3 Ndis miniport drivers

1) I am using Windows XP SP2. I see three ndis miniport drivers for
each adapter. One is the driver from NIC manafacturer, Packet scheduler
from Microsoft. These two drivers are on both PC and on laptop with
WiFi. But on laptop there is third mini port driver for each ethernet
adapter - Nortel IPSECSHM Adapter EacMiniport.

I can understand one miniport driver for an NIC adapter.

Can someone please explain why we have many miniport drivers. Will the
protocol driver talk only to the miniport driver of the manufacturer or
talks to all miniport drivers. I am trying to understand how the driver
stack would look like.

2) What drivers fall into 'Show hidden devices' category in device
manager.

Thanks,
Raj

Stephan
Thu Apr 13 14:27:40 CDT 2006

There is always exactly one NDIS miniport driver per NIC. The other
"miniports" that you see are actually NDIS filter intermediate (IM)
drivers.

Filter IMs are usually "invisible". They sit on top of an NDIS miniport
and wrap it completely such that other drivers that want to talk to the
original miniport now actually talk to the filter IM without even being
aware of this fact (i.e. they think they talk to the original
miniport).

Now if there is more than one Filter IM, they are stacked on top of
each other, again without being aware of this fact.

For instance:

NIC Miniport <-> Filter IM #1 <-> Filter IM #2 <-> Protocol(s) (e.g.
TCP/IP)

Stephan
---
r_konjeti@mailcity.com wrote:
> 1) I am using Windows XP SP2. I see three ndis miniport drivers for
> each adapter. One is the driver from NIC manafacturer, Packet scheduler
> from Microsoft. These two drivers are on both PC and on laptop with
> WiFi. But on laptop there is third mini port driver for each ethernet
> adapter - Nortel IPSECSHM Adapter EacMiniport.
>
> I can understand one miniport driver for an NIC adapter.
>
> Can someone please explain why we have many miniport drivers. Will the
> protocol driver talk only to the miniport driver of the manufacturer or
> talks to all miniport drivers. I am trying to understand how the driver
> stack would look like.
>
> 2) What drivers fall into 'Show hidden devices' category in device
> manager.
>
> Thanks,
> Raj

r_konjeti
Thu Apr 13 15:50:33 CDT 2006

Thanks for the reply.

When I was querying for WiFi RSSI through WMI, I see three instances of
same access point and its RSSI (one from each driver).

If these are filter drivers and they are stacked up as you described, I
would expect only one actual miniport driver to provide service to the
query. Because these are stacked up, I was thinking they should
transmit the IRP to the lower driver or they handle the request and
complete IRP.

I cant understand why my WMI query gets three replies from 3 instances.
I thought it was the responsibility of only actual miniport driver to
repond to OID.

Thanks,
Raj

Stephan Wolf [MVP] wrote:
> There is always exactly one NDIS miniport driver per NIC. The other
> "miniports" that you see are actually NDIS filter intermediate (IM)
> drivers.
>
> Filter IMs are usually "invisible". They sit on top of an NDIS miniport
> and wrap it completely such that other drivers that want to talk to the
> original miniport now actually talk to the filter IM without even being
> aware of this fact (i.e. they think they talk to the original
> miniport).
>
> Now if there is more than one Filter IM, they are stacked on top of
> each other, again without being aware of this fact.
>
> For instance:
>
> NIC Miniport <-> Filter IM #1 <-> Filter IM #2 <-> Protocol(s) (e.g.
> TCP/IP)
>
> Stephan
> ---
> r_konjeti@mailcity.com wrote:
> > 1) I am using Windows XP SP2. I see three ndis miniport drivers for
> > each adapter. One is the driver from NIC manafacturer, Packet scheduler
> > from Microsoft. These two drivers are on both PC and on laptop with
> > WiFi. But on laptop there is third mini port driver for each ethernet
> > adapter - Nortel IPSECSHM Adapter EacMiniport.
> >
> > I can understand one miniport driver for an NIC adapter.
> >
> > Can someone please explain why we have many miniport drivers. Will the
> > protocol driver talk only to the miniport driver of the manufacturer or
> > talks to all miniport drivers. I am trying to understand how the driver
> > stack would look like.
> >
> > 2) What drivers fall into 'Show hidden devices' category in device
> > manager.
> >
> > Thanks,
> > Raj

Stephan
Fri Apr 14 16:56:48 CDT 2006

You are talking about three different things here:

1. Each NDIS miniport driver must respond to various OID requests. Such
requests can only be initiated by NDIS protocol drivers via
NdisRequest(). The NDIS Wrapper then forwards the request to the
miniport's MiniportQueryInformation() or MiniportSetInformation() for
query and set requests, respectively.

The only exception to this rule is that applications can issue OID
queries (not sets) via IOCTL_NDIS_QUERY_GLOBAL_STATS.

For details see:

"How can I access my NDIS miniport driver from a user-mode
application?"
http://www.ndis.com/faq/QA10290101.htm

2. NDIS miniports can have their own IOCTL interface. The IOCTLs used
by this interface are of a completely private nature. Vendors usually
make use of IOCTLs to implement special, vendor-specific features in
their NDIS miniports.

3. The NDIS Wrapper exposes some information (i.e. OIDs) about each
miniport to WMI. Miniports can also expose custom OIDs (see
OID_GEN_SUPPORTED_GUIDS).

The real OID requests are actually going through the Filter IMs. But
usually they simply forward the requests to the miniport (or Filter)
below them without any intervention.

Not sure what WMI does here. It would seem it presents you the miniport
and the two Filter IMs as if they were all real miniports. Sure they
all return the same values for (probably) all OIDs. So is the case for
WLAN OIDs.

HTH, Stephan
---
r_konjeti@mailcity.com wrote:
> Thanks for the reply.
>
> When I was querying for WiFi RSSI through WMI, I see three instances of
> same access point and its RSSI (one from each driver).
>
> If these are filter drivers and they are stacked up as you described, I
> would expect only one actual miniport driver to provide service to the
> query. Because these are stacked up, I was thinking they should
> transmit the IRP to the lower driver or they handle the request and
> complete IRP.
>
> I cant understand why my WMI query gets three replies from 3 instances.
> I thought it was the responsibility of only actual miniport driver to
> repond to OID.
>
> Thanks,
> Raj