server: Allow creating thread kernel objects.

dlls/ntoskrnl.exe/tests/driver.c

@@ -822,7 +822,6 @@ static void test_ob_reference(const WCHAR *test_path)
 
     status = ObReferenceObjectByHandle(thread_handle, SYNCHRONIZE, *pPsThreadType, KernelMode, &obj2, NULL);
     ok(!status, "ObReferenceObjectByHandle failed: %#x\n", status);
-    todo_wine
     ok(obj1 == obj2, "obj1 != obj2\n");
 
     ObDereferenceObject(obj1);

server/thread.c

@@ -133,6 +133,7 @@ static struct object_type *thread_get_type( struct object *obj );
 static int thread_signaled( struct object *obj, struct wait_queue_entry *entry );
 static unsigned int thread_map_access( struct object *obj, unsigned int access );
 static void thread_poll_event( struct fd *fd, int event );
+static struct list *thread_get_kernel_obj_list( struct object *obj );
 static void destroy_thread( struct object *obj );
 
 static const struct object_ops thread_ops =
@@ -153,7 +154,7 @@ static const struct object_ops thread_ops =
     no_link_name,               /* link_name */
     NULL,                       /* unlink_name */
     no_open_file,               /* open_file */
-    no_kernel_obj_list,         /* get_kernel_obj_list */
+    thread_get_kernel_obj_list, /* get_kernel_obj_list */
     no_close_handle,            /* close_handle */
     destroy_thread              /* destroy */
 };
@@ -209,6 +210,7 @@ static inline void init_thread_structure( struct thread *thread )
     list_init( &thread->mutex_list );
     list_init( &thread->system_apc );
     list_init( &thread->user_apc );
+    list_init( &thread->kernel_object );
 
     for (i = 0; i < MAX_INFLIGHT_FDS; i++)
         thread->inflight[i].server = thread->inflight[i].client = -1;
@@ -304,6 +306,12 @@ static void thread_poll_event( struct fd *fd, int event )
     release_object( thread );
 }
 
+static struct list *thread_get_kernel_obj_list( struct object *obj )
+{
+    struct thread *thread = (struct thread *)obj;
+    return &thread->kernel_object;
+}
+
 /* cleanup everything that is no longer needed by a dead thread */
 /* used by destroy_thread and kill_thread */
 static void cleanup_thread( struct thread *thread )

server/thread.h

@@ -89,6 +89,7 @@ struct thread
     timeout_t              creation_time; /* Thread creation time */
     timeout_t              exit_time;     /* Thread exit time */
     struct token          *token;         /* security token associated with this thread */
+    struct list            kernel_object; /* list of kernel object pointers */
 };
 
 struct thread_snapshot