I have a requirement in my mini-filter to write some data to the volume after all writes to the volume are complete during the machine shutdown.
The mini-filter documentation states that only pre-op is supported for IRP_MJ_SHUTDOWN.
As per IRP_MJ_SHUTDOWN notification is received when all the file systems are flushed.
I am just wondering if it is at all possible in a mini-filter to ensure that all the FS writes are complete.
If not a mini filter driver, is there an alternative to get notified that all I/O is complete before the final writes can be performed.
Thanks Peter, one more query - during shutdown - for a mini filter is it possible that some IO writes are missed - i.e. a lower altitude driver or any other driver can perform some write operations which a higher order mini filter driver may miss because its teardown has been called. also does handling IRP_MJ_VOLUME_DISMOUNT may help this case?
The file system is the one responsible for determining the “last write” and it does this while handling the IRP_MJ_SHUTDOWN. So until the shutdown actually hits the file system any number of writes can happen. Also note that the file system will undoubtedly generate its own writes while handling the shutdown.