The FsRtlEnterFileSystem macro temporarily disables the delivery of normal kernel-mode asynchronous procedure calls (APC). Special kernel-mode APCs are still delivered.
VOID FsRtlEnterFileSystem( VOID );
This function does not return a value.
Every file system driver entry point routine must call FsRtlEnterFileSystem immediately before acquiring a resource required in performing a file I/O request and call FsRtlExitFileSystem immediately afterward. This ensures that the routine cannot be suspended while running and thus block other file I/O requests.
Every successful call to FsRtlEnterFileSystem must be matched by a subsequent call to FsRtlExitFileSystem.
File system filter drivers can disable delivery of normal kernel APCs by calling FsRtlEnterFileSystem or KeEnterCriticalRegion prior to IoCallDriver only if FsRtlExitFileSystem or KeLeaveCriticalRegion is in the same dispatch routine. They should not call FsRtlEnterFileSystem or KeEnterCriticalRegion prior to IoCallDriver and then call FsRtlExitFileSystem or KeLeaveCriticalRegion in the completion routine of the IRP. Driver Verifier has a rule to help catch this condition.
File system filter drivers should disable normal kernel APCs before acquiring any resource. File system filter drivers acquire resources with the following routines:
As an alternative to FsRtlEnterFileSystem, minifilter drivers can use the FltAcquireResourceExclusive, FltAcquireResourceShared, and FltReleaseResource routines which properly handles APCs when acquiring and releasing a resource.
|Header||Ntifs.h (include Ntifs.h)|