We have a filter driver that maintains a record of IO and works well for the most part by flushing a bitmap to disk after receiving LastChanceShutdownNotification. Occasionally, however, we find that we have received new IRPs AFTER this bitmap has already been persisted… (inside DispatchPower for PowerSystemShutdown).
We have tried to do as little as possible during power off, but it looks like we are shutting down too early to track all IO.
I’ve seen it suggested to actually perform the bitmap write during the DispatchPower and registering a completion callback for processing the result , forwarding the IRP on the next layer, then returning STATUS_PENDING. As I understand it, the moment we pass on the DispatchPower IRP to the lower levels, those layers are no longer going to be able to accept writes.
The point of confusion is that we don’t know when those new IRPs will be finished. We don’t want to block, but we really need them to finish before we write the bitmap.
??