DisplayLink overloads Windows Kernel

[jdelatorre]

Dear Alban,

I attach you our Platform people message, please tell me if it helps anyway, best regards:

“In our scenario, it is not possible to remove any layer from the system, as all of them are required to enforce security in our systems. The protector.sys file is part of Checker solution (from GMV), and it is in charge of monitoring security settings in the computer. It’s the interaction with this file what is causing issues when operating at the same time than your driver, as observed by our technicians. The issue appears when Checker is already installed in the Operating System and the DisplayLink Driver for the USB Lilliput UM-1010 is installed. At that moment, and during the installation, the system goes to BSoD.

If installed in a different order, this is, DisplayLink driver first and Checker software secondly, the BSoD occurs when the system is rebooted with the same Error Code than in the other scenario. We have already tested a lot of other drivers and software, in collaboration with GMV, and it seems it’s the DL driver what is causing the BSoD, and we contacted you so this could be clarified.

[AlbanRampon]

Good evening,
I am afraid I miss one part of the reasoning. How do we go from 1. to 2. ?

1a. The DisplayLink driver works on its own. This is what I had asked to test and even if it is not possible to remove any layer, it sounds like they did it anyway.
1b. The tool made especially to snoop on running processes works on its own.
1c. They don't work **together**.

2. Your conclusion is DL is responsible for the crash.

What is the result of the analysis of the crash dump with GMV debug symbols? What kind of function is called at the time of crash? Is there an explanation as to why there is an exception going through their driver? I don't have their symbols and we don't have the OS. They are higher in the call stack.

I believe testing a "lot of other drivers" is not relevant to fix the problem. I did not use the argument that we have millions of devices running in the field to refuse helping on an OS we don't support.

May I get the crash dumps with the full Windows 7 OS, access to that GMV software, so I can get an internal reproduction from our engineering team? As we have neither Windows POSReady, or this application monitoring processes, it won't be possible for them to progress this. Without repro, debugging is close to impossible.
Having access to what investigation and analysis GMV/you have done to reach these conclusions would also be helpful.
I recommend you use the email address I replied you on to provide these elements as I don't believe posting third party software on forums is appropriate. Also, GMV might not wish information about their monitoring application being posted publicly.

Kind regards,
Alban