Was this page helpful?
Your feedback about this content is important. Let us know what you think.
Additional feedback?
1500 characters remaining
FLT_REGISTRATION
Collapse the table of content
Expand the table of content

FLT_REGISTRATION structure

The FLT_REGISTRATION structure is passed as a parameter to FltRegisterFilter.

Syntax


typedef struct _FLT_REGISTRATION {
  USHORT                                      Size;
  USHORT                                      Version;
  FLT_REGISTRATION_FLAGS                      Flags;
  const FLT_CONTEXT_REGISTRATION              *ContextRegistration;
  const FLT_OPERATION_REGISTRATION            *OperationRegistration;
  PFLT_FILTER_UNLOAD_CALLBACK                 FilterUnloadCallback;
  PFLT_INSTANCE_SETUP_CALLBACK                InstanceSetupCallback;
  PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK       InstanceQueryTeardownCallback;
  PFLT_INSTANCE_TEARDOWN_CALLBACK             InstanceTeardownStartCallback;
  PFLT_INSTANCE_TEARDOWN_CALLBACK             InstanceTeardownCompleteCallback;
  PFLT_GENERATE_FILE_NAME                     GenerateFileNameCallback;
  PFLT_NORMALIZE_NAME_COMPONENT               NormalizeNameComponentCallback;
  PFLT_NORMALIZE_CONTEXT_CLEANUP              NormalizeContextCleanupCallback;
#if FLT_MGR_LONGHORN
  PFLT_TRANSACTION_NOTIFICATION_CALLBACK      TransactionNotificationCallback;
  PFLT_NORMALIZE_NAME_COMPONENT_EX            NormalizeNameComponentExCallback;
#endif 
#ifdef FLT_MFG_WIN8
  PFLT_SECTION_CONFLICT_NOTIFICATION_CALLBACK SectionNotificationCallback;
#endif 
} FLT_REGISTRATION, *PFLT_REGISTRATION;

Members

Size

The size, in bytes, of the FLT_REGISTRATION structure. Minifilter drivers must set this member to sizeof(FLT_REGISTRATION).

Version

The revision level of the FLT_REGISTRATION structure. Minifilter drivers must set this member to FLT_REGISTRATION_VERSION.

Flags

A bitmask of minifilter registration flags. This member can be NULL or a combination of the following.

ValueMeaning
FLTFL_REGISTRATION_DO_NOT_SUPPORT_SERVICE_STOP

If this flag is set, the minifilter is not unloaded in response to service stop requests, even if the FilterUnloadCallback member is not NULL.

FLTFL_REGISTRATION_SUPPORT_NPFS_MSFS

If this flag is set, the minifilter will support filtering of named pipe and mailslot requests.

 

ContextRegistration

A variable-length array of FLT_CONTEXT_REGISTRATION structures, one for each context type that the minifilter uses. The last element in the array must be {FLT_CONTEXT_END}.

OperationRegistration

A variable-length array of FLT_OPERATION_REGISTRATION structures, one for each type of I/O for which the minifilter registers preoperation (PFLT_PRE_OPERATION_CALLBACK) and postoperation (PFLT_POST_OPERATION_CALLBACK) callback routines. The last element in the array must be {IRP_MJ_OPERATION_END}.

FilterUnloadCallback

A pointer to a routine of type PFLT_FILTER_UNLOAD_CALLBACK to be registered as the minifilter's FilterUnloadCallback routine. This member is optional and can be NULL.

InstanceSetupCallback

A pointer to a routine of type PFLT_INSTANCE_SETUP_CALLBACK to be registered as the minifilter's InstanceSetupCallback routine. This member is optional and can be NULL.

InstanceQueryTeardownCallback

A pointer to a routine of type PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK to be registered as the minifilter's InstanceQueryTeardownCallback routine. This member is optional and can be NULL.

InstanceTeardownStartCallback

A pointer to a routine of type PFLT_INSTANCE_TEARDOWN_CALLBACK to be registered as the minifilter's InstanceTeardownStartCallback routine. This member is optional and can be NULL.

InstanceTeardownCompleteCallback

A pointer to a routine of type PFLT_INSTANCE_TEARDOWN_CALLBACK to be registered as the minifilter's InstanceTeardownCompleteCallback routine. This member is optional and can be NULL.

GenerateFileNameCallback

A pointer to a routine of type PFLT_GENERATE_FILE_NAME to be registered as the minifilter's GenerateFileNameCallback routine. This member is optional and can be NULL.

NormalizeNameComponentCallback

A pointer to a routine of type PFLT_NORMALIZE_NAME_COMPONENT to be registered as the minifilter's NormalizeNameComponentCallback routine. This member is optional and can be NULL.

NormalizeContextCleanupCallback

A pointer to a routine of type PFLT_NORMALIZE_CONTEXT_CLEANUP to be registered as the minifilter's NormalizeContextCleanupCallback routine. This member is optional and can be NULL.

TransactionNotificationCallback

(Windows Vista and later only.) A pointer to a routine of type PFLT_TRANSACTION_NOTIFICATION_CALLBACK to be registered as the minifilter's TransactionNotificationCallback routine. This member is optional and can be NULL.

NormalizeNameComponentExCallback

(Windows Vista and later only.) A pointer to a routine of type PFLT_NORMALIZE_NAME_COMPONENT_EX to be registered as the minifilter driver's NormalizeNameComponentExCallback routine. This member is optional and can be NULL.

Compared to the NormalizeNameComponentCallback callback routine, the NormalizeNameComponentExCallback callback routine supports an additional file object parameter, FileObject (of type PFILE_OBJECT). A minifilter driver can use this parameter to acquire additional information, such as that provided by the TXN_PARAMETER_BLOCK structure.

A minifilter driver can simultaneously set both the NormalizeNameComponentCallback and NormalizeNameComponentExCallback members to NULL; however, a name provider minifilter driver must register either a NormalizeNameComponentCallback or NormalizeNameComponentExCallback callback routine, or both. For example, a name provider minifilter driver that has no use for the additional FileObject parameter can set the NormalizeNameComponentExCallback member to NULL and only provide a NormalizeNameComponentCallback callback routine.

A minifilter driver can provide both a NormalizeNameComponentCallback callback and a NormalizeNameComponentExCallback callback. In this case, starting with Windows Vista, the filter manager will use only the NormalizeNameComponentExCallback callback; for Windows operating systems prior to Windows Vista, the filter manager will use only the NormalizeNameComponentCallback callback. This allows the same minifilter driver binary to run under all versions of the operating system.

SectionNotificationCallback

Pointer to a routine of type PFLT_SECTION_CONFLICT_NOTIFICATION_CALLBACK to be registered as the minifilter's SectionNotificationCallback routine. This member is optional and can be NULL. This callback is called for notifications of I/O failures for sections created with FltCreateSectionForDatascan.

Remarks

The FLT_REGISTRATION structure is used to provide information about a file system minifilter, such as a FilterUnloadCallback (PFLT_FILTER_UNLOAD_CALLBACK) routine and preoperation (PFLT_PRE_OPERATION_CALLBACK) and postoperation (PFLT_POST_OPERATION_CALLBACK) callback routines, to the filter manager. The minifilter passes a pointer to this structure as the Registration parameter to FltRegisterFilter.

Requirements

Header

Fltkernel.h (include Fltkernel.h)

See also

FLT_CONTEXT_REGISTRATION
FLT_OPERATION_REGISTRATION
FltRegisterFilter
PFLT_FILTER_UNLOAD_CALLBACK
PFLT_GENERATE_FILE_NAME
PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK
PFLT_INSTANCE_SETUP_CALLBACK
PFLT_INSTANCE_TEARDOWN_CALLBACK
PFLT_NORMALIZE_CONTEXT_CLEANUP
PFLT_NORMALIZE_NAME_COMPONENT
PFLT_NORMALIZE_NAME_COMPONENT_EX
PFLT_POST_OPERATION_CALLBACK
PFLT_PRE_OPERATION_CALLBACK
PFLT_TRANSACTION_NOTIFICATION_CALLBACK

 

 

Send comments about this topic to Microsoft

Show:
© 2015 Microsoft