Some requests are synchronous and other are asynchronous. IRP_MJ_CREATE
request is synchronous one. That means a thread sent this request will
block until this request is completed. IRP_MJ_CREATE request is sent always
at PASSIVE_LEVEL. For this reason all filters forward request down the
stack and wait for event to be signaled on request completion by all lower
drivers of the stack. Thus before forwarding you are at PASSIVE_LEVEL and
after request completion by lower drivers you are at PASSIVE_LEVEL again.
No one forward this request at IRQL above PASSIVE_LEVEL because this leads
to faulty behavior of FSD first of all. You can queue work to some thread
to continue request processing. But it’ll be at PASSIVE_LEVEL again. This
is what filters usually do including filter manager. So you can be sure
your pre and post routines would be called at PASSIVE_LEVEL.
2016-10-31 21:42 GMT+03:00 :
> Struggling to find consistent documentation on what IRQL the pre and post
> IRP_MJ_CREATE handlers are called at. What I need to do is call some
> PASSIVE_LEVEL only routines on the create path, and I’m trying to determine
> if I need to defer the work to a passive level worker, or if I can call the
> routines directly in the handlers.
>
> Is the following true?
> “If a minifilter driver has registered preoperation and postoperation
> callback routines for IRP_MJ_CREATE operations, the post-create callback
> routine is called at IRQL = PASSIVE_LEVEL, in the same thread context as
> the pre-create callback routine.”
>
> The MSDN documentation led me to believe that pre-routines can be called
> at both PASSIVE_LEVEL and APC_LEVEL. Is this true though for the Create pre
> routine, or will the create pre only be called at PASSIVE_LEVEL? If the
> create pre can be called at APC_LEVEL, I don’t understand how the previous
> statement could be true. If it’s running in the same thread context as the
> pre-create, which may be at APC_LEVEL, then the post routine would also be
> running at APC_LEVEL…
>
>
>
> —
> NTFSD is sponsored by OSR
>
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer>
></http:>