Device Object Deletion

NTDEV
1

Hi

I have a very peculiar situation.

I opened my driver using symbolic link in a Win 32 Application. I put a
break point in my Win32 program after opening the driver. Then I when to
deivice manager and removed the driver. The unloading of the driver went
smoothly. I went back to my Win32 program , and continued to issue IOCTL
calls, and other calls like CloseHandle(). All these calls I received in my
driver program.

How I am still able to recive the calls from Win32 application, after
unloading the driver…?

Could anybody please explain this behaviour…? I want the answer, how this
is happening…!

Thanks,
San Wind

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

2

Hi ,
Although you found out that the driver unloaded
properly in reality it hasnt.Hence the Device object
is still there in the memory and henct the code is
still running.

This use to happen with me when i used to unload the
driver before closing down the user mode service with
which my driver was tightly coupled.The only way i
solved this was making it sure that the user mode
service was closed before the driver was unloaded.

I regret that i couldnt provide the exact answer to
your query but hope that it helps just in case you are
also using a user mode prg interacting with the
Driver.

– Harshal

Wind Wrote:

Hi

I have a very peculiar situation.

I opened my driver using symbolic link in a Win 32
Application. I put a
break point in my Win32 program after opening the
driver. Then I when to
deivice manager and removed the driver. The unloading
of the driver went
smoothly. I went back to my Win32 program , and
continued to issue IOCTL
calls, and other calls like CloseHandle(). All these
calls I received in my
driver program.

How I am still able to recive the calls from Win32
application, after
unloading the driver…?

Could anybody please explain this behaviour…? I want
the answer, how this
is happening…!

Thanks,
San Wind

Do You Yahoo!?
Make a great connection at Yahoo! Personals.
http://personals.yahoo.com

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

3

Hi

Small change in my earlier query. In the driver I am creating an additional
device object. Without attaching to the device stack. Win32 Application is
opening this secondary device object.

I have a very peculiar situation.

I opened my driver using symbolic link in a Win 32
Application. I put a
break point in my Win32 program after opening the
driver. Then I when to
deivice manager and removed the driver. The unloading
of the driver went
smoothly. I went back to my Win32 program , and
continued to issue IOCTL
calls, and other calls like CloseHandle(). All these
calls I received in my
driver program.

How I am still able to recive the calls from Win32
application, after
unloading the driver…?

Could anybody please explain this behaviour…? I want
the answer, how this
is happening…!

Thanks,
San Wind

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

4

Well my device manager has no option to ‘remove the driver’. It has an
uninstall button and a disable (device) button. I assume that you used the
uninstall button, right? These buttons actually work on device objects, not
drivers. If for example your driver has several FDOs then you have to
uninstall all of them in order to unload your driver.

I also have a hard time believing that your driver’s unload entry was
actually called. Did you put a breakpoint in this routine or use a debug
print to verify that you got to the unload? As far as I know you will NOT
get called at your unload routine as long as your driver has any open
references to any of its device objects, pnp or non-pnp inclusive. This is
an NT system, right? If we are talking about some windos9x-Me variant, all
bets are off.

The additional device object should not matter - the OS is checking that all
of the devices linked to your driver object have a zero reference count in
order to decide that unload should be called. In your case your open handle
from your application to your device will prevent unload from being invoked
when you uninstall the pnp device. However the uninstall (of the device, not
the driver!) should work just fine - perhaps that is your confusion?

-----Original Message-----
From: San Wind [mailto:xxxxx@hotpop.com]
Sent: Wednesday, October 24, 2001 12:23 AM
To: NT Developers Interest List
Subject: [ntdev] Device Object Deletion

Hi

Small change in my earlier query. In the driver I am creating an additional
device object. Without attaching to the device stack. Win32 Application is
opening this secondary device object. ________________________________ I
have a very peculiar situation.

I opened my driver using symbolic link in a Win 32
Application. I put a
break point in my Win32 program after opening the
driver. Then I when to
deivice manager and removed the driver. The unloading
of the driver went
smoothly. I went back to my Win32 program , and
continued to issue IOCTL
calls, and other calls like CloseHandle(). All these
calls I received in my
driver program.

How I am still able to recive the calls from Win32
application, after
unloading the driver…?

Could anybody please explain this behaviour…? I want
the answer, how this
is happening…!

Thanks,
San Wind

You are currently subscribed to ntdev as: xxxxx@stratus.com To
unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

5

I don’t think your driver is actually going to be unloaded as long as there
is a handle open to it (despite the visual indication you get from device
manager). So, until you close the handle or unplug it, I think it will
remain loaded.

Also, look at RegisterDeviceNotifcation.

Marc Reinig
System Solutions

-----Original Message-----

Small change in my earlier query. In the driver I am creating an additional
device object. Without attaching to the device stack. Win32 Application is
opening this secondary device object.

I have a very peculiar situation.

I opened my driver using symbolic link in a Win 32
Application. I put a
break point in my Win32 program after opening the
driver. Then I when to
deivice manager and removed the driver. The unloading
of the driver went
smoothly. I went back to my Win32 program , and
continued to issue IOCTL
calls, and other calls like CloseHandle(). All these
calls I received in my
driver program.

How I am still able to recive the calls from Win32
application, after
unloading the driver…?

Could anybody please explain this behaviour…? I want
the answer, how this
is happening…!

Thanks,
San Wind

You are currently subscribed to ntdev as: xxxxx@pacbell.net
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com

6

> Well my device manager has no option to ‘remove the driver’. It has an

uninstall button and a disable (device) button. I assume that you used the
uninstall button, right? These buttons actually work on device objects, not
drivers. If for example your driver has several FDOs then you have to
uninstall all of them in order to unload your driver.

A sample:

  • I have installed w2k on a machine with OHCI1394 card.
  • then I have removed the card.
  • nevertheless, w2k still loads 1394bus.sys and ohci1394.sys AT BOOT.

Max

You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com