使用buffer咋会导致文件操作就不走文件系统了？表述肯定是有问题的。

是指Fast I/O？

Fast I/O is specifically designed for rapid synchronous I/O on cached files. In fast I/O operations, data is transferred directly between user buffers and the system cache, bypassing the file system and the storage driver stack. (Storage drivers do not use fast I/O.) If all of the data to be read from a file is resident in the system cache when a fast I/O read or write request is received, the request is satisfied immediately. Otherwise, a page fault can occur, causing one or more IRPs to be generated. When this happens, the fast I/O routine either returns FALSE, or puts the caller into a wait state until the page fault is processed. If the fast I/O routine returns FALSE, the requested operation failed and the caller must create an IRP.

https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/irps-are-different-from-fast-i-o
https://www.osronline.com/article.cfm%5Eid=166.htm

【 在 saynothing 的大作中提到: 】
: 文件读写，使用buffer的话，是不是会不经过文件系统？
: 而驱动是挂载在文件系统minifilter这一层，这个时候加解密不一致。
: 这个不好弄。不知我的表述是否有问题
: ...................
--
修改:z16166 FROM 221.220.172.*
FROM 221.220.172.*