Kernel Objects and Data Structures

Drivers depend on various kernel objects and data structures. These objects and data structures are managed by the Windows kernel and encapsulate various system resources such as devices, I/O requests, threads, events, and so on.

• Objects Objects are managed by the object manager and are reference counted. For example, \KernelObjects\LowMemoryCondition is a standard event object that signals when free memory is low. Process and thread objects are also managed by the object manager. Many objects can have handles that can be obtained by applications and used to manipulate the object.

• Data structures Much of the data that drivers use is in the form of data structures that the kernel manages. Although they are not objects in the same sense as \KernelObjects\LowMemoryCondition, these data structures are often referred to as objects and presented in an object-like way. For example, drivers must often use methods to manipulate at least some aspects of kernel data structures. A commonly used example of a kernel data structure is the I/O request packet (IRP), which is used to communicate I/O and related requests to a device stack.

 Tip  See "Object Management" in the WDK for information about named objects-online at http://go.microsoft.com/fwlink/?LinkId=82272.