driver keeps receiving IRP_MJ_CREATE, IRP_MJ_CLOSE and IRP_MJ_CLEANUP irps

device driver

    Sponsored Links


  • 1. IoCreateDevice before or after IoInvalidateDeviceRelations
    I'm back-porting an XP WDM/PNP bus driver to W98SE (don't ask why!) and it seems that under 98 I must create a PDO for a newly-arrived device before I call IoInvalidateDeviceRelations, otherwise the driver does not get a following IRP_MN_QUERY_DEVICE_RELATIONS. Under XP the original driver was Invalidating the relations, then creating the PDO during the consequent IRP_MN_QUERY_DEVICE_RELATIONS handling. Is either ordering mandatory? TIA
  • 2. where can I find toaster sample in xpddk?
    I have just installed xpddk but I can't find toaster in the ddk folder. I was told that in 2KDDK , the path is NTDDK\src\general\toaster. But there isn't a \src in my \winddk\2600. Could anyone help me? thanks & Best Regards! XQing Wang XXXX@XXXXX.COM
  • 3. USB driver does not start after computer restart
    Hi everyone I am having some problems with an USB device supplied by our vendor. It comes with a standard .inf & .sys file. The first problem: even the driver can be installed properly in the first time, it always will not work after I restart the computer (it becomes Unknown Device inside Device Manager's Device List), I always have to unplug and replug the device again for it to work properly. The second problem: if I use MS devcon or Walter Oney's FastInst to install the .inf file automatically, I will always have BSOD right away. However, if I install manually by running the Windows Install Driver Wizard and select the .inf file, it can be installed without any problem. So my question is: is there a common mistake (e.g. forget to handling certain IRPs) that could cause the above two problems? I already ask our vendor and they seem quite clueless, so I would like to ask if anyone here have experienced it before and could shed some lights for me to speed up our vendor. Thanks in advance Hai
  • 4. Webcam "Hazy" effect on USB1.1 mode
    My webcam driver is based on "usbintel" sample in DDK src\wdm\videocap folder. We changed it to support 64-bit system but encountered a problem when connect the device to USB1.1 port (via a USB1.1 hub which connect to a USB2.0 port on motherboard) on 64-bit XP. The issue is : preview effect is hazy, it's like cover the preview window by using a gray semitransparent cloth. I have no idea how come that happened? Is it related to the sensor settings or USB chip control? Any suggestion would be greatly appreciated~ Barry
  • 5. data exchange betwen driver and gui aplication
    I want to know how can it be done corectly. I can't seem to find any documentation on this. For example how can I tell if the buffer was sent to the driver in the Type3InputBuffer variable or Irp->UserBuffer. I know it depends on how you define your control codes. I mean: METHOD bufered => the buffer will come in Irp->UserBuffer for example. Can someone clear this out for me a little or tell me where I can find documentation. I am trying to send a handle of an event in kernel mode and it always tells me that the memory is not valid but if I am sending a string it works. Please help me. Thanks in advance

driver keeps receiving IRP_MJ_CREATE, IRP_MJ_CLOSE and IRP_MJ_CLEANUP irps

Postby Robert » Fri, 15 Aug 2003 02:21:41 GMT

   I have a PNP driver, which creates virtual CDRom 
devices to emulate ISO images (setup programs) on a 
harddhisk. It works fine on 2k - loading the CD image and 
install applications from the CD image (including setup 
programs containing cab files). However, on XP with the 
same driver, the CD image is loaded fine, if the setup 
programs contain cab files, the setup process cannot find 
the cab files. 
    Comparing debug outputs from the driver on the two OS 
systems when a CD image is loaded, on XP, the driver 
keeps receiving IRP_MJ_CREATE, IRP_MJ_CLOSE and 
IRP_MJ_CLEANUP irps about every minute. But this is not 
happening on Windows 2000.
    What can I do to fix the problem? Thanks


Similar Threads:

1.Why is IRP_MJ_CLOSE needed (when there is IRP_MJ_CLEANUP)?

>From the WDK documentation for IRP_MJ_CLEANUP:

"Receipt of the IRP_MJ_CLEANUP request indicates that the *handle*
reference count on a file object has reached zero."

>From the WDK documentation for IRP_MJ_CLOSE:

"Receipt of the IRP_MJ_CLOSE request indicates that the reference
count on a file object has reached zero."

Is the difference abvoe between "handle reference count" and
"reference count" meaningful? If so, what does that mean?

OK, so I read on and the the WDK documentation for IRP_MJ_CLEANUP

"Often it is sent when a user-mode application has called the
Microsoft Win32 CloseHandle function (or when a kernel-mode driver has
called ZwClose) on the last outstanding handle to a file object."

How confusing: a call to CloseHandle() does not translate into
IRP_MJ_CLOSE but rather into IRP_MJ_CLEANUP. Why is that?

The WDK documentation for IRP_MJ_CLOSE, on the other hand, reads:

"usually because a file system driver or other kernel-mode component
has called ObDereferenceObject on the file object."

OK, so I understand that while IRP_MJ_CLEANUP is guaranteed to be sent
in the context of the process that created the handle,  IRP_MJ_CLOSE
can come in *any* context, including the system context after the
process has exited.

But... the WDK documentation for IRP_MJ_CLOSE, continues:

"This request normally follows a cleanup request. However, this does
not necessarily mean that the close request will be received
immediately after the cleanup request."

So, Is IRP_MJ_CLEANUP *always* followed by a IRP_MJ_CLOSE (even if not
"immediately")? What does "immediately" in the above context means?

My observation, using WinDbg on a driver that I develop, suggests that
the answer is "Yes" -  IRP_MJ_CLEANUP is *always* followed by a
IRP_MJ_CLOSE. But this doesn't make sense: why two IRPs for the same
thing? What am I supposed to do in response to IRP_MJ_CLOSE if I
already handle IRP_MJ_CLEANUP?

What am I missing?



Does the I/O manager guarantee any sort of ordering with respect to file handles during abnormal user-mode program termination?  That is, if an application opens a series of file handles and then crashes, will those handles get closed in the opposite order from creation, same order, random order?

Is this documented somewhere in the DDK?


- Fab

3.Difference between IRP_MJ_CLOSE and IRP_MJ_CLEANUP

Hi everybody,

Can anybody please explain the difference between IRP_MJ_CLOSE and 
IRP_MJ_CLEANUP. I *thought* that the IRP_MJ_CLEANUP IRP is send whenever the 
last handle from 1 process to a device was closed. But today I found out 
that the cleanup was called every time I closed a handle to my device, even 
when I had other handles open in the same process.
The only difference now seems to be that the cleanup is allways processed in 
the context of the owning process.

I need some mechanism to detect when the last handle from 1 process is 
closed so I can perform cleanup of per process data. Sure, I can create an 
administration in the device extension but I thought the IRP_MJ_CLEANUP 
could be used for this purpose.

Any info is appreciated,



When an application exits abnormally, are file handles closed following a documented order?  Is there some ordering that is guaranteed to be followed?  Do file handles get closed in the opposite order from creation, same order, or random order?


- Fab

5.Don't receive IRP_MJ_CREATE on a CreateFile


I use CreateFile on my device to DeviceIoControl on it.
But AFAI understand I should receive IRP_MJ_CREATE on CreateFile and CLEANUP
& CLOSE on CloseHandle (am I right ?) but my driver does not receive these
events. But it receive these from other time (maybe explorer.exe).

What's the problem ?

6. context of irp_mj_close

7. Closing application without sending IRP_MJ_CLOSE

8. IRP_MJ_CLEANUP and FltGetFileNameInformation in minifilter dri

Return to device driver


Who is online

Users browsing this forum: No registered users and 60 guest