Minifilter中 Filter Initiated I/O（过滤器自产生I/O）

下面的话摘自《Filter Driver Developer Guide》：

Certain minifilters need to perform I/O of theirown.  This I/O is only seen byminifilters below the current minifilter in the minifilter stack of theVolume.  For instance, an anti-virusminifilter may wish to read a file before an open has completed.  In the new minifilter model, a minifilter willbe able to generate I/O in one of two ways: using general routines similar totoday's routines, and using simplified routines that provide an interfacesimilar to the ZwXxx routines.

The general routines that the system provides tominifilters for I/O generation are:

NTSTATUS

FLTAPI

FltAllocateCallbackData (

    INPFLT_INSTANCE Instance,

    INPFILE_OBJECT FileObject OPTIONAL,

    OUTPFLT_CALLBACK_DATA *RetNewCallbackData

    );

 

VOID

FLTAPI

FltPerformSynchronousIo(

    IN PFLT_CALLBACK_DATA CallbackData

    );

 

NTSTATUS

FLTAPI

FltPerformAsynchronousIo(

    IN PFLT_CALLBACK_DATA CallbackData,

    IN PFLT_COMPLETED_ASYNC_IO_CALLBACKCallbackRoutine,

    IN PVOID CallbackContext

    );

Using the general routines, a minifilter cancall FltAllocateCallbackData() to allocate a CallbackData for the operation, and then fill in the appropriate parameters inthe CallbackData for the desired operation. The minifilter then calls FltPerformSynchronousIo() or FltPerformAsynchronousIo() to actually initiate the I/O. The instance parameter should always be for the current instance doingthe I/O operation.

In addition Filter Manager exports some commonutility routines. Examples:

NTSTATUS

FLTAPI

FltCreateFile(

    IN PFLT_FILTER Filter,

    IN PFLT_INSTANCE Instance OPTIONAL,

    OUT PHANDLE   FileHandle,

    IN ACCESS_MASK DesiredAccess,

    INPOBJECT_ATTRIBUTES ObjectAttributes,

    OUT PIO_STATUS_BLOCK IoStatusBlock,

    IN PLARGE_INTEGER AllocationSize OPTIONAL,

    IN ULONG FileAttributes,

    IN ULONG ShareAccess,

    IN ULONG CreateDisposition,

    IN ULONG CreateOptions,

    IN PVOID EaBuffer OPTIONAL,

    IN ULONG EaLength,

    IN ULONG Flags

    );

If InstanceHandle is omitted,the CREATE will be sent to the top of the stack (so the minifilter initiatingthe operation will itself see the I/O recursively.) This is discouraged unlessabsolutely necessary as it can cause deadlocks and stack overflows ifminifilters misuse it.

If InstanceHandle is provided(this should always be your own instance), then the create is initiated withthe minifilter just below the caller of this API, by passing all legacyminifilters above the Filter Manager and minifi