Writing Preoperation and Postoperation Callback Routines
In its DriverEntry routine, a minifilter driver can register up to one preoperation callback routine and up to one postoperation callback routine for each type of I/O operation that it needs to filter.
Unlike a legacy file system filter driver, a minifilter driver can choose which types of I/O operations to filter. A minifilter driver can register a preoperation callback routine for a given type of I/O operation without registering a postoperation callback, and vice versa. The minifilter driver receives only those I/O operations for which it has registered a preoperation or postoperation callback routine.
A preoperation callback routine is similar to a dispatch routine in the legacy filter driver model. When the filter manager processes an I/O operation, it calls the preoperation callback routine of each minifilter driver in the minifilter driver instance stack that has registered one for this type of I/O operation. The topmost minifilter driver in the stack--that is, the one whose instance has the highest altitude--receives the operation first. When that minifilter driver finishes processing the operation, it returns the operation to the filter manager, which then passes the operation to the next-highest minifilter driver, and so on. When all minifilter drivers in the minifilter driver instance stack have processed the I/O operation--unless a minifilter driver has completed the I/O operation--the filter manager sends the operation to legacy filters and the file system.
A postoperation callback routine is similar to a completion routine in the legacy filter driver model. Completion processing for an I/O operation begins when the I/O manager passes the operation to the file system and legacy filters that have registered completion routines for the operation. After these completion routines have finished, the filter manager performs completion processing for the operation. The filter manager then calls the postoperation callback routine of each minifilter driver in the minifilter driver instance stack that has registered one for this type of I/O operation. The bottom minifilter driver in the stack--that is, the one whose instance has the lowest altitude--receives the operation first. When that minifilter driver finishes processing the operation, it returns it to the filter manager, which then passes the operation to the next-lowest minifilter driver, and so on.
This section includes:
Registering Preoperation and Postoperation Callback Routines
Filtering I/O Operations in a Minifilter Driver
Writing Preoperation Callback Routines
Writing Postoperation Callback Routines
Modifying the Parameters for an I/O Operation