What should I do if I want to block the flushing a file cache

NTFSD
1

In my filter driver, I need to block some special flushing a file cache.
When the FS driver intercepts the IRP_MJ_FLUSH_BUFFERS with a file
object
representing the file I’m interested in, I just fake this IRP request by
return IoCompleteRequest() with STATUS_SUCCESS. But it won’t work. The
file still get the data from cache. So how to handle the
IPR_MJ_FLUSH_BUFFERS properly?

Thanks

2

> In my filter driver, I need to block some special flushing a file cache.

When the FS driver intercepts the IRP_MJ_FLUSH_BUFFERS with a file
object

I don’t know why do you want to do this,
but IRP_MJ_FLUSH_BUFFERS is only a command
that the cache should be flushed RIGHT NOW. Without this
request sent, the cache manager will still write the file’s
content to the disk, but usually a bit later.

L.