FltAllocateExtraCreateParameter - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers
// fltkernel.h

NTSTATUS FLTAPI FltAllocateExtraCreateParameter(
  [in]           PFLT_FILTER                                    Filter,
  [in]           LPCGUID                                        EcpType,
  [in]           ULONG                                          SizeOfContext,
  [in]           FSRTL_ALLOCATE_ECP_FLAGS                       Flags,
  [in, optional] PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK CleanupCallback,
  [in]           ULONG                                          PoolTag,
  [out]          PVOID                                          *EcpContext
);

View the official Windows Driver Kit DDI reference

NtDoc

No description available.

Windows Driver Kit DDI reference (nf-fltkernel-fltallocateextracreateparameter)

FltAllocateExtraCreateParameter function

Description

The FltAllocateExtraCreateParameter routine allocates paged memory pool for a user-defined extra create parameter (ECP) context structure and generates a pointer to that structure.

Parameters

Filter [in]

Opaque filter pointer for the minifilter driver. This pointer uniquely identifies the minifilter driver and remains constant as long as the minifilter driver is loaded.

EcpType [in]

Pointer to a user-defined GUID indicating the type of the ECP context structure. See Using GUIDs in Drivers for more information.

SizeOfContext [in]

The size, in bytes, of the user-defined context structure.

Flags [in]

Defines pool allocation options. The following describes how pool will be allocated when one or more of the listed flag values are combined with the Flags parameter by using a bitwise OR operation:

If more than one flag is used, all of the effects associated with the utilized flag values will occur.

CleanupCallback [in, optional]

Optional pointer to a minifilter-defined cleanup callback routine of type PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK. The cleanup callback routine is called when the ECP structure (created by the FltAllocateExtraCreateParameter routine) is deleted. Set this parameter to NULL if a cleanup callback routine is not applicable.

PoolTag [in]

Specifies the pool tag for the allocated memory. For more information, see the Tag parameter of ExAllocatePoolWithTag.

EcpContext [out]

Receives a pointer to the allocated ECP context structure. If the routine failed to allocate sufficient pool, *EcpContext will be NULL and the routine will return status code STATUS_INSUFFICIENT_RESOURCES.

Return value

FltAllocateExtraCreateParameter can return one of the following values:

Return code Description
STATUS_INSUFFICIENT_RESOURCES FltAllocateExtraCreateParameter was unable to allocate sufficient memory for an ECP structure. In this case, EcpContext will be NULL.
STATUS_SUCCESS The ECP structure was successfully allocated. In this case, a pointer to the allocated structure is returned in the EcpContext parameter.

Remarks

By default, the FltAllocateExtraCreateParameter routine allocates paged memory pool for a user-defined ECP context structure. If the FSRTL_ALLOCATE_ECP_FLAG_NONPAGED_POOL bitmask is used as described above, a non-paged memory pool is allocated. Once this pool has been allocated and the ECP context structure has been initialized, the FltInsertExtraCreateParameter routine is used to insert the ECP context structure (ECP list element) into an ECP list structure (ECP list).

Memory pool that is allocated by the FltAllocateExtraCreateParameter routine is not automatically freed by the operating system. This memory pool must eventually be released by using one of the following methods:

See also

ECP_LIST

FltAllocateExtraCreateParameterFromLookasideList

FltAllocateExtraCreateParameterList

FltCreateFileEx2

FltFreeExtraCreateParameter

FltFreeExtraCreateParameterList

FltGetEcpListFromCallbackData

FltInsertExtraCreateParameter

FltRemoveExtraCreateParameter

FltSetEcpListIntoCallbackData

IoCreateFileEx

PFSRTL_EXTRA_CREATE_PARAMETER_CLEANUP_CALLBACK