add a realtime scheduler class and priority-inheritance mutexes with timeouts and abandonment, add an HDA audio driver and a SYS_AUDIO_* syscall family, flesh out kernel32 with Win32 threads, events, mutexes, critical sections, and condition variables, add SYS_RESUME_THREAD for suspended thread creation, add KeInitializeMemoryTypes to reprogram MTRRs and install a canonical PAT for WB/WC/UC control, rework the display pipeline with a pitched present path and console output flush, bring back disk.vhd with mtools since vvfat fucking sucks, harden AHCI with serialized cache flush, USB mass storage with SCSI sense-data decoding, and xHCI with cleaner DMA teardown, fix the last stray for(;;) in HalStopProcessor to while(true), pile on smoke tests for audio, win32 sync primitives, and thread suspend, implement AHCI timeout, kill readahead since it was desperetaly trying to murder me, fix doom sound x2.

code/public/ntlite/ddk/audio.h

@@ -0,0 +1,105 @@
+// Public nt-lite kernel-audio provider declarations.
+
+#pragma once
+
+#include <stddef.h>
+#include <stdint.h>
+#include <ntlite/status.h>
+
+struct DEVICE_OBJECT;
+typedef struct IO_AUDIO_ENDPOINT IO_AUDIO_ENDPOINT;
+
+// Identifies one logical render destination rather than one codec pin.
+typedef enum IO_AUDIO_ENDPOINT_KIND {
+    IoAudioEndpointLineOut = 1,
+    IoAudioEndpointSpeakerHeadphone,
+    IoAudioEndpointOtherAnalog
+} IO_AUDIO_ENDPOINT_KIND;
+
+// Identifies the canonical interleaved PCM sample representation.
+typedef enum IO_AUDIO_SAMPLE_FORMAT {
+    IoAudioSampleS16 = 1
+} IO_AUDIO_SAMPLE_FORMAT;
+
+// Describes interleaved PCM frames.
+typedef struct IO_AUDIO_FORMAT {
+    uint32_t SampleRate;
+    uint16_t ChannelCount;
+    uint16_t SampleFormat;
+} IO_AUDIO_FORMAT;
+
+#define IO_AUDIO_ENDPOINT_CAP_JACK_SENSE     0x00000001u
+#define IO_AUDIO_ENDPOINT_CAP_HARDWARE_GAIN  0x00000002u
+#define IO_AUDIO_ENDPOINT_CAP_VALID_MASK     0x00000003u
+
+// Bounds provider-advertised hardware gain ranges in millidecibels.
+#define IO_AUDIO_HARDWARE_GAIN_LIMIT_MILLIDB 200000
+
+// Distinguishes orderly teardown from surprise removal where registers may no longer be accessible.
+typedef enum IO_AUDIO_REMOVAL_MODE {
+    IoAudioOrderlyRemoval = 1,
+    IoAudioSurpriseRemoval
+} IO_AUDIO_REMOVAL_MODE;
+
+#define IO_AUDIO_FAILURE_HARDWARE_INACCESSIBLE 0x00000001u
+#define IO_AUDIO_FAILURE_VALID_MASK             0x00000001u
+
+// Provider operations are invoked only at PASSIVE_LEVEL by the endpoint mixer thread.
+typedef struct IO_AUDIO_PROVIDER_OPERATIONS {
+    // Starts DMA only after the ring contains at least two prepared periods.
+    // Failure must leave the provider stopped; Stop may still be called for partial-start cleanup.
+    KSTATUS (*Start)(void* providerContext);
+    // Stops DMA before unregister permits provider storage to be released.
+    void (*Stop)(void* providerContext);
+    // Applies endpoint gain and mute only with IO_AUDIO_ENDPOINT_CAP_HARDWARE_GAIN.
+    KSTATUS (*SetGain)(void* providerContext, int32_t gainMilliDb, uint8_t muted);
+} IO_AUDIO_PROVIDER_OPERATIONS;
+
+// Registers one fixed-format render ring owned by a hardware provider.
+// The provider must keep DMA stopped and the physical output muted until Start is called.
+typedef struct IO_AUDIO_ENDPOINT_REGISTRATION {
+    struct DEVICE_OBJECT* Device;
+    IO_AUDIO_ENDPOINT_KIND Kind;
+    uint32_t Capabilities;
+    uint8_t InitiallyAvailable;
+    void* ProviderContext;
+    IO_AUDIO_PROVIDER_OPERATIONS Operations;
+    void* PeriodBuffer;
+    size_t PeriodBufferBytes;
+    uint32_t PeriodCount;
+    uint32_t FramesPerPeriod;
+    size_t PeriodStrideBytes;
+    IO_AUDIO_FORMAT HardwareFormat;
+    // Gain fields must be zero unless IO_AUDIO_ENDPOINT_CAP_HARDWARE_GAIN is present.
+    int32_t HardwareGainMinimumMilliDb;
+    int32_t HardwareGainMaximumMilliDb;
+    uint32_t HardwareGainStepMilliDb;
+} IO_AUDIO_ENDPOINT_REGISTRATION;
+
+// Driver-visible services for registering and advancing kernel audio endpoints.
+typedef struct NTL_DDK_AUDIO {
+    // Registers one endpoint and returns a provider-owned reference valid until unregister returns.
+    KSTATUS (*RegisterEndpoint)(const IO_AUDIO_ENDPOINT_REGISTRATION* registration,
+                                IO_AUDIO_ENDPOINT** outEndpoint);
+
+    // Stops the endpoint, removes it from enumeration, and consumes the provider-owned reference.
+    void (*UnregisterEndpoint)(IO_AUDIO_ENDPOINT* endpoint, IO_AUDIO_REMOVAL_MODE mode);
+
+    // Reports one completed hardware period from ISR/DPC completion processing.
+    // presentedFrames, hardwarePositionFrames, and interruptCount must be monotonic for the
+    // endpoint lifetime. timestampTicks uses the DDK monotonic microsecond source.
+    void (*NotifyPeriod)(IO_AUDIO_ENDPOINT* endpoint,
+                         uint32_t completedPeriodIndex,
+                         uint64_t presentedFrames,
+                         uint64_t hardwarePositionFrames,
+                         uint64_t interruptCount,
+                         uint64_t timestampTicks);
+
+    // Updates jack-derived endpoint availability without changing endpoint identity.
+    void (*SetEndpointAvailable)(IO_AUDIO_ENDPOINT* endpoint, uint8_t available);
+
+    // Fails an endpoint and wakes every stream owner.
+    void (*ReportEndpointFailure)(IO_AUDIO_ENDPOINT* endpoint,
+                                  KSTATUS status,
+                                  uint32_t flags);
+} NTL_DDK_AUDIO;

code/public/ntlite/ddk/ddk.h

@@ -4,7 +4,9 @@
 
 #include <stdint.h>
 #include <ntlite/ddk/async.h>
+#include <ntlite/ddk/audio.h>
 #include <ntlite/ddk/debug.h>
+#include <ntlite/ddk/dma.h>
 #include <ntlite/ddk/display.h>
 #include <ntlite/ddk/dpc.h>
 #include <ntlite/ddk/driver.h>
@@ -25,12 +27,14 @@
 #include <ntlite/ddk/time.h>
 #include <ntlite/ddk/timer.h>
 
-#define NTL_DDK_VERSION 2u
+#define NTL_DDK_VERSION 1u
 
 // Root DDK table passed to kernel drivers by the driver loader.
 typedef struct NTL_DDK {
     uint32_t Version;
     const NTL_DDK_DEBUG* Debug;
+    const NTL_DDK_AUDIO* Audio;
+    const NTL_DDK_DMA* Dma;
     const NTL_DDK_INTERRUPT* Interrupt;
     const NTL_DDK_MEMORY* Memory;
     const NTL_DDK_PLATFORM* Platform;

code/public/ntlite/ddk/debug.h

@@ -2,11 +2,29 @@
 
 #pragma once
 
+#include <stdint.h>
 #include <ntlite/status.h>
 
+#define KE_DEBUG_CONSOLE          0x00000001u
+#define KE_DEBUG_SELFTEST         0x00000002u
+#define KE_DEBUG_FILE_LOG         0x00000004u
+#define KE_DEBUG_POOL_CANARY      0x00000008u
+#define KE_DEBUG_POOL_POISON      0x00000010u
+#define KE_DEBUG_POOL_QUARANTINE  0x00000020u
+#define KE_DEBUG_POOL_CALLERS     0x00000040u
+#define KE_DEBUG_DISPLAY_ASSERTS  0x00000080u
+#define KE_DEBUG_DISPLAY_TRACE    0x00000100u
+#define KE_DEBUG_INPUT_TRACE      0x00000200u
+#define KE_DEBUG_VM_ASSERTS       0x00000400u
+#define KE_DEBUG_SYSCALL_ASSERTS  0x00000800u
+#define KE_DEBUG_LIST_CHECKS      0x00001000u
+#define KE_DEBUG_AUDIO            0x00002000u
+#define KE_DEBUG_AUDIO_SELFTEST   0x00004000u
+
 // Driver-visible debug output service table passed through NTL_DDK.
 typedef struct NTL_DDK_DEBUG {
     void (*Print)(const char* fmt, ...);
+    uint32_t (*GetFlags)(void);
 } NTL_DDK_DEBUG;
 
 // Current fatal categories used by kernel-mode driver diagnostics.

code/public/ntlite/ddk/display.h

@@ -21,6 +21,8 @@ typedef struct KE_DISPLAY_INFO {
     DISPLAY_MODE Mode;
     uint32_t Caps;
     uint32_t DeviceCount;
+    uint32_t Flags;
+    uint32_t Reserved;
     DISPLAY_STATS ManagerStats;
     DISPLAY_STATS DeviceStats;
 } KE_DISPLAY_INFO;
@@ -40,10 +42,9 @@ DISPLAY_API KSTATUS KeDisplayGetMode(DISPLAY_MODE* outMode);
 // Queries the current display size.
 DISPLAY_API KSTATUS KeDisplayGetSize(int* outWidth, int* outHeight);
 
-typedef KSTATUS (*KE_DISPLAY_ROW_SOURCE)(void* context, int rowIndex, uint32_t* scratch, size_t pixelCount);
-
 DISPLAY_API KSTATUS KeDisplayBlit(int x, int y, int w, int h, const uint32_t* pixels);
-DISPLAY_API KSTATUS KeDisplayBlitRows(int x, int y, int w, int h, KE_DISPLAY_ROW_SOURCE source, void* context, uint32_t* scratch);
+DISPLAY_API KSTATUS KeDisplayBlitPitched(int x, int y, int w, int h, const uint32_t* pixels, uint32_t pitchBytes);
+DISPLAY_API KSTATUS KeDisplayPresentPitched(int x, int y, int w, int h, const uint32_t* pixels, uint32_t pitchBytes);
 DISPLAY_API KSTATUS KeDisplayFillRect(int x, int y, int w, int h, uint32_t color);
 DISPLAY_API KSTATUS KeDisplayClear(uint32_t color);
 DISPLAY_API KSTATUS KeDisplayCopyRect(int dstX, int dstY, int srcX, int srcY, int w, int h);

code/public/ntlite/ddk/dma.h

@@ -0,0 +1,146 @@
+// Public nt-lite DMA declarations.
+
+#pragma once
+
+#include <stddef.h>
+#include <stdint.h>
+#include <ntlite/status.h>
+
+struct DEVICE_OBJECT;
+struct PROCESS;
+typedef struct IO_DMA_ADAPTER IO_DMA_ADAPTER;
+typedef struct IO_DMA_BUFFER IO_DMA_BUFFER;
+typedef struct IO_DMA_MAPPING IO_DMA_MAPPING;
+typedef struct MM_PINNED_MEMORY MM_PINNED_MEMORY;
+
+typedef enum IO_DMA_DIRECTION {
+    IoDmaToDevice = 1,
+    IoDmaFromDevice,
+    IoDmaBidirectional
+} IO_DMA_DIRECTION;
+
+// Fails a streaming mapping instead of allocating a bounce buffer.
+#define IO_DMA_MAP_NO_BOUNCE 0x00000001u
+
+// Describes immutable constraints shared by one device adapter. Address,
+// alignment, and boundary limits apply to common buffers. Segment limits apply
+// to streaming mappings. Zero selects the unconstrained default for each field.
+typedef struct IO_DMA_REQUIREMENTS {
+    uint64_t MaximumDeviceAddress;
+    size_t Alignment;
+    size_t Boundary;
+    size_t MaximumSegmentLength;
+    uint32_t MaximumSegments;
+} IO_DMA_REQUIREMENTS;
+
+// Describes one device-visible span in a streaming mapping.
+typedef struct IO_DMA_SEGMENT {
+    uint64_t DeviceAddress;
+    size_t Length;
+} IO_DMA_SEGMENT;
+
+// Reports cumulative activity and live ownership for validation.
+typedef struct IO_DMA_STATS {
+    uint64_t AdaptersCreated;
+    uint64_t AdaptersDestroyed;
+    uint64_t AdaptersInUse;
+    uint64_t CommonBuffersAllocated;
+    uint64_t CommonBuffersFreed;
+    uint64_t CommonBuffersInUse;
+    uint64_t CommonBufferBytesInUse;
+    uint64_t PinnedKernelRanges;
+    uint64_t PinnedUserRanges;
+    uint64_t PinnedRangesReleased;
+    uint64_t PinnedRangesInUse;
+    uint64_t PinnedPagesInUse;
+    uint64_t StreamingMappings;
+    uint64_t StreamingMappingsUnmapped;
+    uint64_t StreamingMappingsInUse;
+    uint64_t DirectMappings;
+    uint64_t BounceMappings;
+    uint64_t BounceBytesCopiedToDevice;
+    uint64_t BounceBytesCopiedToCpu;
+    uint64_t FailedAllocations;
+    uint64_t FailedMappings;
+} IO_DMA_STATS;
+
+// Driver-visible DMA services. Device addresses are intentionally distinct
+// from physical addresses even while the first implementation maps them one to
+// one on x86-64.
+typedef struct NTL_DDK_DMA {
+    // Returns the one adapter and requirement set owned by a device object.
+    KSTATUS (*GetAdapter)(struct DEVICE_OBJECT* device,
+                          const IO_DMA_REQUIREMENTS* requirements,
+                          IO_DMA_ADAPTER** outAdapter);
+
+    // Releases one caller-owned adapter reference.
+    void (*PutAdapter)(IO_DMA_ADAPTER* adapter);
+
+    // Allocates coherent memory with stable CPU and base device addresses. The
+    // caller must quiesce every device reference before releasing the buffer.
+    KSTATUS (*AllocateCommonBuffer)(IO_DMA_ADAPTER* adapter,
+                                    size_t size,
+                                    size_t alignment,
+                                    IO_DMA_BUFFER** outBuffer);
+
+    // Releases a coherent common buffer.
+    void (*FreeCommonBuffer)(IO_DMA_BUFFER* buffer);
+
+    // Returns the stable CPU address of a common buffer.
+    void* (*GetCommonBufferAddress)(const IO_DMA_BUFFER* buffer);
+
+    // Returns the stable device address of a common buffer.
+    uint64_t (*GetCommonBufferDeviceAddress)(const IO_DMA_BUFFER* buffer);
+
+    // Returns the caller-requested size of a common buffer.
+    size_t (*GetCommonBufferSize)(const IO_DMA_BUFFER* buffer);
+
+    // Stabilizes a kernel range for one or more streaming mappings. Pinning
+    // preserves the pages, but does not transfer ownership to a device.
+    KSTATUS (*PinKernelMemory)(void* address,
+                               size_t size,
+                               IO_DMA_DIRECTION direction,
+                               MM_PINNED_MEMORY** outMemory);
+
+    // Stabilizes a process-owned user range for one or more mappings. The
+    // descriptor retains the process and range until the final unpin.
+    KSTATUS (*PinUserMemory)(struct PROCESS* process,
+                             void* address,
+                             size_t size,
+                             IO_DMA_DIRECTION direction,
+                             MM_PINNED_MEMORY** outMemory);
+
+    // Releases one pinned-memory reference after all mappings leave.
+    void (*UnpinMemory)(MM_PINNED_MEMORY* memory);
+
+    // Maps a pinned subrange and creates a constrained segment list. A new
+    // mapping begins CPU-owned and requires external operation serialization.
+    KSTATUS (*MapPinnedMemory)(IO_DMA_ADAPTER* adapter,
+                               MM_PINNED_MEMORY* memory,
+                               size_t offset,
+                               size_t length,
+                               IO_DMA_DIRECTION direction,
+                               uint32_t flags,
+                               IO_DMA_MAPPING** outMapping);
+
+    // Releases a mapping and performs a final receive-side bounce copy only
+    // when ownership was transferred to the device and not returned to the CPU.
+    void (*UnmapMemory)(IO_DMA_MAPPING* mapping);
+
+    // Transfers mapping ownership from the CPU to the device. Streaming DMA
+    // must not begin before this operation succeeds.
+    KSTATUS (*SynchronizeForDevice)(IO_DMA_MAPPING* mapping);
+
+    // Transfers mapping ownership from the device to the CPU. CPU readers must
+    // not consume receive data before this operation succeeds.
+    KSTATUS (*SynchronizeForCpu)(IO_DMA_MAPPING* mapping);
+
+    // Returns the immutable segment count owned by a mapping.
+    uint32_t (*GetSegmentCount)(const IO_DMA_MAPPING* mapping);
+
+    // Returns the immutable segment array owned by a mapping.
+    const IO_DMA_SEGMENT* (*GetSegments)(const IO_DMA_MAPPING* mapping);
+
+    // Copies current DMA counters into caller-owned storage.
+    void (*QueryStats)(IO_DMA_STATS* outStats);
+} NTL_DDK_DMA;

code/public/ntlite/ddk/file.h

@@ -59,6 +59,7 @@ typedef struct IO_FILESYSTEM {
     KSTATUS (*QueryInfo)(struct IO_FILESYSTEM* fs, void* fileCtx, SYS_FILE_STAT* out);
     KSTATUS (*Stat)(struct IO_FILESYSTEM* fs, SYS_STRING_VIEW path, SYS_FILE_STAT* out);
     KSTATUS (*QueryIdentity)(struct IO_FILESYSTEM* fs, void* fileCtx, IO_FILE_IDENTITY* out);
+    KSTATUS (*Flush)(struct IO_FILESYSTEM* fs, void* fileCtx);
     void (*Close)(struct IO_FILESYSTEM* fs, void* fileCtx);
     void (*QueryStats)(struct IO_FILESYSTEM* fs, IO_FILESYSTEM_STATS* out);
     void* DriverCtx;
@@ -84,10 +85,6 @@ typedef struct FILE_OBJECT {
     uint64_t Size;
     uint64_t Offset;
     uint32_t Flags;
-    uint32_t ReadaheadScore;
-    uint64_t ReadaheadNextOffset;
-    uint64_t ReadaheadIssuedUntil;
-    uint64_t ReadaheadSuppressedUntil;
 } FILE_OBJECT;
 
 typedef struct DIR_OBJECT {

code/public/ntlite/ddk/irp.h

@@ -23,11 +23,12 @@ typedef enum IO_MAJOR_FUNCTION {
     IRP_MJ_CLOSE                   = 1,
     IRP_MJ_READ                    = 2,
     IRP_MJ_WRITE                   = 3,
-    IRP_MJ_DEVICE_CONTROL          = 4,
-    IRP_MJ_INTERNAL_DEVICE_CONTROL = 5,
-    IRP_MJ_PNP                     = 6,
-    IRP_MJ_POWER                   = 7,
-    IRP_MJ_MAXIMUM_FUNCTION        = 8,
+    IRP_MJ_FLUSH_BUFFERS           = 4,
+    IRP_MJ_DEVICE_CONTROL          = 5,
+    IRP_MJ_INTERNAL_DEVICE_CONTROL = 6,
+    IRP_MJ_PNP                     = 7,
+    IRP_MJ_POWER                   = 8,
+    IRP_MJ_MAXIMUM_FUNCTION        = 9,
 } IO_MAJOR_FUNCTION;
 
 // PnP minor functions.
@@ -159,10 +160,10 @@ __declspec(dllexport) void IrpQueueEnqueue(IRP_QUEUE* q, IRP* irp);
 __declspec(dllexport) IRP* IrpQueueDequeue(IRP_QUEUE* q);
 
 // Cancels every IRP in a queue and invokes a callback for each one.
-__declspec(dllexport) void IrpQueueCancelAllEx(IRP_QUEUE* q,
-                                               KSTATUS status,
-                                               IRP_QUEUE_CANCEL_CALLBACK callback,
-                                               void* context);
+__declspec(dllexport) void IrpQueueCancelAllWithCallback(IRP_QUEUE* q,
+                                                         KSTATUS status,
+                                                         IRP_QUEUE_CANCEL_CALLBACK callback,
+                                                         void* context);
 
 // Cancels every IRP in a queue.
 __declspec(dllexport) void IrpQueueCancelAll(IRP_QUEUE* q, KSTATUS status);

code/public/ntlite/ddk/memory.h

@@ -14,12 +14,14 @@
 #define PAGE_MASK   (~(PAGE_SIZE - 1ULL))
 #endif
 
-#define NTL_DDK_PAGE_SIZE         PAGE_SIZE
-#define NTL_DDK_PAGE_PRESENT      (1ULL << 0)
-#define NTL_DDK_PAGE_WRITE        (1ULL << 1)
-#define NTL_DDK_PAGE_WRITETHROUGH (1ULL << 3)
-#define NTL_DDK_PAGE_NOCACHE      (1ULL << 4)
-#define NTL_DDK_PAGE_NX           (1ULL << 63)
+#define NTL_DDK_PAGE_SIZE       PAGE_SIZE
+#define NTL_DDK_PAGE_PRESENT    (1ULL << 0)
+#define NTL_DDK_PAGE_WRITE      (1ULL << 1)
+#define NTL_DDK_PAGE_CACHE_WB   0ULL
+#define NTL_DDK_PAGE_CACHE_WC   (1ULL << 3)
+#define NTL_DDK_PAGE_CACHE_UC   (1ULL << 4)
+#define NTL_DDK_PAGE_CACHE_MASK (NTL_DDK_PAGE_CACHE_WC | NTL_DDK_PAGE_CACHE_UC)
+#define NTL_DDK_PAGE_NX         (1ULL << 63)
 
 #ifndef PAGE_PRESENT
 #define PAGE_PRESENT      (1ULL << 0)
@@ -30,11 +32,17 @@
 #ifndef PAGE_USER
 #define PAGE_USER         (1ULL << 2)
 #endif
-#ifndef PAGE_WRITETHROUGH
-#define PAGE_WRITETHROUGH (1ULL << 3)
+#ifndef PAGE_CACHE_WB
+#define PAGE_CACHE_WB   0ULL
 #endif
-#ifndef PAGE_NOCACHE
-#define PAGE_NOCACHE      (1ULL << 4)
+#ifndef PAGE_CACHE_WC
+#define PAGE_CACHE_WC   (1ULL << 3)
+#endif
+#ifndef PAGE_CACHE_UC
+#define PAGE_CACHE_UC   (1ULL << 4)
+#endif
+#ifndef PAGE_CACHE_MASK
+#define PAGE_CACHE_MASK (PAGE_CACHE_WC | PAGE_CACHE_UC)
 #endif
 #ifndef PAGE_ACCESSED
 #define PAGE_ACCESSED     (1ULL << 5)
@@ -56,55 +64,6 @@ typedef enum NTL_DDK_MAP_MODE {
     NtlDdkMapReplaceExisting = 1,
 } NTL_DDK_MAP_MODE;
 
-#ifndef NTL_MM_PTE_MAP_MODE_DEFINED
-typedef enum MM_PTE_MAP_MODE {
-    MmPteMapFailIfPresent = 0,
-    MmPteMapReplaceExisting = 1,
-} MM_PTE_MAP_MODE;
-#define NTL_MM_PTE_MAP_MODE_DEFINED 1
-#endif
-
-#ifndef NTL_MM_PFN_TYPES_DEFINED
-typedef enum MM_PFN_STATE {
-    MmPfnStateInvalid = 0,
-    MmPfnStateReserved,
-    MmPfnStateFree,
-    MmPfnStateZeroed,
-    MmPfnStateActive,
-    MmPfnStateStandby,
-    MmPfnStateModified,
-} MM_PFN_STATE;
-
-typedef enum MM_PFN_USAGE {
-    MmPfnUseNone = 0,
-    MmPfnUseKernel,
-    MmPfnUsePageTable,
-    MmPfnUseUser,
-    MmPfnUseCleanFileCache,
-    MmPfnUseImage,
-    MmPfnUseMappedFile,
-    MmPfnUseAnonymous,
-    MmPfnUseCow,
-    MmPfnUseSurface,
-    MmPfnUseDriver,
-    MmPfnUseDma,
-    MmPfnUseBootloader,
-    MmPfnUsePfnDatabase,
-    MmPfnUseMmio,
-} MM_PFN_USAGE;
-
-typedef struct MM_PFN {
-    uint16_t State;
-    uint16_t Usage;
-    uint16_t RefCount;
-    uint16_t PinCount;
-    uint32_t Flags;
-    uint32_t MappedCount;
-    void* Owner;
-    uint64_t BackingPage;
-} MM_PFN;
-#define NTL_MM_PFN_TYPES_DEFINED 1
-#endif
 
 #define MM_POOL_TAG(a, b, c, d) \
     ((uint32_t)(uint8_t)(a) | ((uint32_t)(uint8_t)(b) << 8) | \
@@ -131,56 +90,3 @@ __declspec(dllexport) void MmFreePool(void* ptr);
 
 // Reallocates kernel pool memory.
 __declspec(dllexport) void* MmReallocatePool(void* ptr, size_t newSize);
-
-// Allocates one physical frame for a specific driver-visible usage.
-__declspec(dllexport) PHYSICAL_ADDRESS MmPfnAllocate(MM_PFN_USAGE usage);
-
-// Allocates one physical frame below maxExclusive.
-__declspec(dllexport) PHYSICAL_ADDRESS MmPfnAllocateBelow(PHYSICAL_ADDRESS maxExclusive, MM_PFN_USAGE usage);
-
-// Allocates one physical frame in a range.
-__declspec(dllexport) PHYSICAL_ADDRESS MmPfnAllocateInRange(PHYSICAL_ADDRESS minInclusive,
-                                                            PHYSICAL_ADDRESS maxExclusive,
-                                                            MM_PFN_USAGE usage);
-
-// Allocates contiguous physical frames.
-__declspec(dllexport) PHYSICAL_ADDRESS MmPfnAllocateContiguous(size_t count, MM_PFN_USAGE usage);
-
-// Releases a frame reference.
-__declspec(dllexport) KSTATUS MmPfnFree(PHYSICAL_ADDRESS frame);
-
-// Retains a physical frame.
-__declspec(dllexport) KSTATUS MmPfnRetain(PHYSICAL_ADDRESS frame);
-
-// Releases a retained physical frame.
-__declspec(dllexport) KSTATUS MmPfnRelease(PHYSICAL_ADDRESS frame);
-
-// Pins a physical frame.
-__declspec(dllexport) KSTATUS MmPfnPin(PHYSICAL_ADDRESS frame);
-
-// Unpins a physical frame.
-__declspec(dllexport) KSTATUS MmPfnUnpin(PHYSICAL_ADDRESS frame);
-
-// Returns the PFN database entry for a frame.
-__declspec(dllexport) MM_PFN* MmPfnGet(PHYSICAL_ADDRESS frame);
-
-// Returns the direct-map alias for a physical frame.
-__declspec(dllexport) void* MmPfnToVirtual(PHYSICAL_ADDRESS frame);
-
-// Maps one page into the shared kernel address space.
-__declspec(dllexport) KSTATUS MmPteMapPage(uintptr_t virt,
-                                           PHYSICAL_ADDRESS phys,
-                                           uint64_t flags,
-                                           MM_PTE_MAP_MODE mode);
-
-// Removes one page mapping from the shared kernel address space.
-__declspec(dllexport) KSTATUS MmPteUnmapPage(uintptr_t virt);
-
-// Replaces flags on a mapped range.
-__declspec(dllexport) KSTATUS MmPteProtectRange(uintptr_t virt, size_t size, uint64_t flags);
-
-// Translates a virtual address through the shared kernel page tables.
-__declspec(dllexport) PHYSICAL_ADDRESS MmPteTranslate(uintptr_t virt);
-
-// Returns the physical address and flags for a mapped page.
-__declspec(dllexport) KSTATUS MmPteQueryPage(uintptr_t virt, PHYSICAL_ADDRESS* physOut, uint64_t* flagsOut);

code/public/ntlite/ddk/mutex.h

@@ -13,16 +13,23 @@ typedef struct MUTEX {
     SPINLOCK Lock;
     THREAD* Owner;
     LIST_ENTRY WaitList;
+    LIST_ENTRY OwnerLink;
+    KE_SCHEDULING_CLASS DonationClass;
+    uint32_t DonationPriority;
+    uint8_t HasDonation;
+    uint8_t Abandoned;
 } MUTEX;
 
+// Tests whether a mutex acquisition transferred ownership to the caller.
+#define KE_MUTEX_ACQUIRE_SUCCEEDED(status) \
+    ((status) == NTLSTATUS_SUCCESS || (status) == NTLSTATUS_ABANDONED)
+
 // Creates a mutex object.
 __declspec(dllexport) KSTATUS KeMutexCreate(MUTEX** out);
 
-// Acquires a mutex, blocking when necessary.
-__declspec(dllexport) KSTATUS KeAcquireMutex(MUTEX* mutex);
-
-// Attempts to acquire a mutex without blocking.
-__declspec(dllexport) KSTATUS KeTryAcquireMutex(MUTEX* mutex);
+// Acquires a mutex within the requested timeout and reports abandonment on transfer.
+// Zero performs a nonblocking probe; KE_WAIT_INFINITE waits without a timeout.
+__declspec(dllexport) KSTATUS KeAcquireMutex(MUTEX* mutex, uint64_t timeoutMilliseconds);
 
 // Releases a mutex.
 __declspec(dllexport) void KeReleaseMutex(MUTEX* mutex);

code/public/ntlite/ddk/object.h

@@ -29,6 +29,8 @@ typedef enum OBJECT_TYPE {
     ObjectTypeTimer        = 19,
     ObjectTypeModule       = 20,
     ObjectTypeDisplayClock = 21,
+    ObjectTypeAudioEndpoint = 22,
+    ObjectTypeAudioStream   = 23,
 } OBJECT_TYPE;
 
 typedef enum OBJECT_LIFETIME_STATE {

code/public/ntlite/ddk/semaphore.h

@@ -19,11 +19,9 @@ typedef struct SEMAPHORE {
 // Creates a counting semaphore.
 __declspec(dllexport) KSTATUS KeSemaphoreCreate(int32_t initial, int32_t max, SEMAPHORE** out);
 
-// Waits for a semaphore count to become available.
-__declspec(dllexport) KSTATUS KeWaitSemaphore(SEMAPHORE* semaphore);
-
-// Attempts to take a semaphore without blocking.
-__declspec(dllexport) KSTATUS KeTrySemaphore(SEMAPHORE* semaphore);
+// Waits for a semaphore count within the requested timeout.
+// Zero performs a nonblocking probe; KE_WAIT_INFINITE waits without a timeout.
+__declspec(dllexport) KSTATUS KeWaitSemaphore(SEMAPHORE* semaphore, uint64_t timeoutMilliseconds);
 
 // Releases one semaphore count.
 __declspec(dllexport) void KeSignalSemaphore(SEMAPHORE* semaphore);

code/public/ntlite/ddk/sync.h

@@ -14,6 +14,9 @@ typedef struct SPINLOCK {
 
 #define SPINLOCK_INIT { 0 }
 
+// Requests a synchronization wait without a timeout.
+#define KE_WAIT_INFINITE UINT64_MAX
+
 #define KI_SPINLOCK_IRQL_SHIFT  ((unsigned)(sizeof(uintptr_t) * 8u - 8u))
 #define KI_SPINLOCK_FLAGS_MASK  (~(((uintptr_t)0xFFu) << KI_SPINLOCK_IRQL_SHIFT))
 

code/public/ntlite/ddk/thread.h

@@ -17,18 +17,49 @@ typedef enum THREAD_PRIORITY {
 #define NTL_THREAD_PRIORITY_DEFINED 1
 #endif
 
-// Creates a system-process kernel thread for a kernel-mode driver.
+// Selects dynamic normal scheduling or static real-time scheduling.
+typedef enum KE_SCHEDULING_CLASS {
+    KeSchedulingNormal = 0,
+    KeSchedulingRealtime = 1,
+    KeSchedulingClassCount = 2,
+} KE_SCHEDULING_CLASS;
+
+// Higher real-time values outrank lower values. Real-time threads always
+// outrank normal threads and round-robin with equal-priority peers.
+#define KE_REALTIME_PRIORITY_MIN   0u
+#define KE_REALTIME_PRIORITY_MAX  31u
+#define KE_REALTIME_PRIORITY_COUNT 32u
+
+// Creates a thread without placing it on a scheduler ready queue. The caller
+// must retain the returned THREAD reference and call KeResumeThread().
+#define KE_THREAD_CREATE_FLAG_SUSPENDED 0x00000001u
+
+// Describes initial scheduling, execution state, and affinity for one new
+// thread. Zero affinity selects the kernel default rather than an empty CPU
+// set.
+typedef struct KE_THREAD_CREATE_PARAMETERS {
+    KE_SCHEDULING_CLASS SchedulingClass;
+    uint32_t Priority;
+    uint32_t Flags;
+    uint64_t AffinityMask;
+} KE_THREAD_CREATE_PARAMETERS;
+
+#define KE_THREAD_CREATE_NORMAL(priorityValue) \
+    { KeSchedulingNormal, (uint32_t)(priorityValue), 0u, 0ULL }
+
+#define KE_THREAD_CREATE_REALTIME(priorityValue) \
+    { KeSchedulingRealtime, (uint32_t)(priorityValue), 0u, 0ULL }
+
+// Creates a system-process kernel thread with explicit scheduling parameters.
 __declspec(dllexport) KSTATUS KeCreateKernelThread(uintptr_t fn,
                                                    uintptr_t arg,
-                                                   THREAD_PRIORITY priority,
+                                                   const KE_THREAD_CREATE_PARAMETERS* parameters,
                                                    THREAD** out);
 
-// Creates a system-process kernel thread with an explicit affinity mask.
-__declspec(dllexport) KSTATUS KeCreateKernelThreadWithAffinity(uintptr_t fn,
-                                                               uintptr_t arg,
-                                                               THREAD_PRIORITY priority,
-                                                               uint64_t affinityMask,
-                                                               THREAD** out);
+// Decrements one thread's suspend count and queues it when the count reaches
+// zero. previousSuspendCountOut may be NULL.
+__declspec(dllexport) KSTATUS KeResumeThread(THREAD* thread,
+                                             uint32_t* previousSuspendCountOut);
 
 // Yields the current processor to another runnable thread.
 __declspec(dllexport) void KeYield(void);