Hi all,
Is there any way to flush all of the cache memory
in InstanceQueryTeardown()?
i.e. when I run command “fltmc detach myminifilter f:” then it should clear
the cache(related to f: only if possible).
Is there any mechanism to do it?
–
Kapil Bhadke
Absolutely no full proof way. And several known “will fail”
scenarios.
kapil bhadke wrote:
Hi all,
Is there any way to flush all of the cache memory
in InstanceQueryTeardown()?
i.e. when I run command “fltmc detach myminifilter f:” then it should
clear
the cache(related to f: only if possible).
Is there any mechanism to do it?–
Kapil Bhadke
NTFSD is sponsored by OSR
For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminarsTo unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
–
Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.
Reboot. That’s guaranteed to flush the cache.
Tony
OSR
>Reboot. That’s guaranteed to flush the cache.
Volume remount is enough.
–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com
On 4/29/2011 8:27 AM, Maxim S. Shatskih wrote:
> Reboot. That’s guaranteed to flush the cache.
Volume remount is enough.
Can’t be performed on the system volume.
Pete
–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295
What about flushing whole of the cache??
On Fri, Apr 29, 2011 at 8:56 PM, Peter Scott wrote:
>
>
> On 4/29/2011 8:27 AM, Maxim S. Shatskih wrote:
>
>> Reboot. That’s guaranteed to flush the cache.
>>>
>>
>> Volume remount is enough.
>>
>>
> Can’t be performed on the system volume.
>
> Pete
>
> –
> Kernel Drivers
> Windows File System and Device Driver Consulting
> www.KernelDrivers.com
> 866.263.9295
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
–
Kapil Bhadke
If system can’t guarantee that the cache can be flushed out upon request,
how will filter driver receive the IRP, data from the cache and process it
during the fly? Doesn’t that defeat the purpose to have a filter driver?
John W.
On 4/29/2011 1:02 PM, xxxxx@TwinPeakSoft.com wrote:
If system can’t guarantee that the cache can be flushed out upon request,
how will filter driver receive the IRP, data from the cache and process it
during the fly? Doesn’t that defeat the purpose to have a filter driver?
You can flush the cache for a given file but the OP requested how to
flush the entire cache. As well, you could flush the cache for some file
and an instance later the data for that file is once again dirty. So
trying to flush the cache for all files currently cached is futile at best.
Pete
–
Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295
No, it just means the filter can’t do everything it wants 
Actually, we are mixing two different terms here. A flush can always succeed, i.e. you can force unwritten data
to be flushed. What the OP wants is to PURGE the cache, i.e. remove read cache as well.
If a purge were guaranteed to succeed it would be guaranteed to break very simple functionality such as memory
mapping, non page-file backed executables, etc. Would you consider it fair? We wouldn’t.
Dejan.
xxxxx@TwinPeakSoft.com wrote:
If system can’t guarantee that the cache can be flushed out upon request,
how will filter driver receive the IRP, data from the cache and process it
during the fly? Doesn’t that defeat the purpose to have a filter driver?John W.
NTFSD is sponsored by OSR
For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminarsTo unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
–
Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.
However it is used mostly when shadow copies are created
however I don’t see any reason why this
IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITEShttp:can’t
be used for your problem.
-Deepak
On Sat, Apr 30, 2011 at 1:19 PM, Dejan Maksimovic wrote:
>
> No, it just means the filter can’t do everything it wants
>
> Actually, we are mixing two different terms here. A flush can always
> succeed, i.e. you can force unwritten data
> to be flushed. What the OP wants is to PURGE the cache, i.e. remove read
> cache as well.
> If a purge were guaranteed to succeed it would be guaranteed to break
> very simple functionality such as memory
> mapping, non page-file backed executables, etc. Would you consider it fair?
> We wouldn’t.
>
> Dejan.
>
> xxxxx@TwinPeakSoft.com wrote:
>
> > If system can’t guarantee that the cache can be flushed out upon request,
> > how will filter driver receive the IRP, data from the cache and process
> it
> > during the fly? Doesn’t that defeat the purpose to have a filter driver?
> >
> > John W.
> >
> > —
> > NTFSD is sponsored by OSR
> >
> > For our schedule of debugging and file system seminars visit:
> > http://www.osr.com/seminars
> >
> > To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
> –
> Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
> http://www.alfasp.com
> File system audit, security and encryption kits.
>
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
></http:>
I mentioned already that flush and purge are mixed.
What you linked to is a flush (and again not a certain to succeed
flush), while the OP requires a PURGE.
Deepak Gupta wrote:
However it is used mostly when shadow copies are created
however I don’t see any reason why this
IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES> ://msdn.microsoft.com/en-us/library/ff548334%28v=vs.85%29.aspx>can’t
> be used for your problem.
>
> -Deepak
>
> > Actually, we are mixing two different terms here. A flush can
> always
> > succeed, i.e. you can force unwritten data
> > to be flushed. What the OP wants is to PURGE the cache, i.e. remove
> read
> > cache as well.
–
Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.
Oops I assumed he meant flush, my mistake.
But why OP requires read caches to be cleared also?
-Deepak
On Sat, Apr 30, 2011 at 11:29 PM, Dejan Maksimovic wrote:
>
> I mentioned already that flush and purge are mixed.
> What you linked to is a flush (and again not a certain to succeed
> flush), while the OP requires a PURGE.
>
> Deepak Gupta wrote:
>
> > However it is used mostly when shadow copies are created
> > however I don’t see any reason why this
> > IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES> > ://msdn.microsoft.com/en-us/library/ff548334%28v=vs.85%29.aspx>can’t
> > be used for your problem.
> >
> > -Deepak
> >
> > > Actually, we are mixing two different terms here. A flush can
> > always
> > > succeed, i.e. you can force unwritten data
> > > to be flushed. What the OP wants is to PURGE the cache, i.e. remove
> > read
> > > cache as well.
>
> –
> Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
> http://www.alfasp.com
> File system audit, security and encryption kits.
>
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
Encryption filter.
Deepak Gupta wrote:
Oops I assumed he meant flush, my mistake.
But why OP requires read caches to be cleared also?
-Deepak
–
Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.
Are you sure you can call this IOCTL in a proper way, and avoid confusing VolSnap?
–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com
“Deepak Gupta” wrote in message news:xxxxx@ntfsd…
However it is used mostly when shadow copies are created
however I don’t see any reason why this IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES can’t be used for your problem.
-Deepak
On Sat, Apr 30, 2011 at 1:19 PM, Dejan Maksimovic wrote:
No, it just means the filter can’t do everything it wants
Actually, we are mixing two different terms here. A flush can always succeed, i.e. you can force unwritten data
to be flushed. What the OP wants is to PURGE the cache, i.e. remove read cache as well.
If a purge were guaranteed to succeed it would be guaranteed to break very simple functionality such as memory
mapping, non page-file backed executables, etc. Would you consider it fair? We wouldn’t.
Dejan.
xxxxx@TwinPeakSoft.com wrote:
> If system can’t guarantee that the cache can be flushed out upon request,
> how will filter driver receive the IRP, data from the cache and process it
> during the fly? Doesn’t that defeat the purpose to have a filter driver?
>
> John W.
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
–
Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.
—
NTFSD is sponsored by OSR
For our schedule of debugging and file system seminars visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
Maxim,
No I am not sure about it and have never tested it.
However if we see the documentation -
http://msdn.microsoft.com/en-us/library/ff548334(v=vs.85).aspx,
It says that "This IOCTL is most commonly sent by the Volume Shadow Copy
Service, but it can also be issued by other user-mode applications or
processes. "
This statement in documentation made me think that it can be used if it’s a
flush case.
-Deepak
On Tue, May 3, 2011 at 5:27 PM, Maxim S. Shatskih wrote:
> Are you sure you can call this IOCTL in a proper way, and avoid
> confusing VolSnap?
>
> –
> Maxim S. Shatskih
> Windows DDK MVP
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
> “Deepak Gupta” wrote in message news:xxxxx@ntfsd.
> …
> However it is used mostly when shadow copies are created
> however I don’t see any reason why this IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES
> can’t be used for your problem.
>
> -Deepak
>
>
> On Sat, Apr 30, 2011 at 1:19 PM, Dejan Maksimovic
> wrote:
>
>
> No, it just means the filter can’t do everything it wants
>
> Actually, we are mixing two different terms here. A flush can always
> succeed, i.e. you can force unwritten data
> to be flushed. What the OP wants is to PURGE the cache, i.e. remove read
> cache as well.
> If a purge were guaranteed to succeed it would be guaranteed to break
> very simple functionality such as memory
> mapping, non page-file backed executables, etc. Would you consider it fair?
> We wouldn’t.
>
> Dejan.
>
>
> xxxxx@TwinPeakSoft.com wrote:
>
> > If system can’t guarantee that the cache can be flushed out upon request,
> > how will filter driver receive the IRP, data from the cache and process
> it
> > during the fly? Doesn’t that defeat the purpose to have a filter driver?
> >
> > John W.
> >
> > —
> > NTFSD is sponsored by OSR
> >
> > For our schedule of debugging and file system seminars visit:
> > http://www.osr.com/seminars
> >
> > To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
>
> –
> Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
> http://www.alfasp.com
> File system audit, security and encryption kits.
>
>
>
> —
>
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>