IRP_MJ_READ and Cache

Hi,

I have a question on reading data from CACHE.

if data is in CACHE then when requested it, IRP_MJ_READ called for that request?

Thanks very much for your answers…

You need to understand the difference between cached io, paging io and non cached io.
The first is too/from cache, the other are too/from disk.
Read the read and write path for FAT to get the details. Or read any month from this list. This question crops up about 12 times a year.
You never want to encrypt cached IO (otherwise you see “the notepad problem”), you always want to encrypt paging and cached io.
And it all falls apart on the network.
Good luck. Expect to spend 3 to 6 months going up the learning curve. Also it can be handy to “plan to throw one away”.
Rod

IRP_MJ_READ for data in cache is sent in the following cases

  • in case of NtReadFile a file system driver or filter returned FALSE from FastIoRead or FastIoRead is NULL

  • a paging IO request is issued, paging IO read is usually not generated for resident pages and pages in the cache are resident, but this rule is not exact

  • IRP_MJ_READ IRP was created by a driver/filter instead of a call to NtReadFile