PassThru Sample: Does it work at all on Windows Server 2008?

NTDEV
1

Hi,

We have a driver based upon the PassThru sample and some parts of Thomas Divine’s passthru extended example. Our driver works fine on both 32 bit and 64 bit Windows Server 2003. It works fine on both real machines and guests on VMWare Server. However, when we try to load this driver on Windows Server 2008, it installs but it destroys all network connectivity.

To try to simply things, I went back and built and tried to install the PassThru sample from the DDK. I see exactly the same behavior. I have seen this on multiple machines as well. This leads me to the basic question: Does the PassThru sample driver work out of the box on Windows Server 2008.

It is entirely possible that I am misconfigured or I have somehow failed to set the environment up correctly. But am I missing something basic here. I read about some of the changes for NDIS 6, but isn’t PassThru still a 5.1 NDIS driver.
i.e. from sources:

!if “$(DDK_TARGET_OS)”==“Win2K”

The driver is built in the Win2K build environment

C_DEFINES=$(C_DEFINES) -DNDIS40_MINIPORT=1
C_DEFINES=$(C_DEFINES) -DNDIS40=1
!else

The driver is built in the XP or .NET build environment

So let us build NDIS 5.1 version.

C_DEFINES=$(C_DEFINES) -DNDIS51_MINIPORT=1
C_DEFINES=$(C_DEFINES) -DNDIS51=1
!endif

This is still supported on Windows Server 2008 ( and Server 2008 R2? ) isn’t it?

Thanks in advance,

Dave

2

What specifically do you mean by “destroys all network connectivity”?

Did you sign your driver or do you even know that it is loading?

Presumably you have some ability to determine if packets are being presented
to either edge of your IM driver - are they?

Does your driver work in Vista? Vista SP1? Vista SP2?

What version of Server 2008 are we talking about here?

Does this behavior occur with different NICs?

Good Luck,
Dave Cattley
Consulting Engineer
Systems Software Development

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@comcast.net
Sent: Wednesday, May 27, 2009 8:19 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] PassThru Sample: Does it work at all on Windows Server
2008?

Hi,

We have a driver based upon the PassThru sample and some parts of Thomas
Divine’s passthru extended example. Our driver works fine on both 32 bit and
64 bit Windows Server 2003. It works fine on both real machines and guests
on VMWare Server. However, when we try to load this driver on Windows Server
2008, it installs but it destroys all network connectivity.

To try to simply things, I went back and built and tried to install the
PassThru sample from the DDK. I see exactly the same behavior. I have seen
this on multiple machines as well. This leads me to the basic question: Does
the PassThru sample driver work out of the box on Windows Server 2008.

It is entirely possible that I am misconfigured or I have somehow failed to
set the environment up correctly. But am I missing something basic here. I
read about some of the changes for NDIS 6, but isn’t PassThru still a 5.1
NDIS driver.
i.e. from sources:

!if “$(DDK_TARGET_OS)”==“Win2K”

The driver is built in the Win2K build environment

C_DEFINES=$(C_DEFINES) -DNDIS40_MINIPORT=1
C_DEFINES=$(C_DEFINES) -DNDIS40=1
!else

The driver is built in the XP or .NET build environment

So let us build NDIS 5.1 version.

C_DEFINES=$(C_DEFINES) -DNDIS51_MINIPORT=1
C_DEFINES=$(C_DEFINES) -DNDIS51=1
!endif

This is still supported on Windows Server 2008 ( and Server 2008 R2? ) isn’t
it?

Thanks in advance,

Dave

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

3

>What specifically do you mean by “destroys all network connectivity”?
Specifically, the physical adapter disappears.
Before:
C:\Windows>ipconfig

Windows IP Configuration

Ethernet adapter Local Area Connection 2:

Connection-specific DNS Suffix . : davedev.[more]
IPv4 Address. . . . . . . . . . . : 192.168.106.29
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.106.1

Tunnel adapter Local Area Connection* 8:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter Local Area Connection* 9:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter Local Area Connection* 11:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : davedev.[more]

C:\Windows>

After installing/re-enabling PassThru

C:\Windows>ipconfig

Windows IP Configuration

Tunnel adapter Local Area Connection* 8:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter Local Area Connection* 9:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

C:\Windows>

The same thing happens for the PassThru Driver.

Did you sign your driver or do you even know that it is loading?
I do not sign it. Should I be self signing this driver? Must I self sign the passthru driver? This could be the whole problem. Should I follow the self-sign example?

Again, I get the exact same behavior out of the PassThru sample. Must it be signed as well? I assume if I can passthru to load, my driver will load as well.

I am guilty of literally following the directions passthru.htm in src\network\nsdis\passhtru:

On the desktop, right-click the My Network Places icon and choose Properties.

Right-click on the relevant Local Area Connection icon and choose Properties.

[Quote]Click Install, then Service, then Add, then Have Disk.

Browse to the drive/directory containing the files listed above. Click OK. This should show ?Passthru Driver? in a list of Network Services. Highlight this and click OK. This should install the Passthru driver.

Click OK or Yes each time the system prompts with a warning regarding installation of unsigned files. This is necessary because binaries generated via the DDK build environment are not signed.

Two .INF files are needed rather than one because Passthru is installed both as a protocol and a miniport.
[/Quote]

Presumably you have some ability to determine if packets are being presented
to either edge of your IM driver - are they?
No I don’t believe so. I don’t get any debug output from a checked version of my driver. I don’t hit any breakpoints.

Does your driver work in Vista? Vista SP1? Vista SP2?
It is a server based and I have not tried. We only run our application that uses this driver on a server. I can try on Vista if this would be instructive,
What version of Server 2008 are we talking about here?
Windows Server 2008 Enterprise Edition 64 bit running on VMWARE

Does this behavior occur with different NICs?
The platform is defined as above. If the problem is likely to be platform specific, I can try to acquire new hardware. It happens on multiple instances of this configuration.

Thanks for any and all input.

4

xxxxx@comcast.net wrote:

> Did you sign your driver or do you even know that it is loading?
>
I do not sign it. Should I be self signing this driver? Must I self sign the passthru driver? This could be the whole problem. Should I follow the self-sign example?
…

> What version of Server 2008 are we talking about here?
>
Windows Server 2008 Enterprise Edition 64 bit running on VMWARE

I’m surprised you haven’t encountered this before. *ALL* kernel-mode
drivers on 64-bit systems must be signed. Otherwise, they will not be
loaded. This is separate from the WHQL signature that causes a warning
at install time – KMCS is checked every time your driver loads. The
KMCS signature must use a code-signing certificate from a certificate
source that is on Microsoft’s KMCS approved list. You can temporarily
disable this requirement by hooking up a kernel debugger, or by using
the F8 option at boot time and choosing “Disable Driver Signature
Enforcement”.

http://www.microsoft.com/whdc/winlogo/drvsign/kmcs_walkthrough.mspx
http://www.microsoft.com/whdc/winlogo/drvsign/crosscert.mspx
http://msdn.microsoft.com/en-us/library/aa906338.aspx
http://msdn.microsoft.com/en-us/library/aa906239.aspx

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

5

If the server is using adapters with advanced NDIS 6 capabilities (E.g.,
Receive-Side Scaling or “Chimney” TCP Offload) then the NDIS 5 PassThru (as
well as NDIS 6 Lightweight Filters…) may very well interfere with network
operations.

I would expect that PassThru could operate successfully on “ordinary”
Ethernet adapters on Windows Server 2008.

Thomas F. Divine

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@comcast.net
Sent: Wednesday, May 27, 2009 9:58 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] PassThru Sample: Does it work at all on Windows Server
2008?

What specifically do you mean by “destroys all network connectivity”?
Specifically, the physical adapter disappears.
Before:
C:\Windows>ipconfig

Windows IP Configuration

Ethernet adapter Local Area Connection 2:

Connection-specific DNS Suffix . : davedev.[more]
IPv4 Address. . . . . . . . . . . : 192.168.106.29
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.106.1

Tunnel adapter Local Area Connection* 8:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter Local Area Connection* 9:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter Local Area Connection* 11:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : davedev.[more]

C:\Windows>

After installing/re-enabling PassThru

C:\Windows>ipconfig

Windows IP Configuration

Tunnel adapter Local Area Connection* 8:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter Local Area Connection* 9:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

C:\Windows>

The same thing happens for the PassThru Driver.

Did you sign your driver or do you even know that it is loading?
I do not sign it. Should I be self signing this driver? Must I self sign the
passthru driver? This could be the whole problem. Should I follow the
self-sign example?

Again, I get the exact same behavior out of the PassThru sample. Must it be
signed as well? I assume if I can passthru to load, my driver will load as
well.

I am guilty of literally following the directions passthru.htm in
src\network\nsdis\passhtru:

On the desktop, right-click the My Network Places icon and choose
Properties.

Right-click on the relevant Local Area Connection icon and choose
Properties.

[Quote]Click Install, then Service, then Add, then Have Disk.

Browse to the drive/directory containing the files listed above. Click OK.
This should show ?Passthru Driver? in a list of Network Services. Highlight
this and click OK. This should install the Passthru driver.

Click OK or Yes each time the system prompts with a warning regarding
installation of unsigned files. This is necessary because binaries generated
via the DDK build environment are not signed.

Two .INF files are needed rather than one because Passthru is installed both
as a protocol and a miniport.
[/Quote]

Presumably you have some ability to determine if packets are being
presented
to either edge of your IM driver - are they?
No I don’t believe so. I don’t get any debug output from a checked version
of my driver. I don’t hit any breakpoints.

Does your driver work in Vista? Vista SP1? Vista SP2?
It is a server based and I have not tried. We only run our application that
uses this driver on a server. I can try on Vista if this would be
instructive,
What version of Server 2008 are we talking about here?
Windows Server 2008 Enterprise Edition 64 bit running on VMWARE

Does this behavior occur with different NICs?
The platform is defined as above. If the problem is likely to be platform
specific, I can try to acquire new hardware. It happens on multiple
instances of this configuration.

Thanks for any and all input.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

6

In all likelihood your driver is just not loading because you have not:

  1. signed it.
  2. enabled test signing mode.
  3. attached a debugger before trying to load it.

NT6 x64 will not load your driver unless you test sign it or have a debugger
attached.

I suggest you spend some quality time on www.microsoft.com/whdc and read the
documents on signing drivers.

And attach a debugger to your target system - that ought to allow the
drivers to load and restore your faith in NDIS 5.x compatibility.

Good Luck,
Dave Cattley
Consulting Engineer
Systems Software Development