A file system filter driver typically creates a per-stream context structure for a file stream when the file stream is first opened. However, a per-stream context structure can be created and associated with a file stream during any operation.
Allocating the Per-Stream Context
Per-stream context structures can be allocated from paged or nonpaged pool. To allocate a per-stream context, call ExAllocatePoolWithTag as shown in the following example:
contextSize = sizeof(SPY_STREAM_CONTEXT) + fileName.Length; ctx = ExAllocatePoolWithTag(NonPagedPool, contextSize, MYLEGACYFILTER_CONTEXT_TAG);
Note If your filter allocates the per-stream context structure from paged pool, it cannot call ExAllocatePoolWithTag from its create completion routine. This is because completion routines can be called at IRQL DISPATCH_LEVEL.
Initializing the Per-Stream Context
File system filter drivers call FsRtlInitPerStreamContext to initialize a per-stream context structure. This routine initializes the FSRTL_PER_STREAM_CONTEXT portion of the context structure. (The remainder of the structure is filter-driver-specific.)
Note If your filter driver creates only one per-stream context structure per file stream, it should pass NULL for the InstanceId parameter to FsRtlInitPerStreamContext.
A filter driver can initialize a per-stream context at any time. However, it must do so before associating the context with a file stream.