FLT_CALLBACK_DATA structure (fltkernel.h)

The FLT_CALLBACK_DATA structure represents an I/O operation. The Filter Manager and minifilters use this structure to initiate and process I/O operations.

Syntax

typedef struct _FLT_CALLBACK_DATA {
  FLT_CALLBACK_DATA_FLAGS     Flags;
  PETHREAD                    Thread;
  PFLT_IO_PARAMETER_BLOCK     Iopb;
  IO_STATUS_BLOCK             IoStatus;
  struct _FLT_TAG_DATA_BUFFER *TagData;
  union {
    struct {
      LIST_ENTRY QueueLinks;
      PVOID      QueueContext[2];
    };
    PVOID FilterContext[4];
  };
  KPROCESSOR_MODE             RequestorMode;
} FLT_CALLBACK_DATA, *PFLT_CALLBACK_DATA;

Members

Flags

Bitmask of flags describing the I/O operation.

Minifilters can set the following flag.

Flag Meaning
FLTFL_CALLBACK_DATA_DIRTY A minifilter sets this flag (by calling FltSetCallbackDataDirty) to indicate that it has modified the contents of the callback data structure. (For more information, see the following Remarks section.)

Note

Only the Filter Manager can set the following flags.

When the Filter Manager initializes the callback data structure, it sets one of the following flags to specify the type of I/O operation that the callback data structure represents.

Flag Meaning
FLTFL_CALLBACK_DATA_FAST_IO_OPERATION The callback data structure represents a fast I/O operation.
FLTFL_CALLBACK_DATA_FS_FILTER_OPERATION The callback data structure represents a file system minifilter callback operation.
FLTFL_CALLBACK_DATA_IRP_OPERATION The callback data structure represents an I/O request packet (IRP)-based operation.

Note

Only the Filter Manager can set the following flags.

When the Filter Manager initializes the callback data structure, it can also set the following flags.

Flag Meaning
FLTFL_CALLBACK_DATA_GENERATED_IO The callback data structure represents an I/O operation that was generated by a minifilter. This flag is valid only for IRP-based operations.
FLTFL_CALLBACK_DATA_REISSUED_IO The callback data structure represents an I/O operation that is being reissued by a minifilter. (To reissue an I/O operation, a minifilter calls FltReissueSynchronousIo.) This flag is valid only for IRP-based operations.
FLTFL_CALLBACK_DATA_SYSTEM_BUFFER The buffer for the I/O operation was allocated from nonpaged pool. This flag can be set for any type of I/O operation. Minifilters must never set this flag.

Note

Only the Filter Manager can set the following flags.

When the Filter Manager performs completion processing for the I/O operation that the callback data structure represents, it sets one or both of the following flags.

Flag Meaning
FLTFL_CALLBACK_DATA_DRAINING_IO The Filter Manager sets this flag to indicate that it is currently draining the completion node for the I/O operation. This flag is valid only during I/O completion.
FLTFL_CALLBACK_DATA_POST_OPERATION The Filter Manager sets this flag to indicate that it is currently calling registered post-operation callback (PFLT_POST_OPERATION_CALLBACK) routines for the operation. This flag is valid only during I/O completion.

Thread

Pointer to the thread that initiated the I/O operation. This field may be NULL.

Iopb

Pointer to an FLT_IO_PARAMETER_BLOCK structure that contains the parameters for the I/O operation.

IoStatus

An IO_STATUS_BLOCK structure that contains status and information for the I/O operation. A minifilter can modify the contents of this structure only in a pre-operation callback (PFLT_PRE_OPERATION_CALLBACK) routine from which it is about to return FLT_PREOP_COMPLETE or in a post-operation callback (PFLT_POST_OPERATION_CALLBACK) routine from which it is about to return FLT_POSTOP_FINISHED_PROCESSING. Otherwise, the contents of this structure are normally set by the Filter Manager.

TagData

Pointer to an FLT_TAG_DATA_BUFFER structure that contains reparse point data for the I/O operation. This pointer is valid only in the post-create path. Thus only a minifilter's post-operation callback routine can change the value of this member. A minifilter's post-create callback routine can change this member to point to a different FLT_TAG_DATA_BUFFER structure. However, if it changes the member to point to a different structure, it must first call ExFreePool to free the existing structure to prevent a pool memory leak.

QueueLinks

Queue links that a minifilter can use when the Filter Manager's callback data queue is used to pend the I/O operation.

QueueContext[2]

Array of context information pointers that a minifilter can use when the Filter Manager's queue is used to pend the I/O operation.

FilterContext[4]

Array of context information pointers that a minifilter can use when a queue other than the Filter Manager's queue is used to pend the I/O operation.

RequestorMode

Indicates the execution mode of the process that initiated the I/O operation, either KernelMode or UserMode.

Remarks

A minifilter registers pre-operation (PFLT_PRE_OPERATION_CALLBACK) and post-operation (PFLT_POST_OPERATION_CALLBACK) callback routines for one or more types of I/O operations. When the Filter Manager calls one of these callback routines, it passes a callback data (FLT_CALLBACK_DATA) structure as the first parameter. This structure represents the I/O operation.

A minifilter's pre-operation or post-operation callback routine can modify the contents of the callback data structure, except for the Thread and RequestorMode members. If it does, it must then call FltSetCallbackDataDirty, unless it has also modified the contents of the IoStatus member. Otherwise, the modified values are ignored.

A minifilter can initiate an I/O operation by calling a support routine such as FltReadFile or by calling FltAllocateCallbackData to allocate a callback data structure; initializing the structure's I/O parameters, and passing the structure to FltPerformSynchronousIo or FltPerformAsynchronousIo.

A minifilter-initiated I/O operation is sent only to the minifilter instances attached below the calling instance, and to the file system. Minifilters attached above the specified instance do not receive the I/O operation.

Minifilters can only initiate IRP-based I/O operations. They cannot initiate fast I/O or file system filter (FSFilter) callback operations.

Requirements

Requirement Value
Header fltkernel.h (include Fltkernel.h)

See also

FLT_IO_PARAMETER_BLOCK

FLT_IS_FASTIO_OPERATION

FLT_IS_FS_FILTER_OPERATION

FLT_IS_IRP_OPERATION

FLT_IS_REISSUED_IO

FLT_IS_SYSTEM_BUFFER

FLT_REGISTRATION

FLT_RELATED_OBJECTS

FLT_TAG_DATA_BUFFER

FltAllocateCallbackData

FltFreeCallbackData

FltPerformAsynchronousIo

FltPerformSynchronousIo

FltReadFile

FltReissueSynchronousIo

FltReuseCallbackData

FltSetCallbackDataDirty

IO_STACK_LOCATION

IO_STATUS_BLOCK

IRP

PFLT_POST_OPERATION_CALLBACK

PFLT_PRE_OPERATION_CALLBACK