I am reading MS avscan sample and noticed that they call FsRtlEnterFileSystem/KeEnterCriticalRegion not before ExAcquireResource***Lite. They call FsRtlEnterFileSystem/KeEnterCriticalRegion in context of PostCreate, PreCleanup and InstanceSetupCallback. My understanding was that in general we don’t need to call FsRtlEnterFileSystem/KeEnterCriticalRegion in minifilter. In filesystem we call FsRtlEnterFileSystem before acquiring file resources for thread to not became suspended.
So when should we care about thread suspension in minifilter ?
It looks like you're new here. If you want to get involved, click one of these buttons!
|Upcoming OSR Seminars||Kernel Debugging||30 Mar 2020||OSR Seminar Space|
|Writing WDF Drivers||13 April 2020||OSR Seminar Space & ONLINE|
|Developing Minifilters||20 Apr 2020||OSR Seminar Space & ONLINE|
|Internals & Software Drivers||TBD||Dulles, VA|