FltFlushBuffers2 function (fltkernel.h)

Article
02/23/2024

A minifilter driver calls FltFlushBuffers2 to send a flush request to the file system for a given file.

Syntax

NTSTATUS FLTAPI FltFlushBuffers2(
  PFLT_INSTANCE      Instance,
  PFILE_OBJECT       FileObject,
  ULONG              FlushType,
  PFLT_CALLBACK_DATA CallbackData
);

Parameters

Instance

[in] Opaque instance pointer for the calling minifilter driver instance. This parameter is required and can't be NULL.

FileObject

[in] File object pointer for the file or volume to be flushed. This parameter is required and can't be NULL.

FlushType

[in] Specifies the type of flush that the file system should do on the file. FlushType can be one of the following:

FlushType Operation Value	Description
0	If FileObject is for a file, both the file data and metadata in the file cache will be written, and the underlying storage will be synchronized to flush its cache. If FileObject is for a volume, the file system will cause both the file data and metadata for all modified files on the volume will be written, and the underlying storage to be synchronized to flush its cache. This operation is equivalent to FltFlushBuffers.
FLT_FLUSH_TYPE_FLUSH_AND_PURGE	Same as 0 (FltFlushBuffers), except that the cache is also purged after the flush completes.
FLT_FLUSH_TYPE_FILE_DATA_ONLY	If the file is on an NTFS file system, only file data in the file cache will be written. No metadata is written and the underlying storage is not synchronized to flush its cache. This flag is not valid if FileObject is for a volume.
FLT_FLUSH_TYPE_NO_SYNC	If the file is on an NTFS file system, file data and metadata in the file cache will be written. The underlying storage will not be synchronized to flush its cache. This flag is not valid if FileObject is for a volume.
FLT_FLUSH_TYPE_DATA_SYNC_ONLY	If the file is on an NTFS file system, file data in the file cache will be written. No metadata is written. The underlying storage is synchronized to flush its cache. This flag is not valid if FileObject is for a volume or directory.

CallbackData

[in/optional] Pointer to optional FLT_CALLBACK_DATA structure used to propagate the caller's IRP extension. See FltPropagateIrpExtension.

Return value

FltFlushBuffers2 returns STATUS_SUCCESS or an appropriate NTSTATUS value such as one of the following:

Return code	Description
STATUS_MEDIA_WRITE_PROTECTED	The file resides on a write-protected volume. This is an error code.
STATUS_VOLUME_DISMOUNTED	The file resides on a volume that is not currently mounted. This is an error code.

Remarks

A minifilter driver can call FltFlushBuffers2 to issue an IRP_MJ_FLUSH_BUFFERS request to the file system for a given file. The flush operation is synchronous and is issued to the instance(s) below the specified Instance.

If the file is on an NTFS file system, the minifilter can control the type of flush through the FlushType parameter.

Requirements

Requirement	Value
Minimum supported client	Windows 10, version 1903
Header	fltkernel.h