Display mini port driver

NTDEV
1

I am working on display driver and video miniport driver.I am facing system crash which i explained below.

Display driver maps video frame buffer into system’s virtual address space by sending IOCTL_VIDEO_MAP_VIDEO_MEMORY to miniport driver.
Miniport driver gets frame buffer access range using VideoPortGetAccessRanges() function in its DrvFindAdapter callback function and then maps this frame buffer using VideoPortMapMemory()
function when display driver asks.

When frame buffer gets map into system virtual address space then while accessing it i am getting system crash with either of below mentioned bug check,
1.PAGE_FAULT_IN_NONPAGED_AREA(0x50)
2.ATTEMPTED_WRITE_TO_READONLY_MEMORY(0xBE)

Above both bug checks occur when display driver tries to access mapped virtual address or win32 driver tries to write to mapped virtual address. Can anyone please help me to
understand why this is happening as i am just mapping physical address which got from VideoPortGetAccessRanges() function?

I have below observations when i debugged in detail,

  1. When i get bug check 0x50, then i observed mapped virtual address and found that at the same virtual address “fileinfo” driver image was mapped as i saw PE header
    started from that address.

2.When i get bug check 0xBE, i used !pte extension with mapped virtual address and got below output,

kd> !pte 0xFFFFF88001001000 (Actual mapped virtual address was 0xFFFFF88001000000)
VA fffff88001001000
PXE at FFFFF6FB7DBEDF88 PPE at FFFFF6FB7DBF1000 PDE at FFFFF6FB7E200040 PTE at FFFFF6FC40008008
contains 000000001C5C4863 contains 000000001C5C3863 contains 0000000000BEA863 contains 0000000004888121
pfn 1c5c4 —DA–KWEV pfn 1c5c3 —DA–KWEV pfn bea —DA–KWEV pfn 4888 -G–A–KREV

From above output, if we observe page with pfn 4888 then it shows that its a read-only(-G–A–KREV). How this page could be read-only?

Please help me to understand why mapped virtual address looks invalid?

2

Send us !analyze -v output with correct symbol path then only someone may help you here.

./nT

3

Perhaps the code you are using would be helpful. All I can tell you is that
“I have code that does this”, and it works, but I can’t share it with you.
I can also tell you that your description of your code sounds “about
right”, so obviously it is the details that are wrong.

Mark Roddy

On Fri, May 20, 2016 at 5:02 AM, wrote:

> Send us !analyze -v output with correct symbol path then only someone may
> help you here.
>
> ./nT
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list online at: <
> http://www.osronline.com/showlists.cfm?list=ntdev&gt;
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer&gt;
></http:>