Re[2]: Re[2]: Re[2]: FsMiniFilter - IRQL for PreOperationCallback for IRP_MJ_WRITE

NTFSD
1

You are correct but that said, the OP asked if pre-write can be called
at APC. I feel it is ‘bad’ design to think that it will never be called
at APC in a filter driver, or more subtle cases of various APC delivery
being disabled with IRQL PASSIVE.

Pete

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295

------ Original Message ------
From: xxxxx@hotmail.com
To: “Windows File Systems Devs Interest List”
Sent: 4/11/2017 9:22:24 AM
Subject: RE:[ntfsd] Re[2]: Re[2]: FsMiniFilter - IRQL for
PreOperationCallback for IRP_MJ_WRITE

>


>
>All file systems use KeEnterCriticalRegion() as it is required before
>acquiring resources to disable normal kernel mode APCs that might
>recursively acquire the same resource or suspend a thread and break
>FSD’s logic or deadlock the system.
>
>KeEnterCriticalRegion() doesn’t raise IRQL to APC_LEVEL it just
>disables normal APCs but doesn’t disable special kernel mode APC to
>allow IoCompleteRequest’s control flow with APC.
>
>There is a difference between APC_LEVEL when all APCs are disabled and
>a code section inside KeEnterCriticalRegion(){ …
>}KeLeaveCriticalRegion() where special kernel mode APCs are allowed.
>
>—
>NTFSD is sponsored by OSR
>
>
>MONTHLY seminars on crash dump analysis, WDF, Windows internals and
>software drivers!
>Details at http:
>
>To unsubscribe, visit the List Server section of OSR Online at
>http:</http:></http:>

2

I didn’t say that it would not be called at APC_LEVEL. My point was about probability of receiving IRP_MJ_WRITE at APC_LEVEL which is extremely low and should be considered as exception.

3

Thanks for the answers Slava and Peter

You are correct but that said, the OP asked if pre-write can be called
at APC.

Well, no. I asked if it can be called at greater than APC for any case which both of you have already clarified (that it wont happen)