Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
More Info on Driver Writing and Debugging
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
Does IRP_MJ_SHUTDOWN in a minifilter gurantee that no more I/O is left pending
Hello,
I have a requirement in my mini-filter to write some data to the volume after all writes to the volume are complete during the machine shutdown.
The mini-filter documentation states that only pre-op is supported for IRP_MJ_SHUTDOWN.
As per IRP_MJ_SHUTDOWN notification is received when all the file systems are flushed.
I am just wondering if it is at all possible in a mini-filter to ensure that all the FS writes are complete.
If not a mini filter driver, is there an alternative to get notified that all I/O is complete before the final writes can be performed.
Thanks.
| Upcoming OSR Seminars | ||
|---|---|---|
| OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead! | ||
| Writing WDF Drivers | 7 Dec 2020 | LIVE ONLINE |
| Internals & Software Drivers | 25 Jan 2021 | LIVE ONLINE |
| Developing Minifilters | 8 March 2021 | LIVE ONLINE |
Comments
In a word, no.
When you get the IRP_MJ_SHUTDOWN, there is no guarantee that you won't get further I/O operations.
Searching this forum for "IRP_MJ_SHUTDOWN Minifilter" will get you a very large number of posts that you might find interesting.
Peter
Peter Viscarola
OSR
@OSRDrivers
Thanks Peter, one more query - during shutdown - for a mini filter is it possible that some IO writes are missed - i.e. a lower altitude driver or any other driver can perform some write operations which a higher order mini filter driver may miss because its teardown has been called. also does handling IRP_MJ_VOLUME_DISMOUNT may help this case?
The file system is the one responsible for determining the "last write" and it does this while handling the IRP_MJ_SHUTDOWN. So until the shutdown actually hits the file system any number of writes can happen. Also note that the file system will undoubtedly generate its own writes while handling the shutdown.
-scott
OSR