Post routines (Mini Filter Driver) at Passive Level

NTFSD
1

Hi All,

Post routines (Completion Routines) in Mini Filter Driver can be called at Dispatch Level. But i want to perform some of the operations at PASSIVE_LEVEL only. To perform these operation i am using the critical Queues and returning MORE_PROCESSING_REQUIRED from Post operations.

I need to use some of the parameters passed to me in the post operations. and I have some questions regarding the parameters PFLT_CALLBACK_DATA and PCFLT_RELATED_OBJECTS.

  1. Will FLT_CALLBACK_DATA be valid by the time worker thread will be called? I am passing this pointer to the worker thread using the context? As i am returning MORE_PROCESSING_REQUIRED from the Post routine, IRP is not yet complete yet. So can i assume that PFLT_CALLBACK_DATA will be valid in worker thread? Or i shall allocate my own memory and pass on the required data.

  2. TargetFileObject and TargetInstance in IO Parameter block of FLT_CALLBACK_DATA are ALWAYS same as FileObject and Instance in the FLT_RELATED_OBJECTS? From the documentation its not clear.

thanks in advance

2

AFAIT It should not be de-allocated as a system can have some mini filters above your filter which actually can access the data in their post routine, so it should remain intact till the last mini-filter return post operation completed.

One alternative is to return preop_synchronize from your pre-handler but it has its own performance issues, if required you can refer to http://msdn.microsoft.com/en-us/library/ms793672.aspx.

Thanks
Aditya

3

Thanks Aditya,

Thats what was my understanding. Thanks a lot for clarification.

How about TargetFileObject and TargetInstance in IO Parameter block of FLT_CALLBACK_DATA are ALWAYS same as FileObject and Instance in the FLT_RELATED_OBJECTS?

I guess FileObjects would be ALWAYS same, but i am not sure about Instance.