STATUS_DEVICE_CONFIGURATION_ERROR in ClsUpper filter

Hello,

I am trying to write a class upper filter based on the toaster
filter sample.
However, when even the base code filter (unchanged toaster
filter sample) is set as the class upper filter for certain WP devices
or Korean Galaxy line devices, the device cannot start, and I see that
the IRP_MN_START_DEVICE handler receives
STATUS_DEVICE_CONFIGURATION_ERROR in the IoCallDriver call. European
Galaxy line models work fine, it is only the Korean ones that have the
error (the WP phone is a European model, Samsung brand, OS is 7.5).

This is my first dive into hardware filters, so I have no clue
where to look even. All advises are appreciated.


Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.

Phones are user mode wpd device stacks. Adding a km class upper filter is asking for a lot of pain mixing and matching um and km in this way

d

Bent from my phone


From: Dejan Maksimovicmailto:xxxxx
Sent: ?11/?18/?2013 5:17 AM
To: Windows System Software Devs Interest Listmailto:xxxxx
Subject: [ntdev] STATUS_DEVICE_CONFIGURATION_ERROR in ClsUpper filter

Hello,

I am trying to write a class upper filter based on the toaster
filter sample.
However, when even the base code filter (unchanged toaster
filter sample) is set as the class upper filter for certain WP devices
or Korean Galaxy line devices, the device cannot start, and I see that
the IRP_MN_START_DEVICE handler receives
STATUS_DEVICE_CONFIGURATION_ERROR in the IoCallDriver call. European
Galaxy line models work fine, it is only the Korean ones that have the
error (the WP phone is a European model, Samsung brand, OS is 7.5).

This is my first dive into hardware filters, so I have no clue
where to look even. All advises are appreciated.


Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</mailto:xxxxx></mailto:xxxxx>

What is the proper way to filter WPD devices then?
Why does a simple filter attaching to them make a problem? It seems
like a big hiccup of the stack.

Doron Holan wrote:

Phones are user mode wpd device stacks. Adding a km class upper filter
is asking for a lot of pain mixing and matching um and km in this way

d

Bent from my phone


From: Dejan Maksimovicmailto:xxxxx
> Sent: ý11/ý18/ý2013 5:17 AM
> To: Windows System Software Devs Interest
> Listmailto:xxxxx
> Subject: [ntdev] STATUS_DEVICE_CONFIGURATION_ERROR in ClsUpper filter
>
>
> Hello,
>
> I am trying to write a class upper filter based on the toaster
>
> filter sample.
> However, when even the base code filter (unchanged toaster
> filter sample) is set as the class upper filter for certain WP devices
>
> or Korean Galaxy line devices, the device cannot start, and I see that
>
> the IRP_MN_START_DEVICE handler receives
> STATUS_DEVICE_CONFIGURATION_ERROR in the IoCallDriver call. European
> Galaxy line models work fine, it is only the Korean ones that have the
>
> error (the WP phone is a European model, Samsung brand, OS is 7.5).
>
>
> This is my first dive into hardware filters, so I have no clue
>
> where to look even. All advises are appreciated.


Kind regards, Dejan (MSN support: xxxxx@alfasp.com)
http://www.alfasp.com
File system audit, security and encryption kits.</mailto:xxxxx></mailto:xxxxx>

Dejan Maksimovic wrote:

What is the proper way to filter WPD devices then?

What do you think you’re going to be filtering? Do you know what
requests the WPD stack will be receiving?

You should be able to place a UMDF filter above a UMDF driver.

Why does a simple filter attaching to them make a problem? It seems
like a big hiccup of the stack.

You’re asking an awful lot. User/kernel transitions are expensive.
Consider a single request coming from a user-mode app. It would have to
make user/kernel transition to go into your filter, then a kernel/user
transition and a context-switch to fire up the UMDF process to handle
the function, then another user/kernel transition to go back to kernel
mode for the rest of the stack. Then, we have to undo that on the way back.


Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

>> What is the proper way to filter WPD devices then?

What do you think you’re going to be filtering? Do you know what
requests the WPD stack will be receiving?
I am not sure if the UM WPD stack receives the same requests as the
KM. I know which ones to check for in a KM filters (for cases where it
works :))

You’re asking an awful lot. User/kernel transitions are expensive.
Consider a single request coming from a user-mode app. It would have to
make user/kernel transition to go into your filter, then a kernel/user
transition and a context-switch to fire up the UMDF process to handle
the function, then another user/kernel transition to go back to kernel
mode for the rest of the stack. Then, we have to undo that on the way back.
That would explain if the requests are slower than usual, but not why
the IRP_MN_START_DEVICE’s IoCallDriver pass fails. (or why the device
seems mosconfigured at that point)

And, just a check:
http://stackoverflow.com/questions/14359871/umdf-filter-driver-for-mtp-devices
Can a UMDF filter be installed as a third party filter, or is the
above link correct in the opposite assumption?
Kind regards, Dejan.

On Mon, Nov 18, 2013 at 7:08 PM, Tim Roberts wrote:
> Dejan Maksimovic wrote:
>> What is the proper way to filter WPD devices then?
>
> What do you think you’re going to be filtering? Do you know what
> requests the WPD stack will be receiving?
>
> You should be able to place a UMDF filter above a UMDF driver.
>
>
>> Why does a simple filter attaching to them make a problem? It seems
>> like a big hiccup of the stack.
>
> You’re asking an awful lot. User/kernel transitions are expensive.
> Consider a single request coming from a user-mode app. It would have to
> make user/kernel transition to go into your filter, then a kernel/user
> transition and a context-switch to fire up the UMDF process to handle
> the function, then another user/kernel transition to go back to kernel
> mode for the rest of the stack. Then, we have to undo that on the way back.
>
> –
> Tim Roberts, xxxxx@probo.com
> Providenza & Boekelheide, Inc.
>
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev
>
> OSR is HIRING!! See http://www.osr.com/careers
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Dejan Maksimovic wrote:

And, just a check:
http://stackoverflow.com/questions/14359871/umdf-filter-driver-for-mtp-devices
Can a UMDF filter be installed as a third party filter, or is the
above link correct in the opposite assumption?

I don’t think you should generalize a rule from one example. It’s not
clear to me whether this is a functionality problem, or if it is just a
case of this person not getting their INF right. It’s a complicated
INF, drawing sections from a number of standard INFs. Have you tried
doing registry hacking to install this by hand to see if it works?


Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

I have not tried to do a UMDF filter yet; still trying to figure why
the toaster filter would sometimes cause the error.
I installed it via Filter Manager, not via INFs.
Kind regards, Dejan.

On Tue, Nov 19, 2013 at 6:09 PM, Tim Roberts wrote:
> Dejan Maksimovic wrote:
>> And, just a check:
>> http://stackoverflow.com/questions/14359871/umdf-filter-driver-for-mtp-devices
>> Can a UMDF filter be installed as a third party filter, or is the
>> above link correct in the opposite assumption?
>
> I don’t think you should generalize a rule from one example. It’s not
> clear to me whether this is a functionality problem, or if it is just a
> case of this person not getting their INF right. It’s a complicated
> INF, drawing sections from a number of standard INFs. Have you tried
> doing registry hacking to install this by hand to see if it works?
>
> –
> Tim Roberts, xxxxx@probo.com
> Providenza & Boekelheide, Inc.
>
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev
>
> OSR is HIRING!! See http://www.osr.com/careers
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer