Minifilter cancel-safe callback data queue and PeekContext RRS feed

  • Question

  • In the remarks section for FltCbdqInitialize, it says of CbdqPeekNextIo that the minifilter driver entirely defines the meaning of PeekContext, yet in description of this function earlier the documentation, it says that "The Filter Manager calls this function to get a pointer to the next I/O operation matching PeekContext in the queue".

    Since the Filter Manage has no knowledge of the meaning of the PeekContext, I don't see how it can do that.

    It appears that I'm missing something. What does the Filter Manager actually do when user space attempts to cancel a pending I/O operation?

    Edit: Some experiments indicate that the Filter Manager only calls CbdqRemoveIo for the operation being cancelled, and then the CbdqCompleteCanceledIo function.


    Saturday, May 5, 2018 3:27 AM


  • Your CbdqPeekNextIo routine will only be called if your driver calls FltCbdqRemoveNextIo.  The PeekContext is passed from that function into your callback, and has meaning only within your driver.

    Tim Roberts, Driver MVP Providenza & Boekelheide, Inc.

    Tuesday, May 8, 2018 5:42 AM