NtFlushBuffersFile - NtDoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers 
#ifndef _NTIOAPI_H

/**
 * The NtFlushBuffersFile routine sends a flush request for the specified file to the file system.
 *
 * \param[in] FileHandle A handle to the file whose buffers will be flushed.
 * \param[out] IoStatusBlock Pointer to an IO_STATUS_BLOCK structure that receives the final completion status and information about the operation.
 * \return NTSTATUS Successful or errant status.
 * \sa https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-zwflushbuffersfile
 */
NTSYSCALLAPI
NTSTATUS
NTAPI
NtFlushBuffersFile(
    _In_ HANDLE FileHandle,
    _Out_ PIO_STATUS_BLOCK IoStatusBlock
    );

#endif

View code on GitHub
#ifndef _NTZWAPI_H

NTSYSCALLAPI
NTSTATUS
NTAPI
ZwFlushBuffersFile(
    _In_ HANDLE FileHandle,
    _Out_ PIO_STATUS_BLOCK IoStatusBlock
    );

#endif

View code on GitHub
// ntifs.h

NTSYSAPI NTSTATUS ZwFlushBuffersFile(
  [in]  HANDLE           FileHandle,
  [out] PIO_STATUS_BLOCK IoStatusBlock
);
View the official Windows Driver Kit DDI reference

NtDoc

No description available.

Edit description on GitHub

Windows Driver Kit DDI reference (nf-ntifs-zwflushbuffersfile)

ZwFlushBuffersFile function

Description

The ZwFlushBuffersFile routine is called by a file system filter driver to send a flush request for the specified file to the file system.

Parameters

FileHandle [in]

Handle returned by ZwCreateFile or ZwOpenFile for the file whose buffers will be flushed. This parameter is required and cannot be NULL.

IoStatusBlock [out]

Address of the caller's I/O status block. This parameter is required and cannot be NULL.

Return value

ZwFlushBuffersFile returns STATUS_SUCCESS or an appropriate NTSTATUS value, such as one of the following:

Return code Description
STATUS_MEDIA_WRITE_PROTECTED The file resides on a write-protected volume; this is an error code.
STATUS_VOLUME_DISMOUNTED The file resides on a volume that is not currently mounted; this is an error code.

Remarks

A file system filter driver can call ZwFlushBuffersFile to issue an IRP_MJ_FLUSH_BUFFERS request to the file system for a given file. The flush operation is synchronous.

Minifilter drivers should call FltFlushBuffers instead of calling ZwFlushBuffersFile.

Callers of ZwFlushBuffersFile must be running at IRQL = PASSIVE_LEVEL and with special kernel APCs enabled.

Note If the call to the ZwFlushBuffersFile function occurs in user mode, you should use the name "NtFlushBuffersFile" instead of "ZwFlushBuffersFile".

For calls from kernel-mode drivers, the Nt*Xxx* and Zw*Xxx* versions of a Windows Native System Services routine can behave differently in the way that they handle and interpret input parameters. For more information about the relationship between the Nt*Xxx* and Zw*Xxx* versions of a routine, see Using Nt and Zw Versions of the Native System Services Routines.

See also

FltFlushBuffers

IRP_MJ_FLUSH_BUFFERS

Using Nt and Zw Versions of the Native System Services Routines

ZwCreateFile

ZwOpenFile

View the official Windows Driver Kit DDI reference

Edit description on GitHub

NTinternals.net (undocumented.ntinternals.net)

This function is documented in Windows Driver Kit.

Function NtFlushBuffersFile flushes currently cashed data and write it to storage.

FileHandle

HANDLE to File Object.

IoStatusBlock

IO result of call.

Documented by

See also

Edit description on GitHub