Edit

Share via

Completing an I/O Operation in a Preoperation Callback Routine

  • Article

To complete an I/O operation means to halt processing for the operation, assign it a final NTSTATUS value, and return it to the filter manager.

When a minifilter driver completes an I/O operation, the filter manager does the following:

  • Does not send the operation to minifilter drivers below the current minifilter driver, to legacy filters, or to the file system.

  • Calls the postoperation callback routines of the minifilter drivers above the current minifilter driver in the minifilter driver instance stack.

  • Does not call the current minifilter driver's postoperation callback routine for the operation, if one exists.

A minifilter driver's preoperation callback routine completes an I/O operation by performing the following steps:

  1. Setting the callback data structure's IoStatus.Status field to the final NTSTATUS value for the operation.

  2. Returning FLT_PREOP_COMPLETE.

A preoperation callback routine that completes an I/O operation cannot set a non-NULL completion context (in the CompletionContext output parameter).

A minifilter driver can also complete an operation in the work routine for a previously pended I/O operation by performing the following steps:

  1. Setting the callback data structure's IoStatus.Status field to the final NTSTATUS value for the operation.

  2. Passing FLT_PREOP_COMPLETE in the CallbackStatus parameter when the work routine calls FltCompletePendedPreOperation.

When completing an I/O operation, a minifilter driver must set the callback data structure's IoStatus.Status field to the final NTSTATUS value for the operation, but this NTSTATUS value cannot be STATUS_PENDING or STATUS_FLT_DISALLOW_FAST_IO. For a cleanup or close operation, the field must be STATUS_SUCCESS. These operations cannot be completed with any other NTSTATUS value.

Completing an I/O operation is often referred to as succeeding or failing the operation, depending on the NTSTATUS value:

  • To succeed an I/O operation means to complete it with a success or informational NTSTATUS value, such as STATUS_SUCCESS.

  • To fail an I/O operation means to complete it with an error or warning NTSTATUS value, such as STATUS_INVALID_DEVICE_REQUEST or STATUS_BUFFER_OVERFLOW.

NTSTATUS values are defined in ntstatus.h. These values fall into four categories: success, informational, warning, and error. For more information about these values, see Using NTSTATUS Values.