Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTFSD
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Does IRP_MJ_SHUTDOWN in a minifilter gurantee that no more I/O is left pending

john-7john-7 Member Posts: 24

Hello,

I have a requirement in my mini-filter to write some data to the volume after all writes to the volume are complete during the machine shutdown.
The mini-filter documentation states that only pre-op is supported for IRP_MJ_SHUTDOWN.
As per IRP_MJ_SHUTDOWN notification is received when all the file systems are flushed.
I am just wondering if it is at all possible in a mini-filter to ensure that all the FS writes are complete.

If not a mini filter driver, is there an alternative to get notified that all I/O is complete before the final writes can be performed.

Thanks.

Comments

  • Peter_Viscarola_(OSR)Peter_Viscarola_(OSR) Administrator Posts: 8,158

    In a word, no.

    When you get the IRP_MJ_SHUTDOWN, there is no guarantee that you won't get further I/O operations.

    Searching this forum for "IRP_MJ_SHUTDOWN Minifilter" will get you a very large number of posts that you might find interesting.

    Peter

    Peter Viscarola
    OSR
    @OSRDrivers

  • john-7john-7 Member Posts: 24
    edited November 6

    Thanks Peter, one more query - during shutdown - for a mini filter is it possible that some IO writes are missed - i.e. a lower altitude driver or any other driver can perform some write operations which a higher order mini filter driver may miss because its teardown has been called. also does handling IRP_MJ_VOLUME_DISMOUNT may help this case?

  • Scott_Noone_(OSR)Scott_Noone_(OSR) Administrator Posts: 3,362

    The file system is the one responsible for determining the "last write" and it does this while handling the IRP_MJ_SHUTDOWN. So until the shutdown actually hits the file system any number of writes can happen. Also note that the file system will undoubtedly generate its own writes while handling the shutdown.

    -scott
    OSR

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Writing WDF Drivers 7 Dec 2020 LIVE ONLINE
Internals & Software Drivers 25 Jan 2021 LIVE ONLINE
Developing Minifilters 8 March 2021 LIVE ONLINE