6.1 Dispatch Routine Requirements

Processing any IRP begins in the Dispatch routine that the DriverEntry routine set up to handle the given major function code (IRP_MJ_XXX), which is set in the driver’s I/O stack location of each incoming IRP.

Most NT drivers’ Dispatch routines are called in an arbitrary thread context at IRQL PASSIVE_LEVEL, with the following exceptions:

• Any highest-level NT driver’s Dispatch routines are called in the context of the thread that originated the I/O request, which is commonly a user-mode application thread.

  In other words, the Dispatch routines of NT file system drivers and other highest-level NT drivers are called in a nonarbitrary thread context at IRQL PASSIVE_LEVEL.

• The DispatchRead and/or DispatchWrite routines of mass-storage device drivers and of NT intermediate drivers layered above them, can be called at IRQL APC_LEVEL and in an arbitrary thread context.

  The DispatchRead and/or DispatchWrite and any other routine that also processes read and/or write requests in such a device or intermediate driver must be resident at all times. These NT driver routines can neither be pageable nor be part of a driver’s pageable-image section.

  For more information about pageable and pageable-image driver routines, see the Programmer’s Guide.

The driver writer determines how many Dispatch routines any NT driver has. An NT driver can have as many Dispatch routines as the IRP_MJ_XXX  function codes the driver handles, as already mentioned in Chapter 4.