windowsdriverwdkndisdriver-signing

HCK has 0 tests for our NDIS LWF? And HLK doesn't include NDIS Test 6.5 LWF Logo tests?


As cross signing is now deprecated, we are trying to pass the HCK and HLK test in order for our NDIS LWF to install on 7+ machines, and our LWF uses NDIS 6.0.

My questions are:

  1. When we select our driver in HCK, there are 0 tests available, even tho our LWF is clearly installed, Is this normal?

  2. When we run HLK 1607, there are only the two basic tests, which are the TDI and Hyper-V readiness test, but there is no NDIS 6.5 LWF Logo test. Do we only need to pass these two tests?

  3. Should we add the folder that contains our driver + its inf in the package tab, before creating the package? Or our driver automatically gets bundled in the hlkx file that gets generated?

Note that we are not using any playlist, although i am still not sure what's the deal with these playlists and whether or not we need to use a playlist or just use the default one?


Solution

  • Regarding the first couple questions, yes that sounds normal. We (the NDIS team at Microsoft) honestly don't know how to test an arbitrary NDIS LWF. LWFs can just do so many different things, that any generic test we could try to make would probably cause a false negative for some filter driver. For example, a test that verifies various types of network traffic pass through the LWF would likely fail on a firewall driver, whose very job is to drop suspicious traffic. And in many cases, LWFs do nothing at all until some 3rd party usermode application sets up some configuration for them. For example, a QoS filter probably operates in a no-op mode until some usermode application pushes down QoS policies; any generic test we build would just be exercising the no-op mode, and we'd completely miss the interesting part of the driver.

    So for now, you're largely on the honor system that you've implemented NDIS contract correctly and done your due diligence in testing its functionality.

    We reserve the right to add more tests in the future, of course, if it becomes clear that this would benefit our mutual customers.

    Note that Driver Verifier (DV) includes an "NDIS/WIFI" flag: if you enable that mode, NDIS will automatically verify many of its programming contracts. So if you're looking for some assurance that you've done things correctly, make sure you exercise your LWF's various scenarios with DV + NDIS/WIFI enabled. In general, DV gets a bit better with each OS release, so testing on the latest OS version will catch the most bugs, even if your LWF is targeted towards an older OS.

    As to your third question: I don't know. (Ironically, I don't have access to the driver submission pipeline myself, so I have never actually tried things from your point of view.)