Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging

The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.

Check out The OSR Learning Library at:

Check for paging file on read / write

Sergey_PisarevSergey_Pisarev Member - All Emails Posts: 236
Hello !

Here it’s said “ Dispatch routines that are in the paging file I/O path cannot safely call any kernel-mode routines that require a caller to be running at IRQL < DISPATCH_LEVEL.” . So I can’t call fltgetstreamcontext for paging file on pre-write ? I understand that context can’t be attached to a pagefile, but I thought that get context call is at least safe. In Microsoft samples I don’t see check for pagefile.

So the question is it safe to call get context routines for page file on pre- read/ write ?

This documentation is for legacy filters, but in pre callback we are called in the context of legacy filter(fltmgr) dispatch routine. So the constraint should still apply, right ?


  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,131

    is it safe to call get context routines for page file on pre- read/ write ?

    Only if you know this isn’t a paging file object. ISTR that’s there’s a fsrtl call to establish that. Or of course you could check the IRQL

  • Sergey_PisarevSergey_Pisarev Member - All Emails Posts: 236
    edited January 31
    Thank you Rod !
    Yes, FsRtlIsPagingFile.

    > @rod_widdowson said:
    > (Quote)
    > Or of course you could check the IRQL

    What do you mean? In file filter dispatch we are guaranteed to be below dispatch level. The constraint is that for pf I can’t call passive and apc routines even at passive or apc. What would IRQL check do for me ?
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 30 Mar 2020 OSR Seminar Space
Developing Minifilters 15 Jun 2020 LIVE ONLINE
Writing WDF Drivers 22 June 2020 LIVE ONLINE
Internals & Software Drivers 28 Sept 2020 Dulles, VA