Hello ! Here https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/constraints-on-dispatch-routines it’s said “ Dispatch routines that are in the paging file I/O path cannot safely call any kernel-mode routines that require a caller to be running at IRQL < DISPATCH_LEVEL.” . So I can’t call fltgetstreamcontext for paging file on pre-write ? I understand that context can’t be attached to a pagefile, but I thought that get context call is at least safe. In Microsoft samples I don’t see check for pagefile. So the question is it safe to call get context routines for page file on pre- read/ write ? This documentation is for legacy filters, but in pre callback we are called in the context of legacy filter(fltmgr) dispatch routine. So the constraint should still apply, right ?
is it safe to call get context routines for page file on pre- read/ write ?
Only if you know this isn’t a paging file object. ISTR that’s there’s a fsrtl call to establish that. Or of course you could check the IRQL
Thank you Rod ! Yes, FsRtlIsPagingFile. > @rod_widdowson said: > (Quote) > Or of course you could check the IRQL What do you mean? In file filter dispatch we are guaranteed to be below dispatch level. The constraint is that for pf I can’t call passive and apc routines even at passive or apc. What would IRQL check do for me ?