Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


alternative to FltFlushBuffers2() in OS version prior to 19041

sagi_zarsagi_zar Member - All Emails Posts: 22

Hi,

I'm implementing a minifilter driver and I need to flush and purge the cache of files that I monitor.
I saw that recently Microsoft added a new API FltFlushBuffers2() that does flush and can also purge the cache.
In the past I used the cache manager API's to do that, but they are not safe to use and cause my driver to hang from time to time.
FltFlushBuffers2() seems to be supported only from Windows build version 19041 which still can't be installed on all computers.
What alternatives I have if I need to flush and purge files that I monitor from within my minifilter?

Thanks,
Sagi

Comments

  • rod_widdowsonrod_widdowson Member - All Emails Posts: 1,173

    I’ve always used FltPerformSynchronousIo (and FltAllocateCallbackData &c).

    There is a minor function (since win7 I think) to turn a MJ_FLUSH into flush & purge.

  • sagi_zarsagi_zar Member - All Emails Posts: 22

    The minifilter is not initiating the write requests to the file.
    I want to flush and purge the cache that was updated by write and read requests that user applications did and the driver monitored

  • Scott_Noone_(OSR)Scott_Noone_(OSR) Administrator Posts: 3,379

    FltFlushBuffers2 is just a wrapper around sending an IRP_MJ_FLUSH_BUFFERS with various different minor function codes:

    //
    // Flush minor function codes
    //
    
    #define IRP_MN_FLUSH_AND_PURGE           0x01
    #if (NTDDI_VERSION >= NTDDI_WIN8)
    #define IRP_MN_FLUSH_DATA_ONLY           0x02    //see FLUSH_FLAGS_FILE_DATA_ONLY for definition of how this works
    #define IRP_MN_FLUSH_NO_SYNC             0x03    //see FLUSH_FLAGS_NO_SYNC for definition of how this works
    #endif
    #if (NTDDI_VERSION >= NTDDI_WIN10_RS1)
    #define IRP_MN_FLUSH_DATA_SYNC_ONLY      0x04    //see FLUSH_FLAGS_FILE_DATA_SYNC_ONLY for definition of how this works
    #endif
    

    As Rod said you can just build your own callback data instead of using this API.

    Note however that it's up to the file system to actually implement these minor function code. For example, I don't believe FAT uses any of them.

    -scott
    OSR

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Writing WDF Drivers 7 Dec 2020 LIVE ONLINE
Internals & Software Drivers 25 Jan 2021 LIVE ONLINE
Developing Minifilters 8 March 2021 LIVE ONLINE