Can WPP logging functions be used at higher IRQL?

NTDEV
1

I'm assuming that yes, but I can't seem to find any documentation. Can someone confirm?

2

Yes, you can log at any IRQL. It all ends up being ETW and coming through some variation of EtwWriteXxx:

You can call EtwWrite at any IRQL. However, when IRQL is greater than APC_LEVEL, any data passed to the EtwWrite, EtwWriteEx, EtwWriteString, EtwWriteTransfer functions must not be pageable.

EtwWrite function (wdm.h) - Windows drivers | Microsoft Learn

2 Likes