NDIS Filter / domain computer / RDP session

Hi!

Sounds crazy, but I think there’s a situation where user-mode threads won’t
be served by the scheduler in a special moment: I have a NDIS filter driver,
that schedules packets from kernel- to user-mode and vice versa. The problem
comes up if the following things come together:

  • the computer is linked to a windows server domain
  • I am trying to connect the computer from a remote machine via RDP

When I log onto the computer, the NDIS filter signals the user-mode service,
but the user-mode service won’t wake-up…seems like the whole machine
hangs. It’s no deadlock…after a while the RDP-session terminates and the
machine runs normal again.

OS is WinXP. I am curious if someone encountered something similar.

Thanks in advance
Frank Friemel

I’ve run across similar problems in the realm of RDP but mostly in
conjunction with SMB or virutal machines. Are you by chance running
in a VM-related environment?

I assume you have a thread from the user-mode app de-queuing packets?
What’s it doing during the hang?

!process 0 7 can be useful.

How are you doing your packet scheduling? I’d really recommend
following the inverted call model (pend a bunch of IRPs in a CSQ and
complete them as you have data). There are some difficult-to-control
cases if you’re waiting on events in the kernel.

-sd

On Jun 11, 2007, at 9:38 AM, frank wrote:

Hi!

Sounds crazy, but I think there’s a situation where user-mode
threads won’t
be served by the scheduler in a special moment: I have a NDIS
filter driver,
that schedules packets from kernel- to user-mode and vice versa.
The problem
comes up if the following things come together:

  • the computer is linked to a windows server domain
  • I am trying to connect the computer from a remote machine via RDP

When I log onto the computer, the NDIS filter signals the user-mode
service,
but the user-mode service won’t wake-up…seems like the whole machine
hangs. It’s no deadlock…after a while the RDP-session terminates
and the
machine runs normal again.

OS is WinXP. I am curious if someone encountered something similar.

Thanks in advance
Frank Friemel


Questions? First check the Kernel Driver FAQ at http://
www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Thank you, Steve.

I am testing on VMWare, but customer report came from a real machine. Funny
thing is, that problem doesn’t show up, if computer is just part of a
workgroup instead of a domain.

I tried !process 0 7 and searched output for “running”, which hasn’t matched
(is it possible?). Didn’t find a thread stucking inside my driver as well.
!locks showed nothing suspicious.

Currently I’m using an event to signal the user-mode service, but I will try
and implement an inverted call.

Thanks again
Frank

“Steve Dispensa” schrieb im Newsbeitrag
news:xxxxx@ntdev…
> I’ve run across similar problems in the realm of RDP but mostly in
> conjunction with SMB or virutal machines. Are you by chance running in a
> VM-related environment?
>
> I assume you have a thread from the user-mode app de-queuing packets?
> What’s it doing during the hang?
>
> !process 0 7 can be useful.
>
> How are you doing your packet scheduling? I’d really recommend following
> the inverted call model (pend a bunch of IRPs in a CSQ and complete them
> as you have data). There are some difficult-to-control cases if you’re
> waiting on events in the kernel.
>
>
> -sd
>
> On Jun 11, 2007, at 9:38 AM, frank wrote:
>
>> Hi!
>>
>> Sounds crazy, but I think there’s a situation where user-mode threads
>> won’t
>> be served by the scheduler in a special moment: I have a NDIS filter
>> driver,
>> that schedules packets from kernel- to user-mode and vice versa. The
>> problem
>> comes up if the following things come together:
>>
>> - the computer is linked to a windows server domain
>> - I am trying to connect the computer from a remote machine via RDP
>>
>> When I log onto the computer, the NDIS filter signals the user-mode
>> service,
>> but the user-mode service won’t wake-up…seems like the whole machine
>> hangs. It’s no deadlock…after a while the RDP-session terminates and
>> the
>> machine runs normal again.
>>
>> OS is WinXP. I am curious if someone encountered something similar.
>>
>> Thanks in advance
>> Frank Friemel
>>
>>
>>
>> —
>> Questions? First check the Kernel Driver FAQ at http://
>> www.osronline.com/article.cfm?id=256
>>
>> To unsubscribe, visit the List Server section of OSR Online at
>> http://www.osronline.com/page.cfm?name=ListServer
>
>

Does your user mode thread that does processing of packets make any
NtUser/NtGdi (e.g. user32/gdi32) calls? In the case of an RDP session, some
of these calls will actually end up blocking on the network, which can lead
to apparent mysterious deadlocks if your thread is in the packet path for
RDP packets for the current RDP session, if the thread is on that session.

e.g. your thread makes NtUser call, NtUser does a network request to the
remote RDP client, that ends up in your filter and ends up waiting for your
thread to pick it up and process it.

I’ve seen this if you have a VMware VM routing traffic for an XP box and RDP
into the console of that XP box, where a critical thread in the vmware-vmx
process executing the VM doing routing for the RDP traffic gets blocked in
NtUser as part of its message loop, with NtUser waiting on a network call
that requires the blocked thread to resume execution so the VM processing
the packets can run. This is not really a VMware specific problem, so it
might apply to you if you make calls to win32k.sys from a packet path
thread. Just a thought.


Ken Johnson (Skywing)
Windows SDK MVP
http://www.nynaeve.net
“frank” wrote in message news:xxxxx@ntdev…
> Thank you, Steve.
>
> I am testing on VMWare, but customer report came from a real machine.
> Funny thing is, that problem doesn’t show up, if computer is just part of
> a workgroup instead of a domain.
>
> I tried !process 0 7 and searched output for “running”, which hasn’t
> matched (is it possible?). Didn’t find a thread stucking inside my driver
> as well. !locks showed nothing suspicious.
>
> Currently I’m using an event to signal the user-mode service, but I will
> try and implement an inverted call.
>
> Thanks again
> Frank
>
>
> “Steve Dispensa” schrieb im Newsbeitrag
> news:xxxxx@ntdev…
>> I’ve run across similar problems in the realm of RDP but mostly in
>> conjunction with SMB or virutal machines. Are you by chance running in a
>> VM-related environment?
>>
>> I assume you have a thread from the user-mode app de-queuing packets?
>> What’s it doing during the hang?
>>
>> !process 0 7 can be useful.
>>
>> How are you doing your packet scheduling? I’d really recommend following
>> the inverted call model (pend a bunch of IRPs in a CSQ and complete them
>> as you have data). There are some difficult-to-control cases if you’re
>> waiting on events in the kernel.
>>
>>
>> -sd
>>
>> On Jun 11, 2007, at 9:38 AM, frank wrote:
>>
>>> Hi!
>>>
>>> Sounds crazy, but I think there’s a situation where user-mode threads
>>> won’t
>>> be served by the scheduler in a special moment: I have a NDIS filter
>>> driver,
>>> that schedules packets from kernel- to user-mode and vice versa. The
>>> problem
>>> comes up if the following things come together:
>>>
>>> - the computer is linked to a windows server domain
>>> - I am trying to connect the computer from a remote machine via RDP
>>>
>>> When I log onto the computer, the NDIS filter signals the user-mode
>>> service,
>>> but the user-mode service won’t wake-up…seems like the whole machine
>>> hangs. It’s no deadlock…after a while the RDP-session terminates and
>>> the
>>> machine runs normal again.
>>>
>>> OS is WinXP. I am curious if someone encountered something similar.
>>>
>>> Thanks in advance
>>> Frank Friemel
>>>
>>>
>>>
>>> —
>>> Questions? First check the Kernel Driver FAQ at http://
>>> www.osronline.com/article.cfm?id=256
>>>
>>> To unsubscribe, visit the List Server section of OSR Online at
>>> http://www.osronline.com/page.cfm?name=ListServer
>>
>>
>
>
>