FLT_CALLBACK_DATA structure

The FLT_CALLBACK_DATA structure represents an I/O operation. The Filter Manager and minifilters use this structure to initiate and process I/O operations.

Syntax


typedef struct _FLT_CALLBACK_DATA {
  FLT_CALLBACK_DATA_FLAGS       Flags;
  const PETHREAD                Thread;
  const PFLT_IO_PARAMETER_BLOCK Iopb;
  IO_STATUS_BLOCK               IoStatus;
  struct _FLT_TAG_DATA_BUFFER  *TagData;
  union {
    struct {
      LIST_ENTRY QueueLinks;
      PVOID      QueueContext[2];
    };
    PVOID  FilterContext[4];
  };
  KPROCESSOR_MODE               RequestorMode;
} FLT_CALLBACK_DATA, *PFLT_CALLBACK_DATA;

Members

Flags

Bitmask of flags describing the I/O operation.

Note  Minifilters can set the following flag.
 
FlagMeaning

FLTFL_CALLBACK_DATA_DIRTY

A minifilter sets this flag (by calling FltSetCallbackDataDirty) to indicate that it has modified the contents of the callback data structure. (For more information, see the following Remarks section.)

 

Note  Only the Filter Manager can set the following flags.
 

When the Filter Manager initializes the callback data structure, it sets one of the following flags to specify the type of I/O operation that the callback data structure represents.

FlagMeaning

FLTFL_CALLBACK_DATA_FAST_IO_OPERATION

The callback data structure represents a fast I/O operation.

FLTFL_CALLBACK_DATA_FS_FILTER_OPERATION

The callback data structure represents a file system minifilter callback operation.

FLTFL_CALLBACK_DATA_IRP_OPERATION

The callback data structure represents an I/O request packet (IRP)-based operation.

 

Note  Only the Filter Manager can set the following flags.
 

When the Filter Manager initializes the callback data structure, it can also set the following flags.

FlagMeaning

FLTFL_CALLBACK_DATA_GENERATED_IO

The callback data structure represents an I/O operation that was generated by a minifilter. This flag is valid only for IRP-based operations.

FLTFL_CALLBACK_DATA_REISSUED_IO

The callback data structure represents an I/O operation that is being reissued by a minifilter. (To reissue an I/O operation, a minifilter calls FltReissueSynchronousIo.) This flag is valid only for IRP-based operations.

FLTFL_CALLBACK_DATA_SYSTEM_BUFFER

The buffer for the I/O operation was allocated from nonpaged pool. This flag can be set for any type of I/O operation. Minifilters must never set this flag.

 

Note  Only the Filter Manager can set the following flags.
 

When the Filter Manager performs completion processing for the I/O operation that the callback data structure represents, it sets one or both of the following flags.

FlagMeaning

FLTFL_CALLBACK_DATA_DRAINING_IO

The Filter Manager sets this flag to indicate that it is currently draining the completion node for the I/O operation. This flag is valid only during I/O completion.

FLTFL_CALLBACK_DATA_POST_OPERATION

The Filter Manager sets this flag to indicate that it is currently calling registered postoperation callback (PFLT_POST_OPERATION_CALLBACK) routines for the operation. This flag is valid only during I/O completion.

 

Thread

Pointer to the thread that initiated the I/O operation.

Iopb

Pointer to an FLT_IO_PARAMETER_BLOCK structure that contains the parameters for the I/O operation.

IoStatus

An IO_STATUS_BLOCK structure that contains status and information for the I/O operation. A minifilter can modify the contents of this structure only in a preoperation callback (PFLT_PRE_OPERATION_CALLBACK) routine from which it is about to return FLT_PREOP_COMPLETE or in a postoperation callback (PFLT_POST_OPERATION_CALLBACK) routine from which it is about to return FLT_POSTOP_FINISHED_PROCESSING. Otherwise, the contents of this structure are normally set by the Filter Manager.

TagData

Pointer to an FLT_TAG_DATA_BUFFER structure that contains reparse point data for the I/O operation. This pointer is valid only in the post-create path. Thus only a minifilter's postoperation callback routine can change the value of this member. A minifilter's post-create callback routine can change this member to point to a different FLT_TAG_DATA_BUFFER structure. However, if it changes the member to point to a different structure, it must first free the existing structure to prevent a pool memory leak.

QueueLinks

Queue links that a minifilter can use when the Filter Manager's callback data queue is used to pend the I/O operation.

QueueContext

Array of context information pointers that a minifilter can use when the Filter Manager's queue is used to pend the I/O operation.

FilterContext

Array of context information pointers that a minifilter can use when a queue other than the Filter Manager's queue is used to pend the I/O operation.

RequestorMode

Indicates the execution mode of the process that initiated the I/O operation, either KernelMode or UserMode.

Remarks

A minifilter registers preoperation (PFLT_PRE_OPERATION_CALLBACK) and postoperation (PFLT_POST_OPERATION_CALLBACK) callback routines for one or more types of I/O operations. When the Filter Manager calls one of these callback routines, it passes a callback data (FLT_CALLBACK_DATA) structure as the first parameter. This structure represents the I/O operation.

A minifilter's preoperation or postoperation callback routine can modify the contents of the callback data structure, except for the Thread and RequestorMode members. If it does, it must then call FltSetCallbackDataDirty, unless it has also modified the contents of the IoStatus member. Otherwise, the modified values are ignored.

A minifilter can initiate an I/O operation by calling a support routine such as FltReadFile or by calling FltAllocateCallbackData to allocate a callback data structure; initializing the structure's I/O parameters, and passing the structure to FltPerformSynchronousIo or FltPerformAsynchronousIo.

A minifilter-initiated I/O operation is sent only to the minifilter instances attached below the calling instance, and to the file system. Minifilters attached above the specified instance do not receive the I/O operation.

Minifilters can only initiate IRP-based I/O operations. They cannot initiate fast I/O or file system filter (FSFilter) callback operations.

Requirements

Header

Fltkernel.h (include Fltkernel.h)

See also

FLT_IO_PARAMETER_BLOCK
FLT_IS_FASTIO_OPERATION
FLT_IS_FS_FILTER_OPERATION
FLT_IS_IRP_OPERATION
FLT_IS_REISSUED_IO
FLT_IS_SYSTEM_BUFFER
FLT_REGISTRATION
FLT_RELATED_OBJECTS
FLT_TAG_DATA_BUFFER
FltAllocateCallbackData
FltFreeCallbackData
FltPerformAsynchronousIo
FltPerformSynchronousIo
FltReadFile
FltReissueSynchronousIo
FltReuseCallbackData
FltSetCallbackDataDirty
IO_STACK_LOCATION
IO_STATUS_BLOCK
IRP
PFLT_POST_OPERATION_CALLBACK
PFLT_PRE_OPERATION_CALLBACK

 

 

Send comments about this topic to Microsoft

Show: