IRQL for PsSetLoadImageNotifyRoutine callback ?

[Marc Sherman]

The documentation for PsSetLoadImageNotifyRoutine does not mention the IRQL
of the callback. Does anyone know if it's always PASSIVE_LEVEL?

thanks,
Marc

[Eliyas Yakub [MSFT]]

Yep, it has to be called at IRQL < DISPATCH_LEVEL.

--
-Eliyas
This posting is provided "AS IS" with no warranties, and confers no rights.
http://www.microsoft.com/whdc/hwdev/driver/kb-drv.mspx
"Marc Sherman" <masher...@yahoo.com> wrote in message
news:uLA5AqZU...@TK2MSFTNGP10.phx.gbl...

[Jerry Schneider]

Marc Sherman wrote:
> The documentation for PsSetLoadImageNotifyRoutine does not mention the IRQL
> of the callback. Does anyone know if it's always PASSIVE_LEVEL?

In the cases where the IRQL limits are not stated in the docs, I step into
the function using the checked kernel/hal (you _are_ using these for your
development/debug work, no?). One of the first things a checked build does
is to call KeGetCurrentIrql and then test the result to insure it is less
than or equal to some small constant value. This constant value is the
ordinal of the IRQL representing the highest level the function can be called
at.

The same technique can be used on "undocumented" kernel functions to see
the maximum IRQL the function was designed for, since there are no "docs".

Jerry

[Marc Sherman]

"Jerry Schneider" <NoS...@spamville.com> wrote in message
news:efg6b9wV...@tk2msftngp13.phx.gbl...

> Marc Sherman wrote:
> > The documentation for PsSetLoadImageNotifyRoutine does not mention the
IRQL
> > of the callback. Does anyone know if it's always PASSIVE_LEVEL?
>
> In the cases where the IRQL limits are not stated in the docs, I step into
> the function using the checked kernel/hal

Unfortunately, I'm not calling my callback, the system is. But thanks for
the info, I'll use this method for funcs that I call where the IRQL is not
specified.

Marc

[Skywing]

Just to clarify, on some platforms it is called at APC_LEVEL and on some
platforms it is called at PASSIVE_LEVEL with APCs disabled via the use of a
guarded mutex.

This is of course somewhat of an implementation detail, but it's all we have
to go on because of the rather incomplete documentation for this function.
On XP and below it should generally run at APC_LEVEL, and on newer platforms
that support guarded mutexes (such as Windows Server 2003 and beyond) it
should generally run at PASSIVE_LEVEL (though I would not write code that
couldn't operate at both IRQLs - just assume that you can't deliver APCs
during the operation of the call and you should be okay).

"Eliyas Yakub [MSFT]" <eli...@online.microsoft.com> wrote in message
news:%23HY5%233lUF...@TK2MSFTNGP09.phx.gbl...

[Marc Sherman]

Thanks for this very detailed info!

BTW, I originally posted this months ago and I think Eliyas responded many
months ago too. Weird.

Marc

"Skywing" <skywing_...@valhallalegends.com> wrote in message
news:OV5lpG9i...@TK2MSFTNGP04.phx.gbl...