Passing I/O Operations Down the Minifilter Driver Instance Stack
When a minifilter driver's preoperation callback routine or work routine returns an I/O operation to the filter manager, the filter manager sends the operation to minifilter drivers below the current minifilter driver in the minifilter driver instance stack and to legacy filters and the file system for further processing.
A minifilter driver's preoperation callback routine returns an I/O operation to the filter manager for further processing by returning one of the following status values:
FLT_PREOP_SUCCESS_NO_CALLBACK (all operation types)
FLT_PREOP_SUCCESS_WITH_CALLBACK (all operation types)
FLT_PREOP_SYNCHRONIZE (IRP-based I/O operations only)
Note Although FLT_PREOP_SYNCHRONIZE should be returned only for IRP-based I/O operations, you can return this status value for other operation types. If it is returned for an I/O operation that is not an IRP-based I/O operation, the filter manager treats this return value as if it were FLT_PREOP_SUCCESS_WITH_CALLBACK.
Alternatively, the work routine for an operation that was pended in a preoperation callback routine returns an I/O operation to the filter manager by passing one of the preceding status values in the CallbackStatus parameter when it calls FltCompletePendedPreOperation to resume processing for the pended I/O operation.
This section includes:
Returning FLT_PREOP_SUCCESS_WITH_CALLBACK