Terminating a file cached data

In our filter driver, while processing a certain IRP we need to terminate
the corresponding cached data of the file being accessed. We are wondering
how it can be done correctly (and if it is possible).

As of now, we see 2 possibilities:

  1. Execute CcUninitializeCacheMap on every FILE_OBJECT associated with this
    file stream (since they all share the same SECTION_OBJECT). The problem is
    that we can’t force the Cache Manager to issue a IRP_MJ_CLOSE (which ensures
    that caching for that stream has been terminated, and the SECTION_OBJECT
    released). This happens because Cache Manager and the VMM mantain a
    reference to the first FILE_OBJECT that initiated caching for that file
    stream. (NT File System Internals)

  2. Execute CcPurgeCacheSection on the apropriate SECTION_OBJECT. This
    automaticaly executes CcUninitializeCacheMap on every FILE_OBJECT for this
    stream. But, since previous written data is discarded without being flushed,
    we first have to execute CcFlushCache, to ensure that the data is flushed.
    But, CcFlushCache (which is a synchronous operation) will certainly issue
    more IRP_MJ_WRITEs that we can’t process because we are in the middle of
    processing the current IRP.

Is there any way to solve these problems, or even another way to solve our
problem?


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com

> But, CcFlushCache (which is a synchronous operation) will certainly issue

more IRP_MJ_WRITEs that we can’t process because we are in the middle of
processing the current IRP.

And why you cannot process more IRPs? Do you have any limits on how many
IRPs you can process in parallel?

See how FASTFAT flushes the cache in the uncached write path.

Max


You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com