In our filter driver, while processing a certain IRP we need to terminate
the corresponding cached data of the file being accessed. We are wondering
how it can be done correctly (and if it is possible).
As of now, we see 2 possibilities:
-
Execute CcUninitializeCacheMap on every FILE_OBJECT associated with this
file stream (since they all share the same SECTION_OBJECT). The problem is
that we can’t force the Cache Manager to issue a IRP_MJ_CLOSE (which ensures
that caching for that stream has been terminated, and the SECTION_OBJECT
released). This happens because Cache Manager and the VMM mantain a
reference to the first FILE_OBJECT that initiated caching for that file
stream. (NT File System Internals) -
Execute CcPurgeCacheSection on the apropriate SECTION_OBJECT. This
automaticaly executes CcUninitializeCacheMap on every FILE_OBJECT for this
stream. But, since previous written data is discarded without being flushed,
we first have to execute CcFlushCache, to ensure that the data is flushed.
But, CcFlushCache (which is a synchronous operation) will certainly issue
more IRP_MJ_WRITEs that we can’t process because we are in the middle of
processing the current IRP.
Is there any way to solve these problems, or even another way to solve our
problem?
You are currently subscribed to ntfsd as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntfsd-$subst(‘Recip.MemberIDChar’)@lists.osr.com