ESERVERSILO_GLOBALS

The ESERVERSILO_GLOBALS (formally _ESERVERSILO_GLOBALS) holds the essence of system state that is presented differently to software in the corresponding server silo.

Variability

The ESERVERSILO_GLOBALS is highly susceptible to changing between builds. The following changes of size give some rough indication:

Much of the expansion for Version 1607 came ultimately from one change. Earlier versions provide for arbitrary callers to obtain storage for their own context to associate with each server silo. The kernel used this internally to support the ETW_SILODRIVERSTATE, OBP_SILODRIVERSTATE, SEP_RM_LSA_CONNECTION_STATE, SEP_SILOSTATE and WNF_SILODRIVERSTATE structures as per-silo state for specialised purposes. Version 1607 moved all these, or at least a pointer to them, into the ESERVERSILO_GLOBALS as if built-in.

Layout

The sizes in the preceding table and the offsets, names and types in the next are from NTOSP.H for the first two releases of Windows 10 and are thereafter from type information in public symbol files for the kernel.

ULONG ServiceSessionId;

UNICODE_STRING SiloRootDirectoryName;

HANDLE SiloRootDirectoryHandle;

ULONG HardErrorState;

EPROCESS *ExpDefaultErrorPortProcess;

HANDLE ExpDefaultErrorPort;

EPROCESS *MiSessionLeaderProcess;

PVOID *MonitorContextArray;

ULONG MonitorContextArrayLength;

In the first draft of support for server silos, calling PsRegisterMonitorServerSilo to register as a monitor of server silos creates a SERVER_SILO_MONITOR structure and allocates to it a slot in ever server silo’s MonitorContextArray. The monitor may then call PsAllocateMonitorContextServerSilo to obtain storage whose address the function puts into the monitor’s slot of a given server silo’s MonitorContextArray.

Version 1607 reworked this, arguably for better. The MonitorContextArray goes away but the structures that the kernel itself used to insert as monitor contexts were neither thrown away nor adapted to the replacement interface. They were instead absorbed into a reworked ESERVERSILO_GLOBALS:

OBP_SILODRIVERSTATE ObSiloState;

SEP_SILOSTATE SeSiloState;

SEP_RM_LSA_CONNECTION_STATE SeRmSiloState;

ETW_SILODRIVERSTATE *EtwSiloState;

EPROCESS *MiSessionLeaderProcess;

EPROCESS *ExpDefaultErrorPortProcess;

HANDLE ExpDefaultErrorPort;

ULONG HardErrorState;

EXP_LICENSE_STATE *ExpLicenseState;

WNF_SILODRIVERSTATE WnfSiloState;

DBGK_SILOSTATE DbgkSiloState;

UNICODE_STRING PsProtectedCurrentDirectory;

UNICODE_STRING PsProtectedEnvironment;

PVOID ApiSetSection;

PVOID ApiSetSchema;

BOOLEAN OneCoreForwardersEnabled;

UNICODE_STRING NtSystemRoot;

UNICODE_STRING SiloRootDirectoryName;

PSP_STORAGE *Storage;

WORK_QUEUE_ITEM TerminateWorkItem;

SERVERSILO_STATE State;

COMPARTMENT_ID DefaultCompartmentId;

NTSTATUS ExitStatus;

PVOID SystemProcessSecurityPort;

KEVENT *DeleteEvent;

SILO_USER_SHARED_DATA UserSharedData;

SILO_USER_SHARED_DATA *UserSharedData;

PVOID UserSharedSection;

EX_WORK_QUEUE_ITEM TerminateWorkItem;

BOOLEAN IsDownlevelContainer;