[vbox-dev] BSOD in Windows Guest after installing third party Upper Class Filter

[Julián de Navascués]

Hi all,

We are developing an Upper Class Filter driver that has been running
smoothly in several versions of Windows in both physical and virtual
machines*.  As a kernel developer, every time a I see a blue screen in a
machine with our drivers, I assume "our driver is guilty". After spending
some hours trying to find the problem... I am not so sure.

Let me focus on my last test to reduce the noise:

For testing purposes I have developed what I consider the simplest case of
an Upper Class Filter: a driver that has just two functions, the
DriverEntry and the AddDevice. In the AddDevice I do not attach to any
device... by just returning STATUS_SUCCESS. So basically the driver is
loaded with the rest of the stack but does not filter any I/O operation. It
should be transparent. I have both WDM and KMDF versions of this driver,
both of them are loaded giving the same result (bugcheck 0x7B).

In my VirtualBox enviroment (Win7 32 bits) It is working for all classes
except System class. For this class the driver is loaded, I can debug the
subsequent calls to AddDevice... but after two of them the kernel shows a
BSOD with bugcheck 0x7B.

Funny fact: the same filter installed for Disk class does not cause any
problems to the disk stack. The same filter driver installed at the same
time in all Windows device classes (except System class) does not crash the
system...

Is there any limitation for this in VirtualBox? Something that could be
related only to the System class devices?

Thanks a lot,

Julian

* the full version of the filter is working in Windows XP x86  (Phyiscal,
VMware,VirtualBox), Win 7 x86/x64 (physical, VMware), Windows Server 2012
x64 (physical, VMware).

PS: Does not look as a signing (signing enforcemente disabled on boot) or
dependency problem (WDF frameworks) as the driver is loaded and WDF is
loaded too. Also it happens with the WDM version.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.virtualbox.org/pipermail/vbox-dev/attachments/20180723/a00f6493/attachment.html>