FLT_CALLBACK_DATA structure (fltkernel.h)
The FLT_CALLBACK_DATA structure represents an I/O operation. The Filter Manager and minifilters use this structure to initiate and process I/O operations.
Syntax
typedef struct _FLT_CALLBACK_DATA {
FLT_CALLBACK_DATA_FLAGS Flags;
PETHREAD Thread;
PFLT_IO_PARAMETER_BLOCK Iopb;
IO_STATUS_BLOCK IoStatus;
struct _FLT_TAG_DATA_BUFFER *TagData;
union {
struct {
LIST_ENTRY QueueLinks;
PVOID QueueContext[2];
};
PVOID FilterContext[4];
};
KPROCESSOR_MODE RequestorMode;
} FLT_CALLBACK_DATA, *PFLT_CALLBACK_DATA;
Members
Flags
Bitmask of flags describing the I/O operation.
Minifilters can set the following flag.
| Flag | Meaning |
|---|---|
| FLTFL_CALLBACK_DATA_DIRTY | A minifilter sets this flag (by calling FltSetCallbackDataDirty) to indicate that it has modified the contents of the callback data structure. (For more information, see the following Remarks section.) |
Note
Only the Filter Manager can set the following flags.
When the Filter Manager initializes the callback data structure, it sets one of the following flags to specify the type of I/O operation that the callback data structure represents.
| Flag | Meaning |
|---|---|
| FLTFL_CALLBACK_DATA_FAST_IO_OPERATION | The callback data structure represents a fast I/O operation. |
| FLTFL_CALLBACK_DATA_FS_FILTER_OPERATION | The callback data structure represents a file system minifilter callback operation. |
| FLTFL_CALLBACK_DATA_IRP_OPERATION | The callback data structure represents an I/O request packet (IRP)-based operation. |
Note
Only the Filter Manager can set the following flags.
When the Filter Manager initializes the callback data structure, it can also set the following flags.
| Flag | Meaning |
|---|---|
| FLTFL_CALLBACK_DATA_GENERATED_IO | The callback data structure represents an I/O operation that was generated by a minifilter. This flag is valid only for IRP-based operations. |
| FLTFL_CALLBACK_DATA_REISSUED_IO | The callback data structure represents an I/O operation that is being reissued by a minifilter. (To reissue an I/O operation, a minifilter calls FltReissueSynchronousIo.) This flag is valid only for IRP-based operations. |
| FLTFL_CALLBACK_DATA_SYSTEM_BUFFER | The buffer for the I/O operation was allocated from nonpaged pool. This flag can be set for any type of I/O operation. Minifilters must never set this flag. |
Note
Only the Filter Manager can set the following flags.
When the Filter Manager performs completion processing for the I/O operation that the callback data structure represents, it sets one or both of the following flags.
| Flag | Meaning |
|---|---|
| FLTFL_CALLBACK_DATA_DRAINING_IO | The Filter Manager sets this flag to indicate that it is currently draining the completion node for the I/O operation. This flag is valid only during I/O completion. |
| FLTFL_CALLBACK_DATA_POST_OPERATION | The Filter Manager sets this flag to indicate that it is currently calling registered post-operation callback (PFLT_POST_OPERATION_CALLBACK) routines for the operation. This flag is valid only during I/O completion. |
Thread
Pointer to the thread that initiated the I/O operation. This field may be NULL.
Iopb
Pointer to an FLT_IO_PARAMETER_BLOCK structure that contains the parameters for the I/O operation.
IoStatus
An IO_STATUS_BLOCK structure that contains status and information for the I/O operation. A minifilter can modify the contents of this structure only in a pre-operation callback (PFLT_PRE_OPERATION_CALLBACK) routine from which it is about to return FLT_PREOP_COMPLETE or in a post-operation callback (PFLT_POST_OPERATION_CALLBACK) routine from which it is about to return FLT_POSTOP_FINISHED_PROCESSING. Otherwise, the contents of this structure are normally set by the Filter Manager.
TagData
Pointer to an FLT_TAG_DATA_BUFFER structure that contains reparse point data for the I/O operation. This pointer is valid only in the post-create path. Thus only a minifilter's post-operation callback routine can change the value of this member. A minifilter's post-create callback routine can change this member to point to a different FLT_TAG_DATA_BUFFER structure. However, if it changes the member to point to a different structure, it must first call ExFreePool to free the existing structure to prevent a pool memory leak.
QueueLinks
Queue links that a minifilter can use when the Filter Manager's callback data queue is used to pend the I/O operation.
QueueContext[2]
Array of context information pointers that a minifilter can use when the Filter Manager's queue is used to pend the I/O operation.
FilterContext[4]
Array of context information pointers that a minifilter can use when a queue other than the Filter Manager's queue is used to pend the I/O operation.
RequestorMode
Indicates the execution mode of the process that initiated the I/O operation, either KernelMode or UserMode.
Remarks
A minifilter registers pre-operation (PFLT_PRE_OPERATION_CALLBACK) and post-operation (PFLT_POST_OPERATION_CALLBACK) callback routines for one or more types of I/O operations. When the Filter Manager calls one of these callback routines, it passes a callback data (FLT_CALLBACK_DATA) structure as the first parameter. This structure represents the I/O operation.
A minifilter's pre-operation or post-operation callback routine can modify the contents of the callback data structure, except for the Thread and RequestorMode members. If it does, it must then call FltSetCallbackDataDirty, unless it has also modified the contents of the IoStatus member. Otherwise, the modified values are ignored.
A minifilter can initiate an I/O operation by calling a support routine such as FltReadFile or by calling FltAllocateCallbackData to allocate a callback data structure; initializing the structure's I/O parameters, and passing the structure to FltPerformSynchronousIo or FltPerformAsynchronousIo.
A minifilter-initiated I/O operation is sent only to the minifilter instances attached below the calling instance, and to the file system. Minifilters attached above the specified instance do not receive the I/O operation.
Minifilters can only initiate IRP-based I/O operations. They cannot initiate fast I/O or file system filter (FSFilter) callback operations.
Requirements
| Requirement | Value |
|---|---|
| Header | fltkernel.h (include Fltkernel.h) |