PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK callback function (fltkernel.h)

A minifilter driver can register a routine of type PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK as the minifilter driver's InstanceQueryTeardownCallback routine.

Syntax

PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK PfltInstanceQueryTeardownCallback;

NTSTATUS PfltInstanceQueryTeardownCallback(
  [in] PCFLT_RELATED_OBJECTS FltObjects,
  [in] FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags
)
{...}

Parameters

[in] FltObjects

Pointer to an FLT_RELATED_OBJECTS structure that contains opaque pointers for the objects related to the current operation.

[in] Flags

Bitmask of flags that describe why the given instance query teardown callback routine was called. No flags are currently defined.

Return value

This callback routine returns STATUS_SUCCESS or an NTSTATUS value such as one of the following:

Remarks

When a minifilter driver registers itself by calling FltRegisterFilter from its DriverEntry routine, it can register a routine of type PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK as the minifilter driver's InstanceQueryTeardownCallback routine.

To register the InstanceQueryTeardownCallback routine, the minifilter driver stores the address of a routine of type PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK in the InstanceQueryTeardownCallback member of the FLT_REGISTRATION structure that the minifilter driver passes as the Registration parameter of FltRegisterFilter.

The filter manager calls this routine to allow the minifilter driver to respond to a manual detach request. Such a request is received when a user-mode application calls FilterDetach or a kernel-mode component calls FltDetachVolume.

This routine is not called for automatic or mandatory detach requests, for example, when the minifilter driver is unloaded or a volume is dismounted.

If this routine returns an error or warning NTSTATUS code, such as STATUS_FLT_DO_NOT_DETACH, the minifilter driver instance is not detached from the volume. Otherwise, the instance is detached.

If a minifilter driver does not define an InstanceQueryTeardownCallback routine, its instances cannot be detached manually by calling FilterDetach or FltDetachVolume.

Requirements

See also

FLT_REGISTRATION

FLT_RELATED_OBJECTS

FilterDetach

FltDetachVolume

FltRegisterFilter

PFLT_INSTANCE_SETUP_CALLBACK

PFLT_INSTANCE_TEARDOWN_CALLBACK