PFLT_FILTER_UNLOAD_CALLBACK routine

A minifilter driver can register a routine of type PFLT_FILTER_UNLOAD_CALLBACK as the minifilter driver's FilterUnloadCallback routine.

Syntax


PFLT_FILTER_UNLOAD_CALLBACK FilterUnloadCallback;

NTSTATUS FilterUnloadCallback(
   FLT_FILTER_UNLOAD_FLAGS Flags
)
{ ... }

Parameters

Flags

Bitmask of flags describing the unload request. This parameter can be NULL or the following:

FlagMeaning

FLTFL_FILTER_UNLOAD_MANDATORY

The filter manager sets this flag to indicate that the unload operation is mandatory.

 

Return value

This callback routine returns STATUS_SUCCESS or an NTSTATUS value such as the following:

Return codeDescription
STATUS_FLT_DO_NOT_DETACH

If the unload operation is not mandatory, returning this status value prevents the minifilter driver from being unloaded. This is an error code.

 

Remarks

When a minifilter driver registers itself by calling FltRegisterFilter, it can register a FilterUnloadCallback routine. To register this callback routine, the minifilter driver stores the address of a routine of type PFLT_FILTER_UNLOAD_CALLBACK in the FilterUnloadCallback field of the FLT_REGISTRATION structure that the minifilter driver passes as a parameter to FltRegisterFilter.

Minifilter drivers are not required to register a FilterUnloadCallback routine. However, registering an unload routine is strongly recommended. If a minifilter driver does not register a FilterUnloadCallback routine, it cannot be unloaded.

The filter manager calls the minifilter driver's FilterUnloadCallback routine to notify the minifilter driver that the filter manager is about to unload the minifilter driver.

If the unload operation is not mandatory, and the FilterUnloadCallback routine returns an error or warning NTSTATUS code, such as STATUS_FLT_DO_NOT_DETACH, the minifilter driver is not unloaded. Otherwise, the minifilter driver is unloaded.

If the FLTFL_FILTER_UNLOAD_MANDATORY flag is set in the Flags parameter, the unload operation is mandatory, and the minifilter driver cannot prevent itself from being unloaded.

Requirements

Target platform

Desktop

Header

Fltkernel.h (include Fltkernel.h)

IRQL

PASSIVE_LEVEL

See also

FLT_REGISTRATION
FltRegisterFilter

 

 

Send comments about this topic to Microsoft

Show: