alternative to FltFlushBuffers2() in OS version prior to 19041

Question

Hi,

I'm implementing a minifilter driver and I need to flush and purge the cache of files that I monitor.
This is for flush and purge the cache after write and read requests that were initiated by user-mode applications.
I saw that recently Microsoft added a new API FltFlushBuffers2() that does flush and can also purge the cache.
In the past I used the cache manager API's to do that, but they are not safe to use and cause my driver to hang from time to time.
FltFlushBuffers2() seems to be supported only from Windows build version 19041 which still can't be installed on all computers.
What alternatives I have if I need to flush and purge files that I monitor from within my minifilter?

Thanks,
Sagi

Answer 1

The underlying functionality made available via FltFlushBuffers2 API has been in the system since at least Windows 7.

Your minifilter can generate its own CallbackData structure and issue its own FLUSH api. It would like something like this:

status = FltAllocateCallbackData( YourInstance, FileObjectToFlush, &cbd);
cbd->Iopb->MajorFunction = IRP_MJ_FLUSH_BUFFERS;
cbd->Iopb->MinorFUnction = IRP_MN_FLUSH_AND_PURGE;
cbd->Iopb->IrpFlags = IRP_SYNCHRONOUS_API;

FltPerformSynchronousIO(cbd);

I have not tried executing this code but this should work.

If you already have a handle created via FltCreateFile (or one of its variants), if you call ZwFlushBuffersFileEx using that handle, the flush request will be properly targeted to filters below you and wi