You are correct but that said, the OP asked if pre-write can be called
at APC. I feel it is ‘bad’ design to think that it will never be called
at APC in a filter driver, or more subtle cases of various APC delivery
being disabled with IRQL PASSIVE.
Pete
–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295
------ Original Message ------
From: xxxxx@hotmail.com
To: “Windows File Systems Devs Interest List”
Sent: 4/11/2017 9:22:24 AM
Subject: RE:[ntfsd] Re[2]: Re[2]: FsMiniFilter - IRQL for
PreOperationCallback for IRP_MJ_WRITE
>
>
>All file systems use KeEnterCriticalRegion() as it is required before
>acquiring resources to disable normal kernel mode APCs that might
>recursively acquire the same resource or suspend a thread and break
>FSD’s logic or deadlock the system.
>
>KeEnterCriticalRegion() doesn’t raise IRQL to APC_LEVEL it just
>disables normal APCs but doesn’t disable special kernel mode APC to
>allow IoCompleteRequest’s control flow with APC.
>
>There is a difference between APC_LEVEL when all APCs are disabled and
>a code section inside KeEnterCriticalRegion(){ …
>}KeLeaveCriticalRegion() where special kernel mode APCs are allowed.
>
>—
>NTFSD is sponsored by OSR
>
>
>MONTHLY seminars on crash dump analysis, WDF, Windows internals and
>software drivers!
>Details at http:
>
>To unsubscribe, visit the List Server section of OSR Online at
>http:</http:></http:>