Using ECPs to Process IRP_MJ_CREATE Operations in a File System Filter Driver

You can use ECPs in your file system filter driver to process IRP_MJ_CREATE operations. Your file system filter driver can call the routines in the following sections to retrieve, acknowledge, add, and remove ECPs for the IRP_MJ_CREATE operation. You can also determine the operating-system space from which the ECPs originated.

Retrieving ECPs

Your file system filter driver can follow these steps to retrieve ECPs for the IRP_MJ_CREATE operation:

  1. Call the FltGetEcpListFromCallbackData or FsRtlGetEcpListFromIrp routine to retrieve a pointer to an ECP context structure list (ECP_LIST) that is associated with the create operation.

  2. Perform either of the following operations:

Setting ECPs

To set ECPs for the IRP_MJ_CREATE operation, your file system filter driver can first either retrieve an existing ECP context structure list (ECP_LIST) that is associated with the create operation, or allocate ECP_LIST and an ECP context structure and insert the ECP context structure in the ECP_LIST.

Your file system filter driver can follow these steps to set ECPs in an existing ECP_LIST that is associated with the create operation:

  1. Call the FltGetEcpListFromCallbackData or FsRtlGetEcpListFromIrp routine to retrieve a pointer to an ECP context structure list (ECP_LIST) that is associated with the create operation.

  2. Call the FltAllocateExtraCreateParameter or FsRtlAllocateExtraCreateParameter routine to allocate paged memory pool for an ECP context structure and to generate a pointer to that structure.

  3. Call the FltInsertExtraCreateParameter or FsRtlInsertExtraCreateParameter routine to insert ECP context structures into the ECP_LIST structure.

Your file system filter driver can follow these steps to set ECPs in a newly created ECP_LIST that is associated with the create operation:

  1. Call the FltAllocateExtraCreateParameterList or FsRtlAllocateExtraCreateParameterList routine to allocate memory for an ECP_LIST structure.

  2. Call the FltAllocateExtraCreateParameter or FsRtlAllocateExtraCreateParameter routine to allocate paged memory pool for an ECP context structure and to generate a pointer to that structure.

  3. Call the FltInsertExtraCreateParameter or FsRtlInsertExtraCreateParameter routine to insert ECP context structures into the ECP_LIST structure.

  4. Call the FltSetEcpListIntoCallbackData or FsRtlSetEcpListIntoIrp routine to attach an ECP list to the create operation.

Removing ECPs

Your file system filter driver can follow these steps to remove ECPs for the IRP_MJ_CREATE operation:

  1. Call the FltRemoveExtraCreateParameter or FsRtlRemoveExtraCreateParameter routine to search an ECP list for an ECP context structure. If the ECP context structure is found, the routine detaches the ECP context structure from the ECP list.

  2. To free the memory for the detached ECP context structure, call the FltFreeExtraCreateParameter or FsRtlFreeExtraCreateParameter routine. You can call these routines to free memory for the ECP context structure if you have allocated the memory in one of the following ways:

Marking ECPs as Acknowledged, or Determining Acknowledge Status

Your file system filter driver can call the following routines to either mark ECPs as acknowledged or determine whether the ECPs are marked as acknowledged:

Determining Origination Mode

Your file system filter driver can call the FltIsEcpFromUserMode or FsRtlIsEcpFromUserMode routine to determine whether an ECP context structure originated from user mode. A file system filter driver can refuse to accept an ECP context structure that originated from user mode.

Using Lookaside Lists to Allocate ECPs

Your file system filter driver can call the following routines to allocate ECPs from lookaside lists and to manage the lookaside lists and ECPs: