Re: How is possible that NDIS_PACKET->Head->MappedSystemVa is page

Thanks for specifiying how it is functional,
probably this problem is relating to other problem which I often met:

In user-mode dll is allocated memory with malloc(). This returns non-NULL
address of memory, but when it is passed to IM driver, this user buffer is
there mapped by:
MmGetSystemAddressForMdlSafe(..., HighPagePriority);
and it often fails and returns NULL. Mainly it fails when system is run
under memory stress, but amazing is that failing continues after memory
stress is switched off even
several minutes after it and sometimes also absolutely without memory
stress, but it seems that only in debug version of my IM driver. I see this
behavior on several different machines. Does exist some memory quota for
non-paged memory allocated some driver ?
What about driver verifier, if it is set to inject memory allocation faults,
can it be reason of MmGetSystemAddressForMdlSafe(..., HighPagePriority)
failing ?

Second: more detailed info - relating to Thomas's idea - if in packet buffer
has ethernet header
In my crashes *paged* MappedSystemVa occurs only in loopback packets,
(Flags NDIS_FLAGS_IS_LOOPBACK_PACKET is set in NDIS_PACKET),
I create packet only with help of: NdisDprCreatePacket(),
NdisQueryBufferSafe(...,HighPagePriority); NdisCopyBuffer() - copying
original.
NdisQueryBufferSafe() always returns valid memory under debugger and hope
also NdisCopyBuffer() - there is no return code...
This "repacked" loopback packet is for some time stored to queue and after
it it is flushed - NdisMIndicateReceivePacket() on such decelerated packet
crashes and MappedSystemVa in NDIS_PACKET is NULL.

Peter

"Maxim S. Shatskih" wrote:

So are you 100% sure that in health W2K/WXP/W2K3 OS-es
Packet->Head->MappedSystemVa, never can be paged ?

Surely. This is a return value from MmGetSystemAddressForMdlSafe (well, maybe
as sum of this and ->ByteOffset is the return value, forgotten the exact
picture - possible ->MappedSystemVa is page-aligned down). This cannot be
paged.

For MDLs built by MmBuildMdlForNonPagedPool, MappedSystemVa is the same as
BaseVa, and a flag is set in the MDL to force MmGetSystemAddressForMdlSafe to
be a no-op.

NdisAllocateBuffer == IoAllocateMdl + MmBuildMdlForNonPagedPool, so, something
is really strange for you.

Remember the "first buffer size" requirement for NdisMIndicateReceivePacket
mentioned by Thomas. It must be >= MAC header size + the lookahead size
(requested by the uppers using OID).

This is done for NDIS to allow to deliver this packet to old-style PtReceive
without doing data copies, and to allow the protocols to always treat their
headers as contiguous - TCP/IP relies on this.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@xxxxxxxxxxxxxxxx
http://www.storagecraft.com


.

Relevant Pages

  • [patch 2.6.12-rc3] dell_rbu: Resubmitting patch for new Dell BIOS update driver
    ... +The BIOS update is done by writing the new BIOS image in to contiguous physical ... +memory addressable by the BIOS. ... +The disadvantage of contiguous allocation is that it may not be always possible ... * break the BIOS image in to fixed sized packet chunks and each packet is written ...
    (Linux-Kernel)
  • [NT]Microsoft Windows WRITE_ANDX SMB Command Handling Kernel DoS
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Microsoft Windows Vista SP1 with latest security updates ... Invalid system memory was referenced. ... Srv.sys is the driver that will process the received SMB packet, ...
    (Securiteam)
  • Re: PCI newbie problems
    ... there is a manual on the Xilinx web site that I would look at first. ... How to decode a PCIexpress packet. ... As regards writing to memory using PCItree. ... These are typically control registers, ...
    (comp.arch.fpga)
  • Re: Library design for downloading an unknown amount of data?
    ... Multiple manufacturers just adds to the fun! ... Some devices send everything in a single packet, ... you could malloc the correct sized buffer. ... devices that only have 32KB of memory. ...
    (comp.lang.c)
  • Re: [PATCH 1/1] network memory allocator.
    ... Swap storage then sends an ack for that data, since network allocations ... data and main system can work with that free memory. ... No need to detect OOM or something other - it just works. ... each new packet goes slow path since VJ header ...
    (Linux-Kernel)