry. Else set it to NULL. if (!IsListEmpty(&Process->GDIDcAttrFreeList)) { pFreeList = (PDCAFLISTENTRY)Process->GDIDcAttrFreeList.Flink; ASSERTGDI(pFreeList->cFree == ULNUMDC, "HmgAllocateDcAttr: next available free list does not have cFree of ULNUMDC\n"); pdcaFreeList = (PDC_ATTR *)(&pFreeList->a[0]); Process->pDCAttrList = (PVOID) (pdcaFreeList[pFreeList->cFree-1]); } else { Process->pDCAttrList = 0; } } else { Process->pDCAttrList = (PVOID) (pdcaFreeList[pFreeList->cFree-1]); } } GreReleaseHmgrSemaphore(); } #endif return(pDCAttr); } /******************************Public*Routine******************************\ * HmgAllocateBrushAttr * * Look on thread for free brushattr, else look on process free * list. If none is available, allocate a dcattr and divide it * up. * * Arguments: * * none * * Return Value: * * pbrushattr or NULL * * History: * * 28-Aug-1995 -by- Mark Enstrom [marke] * \**************************************************************************/ POBJECTATTR HmgAllocateObjectAttr() { PW32THREAD pThread = W32GetCurrentThread(); POBJECTATTR pobjattr = NULL; #if defined(_GDIPLUS_) pobjattr = (OBJECTATTR*) PALLOCMEM(sizeof(OBJECTATTR), 'zzzG'); #else // // quick check on thread for free OBJECTATTR // if (pThread->pgdiBrushAttr) { pobjattr = (POBJECTATTR)pThread->pgdiBrushAttr; pThread->pgdiBrushAttr = NULL; } else { PW32PROCESS Process = W32GetCurrentProcess(); GreAcquireHmgrSemaphore(); // // look on process list for free dcattr, if none are // available then allocate 1 page of memory and add // to list. // POBJECTATTR *pobaFreeList = 0; POBAFLISTENTRY pFreeList = 0; if (Process->pBrushAttrList == NULL) { ASSERTGDI(IsListEmpty(&Process->GDIBrushAttrFreeList), "HmgAllocateObjectAttr pBrushAttrList is NULL but GDIBrushAttrFreeList is not empty\n"); HANDLE hSecure; POBJECTATTR psbr = (POBJECTATTR)HmgAllocateSecureUserMemory(&hSecure); if (psbr != (POBJECTATTR)NULL) { ULONG ulIndex; // No free list available. Allocate one which can handle // ulNumBrush entries. pFreeList = (POBAFLISTENTRY)PALLOCNOZ(sizeof(OBAFLISTENTRY), 'fabG'); if (pFreeList == 0) { HmgFreeAllocateSecureUserMemory(psbr, hSecure); GreReleaseHmgrSemaphore(); return 0; } InsertHeadList(&Process->GDIBrushAttrFreeList, (PLIST_ENTRY)pFreeList); pFreeList->cFree = ULNUMBRUSH; pobaFreeList = (POBJECTATTR *)(&pFreeList->a[0]); // // init process list, then create a linked list of all // the new dcattrs on the process list // Process->pBrushAttrList = (PVOID)&psbr[ULNUMBRUSH-1]; for (ulIndex=0;ulIndexpBrushAttrList != NULL) { ASSERTGDI(!IsListEmpty(&Process->GDIBrushAttrFreeList), "HmgAllocateObjectAttr pBrushAttrList != NULL but GDIBrushAttrFreeList is empty\n"); pFreeList = (POBAFLISTENTRY)Process->GDIBrushAttrFreeList.Flink; pobaFreeList = (POBJECTATTR*)(&pFreeList->a[0]); ASSERTGDI(Process->pBrushAttrList == (PVOID)(pobaFreeList[pFreeList->cFree-1]), "HmgAllocateObjectAttr pBrushAttrList and pobjFreeList entries dont match\n"); // // get dcattr and remove from list // pobjattr = (POBJECTATTR)Process->pBrushAttrList; pFreeList->cFree--; // If pFreeList has no more free entries remove it from the process // free list. Else adjust the free list pointer to next available // attr. if (pFreeList->cFree == 0) { RemoveEntryList((PLIST_ENTRY)pFreeList); VFREEMEM(pFreeList); // If the process free list is not empty, update free list // pointer to the next available entry. Else set it to NULL. if (!IsListEmpty(&Process->GDIBrushAttrFreeList)) { pFreeList = (POBAFLISTENTRY)Process->GDIBrushAttrFreeList.Flink; ASSERTGDI(pFreeList->cFree == ULNUMBRUSH, "HmgAllocateObjextAttr: next available free list does not have cFree of ULNUMBRUSH\n"); pobaFreeList = (POBJECTATTR*)(&pFreeList->a[0]); Process->pBrushAttrList = (PVOID) (pobaFreeList[pFreeList->cFree-1]); } else { Process->pBrushAttrList = 0; } } else { Process->pBrushAttrList = (PVOID) (pobaFreeList[pFreeList->cFree-1]); } } GreReleaseHmgrSemaphore(); } #endif return(pobjattr); } /******************************Public*Routine******************************\ * HmgFreeDcAttr * * Free the dcattr, try to put it on w32thread, if no space then push onto * w32process * * Arguments: * * pdcattr * * Return Value: * * none * * History: * * 28-Aug-1995 -by- Mark Enstrom [marke] * \**************************************************************************/ VOID HmgFreeDcAttr( PDC_ATTR pdca ) { PW32THREAD pThread = W32GetCurrentThread(); #if defined(_GDIPLUS_) VFREEMEM(pdca); #else if ((pdca != NULL) && (pThread != NULL)) { // // try to place on thread // if (pThread->pgdiDcattr == NULL) { pThread->pgdiDcattr = pdca; } else { PW32PROCESS Process = W32GetCurrentProcess(); // // Need to check if W32 process pointer is valid. There are // circumstances in which the process can die without setting // the W32 process. // if (Process != NULL) { GreAcquireHmgrSemaphore(); // // We have to allocate a new free List Entry or add to the one // we already have. PDCAFLISTENTRY pFreeList = 0; PDC_ATTR *pdcaFreeList = 0; if (IsListEmpty(&Process->GDIDcAttrFreeList) || ((PDCAFLISTENTRY)Process->GDIDcAttrFreeList.Flink)->cFree == ULNUMDC) { pFreeList = (PDCAFLISTENTRY)PALLOCNOZ(sizeof(DCAFLISTENTRY), 'fcdG'); if (pFreeList == 0) { GreReleaseHmgrSemaphore(); return; } InsertHeadList(&Process->GDIDcAttrFreeList, (PLIST_ENTRY)pFreeList); pFreeList->cFree = 0; } else { pFreeList = (PDCAFLISTENTRY)Process->GDIDcAttrFreeList.Flink; } pdcaFreeList = (PDC_ATTR *)(&pFreeList->a[0]); // place on process single linked list pFreeList->cFree++; pdcaFreeList[pFreeList->cFree-1] = pdca; Process->pDCAttrList = pdca; GreReleaseHmgrSemaphore(); } } } #endif } /******************************Public*Routine******************************\ * HmgFreeObjectAttr * * Free the objattr, try to put it on w32thread, if no space then * check other part(s) of block that make up a dcattr. If they are * free then place whole dcattr back on dcattr list. * * Arguments: * * pobjattr * * Return Value: * * none * * History: * * 28-Aug-1995 -by- Mark Enstrom [marke] * \**************************************************************************/ VOID HmgFreeObjectAttr( POBJECTATTR pobjattr ) { PW32THREAD pThread = W32GetCurrentThread(); #if defined(_GDIPLUS_) VFREEMEM(pobjattr); #else if ((pobjattr != NULL) && (pThread != NULL)) { // // try to place on thread // if (pThread->pgdiBrushAttr == NULL) { pThread->pgdiBrushAttr = pobjattr; } else { PW32PROCESS Process = W32GetCurrentProcess(); // // Need to check if W32 process pointer is valid. There are // circumstances in which the process can die without setting // the W32 process. // if (Process != NULL) { GreAcquireHmgrSemaphore(); // // We have to allocate a new free List Entry or add to the one // we alread have. POBAFLISTENTRY pFreeList = 0; POBJECTATTR *pobaFreeList = 0; if (IsListEmpty(&Process->GDIBrushAttrFreeList) || ((POBAFLISTENTRY)Process->GDIBrushAttrFreeList.Flink)->cFree == ULNUMBRUSH) { pFreeList = (POBAFLISTENTRY)PALLOCNOZ(sizeof(OBAFLISTENTRY), 'fabG'); if (pFreeList == 0) { GreReleaseHmgrSemaphore(); return; } InsertHeadList(&Process->GDIBrushAttrFreeList, (PLIST_ENTRY)pFreeList); pFreeList->cFree = 0; } else { pFreeList = (POBAFLISTENTRY)Process->GDIBrushAttrFreeList.Flink; } pobaFreeList = (POBJECTATTR*)(&pFreeList->a[0]); // // place on process single linked list // pFreeList->cFree++; pobaFreeList[pFreeList->cFree-1] = pobjattr; Process->pBrushAttrList = pobjattr; GreReleaseHmgrSemaphore(); } } } #endif } /******************************Public*Routine******************************\ * GreIncQuotaCount GreDecQuotaCount * * This is called by user Inc or Dec cursor bitmaps against the creating process * * Notice that cursor bitmaps are marked as PUBLIC by USER but charged against * the creating process's handle quota * * History: * 2/10/98 - by Lingyun Wang [lingyunw] * \**************************************************************************/ VOID GreIncQuotaCount(PW32PROCESS pW32) { InterlockedIncrement(&pW32->GDIHandleCount); } VOID GreDecQuotaCount(PW32PROCESS pW32) { InterlockedDecrement(&pW32->GDIHandleCount); } /******************************Public*Routine******************************\ * HmgPrintBadHandle * * Simple routine that prints out a warning when a handle manager * lock fails due to a bad handle. * \**************************************************************************/ #if DBG CONST CHAR* aszType[] = { "hdef", // DEF_TYPE "HDC", // DC_TYPE "hunused", // DD_DIRECTDRAW_TYPE "hunused", // DD_SURFACE_TYPE "HRGN", // RGN_TYPE "HBITMAP", // SURF_TYPE "HCLIENT", // CLIENTOBJ_TYPE "hpath", // PATH_TYPE "HPALETTE", // PAL_TYPE "HCOLORSPACE", // ICMLCS_TYPE "HFONT", // LFONT_TYPE "hrfont", // RFONT_TYPE "hpfe", // PFE_TYPE "hpft", // PFT_TYPE "hicmcxf", // ICMCXF_TYPE "HSPRITE", // SPRITE_TYPE "HBRUSH", // BRUSH_TYPE "hunused", // D3D_HANDLE_TYPE "hunused", // DD_VIDEOPORT_TYPE "hspace", // SPACE_TYPE "hunused", // DD_MOTIONCOMP_TYPE "HENHMETAFILE", // META_TYPE "hefstate", // EFSTATE_TYPE "hunused", // BMFD_TYPE "hunused", // VTFD_TYPE "hunused", // TTFD_TYPE "hunused", // RC_TYPE "hunused", // TEMP_TYPE "HDRVOBJ", // DRVOBJ_TYPE "hunused", // DCIOBJ_TYPE "hspool", // SPOOL_TYPE "hunused", // }; VOID HmgPrintBadHandle( HOBJ hobj, OBJTYPE objt ) { static CHAR *szSystem = "System"; static CHAR *szUnknown = "???"; CHAR *pszImage; { PETHREAD pet; PEPROCESS pep; if (pep = PsGetCurrentProcess()) { pszImage = (CHAR *)PsGetProcessImageFileName(pep); if (*pszImage == '\0') { pszImage = szSystem; } } else { pszImage = szUnknown; } } KdPrint(("GDI: %s or DLL gave bad handle 0x%p as an %s.\n", pszImage, hobj, aszType[objt])); // Private debug code to catch invalid hpath handle in DC // 6/24/98 - davidx if (hobj != NULL && objt == PATH_TYPE) { RIP("Private debug breakpoint. Please contact ntgdi."); } } #endif