Edit

Pending an I/O Operation in a Postoperation Callback Routine

  • Article

A minifilter driver's postoperation callback routine can pend an I/O operation by performing the following steps:

  1. Calling FltAllocateDeferredIoWorkItem to allocate a work item for the I/O operation.

  2. Calling FltQueueDeferredIoWorkItem to post the I/O operation to a system work queue.

  3. Returning FLT_POSTOP_MORE_PROCESSING_REQUIRED.

Note that the call to FltQueueDeferredIoWorkItem will fail if any of the following conditions are true:

  • The operation is not an IRP-based I/O operation.

  • The operation is a paging I/O operation.

  • The TopLevelIrp field of the current thread is not NULL. (For more information about how to find the value of this field, see IoGetTopLevelIrp.)

  • The target instance for the I/O operation is being torn down. (The filter manager indicates this situation by setting the FLTFL_POST_OPERATION_DRAINING flag in the Flags input parameter to the postoperation callback routine.)

Minifilter drivers must be prepared to handle this failure. If your minifilter driver cannot handle such failures, you should consider using the technique that is described in Returning FLT_PREOP_SYNCHRONIZE instead of pending the I/O operation.

After the minifilter driver's postoperation callback routine returns FLT_POSTOP_MORE_PROCESSING_REQUIRED, the filter manager will not perform any further completion processing for the I/O operation until the minifilter driver's work routine calls FltCompletePendedPostOperation to return control of the operation to the filter manager. The filter manager will not perform any further processing in this situation even if the work routine sets a failure NTSTATUS value in the IoStatus.Status field of the callback data structure for the operation.

The work routine that dequeues and performs completion processing for the I/O operation must call FltCompletePendedPostOperation to return control of the operation to the filter manager.