identifying Cache flushes in minifilter

Hi all,

in my PreWrite I want to be able to identify any IRPs from Cache manager,
responsible for Cache flushes. What is the best way to do this?

Irps that have stacks like this:

fffff88005fcf6e0 fffff800018d0c00 : 0000000000000100 fffff88005fcfc58 fffffa8001294050 0000000000000000 :
nt!IoSynchronousPageWrite+0x24f
fffff88005fcf760 fffff800018cf188 : fffff8a001b2b010 fffff8a009167800 fffffa8003e06090 fffffa8003c65c70 :
nt!MiFlushSectionInternal+0xb30
fffff88005fcf990 fffff800018ce669 : 00000000000bbe57 fffff88005fcfc58 0000000002000000 fffffa8003f005b0 :
nt!MmFlushSection+0xa4
fffff88005fcfa50 fffff800018d1f76 : fffffa800363c0c8 0000000000000001 fffffa8000000001 fffffa8002000000 :
nt!CcFlushCache+0x5e9
fffff88005fcfb50 fffff800018d2938 : fffffa8000000000 fffff88005fcfc58 fffffa800332a320 fffff80001a8e8b8 :
nt!CcWriteBehind+0x1c6
fffff88005fcfc00 fffff80001897001 : fffffa8001894510 fffff80001b83900 fffff80001a8e8c0 fffffa8003749bb0 :
nt!CcWorkerThread+0x1c8
fffff88005fcfcb0 fffff80001b27fee : fffff88000000001 fffffa80018f9ae0 0000000000000080 fffffa800188f890 :
nt!ExpWorkerThread+0x111
fffff88005fcfd40 fffff8000187e5e6 : fffff880009b8180 fffffa80018f9ae0 fffffa8002386b60 fffff88001466384 :
nt!PspSystemThreadStartup+0x5a
fffff88005fcfd80 0000000000000000 : fffff88005fd0000 fffff88005fca000 fffff88005fcf070 0000000000000000 :
nt!KxStartSystemThread+0x16

Thanks.

Well, what is it that you are trying to do ?

Also, did you look at the TopLevelIrp ? Will that be good enough for you ?

Thanks,
Alex.

You are awesome…

I want to let these IRPs go through, without me modifying their timing.

Thanks.

On Thu, Mar 8, 2012 at 3:05 PM, wrote:

> Well, what is it that you are trying to do ?
>
> Also, did you look at the TopLevelIrp ? Will that be good enough for you ?
>
> Thanks,
> Alex.
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

And you are interested in those specifically from CC? What about MM? If
you are interested in all paging requests then you can check for the
paging bit in the request.

Pete

On 3/8/2012 1:17 PM, Kamran Tavakoli wrote:

You are awesome…

I want to let these IRPs go through, without me modifying their timing.

Thanks.

On Thu, Mar 8, 2012 at 3:05 PM, > mailto:xxxxx> wrote:
>
> Well, what is it that you are trying to do ?
>
> Also, did you look at the TopLevelIrp ? Will that be good enough for
> you ?
>
> Thanks,
> Alex.
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
>
> — NTFSD is sponsored by OSR For our schedule of debugging and file
> system seminars visit: http://www.osr.com/seminars To unsubscribe, visit
> the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer


Kernel Drivers
Windows File System and Device Driver Consulting
www.KernelDrivers.com
866.263.9295</mailto:xxxxx>

Thanks Pete, we may have to leave those alone as well.

On Thu, Mar 8, 2012 at 5:41 PM, Peter Scott wrote:

>
> And you are interested in those specifically from CC? What about MM? If
> you are interested in all paging requests then you can check for the paging
> bit in the request.
>
> Pete
>
>
> On 3/8/2012 1:17 PM, Kamran Tavakoli wrote:
>
>> You are awesome…
>>
>> I want to let these IRPs go through, without me modifying their timing.
>>
>> Thanks.
>>
>> On Thu, Mar 8, 2012 at 3:05 PM, >> mailto:alexandru.carp.osr>>
>> wrote:
>>
>> Well, what is it that you are trying to do ?
>>
>> Also, did you look at the TopLevelIrp ? Will that be good enough for
>> you ?
>>
>> Thanks,
>> Alex.
>>
>> —
>> NTFSD is sponsored by OSR
>>
>> For our schedule of debugging and file system seminars visit:
>> http://www.osr.com/seminars
>>
>> To unsubscribe, visit the List Server section of OSR Online at
>> http://www.osronline.com/page. cfm?name=ListServerhttp:
>>
>>
>> — NTFSD is sponsored by OSR For our schedule of debugging and file
>> system seminars visit: http://www.osr.com/seminars To unsubscribe, visit
>> the List Server section of OSR Online at
>> http://www.osronline.com/page.
cfm?name=ListServerhttp:
>>
>
> –
> Kernel Drivers
> Windows File System and Device Driver Consulting
> www.KernelDrivers.com
> 866.263.9295
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.**cfm?name=ListServerhttp:
></http:></http:></http:></mailto:alexandru.carp.osr>