Brad DeMorrow wrote:
When a kernel service is started, it's DriverEntry routine is called with a DRIVER_OBJECT. In which thread does that happen ?
Depends on the way the driver is loaded. On system start the drivers are loaded in system process context (in the first thread typical, but that mustn't be true of WinXP anymore). On demand drivers started with SCM API are loaded in context of Services thread. The driver shouldn't normally depend on that.
Is a new kernel thread started for that ?
No.
Can DriverEntry block or must it return immediately ?
Immediately.
In which thread do the dispatch routines run when they are called from user-space ?
In context of the user-space thread that called them.
Regards, Filip