Does IRP_MJ_SHUTDOWN in a minifilter gurantee that no more I/O is left pending

NTFSD
1

Hello,

I have a requirement in my mini-filter to write some data to the volume after all writes to the volume are complete during the machine shutdown.
The mini-filter documentation states that only pre-op is supported for IRP_MJ_SHUTDOWN.
As per IRP_MJ_SHUTDOWN notification is received when all the file systems are flushed.
I am just wondering if it is at all possible in a mini-filter to ensure that all the FS writes are complete.

If not a mini filter driver, is there an alternative to get notified that all I/O is complete before the final writes can be performed.

Thanks.

2

In a word, no.

When you get the IRP_MJ_SHUTDOWN, there is no guarantee that you won’t get further I/O operations.

Searching this forum for “IRP_MJ_SHUTDOWN Minifilter” will get you a very large number of posts that you might find interesting.

Peter

3

Thanks Peter, one more query - during shutdown - for a mini filter is it possible that some IO writes are missed - i.e. a lower altitude driver or any other driver can perform some write operations which a higher order mini filter driver may miss because its teardown has been called. also does handling IRP_MJ_VOLUME_DISMOUNT may help this case?

4

The file system is the one responsible for determining the “last write” and it does this while handling the IRP_MJ_SHUTDOWN. So until the shutdown actually hits the file system any number of writes can happen. Also note that the file system will undoubtedly generate its own writes while handling the shutdown.