Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

Check for paging file on read / write

Sergey_PisarevSergey_Pisarev Member - All Emails Posts: 274
Hello !

Here https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/constraints-on-dispatch-routines it’s said “ Dispatch routines that are in the paging file I/O path cannot safely call any kernel-mode routines that require a caller to be running at IRQL < DISPATCH_LEVEL.” . So I can’t call fltgetstreamcontext for paging file on pre-write ? I understand that context can’t be attached to a pagefile, but I thought that get context call is at least safe. In Microsoft samples I don’t see check for pagefile.

So the question is it safe to call get context routines for page file on pre- read/ write ?

This documentation is for legacy filters, but in pre callback we are called in the context of legacy filter(fltmgr) dispatch routine. So the constraint should still apply, right ?

Comments

  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,188

    is it safe to call get context routines for page file on pre- read/ write ?

    Only if you know this isn’t a paging file object. ISTR that’s there’s a fsrtl call to establish that. Or of course you could check the IRQL

  • Sergey_PisarevSergey_Pisarev Member - All Emails Posts: 274
    edited January 2020
    Thank you Rod !
    Yes, FsRtlIsPagingFile.

    > @rod_widdowson said:
    > (Quote)
    > Or of course you could check the IRQL

    What do you mean? In file filter dispatch we are guaranteed to be below dispatch level. The constraint is that for pf I can’t call passive and apc routines even at passive or apc. What would IRQL check do for me ?
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Developing Minifilters 24 May 2021 Live, Online
Writing WDF Drivers 14 June 2021 Live, Online
Internals & Software Drivers 2 August 2021 Live, Online
Kernel Debugging 27 Sept 2021 Live, Online