CREATE/CLOSE Dispatch routines

OSR_Community_User · October 20, 2003, 1:52pm

Hi all,

I am writing a disk filter driver. My driver will be the top driver on the stack. My question is, do I complete the IRP_MJ_CREATE and
IRP_MJ_CLOSE or, do I pass it down to the lower driver?
It is not really clear in the DDK.

Thanks

Peter

Maxim_S_Shatskih · October 20, 2003, 2:31pm

Pass them down, just for a case the lower driver will want to employ
FsContext2 to store some per-file data.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From:
To: “Windows System Software Devs Interest List”
Sent: Monday, October 20, 2003 9:51 PM
Subject: [ntdev] CREATE/CLOSE Dispatch routines

> Hi all,
>
> I am writing a disk filter driver. My driver will be the top driver on the
stack. My question is, do I complete the IRP_MJ_CREATE and
> IRP_MJ_CLOSE or, do I pass it down to the lower driver?
> It is not really clear in the DDK.
>
> Thanks
>
> Peter
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

OSR_Community_User · October 20, 2003, 2:37pm

disk drivers very very rarely even get CREATE/CLOSE requests. Most
attempts to open a disk go to the attached file system (or cause the
mount of one) and the CREATE (and subsequent close) are swallowed by the
file system rather than being passed through. The only case where you
would get a create is a so-called “direct device open” which is an
attempt to open the device itself rather than a directory on the device
for effectively no possible access. In this event you should send the
request down to the lower drivers in the stack since you’re a filter.

-p

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@verizon.net
Sent: Monday, October 20, 2003 10:51 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] CREATE/CLOSE Dispatch routines

Hi all,

I am writing a disk filter driver. My driver will be the top driver on
the stack. My question is, do I complete the IRP_MJ_CREATE and
IRP_MJ_CLOSE or, do I pass it down to the lower driver?
It is not really clear in the DDK.

Thanks

Peter

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@microsoft.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

OSR_Community_User · October 20, 2003, 3:14pm

Hi,

Actually, I wrote an app. using SetupDixxx to remove and re-enumerate the disk devices that I am filtering (my driver is the top on stack).
In my driver I keep track of the number of CREATEs and CLOSEs count. When I receive the QUERY_REMOVAL, I check this count to see if it is 0. If it is, I complete the Irp. If it’s not, I fail it. I never pass the CREATE and CLOSE Irp down the stack.
Is there a problem with this?

Peter

From: “Peter Wieland”
> Date: 2003/10/20 Mon PM 01:37:09 CDT
> To: “Windows System Software Devs Interest List”
> Subject: [ntdev] RE: CREATE/CLOSE Dispatch routines
>
> disk drivers very very rarely even get CREATE/CLOSE requests. Most
> attempts to open a disk go to the attached file system (or cause the
> mount of one) and the CREATE (and subsequent close) are swallowed by the
> file system rather than being passed through. The only case where you
> would get a create is a so-called “direct device open” which is an
> attempt to open the device itself rather than a directory on the device
> for effectively no possible access. In this event you should send the
> request down to the lower drivers in the stack since you’re a filter.
>
> -p
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of
> xxxxx@verizon.net
> Sent: Monday, October 20, 2003 10:51 AM
> To: Windows System Software Devs Interest List
> Subject: [ntdev] CREATE/CLOSE Dispatch routines
>
> Hi all,
>
> I am writing a disk filter driver. My driver will be the top driver on
> the stack. My question is, do I complete the IRP_MJ_CREATE and
> IRP_MJ_CLOSE or, do I pass it down to the lower driver?
> It is not really clear in the DDK.
>
> Thanks
>
> Peter
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@microsoft.com To
> unsubscribe send a blank email to xxxxx@lists.osr.com
>
> —
> Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@verizon.net
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

OSR_Community_User · October 20, 2003, 3:23pm

yes - the lower drivers need to see CREATE/CLOSE for direct device
opens. You need to send them down.

on the query-remove case: the file system and the disk class driver
already do this for you. Unless you have some outstanding operation
that can’t be aborted you should just pass the QR down the stack.

-p

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@verizon.net
Sent: Monday, October 20, 2003 12:14 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] RE: CREATE/CLOSE Dispatch routines

Hi,

Actually, I wrote an app. using SetupDixxx to remove and re-enumerate
the disk devices that I am filtering (my driver is the top on stack).
In my driver I keep track of the number of CREATEs and CLOSEs count.
When I receive the QUERY_REMOVAL, I check this count to see if it is 0.
If it is, I complete the Irp. If it’s not, I fail it. I never pass the
CREATE and CLOSE Irp down the stack.
Is there a problem with this?

Peter

From: “Peter Wieland”
> Date: 2003/10/20 Mon PM 01:37:09 CDT
> To: “Windows System Software Devs Interest List”
> Subject: [ntdev] RE: CREATE/CLOSE Dispatch routines
>
> disk drivers very very rarely even get CREATE/CLOSE requests. Most
> attempts to open a disk go to the attached file system (or cause the
> mount of one) and the CREATE (and subsequent close) are swallowed by
> the file system rather than being passed through. The only case where

> you would get a create is a so-called “direct device open” which is an

> attempt to open the device itself rather than a directory on the
> device for effectively no possible access. In this event you should
> send the request down to the lower drivers in the stack since you’re a
filter.
>
> -p
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of
> xxxxx@verizon.net
> Sent: Monday, October 20, 2003 10:51 AM
> To: Windows System Software Devs Interest List
> Subject: [ntdev] CREATE/CLOSE Dispatch routines
>
> Hi all,
>
> I am writing a disk filter driver. My driver will be the top driver on

> the stack. My question is, do I complete the IRP_MJ_CREATE and
> IRP_MJ_CLOSE or, do I pass it down to the lower driver?
> It is not really clear in the DDK.
>
> Thanks
>
> Peter
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@microsoft.com To
> unsubscribe send a blank email to xxxxx@lists.osr.com
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@verizon.net To
> unsubscribe send a blank email to xxxxx@lists.osr.com
>

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@microsoft.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

OSR_Community_User · October 20, 2003, 3:31pm

There is a well known problem with a filter driver making the assumption
that it is “the top of the stack”. That is simply an invalid assumption, as
anyone can write a filter driver that will install after your filter driver
and violate your assumption. If your design depends on this bogus assumption
then you need to rethink your design.

=====================
Mark Roddy

-----Original Message-----
From: xxxxx@verizon.net [mailto:xxxxx@verizon.net]
Sent: Monday, October 20, 2003 3:14 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] RE: CREATE/CLOSE Dispatch routines

Hi,

Actually, I wrote an app. using SetupDixxx to remove and
re-enumerate the disk devices that I am filtering (my driver
is the top on stack). In my driver I keep track of the number
of CREATEs and CLOSEs count. When I receive the
QUERY_REMOVAL, I check this count to see if it is 0. If it
is, I complete the Irp. If it’s not, I fail it. I never pass
the CREATE and CLOSE Irp down the stack. Is there a problem with this?

Peter

>
> From: “Peter Wieland”
> > Date: 2003/10/20 Mon PM 01:37:09 CDT
> > To: “Windows System Software Devs Interest List”
>
> > Subject: [ntdev] RE: CREATE/CLOSE Dispatch routines
> >
> > disk drivers very very rarely even get CREATE/CLOSE requests. Most
> > attempts to open a disk go to the attached file system (or
> cause the
> > mount of one) and the CREATE (and subsequent close) are
> swallowed by
> > the file system rather than being passed through. The only
> case where
> > you would get a create is a so-called “direct device open”
> which is an
> > attempt to open the device itself rather than a directory on the
> > device for effectively no possible access. In this event
> you should
> > send the request down to the lower drivers in the stack
> since you’re a
> > filter.
> >
> > -p
> >
> >
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com] On Behalf Of
> > xxxxx@verizon.net
> > Sent: Monday, October 20, 2003 10:51 AM
> > To: Windows System Software Devs Interest List
> > Subject: [ntdev] CREATE/CLOSE Dispatch routines
> >
> > Hi all,
> >
> > I am writing a disk filter driver. My driver will be the
> top driver on
> > the stack. My question is, do I complete the IRP_MJ_CREATE and
> > IRP_MJ_CLOSE or, do I pass it down to the lower driver? It is not
> > really clear in the DDK.
> >
> > Thanks
> >
> > Peter
> >
> >
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> > http://www.osronline.com/article.cfm?id=256
> >
> > You are currently subscribed to ntdev as: xxxxx@microsoft.com To
> > unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> > http://www.osronline.com/article.cfm?id=256
> >
> > You are currently subscribed to ntdev as:
> xxxxx@verizon.net To
> > unsubscribe send a blank email to xxxxx@lists.osr.com
> >
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@stratus.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

OSR_Community_User · October 20, 2003, 4:14pm

Mark,

Point taken. Could you answer my initial question: should I complete the CREATE/CLOSE Irp or just simply pass it down to the lower driver?

Regards,

Peter

From: “Roddy, Mark”
> Date: 2003/10/20 Mon PM 02:30:27 CDT
> To: “Windows System Software Devs Interest List”
> Subject: [ntdev] RE: CREATE/CLOSE Dispatch routines
>
> There is a well known problem with a filter driver making the assumption
> that it is “the top of the stack”. That is simply an invalid assumption, as
> anyone can write a filter driver that will install after your filter driver
> and violate your assumption. If your design depends on this bogus assumption
> then you need to rethink your design.
>
>
> =====================
> Mark Roddy
>
>
> > -----Original Message-----
> > From: xxxxx@verizon.net [mailto:xxxxx@verizon.net]
> > Sent: Monday, October 20, 2003 3:14 PM
> > To: Windows System Software Devs Interest List
> > Subject: [ntdev] RE: CREATE/CLOSE Dispatch routines
> >
> >
> > Hi,
> >
> > Actually, I wrote an app. using SetupDixxx to remove and
> > re-enumerate the disk devices that I am filtering (my driver
> > is the top on stack). In my driver I keep track of the number
> > of CREATEs and CLOSEs count. When I receive the
> > QUERY_REMOVAL, I check this count to see if it is 0. If it
> > is, I complete the Irp. If it’s not, I fail it. I never pass
> > the CREATE and CLOSE Irp down the stack. Is there a problem with this?
> >
> > Peter
> >
> >
> > >
> > > From: “Peter Wieland”
> > > Date: 2003/10/20 Mon PM 01:37:09 CDT
> > > To: “Windows System Software Devs Interest List”
> >
> > > Subject: [ntdev] RE: CREATE/CLOSE Dispatch routines
> > >
> > > disk drivers very very rarely even get CREATE/CLOSE requests. Most
> > > attempts to open a disk go to the attached file system (or
> > cause the
> > > mount of one) and the CREATE (and subsequent close) are
> > swallowed by
> > > the file system rather than being passed through. The only
> > case where
> > > you would get a create is a so-called “direct device open”
> > which is an
> > > attempt to open the device itself rather than a directory on the
> > > device for effectively no possible access. In this event
> > you should
> > > send the request down to the lower drivers in the stack
> > since you’re a
> > > filter.
> > >
> > > -p
> > >
> > >
> > > -----Original Message-----
> > > From: xxxxx@lists.osr.com
> > > [mailto:xxxxx@lists.osr.com] On Behalf Of
> > > xxxxx@verizon.net
> > > Sent: Monday, October 20, 2003 10:51 AM
> > > To: Windows System Software Devs Interest List
> > > Subject: [ntdev] CREATE/CLOSE Dispatch routines
> > >
> > > Hi all,
> > >
> > > I am writing a disk filter driver. My driver will be the
> > top driver on
> > > the stack. My question is, do I complete the IRP_MJ_CREATE and
> > > IRP_MJ_CLOSE or, do I pass it down to the lower driver? It is not
> > > really clear in the DDK.
> > >
> > > Thanks
> > >
> > > Peter
> > >
> > >
> > >
> > > —
> > > Questions? First check the Kernel Driver FAQ at
> > > http://www.osronline.com/article.cfm?id=256
> > >
> > > You are currently subscribed to ntdev as: xxxxx@microsoft.com To
> > > unsubscribe send a blank email to xxxxx@lists.osr.com
> > >
> > > —
> > > Questions? First check the Kernel Driver FAQ at
> > > http://www.osronline.com/article.cfm?id=256
> > >
> > > You are currently subscribed to ntdev as:
> > xxxxx@verizon.net To
> > > unsubscribe send a blank email to xxxxx@lists.osr.com
> > >
> >
> >
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@stratus.com To
> unsubscribe send a blank email to xxxxx@lists.osr.com
>
> —
> Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@verizon.net
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

OSR_Community_User · October 20, 2003, 4:19pm

Peter Wieland’s answer was correct as far as I know. The only cases where
you wouldn’t pass these requests down, that I can think of are:

you have some sort of ‘special’ device object in your filter driver;
you are blocking creates on a device for some reason (unlikely for a disk
filter driver.)

=====================
Mark Roddy

-----Original Message-----
From: xxxxx@verizon.net [mailto:xxxxx@verizon.net]
Sent: Monday, October 20, 2003 4:13 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] RE: CREATE/CLOSE Dispatch routines

Mark,

Point taken. Could you answer my initial question: should I
complete the CREATE/CLOSE Irp or just simply pass it down to
the lower driver?

Regards,

Peter
>
> From: “Roddy, Mark”
> > Date: 2003/10/20 Mon PM 02:30:27 CDT
> > To: “Windows System Software Devs Interest List”
>
> > Subject: [ntdev] RE: CREATE/CLOSE Dispatch routines
> >
> > There is a well known problem with a filter driver making the
> > assumption that it is “the top of the stack”. That is simply an
> > invalid assumption, as anyone can write a filter driver that will
> > install after your filter driver and violate your
> assumption. If your
> > design depends on this bogus assumption then you need to
> rethink your
> > design.
> >
> >
> > =====================
> > Mark Roddy
> >
> >
> > > -----Original Message-----
> > > From: xxxxx@verizon.net [mailto:xxxxx@verizon.net]
> > > Sent: Monday, October 20, 2003 3:14 PM
> > > To: Windows System Software Devs Interest List
> > > Subject: [ntdev] RE: CREATE/CLOSE Dispatch routines
> > >
> > >
> > > Hi,
> > >
> > > Actually, I wrote an app. using SetupDixxx to remove and
> > > re-enumerate the disk devices that I am filtering (my driver
> > > is the top on stack). In my driver I keep track of the number
> > > of CREATEs and CLOSEs count. When I receive the
> > > QUERY_REMOVAL, I check this count to see if it is 0. If it
> > > is, I complete the Irp. If it’s not, I fail it. I never pass
> > > the CREATE and CLOSE Irp down the stack. Is there a
> problem with this?
> > >
> > > Peter
> > >
> > >
> > > >
> > > > From: “Peter Wieland”
> > > > Date: 2003/10/20 Mon PM 01:37:09 CDT
> > > > To: “Windows System Software Devs Interest List”
> > >
> > > > Subject: [ntdev] RE: CREATE/CLOSE Dispatch routines
> > > >
> > > > disk drivers very very rarely even get CREATE/CLOSE requests.
> > > > Most
> > > > attempts to open a disk go to the attached file system (or
> > > cause the
> > > > mount of one) and the CREATE (and subsequent close) are
> > > swallowed by
> > > > the file system rather than being passed through. The only
> > > case where
> > > > you would get a create is a so-called “direct device open”
> > > which is an
> > > > attempt to open the device itself rather than a directory on the
> > > > device for effectively no possible access. In this event
> > > you should
> > > > send the request down to the lower drivers in the stack
> > > since you’re a
> > > > filter.
> > > >
> > > > -p
> > > >
> > > >
> > > > -----Original Message-----
> > > > From: xxxxx@lists.osr.com
> > > > [mailto:xxxxx@lists.osr.com] On Behalf Of
> > > > xxxxx@verizon.net
> > > > Sent: Monday, October 20, 2003 10:51 AM
> > > > To: Windows System Software Devs Interest List
> > > > Subject: [ntdev] CREATE/CLOSE Dispatch routines
> > > >
> > > > Hi all,
> > > >
> > > > I am writing a disk filter driver. My driver will be the
> > > top driver on
> > > > the stack. My question is, do I complete the IRP_MJ_CREATE and
> > > > IRP_MJ_CLOSE or, do I pass it down to the lower driver?
> It is not
> > > > really clear in the DDK.
> > > >
> > > > Thanks
> > > >
> > > > Peter
> > > >
> > > >
> > > >
> > > > —
> > > > Questions? First check the Kernel Driver FAQ at
> > > > http://www.osronline.com/article.cfm?id=256
> > > >
> > > > You are currently subscribed to ntdev as:
> xxxxx@microsoft.com
> > > > To
> > > > unsubscribe send a blank email to
> xxxxx@lists.osr.com
> > > >
> > > > —
> > > > Questions? First check the Kernel Driver FAQ at
> > > > http://www.osronline.com/article.cfm?id=256
> > > >
> > > > You are currently subscribed to ntdev as:
> > > xxxxx@verizon.net To
> > > > unsubscribe send a blank email to
> xxxxx@lists.osr.com
> > > >
> > >
> > >
> > >
> > > —
> > > Questions? First check the Kernel Driver FAQ at
> > http://www.osronline.com/article.cfm?id=256
> >
> > You are currently subscribed to ntdev as: xxxxx@stratus.com To
> > unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> > http://www.osronline.com/article.cfm?id=256
> >
> > You are currently subscribed to ntdev as:
> xxxxx@verizon.net To
> > unsubscribe send a blank email to xxxxx@lists.osr.com
> >
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@stratus.com To
unsubscribe send a blank email to xxxxx@lists.osr.com

OSR_Community_User · October 20, 2003, 4:56pm

Thanks to all for helping me out.
One more question:
Is it possible that a device receives more CLOSE requests than CREATE requests?

I am executing my application, and I set breakpoints at the CREATE and CLOSE routines. Looks like I am receiving more CLOSEs than CREATEs. My application does CreateFile() and CloseHandle() only once.

Thanks

Peter

From: “Roddy, Mark”
> Date: 2003/10/20 Mon PM 03:18:51 CDT
> To: “Windows System Software Devs Interest List”
> Subject: [ntdev] RE: CREATE/CLOSE Dispatch routines
>
> Peter Wieland’s answer was correct as far as I know. The only cases where
> you wouldn’t pass these requests down, that I can think of are:
> 1) you have some sort of ‘special’ device object in your filter driver;
> 2) you are blocking creates on a device for some reason (unlikely for a disk
> filter driver.)
>
>
> =====================
> Mark Roddy
>
>
> > -----Original Message-----
> > From: xxxxx@verizon.net [mailto:xxxxx@verizon.net]
> > Sent: Monday, October 20, 2003 4:13 PM
> > To: Windows System Software Devs Interest List
> > Subject: [ntdev] RE: CREATE/CLOSE Dispatch routines
> >
> >
> > Mark,
> >
> > Point taken. Could you answer my initial question: should I
> > complete the CREATE/CLOSE Irp or just simply pass it down to
> > the lower driver?
> >
> > Regards,
> >
> > Peter
> > >
> > > From: “Roddy, Mark”
> > > Date: 2003/10/20 Mon PM 02:30:27 CDT
> > > To: “Windows System Software Devs Interest List”
> >
> > > Subject: [ntdev] RE: CREATE/CLOSE Dispatch routines
> > >
> > > There is a well known problem with a filter driver making the
> > > assumption that it is “the top of the stack”. That is simply an
> > > invalid assumption, as anyone can write a filter driver that will
> > > install after your filter driver and violate your
> > assumption. If your
> > > design depends on this bogus assumption then you need to
> > rethink your
> > > design.
> > >
> > >
> > > =====================
> > > Mark Roddy
> > >
> > >
> > > > -----Original Message-----
> > > > From: xxxxx@verizon.net [mailto:xxxxx@verizon.net]
> > > > Sent: Monday, October 20, 2003 3:14 PM
> > > > To: Windows System Software Devs Interest List
> > > > Subject: [ntdev] RE: CREATE/CLOSE Dispatch routines
> > > >
> > > >
> > > > Hi,
> > > >
> > > > Actually, I wrote an app. using SetupDixxx to remove and
> > > > re-enumerate the disk devices that I am filtering (my driver
> > > > is the top on stack). In my driver I keep track of the number
> > > > of CREATEs and CLOSEs count. When I receive the
> > > > QUERY_REMOVAL, I check this count to see if it is 0. If it
> > > > is, I complete the Irp. If it’s not, I fail it. I never pass
> > > > the CREATE and CLOSE Irp down the stack. Is there a
> > problem with this?
> > > >
> > > > Peter
> > > >
> > > >
> > > > >
> > > > > From: “Peter Wieland”
> > > > > Date: 2003/10/20 Mon PM 01:37:09 CDT
> > > > > To: “Windows System Software Devs Interest List”
> > > >
> > > > > Subject: [ntdev] RE: CREATE/CLOSE Dispatch routines
> > > > >
> > > > > disk drivers very very rarely even get CREATE/CLOSE requests.
> > > > > Most
> > > > > attempts to open a disk go to the attached file system (or
> > > > cause the
> > > > > mount of one) and the CREATE (and subsequent close) are
> > > > swallowed by
> > > > > the file system rather than being passed through. The only
> > > > case where
> > > > > you would get a create is a so-called “direct device open”
> > > > which is an
> > > > > attempt to open the device itself rather than a directory on the
> > > > > device for effectively no possible access. In this event
> > > > you should
> > > > > send the request down to the lower drivers in the stack
> > > > since you’re a
> > > > > filter.
> > > > >
> > > > > -p
> > > > >
> > > > >
> > > > > -----Original Message-----
> > > > > From: xxxxx@lists.osr.com
> > > > > [mailto:xxxxx@lists.osr.com] On Behalf Of
> > > > > xxxxx@verizon.net
> > > > > Sent: Monday, October 20, 2003 10:51 AM
> > > > > To: Windows System Software Devs Interest List
> > > > > Subject: [ntdev] CREATE/CLOSE Dispatch routines
> > > > >
> > > > > Hi all,
> > > > >
> > > > > I am writing a disk filter driver. My driver will be the
> > > > top driver on
> > > > > the stack. My question is, do I complete the IRP_MJ_CREATE and
> > > > > IRP_MJ_CLOSE or, do I pass it down to the lower driver?
> > It is not
> > > > > really clear in the DDK.
> > > > >
> > > > > Thanks
> > > > >
> > > > > Peter
> > > > >
> > > > >
> > > > >
> > > > > —
> > > > > Questions? First check the Kernel Driver FAQ at
> > > > > http://www.osronline.com/article.cfm?id=256
> > > > >
> > > > > You are currently subscribed to ntdev as:
> > xxxxx@microsoft.com
> > > > > To
> > > > > unsubscribe send a blank email to
> > xxxxx@lists.osr.com
> > > > >
> > > > > —
> > > > > Questions? First check the Kernel Driver FAQ at
> > > > > http://www.osronline.com/article.cfm?id=256
> > > > >
> > > > > You are currently subscribed to ntdev as:
> > > > xxxxx@verizon.net To
> > > > > unsubscribe send a blank email to
> > xxxxx@lists.osr.com
> > > > >
> > > >
> > > >
> > > >
> > > > —
> > > > Questions? First check the Kernel Driver FAQ at
> > > http://www.osronline.com/article.cfm?id=256
> > >
> > > You are currently subscribed to ntdev as: xxxxx@stratus.com To
> > > unsubscribe send a blank email to xxxxx@lists.osr.com
> > >
> > > —
> > > Questions? First check the Kernel Driver FAQ at
> > > http://www.osronline.com/article.cfm?id=256
> > >
> > > You are currently subscribed to ntdev as:
> > xxxxx@verizon.net To
> > > unsubscribe send a blank email to xxxxx@lists.osr.com
> > >
> >
> >
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@stratus.com To
> unsubscribe send a blank email to xxxxx@lists.osr.com
>
> —
> Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@verizon.net
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>

OSR_Community_User · October 20, 2003, 5:05pm

are you sure it’s multiple close requests that you’re getting, and that
you aren’t counting both cleanup and close IRPs?

-p

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@verizon.net
Sent: Monday, October 20, 2003 1:55 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] RE: CREATE/CLOSE Dispatch routines

Thanks to all for helping me out.
One more question:
Is it possible that a device receives more CLOSE requests than CREATE
requests?

I am executing my application, and I set breakpoints at the CREATE and
CLOSE routines. Looks like I am receiving more CLOSEs than CREATEs. My
application does CreateFile() and CloseHandle() only once.

Thanks

Peter

From: “Roddy, Mark”
> Date: 2003/10/20 Mon PM 03:18:51 CDT
> To: “Windows System Software Devs Interest List”
> Subject: [ntdev] RE: CREATE/CLOSE Dispatch routines
>
> Peter Wieland’s answer was correct as far as I know. The only cases
> where you wouldn’t pass these requests down, that I can think of are:
> 1) you have some sort of ‘special’ device object in your filter
> driver;
> 2) you are blocking creates on a device for some reason (unlikely for
> a disk filter driver.)
>
>
> =====================
> Mark Roddy
>
>
> > -----Original Message-----
> > From: xxxxx@verizon.net [mailto:xxxxx@verizon.net]
> > Sent: Monday, October 20, 2003 4:13 PM
> > To: Windows System Software Devs Interest List
> > Subject: [ntdev] RE: CREATE/CLOSE Dispatch routines
> >
> >
> > Mark,
> >
> > Point taken. Could you answer my initial question: should I complete

> > the CREATE/CLOSE Irp or just simply pass it down to the lower
> > driver?
> >
> > Regards,
> >
> > Peter
> > >
> > > From: “Roddy, Mark”
> > > Date: 2003/10/20 Mon PM 02:30:27 CDT
> > > To: “Windows System Software Devs Interest List”
> >
> > > Subject: [ntdev] RE: CREATE/CLOSE Dispatch routines
> > >
> > > There is a well known problem with a filter driver making the
> > > assumption that it is “the top of the stack”. That is simply an
> > > invalid assumption, as anyone can write a filter driver that will
> > > install after your filter driver and violate your
> > assumption. If your
> > > design depends on this bogus assumption then you need to
> > rethink your
> > > design.
> > >
> > >
> > > =====================
> > > Mark Roddy
> > >
> > >
> > > > -----Original Message-----
> > > > From: xxxxx@verizon.net [mailto:xxxxx@verizon.net]
> > > > Sent: Monday, October 20, 2003 3:14 PM
> > > > To: Windows System Software Devs Interest List
> > > > Subject: [ntdev] RE: CREATE/CLOSE Dispatch routines
> > > >
> > > >
> > > > Hi,
> > > >
> > > > Actually, I wrote an app. using SetupDixxx to remove and
> > > > re-enumerate the disk devices that I am filtering (my driver is
> > > > the top on stack). In my driver I keep track of the number of
> > > > CREATEs and CLOSEs count. When I receive the QUERY_REMOVAL, I
> > > > check this count to see if it is 0. If it is, I complete the
> > > > Irp. If it’s not, I fail it. I never pass the CREATE and CLOSE
> > > > Irp down the stack. Is there a
> > problem with this?
> > > >
> > > > Peter
> > > >
> > > >
> > > > >
> > > > > From: “Peter Wieland”
> > > > > Date: 2003/10/20 Mon PM 01:37:09 CDT
> > > > > To: “Windows System Software Devs Interest List”
> > > >
> > > > > Subject: [ntdev] RE: CREATE/CLOSE Dispatch routines
> > > > >
> > > > > disk drivers very very rarely even get CREATE/CLOSE requests.

> > > > > Most
> > > > > attempts to open a disk go to the attached file system (or
> > > > cause the
> > > > > mount of one) and the CREATE (and subsequent close) are
> > > > swallowed by
> > > > > the file system rather than being passed through. The only
> > > > case where
> > > > > you would get a create is a so-called “direct device open”
> > > > which is an
> > > > > attempt to open the device itself rather than a directory on
> > > > > the device for effectively no possible access. In this event
> > > > you should
> > > > > send the request down to the lower drivers in the stack
> > > > since you’re a
> > > > > filter.
> > > > >
> > > > > -p
> > > > >
> > > > >
> > > > > -----Original Message-----
> > > > > From: xxxxx@lists.osr.com
> > > > > [mailto:xxxxx@lists.osr.com] On Behalf Of
> > > > > xxxxx@verizon.net
> > > > > Sent: Monday, October 20, 2003 10:51 AM
> > > > > To: Windows System Software Devs Interest List
> > > > > Subject: [ntdev] CREATE/CLOSE Dispatch routines
> > > > >
> > > > > Hi all,
> > > > >
> > > > > I am writing a disk filter driver. My driver will be the
> > > > top driver on
> > > > > the stack. My question is, do I complete the IRP_MJ_CREATE and

> > > > > IRP_MJ_CLOSE or, do I pass it down to the lower driver?
> > It is not
> > > > > really clear in the DDK.
> > > > >
> > > > > Thanks
> > > > >
> > > > > Peter
> > > > >
> > > > >
> > > > >
> > > > > —
> > > > > Questions? First check the Kernel Driver FAQ at
> > > > > http://www.osronline.com/article.cfm?id=256
> > > > >
> > > > > You are currently subscribed to ntdev as:
> > xxxxx@microsoft.com
> > > > > To
> > > > > unsubscribe send a blank email to
> > xxxxx@lists.osr.com
> > > > >
> > > > > —
> > > > > Questions? First check the Kernel Driver FAQ at
> > > > > http://www.osronline.com/article.cfm?id=256
> > > > >
> > > > > You are currently subscribed to ntdev as:
> > > > xxxxx@verizon.net To
> > > > > unsubscribe send a blank email to
> > xxxxx@lists.osr.com
> > > > >
> > > >
> > > >
> > > >
> > > > —
> > > > Questions? First check the Kernel Driver FAQ at
> > > http://www.osronline.com/article.cfm?id=256
> > >
> > > You are currently subscribed to ntdev as: xxxxx@stratus.com
> > > To unsubscribe send a blank email to
> > > xxxxx@lists.osr.com
> > >
> > > —
> > > Questions? First check the Kernel Driver FAQ at
> > > http://www.osronline.com/article.cfm?id=256
> > >
> > > You are currently subscribed to ntdev as:
> > xxxxx@verizon.net To
> > > unsubscribe send a blank email to xxxxx@lists.osr.com
> > >
> >
> >
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@stratus.com To
> unsubscribe send a blank email to xxxxx@lists.osr.com
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@verizon.net To
> unsubscribe send a blank email to xxxxx@lists.osr.com
>

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@microsoft.com To
unsubscribe send a blank email to xxxxx@lists.osr.com