FLT_OPERATION_REGISTRATION structure

The FLT_OPERATION_REGISTRATION structure is used to register operation callback routines.

Syntax


typedef struct _FLT_OPERATION_REGISTRATION {
  UCHAR                            MajorFunction;
  FLT_OPERATION_REGISTRATION_FLAGS Flags;
  PFLT_PRE_OPERATION_CALLBACK      PreOperation;
  PFLT_POST_OPERATION_CALLBACK     PostOperation;
  PVOID                            Reserved1;
} FLT_OPERATION_REGISTRATION, *PFLT_OPERATION_REGISTRATION;

Members

MajorFunction

Major function code specifying the type of I/O operation. This member is required and cannot be NULL. For more information about additional operations, see FLT_PARAMETERS.

Flags

Bitmask of flags specifying when to call the preoperation (PFLT_PRE_OPERATION_CALLBACK) and postoperation (PFLT_POST_OPERATION_CALLBACK) callback routines for cached I/O or paging I/O operations. This member is optional and can be zero.

FlagDescription

FLTFL_OPERATION_REGISTRATION_SKIP_CACHED_IO

A minifilter sets this flag for read or write operations to specify that its preoperation and postoperation callback routines should not be called for cached I/O operations. This flag applies to fast I/O as well as IRP-based reads and writes because all fast I/O is cached.

FLTFL_OPERATION_REGISTRATION_SKIP_PAGING_IO

A minifilter sets this flag for read or write operations to specify that its preoperation and postoperation callback routines should not be called for paging I/O operations. This flag applies only to IRP-based I/O operations. It is ignored for I/O operations that are not IRP-based.

 

PreOperation

Pointer to a PFLT_PRE_OPERATION_CALLBACK-typed routine to be registered as the preoperation callback routine for this type of I/O operation. This member is optional and can be NULL.

PostOperation

Pointer to a PFLT_POST_OPERATION_CALLBACK-typed routine to be registered as the postoperation callback routine for this type of I/O operation. This member is optional and can be NULL.

Reserved1

Reserved for system use. Minifilters must set this member to NULL.

Remarks

When a minifilter calls FltRegisterFilter from its DriverEntry routine, it can register a preoperation callback (PFLT_PRE_OPERATION_CALLBACK) routine and a postoperation callback (PFLT_POST_OPERATION_CALLBACK) routine for each type of I/O operation that it must handle.

To register these callback routines, the minifilter creates a variable-length array of FLT_OPERATION_REGISTRATION structures and stores a pointer to the array in the OperationRegistration member of the FLT_REGISTRATION structure that the minifilter passes as the Registration parameter of FltRegisterFilter. The last element of this array must be {IRP_MJ_OPERATION_END}.

The minifilter must create a separate FLT_OPERATION_REGISTRATION structure for each type of I/O operation that it handles. In this structure, the minifilter specifies the entry points of its callback routines in the structure's PreOperation and PostOperation members.

A minifilter can register a preoperation callback routine for a given type of I/O operation without registering a postoperation callback and vice versa.

File systems do not receive IRP_MJ_POWER or IRP_MJ_DEVICE_CHANGE requests. Minifilters cannot register preoperation or postoperation callback routines for these operations.

A minifilter cannot register a postoperation callback routine for IRP_MJ_SHUTDOWN.

A single preoperation or postoperation callback routine can be used to process more than one type of I/O operation. However, the callback routine must be registered separately for each type of I/O operation.

Requirements

Header

Fltkernel.h (include Fltkernel.h)

See also

FLT_REGISTRATION
FltRegisterFilter
PFLT_POST_OPERATION_CALLBACK
PFLT_PRE_OPERATION_CALLBACK

 

 

Send comments about this topic to Microsoft

Show: