FltXxx (Minifilter Driver) Macros

The following table contains minifilter driver macros.

MacroDeclared inDescription
FLT_IS_FASTIO_OPERATION

fltkernel.h

The FLT_IS_FASTIO_OPERATION macro determines whether the given callback data structure represents a fast I/O operation.

Data [in]

PFLT_CALLBACK_DATA

A pointer to a callback data (FLT_CALLBACK_DATA) structure.

Return value

BOOLEAN

FLT_IS_FASTIO_OPERATION returns a nonzero value if the fast I/O operation flag is set in the callback data structure. Otherwise, it returns zero.

The FLT_IS_FASTIO_OPERATION macro checks whether the FLTFL_CALLBACK_DATA_FAST_IO_OPERATION bit is set in the Flags member of the FLT_CALLBACK_DATA structure that the Data parameter points to. Thus, the return type of FLT_IS_FASTIO_OPERATION is of the same type as the Flags member.

FLT_IS_FS_FILTER_OPERATION

fltkernel.h

The FLT_IS_FS_FILTER_OPERATION macro determines whether the given callback data structure represents a file system filter (FSFilter) callback operation.

Data [in]

PFLT_CALLBACK_DATA

A pointer to a callback data (FLT_CALLBACK_DATA) structure.

Return value

BOOLEAN

FLT_IS_FS_FILTER_OPERATION returns a nonzero value if the FLTFL_CALLBACK_DATA_FS_FILTER_OPERATION flag is set in the callback data structure. Otherwise, it returns zero.

The FLT_IS_FS_FILTER_OPERATION macro checks whether the FLTFL_CALLBACK_DATA_FS_FILTER_OPERATION bit is set in the Flags member of the FLT_CALLBACK_DATA structure that the Data parameter points to. If this flag is set, the callback data structure represents one of the following file system filter (FSFilter) callback operations:

IRP_MJ_ACQUIRE_FOR_CC_FLUSH

IRP_MJ_ACQUIRE_FOR_MOD_WRITE

IRP_MJ_ACQUIRE_FOR_SECTION_SYNCHRONIZATION

IRP_MJ_RELEASE_FOR_CC_FLUSH

IRP_MJ_RELEASE_FOR_MOD_WRITE

IRP_MJ_RELEASE_FOR_SECTION_SYNCHRONIZATION

For information about specific FSFilter callback operations, see the reference entry for FsRtlRegisterFileSystemFilterCallbacks. Note that in the legacy filter driver model, filters used FsRtlRegisterFileSystemFilterCallbacks to register callback functions for various FSFilter callback operations. However, FsRtlRegisterFileSystemFilterCallbacks is not used in the minifilter driver model, and minifilter drivers should never call it.

Note  The return type of FLT_IS_FS_FILTER_OPERATION is of the same type as the Flags member of the FLT_CALLBACK_DATA structure.
 
FLT_IS_IRP_OPERATION

fltkernel.h

The FLT_IS_IRP_OPERATION macro determines whether the given callback data structure represents an I/O request packet (IRP)-based I/O operation.

Data [in]

PFLT_CALLBACK_DATA

A pointer to a callback data (FLT_CALLBACK_DATA) structure.

Return value

BOOLEAN

FLT_IS_IRP_OPERATION returns a nonzero value if the IRP operation flag is set in the callback data structure. Otherwise, it returns zero.

The FLT_IS_IRP_OPERATION macro checks whether the FLTFL_CALLBACK_DATA_IRP_OPERATION bit is set in the Flags member of the FLT_CALLBACK_DATA structure that the Data parameter points to. Thus, the return type of FLT_IS_IRP_OPERATION is of the same type as the Flags member.

FLT_IS_REISSUED_IO

fltkernel.h

The FLT_IS_REISSUED_IO macro determines whether the given callback data structure represents a reissued I/O operation.

Data [in]

PFLT_CALLBACK_DATA

A pointer to a callback data (FLT_CALLBACK_DATA) structure.

Return value

BOOLEAN

FLT_IS_REISSUED_IO returns TRUE if the reissued I/O operation flag is set in the callback data structure; FALSE otherwise.

The FLT_IS_REISSUED_IO macro checks whether the FLTFL_CALLBACK_DATA_REISSUED_IO flag is set in the Flags member of the FLT_CALLBACK_DATA structure that the Data parameter points to. This flag is set by FltReissueSynchronousIo when an I/O operation is reissued. This flag is valid only for IRP-based I/O operations. To determine whether an I/O operation is IRP-based, use the FLT_IS_IRP_OPERATION macro.

FLT_IS_SYSTEM_BUFFER

fltkernel.h

The FLT_IS_SYSTEM_BUFFER macro tests the system buffer flag in a callback data structure.

Data [in]

PFLT_CALLBACK_DATA

A pointer to a callback data (FLT_CALLBACK_DATA) structure.

Return value

BOOLEAN

FLT_IS_SYSTEM_BUFFER returns TRUE if the system buffer flag is set in the callback data structure; FALSE otherwise.

The FLT_IS_SYSTEM_BUFFER macro checks whether the system buffer flag (FLTFL_CALLBACK_DATA_SYSTEM_BUFFER) is set in a callback data (FLT_CALLBACK_DATA) structure.

The system buffer flag is set in the callback data structure for an I/O operation if the buffer for the operation is allocated from nonpaged pool. If this flag is set, minifilter drivers can assume that the buffer is already locked down and can be accessed safely.

Note that minifilter drivers must never set the system buffer flag.

IS_ALIGNED

fltkernel.h

The IS_ALIGNED macro determines whether the first argument is aligned on the specified power-of-2 boundary.

_pointer

The pointer to check for proper alignment.

_alignment

A power of two that specifies the alignment.

Return value

BOOLEAN

The IS_ALIGNED macro returns a value of TRUE if the pointer is properly aligned or FALSE if the pointer is not properly aligned.

Minifilter drivers can use the IS_ALIGNED macro to verify that a pointer has the proper alignment for a 32-bit or 64-bit process. For instance, the following example verifies that the pointer is properly aligned for a 32-bit process:

if ( !IS_ALIGNED(OutputBuffer,sizeof(ULONG))) {
    status = STATUS_DATATYPE_MISALIGNMENT;
    break;
}

 

Related topics

FLT_CALLBACK_DATA
FLT_IS_FS_FILTER_OPERATION
FLT_IS_IRP_OPERATION
FLT_IS_REISSUED_IO
FLT_IS_SYSTEM_BUFFER

 

 

Send comments about this topic to Microsoft

Show: