none
Instance Tear Down Call Callback RRS feed

  • Question

  • I am writing following function for safely unloading driver without causing system crash.

    typedef VOID ( *PFLT_INSTANCE_TEARDOWN_CALLBACK)(
      _In_  PCFLT_RELATED_OBJECTS FltObjects,
      _In_  FLT_INSTANCE_TEARDOWN_FLAGS Reason
    );

    It requires following functions to be called within above function.

    VOID FltCompletePendedPreOperation(
      _In_      PFLT_CALLBACK_DATA Data,
      _In_      FLT_PREOP_CALLBACK_STATUS CallbackStatus,
      _In_opt_  PVOID Context
    );

    VOID FltCbdqDisable(
      _Inout_  PFLT_CALLBACK_DATA_QUEUE Cbdq
    );

    VOID FltCompletePendedPostOperation(
      _In_  PFLT_CALLBACK_DATA CallbackData
    );

    But from where to get PFLT_CALLBACK_DATA Data and PFLT_CALLBACK_DATA_QUEUE Cbdq inside VOID ( *PFLT_INSTANCE_TEARDOWN_CALLBACK)() funtion  ,So that they can be passed to above mentioned functions.

    Tuesday, January 8, 2013 7:24 AM

Answers

  • You need to store in the instance context the Cbdq then you use FltCbdqRemoveNextIo to fetch the Data and complete the pended operations.  Note: to do this it assumes you have been using FltCbdqInsertIo to pend the operations, a lot of file system filters just pass through the operations so don't need this.


    Don Burn Windows Filesystem and Driver Consulting Website: http://www.windrvr.com Blog: http://msmvps.com/blogs/WinDrvr

    Tuesday, January 8, 2013 12:58 PM