How to probe an address mapped by MmMapIoSpace

My driver is giving a bugcheck 0x50, which I’d like to avoid.

I think I know the root cause of the error (it’s misconfigured hardware) and
how to fix it (configure the hardware properly) but that isn’t the purpose
of my question: I’d like to be able to return a sensible error message, put
stuff in the event log etc., rather than blue screen.

The bugcheck occurs the first time I attempt to access the device memory at
the address returned by MmMapIoSpace.

The DDK says at the bottom of the discussion of bugcheck 0x50

“This cannot be protected by a try-except handler - it can only be protected
by a probe.”

I’ve looked at the 50 or so topics in the DDK brought up by a search for
“probe” but they either refer to the probing of user space memory, or use
the word in a context that obviously doesn’t apply.

So, temporarily disregarding the DDK (not usually a good idea), I wrote

BOOLEAN probe(PVOID addr, ULONG length)
{
PMDL probeMdl = IoAllocateMdl(addr, length, FALSE, FALSE, NULL);

if (probeMdl == NULL) return FALSE;

__try
{
__try
{
MmBuildMdlForNonPagedPool(probeMdl);
MmProbeAndLockPages(probeMdl, KernelMode, IoModifyAccess);
MmUnlockPages(probeMdl);
return TRUE;
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
return FALSE;
}
}
__finally
{
IoFreeMdl(probeMdl);
}
}

When I feed the routine with the (non NULL) address returned by
MmMapIoSpace, which in turn was supplied with the translated memory address
from the resource list in startdevice, I get two problems:

a) An assert fails in MmBuildMdlForNonPagedPool

*** Assertion failed: (MemoryDescriptorList->MdlFlags & ( MDL_PAGES_LOCKED |
MDL_MAPPED_TO_SYSTEM_VA | MDL_SOURCE_IS_NONPAGED_POOL | MDL_PARTIAL |
MDL_IO_SPACE)) == 0
*** Source File: d:\srv03rtm\base\ntos\mm\iosup.c, line 347

The flags field is 0x804, which I read as (MDL_SOURCE_IS_NONPAGED_POOL |
MDL_IO_SPACE)

b) It bugchecks 0x50 inside MmProbeAndLockPages

Which brings me to my question: How do I perform the probe mentioned at the
bottom of the discussion of bugcheck 0x50?
Any help gratefully accepted.

I should perhaps add that I’m running the checked build of Server2003 and
would like my driver to run on Win2K and later. Thankfully, I can live
without 98, ME etc.

Don Ward

It’s hard to be sure but I think you have mis-interpreted your bug check –
0x50 is ‘page fault in nonpaged area’ which means a reference to an invalid
virtual address that is within the non-paged pool area.

The va you get back from MmMapIoSpace is definitely valid (that’s what
MmMapIoSpace does) so accesses to that address cant cause this bug check
(even if the hardware backing the address is misconfigured). Chances are you
have a bug in your driver that causes it to access a va outside of the range
that you mapped with MmMapIoSpace.

/simgr

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Don Ward
Sent: Thursday, December 16, 2004 7:49 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] How to probe an address mapped by MmMapIoSpace

My driver is giving a bugcheck 0x50, which I’d like to avoid.

I think I know the root cause of the error (it’s misconfigured hardware) and
how to fix it (configure the hardware properly) but that isn’t the purpose
of my question: I’d like to be able to return a sensible error message, put
stuff in the event log etc., rather than blue screen.

The bugcheck occurs the first time I attempt to access the device memory at
the address returned by MmMapIoSpace.

The DDK says at the bottom of the discussion of bugcheck 0x50

“This cannot be protected by a try-except handler - it can only be protected
by a probe.”

I’ve looked at the 50 or so topics in the DDK brought up by a search for
“probe” but they either refer to the probing of user space memory, or use
the word in a context that obviously doesn’t apply.

So, temporarily disregarding the DDK (not usually a good idea), I wrote

BOOLEAN probe(PVOID addr, ULONG length)
{
PMDL probeMdl = IoAllocateMdl(addr, length, FALSE, FALSE, NULL);

if (probeMdl == NULL) return FALSE;

__try
{
__try
{
MmBuildMdlForNonPagedPool(probeMdl);
MmProbeAndLockPages(probeMdl, KernelMode, IoModifyAccess);
MmUnlockPages(probeMdl);
return TRUE;
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
return FALSE;
}
}
__finally
{
IoFreeMdl(probeMdl);
}
}

When I feed the routine with the (non NULL) address returned by
MmMapIoSpace, which in turn was supplied with the translated memory address
from the resource list in startdevice, I get two problems:

a) An assert fails in MmBuildMdlForNonPagedPool

*** Assertion failed: (MemoryDescriptorList->MdlFlags & ( MDL_PAGES_LOCKED |
MDL_MAPPED_TO_SYSTEM_VA | MDL_SOURCE_IS_NONPAGED_POOL | MDL_PARTIAL |
MDL_IO_SPACE)) == 0
*** Source File: d:\srv03rtm\base\ntos\mm\iosup.c, line 347

The flags field is 0x804, which I read as (MDL_SOURCE_IS_NONPAGED_POOL |
MDL_IO_SPACE)

b) It bugchecks 0x50 inside MmProbeAndLockPages

Which brings me to my question: How do I perform the probe mentioned at the
bottom of the discussion of bugcheck 0x50?
Any help gratefully accepted.

I should perhaps add that I’m running the checked build of Server2003 and
would like my driver to run on Win2K and later. Thankfully, I can live
without 98, ME etc.

Don Ward


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com

After some private conversation some help from Simon Graham (Thank you
Simon) and some more investigation, it turns out he was right. It was a
fault in my driver, not the card not responding.

However, the original question remains; how does one do the probe referred
to in the DDK when it says

“This cannot be protected by a try-except handler - it can only be protected
by a probe.”

Don

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Graham, Simon
Sent: 16 December 2004 13:44
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] How to probe an address mapped by MmMapIoSpace

It’s hard to be sure but I think you have mis-interpreted
your bug check – 0x50 is ‘page fault in nonpaged area’ which
means a reference to an invalid virtual address that is
within the non-paged pool area.

The va you get back from MmMapIoSpace is definitely valid
(that’s what MmMapIoSpace does) so accesses to that address
cant cause this bug check (even if the hardware backing the
address is misconfigured). Chances are you have a bug in your
driver that causes it to access a va outside of the range
that you mapped with MmMapIoSpace.

/simgr

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Don Ward
Sent: Thursday, December 16, 2004 7:49 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] How to probe an address mapped by MmMapIoSpace

My driver is giving a bugcheck 0x50, which I’d like to avoid.

I think I know the root cause of the error (it’s
misconfigured hardware) and how to fix it (configure the
hardware properly) but that isn’t the purpose of my question:
I’d like to be able to return a sensible error message, put
stuff in the event log etc., rather than blue screen.

The bugcheck occurs the first time I attempt to access the
device memory at the address returned by MmMapIoSpace.

The DDK says at the bottom of the discussion of bugcheck 0x50

“This cannot be protected by a try-except handler - it can
only be protected by a probe.”

I’ve looked at the 50 or so topics in the DDK brought up by a
search for “probe” but they either refer to the probing of
user space memory, or use the word in a context that
obviously doesn’t apply.

So, temporarily disregarding the DDK (not usually a good
idea), I wrote

BOOLEAN probe(PVOID addr, ULONG length)
{
PMDL probeMdl = IoAllocateMdl(addr, length, FALSE, FALSE, NULL);

if (probeMdl == NULL) return FALSE;

__try
{
__try
{
MmBuildMdlForNonPagedPool(probeMdl);
MmProbeAndLockPages(probeMdl, KernelMode, IoModifyAccess);
MmUnlockPages(probeMdl);
return TRUE;
}
__except (EXCEPTION_EXECUTE_HANDLER)
{
return FALSE;
}
}
__finally
{
IoFreeMdl(probeMdl);
}
}

When I feed the routine with the (non NULL) address returned
by MmMapIoSpace, which in turn was supplied with the
translated memory address from the resource list in
startdevice, I get two problems:

a) An assert fails in MmBuildMdlForNonPagedPool

*** Assertion failed: (MemoryDescriptorList->MdlFlags & (
MDL_PAGES_LOCKED | MDL_MAPPED_TO_SYSTEM_VA |
MDL_SOURCE_IS_NONPAGED_POOL | MDL_PARTIAL |
MDL_IO_SPACE)) == 0
*** Source File: d:\srv03rtm\base\ntos\mm\iosup.c, line 347

The flags field is 0x804, which I read as
(MDL_SOURCE_IS_NONPAGED_POOL |
MDL_IO_SPACE)

b) It bugchecks 0x50 inside MmProbeAndLockPages

Which brings me to my question: How do I perform the probe
mentioned at the bottom of the discussion of bugcheck 0x50?
Any help gratefully accepted.

I should perhaps add that I’m running the checked build of
Server2003 and would like my driver to run on Win2K and
later. Thankfully, I can live without 98, ME etc.

Don Ward


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@careful.co.uk
To unsubscribe send a blank email to xxxxx@lists.osr.com

See ProbeForRead and ProbeForWrite in the DDK.


Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply

“Don Ward” wrote in message news:xxxxx@ntdev…
After some private conversation some help from Simon Graham (Thank you
Simon) and some more investigation, it turns out he was right. It was a
fault in my driver, not the card not responding.

However, the original question remains; how does one do the probe referred
to in the DDK when it says

“This cannot be protected by a try-except handler - it can only be protected
by a probe.”

Don

> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Graham, Simon
> Sent: 16 December 2004 13:44
> To: Windows System Software Devs Interest List
> Subject: RE: [ntdev] How to probe an address mapped by MmMapIoSpace
>
>
> It’s hard to be sure but I think you have mis-interpreted
> your bug check – 0x50 is ‘page fault in nonpaged area’ which
> means a reference to an invalid virtual address that is
> within the non-paged pool area.
>
> The va you get back from MmMapIoSpace is definitely valid
> (that’s what MmMapIoSpace does) so accesses to that address
> cant cause this bug check (even if the hardware backing the
> address is misconfigured). Chances are you have a bug in your
> driver that causes it to access a va outside of the range
> that you mapped with MmMapIoSpace.
>
> /simgr
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Don Ward
> Sent: Thursday, December 16, 2004 7:49 AM
> To: Windows System Software Devs Interest List
> Subject: [ntdev] How to probe an address mapped by MmMapIoSpace
>
> My driver is giving a bugcheck 0x50, which I’d like to avoid.
>
> I think I know the root cause of the error (it’s
> misconfigured hardware) and how to fix it (configure the
> hardware properly) but that isn’t the purpose of my question:
> I’d like to be able to return a sensible error message, put
> stuff in the event log etc., rather than blue screen.
>
> The bugcheck occurs the first time I attempt to access the
> device memory at the address returned by MmMapIoSpace.
>
> The DDK says at the bottom of the discussion of bugcheck 0x50
>
> “This cannot be protected by a try-except handler - it can
> only be protected by a probe.”
>
> I’ve looked at the 50 or so topics in the DDK brought up by a
> search for “probe” but they either refer to the probing of
> user space memory, or use the word in a context that
> obviously doesn’t apply.
>
> So, temporarily disregarding the DDK (not usually a good
> idea), I wrote
>
> BOOLEAN probe(PVOID addr, ULONG length)
> {
> PMDL probeMdl = IoAllocateMdl(addr, length, FALSE, FALSE, NULL);
>
> if (probeMdl == NULL) return FALSE;
>
> try
> {
>
try
> {
> MmBuildMdlForNonPagedPool(probeMdl);
> MmProbeAndLockPages(probeMdl, KernelMode, IoModifyAccess);
> MmUnlockPages(probeMdl);
> return TRUE;
> }
> __except (EXCEPTION_EXECUTE_HANDLER)
> {
> return FALSE;
> }
> }
>__finally
> {
> IoFreeMdl(probeMdl);
> }
> }
>
> When I feed the routine with the (non NULL) address returned
> by MmMapIoSpace, which in turn was supplied with the
> translated memory address from the resource list in
> startdevice, I get two problems:
>
> a) An assert fails in MmBuildMdlForNonPagedPool
>
> Assertion failed: (MemoryDescriptorList->MdlFlags & (
> MDL_PAGES_LOCKED | MDL_MAPPED_TO_SYSTEM_VA |
> MDL_SOURCE_IS_NONPAGED_POOL | MDL_PARTIAL |
> MDL_IO_SPACE)) == 0
>
Source File: d:\srv03rtm\base\ntos\mm\iosup.c, line 347
>
> The flags field is 0x804, which I read as
> (MDL_SOURCE_IS_NONPAGED_POOL |
> MDL_IO_SPACE)
>
> b) It bugchecks 0x50 inside MmProbeAndLockPages
>
> Which brings me to my question: How do I perform the probe
> mentioned at the bottom of the discussion of bugcheck 0x50?
> Any help gratefully accepted.
>
> I should perhaps add that I’m running the checked build of
> Server2003 and would like my driver to run on Win2K and
> later. Thankfully, I can live without 98, ME etc.
>
> Don Ward
>
>
> —
> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@careful.co.uk
To unsubscribe send a blank email to xxxxx@lists.osr.com

> MmBuildMdlForNonPagedPool(probeMdl);

MmProbeAndLockPages(probeMdl, KernelMode, IoModifyAccess);

Remove MmBuildMdlForNonPagedPool at all.

MmBuildMdlForNonPagedPool is a replacement for MmProbeAndLockPages for a case
if the memory described by the MDL is surely nonpaged. They cannot be used
both.

MmBuildMdlForNonPagedPool also cannot fail in any way.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

You do not need to probe such addresses. Use MmBuildMdlForNonPagedPool
instead.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Don Ward”
To: “Windows System Software Devs Interest List”
Sent: Thursday, December 16, 2004 7:36 PM
Subject: RE: [ntdev] How to probe an address mapped by MmMapIoSpace

After some private conversation some help from Simon Graham (Thank you
Simon) and some more investigation, it turns out he was right. It was a
fault in my driver, not the card not responding.

However, the original question remains; how does one do the probe referred
to in the DDK when it says

“This cannot be protected by a try-except handler - it can only be protected
by a probe.”

Don

> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Graham, Simon
> Sent: 16 December 2004 13:44
> To: Windows System Software Devs Interest List
> Subject: RE: [ntdev] How to probe an address mapped by MmMapIoSpace
>
>
> It’s hard to be sure but I think you have mis-interpreted
> your bug check – 0x50 is ‘page fault in nonpaged area’ which
> means a reference to an invalid virtual address that is
> within the non-paged pool area.
>
> The va you get back from MmMapIoSpace is definitely valid
> (that’s what MmMapIoSpace does) so accesses to that address
> cant cause this bug check (even if the hardware backing the
> address is misconfigured). Chances are you have a bug in your
> driver that causes it to access a va outside of the range
> that you mapped with MmMapIoSpace.
>
> /simgr
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Don Ward
> Sent: Thursday, December 16, 2004 7:49 AM
> To: Windows System Software Devs Interest List
> Subject: [ntdev] How to probe an address mapped by MmMapIoSpace
>
> My driver is giving a bugcheck 0x50, which I’d like to avoid.
>
> I think I know the root cause of the error (it’s
> misconfigured hardware) and how to fix it (configure the
> hardware properly) but that isn’t the purpose of my question:
> I’d like to be able to return a sensible error message, put
> stuff in the event log etc., rather than blue screen.
>
> The bugcheck occurs the first time I attempt to access the
> device memory at the address returned by MmMapIoSpace.
>
> The DDK says at the bottom of the discussion of bugcheck 0x50
>
> “This cannot be protected by a try-except handler - it can
> only be protected by a probe.”
>
> I’ve looked at the 50 or so topics in the DDK brought up by a
> search for “probe” but they either refer to the probing of
> user space memory, or use the word in a context that
> obviously doesn’t apply.
>
> So, temporarily disregarding the DDK (not usually a good
> idea), I wrote
>
> BOOLEAN probe(PVOID addr, ULONG length)
> {
> PMDL probeMdl = IoAllocateMdl(addr, length, FALSE, FALSE, NULL);
>
> if (probeMdl == NULL) return FALSE;
>
> try
> {
>
try
> {
> MmBuildMdlForNonPagedPool(probeMdl);
> MmProbeAndLockPages(probeMdl, KernelMode, IoModifyAccess);
> MmUnlockPages(probeMdl);
> return TRUE;
> }
> __except (EXCEPTION_EXECUTE_HANDLER)
> {
> return FALSE;
> }
> }
>__finally
> {
> IoFreeMdl(probeMdl);
> }
> }
>
> When I feed the routine with the (non NULL) address returned
> by MmMapIoSpace, which in turn was supplied with the
> translated memory address from the resource list in
> startdevice, I get two problems:
>
> a) An assert fails in MmBuildMdlForNonPagedPool
>
> Assertion failed: (MemoryDescriptorList->MdlFlags & (
> MDL_PAGES_LOCKED | MDL_MAPPED_TO_SYSTEM_VA |
> MDL_SOURCE_IS_NONPAGED_POOL | MDL_PARTIAL |
> MDL_IO_SPACE)) == 0
>
Source File: d:\srv03rtm\base\ntos\mm\iosup.c, line 347
>
> The flags field is 0x804, which I read as
> (MDL_SOURCE_IS_NONPAGED_POOL |
> MDL_IO_SPACE)
>
> b) It bugchecks 0x50 inside MmProbeAndLockPages
>
> Which brings me to my question: How do I perform the probe
> mentioned at the bottom of the discussion of bugcheck 0x50?
> Any help gratefully accepted.
>
> I should perhaps add that I’m running the checked build of
> Server2003 and would like my driver to run on Win2K and
> later. Thankfully, I can live without 98, ME etc.
>
> Don Ward
>
>
> —
> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@careful.co.uk
To unsubscribe send a blank email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com