IRQL device driver and threaded / context switches

Question

I am new to Windows device driver programming. I know that certain operations can only be performed in IRQL PASSIVE_LEVEL. For example, Microsoft has this sample code for writing to a file from the kernel driver:

if (KeGetCurrentIrql() != PASSIVE_LEVEL)
    return STATUS_INVALID_DEVICE_STATE; 

Status = ZwCreateFile(...);

My question is: what prevents IRQL from rising after checking KeGetCurrentIrql()above? Let's say a context or swithch flow arises, can IRQL suddenly become DISPATCH_LEVELwhen it returns to my driver, which then leads to a system crash?

If this is NOT possible, then why not just check the IRQL in the function DriverEntryand do it once for everyone?

Answer 1

irql .

/ , irql . , / irql.

:

IRP_MJ_READ

   NTSTATUS DispatchRead(
    __in struct _DEVICE_OBJECT  *DeviceObject,
    __in struct _IRP  *Irp
    )
  {
     // this will be called at irql == PASSIVE_LEVEL
     ...
     // we have acquire a spinlock
     KSSPIN_LOCK lck;
     KeInititializeSpinLock( &lck );
     KIRQL prev_irql;
     KeAcquireSpinLock( &lck,&prev_irql );

     // KeGetCurrentIrql() == DISPATCH_LEVEL 

     KeReleaseSpinLock( &lck, prev_irql );
     // KeGetCurrentIrql() == PASSIVE_LEVEL 
     ...
  }

(Io-) DISPATCH_LEVEL .

NTSTATUS CompleteSth(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp,IN PVOID Context)
{
    // KeGetCurrentIrql() >= PASSIVE_LEVEL
}

Answer 2

IRQL - , . " " IRQL - PASSIVE_LEVEL APC_LEVEL. , , , . " " IRQL. DISPATCH_LEVEL . . , - .. ISR IRQL , . , IRQL .

Answer 3

DriverEntry PASSIVE_LEVEL.

If you want to complete the task in PASSIVE_LEVEL, use functions such as IoQueueWorkItem