PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK callback function (fltkernel.h)
A minifilter driver can register a routine of type PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK as the minifilter driver's InstanceQueryTeardownCallback routine.
Syntax
PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK PfltInstanceQueryTeardownCallback;
NTSTATUS PfltInstanceQueryTeardownCallback(
[in] PCFLT_RELATED_OBJECTS FltObjects,
[in] FLT_INSTANCE_QUERY_TEARDOWN_FLAGS Flags
)
{...}
Parameters
[in] FltObjects
Pointer to an FLT_RELATED_OBJECTS structure that contains opaque pointers for the objects related to the current operation.
[in] Flags
Bitmask of flags that describe why the given instance query teardown callback routine was called. No flags are currently defined.
Return value
This callback routine returns STATUS_SUCCESS or an NTSTATUS value such as one of the following:
| Return code | Description |
|---|---|
|
Returning this status value prevents the minifilter driver instance from being detached. This is an error code. |
Remarks
When a minifilter driver registers itself by calling FltRegisterFilter from its DriverEntry routine, it can register a routine of type PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK as the minifilter driver's InstanceQueryTeardownCallback routine.
To register the InstanceQueryTeardownCallback routine, the minifilter driver stores the address of a routine of type PFLT_INSTANCE_QUERY_TEARDOWN_CALLBACK in the InstanceQueryTeardownCallback member of the FLT_REGISTRATION structure that the minifilter driver passes as the Registration parameter of FltRegisterFilter.
The filter manager calls this routine to allow the minifilter driver to respond to a manual detach request. Such a request is received when a user-mode application calls FilterDetach or a kernel-mode component calls FltDetachVolume.
This routine is not called for automatic or mandatory detach requests, for example, when the minifilter driver is unloaded or a volume is dismounted.
If this routine returns an error or warning NTSTATUS code, such as STATUS_FLT_DO_NOT_DETACH, the minifilter driver instance is not detached from the volume. Otherwise, the instance is detached.
If a minifilter driver does not define an InstanceQueryTeardownCallback routine, its instances cannot be detached manually by calling FilterDetach or FltDetachVolume.
Requirements
| Requirement | Value |
|---|---|
| Target Platform | Desktop |
| Header | fltkernel.h (include Fltkernel.h) |
| IRQL | PASSIVE_LEVEL |