FsRtlEnterFileSystem function

Article
03/14/2023

The FsRtlEnterFileSystem macro temporarily disables the delivery of normal kernel-mode asynchronous procedure calls (APC). Special kernel-mode APCs are still delivered.

Syntax

VOID FsRtlEnterFileSystem(
   VOID
);

Parameters

None

Return value

This function doesn't return a value.

Remarks

Every file system driver entry point routine must call FsRtlEnterFileSystem immediately before acquiring a resource required in performing a file I/O request and call FsRtlExitFileSystem immediately afterward. This ensures that the routine can't be suspended while running and thus block other file I/O requests.

Every successful call to FsRtlEnterFileSystem must be matched by a subsequent call to FsRtlExitFileSystem.

File system filter drivers can disable delivery of normal kernel APCs by calling FsRtlEnterFileSystem or KeEnterCriticalRegion prior to IoCallDriver only if FsRtlExitFileSystem or KeLeaveCriticalRegion is in the same dispatch routine. They shouldn't call FsRtlEnterFileSystem or KeEnterCriticalRegion prior to IoCallDriver and then call FsRtlExitFileSystem or KeLeaveCriticalRegion in the completion routine of the IRP. Driver Verifier has a rule to help catch this condition.

File system filter drivers should disable normal kernel APCs before acquiring any resource. File system filter drivers acquire resources with the following routines:

As an alternative to FsRtlEnterFileSystem, minifilter drivers can use the FltAcquireResourceExclusive, FltAcquireResourceShared, and FltReleaseResource routines, which properly handle APCs when acquiring and releasing a resource.

Requirements

Requirement type	Requirement
Header	Ntifs.h (include Ntifs.h)
IRQL	<= APC_LEVEL