Threads can jump among processes?

NTFSD
1

Not exactly a file system question, but I saw something in the help for
FltGetRequestorProcessId: "FltGetRequestorProcessId returns the process ID
for the process that the requesting thread is currently attached to. This
process may or may not be the same process that created the thread. "

Can a thread be owned by different processes throughout its life time? If
so, do threads only hop around within the I/O subsystem?

Thanks

Doug

2

See KeStackAttachProcess, it’s possible to have a thread run under the
context of a different process for a period of time.

-scott

–
Scott Noone
Consulting Associate
OSR Open Systems Resources, Inc.
http://www.osronline.com

“Doug” wrote in message news:xxxxx@ntfsd…
Not exactly a file system question, but I saw something in the help for
FltGetRequestorProcessId: "FltGetRequestorProcessId returns the process ID
for the process that the requesting thread is currently attached to. This
process may or may not be the same process that created the thread. "

Can a thread be owned by different processes throughout its life time? If
so, do threads only hop around within the I/O subsystem?

Thanks
Doug

3

IMO, It’s not correct to say that a different process “owns” the thread.
Infact, it’s the thread that chooses to be part of a different process
address space. Have a look at the KeStackAttachProcess. Moreover, if I am
correct, this sort of thing can be done only from kernel mode.

Coming back to the original question “can a thread be owned by different
processes throughout its life time?”, the answer really depends on whether
the thread keeps itself attached to other process.

“If so, do threads only hop around within the I/O subsystem?”- Not
necessarily. This can happen at almost an place in the kernel where you can
use KeStackAttachProcess.

Regards,

Ayush Gupta

AI Consulting

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Doug
Sent: Tuesday, March 16, 2010 10:24 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Threads can jump among processes?

Not exactly a file system question, but I saw something in the help for
FltGetRequestorProcessId: "FltGetRequestorProcessId returns the process ID
for the process that the requesting thread is currently attached to. This
process may or may not be the same process that created the thread. "

Can a thread be owned by different processes throughout its life time? If
so, do threads only hop around within the I/O subsystem?

Thanks

Doug

NTFSD is sponsored by OSR

For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer