reactos/win32ss/gdi/ntgdi/gdiobj.c

   1 /*
   2  * PROJECT:         ReactOS win32 kernel mode subsystem
   3  * LICENSE:         GPL - See COPYING in the top level directory
   4  * FILE:            subsystems/win32/win32k/objects/gdiobj.c
   5  * PURPOSE:         General GDI object manipulation routines
   6  * PROGRAMMERS:     Timo Kreuzer
   7  */
   8
   9 /*
  10  * If you want to understand this code, you need to start thinking in portals.
  11  * - gpaulRefCount is a global pointer to an allocated array of ULONG values,
  12  * one for each handle. Bits 0 - 22 contain a reference count for the handle.
  13  * It gets increased for each handle lock / reference. Bit 23 contains a valid
  14  * bit. If this bit is 0, the handle got deleted and will be pushed to the free
  15  * list, once all references are gone. Bits 24 - 31 contain the reuse value of
  16  * the handle, which allows to check if the entry was changed before atomically
  17  * exchanging the reference count.
  18  * - Objects can exist with or without a handle
  19  *   - Objects with a handle can be locked either exclusively or shared.
  20  *     Both locks increase the handle reference count in gpaulRefCount.
  21  *     Exclusive locks also increase the BASEOBJECT's cExclusiveLock field
  22  *     and the first lock (can be acquired recursively) acquires a pushlock
  23  *     that is also stored in the BASEOBJECT.
  24  *   - Objects without a handle cannot have exclusive locks. Their reference
  25  *     count is tracked in the BASEOBJECT's ulShareCount field.
  26  * - An object that is inserted in the handle table automatically has an
  27  *   exclusive lock. For objects that are "shared objects" (BRUSH, PALETTE, ...)
  28  *   this is the only way it can ever be exclusively locked. It prevents the
  29  *   object from being locked by another thread. A shared lock will simply fail,
  30  *   while an exclusive lock will succeed after the object was unlocked.
  31  *
  32  */
  33
  34 /* INCLUDES ******************************************************************/
  35
  36 #include <win32k.h>
  37 #define NDEBUG
  38 #include <debug.h>
  39
  40 // Move to gdidbg.h
  41 #if DBG
  42 #define DBG_INCREASE_LOCK_COUNT(pti, hobj) \
  43     if (pti) ((PTHREADINFO)pti)->acExclusiveLockCount[((ULONG_PTR)hobj >> 16) & 0x1f]++;
  44 #define DBG_DECREASE_LOCK_COUNT(pti, hobj) \
  45     if (pti) ((PTHREADINFO)pti)->acExclusiveLockCount[((ULONG_PTR)hobj >> 16) & 0x1f]--;
  46 #define ASSERT_SHARED_OBJECT_TYPE(objt) \
  47     ASSERT((objt) == GDIObjType_SURF_TYPE || \
  48            (objt) == GDIObjType_PAL_TYPE || \
  49            (objt) == GDIObjType_LFONT_TYPE || \
  50            (objt) == GDIObjType_PATH_TYPE || \
  51            (objt) == GDIObjType_BRUSH_TYPE)
  52 #define ASSERT_EXCLUSIVE_OBJECT_TYPE(objt) \
  53     ASSERT((objt) == GDIObjType_DC_TYPE || \
  54            (objt) == GDIObjType_RGN_TYPE || \
  55            (objt) == GDIObjType_LFONT_TYPE)
  56 #else
  57 #define DBG_INCREASE_LOCK_COUNT(ppi, hobj)
  58 #define DBG_DECREASE_LOCK_COUNT(x, y)
  59 #define ASSERT_SHARED_OBJECT_TYPE(objt)
  60 #define ASSERT_EXCLUSIVE_OBJECT_TYPE(objt)
  61 #endif
  62
  63 #define MmMapViewInSessionSpace MmMapViewInSystemSpace
  64
  65 #if defined(_M_IX86) || defined(_M_AMD64)
  66 #define InterlockedOr16 _InterlockedOr16
  67 #endif
  68
  69 #define GDIOBJ_POOL_TAG(type) ('00hG' + ((objt & 0x1f) << 24))
  70
  71 enum
  72 {
  73     REF_MASK_REUSE = 0xff000000,
  74     REF_INC_REUSE  = 0x01000000,
  75     REF_MASK_VALID = 0x00800000,
  76     REF_MASK_COUNT = 0x007fffff,
  77     REF_MASK_INUSE = 0x00ffffff,
  78 };
  79
  80 /* GLOBALS *******************************************************************/
  81
  82 /* Per session handle table globals */
  83 static PVOID gpvGdiHdlTblSection = NULL;
  84 static PENTRY gpentHmgr;
  85 static PULONG gpaulRefCount;
  86 ULONG gulFirstFree;
  87 ULONG gulFirstUnused;
  88 static PPAGED_LOOKASIDE_LIST gpaLookasideList;
  89
  90 static BOOL NTAPI GDIOBJ_Cleanup(PVOID ObjectBody);
  91
  92 static const
  93 GDICLEANUPPROC
  94 apfnCleanup[] =
  95 {
  96     NULL,             /* 00 GDIObjType_DEF_TYPE */
  97     DC_Cleanup,       /* 01 GDIObjType_DC_TYPE */
  98     NULL,             /* 02 GDIObjType_UNUSED1_TYPE */
  99     NULL,             /* 03 GDIObjType_UNUSED2_TYPE */
 100     REGION_Cleanup,   /* 04 GDIObjType_RGN_TYPE */
 101     SURFACE_Cleanup,  /* 05 GDIObjType_SURF_TYPE */
 102     GDIOBJ_Cleanup,   /* 06 GDIObjType_CLIENTOBJ_TYPE */
 103     GDIOBJ_Cleanup,   /* 07 GDIObjType_PATH_TYPE */
 104     PALETTE_Cleanup,  /* 08 GDIObjType_PAL_TYPE */
 105     GDIOBJ_Cleanup,   /* 09 GDIObjType_ICMLCS_TYPE */
 106     GDIOBJ_Cleanup,   /* 0a GDIObjType_LFONT_TYPE */
 107     NULL,             /* 0b GDIObjType_RFONT_TYPE, unused */
 108     NULL,             /* 0c GDIObjType_PFE_TYPE, unused */
 109     NULL,             /* 0d GDIObjType_PFT_TYPE, unused */
 110     GDIOBJ_Cleanup,   /* 0e GDIObjType_ICMCXF_TYPE */
 111     NULL,             /* 0f GDIObjType_SPRITE_TYPE, unused */
 112     BRUSH_Cleanup,    /* 10 GDIObjType_BRUSH_TYPE, BRUSH, PEN, EXTPEN */
 113     NULL,             /* 11 GDIObjType_UMPD_TYPE, unused */
 114     NULL,             /* 12 GDIObjType_UNUSED4_TYPE */
 115     NULL,             /* 13 GDIObjType_SPACE_TYPE, unused */
 116     NULL,             /* 14 GDIObjType_UNUSED5_TYPE */
 117     NULL,             /* 15 GDIObjType_META_TYPE, unused */
 118     NULL,             /* 16 GDIObjType_EFSTATE_TYPE, unused */
 119     NULL,             /* 17 GDIObjType_BMFD_TYPE, unused */
 120     NULL,             /* 18 GDIObjType_VTFD_TYPE, unused */
 121     NULL,             /* 19 GDIObjType_TTFD_TYPE, unused */
 122     NULL,             /* 1a GDIObjType_RC_TYPE, unused */
 123     NULL,             /* 1b GDIObjType_TEMP_TYPE, unused */
 124     DRIVEROBJ_Cleanup,/* 1c GDIObjType_DRVOBJ_TYPE */
 125     NULL,             /* 1d GDIObjType_DCIOBJ_TYPE, unused */
 126     NULL,             /* 1e GDIObjType_SPOOL_TYPE, unused */
 127     NULL,             /* 1f reserved entry */
 128 };
 129
 130 /* INTERNAL FUNCTIONS ********************************************************/
 131
 132 static
 133 BOOL NTAPI
 134 GDIOBJ_Cleanup(PVOID ObjectBody)
 135 {
 136     return TRUE;
 137 }
 138
 139 static
 140 VOID
 141 InitLookasideList(UCHAR objt, ULONG cjSize)
 142 {
 143     ExInitializePagedLookasideList(&gpaLookasideList[objt],
 144                                    NULL,
 145                                    NULL,
 146                                    0,
 147                                    cjSize,
 148                                    GDITAG_HMGR_LOOKASIDE_START + (objt << 24),
 149                                    0);
 150 }
 151
 152 INIT_FUNCTION
 153 NTSTATUS
 154 NTAPI
 155 InitGdiHandleTable(void)
 156 {
 157     NTSTATUS status;
 158     LARGE_INTEGER liSize;
 159     PVOID pvSection;
 160     SIZE_T cjViewSize = 0;
 161
 162     /* Create a section for the shared handle table */
 163     liSize.QuadPart = sizeof(GDI_HANDLE_TABLE); // GDI_HANDLE_COUNT * sizeof(ENTRY);
 164     status = MmCreateSection(&gpvGdiHdlTblSection,
 165                              SECTION_ALL_ACCESS,
 166                              NULL,
 167                              &liSize,
 168                              PAGE_READWRITE,
 169                              SEC_COMMIT,
 170                              NULL,
 171                              NULL);
 172     if (!NT_SUCCESS(status))
 173     {
 174         DPRINT1("INITGDI: Could not allocate a GDI handle table.\n");
 175         return status;
 176     }
 177
 178     /* Map the section in session space */
 179     status = MmMapViewInSessionSpace(gpvGdiHdlTblSection,
 180                                      (PVOID*)&gpentHmgr,
 181                                      &cjViewSize);
 182     if (!NT_SUCCESS(status))
 183     {
 184         DPRINT1("INITGDI: Failed to map handle table section\n");
 185         ObDereferenceObject(gpvGdiHdlTblSection);
 186         return status;
 187     }
 188
 189     /* Allocate memory for the reference counter table */
 190     gpaulRefCount = EngAllocSectionMem(&pvSection,
 191                                      FL_ZERO_MEMORY,
 192                                      GDI_HANDLE_COUNT * sizeof(ULONG),
 193                                      'frHG');
 194     if (!gpaulRefCount)
 195     {
 196         DPRINT1("INITGDI: Failed to allocate reference table.\n");
 197         ObDereferenceObject(gpvGdiHdlTblSection);
 198         return STATUS_INSUFFICIENT_RESOURCES;
 199     }
 200
 201     gulFirstFree = 0;
 202     gulFirstUnused = RESERVE_ENTRIES_COUNT;
 203
 204     GdiHandleTable = (PVOID)gpentHmgr;
 205
 206     /* Initialize the lookaside lists */
 207     gpaLookasideList = ExAllocatePoolWithTag(NonPagedPool,
 208                            GDIObjTypeTotal * sizeof(PAGED_LOOKASIDE_LIST),
 209                            TAG_GDIHNDTBLE);
 210     if(!gpaLookasideList)
 211         return STATUS_NO_MEMORY;
 212
 213     InitLookasideList(GDIObjType_DC_TYPE, sizeof(DC));
 214     InitLookasideList(GDIObjType_RGN_TYPE, sizeof(REGION));
 215     InitLookasideList(GDIObjType_SURF_TYPE, sizeof(SURFACE));
 216     InitLookasideList(GDIObjType_CLIENTOBJ_TYPE, sizeof(CLIENTOBJ));
 217     InitLookasideList(GDIObjType_PATH_TYPE, sizeof(PATH));
 218     InitLookasideList(GDIObjType_PAL_TYPE, sizeof(PALETTE));
 219     InitLookasideList(GDIObjType_ICMLCS_TYPE, sizeof(COLORSPACE));
 220     InitLookasideList(GDIObjType_LFONT_TYPE, sizeof(TEXTOBJ));
 221     InitLookasideList(GDIObjType_BRUSH_TYPE, sizeof(BRUSH));
 222
 223     return STATUS_SUCCESS;
 224 }
 225
 226 FORCEINLINE
 227 VOID
 228 IncrementGdiHandleCount(void)
 229 {
 230     PPROCESSINFO ppi = PsGetCurrentProcessWin32Process();
 231     if (ppi) InterlockedIncrement((LONG*)&ppi->GDIHandleCount);
 232 }
 233
 234 FORCEINLINE
 235 VOID
 236 DecrementGdiHandleCount(void)
 237 {
 238     PPROCESSINFO ppi = PsGetCurrentProcessWin32Process();
 239     if (ppi) InterlockedDecrement((LONG*)&ppi->GDIHandleCount);
 240 }
 241
 242 static
 243 PENTRY
 244 ENTRY_pentPopFreeEntry(VOID)
 245 {
 246     ULONG iFirst, iNext, iPrev;
 247     PENTRY pentFree;
 248
 249     DPRINT("Enter InterLockedPopFreeEntry\n");
 250
 251     do
 252     {
 253         /* Get the index and sequence number of the first free entry */
 254         iFirst = gulFirstFree;
 255
 256         /* Check if we have a free entry */
 257         if (!(iFirst & GDI_HANDLE_INDEX_MASK))
 258         {
 259             /* Increment FirstUnused and get the new index */
 260             iFirst = InterlockedIncrement((LONG*)&gulFirstUnused) - 1;
 261
 262             /* Check if we have unused entries left */
 263             if (iFirst >= GDI_HANDLE_COUNT)
 264             {
 265                 DPRINT1("No more GDI handles left!\n");
 266                 return 0;
 267             }
 268
 269             /* Return the old entry */
 270             return &gpentHmgr[iFirst];
 271         }
 272
 273         /* Get a pointer to the first free entry */
 274         pentFree = &gpentHmgr[iFirst & GDI_HANDLE_INDEX_MASK];
 275
 276         /* Create a new value with an increased sequence number */
 277         iNext = (USHORT)(ULONG_PTR)pentFree->einfo.pobj;
 278         iNext |= (iFirst & ~GDI_HANDLE_INDEX_MASK) + 0x10000;
 279
 280         /* Try to exchange the FirstFree value */
 281         iPrev = InterlockedCompareExchange((LONG*)&gulFirstFree,
 282                                            iNext,
 283                                            iFirst);
 284     }
 285     while (iPrev != iFirst);
 286
 287     /* Sanity check: is entry really free? */
 288     ASSERT(((ULONG_PTR)pentFree->einfo.pobj & ~GDI_HANDLE_INDEX_MASK) == 0);
 289
 290     return pentFree;
 291 }
 292
 293 /* Pushes an entry of the handle table to the free list,
 294    The entry must not have any references left */
 295 static
 296 VOID
 297 ENTRY_vPushFreeEntry(PENTRY pentFree)
 298 {
 299     ULONG iToFree, iFirst, iPrev, idxToFree;
 300
 301     DPRINT("Enter ENTRY_vPushFreeEntry\n");
 302
 303     idxToFree = pentFree - gpentHmgr;
 304     ASSERT((gpaulRefCount[idxToFree] & REF_MASK_INUSE) == 0);
 305
 306     /* Initialize entry */
 307     pentFree->Objt = GDIObjType_DEF_TYPE;
 308     pentFree->ObjectOwner.ulObj = 0;
 309     pentFree->pUser = NULL;
 310
 311     /* Increase reuse counter in entry and reference counter */
 312     InterlockedExchangeAdd((LONG*)&gpaulRefCount[idxToFree], REF_INC_REUSE);
 313     pentFree->FullUnique += 0x0100;
 314
 315     do
 316     {
 317         /* Get the current first free index and sequence number */
 318         iFirst = gulFirstFree;
 319
 320         /* Set the einfo.pobj member to the index of the first free entry */
 321         pentFree->einfo.pobj = UlongToPtr(iFirst & GDI_HANDLE_INDEX_MASK);
 322
 323         /* Combine new index and increased sequence number in iToFree */
 324         iToFree = idxToFree | ((iFirst & ~GDI_HANDLE_INDEX_MASK) + 0x10000);
 325
 326         /* Try to atomically update the first free entry */
 327         iPrev = InterlockedCompareExchange((LONG*)&gulFirstFree,
 328                                            iToFree,
 329                                            iFirst);
 330     }
 331     while (iPrev != iFirst);
 332 }
 333
 334 static
 335 PENTRY
 336 ENTRY_ReferenceEntryByHandle(HGDIOBJ hobj, FLONG fl)
 337 {
 338     ULONG ulIndex, cNewRefs, cOldRefs;
 339     PENTRY pentry;
 340
 341     /* Get the handle index and check if its too big */
 342     ulIndex = GDI_HANDLE_GET_INDEX(hobj);
 343     if (ulIndex >= GDI_HANDLE_COUNT) return NULL;
 344
 345     /* Get pointer to the entry */
 346     pentry = &gpentHmgr[ulIndex];
 347
 348     /* Get the current reference count */
 349     cOldRefs = gpaulRefCount[ulIndex];
 350
 351     do
 352     {
 353         /* Check if the slot is deleted */
 354         if ((cOldRefs & REF_MASK_VALID) == 0)
 355         {
 356             DPRINT("GDIOBJ: Slot is not valid: 0x%lx, hobh=%p\n", cOldRefs, hobj);
 357             return NULL;
 358         }
 359
 360         /* Check if the unique value matches */
 361         if (pentry->FullUnique != (USHORT)((ULONG_PTR)hobj >> 16))
 362         {
 363             DPRINT("GDIOBJ: Wrong unique value. Handle: 0x%4x, entry: 0x%4x\n",
 364                    (USHORT)((ULONG_PTR)hobj >> 16, pentry->FullUnique));
 365             return NULL;
 366         }
 367
 368         /* Check if the object owner is this process or public */
 369         if (!(fl & GDIOBJFLAG_IGNOREPID) &&
 370             pentry->ObjectOwner.ulObj != GDI_OBJ_HMGR_PUBLIC &&
 371             pentry->ObjectOwner.ulObj != PtrToUlong(PsGetCurrentProcessId()))
 372         {
 373             DPRINT("GDIOBJ: Cannot reference foreign handle %p, pentry=%p:%lx.\n",
 374                     hobj, pentry, pentry->ObjectOwner.ulObj);
 375             return NULL;
 376         }
 377
 378         /* Try to atomically increment the reference count */
 379         cNewRefs = cOldRefs + 1;
 380         cOldRefs = InterlockedCompareExchange((PLONG)&gpaulRefCount[ulIndex],
 381                                               cNewRefs,
 382                                               cOldRefs);
 383     }
 384     while (cNewRefs != cOldRefs + 1);
 385
 386     /* Integrity checks */
 387     ASSERT((pentry->FullUnique & 0x1f) == pentry->Objt);
 388     ASSERT(pentry->einfo.pobj && pentry->einfo.pobj->hHmgr == hobj);
 389
 390     return pentry;
 391 }
 392
 393 static
 394 HGDIOBJ
 395 ENTRY_hInsertObject(PENTRY pentry, POBJ pobj, UCHAR objt, ULONG ulOwner)
 396 {
 397     ULONG ulIndex;
 398
 399     /* Calculate the handle index */
 400     ulIndex = pentry - gpentHmgr;
 401
 402     /* Update the fields in the ENTRY */
 403     pentry->einfo.pobj = pobj;
 404     pentry->Objt = objt & 0x1f;
 405     pentry->FullUnique = (pentry->FullUnique & 0xff00) | objt;
 406     pentry->ObjectOwner.ulObj = ulOwner;
 407
 408     /* Make the handle valid with 1 reference */
 409     ASSERT((gpaulRefCount[ulIndex] & REF_MASK_INUSE) == 0);
 410     InterlockedOr((LONG*)&gpaulRefCount[ulIndex], REF_MASK_VALID | 1);
 411
 412     /* Return the handle */
 413     return (HGDIOBJ)(((ULONG_PTR)pentry->FullUnique << 16) | ulIndex);
 414 }
 415
 416 POBJ
 417 NTAPI
 418 GDIOBJ_AllocateObject(UCHAR objt, ULONG cjSize, FLONG fl)
 419 {
 420     POBJ pobj;
 421
 422     if (fl & BASEFLAG_LOOKASIDE)
 423     {
 424         /* Allocate the object from a lookaside list */
 425         pobj = ExAllocateFromPagedLookasideList(&gpaLookasideList[objt & 0x1f]);
 426     }
 427     else
 428     {
 429         /* Allocate the object from paged pool */
 430         pobj = ExAllocatePoolWithTag(PagedPool, cjSize, GDIOBJ_POOL_TAG(objt));
 431     }
 432
 433     if (!pobj) return NULL;
 434
 435     /* Initialize the object */
 436     RtlZeroMemory(pobj, cjSize);
 437     pobj->hHmgr = (HGDIOBJ)((ULONG_PTR)objt << 16);
 438     pobj->cExclusiveLock = 0;
 439     pobj->ulShareCount = 1;
 440     pobj->BaseFlags = fl & 0xffff;
 441     DBG_INITLOG(&pobj->slhLog);
 442     DBG_LOGEVENT(&pobj->slhLog, EVENT_ALLOCATE, 0);
 443
 444     return pobj;
 445 }
 446
 447 VOID
 448 NTAPI
 449 GDIOBJ_vFreeObject(POBJ pobj)
 450 {
 451     UCHAR objt;
 452
 453     DBG_CLEANUP_EVENT_LIST(&pobj->slhLog);
 454
 455     /* Get the object type */
 456     objt = ((ULONG_PTR)pobj->hHmgr >> 16) & 0x1f;
 457
 458     /* Call the cleanup procedure */
 459     ASSERT(apfnCleanup[objt]);
 460     apfnCleanup[objt](pobj);
 461
 462     /* Check if the object is allocated from a lookaside list */
 463     if (pobj->BaseFlags & BASEFLAG_LOOKASIDE)
 464     {
 465         ExFreeToPagedLookasideList(&gpaLookasideList[objt], pobj);
 466     }
 467     else
 468     {
 469         ExFreePoolWithTag(pobj, GDIOBJ_POOL_TAG(objt));
 470     }
 471 }
 472
 473 VOID
 474 NTAPI
 475 GDIOBJ_vDereferenceObject(POBJ pobj)
 476 {
 477     ULONG cRefs, ulIndex;
 478
 479     /* Calculate the index */
 480     ulIndex = GDI_HANDLE_GET_INDEX(pobj->hHmgr);
 481
 482     /* Check if the object has a handle */
 483     if (ulIndex)
 484     {
 485         /* Decrement reference count */
 486         ASSERT((gpaulRefCount[ulIndex] & REF_MASK_COUNT) > 0);
 487         cRefs = InterlockedDecrement((LONG*)&gpaulRefCount[ulIndex]);
 488         DBG_LOGEVENT(&pobj->slhLog, EVENT_DEREFERENCE, cRefs);
 489
 490         /* Check if we reached 0 and handle bit is not set */
 491         if ((cRefs & REF_MASK_INUSE) == 0)
 492         {
 493             /* Make sure it's ok to delete the object */
 494             ASSERT(pobj->BaseFlags & BASEFLAG_READY_TO_DIE);
 495
 496             /* Check if the handle was process owned */
 497             if (gpentHmgr[ulIndex].ObjectOwner.ulObj != GDI_OBJ_HMGR_PUBLIC &&
 498                 gpentHmgr[ulIndex].ObjectOwner.ulObj != GDI_OBJ_HMGR_NONE)
 499             {
 500                 /* Decrement the process handle count */
 501                 ASSERT(gpentHmgr[ulIndex].ObjectOwner.ulObj ==
 502                        HandleToUlong(PsGetCurrentProcessId()));
 503                 DecrementGdiHandleCount();
 504             }
 505
 506             /* Push entry to the free list */
 507             ENTRY_vPushFreeEntry(&gpentHmgr[ulIndex]);
 508
 509             /* Free the object */
 510             GDIOBJ_vFreeObject(pobj);
 511         }
 512     }
 513     else
 514     {
 515         /* Decrement the objects reference count */
 516         ASSERT(pobj->ulShareCount > 0);
 517         cRefs = InterlockedDecrement((LONG*)&pobj->ulShareCount);
 518         DBG_LOGEVENT(&pobj->slhLog, EVENT_DEREFERENCE, cRefs);
 519
 520         /* Check if we reached 0 */
 521         if (cRefs == 0)
 522         {
 523             /* Free the object */
 524             GDIOBJ_vFreeObject(pobj);
 525         }
 526     }
 527 }
 528
 529 POBJ
 530 NTAPI
 531 GDIOBJ_ReferenceObjectByHandle(
 532     HGDIOBJ hobj,
 533     UCHAR objt)
 534 {
 535     PENTRY pentry;
 536     POBJ pobj;
 537
 538     /* Check if the handle type matches */
 539     ASSERT_SHARED_OBJECT_TYPE(objt);
 540     if ((((ULONG_PTR)hobj >> 16) & 0x1f) != objt)
 541     {
 542         DPRINT("GDIOBJ: Wrong type. handle=%p, type=%x\n", hobj, objt);
 543         return NULL;
 544     }
 545
 546     /* Reference the handle entry */
 547     pentry = ENTRY_ReferenceEntryByHandle(hobj, 0);
 548     if (!pentry)
 549     {
 550         DPRINT("GDIOBJ: Requested handle 0x%p is not valid.\n", hobj);
 551         return NULL;
 552     }
 553
 554     /* Get the pointer to the BASEOBJECT */
 555     pobj = pentry->einfo.pobj;
 556
 557     /* Check if the object is exclusively locked */
 558     if (pobj->cExclusiveLock != 0)
 559     {
 560         DPRINT1("GDIOBJ: Cannot reference oject %p with exclusive lock.\n", hobj);
 561         GDIOBJ_vDereferenceObject(pobj);
 562         DBG_DUMP_EVENT_LIST(&pobj->slhLog);
 563         return NULL;
 564     }
 565
 566     DBG_LOGEVENT(&pobj->slhLog, EVENT_REFERENCE, gpaulRefCount[pentry - gpentHmgr]);
 567
 568     /* All is well, return the object */
 569     return pobj;
 570 }
 571
 572 VOID
 573 NTAPI
 574 GDIOBJ_vReferenceObjectByPointer(POBJ pobj)
 575 {
 576     ULONG cRefs;
 577
 578     /* Check if the object has a handle */
 579     if (GDI_HANDLE_GET_INDEX(pobj->hHmgr))
 580     {
 581         /* Increase the handle's reference count */
 582         ULONG ulIndex = GDI_HANDLE_GET_INDEX(pobj->hHmgr);
 583         ASSERT((gpaulRefCount[ulIndex] & REF_MASK_COUNT) > 0);
 584         cRefs = InterlockedIncrement((LONG*)&gpaulRefCount[ulIndex]);
 585     }
 586     else
 587     {
 588         /* Increase the object's reference count */
 589         cRefs = InterlockedIncrement((LONG*)&pobj->ulShareCount);
 590     }
 591
 592     DBG_LOGEVENT(&pobj->slhLog, EVENT_REFERENCE, cRefs);
 593 }
 594
 595 PGDIOBJ
 596 NTAPI
 597 GDIOBJ_LockObject(
 598     HGDIOBJ hobj,
 599     UCHAR objt)
 600 {
 601     PENTRY pentry;
 602     POBJ pobj;
 603     DWORD dwThreadId;
 604
 605     /* Check if the handle type matches */
 606     ASSERT_EXCLUSIVE_OBJECT_TYPE(objt);
 607     if ((((ULONG_PTR)hobj >> 16) & 0x1f) != objt)
 608     {
 609         DPRINT("Wrong object type: hobj=0x%p, objt=0x%x\n", hobj, objt);
 610         return NULL;
 611     }
 612
 613     /* Reference the handle entry */
 614     pentry = ENTRY_ReferenceEntryByHandle(hobj, 0);
 615     if (!pentry)
 616     {
 617         DPRINT("GDIOBJ: Requested handle 0x%p is not valid.\n", hobj);
 618         return NULL;
 619     }
 620
 621     /* Get the pointer to the BASEOBJECT */
 622     pobj = pentry->einfo.pobj;
 623
 624     /* Check if we already own the lock */
 625     dwThreadId = PtrToUlong(PsGetCurrentThreadId());
 626     if (pobj->dwThreadId != dwThreadId)
 627     {
 628         /* Disable APCs and acquire the push lock */
 629         KeEnterCriticalRegion();
 630         ExAcquirePushLockExclusive(&pobj->pushlock);
 631
 632         /* Set us as lock owner */
 633         ASSERT(pobj->dwThreadId == 0);
 634         pobj->dwThreadId = dwThreadId;
 635     }
 636
 637     /* Increase lock count */
 638     pobj->cExclusiveLock++;
 639     DBG_INCREASE_LOCK_COUNT(PsGetCurrentProcessWin32Process(), hobj);
 640     DBG_LOGEVENT(&pobj->slhLog, EVENT_LOCK, 0);
 641
 642     /* Return the object */
 643     return pobj;
 644 }
 645
 646 VOID
 647 NTAPI
 648 GDIOBJ_vUnlockObject(POBJ pobj)
 649 {
 650     ULONG cRefs, ulIndex;
 651     ASSERT(pobj->cExclusiveLock > 0);
 652
 653     /* Decrease lock count */
 654     pobj->cExclusiveLock--;
 655     DBG_DECREASE_LOCK_COUNT(PsGetCurrentProcessWin32Process(), pobj->hHmgr);
 656     DBG_LOGEVENT(&pobj->slhLog, EVENT_UNLOCK, 0);
 657
 658     /* Check if this was the last lock */
 659     if (pobj->cExclusiveLock == 0)
 660     {
 661         /* Reset lock owner */
 662         pobj->dwThreadId = 0;
 663
 664         /* Release the pushlock and reenable APCs */
 665         ExReleasePushLockExclusive(&pobj->pushlock);
 666         KeLeaveCriticalRegion();
 667     }
 668
 669     /* Calculate the index */
 670     ulIndex = GDI_HANDLE_GET_INDEX(pobj->hHmgr);
 671
 672     /* Decrement reference count */
 673     ASSERT((gpaulRefCount[ulIndex] & REF_MASK_COUNT) > 0);
 674     cRefs = InterlockedDecrement((LONG*)&gpaulRefCount[ulIndex]);
 675     ASSERT(cRefs & REF_MASK_VALID);
 676 }
 677
 678 HGDIOBJ
 679 NTAPI
 680 GDIOBJ_hInsertObject(
 681     POBJ pobj,
 682     ULONG ulOwner)
 683 {
 684     PENTRY pentry;
 685     UCHAR objt;
 686
 687     /* Must have no handle and only one reference */
 688     ASSERT(GDI_HANDLE_GET_INDEX(pobj->hHmgr) == 0);
 689     ASSERT(pobj->cExclusiveLock == 0);
 690     ASSERT(pobj->ulShareCount == 1);
 691
 692     /* Get a free handle entry */
 693     pentry = ENTRY_pentPopFreeEntry();
 694     if (!pentry)
 695     {
 696         DPRINT1("GDIOBJ: Could not get a free entry.\n");
 697         return NULL;
 698     }
 699
 700     /* Make the object exclusively locked */
 701     ExInitializePushLock(&pobj->pushlock);
 702     KeEnterCriticalRegion();
 703     ExAcquirePushLockExclusive(&pobj->pushlock);
 704     pobj->cExclusiveLock = 1;
 705     pobj->dwThreadId = PtrToUlong(PsGetCurrentThreadId());
 706     DBG_INCREASE_LOCK_COUNT(PsGetCurrentProcessWin32Process(), pobj->hHmgr);
 707
 708     /* Get object type from the hHmgr field */
 709     objt = ((ULONG_PTR)pobj->hHmgr >> 16) & 0xff;
 710     ASSERT(objt != GDIObjType_DEF_TYPE);
 711
 712     /* Check if current process is requested owner */
 713     if (ulOwner == GDI_OBJ_HMGR_POWNED)
 714     {
 715         /* Increment the process handle count */
 716         IncrementGdiHandleCount();
 717
 718         /* Use Process id */
 719         ulOwner = HandleToUlong(PsGetCurrentProcessId());
 720     }
 721
 722     /* Insert the object into the handle table */
 723     pobj->hHmgr = ENTRY_hInsertObject(pentry, pobj, objt, ulOwner);
 724
 725     /* Return the handle */
 726     DPRINT("GDIOBJ: Created handle: %p\n", pobj->hHmgr);
 727     DBG_LOGEVENT(&pobj->slhLog, EVENT_CREATE_HANDLE, 0);
 728     return pobj->hHmgr;
 729 }
 730
 731 VOID
 732 NTAPI
 733 GDIOBJ_vSetObjectOwner(
 734     POBJ pobj,
 735     ULONG ulOwner)
 736 {
 737     PENTRY pentry;
 738
 739     /* This is a ugly HACK, needed to fix IntGdiSetDCOwnerEx */
 740     if (GDI_HANDLE_IS_STOCKOBJ(pobj->hHmgr))
 741     {
 742         DPRINT("Trying to set ownership of stock object %p to %lx\n", pobj->hHmgr, ulOwner);
 743         return;
 744     }
 745
 746     /* Get the handle entry */
 747     ASSERT(GDI_HANDLE_GET_INDEX(pobj->hHmgr));
 748     pentry = &gpentHmgr[GDI_HANDLE_GET_INDEX(pobj->hHmgr)];
 749
 750     /* Is the current process requested? */
 751     if (ulOwner == GDI_OBJ_HMGR_POWNED)
 752     {
 753         /* Use process id */
 754         ulOwner = HandleToUlong(PsGetCurrentProcessId());
 755         if (pentry->ObjectOwner.ulObj != ulOwner)
 756         {
 757             IncrementGdiHandleCount();
 758         }
 759     }
 760
 761     // HACK
 762     if (ulOwner == GDI_OBJ_HMGR_NONE)
 763         ulOwner = GDI_OBJ_HMGR_PUBLIC;
 764
 765     if (ulOwner == GDI_OBJ_HMGR_PUBLIC ||
 766         ulOwner == GDI_OBJ_HMGR_NONE)
 767     {
 768         /* Make sure we don't leak user mode memory */
 769         ASSERT(pentry->pUser == NULL);
 770         if (pentry->ObjectOwner.ulObj != GDI_OBJ_HMGR_PUBLIC &&
 771             pentry->ObjectOwner.ulObj != GDI_OBJ_HMGR_NONE)
 772         {
 773             DecrementGdiHandleCount();
 774         }
 775     }
 776
 777     /* Set new owner */
 778     pentry->ObjectOwner.ulObj = ulOwner;
 779     DBG_LOGEVENT(&pobj->slhLog, EVENT_SET_OWNER, 0);
 780 }
 781
 782 /* Locks 2 or 3 objects at a time */
 783 BOOL
 784 NTAPI
 785 GDIOBJ_bLockMultipleObjects(
 786     IN ULONG ulCount,
 787     IN HGDIOBJ* ahObj,
 788     OUT PGDIOBJ* apObj,
 789     IN UCHAR objt)
 790 {
 791     UINT auiIndices[3] = {0, 1, 2};
 792     UINT i, j, tmp;
 793
 794     ASSERT(ulCount <= 3);
 795
 796     /* Sort the handles */
 797     for (i = 0; i < ulCount - 1; i++)
 798     {
 799         for (j = i + 1; j < ulCount; j++)
 800         {
 801             if ((ULONG_PTR)ahObj[auiIndices[i]] <
 802                 (ULONG_PTR)ahObj[auiIndices[j]])
 803             {
 804                 tmp = auiIndices[i];
 805                 auiIndices[i] = auiIndices[j];
 806                 auiIndices[j] = tmp;
 807             }
 808         }
 809     }
 810
 811     /* Lock the objects in safe order */
 812     for (i = 0; i < ulCount; i++)
 813     {
 814         /* Skip NULL handles */
 815         if (ahObj[auiIndices[i]] == NULL)
 816         {
 817             apObj[auiIndices[i]] = NULL;
 818             continue;
 819         }
 820
 821         /* Lock the object */
 822         apObj[auiIndices[i]] = GDIOBJ_LockObject(ahObj[auiIndices[i]], objt);
 823
 824         /* Check for failure */
 825         if (apObj[auiIndices[i]] == NULL)
 826         {
 827             /* Cleanup */
 828             while (i--)
 829             {
 830                 if (apObj[auiIndices[i]])
 831                     GDIOBJ_vUnlockObject(apObj[auiIndices[i]]);
 832             }
 833             return FALSE;
 834         }
 835     }
 836
 837     return TRUE;
 838 }
 839
 840 PVOID
 841 NTAPI
 842 GDIOBJ_pvGetObjectAttr(POBJ pobj)
 843 {
 844     ULONG ulIndex = GDI_HANDLE_GET_INDEX(pobj->hHmgr);
 845     return gpentHmgr[ulIndex].pUser;
 846 }
 847
 848 VOID
 849 NTAPI
 850 GDIOBJ_vSetObjectAttr(POBJ pobj, PVOID pvObjAttr)
 851 {
 852     ULONG ulIndex;
 853
 854     ASSERT(pobj->hHmgr);
 855
 856     /* Get the handle index */
 857     ulIndex = GDI_HANDLE_GET_INDEX(pobj->hHmgr);
 858
 859     /* Set pointer to the usermode attribute */
 860     gpentHmgr[ulIndex].pUser = pvObjAttr;
 861 }
 862
 863 VOID
 864 NTAPI
 865 GDIOBJ_vDeleteObject(POBJ pobj)
 866 {
 867     ULONG ulIndex;
 868
 869     /* Set the object's delete flag */
 870     InterlockedOr16((SHORT*)&pobj->BaseFlags, BASEFLAG_READY_TO_DIE);
 871     DBG_LOGEVENT(&pobj->slhLog, EVENT_DELETE, 0);
 872
 873     /* Get the handle index */
 874     ulIndex = GDI_HANDLE_GET_INDEX(pobj->hHmgr);
 875     if (ulIndex)
 876     {
 877         /* Reset the handle valid bit */
 878         InterlockedAnd((LONG*)&gpaulRefCount[ulIndex], ~REF_MASK_VALID);
 879
 880         /* Check if the object is exclusively locked */
 881         if (pobj->cExclusiveLock != 0)
 882         {
 883             /* Reset lock owner and lock count */
 884             pobj->dwThreadId = 0;
 885             pobj->cExclusiveLock = 0;
 886
 887             /* Release the pushlock and reenable APCs */
 888             ExReleasePushLockExclusive(&pobj->pushlock);
 889             KeLeaveCriticalRegion();
 890             DBG_DECREASE_LOCK_COUNT(PsGetCurrentProcessWin32Process(), pobj->hHmgr);
 891         }
 892     }
 893
 894     /* Dereference the object (will take care of deletion) */
 895     GDIOBJ_vDereferenceObject(pobj);
 896 }
 897
 898 BOOL
 899 NTAPI
 900 GreIsHandleValid(HGDIOBJ hobj)
 901 {
 902     PENTRY pentry;
 903
 904     pentry = ENTRY_ReferenceEntryByHandle(hobj, 0);
 905     if (!pentry) return FALSE;
 906     GDIOBJ_vDereferenceObject(pentry->einfo.pobj);
 907     return TRUE;
 908 }
 909
 910 BOOL
 911 NTAPI
 912 GreDeleteObject(HGDIOBJ hobj)
 913 {
 914     PENTRY pentry;
 915
 916     /* Check for stock objects */
 917     if (GDI_HANDLE_IS_STOCKOBJ(hobj))
 918     {
 919         DPRINT1("GreDeleteObject: Cannot delete stock object %p.\n", hobj);
 920         return FALSE;
 921     }
 922
 923     /* Reference the handle entry */
 924     pentry = ENTRY_ReferenceEntryByHandle(hobj, 0);
 925     if (!pentry)
 926     {
 927         DPRINT1("GreDeleteObject: Trying to delete invalid object %p\n", hobj);
 928         return FALSE;
 929     }
 930
 931     /* Check for public owner */
 932     if (pentry->ObjectOwner.ulObj == GDI_OBJ_HMGR_PUBLIC)
 933     {
 934         DPRINT1("GreDeleteObject: Trying to delete global object %p\n", hobj);
 935         GDIOBJ_vDereferenceObject(pentry->einfo.pobj);
 936         return FALSE;
 937     }
 938
 939     /* Delete the object */
 940     GDIOBJ_vDeleteObject(pentry->einfo.pobj);
 941     return TRUE;
 942 }
 943
 944 ULONG
 945 NTAPI
 946 GreGetObjectOwner(HGDIOBJ hobj)
 947 {
 948     ULONG ulIndex, ulOwner;
 949
 950     /* Get the handle index */
 951     ulIndex = GDI_HANDLE_GET_INDEX(hobj);
 952
 953     /* Check if the handle is valid */
 954     if (ulIndex >= GDI_HANDLE_COUNT ||
 955         gpentHmgr[ulIndex].Objt == GDIObjType_DEF_TYPE ||
 956         ((ULONG_PTR)hobj >> 16) != gpentHmgr[ulIndex].FullUnique)
 957     {
 958         DPRINT1("GreGetObjectOwner: invalid handle 0x%p.\n", hobj);
 959         return GDI_OBJ_HMGR_RESTRICTED;
 960     }
 961
 962     /* Get the object owner */
 963     ulOwner = gpentHmgr[ulIndex].ObjectOwner.ulObj;
 964
 965     if (ulOwner == HandleToUlong(PsGetCurrentProcessId()))
 966         return GDI_OBJ_HMGR_POWNED;
 967
 968     if (ulOwner == GDI_OBJ_HMGR_PUBLIC)
 969         return GDI_OBJ_HMGR_PUBLIC;
 970
 971     return GDI_OBJ_HMGR_RESTRICTED;
 972 }
 973
 974 BOOL
 975 NTAPI
 976 GreSetObjectOwner(
 977     HGDIOBJ hobj,
 978     ULONG ulOwner)
 979 {
 980     PENTRY pentry;
 981
 982     /* Check for stock objects */
 983     if (GDI_HANDLE_IS_STOCKOBJ(hobj))
 984     {
 985         DPRINT("GreSetObjectOwner: Got stock object %p\n", hobj);
 986         return FALSE;
 987     }
 988
 989     /* Reference the handle entry */
 990     pentry = ENTRY_ReferenceEntryByHandle(hobj, 0);
 991     if (!pentry)
 992     {
 993         DPRINT("GreSetObjectOwner: Invalid handle 0x%p.\n", hobj);
 994         return FALSE;
 995     }
 996
 997     /* Call internal function */
 998     GDIOBJ_vSetObjectOwner(pentry->einfo.pobj, ulOwner);
 999
1000     /* Dereference the object */
1001     GDIOBJ_vDereferenceObject(pentry->einfo.pobj);
1002
1003     return TRUE;
1004 }
1005
1006 INT
1007 NTAPI
1008 GreGetObject(
1009     IN HGDIOBJ hobj,
1010     IN INT cbCount,
1011     IN PVOID pvBuffer)
1012 {
1013     PVOID pvObj;
1014     UCHAR objt;
1015     INT iResult = 0;
1016
1017     /* Verify object type */
1018     objt = ((ULONG_PTR)hobj >> 16) & 0x1f;
1019     if (objt != GDIObjType_BRUSH_TYPE &&
1020         objt != GDIObjType_SURF_TYPE &&
1021         objt != GDIObjType_LFONT_TYPE &&
1022         objt != GDIObjType_PAL_TYPE)
1023     {
1024         DPRINT1("GreGetObject: Invalid object type\n");
1025         return 0;
1026     }
1027
1028     pvObj = GDIOBJ_ReferenceObjectByHandle(hobj, objt);
1029     if (!pvObj)
1030     {
1031         DPRINT("GreGetObject: Could not lock object\n");
1032         return 0;
1033     }
1034
1035     switch (GDI_HANDLE_GET_TYPE(hobj))
1036     {
1037         case GDILoObjType_LO_PEN_TYPE:
1038         case GDILoObjType_LO_EXTPEN_TYPE:
1039             iResult = PEN_GetObject(pvObj, cbCount, pvBuffer);
1040             break;
1041
1042         case GDILoObjType_LO_BRUSH_TYPE:
1043             iResult = BRUSH_GetObject(pvObj, cbCount, pvBuffer);
1044             break;
1045
1046         case GDILoObjType_LO_BITMAP_TYPE:
1047             iResult = BITMAP_GetObject(pvObj, cbCount, pvBuffer);
1048             break;
1049
1050         case GDILoObjType_LO_FONT_TYPE:
1051             iResult = FontGetObject(pvObj, cbCount, pvBuffer);
1052             break;
1053
1054         case GDILoObjType_LO_PALETTE_TYPE:
1055             iResult = PALETTE_GetObject(pvObj, cbCount, pvBuffer);
1056             break;
1057
1058         default:
1059             DPRINT1("GDI object type of 0x%p not implemented\n", hobj);
1060             break;
1061     }
1062
1063     GDIOBJ_vDereferenceObject(pvObj);
1064     return iResult;
1065 }
1066
1067 W32KAPI
1068 INT
1069 APIENTRY
1070 NtGdiExtGetObjectW(
1071     IN HANDLE hobj,
1072     IN INT cbCount,
1073     OUT LPVOID lpBuffer)
1074 {
1075     INT iRetCount = 0;
1076     INT cbCopyCount;
1077     union
1078     {
1079         BITMAP bitmap;
1080         DIBSECTION dibsection;
1081         LOGPEN logpen;
1082         LOGBRUSH logbrush;
1083         LOGFONTW logfontw;
1084         EXTLOGFONTW extlogfontw;
1085         ENUMLOGFONTEXDVW enumlogfontexdvw;
1086     } object;
1087
1088     /* Normalize to the largest supported object size */
1089     cbCount = min((UINT)cbCount, sizeof(object));
1090
1091     /* Now do the actual call */
1092     iRetCount = GreGetObject(hobj, cbCount, lpBuffer ? &object : NULL);
1093     cbCopyCount = min((UINT)cbCount, (UINT)iRetCount);
1094
1095     /* Make sure we have a buffer and a copy size */
1096     if ((cbCopyCount) && (lpBuffer))
1097     {
1098         /* Enter SEH for buffer transfer */
1099         _SEH2_TRY
1100         {
1101             /* Probe the buffer and copy it */
1102             ProbeForWrite(lpBuffer, cbCopyCount, sizeof(WORD));
1103             RtlCopyMemory(lpBuffer, &object, cbCopyCount);
1104         }
1105         _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
1106         {
1107             /* Clear the return value.
1108              * Do *NOT* set last error here! */
1109             iRetCount = 0;
1110         }
1111         _SEH2_END;
1112     }
1113
1114     /* Return the count */
1115     return iRetCount;
1116 }
1117
1118 W32KAPI
1119 HANDLE
1120 APIENTRY
1121 NtGdiCreateClientObj(
1122     IN ULONG ulType)
1123 {
1124     POBJ pObject;
1125     HANDLE handle;
1126
1127     /* Allocate a new object */
1128     pObject = GDIOBJ_AllocateObject(GDIObjType_CLIENTOBJ_TYPE,
1129                                     sizeof(CLIENTOBJ),
1130                                     BASEFLAG_LOOKASIDE);
1131     if (!pObject)
1132     {
1133         DPRINT1("NtGdiCreateClientObj: Could not allocate a clientobj.\n");
1134         return NULL;
1135     }
1136
1137     /* Mask out everything that would change the type in a wrong manner */
1138     ulType &= (GDI_HANDLE_TYPE_MASK & ~GDI_HANDLE_BASETYPE_MASK);
1139
1140     /* Set the real object type */
1141     pObject->hHmgr = UlongToHandle(ulType | GDILoObjType_LO_CLIENTOBJ_TYPE);
1142
1143     /* Create a handle */
1144     handle = GDIOBJ_hInsertObject(pObject, GDI_OBJ_HMGR_POWNED);
1145     if (!handle)
1146     {
1147         DPRINT1("NtGdiCreateClientObj: Could not create a handle.\n");
1148         GDIOBJ_vFreeObject(pObject);
1149         return NULL;
1150     }
1151
1152     /* Unlock it */
1153     GDIOBJ_vUnlockObject(pObject);
1154
1155     return handle;
1156 }
1157
1158 W32KAPI
1159 BOOL
1160 APIENTRY
1161 NtGdiDeleteClientObj(
1162     IN HANDLE hobj)
1163 {
1164     /* We first need to get the real type from the handle */
1165     ULONG ulType = GDI_HANDLE_GET_TYPE(hobj);
1166
1167     /* Check if it's really a CLIENTOBJ */
1168     if ((ulType & GDI_HANDLE_BASETYPE_MASK) != GDILoObjType_LO_CLIENTOBJ_TYPE)
1169     {
1170         /* FIXME: SetLastError? */
1171         return FALSE;
1172     }
1173
1174     return GreDeleteObject(hobj);
1175 }
1176
1177
1178
1179 PGDI_HANDLE_TABLE GdiHandleTable = NULL;
1180
1181 PGDIOBJ NTAPI
1182 GDIOBJ_ShareLockObj(HGDIOBJ hObj, DWORD ExpectedType)
1183 {
1184     if (ExpectedType == GDI_OBJECT_TYPE_DONTCARE)
1185         ExpectedType = GDI_HANDLE_GET_TYPE(hObj);
1186     return GDIOBJ_ReferenceObjectByHandle(hObj, (ExpectedType >> 16) & 0x1f);
1187 }
1188
1189 // This function is not safe to use with concurrent deleting attempts
1190 // That shouldn't be a problem, since we don't have any processes yet,
1191 // that could delete the handle
1192 BOOL
1193 NTAPI
1194 GDIOBJ_ConvertToStockObj(HGDIOBJ *phObj)
1195 {
1196     PENTRY pentry;
1197     POBJ pobj;
1198
1199     /* Reference the handle entry */
1200     pentry = ENTRY_ReferenceEntryByHandle(*phObj, 0);
1201     if (!pentry)
1202     {
1203         DPRINT1("GDIOBJ: Requested handle 0x%p is not valid.\n", *phObj);
1204         return FALSE;
1205     }
1206
1207     /* Update the entry */
1208     pentry->FullUnique |= GDI_ENTRY_STOCK_MASK;
1209     pentry->ObjectOwner.ulObj = 0;
1210
1211     /* Get the pointer to the BASEOBJECT */
1212     pobj = pentry->einfo.pobj;
1213
1214     /* Calculate the new handle */
1215     pobj->hHmgr = (HGDIOBJ)((ULONG_PTR)pobj->hHmgr | GDI_HANDLE_STOCK_MASK);
1216
1217     /* Return the new handle */
1218     *phObj = pobj->hHmgr;
1219
1220     /* Dereference the handle */
1221     GDIOBJ_vDereferenceObject(pobj);
1222
1223     return TRUE;
1224 }
1225
1226 POBJ NTAPI
1227 GDIOBJ_AllocObjWithHandle(ULONG ObjectType, ULONG cjSize)
1228 {
1229     POBJ pobj;
1230     FLONG fl = 0;
1231     UCHAR objt = (ObjectType >> 16) & 0xFF;
1232
1233     if ((objt == GDIObjType_DC_TYPE && cjSize == sizeof(DC)) ||
1234         (objt == GDIObjType_PAL_TYPE && cjSize == sizeof(PALETTE)) ||
1235         (objt == GDIObjType_RGN_TYPE && cjSize == sizeof(REGION)) ||
1236         (objt == GDIObjType_SURF_TYPE && cjSize == sizeof(SURFACE)) ||
1237         (objt == GDIObjType_PATH_TYPE && cjSize == sizeof(PATH)))
1238     {
1239         fl |= BASEFLAG_LOOKASIDE;
1240     }
1241
1242     pobj = GDIOBJ_AllocateObject(objt, cjSize, fl);
1243     if (!GDIOBJ_hInsertObject(pobj, GDI_OBJ_HMGR_POWNED))
1244     {
1245         GDIOBJ_vFreeObject(pobj);
1246         return NULL;
1247     }
1248     return pobj;
1249 }
1250
1251 PVOID NTAPI
1252 GDI_MapHandleTable(PEPROCESS pProcess)
1253 {
1254     PVOID pvMappedView = NULL;
1255     NTSTATUS Status;
1256     LARGE_INTEGER liOffset;
1257     ULONG cjViewSize = sizeof(GDI_HANDLE_TABLE);
1258
1259     liOffset.QuadPart = 0;
1260
1261     ASSERT(gpvGdiHdlTblSection != NULL);
1262     ASSERT(pProcess != NULL);
1263
1264     Status = MmMapViewOfSection(gpvGdiHdlTblSection,
1265                                 pProcess,
1266                                 &pvMappedView,
1267                                 0,
1268                                 0,
1269                                 &liOffset,
1270                                 &cjViewSize,
1271                                 ViewUnmap,
1272                                 SEC_NO_CHANGE,
1273                                 PAGE_READONLY);
1274
1275     if (!NT_SUCCESS(Status))
1276         return NULL;
1277
1278     return pvMappedView;
1279 }
1280
1281 BOOL NTAPI
1282 GDI_CleanupForProcess(struct _EPROCESS *Process)
1283 {
1284     PENTRY pentry;
1285     ULONG ulIndex;
1286     DWORD dwProcessId;
1287     PPROCESSINFO ppi;
1288
1289     DPRINT("CleanupForProcess prochandle %x Pid %d\n",
1290            Process, Process->UniqueProcessId);
1291
1292     ASSERT(Process == PsGetCurrentProcess());
1293
1294     /* Get the current process Id */
1295     dwProcessId = PtrToUlong(PsGetCurrentProcessId());
1296
1297     /* Loop all handles in the handle table */
1298     for (ulIndex = RESERVE_ENTRIES_COUNT; ulIndex < gulFirstUnused; ulIndex++)
1299     {
1300         pentry = &gpentHmgr[ulIndex];
1301
1302         /* Check if the object is owned by the process */
1303         if (pentry->ObjectOwner.ulObj == dwProcessId)
1304         {
1305             ASSERT(pentry->einfo.pobj->cExclusiveLock == 0);
1306
1307             /* Reference the object and delete it */
1308             InterlockedIncrement((LONG*)&gpaulRefCount[ulIndex]);
1309             GDIOBJ_vDeleteObject(pentry->einfo.pobj);
1310         }
1311     }
1312
1313 #if DBG
1314 //#ifdef GDI_DEBUG
1315         DbgGdiHTIntegrityCheck();
1316 //#endif
1317 #endif
1318
1319     ppi = PsGetCurrentProcessWin32Process();
1320     DPRINT("Completed cleanup for process %d\n", Process->UniqueProcessId);
1321     if (ppi->GDIHandleCount != 0)
1322     {
1323         DPRINT1("Leaking %d handles!\n", ppi->GDIHandleCount);
1324         ASSERT(FALSE);
1325     }
1326
1327     /* Loop all handles in the handle table */
1328     for (ulIndex = RESERVE_ENTRIES_COUNT; ulIndex < gulFirstUnused; ulIndex++)
1329     {
1330         pentry = &gpentHmgr[ulIndex];
1331
1332         /* Check if the object is owned by the process */
1333         if (pentry->ObjectOwner.ulObj == dwProcessId)
1334         {
1335             DPRINT1("Leaking object. Index=%lx, type=0x%x, refcount=%lx\n",
1336                     ulIndex, pentry->Objt, gpaulRefCount[ulIndex]);
1337             DBG_DUMP_EVENT_LIST(&pentry->einfo.pobj->slhLog);
1338             //DBG_CLEANUP_EVENT_LIST(&pentry->einfo.pobj->slhLog);
1339             ASSERT(FALSE);
1340         }
1341     }
1342
1343     return TRUE;
1344 }
1345
1346 /* EOF */