RES: Kernel filtering a UMDF driver?

NTDEV
1

AFAIK…One of pre-requisites to write UMDF driver is that an UMDF driver can never be under a Kernel-Mode driver (including KMDF drivers).

So it’d be necessary to write an upper filter driver using UMDF too.

–

Fernando Roberto da Silva

DriverEntry Kernel Development

http://www.driverentry.com.br

De: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] Em nome de Jason T.
Enviada em: ter?a-feira, 2 de outubro de 2007 13:08
Para: Windows System Software Devs Interest List
Assunto: [ntdev] Kernel filtering a UMDF driver?

Hello,

I have an existing WDM class filter driver that is used to block access (i.e. fail create, read, write, device control, etc.) to certain classes of devices. Ideally I would be able to leverage this same driver to block access to devices controlled by UMDF drivers. At first I thought I could just install the filter as an upper filter to WUDFRd.sys but I read on this list that this is not allowed. If filtering both WDM devices and UMDF devices is not possible with a WDM driver, can a single KMDF driver do it? I would prefer not to have two filters performing the same task if I can avoid it.

Thanks for reading.

— NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

2

Even though that’s not the answer I had hoped for I definitely appreciate
both of you responding quickly and definitively on this topic. You have
certainly saved me time in exploring various dead ends.

Thanks!

Peter Wieland wrote:

No - KMDF drivers are still kernel-mode drivers and we don’t currently
support a
KM driver on top of a UM one.

Sorry,
-p

3

Peter Wieland wrote:

No – KMDF drivers are still kernel-mode drivers and we don’t currently
support a KM driver on top of a UM one.

I thought UMDF participated in the KM driver stack via a proxy driver.
If that’s true, then there shouldn’t be any technical barriers to
arbitrary “stackage”; an IRP from an upper level driver would look
exactly like an IRP from a user-mode application. Do I misunderstand?

Note that I’m not intending any criticism here. I’m just trying to
update my “mental model”.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.