The WDK documentation for PFLT_POST_OPERATION_CALLBACK says post-ops can be called at IRQL <= DISPATCH_LEVEL. One exception is the post-op create, which is called at PASSIVE_LEVEL, in the context of the thread that originated the IRP_MJ_CREATE.
WDK sample file filesys\miniFilter\ctx\operations.c has post-op routine CtxPostSetInfo that includes the PAGED_CODE macro and calls FltGetFileNameInformation, which requires IRQL <= APC_LEVEL. Is IRP_MJ_SET_INFORMATION another case where the post-op is guaranteed to be called at IRQL<= APC_LEVEL? Are there others?
As you can see “CtxPreSetInfo” returns FLT_PREOP_SYNCHRONIZE, which
guarantees “CtxPostSetInfo” to be called at passive level *and* in context
of the thread that originated that operation (just like PostCreate).
Read “FilterDriverDeveloperGuide.doc” for more details about
FLT_PREOP_SYNCHRONIZE
wrote news:xxxxx@ntfsd…
> The WDK documentation for PFLT_POST_OPERATION_CALLBACK says post-ops can
> be called at IRQL <= DISPATCH_LEVEL. One exception is the post-op create,
> which is called at PASSIVE_LEVEL, in the context of the thread that
> originated the IRP_MJ_CREATE.
>
> WDK sample file filesys\miniFilter\ctx\operations.c has post-op routine
> CtxPostSetInfo that includes the PAGED_CODE macro and calls
> FltGetFileNameInformation, which requires IRQL <= APC_LEVEL. Is
> IRP_MJ_SET_INFORMATION another case where the post-op is guaranteed to be
> called at IRQL<= APC_LEVEL? Are there others?
>