Pending an I/O Operation in a Preoperation Callback Routine
A minifilter driver's preoperation callback routine can pend an I/O operation by posting the operation to a system work queue and returning FLT_PREOP_PENDING. Returning this status value indicates that the minifilter driver is retaining control of the I/O operation until it calls FltCompletePendedPreOperation to resume processing for the I/O operation.
A minifilter driver's preoperation callback routine pends an I/O operation by performing the following steps:
Posting the I/O operation to a system work queue by calling a routine such as FltQueueDeferredIoWorkItem.
A minifilter driver that must pend all (or most) incoming I/O operations should not use routines such as FltQueueDeferredIoWorkItem to pend operations, because calling this routine can cause the system work queues to be flooded. Instead, such a minifilter driver should use a cancel-safe queue. For more information about using cancel-safe queues, see FltCbdqInitialize.
Note that the call to FltQueueDeferredIoWorkItem will fail if any of the following conditions are true:
The operation is not an IRP-based I/O operation.
The operation is a paging I/O operation.
The TopLevelIrp field of the current thread is not NULL. (For more information about how to find the value of this field, see IoGetTopLevelIrp.)
The target instance for the I/O operation is being torn down.
If the minifilter driver's preoperation callback routine returns FLT_PREOP_PENDING, it must return NULL in the CompletionContext output parameter.
A minifilter driver can return FLT_PREOP_PENDING only for IRP-based I/O operations. To determine whether an operation is an IRP-based I/O operation, use the FLT_IS_IRP_OPERATION macro.
The work routine that dequeues and processes the I/O operation must call FltCompletePendedPreOperation to resume processing for the operation.