It changes back when the system call returns. Another system call made within the same thread won't taint it.
But if a kernel-mode component calls ZwDeviceIoControl(...) it's deliberately switching the previous mode to KernelMode. You should treat that as a kernel-mode call and can trust that it's done any necessary parameter validation, etc...
-p
-----Original Message-----
From: ijor@nospam.nospam
Posted At: Thursday, August 11, 2005 2:21 PM
Posted To: microsoft.public.development.device.drivers
Conversation: Assert being the highest-level driver
Subject: Re: Assert being the highest-level driver
Hmm, I probably miss something. Because otherwise I don't understand how this could be useful as claimed by the docs.
How can I know if by the time I call ExGetPreviousMode some other thread made a system call and changed the "previous mode"?
> "Peter Wieland [MSFT]" wrote:
>
> It's the mode of the processor before the last system call.
>
> -----Original Message-----
> From: ijor@nospam.nospam
> Posted At: Thursday, August 11, 2005 8:20 AM Posted To:
> microsoft.public.development.device.drivers
> Conversation: Assert being the highest-level driver
> Subject: Re: Assert being the highest-level driver
>
>
>
> "Doron Holan [MS]" wrote:
>
> > you can't reliably do this. you have to take it on faith that if
> > the design of your stack is that you are the highest level driver, you are the highest.
>
> I see, thanks.
>
> But just for my knowledge, what is exactly the meaning of "previous" in ExGetPreviousMode? The concept is a bit loose in this context.