Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
Hi,
I'm implementing a minifilter driver and I need to flush and purge the cache of files that I monitor.
I saw that recently Microsoft added a new API FltFlushBuffers2() that does flush and can also purge the cache.
In the past I used the cache manager API's to do that, but they are not safe to use and cause my driver to hang from time to time.
FltFlushBuffers2() seems to be supported only from Windows build version 19041 which still can't be installed on all computers.
What alternatives I have if I need to flush and purge files that I monitor from within my minifilter?
Thanks,
Sagi
Upcoming OSR Seminars | ||
---|---|---|
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead! | ||
Writing WDF Drivers | 12 September 2022 | Live, Online |
Internals & Software Drivers | 23 October 2022 | Live, Online |
Kernel Debugging | 14 November 2022 | Live, Online |
Developing Minifilters | 5 December 2022 | Live, Online |
Comments
I’ve always used FltPerformSynchronousIo (and FltAllocateCallbackData &c).
There is a minor function (since win7 I think) to turn a MJ_FLUSH into flush & purge.
The minifilter is not initiating the write requests to the file.
I want to flush and purge the cache that was updated by write and read requests that user applications did and the driver monitored
FltFlushBuffers2 is just a wrapper around sending an IRP_MJ_FLUSH_BUFFERS with various different minor function codes:
As Rod said you can just build your own callback data instead of using this API.
Note however that it's up to the file system to actually implement these minor function code. For example, I don't believe FAT uses any of them.
-scott
OSR
I've got the same issue as Sagi, and while sending the IRP directly does work (thanks Rod and Scott!), my Lead would rather I use the "documented" way of doing things. As such, I'm trying to use FltFlushBuffers2() if it is available. To check the availability, I'm using MmGetSystemRoutineAddress():
PFN_FLT_FLUSH_BUFFERS_2 pFltFlushBuffers2 = NULL;
UNICODE_STRING FltFlushBuffers2_Text;
RtlInitUnicodeString(&FltFlushBuffers2_Text, L"FltFlushBuffers2");
pFltFlushBuffers2 = (PFN_FLT_FLUSH_BUFFERS_2) (ULONG_PTR)MmGetSystemRoutineAddress(&FltFlushBuffers2_Text);
Although I'm testing on Windows 10 2H20, this always returns NULL. It also returns NULL for FltFlushBuffers and FltCancelIo. The same code works for MmMapIoSpaceEx() in my driver.
Is there a different way of getting the addresses of Filter Manager functions?
Thanks,
Merrill
You need FltGetRoutineAddress
Thanks Rod, this works perfectly.
Merrill