Discretionary access control list
A discretionary ACL is part of the security descriptor for an object. It can be applied to a newly created object in order to constrain access to the object. See also ACE, access right, ACL and security descriptor.
Directory control block
An internal NT file system structure in which a file system maintains state for an open instance of a directory file.
A runtime error condition that occurs when two threads of execution are blocked, each waiting to acquire a resource that the other holds, and both unable to continue running.
A part of a device object whose size is determined when a driver creates the device object and whose internal structure and contents are driver-defined. For many NT drivers, a device extension is the driver’s major and only global data-storage area, used to maintain device state and to contain any system-defined objects and other data that the driver writer decides to use.
A kernel-mode-only, I/O Manager-defined object type, used to represent a physical, logical, or virtual device whose driver has been loaded into the system. Each driver calls IoCreateDevice to initialize a device object for each such device that driver services. An unnamed device object is invisible outside the creating driver. See also device extension and driver object.
Devices are “visible” to end users as named file objects, stored in a directory protected against careless or malicious user-mode access. User-mode code (protected subsystems) must access any device through the opaque handle returned by the system service that opens the file object that represents the device.
A kernel-mode-only, Kernel-defined control object type, used to queue I/O requests for subsequent processing. A device queue object has an associated executive spin lock and a state (Busy or Not-Busy).
An I/O request, called a “queue entry,” is not actually placed in the queue unless the state of the device queue object is already Busy:
·On the transition from Not-Busy to Busy, the driver is expected to service the queue entry immediately because that entry is not queued.
·Subsequent requests while the state is Busy are queued in FIFO or key-sorted order.
·An attempt to remove a queue entry from an empty queue causes the transition from Busy to Not-Busy.
·An attempt to remove a queue entry from an empty queue when the state is Not-Busy is a programming error, which causes the system to “bugcheck” (i.e., crash) in a checked build.
A file that points to or lists a set of named file objects.
Note that on-disk directory files are represented in NT as file objects, not as object directory objects. See also file object and object directory object.
See object directory object.
Device interrupt request level
The IRQL at which a given device interrupts. See also IRQL and IDT
For a thread at any given moment, one of the following:
Initialized
Ready – queued and eligible for dispatch to a processor
Standby – ready and selected to execute, but a context switch to the thread has not yet occurred
Running
Waiting – suspended until a particular dispatcher object is set to the Signaled state
Terminated
A class of Kernel-defined object types, used to manage dispatching and synchronization. See also control objects.
Dispatcher objects have a state (either Signaled or Not-Signaled), and are arguments to the wait services or Kernel wait routines (KeWaitXxx). Dispatcher objects include: events, (kernel-mode-only) mutexes, queues, semaphores, threads, and timers.
Kernel-mode threads synchronize their operations by waiting on one or more dispatcher objects, or by waiting on other objects, such as user-mode file objects, that contain “hidden” kernel-mode dispatcher objects.
It is a fatal error to wait on a dispatcher object at IRQL >= DISPATCH_LEVEL.
Direct memory access
A method of transferring data between a device and main memory without intervention by the CPU. DMA is handled by the device itself (bus-mastering or first-party DMA) or by a DMA controller chip in the system (third-party DMA).
Deferred procedure call
A DPC is a Kernel-defined control object type, representing a procedure that is to be called later. DPCs are executed in kernel mode at IRQL DISPATCH_LEVEL. See also IDT and IRQL.
A DPC is primarily used when an ISR, such as a clock ISR or device driver’s interrupt service routine, needs to perform more work but should do so at a lower IRQL than the one at which an ISR executes. Note that getting the IRQL lowered back down quickly is important for overall system response time. The ISR, then, can request that a procedure be executed at a lower IRQL at a later time.
The Kernel queues DPC objects in a DPC queue, and other executive components and drivers queue their DPCs by calling Kernel-supplied support routines. When a DPC queue entry is dequeued, the Kernel calls the procedure.
A kernel-mode-only object representing an NT driver’s load image, used by the I/O Manager to locate certain entry points in the driver.