Purging the file cache from a filter driver

NTFSD
1

Is there a safe way to purge all cached data for a file from within a
filter driver so that subsequent reads will be forced to re-load the
data from the disk again?

I was thinking of using CcFlushCache() followed by
CcPurgeCacheSection(), but I’m not sure how safe it is to call these
from a filter. I would also need to exclusively acquire the resource
for the file somehow.

Thanks
Shaun

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

2

> Is there a safe way to purge all cached data for a file from within a

filter driver so that subsequent reads will be forced to re-load the
data from the disk again?

There is NO way of doing this if this file has any user- (not Cc-) initated
memory mapped views.

Max

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

3

Maxim S. Shatskih wrote:
>> Is there a safe way to purge all cached data for a file from within a
>> filter driver so that subsequent reads will be forced to re-load the
>> data from the disk again?
>
>There is NO way of doing this if this file has any user- (not Cc-) initated
>memory mapped views.
>

I’m not looking for 100% success on purging the cache - I just want to
do as much as I can. I was just wondering if calling the
CcPurgeCacheSection from a filter would cause problems. Or maybe there
is a better way to do it?

Shaun

—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

4

>

I’m not looking for 100% success on purging the cache - I just want to
do as much as I can. I was just wondering if calling the
CcPurgeCacheSection from a filter would cause problems. Or maybe there
is a better way to do it?

Shaun

i think Purging cache completly is not advisable.

Regards,
Satish K.S

You are currently subscribed to ntfsd as: xxxxx@aalayance.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

5

Satish wrote:
>>
>> I’m not looking for 100% success on purging the cache - I just want to
>> do as much as I can. I was just wondering if calling the
>> CcPurgeCacheSection from a filter would cause problems. Or maybe there
>> is a better way to do it?
>>
>> Shaun
>
>i think Purging cache completly is not advisable.

Well the choice is either leave the cache containing incorrect data, or
try and get rid of the incorrect data. In most of the situations I will
be dealing with, all user handles have closed (cleanup received) on a
particular file (not all files) and only the system has a reference so
that the data remains in the cache.

I suppose the other option is to somehow force the system to release
that last reference. Is that possible?

Even though purging the cache is not advisable, is it still safe? To me
they can be different things.

Shaun

—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

6

> I’m not looking for 100% success on purging the cache - I just want to

do as much as I can. I was just wondering if calling the
CcPurgeCacheSection from a filter would cause problems.

It will not cause problems if you call it having the necessary locks
acquired.

Max

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

7

> I suppose the other option is to somehow force the system to release

that last reference. Is that possible?

Yes. This code snippet will force CLOSE for the file object for which
CLEANUP was previously received:

CcFlushCache(SectionObjectPointers, NULL, 0, &IoStatusBlock);
if( SectionObjectPointers->ImageSectionObject != NULL )
MmFlushImageSection(SectionObjectPointers, MmFlushForWrite);
if( SectionObjectPointers->DataSectionObject != NULL )
CcPurgeCacheSection(SectionObjectPointers, NULL, 0, FALSE);

Max

You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

8

For the particular case of releasing last FO reference (to force
IRP_MJ_CLOSE) the recomended (by MS) way is to open that file with
FILE_NO_INTERMEDIATE_BUFFERING set in CreateOptions. This method will not
work, however, if file in question has been renamed.

Regards,

Vladimir

-----Original Message-----
From: Shaun [mailto:xxxxx@sdlabs.demon.co.uk]
Sent: Tuesday, April 03, 2001 2:58 AM
To: File Systems Developers
Subject: [ntfsd] Re: Purging the file cache from a filter driver

Satish wrote:
>>
>> I’m not looking for 100% success on purging the cache - I just want to
>> do as much as I can. I was just wondering if calling the
>> CcPurgeCacheSection from a filter would cause problems. Or maybe there
>> is a better way to do it?
>>
>> Shaun
>
>i think Purging cache completly is not advisable.

Well the choice is either leave the cache containing incorrect data, or
try and get rid of the incorrect data. In most of the situations I will
be dealing with, all user handles have closed (cleanup received) on a
particular file (not all files) and only the system has a reference so
that the data remains in the cache.

I suppose the other option is to somehow force the system to release
that last reference. Is that possible?

Even though purging the cache is not advisable, is it still safe? To me
they can be different things.

Shaun

—
You are currently subscribed to ntfsd as: xxxxx@Starbase.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

9

I had similar problem in a driver outside of FSD and filters so couldn’t
acquire necessary locks for Cc functions. I use below method but it isn’t so
easy; sometimes it needs several create/close loops until cache is
destroyed. KeDelayExecutionThread() for a small interval in every loop
helps. If there is a better method, I would appreciate a hint.

Best regards,

Michal Vodicka
Veridicom
(RKK - Skytale)
[WWW: http://www.veridicom.com , http://www.skytale.com]

From: Chtchetkine, Vladimir[SMTP:xxxxx@Starbase.com]
Reply To: File Systems Developers
Sent: Tuesday, April 03, 2001 5:47 PM
To: File Systems Developers
Subject: [ntfsd] Re: Purging the file cache from a filter driver

For the particular case of releasing last FO reference (to force
IRP_MJ_CLOSE) the recomended (by MS) way is to open that file with
FILE_NO_INTERMEDIATE_BUFFERING set in CreateOptions. This method will not
work, however, if file in question has been renamed.

Regards,

Vladimir

-----Original Message-----
From: Shaun [mailto:xxxxx@sdlabs.demon.co.uk]
Sent: Tuesday, April 03, 2001 2:58 AM
To: File Systems Developers
Subject: [ntfsd] Re: Purging the file cache from a filter driver

Satish wrote:
> >>
> >> I’m not looking for 100% success on purging the cache - I just want to
> >> do as much as I can. I was just wondering if calling the
> >> CcPurgeCacheSection from a filter would cause problems. Or maybe there
> >> is a better way to do it?
> >>
> >> Shaun
> >
> >i think Purging cache completly is not advisable.
>
> Well the choice is either leave the cache containing incorrect data, or
> try and get rid of the incorrect data. In most of the situations I will
> be dealing with, all user handles have closed (cleanup received) on a
> particular file (not all files) and only the system has a reference so
> that the data remains in the cache.
>
> I suppose the other option is to somehow force the system to release
> that last reference. Is that possible?
>
> Even though purging the cache is not advisable, is it still safe? To me
> they can be different things.
>
> Shaun
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@Starbase.com
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
> —
> You are currently subscribed to ntfsd as: xxxxx@rkk.cz
> To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>

—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

10

Thanks - it does indeed seem to work just great.

Shaun

Maxim S. Shatskih wrote:
>> I suppose the other option is to somehow force the system to release
>> that last reference. Is that possible?
>
>Yes. This code snippet will force CLOSE for the file object for which
>CLEANUP was previously received:
>
> CcFlushCache(SectionObjectPointers, NULL, 0, &IoStatusBlock);
> if( SectionObjectPointers->ImageSectionObject != NULL )
> MmFlushImageSection(SectionObjectPointers, MmFlushForWrite);
> if( SectionObjectPointers->DataSectionObject != NULL )
> CcPurgeCacheSection(SectionObjectPointers, NULL, 0, FALSE);
>
> Max
>
>
>—
>You are currently subscribed to ntfsd as: xxxxx@sdlabs.demon.co.uk
>To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

11

Just don’t forget to acquire the FCB before you do that!

-----Original Message-----
From: Shaun [mailto:xxxxx@sdlabs.demon.co.uk]
Sent: Wednesday, April 04, 2001 2:53 AM
To: File Systems Developers
Subject: [ntfsd] Re: Purging the file cache from a filter driver

Thanks - it does indeed seem to work just great.

Shaun

Maxim S. Shatskih wrote:
>> I suppose the other option is to somehow force the system to release
>> that last reference. Is that possible?
>
>Yes. This code snippet will force CLOSE for the file object for which
>CLEANUP was previously received:
>
> CcFlushCache(SectionObjectPointers, NULL, 0, &IoStatusBlock);
> if( SectionObjectPointers->ImageSectionObject != NULL )
> MmFlushImageSection(SectionObjectPointers, MmFlushForWrite);
> if( SectionObjectPointers->DataSectionObject != NULL )
> CcPurgeCacheSection(SectionObjectPointers, NULL, 0, FALSE);
>
> Max
>
>
>—
>You are currently subscribed to ntfsd as: xxxxx@sdlabs.demon.co.uk
>To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

—
You are currently subscribed to ntfsd as: xxxxx@Starbase.com
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

12

Yep 8*>. My filter is based on the NT4 SFILTER sample which has a
function called SfFastIoAcquireFile. It calls the fast io
AcquireFileForNtCreateSection if there is one, otherwise it goes direct
to the FCB header for the resource.

At the moment I am just calling this function before purging the
cache (and the release function afterwards of course).

Shaun

Chtchetkine, Vladimir wrote:
>
> Just don’t forget to acquire the FCB before you do that!
>
> -----Original Message-----
> From: Shaun [mailto:xxxxx@sdlabs.demon.co.uk]
> Sent: Wednesday, April 04, 2001 2:53 AM
> To: File Systems Developers
> Subject: [ntfsd] Re: Purging the file cache from a filter driver
>
>
> Thanks - it does indeed seem to work just great.
>
> Shaun
>
> Maxim S. Shatskih wrote:
> >> I suppose the other option is to somehow force the system to
> release
> >> that last reference. Is that possible?
> >
> >Yes. This code snippet will force CLOSE for the file object for
> which
> >CLEANUP was previously received:
> >
> > CcFlushCache(SectionObjectPointers, NULL, 0, &IoStatusBlock);
> > if( SectionObjectPointers->ImageSectionObject != NULL )
> > MmFlushImageSection(SectionObjectPointers,
> MmFlushForWrite);
> > if( SectionObjectPointers->DataSectionObject != NULL )
> > CcPurgeCacheSection(SectionObjectPointers, NULL, 0,
> FALSE);
> >
> > Max
> >
> >
> >—
> >You are currently subscribed to ntfsd as: xxxxx@sdlabs.demon.co.uk
> >To unsubscribe send a blank email to
> leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
>
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@Starbase.com
> To unsubscribe send a blank email to
> leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com
>
> —
> You are currently subscribed to ntfsd as: xxxxx@sdlabs.demon.co.uk
> To unsubscribe send a blank email to
> leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

—
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com