Understanding Execution Environments

A kernel extension runs in the process environment when invoked either by a user process in kernel mode or by a kernel process.

A kernel extension is executing in the interrupt environment when invoked as part of an interrupt handler.

A kernel extension can determine in which environment it is called to run by calling the getpid or thread_self kernel service. These services respectively return the process or thread identifier of the current process or thread , or a value of -1 if called in the interrupt environment. Some kernel services can be called in both environments, whereas others can only be called in the process environment.