Driver Verifier DMA Violation Blue Screen With MXIe or Thunderbolt Modules

Updated Jan 4, 2022

Reported In

Hardware

  • PXI Controller
  • PXIe-8301
  • PCIe-8361

Operating System

  • Windows

Issue Details

  • I have a PXIe MXI system that uses a Thunderbolt PXIe-8301 module. If I have any PXI/PXIe cards (such as the PXI-5922 or PXI-5600) installed in my PXI chassis when I start the connected host computer, I get a Blue Screen, with the error message “DRIVER_VERIFIER_DMA_VIOLATION”. This error occurs both before and after logging in to my Windows account.
  • I have a PXIe system connected to my PC using NI PCIe-8361. The PXI chassis houses PXI-6220 and a couple of PXI-6514 modules. As soon as I switch on the whole system and try to open NI MAX, I experience a Blue Screen with the error message “DRIVER_VERIFIER_DMA_VIOLATION”.

Solution

This is a known issue as stated in Stop code DRIVER_VERIFIER_DMA_VIOLATION when Kernel DMA Protection is enabled. Microsoft is aware of this issue. A resolution will be provided in an upcoming release. Until then, the only workaround is to disable the Kernal DMA Protection in the computer’s BIOS.
How to get into the BIOS and the BIOS structure are different depending on manufacturer and model so you should search the PC manufacturers website for any information needed on how to boot into the BIOS and where the Kernel DMA settings are.
Additionally, some computers do not specifically have the option Kernel DMA Protection in the BIOS, you will need to look for the Virtualization Technology for Directed I/O (Vtd) option and disable it, this will disable the Kernel DMA Protection.  
Note, not all laptops with Kernel DMA Protection enabled will give a blue screen. It depends on how the DMA Protection has been implemented by the manufacturer.

Additional Information

This Blue Screen occurs due to the interaction between the data transmitted from the PXIe controller to the connected PC and the Kernal DMA (Direct Memory Access) Protection added in Windows 10 Version 1803.

The attack which the Kernal DMA Protection prevents requires the attacker to have hands-on access with the computer. As such, keeping the computer in a secured environment will reduce the risk of an attack.

As this workaround leaves the end-user vulnerable to a cyberattack, it is advisable to pursue all other lines of troubleshooting first, and please make sure the end-user is aware of the risk.

Laptop manufacturers/vendors determine which PCI segments DMA protection is applied to by setting specific attributes in the AHCI information that Windows gathers when booting the system. The attribute settings are a design decision that is normally based on the intended use of various PCI ports but could easily be an oversight as this new capability is rolled out. It's not something that is easily checked ahead of time.

NI recognizes the importance of supporting hosts with DMA protection enabled and applied to PXI systems. We are actively working on this and expect to roll it out over the next 18 months (written November 2020). 

The best way to check if a laptop would be compatible is to check the ability to disable Intel VT-d or AMD-Vi in the BIOS. While some laptops will work without this needing to be done, there is no way to tell this without testing the laptop with a system.