May I write to file but bypass cache manager?

NTFSD
1

I want to perform a write in my minifilter. the write should not affect the cache manager in any ways.
actually I don’t want the written data to be cached.

  1. Is there any API or flag to prevent cache manager to cache write data? (I am using FltWriteFile)

As I read before, somewhere in this forum, CcPurgeCacheSection does not work in all conditions. The MSDN says it can’t purge a cache if:

CcPurgeCacheSection will not purge mapped files.
Before calling CcPurgeCacheSection, the caller must acquire the file exclusively and ensure >that no thread, including the caller, has mapped or pinned any byte range in the file.

  1. Is this the only condition that CcPurgeCacheSection won’t work under?
2

Specifying non-cached IO will by-pass system cache (except on compressed
volumes) but there are restrictions on the alignment of the request.

Pete

–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295

------ Original Message ------
From: xxxxx@yahoo.com
To: “Windows File Systems Devs Interest List”
Sent: 4/4/2017 12:05:32 AM
Subject: [ntfsd] May I write to file but bypass cache manager?

>I want to perform a write in my minifilter. the write should not affect
>the cache manager in any ways.
>actually I don’t want the written data to be cached.
>
>1. Is there any API or flag to prevent cache manager to cache write
>data? (I am using FltWriteFile)
>
>
>As I read before, somewhere in this forum, CcPurgeCacheSection does not
>work in all conditions. The MSDN says it can’t purge a cache if:
>
>>CcPurgeCacheSection will not purge mapped files.
>>Before calling CcPurgeCacheSection, the caller must acquire the file
>>exclusively and ensure >that no thread, including the caller, has
>>mapped or pinned any byte range in the file.
>
>2. Is this the only condition that CcPurgeCacheSection won’t work
>under?
>
>
>—
>NTFSD is sponsored by OSR
>
>
>MONTHLY seminars on crash dump analysis, WDF, Windows internals and
>software drivers!
>Details at http:
>
>To unsubscribe, visit the List Server section of OSR Online at
>http:</http:></http:>

3

even for a write operation the written data won’t be cached?

4

Only paging IO bypasses cache and it is tricky to implement paging IO.

Using paging IO with some network redirectors will not transfer data if a cached write have not been received by a redirector or there is no active file mapping, this is some sort of optimization.

You can try non cached IO but this will not bypass cache with some file system drivers(FSD). For example - encrypted or compressed NTFS files, some network redirectors, some isolation file system filters. Generally speaking non-cached IO is an advise to a FSD but it still has a liberty to process this requests through the Cache or Memory Manager, the latter is when a proprietary caching by file mapping is implemented .

CcPurgeCacheSection will not purge data if there is an active user file mapping in the system. Also you should not call CcPurgeCacheSection outside file system driver code or CC/MM subsystems, unfortunately you can’t add code to these subsystems.

Calling CcPurgeCacheSection before issuing IO will not solve the problem with cache as FSD will perform a call to the Cache Manager.

Staring from Windows 7 it is better to use CcCoherencyFlushAndPurgeCache which will invalidate user PTE that maps file data then flush data and purge cache. This function is also designed for file system drivers. Using it outside file system driver might result in unpredictable system behavior as it is not possible to synchronize correctly with FSD.