opaque _NDIS_MINIPORT_BLOCK?

Hi Dear All,
I’m debuging a miniport dirver , found it seems _NDIS_MINIPORT_BLOCK
is not opaque to driver , because I can found a call like this

dc21x4!ProcessReceiveDescRing+0x2ae:
f9b9d958 ff90e8000000 call dword ptr [eax+0E8h]
ds:0023:8166b218={NDIS!ethFilterDprIndicateReceivePacket (f98d4a21)}

eax here is a pointer to _NDIS_MINIPORT_BLOCK, following is the stack trace

f9e67f94 f9b9d17b 81613f34 804e5a25 8166b130 dc21x4!ProcessReceiveDescRing+0x2ae
f9e67fb4 f98ce6a5 00000040 81645948 81645bac dc21x4!DC21X4HandleInterrupt+0xe7
f9e67fd0 804dcbd4 8161301c 81613008 00000000 NDIS!ndisMDpc+0xff
f9e67ff4 804dc89e f60ded54 00000000 00000000 nt!KiRetireDpcList+0x46
f9e67ff8 f60ded54 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2a
WARNING: Frame IP not in any known module. Following frames may be wrong.
804dc89e 00000000 00000009 bb835675 00000128 0xf60ded54

I guess NDIS has inlined some library call . Is it possible ? Could
anyone explain this for me ? Many thanks

> I guess NDIS has inlined some library call . Is it possible ?

Yes.


Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

Look in NDIS.H.

Good Luck,
Dave Cattley

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of yushang
Sent: Thursday, July 08, 2010 7:37 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] opaque _NDIS_MINIPORT_BLOCK?

Hi Dear All,
I’m debuging a miniport dirver , found it seems _NDIS_MINIPORT_BLOCK
is not opaque to driver , because I can found a call like this

dc21x4!ProcessReceiveDescRing+0x2ae:
f9b9d958 ff90e8000000 call dword ptr [eax+0E8h]
ds:0023:8166b218={NDIS!ethFilterDprIndicateReceivePacket (f98d4a21)}

eax here is a pointer to _NDIS_MINIPORT_BLOCK, following is the stack trace

f9e67f94 f9b9d17b 81613f34 804e5a25 8166b130 dc21x4!ProcessReceiveDescRing+0x2ae
f9e67fb4 f98ce6a5 00000040 81645948 81645bac dc21x4!DC21X4HandleInterrupt+0xe7
f9e67fd0 804dcbd4 8161301c 81613008 00000000 NDIS!ndisMDpc+0xff
f9e67ff4 804dc89e f60ded54 00000000 00000000 nt!KiRetireDpcList+0x46
f9e67ff8 f60ded54 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2a
WARNING: Frame IP not in any known module. Following frames may be wrong.
804dc89e 00000000 00000009 bb835675 00000128 0xf60ded54

I guess NDIS has inlined some library call . Is it possible ? Could
anyone explain this for me ? Many thanks


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Look what?

2010/7/8 David R. Cattley :
> Look in NDIS.H.

yushang wrote:

Hi Dear All,
I’m debuging a miniport dirver , found it seems _NDIS_MINIPORT_BLOCK
is not opaque to driver , because I can found a call like this

NDIS_MINIPORT_BLOCK is not opaque. The structure definition present in
ndis.h, plain as day.

I guess NDIS has inlined some library call . Is it possible ? Could
anyone explain this for me ?

Explain what?


Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

My fault. many thanks

2010/7/9 Tim Roberts :
> yushang wrote:
>> Hi Dear All,
>> I’m debuging a miniport dirver , found it seems _NDIS_MINIPORT_BLOCK
>> is not opaque to driver , because I can found a call like this
>
> NDIS_MINIPORT_BLOCK is not opaque. The structure definition present in
> ndis.h, plain as day.
>
>> I guess NDIS has inlined some library call . Is it possible ? Could
>> anyone explain this for me ?
>
> Explain what?
>
> –
> Tim Roberts, xxxxx@probo.com
> Providenza & Boekelheide, Inc.
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
>

“Tim Roberts” wrote in message news:xxxxx@ntdev…
> yushang wrote:
>> Hi Dear All,
>> I’m debuging a miniport dirver , found it seems _NDIS_MINIPORT_BLOCK
>> is not opaque to driver , because I can found a call like this
>
> NDIS_MINIPORT_BLOCK is not opaque. The structure definition present in
> ndis.h, plain as day.
>

Internally ndis.sys may use its own structure, not same as in the public
ndis.h.
At least, some parts of it.

–pa

To expand on what Pavel said – NDIS does indeed use a different miniport block internally. (This is intentional). The upshot is that you must never reach into the miniport block directly, since looking at NDIS.H doesn’t tell you how the NDIS.SYS implementation sees those fields. Instead, use documented macros (like NdisMEthIndicateReceive) and pretend that NDIS_MINIPORT_BLOCK doesn’t exist. Or better yet, move to NDIS6 and the NDIS_MINIPORT_BLOCK will be gone; all macros are replaced with proper exported functions.

I am harping on this issue because some of us just recently spent a lot of time diagnosing a 3rd party product that decided to take the liberty of reaching directly into (the non-ABI portion of) NDIS’s miniport block and twiddling some of the data there. The 3rd party component causes NDIS to bugcheck in Win7 SP1, and we naturally get to clean up that mess…

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Pavel A.
Sent: Thursday, July 08, 2010 8:38 PM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] opaque _NDIS_MINIPORT_BLOCK?

“Tim Roberts” wrote in message news:xxxxx@ntdev…
> yushang wrote:
>> Hi Dear All,
>> I’m debuging a miniport dirver , found it seems _NDIS_MINIPORT_BLOCK
>> is not opaque to driver , because I can found a call like this
>
> NDIS_MINIPORT_BLOCK is not opaque. The structure definition present
> in ndis.h, plain as day.
>

Internally ndis.sys may use its own structure, not same as in the public ndis.h.
At least, some parts of it.

–pa


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer