How is it posssible that i dont see my file name in preread callbeck?

I made minifilter with pre and post read callbackes
when i open file i don see any call with my file name (i clean the cash before i opened the file so i’ts can’t be becoase of this) , but when i save something in the file i see the file name (in pre read and post read callback).

i add this dbg print that will make my question clearer:

this is ALL the cals from the moment i double click on "new_check_buffer.txt: file till it’s opened and i can read it:

[-]SwapPreReadBuffers \Device\HarddiskVolume1\Windows\winsxs\FileMaps$$_system32_21f9a9c4a2f8b514.cdf-ms
[-info-] Name:\Device\HarddiskVolume1\Windows\winsxs\FileMaps$$_system32_21f9a9c4a2f8b514.cdf-ms
ParentDir:\Windows\winsxs\FileMaps\
Stream:(null)
FinalComponent:$$_system32_21f9a9c4a2f8b514.cdf-ms

[-]SwapPreReadBuffers \Device\HarddiskVolume1\Windows\winsxs\FileMaps$$_system32_21f9a9c4a2f8b514.cdf-ms
[-info-] Name:\Device\HarddiskVolume1\Windows\winsxs\FileMaps$$_system32_21f9a9c4a2f8b514.cdf-ms
ParentDir:\Windows\winsxs\FileMaps\
Stream:(null)
FinalComponent:$$_system32_21f9a9c4a2f8b514.cdf-ms

[-]SwapPreReadBuffers \Device\HarddiskVolume1\Windows\winsxs\FileMaps$$_system32_21f9a9c4a2f8b514.cdf-ms
[-info-] Name:\Device\HarddiskVolume1\Windows\winsxs\FileMaps$$_system32_21f9a9c4a2f8b514.cdf-ms
ParentDir:\Windows\winsxs\FileMaps\
Stream:(null)
FinalComponent:$$_system32_21f9a9c4a2f8b514.cdf-ms

[-]SwapPreReadBuffers \Device\HarddiskVolume1\Windows\winsxs\FileMaps$$_system32_21f9a9c4a2f8b514.cdf-ms
[-info-] Name:\Device\HarddiskVolume1\Windows\winsxs\FileMaps$$_system32_21f9a9c4a2f8b514.cdf-ms
ParentDir:\Windows\winsxs\FileMaps\
Stream:(null)
FinalComponent:$$_system32_21f9a9c4a2f8b514.cdf-ms

[-]SwapPreReadBuffers \Device\HarddiskVolume1\Windows\winsxs\FileMaps$$_system32_21f9a9c4a2f8b514.cdf-ms
[-info-] Name:\Device\HarddiskVolume1\Windows\winsxs\FileMaps$$_system32_21f9a9c4a2f8b514.cdf-ms
ParentDir:\Windows\winsxs\FileMaps\
Stream:(null)
FinalComponent:$$_system32_21f9a9c4a2f8b514.cdf-ms

[-]SwapPreReadBuffers \Device\HarddiskVolume1\Windows\winsxs\FileMaps$$_system32_21f9a9c4a2f8b514.cdf-ms
[-info-] Name:\Device\HarddiskVolume1\Windows\winsxs\FileMaps$$_system32_21f9a9c4a2f8b514.cdf-ms
ParentDir:\Windows\winsxs\FileMaps\
Stream:(null)
FinalComponent:$$_system32_21f9a9c4a2f8b514.cdf-ms

[-]SwapPreReadBuffers \Device\HarddiskVolume1\Windows\winsxs\FileMaps$$_system32_21f9a9c4a2f8b514.cdf-ms
[-info-] Name:\Device\HarddiskVolume1\Windows\winsxs\FileMaps$$_system32_21f9a9c4a2f8b514.cdf-ms
ParentDir:\Windows\winsxs\FileMaps\
Stream:(null)
FinalComponent:$$_system32_21f9a9c4a2f8b514.cdf-ms

[-]SwapPreReadBuffers \Device\HarddiskVolume1\Users\pit\Desktop\desktop.ini
[-info-] Name:\Device\HarddiskVolume1\Users\pit\Desktop\desktop.ini
ParentDir:\Users\pit\Desktop\
Stream:(null)
FinalComponent:desktop.ini

[-]SwapPreReadBuffers \Device\HarddiskVolume1\Windows\Fonts\StaticCache.dat
[-info-] Name:\Device\HarddiskVolume1\Windows\Fonts\StaticCache.dat
ParentDir:\Windows\Fonts\
Stream:(null)
FinalComponent:StaticCache.dat

this is the calls when i hit ctrl + s:

[+] SwapPreReadBuffers file name \Device\HarddiskVolume1\Users\pit\Desktop\new_check_buffer.txt
[+] postRead file name \Device\HarddiskVolume1\Users\pit\Desktop\new_check_buffer.txt
[*] SwapPostReadBuffersWhenSafe

now i don’t get it , it’s have to be that there is SOME read call for the ability to open and read txt file so how come i don’t see it?
and why i do see read callback dbg printing on save operation???

Thank you
pit

I guess you don’t have an IRP_MJ_CREATE callback in the FLT_OPERATION_REGISTRATION array.

Regarding read callback.

In case of memory mapped IO a read request is not sent to FSD if pages with file data are resident ( i.e. in Active or Standby state ). You might have attached the filter after a file has been cached. If you write a file after attaching the filter the file data was saved in the cache which shares pages with memory mapped section.

so i need to force the file system to not cache the I/O ?
How do i do it?

p.s.
i cleared the cache after installing the minifilter and before i opened the txt file , isn’t that enagh to force the file system go throgh the minifilter for reading the content of the file?

thank you
pit

You can’t do this in a reliable way. Some file system flush and purge pages( that is what you need ), others just flush so pages remain resident. Also, it is not possible to purge pages if user mappings for a file exist. File system drivers use the old purge interface that can’t do this( i.e. unmap virtual to physical mappings in a user process to purge pages ). Anyway, even with the new interface there is a race condition so pages can be brought back on requests from a user process that maps a file into memory.