>WaitMode value should I set? KernelMode or UserMode?
All waits in driver’s internal threads must be KernelMode.
function driver. As I understand,Since I use UserMode >in
ObReferenceObjectByHandle, I should use UserMode in
"KeWaitForMultipleObjects as well.
No. The processor mode parameter to ObReferenceObjectByHandle influences the
validation of the kernel handles (with senior bit set). They are only allowed
if processor mode is KernelMode. The correct value is Irp->RequestorMode in any
IRP handling path, and ExGetPreviousMode() in any other paths. In fact, the IO
manager sets Irp->RequestorMode to ExGetPreviousMode() when it creates the IRP
initially, but after this, the IRP can have a long a complex life, and
ExGetPreviousMode can be invalid somewhere below.
The processor mode parameter to KeWaitForMultipleObjects governs whether the
wait is interruptible by APCs.
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com