Queues and minifilters

NTFSD
1

NTFSD Folk:

I have a minifilter that needs to write stuff to a log file at times. This
can happen in a Post-Write callback, which is called in an arbitrary thread
context, at IRQL <= DISPATCH_LEVEL.

So I create a work item with FltAllocateDeferredIoWorkItem() and queue it
with FltQueueDeferredIoWorkItem(). But more often than not, the
FltQueueDeferredIoWorkItem() returns STATUS_FLT_NOT_SAFE_TO_POST_OPERATION,
which means that TopLevelIrp is not NULL.

So my question is basically: Now what?

If I can’t open the file because I’m not at PASSIVE_LEVEL and I can’t queue
to FltQueueDeferredIoWorkItem(), what are my options?

  1. Can a minifilter use the “traditional” IoAllocateWorkItem &
    IoQueueWorkItem?

  2. Will it hit the same limitation with TopLevelIrp?

  3. Can a minifilter create its own system thread and queue things to it?
    If so, how deep is the queue?

  4. Is there some other way to wait until TopLevelIrp is NULL so I can call
    FltQueueDeferredIoWorkItem()?

The documentation is fuzzy on this stuff…

Ken