PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK routine

A minifilter driver can register a routine of type PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK as the minifilter driver's InstanceQueryTeardownCallback routine.

Syntax


PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK InstanceQueryTeardownCallback;

NTSTATUS InstanceQueryTeardownCallback(
  _In_ PCFLT_RELATED_OBJECTS             FltObjects,
  _In_ FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags
)
{ ... }

Parameters

FltObjects [in]

Pointer to an FLT_RELATED_OBJECTS structure that contains opaque pointers for the objects related to the current operation.

Flags [in]

Bitmask of flags that describe why the given instance query teardown callback routine was called. No flags are currently defined.

Return value

This callback routine returns STATUS_SUCCESS or an NTSTATUS value such as one of the following:

Return codeDescription
STATUS_FLT_DO_NOT_DETACH

Returning this status value prevents the minifilter driver instance from being detached. This is an error code.

 

Remarks

When a minifilter driver registers itself by calling FltRegisterFilter from its DriverEntry routine, it can register a routine of type PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK as the minifilter driver's InstanceQueryTeardownCallback routine.

To register the InstanceQueryTeardownCallback routine, the minifilter driver stores the address of a routine of type PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK in the InstanceQueryTeardownCallback member of the FLT_REGISTRATION structure that the minifilter driver passes as the Registration parameter of FltRegisterFilter.

The filter manager calls this routine to allow the minifilter driver to respond to a manual detach request. Such a request is received when a user-mode application calls FilterDetach or a kernel-mode component calls FltDetachVolume.

This routine is not called for automatic or mandatory detach requests, for example, when the minifilter driver is unloaded or a volume is dismounted.

If this routine returns an error or warning NTSTATUS code, such as STATUS_FLT_DO_NOT_DETACH, the minifilter driver instance is not detached from the volume. Otherwise, the instance is detached.

If a minifilter driver does not define an InstanceQueryTeardownCallback routine, its instances cannot be detached manually by calling FilterDetach or FltDetachVolume.

Requirements

Target platform

Header

Fltkernel.h (include Fltkernel.h)

IRQL

PASSIVE_LEVEL

See also

FilterDetach
FLT_REGISTRATION
FLT_RELATED_OBJECTS
FltDetachVolume
FltRegisterFilter
PFLT_INSTANCE_SETUP_CALLBACK
PFLT_INSTANCE_TEARDOWN_CALLBACK

 

 

Send comments about this topic to Microsoft

Show: