[ros-kernel] Shutdown/logoff

[KJK::Hyperion]

At 17.15 03/07/2004, you wrote:
>- App (usually explorer) calls ExitWindowsEx()
>- ExitWindowsEx() sends a message to CSRSS

ExitWindowsEx is almost surely a kernel-mode API, because the caller needs 
WINSTA_EXITWINDOWS access to its associated window station. Once this is 
verified, the kernel calls CSRSS

>- CSRSS sends all top-level windows WM_QUERYENDSESSION and WM_ENDSESSION 
>messages with timeout

... on all desktops of the affected window station. And it sends a 
CTRL_LOGOFF_EVENT to all the consoles. services.exe runs in a console too, 
and all the services and their non-detached child processes share it

>- WinLogon notices the shell terminated and asks CSRSS about the 
>ExitWindowsEx() options

keep in mind Winlogon is a state machine. What it actually does is entering 
a "pending log-out" state. Once CSRSS confirms that no non-service 
application is alive. It must know: they all call to it on startup, and the 
SCM registers in a special way to be "spared" at logoff together with its 
descendants. That's why the secondary logon service (runas) runs its 
sub-processes in a job: CSRSS won't try too hard to terminate them, so 
seclogon has to clean up after itself

>- If ExitWindowsEx() was called with EWX_LOGOFF a new login session is started

from "pending log-out" state to "log-out" state to "log-in"

>- else we need to shutdown/reboot, WinLogon does this by calling 
>NtShutdownSystem

easy there, hotshot. We need to stop services first. I'd say CSRSS shuts 
the SCM down, because it's CSRSS who the SCM registers with. The question 
is: how the heck do Winlogon and CSRSS communicate? how does Winlogon know 
about the state changes? what does it receive from win32k and what from 
CSRSS? and how?

>Is my global picture correct? Who terminates stubborn processes which 
>won't die, is that handled by CSRSS or by WinLogon?

CSRSS, definitely