We have a filter driver that maintains a record of IO and works well for the most part by flushing a bitmap to disk after receiving LastChanceShutdownNotification. Occasionally, however, we find that we have received new IRPs AFTER this bitmap has already been persisted... (inside DispatchPower for PowerSystemShutdown).
We have tried to do as little as possible during power off, but it looks like we are shutting down too early to track all IO.
I've seen it suggested to actually perform the bitmap write during the DispatchPower and registering a completion callback for processing the result , forwarding the IRP on the next layer, then returning STATUS_PENDING. As I understand it, the moment we pass on the DispatchPower IRP to the lower levels, those layers are no longer going to be able to accept writes.
The point of confusion is that we don't know when those new IRPs will be finished. We don't want to block, but we really need them to finish before we write the bitmap.
It looks like you're new here. If you want to get involved, click one of these buttons!
|Upcoming OSR Seminars|
|Developing Minifilters||29 July 2019||OSR Seminar Space|
|Writing WDF Drivers||23 Sept 2019||OSR Seminar Space|
|Kernel Debugging||21 Oct 2019||OSR Seminar Space|
|Internals & Software Drivers||18 Nov 2019||Dulles, VA|