installation of KMDF filter driver causes issues

NTDEV
1

Hello,

I have a question regarding WDF installation process. I am trying to investigate a case where installation of a KMDF filter driver seems to have caused issues with the actual device and needed to be uninstalled from the user’s PC. I’ve got setupact.log and wdf1009Inst.log files from user’s PC. It is obvious that a reboot was required when this filter driver was installed because an older version of WDF was present. These are the final lines from setupact.log:

DIF_INSTALLDEVICE: Coinstaller version: 1.9.7600
DIF_INSTALLDEVICE: KMDF in-memory version: 1.7.6001
DIF_INSTALLDEVICE: KMDF on-disk version: 1.7.6001
Service Wdf01000 is running

DIF_INSTALLDEVICE: Reboot is required, because the in-memory KMDF version is older than the coinstaller’s version.
DIF_INSTALLDEVICE: Update is required, because the on-disk KMDF version is older than the coinstaller
VerifyMSRoot: exit: error(0) The operation completed successfully.

Invoking “C:\Windows\Temp\WdfTemp\Microsoft Kernel-Mode Driver Framework Install-v1.9-Win2k-WinXP-Win2k3.exe /quiet /norestart /o /ER”.
The package was installed successfully: error(0) The operation completed successfully.

InstallComponents: KMDF installed successfully
InstallComponents: Reboot needed by windows update
WdfPreDeviceInstall: Reboot required
WdfPreDeviceInstall: Installation completed but reboot required (ERROR_SUCCESS_REBOOT_REQUIRED)

I am not sure whether a reboot was performed but I can see some errors in Wdf01009Inst.log:

0.125: d:\1239ce919f2423798667c1\update\update.exe (version 6.3.15.0)
0.125: Hotfix started with following command line: /quiet /norestart /o /ER
0.125: In Function GetReleaseSet, line 1211, RegOpenKeyEx failed with error 0x2
0.125: In Function GetReleaseSet, line 1240, RegOpenKeyEx failed with error 0x2
0.141: C:\Windows\system32\DRIVERS\wdf01000.sys is Present
0.172: FileVersion of C:\Windows\system32\DRIVERS\wdf01000.sys is Less Or Equal To 1.9.9999.0
0.172: Second Condition in Prerequisite.FilecheckOrOp.Section Succeeded
0.172: Condition succeeded for section Prerequisite.FilecheckOrOp.Section in Line 1 of PreRequisite
0.812: In Function TestVolatileFlag, line 11825, RegOpenKeyEx failed with error 0x2
0.812: In Function TestVolatileFlag, line 11857, RegOpenKeyEx failed with error 0x2

…

4.047: Registering Uninstall Program for -> Wdf01009, Wdf01009 , 0x0
4.109: LoadFileQueues: UpdSpGetSourceFileLocation for halmacpi.dll failed: 0xe0000102
4.187: Copied file: C:\Windows\system32\spmsgXP_2k3.dll
4.562: PFE2: Not avoiding Per File Exceptions.
4.578: GetCatVersion: Failed to retrieve version information from C:\Windows\system32\CatRoot{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Wdf01009.cat with error 0x57
4.578: GetCatVersion: Failed to retrieve version information from C:\Windows\Wdf01009.cat with error 0x80092004
4.687: MyMakePerFileExceptionA: MakePerFileException failed; error=0x6ba.
4.750: Copied file: C:\Windows\system32\DRIVERS\wdfldr.sys
4.859: MyMakePerFileExceptionA: MakePerFileException failed; error=0x6ba.
4.906: Copied file: C:\Windows\system32\DRIVERS\wdf01000.sys
5.125: DoInstallation: Installing assemblies with source root path: d:\1239ce919f2423798667c1\
5.125: Num Ticks for Copying files : 1141
5.156: Num Ticks for Reg update and deleting 0 size files : 31

Lines like ?MakePerFileException failed; error=0x6ba? look suspicious. Does this mean something went wrong with the WDF installation and what exactly was that?

Overall it looks like our filter driver installation hasn’t finished successfully. Would you recommend how we could investigate this further?

PS By the way, do these numbers at the start of each line correspond to time offsets from the last date printed in wdf01009Inst.log?

Thank you!

2

It is obvious from setupact .log that your co-installer version doesn’t match with KMDF version.
Update your KMDF library.

Igor Sharovar

3

Hi Igor,

Sure, it is obvious, but this doesn’t require any additional actions from me or the user. WDF performs an automatic update in order to ensure that current KMDF version is up-to-date (http://msdn.microsoft.com/en-us/library/windows/hardware/ff540793(v=vs.85).aspx).
As you can see WDF implicitly invoked an installer that is embedded in the wdfcoinstaller1009.DLL that I’m providing along with the driver:

C:\Windows\Temp\WdfTemp\Microsoft Kernel-Mode Driver Framework
Install-v1.9-Win2k-WinXP-Win2k3.exe /quiet /norestart /o /ER

My question is actually about this installation process and how I can check what has gone wrong looking at the logs.

4

chider@bk.ru wrote:

I have a question regarding WDF installation process. I am trying to investigate a case where installation of a KMDF filter driver seems to have caused issues with the actual device and needed to be uninstalled from the user’s PC. …
…
I am not sure whether a reboot was performed but I can see some errors in Wdf01009Inst.log:

Except for the MakePerFileException lines, all of these errors are
ignorable. I have all of them in the Wdf01009Inst.log file on my XP box
as well, and the installation went just fine.

4.687: MyMakePerFileExceptionA: MakePerFileException failed; error=0x6ba.
4.750: Copied file: C:\Windows\system32\DRIVERS\wdfldr.sys
4.859: MyMakePerFileExceptionA: MakePerFileException failed; error=0x6ba.
4.906: Copied file: C:\Windows\system32\DRIVERS\wdf01000.sys

0x6ba would be RPC_S_SERVER_UNAVAILABLE. Is this a stock standard XP
system? It’s not XP Embedded?

Overall it looks like our filter driver installation hasn’t finished successfully. Would you recommend how we could investigate this further?

Why do you think that? Are the files in the right place? Do you get a
yellow bang?

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

5

I would verify if KMDF updated successfully.

Igor Sharovar

6

Thanks, Tim. I also did a comparison with internal installation logs and error=0x6ba was the only one that concerned me. So I wanted to get some insight what exactly this refers to. This was XP Embedded. I could not really confirm from the docs whether it has RPC service running and why WDF installation needs it.
The symptoms were: when our lower filter driver was installed target device stopped functioning. Uninstallation solved the problem. From internal logs I can see that the symlink associated with our driver could not be opened (Error 2: “File not found”). So it looks like the driver was not loaded correctly.

Igor, I want to try asking them to install again and see in the logs whether in-memory KMDF version changed as they claim a reboot was performed.

7

chider@bk.ru wrote:

Thanks, Tim. I also did a comparison with internal installation logs and error=0x6ba was the only one that concerned me. So I wanted to get some insight what exactly this refers to. This was XP Embedded. I could not really confirm from the docs whether it has RPC service running and why WDF installation needs it.

I, for one, do not know whether KMDF is supported on XP Embedded. One
of our Microsoft friends will have to address that.

One of the features of XP Embedded is that you have very fine-grained
control over the components that are are included. It’s possible that
XPE allows you to configure a system that will not support KMDF. I am,
however, making that up. I don’t know that to be the case.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

8

Thanks Tim. This is not an issue. XP Embedded doesn’t seem have WDF by default but it gets installed first time a driver relying on it is registered on the system.
In this particular case we can see 1.76 was already available when our driver was being installed:

DIF_INSTALLDEVICE: Coinstaller version: 1.9.7600 DIF_INSTALLDEVICE: KMDF in-memory version: 1.7.6001 DIF_INSTALLDEVICE: KMDF on-disk version: 1.7.6001 Service Wdf01000 is running

So the question is really about the upgrade process rather than about the availability of WDF.

9

Is the WU service disabled?

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of chider@bk.ru
Sent: Friday, August 30, 2013 9:37 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] installation of KMDF filter driver causes issues

Thanks Tim. This is not an issue. XP Embedded doesn’t seem have WDF by default but it gets installed first time a driver relying on it is registered on the system.
In this particular case we can see 1.76 was already available when our driver was being installed:

DIF_INSTALLDEVICE: Coinstaller version: 1.9.7600 DIF_INSTALLDEVICE: KMDF in-memory version: 1.7.6001 DIF_INSTALLDEVICE: KMDF on-disk version: 1.7.6001 Service Wdf01000 is running

So the question is really about the upgrade process rather than about the availability of WDF.

NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

10

Doron, I need to confirm this but most likely Windows Update service is disabled because it’s a constrained system with a limited set of functions used.
Would this somehow affect WDF upgrade process?

Thanks.

11

The wdf update process uses the windows packaging service (CBS) combined WU

d

Bent from my phone

From: chider@bk.rumailto:chider
Sent: ?8/?30/?2013 10:26 AM
To: Windows System Software Devs Interest Listmailto:xxxxx
Subject: RE:[ntdev] installation of KMDF filter driver causes issues

Doron, I need to confirm this but most likely Windows Update service is disabled because it’s a constrained system with a limited set of functions used.
Would this somehow affect WDF upgrade process?

Thanks.

—
NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</mailto:xxxxx></mailto:chider>

12

Thank you Doron. Would issues caused by disabling of these services be somehow reflected in the logs?
We’ve had no problems on very similar systems for a while (in fact, they are pretty much identical and with the same OS settings). So it seems that there’s something different in this specific case and I’m trying to find any traces of what this could be.