ZwMapViewOfSection returns STATUS_CONFICTING_ADDRESS

[Salvatore Li Mandri]

I have a driver that uses ZwMapViewOfSection under NT4 to
expose some DMA memory (obtained from a 16 bits ISA card)
that is continually been updated via the AutoInitialize
mode of operation. The driver uses no interrupt.

In this environment it works fine

When I tried to move the driver in XP, I get
STATUS_CONFILICTING_ADDRESS (0xC0000018) when the User
application tries to access the buffer.
The DDK documentation does not list it as a possible
returned value...

Q1: Why I get this error when running in this O.S. mode ?
Q2: Should MmMapIoSpace be considered as a solution ?

Thanks on any help

[Sebastien Charles]

You have this error because you specify a virtual memory range that is
conflicting with an existing one for the process involved.
That is to say that you specify the BaseAddress parameter in
ZwMapViewOfSection so you want you mapping to begin at a given virtual
address. Unfortunately, Something else is mapped in the range (BaseAddress
/ ViewSize) you specify.
You can see that with the kernel debugger:
- issue a !process command for the process in which you want to have the
mapping.
- Locate the VadRoot value and issue a !vad <VadRoot>

You will then see the user-space virtual address ranges that are in use.

To workaround that, let the system determine the BaseAddress by specifying
BaseAddress = NULL.

Thanks,
Sebastien

This posting is provided "AS IS" with no warranties, and confers no rights.

[Eliyas Yakub]

> Q1: Why I get this error when running in this O.S. mode ?

This is a known issue. I bet your driver is mapping \Device\PhysicalMemory
using ZwMapViewOfSection, and specifying PAGE_NOCACHE as one of the
Protection flag.

It is strictly illegal to map a physical address concurrently with 2
different attributes (ie: cached vs noncached vs writecombined). Doing this
causes processor TB corruption and unpredictable results. The DDK recommends
that drivers should set only PAGE_READWRITE. Some people found these flags
themselves in the header file and started using it.

Unfortunately NT4 & Win2K never checked for this but XP returns
STATUS_CONFLICTING_ADDRESSES error when you call ZwMapViewofSection.

In general MapViewOfSection using \Device\PhysicalMemory is very dangerous
unless you already "own" the physical pages. A driver that maps pages they
don't own is almost guaranteed to cause this corruption because the owner
can change the page attributes, free the pages, etc, etc. Drivers should
only map memory they own.

I made an announcement few months ago on another newsgroup on this issue.
Here is the link
http://groups.google.com/groups?q=eliyas+ZwMapViewofSection&hl=en&lr=&ie=UTF
-8&selm=3b572efc%241%40news.microsoft.com&rnum=2.

> Q2: Should MmMapIoSpace be considered as a solution ?

Yes.

-Eliyas

"Salvatore Li Mandri" <Salva...@hi-techeng.com> wrote in message
news:1302101c21de1$c82c9fd0$3aef2ecf@TKMSFTNGXA09...

[Doug Haigh]

If I want to allocate a locked down physically contiguous buffer and provide a virtual address to a user process, what is the recommended way of doing that? Can I use ZwMapViewOfSection since I allocated the memory?

Doug

"Eliyas Yakub" <eli...@microsoft.com> wrote in message news:eTDY##fHCHA.864@tkmsftngp04...

[Eliyas Yakub]

No you can't use ZwMapViewOfSection . There is no secure way of mapping
contiguous memory to usermode. Click on the following link and read the
thread:

http://groups.google.com/groups?q=Eliyas+Paged+Pool+mapping&hl=en&lr=&ie=UTF
-8&selm=%23rNrzODACHA.1340%40tkmsftngp02&rnum=2

The issue discussed in the above thread applies to physically contiguous
memory (MmAllocateContiguousMemory) also. If the mapped view is duplicated
by malicious apps, your driver has no way of knowing it.

So to have a good night sleep, you either have the apps give you the buffer
to DMA the data in or out (scatter/gather), or have your driver copy the
data from the kernelmode physically contiguous buffer to the locked down
user buffer.

If you are mapping adapter RAM then you don't have to worry about any of
this. It's your device memory and you can map that any way you want. The
memory manager doesn't reallocate adapter memory to anybody or use that for
its own paging purposes.

Refer: http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q189327

--
-Eliyas

This posting is provided "AS IS" with no warranties, and confers no rights.

http://www.microsoft.com/hwdev/driver/KB-drv.asp

"Doug Haigh" <dha...@junk.com> wrote in message
news:TDJS8.6215$GF4.2...@twister.southeast.rr.com...

[Doug Haigh]

Thanks Eliyas.

"Eliyas Yakub" <eli...@microsoft.com> wrote in message news:ez2d7BxHCHA.2576@tkmsftngp04...