I am reading MS avscan sample and noticed that they call FsRtlEnterFileSystem/KeEnterCriticalRegion not before ExAcquireResource***Lite. They call FsRtlEnterFileSystem/KeEnterCriticalRegion in context of PostCreate, PreCleanup and InstanceSetupCallback. My understanding was that in general we don’t need to call FsRtlEnterFileSystem/KeEnterCriticalRegion in minifilter. In filesystem we call FsRtlEnterFileSystem before acquiring file resources for thread to not became suspended.
So when should we care about thread suspension in minifilter ?
It looks like you're new here. If you want to get involved, click one of these buttons!
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!||Kernel Debugging||30 Mar 2020||OSR Seminar Space|
|Developing Minifilters||20 Apr 2020||LIVE ONLINE|
|Writing WDF Drivers||11 May 2020||LIVE ONLINE|
|Internals & Software Drivers||28 Sept 2020||Dulles, VA|