Developing Windows FileSystem Filter Driver: Question about IRP_MJ_CLEANUP & IRP_MJ_CLOSE RRS feed

  • Question

  • Hi,

    I am trying to port our file system built on Linux platform to Windows.

    The question I have is about the user-space function:

    BOOL CloseHandle( HANDLE )

    And where this BOOL result code comes from?

    For me, it is a bit unclear in the documentation.

    As I understand it; kernel-space IRP_MJ_CLEANUP is called by this CloseHandle() user-space function.

    But will the result code returned by kernel-space IRP_MJ_CLEANUP go all the way back to the user-space caller function CloseHandle() ?

    Or are there other ways to detect and report back status of a CloseHandle() function from the user-space caller, when a kernel-space close is failed.

    Or a way to signal the kernel-space Write() call that End-Of-File has been reached.

    Or a way to force a kernel-space Flush() call to happen at each user-space CloseHandle()

    In Linux for example:

    Just before a closure of a file ( Close( fd) ); a kernel-space Flush() API call is performed.

    And that kernel-space API will report back the status to the user-space Close() function.


    On Windows, there are no kernel-space Flush() call called before a kernel-space Cleanup() call.

    The sequences for a pure file copy looks like this:

    GetSecurityByName() -> Open() or Create() -> Write() -> ... -> Cleanup() -> Close()

    Friday, October 11, 2019 10:25 AM

All replies

  • How about IRP_MN_COMPLETE?

    Is that intended to be used when no more data is to be sent or received ?

    Can I map this to my function in someway, and if so, will the result code be returned back to the CloseHandle() call? or to the Write() call?

    Regards Tomas

    Wednesday, October 16, 2019 12:39 PM