Re: [PATCH v5 0/5] MR2555: Draft: ntdll: Support ISOLATIONAWARE_MANIFEST_RESOURCE_ID (#18889)

[Jinoh Kang (＠iamahuman)]

On Sat Apr  8 12:22:23 2023 +0000, Nikolay Sivov wrote:
> As I recall, for original fix to accept a range of resource IDs the
> question was how are those different from each other, meaning if there
> are multiple resources, when one should be used but not another.
> From Micrsoft documentation, [Using Side-by-Side Assemblies as a Resource][sxs-rsrc] outlines the significance of each reserved manifest resource ID.

Further investigation reveals the following:

1. `CREATEPROCESS_MANIFEST_RESOURCE_ID` (value: `1`): This is used for process-wide initial (`NULL`) activation context.
   - **Usage documentation**: [Enabling an Assembly in an Application Without Extensions](https://learn.microsoft.com/en-us/windows/win32/sbscs/enabling-an-assembly-i...)
   - **Intended container module type**: EXE only.
   - **Lifetime of the associated activation context**: Alive until the process is terminated.  Owned by system (NTDLL).
   - **Isolation-aware**: No.

2. `ISOLATIONAWARE_MANIFEST_RESOURCE_ID` (value: `2`): This is used to specify the assembly manifest that the loader (Ldr) uses to resolve static imports.  Also, this is used by isolation-aware wrappers defined in `*.inl` files included in the Windows SDK (`include\um`) when the `ISOLATION_AWARE_ENABLED` macro is defined as a nonzero value.
   - **Usage documentation**: [Enabling an Assembly in an Application Hosting a DLL, Extension, or Control Panel](https://learn.microsoft.com/en-us/windows/win32/sbscs/enabling-an-assembly-i...)
   - **Intended container module type**: EXE and DLL.
   - **Lifetime of the associated activation context**: Alive until the module is unloaded (e.g., via `FreeLibrary`).  Owned by system (NTDLL).
   - **Isolation-aware**: Yes.

3. `ISOLATIONAWARE_NOSTATICIMPORT_MANIFEST_RESOURCE_ID` (value: `3`): Ignored by the loader when resolving static imports. This is used by isolation-aware API wrappers defined in `*.inl` files included in the Windows SDK (`include\um`) when the `ISOLATION_AWARE_ENABLED` macro is defined as a nonzero value.
   - **Usage documentation**: [IsolationAwareCleanup function][IsolationAwareCleanup]
   - **Intended container module type**: EXE and DLL.
   - **Lifetime of the associated activation context**: Alive until the application calls [`IsolationAwareCleanup`][IsolationAwareCleanup][^ia-cleanup-note].  Owned by the isolation-aware API wrapper library (part of the Windows SDK, rather than being a system DLL).
   - **Isolation-aware**: Yes.

The `ISOLATION_AWARE_ENABLED` macro is documented in [Isolating Components][sxs-ic] as well as [Specifying a Default Activation Context][sxs-def-actctx]. When `ISOLATION_AWARE_ENABLED` macro is defined as a nonzero value, then the isolation-aware API wrapper library is enabled.  The isolation-aware API wrapper library is responsible for:

- Creating (lazily) and destroying activation context (in `IsolationAwareCleanup`), if the manifest resource ID is `ISOLATIONAWARE_NOSTATICIMPORT_MANIFEST_RESOURCE_ID`.[^actctx-lifetime-remark]
  - Note: the isolation-aware API wrapper library does not manage the activation context's lifetime and delegates the responsibility to the system loader if the manifest resource ID is `ISOLATIONAWARE_MANIFEST_RESOURCE_ID`.
- Intercepting Win32 API calls for automatic activation context activation.  Each API wrapper activates the "isolation-aware" activation context (obtaining one if it did not exist) before calling the original procedure, and deactivates it before returning.

The isolation-aware wrappers may be either be defined inline, or compiled into static libraries that are linked into the final application executable.
> From the information above as well as the tests included in this merge request, we can infer the following:

1. Although side-by-side awareness is a cross-cutting concern, the *activation* of activation contexts itself is *not* usually performed automatically by the system for the application (with the sole exception of process-wide activation context associated with `CREATEPROCESS_MANIFEST_RESOURCE_ID`, and static import resolution).
2. `ISOLATIONAWARE_NOSTATICIMPORT_MANIFEST_RESOURCE_ID` is treated like any other resource ID (from `0x0002` to `0xffff`) as far as the loader is concerned.
3. The resource ID of the manifest only concerns how the module containing the manifest intends to use the manifest.  In fact, for DLLs that do not *statically* import symbols from side-by-side assemblies, the three resource IDs above are basically equivalent.  A DLL can elect not to use manifest resources at all, and manage activation context and library loading by itself.

This is why I believe that this merge request is sufficient in completing the isolation-aware component support in Wine; the heavy lifting is done in the application side, not the system.

**EDIT**: Fix a few typos and unclear wording.

---

[^ia-cleanup-note]: According to the documentation, the application is presumably responsible for calling `IsolationAwareCleanup` from `DllMain` on `fdwReason = DLL_PROCESS_DETACH`.
[^actctx-lifetime-remark]: [IsolationAwareCleanup § Remarks](https://learn.microsoft.com/en-us/previous-versions/windows/desktop/legacy/a...), from Microsoft documentation.

[sxs-rsrc]: https://learn.microsoft.com/en-us/windows/win32/sbscs/using-side-by-side-ass...
[IsolationAwareCleanup]: https://learn.microsoft.com/en-us/previous-versions/windows/desktop/legacy/a...)
[sxs-ic]: https://learn.microsoft.com/en-us/windows/win32/sbscs/isolating-components
[sxs-def-actctx]: https://learn.microsoft.com/en-us/windows/win32/sbscs/specifying-a-default-a...

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/2555#note_29411