PCI bus-relative (physical) addresses

NTDEV
61

[Scott Noone]

this comes up often in relation to forensic analysis.
Often you have a memory dump that you scan for interesting
patterns/data. Given you find something interesting, the next
step is to figure out who is actually using this data. All of
the existing forensics toolkits achieve this using a brute
force approach, but an O/S supported mechanism would be useful.

I think this falls into the same category as debugging. It is
often useful to know all places where a page is mapped, and there
are both brute force (e.g. !searchpte) and specialized methods
(e.g. !ca 4 to dump all mapped views for a control area).

Building support for this into the OS just to make this kind of
analysis easier doesn’t seem worth it, especially since it will
likely require increasing the size of the PFN entry. Plus, as you
mentioned, in the forensic scenario the OS-provided information
couldn’t be considered reliable anyway.

62

> Yes, Tim is correct. My question was related to physical addresses coming

out of the CPU’s pins in ordert to better understand PC systems

coming back to my question…I mean a way (a tool or other…) to find out
in which CPU physical address ranges RAM page frames are mapped to

Thanks
****

Back to my first comment: RAM is accessed ONLY by physical address on the
bus. Period. But the mapping is a mapping in the context of a virtual
address space, so “RAM page frams” is not particularly interesting; you
won’t know what the PFNs are for any given process, unless you are doing
I/O and have looked inside the MDL with the debugger to find the PFNs of
the I/O buffers represented by that MDL. So why does the PFN-to-physical
mapping seem to have value?

*****

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

63

>> No. When your driver maps its device registers into a virtual address,

> it is mapping into KERNEL virtual space. A kernel virtual address is
> valid in all contexts. Plus, device registers cannot be paged out

Maybe I was unclear…of course paging in not applicable, by definition,
to device’s memory-mapped ranges. My question was related to page tables
which map VAs to these physical regions (AFAIK, quite general, page tables
pages themselves can be paged out including page table mapping system
(kernel) VAs )

However as Anton pointed out “It is OS’s responsibility to ensure that
accessing memory that had been mapped with MmMapIoSpace() does not result
in page faults. Therefore, all page tables that are used for mapping the
target page are going to be locked in RAM…”

So driver’s code can safety access its mapped device registers into system
(kernel) virtual space…

****

Yes. Those VAs are guaranteed to be forever valid while the device is
active. If you have a hot-swap backplane, they can be invalidated when
the device is physically removed, and reassigned when the card (or a
working version of the card) is plugged back in, but the mappings may not
be what you had the last time.

The problem seems to be that you have insufficient information, and are
relying on rumor and urban legend to create nonexistent potential
problems.

Since there has never been a statement that a memory-mapped register could
ever be invalid under normal conditions, you should not assume that based
on some rumored behavior, one might be.
joe
****

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

64

> The problem seems to be that you have insufficient information, and are relying on rumor

and urban legend to create nonexistent potential problems.

Well, this is not “rumor and urban legend” but simply a confusion. Let’s face it - the terminology itself is
pretty confusing. What the OP needs here is just to read Intel Manual. Mindshare books, particularly,
“PCI System Architecture” would not hurt him either…

Anton Bassov

65

Joseph,

is not my intention to create nonexistent potential problems… My gola is just to better understand some Windows internals…