Implement kevent

[Alan-Jowett]

Note:
This implementation permits using KEVENT as a local stack variable without leaking large numbers of Win32 handles.

It is a prerequisite to fixing microsoft/ebpf-for-windows#2787.

[nibanks]

Why is this not an abstraction for a HANDLE for a simple event in usermode?

[Alan-Jowett]

Because kernel mode events aren't handles that require a call to CloseHandle on. Valid kernel mode code can initialize events without calling any close API on them.

As an example, this is valid, but it we use a simple Win32 event via a handle it leaks handles.

/**
 * @brief Send a message to the specified CPU and wait for it to complete.
 *
 * @param[in] message Message to send.
 * @param[in] cpu_id CPU to send the message to.
 */
_IRQL_requires_max_(APC_LEVEL) static void _ebpf_epoch_send_message_and_wait(
    _In_ ebpf_epoch_cpu_message_t* message, uint32_t cpu_id)
{
    KDPC dpc;

    // Initialize the completion event.
    KeInitializeEvent(&message->completion_event, NotificationEvent, FALSE);

    // Initialize the dpc
    KeInitializeDpc(&dpc, _ebpf_epoch_messenger_worker, NULL);
    KeSetTargetProcessorDpc(&dpc, (uint8_t)cpu_id);

    // Send the message.
    KeInsertQueueDpc(&dpc, message, NULL);

    // Wait for the message to complete.
    KeWaitForSingleObject(&message->completion_event, Executive, KernelMode, FALSE, NULL);
}

[dthaler]

@Alan-Jowett semaphores have the same difference between user and kernel mode and the usersim implementation of semaphores does use handles. See usersim_free_semaphores() which is called by usersim_platform_terminate().