WDM Memory Mapper Driver for PCI

Hi everybody,
I would want to write a memory mapper driver. This driver should be able to
find the physical base address from the configuration register of a PCI
device. After this it should be able to read and write to register’s at an
offset to this. The user should only need to provide the Subsystem vendor ID
and Subsystem device ID. The driver enumerates the PCI bus and finds the
device.

CM_PARTIAL_RESOURCE_DESCRIPTOR *p_mem_res ; // i get by iterating though the
CM_RESOURCE_LIST
if( p_res->Type == CmResourceTypeMemory )

_p_reg_base = (BYTE*)MmMapIoSpace( p_mem_res->u.Memory.Start,
p_mem_res->u.Memory.Length,
MmNonCached );

now this would give me a virtual base address in kernel space. How would a
user mode application able to address it. Honestly I don’t understand the
concept of kernel memory mapping and MDL’s?
Can somebody patiently answer this.

Also would this work with PCIe?

Thanks
Arif


Express yourself instantly with MSN Messenger! Download today - it’s FREE!
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

This is an incredibly dangerous idea, since it blows security out of the
water. What happens if the device has DMA or an interrupt, the user app
will be able to crash the OS anytime it wants. While there are a few
devices where mapping a large memory region from PCI space to user space is
justified, it is rare.

Tell us why you need such an unsecure and broken architecture, and maybe we
will help.


Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
http://www.windrvr.com
Remove StopSpam from the email to reply

“Arif Golde” wrote in message news:xxxxx@ntdev…
> Hi everybody,
> I would want to write a memory mapper driver. This driver should be able
> to find the physical base address from the configuration register of a PCI
> device. After this it should be able to read and write to register’s at an
> offset to this. The user should only need to provide the Subsystem vendor
> ID and Subsystem device ID. The driver enumerates the PCI bus and finds
> the device.
>
> CM_PARTIAL_RESOURCE_DESCRIPTOR p_mem_res ; // i get by iterating though
> the CM_RESOURCE_LIST
> if( p_res->Type == CmResourceTypeMemory )
>
> _p_reg_base = (BYTE
)MmMapIoSpace( p_mem_res->u.Memory.Start,
> p_mem_res->u.Memory.Length,
> MmNonCached );
>
> now this would give me a virtual base address in kernel space. How would a
> user mode application able to address it. Honestly I don’t understand the
> concept of kernel memory mapping and MDL’s?
> Can somebody patiently answer this.
>
> Also would this work with PCIe?
>
> Thanks
> Arif
>
> _________________________________________________________________
> Express yourself instantly with MSN Messenger! Download today - it’s FREE!
> http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/
>
>

ARIF:

It is dangerous, et. c. Back in less security conscious times,
Microsoft used to provide an example of this type of thing in the DDK,
with the significant exception that the sample allocated it’s own buffer
before mapping it. In any case, the example is no longer shipped, but I
imagine you can find it (it’s called something like MemMap). Below is
an outline of the basic steps, working on the assumption that you
already have a physical address (which I think is correct):

Open a handle to \Device\PhysicalMemory:

RtlInitUnicodeString(& deviceName, “\Device\PhysicalMemory”);
InitializeObjectAttributes(& attributes, & deviceName,
OBJ_CASE_INSENSITIVE, 0, 0);
ZwOpenSection(& handle, SECTION_ALL_ATTRIBUTES, & attributes);
ObReferenceObjectByHandle(handle, SECTION_ALL_ACCESS, NULL, KernelMode,
& section, NULL);

if (numberOfBytesToMap)
{
ZwMapViewOfSection(handle, (HANDLE) -1, & virtualAddress, 0,
numberOfBytesToMap, & sectionBase, & numberOfBytesToMap, ViewShare, 0,
PAGE_READWRITE | PAGE_NOCACHE);
}

virtualAddress += physicalAddress.LowPart - sectionBase.LowPart;

ZwClose(handle);

It’s been a while since I’ve done this, but this is the jist of it.
One issue that you may have to beware of is whether or not the physical
memory that you are attempting to map is already mapped to another
virtual address range (in any context) with different caching
attributes. Doing so on Win2K (I think; it may be XP) or later will
fail; on earlier versions, it may cause corruption of the TLB. There is
no easy or documented way to determining if this is the case or not.

I hope this helps.

MM

>> xxxxx@acm.org 2006-05-27 08:09 >>>
This is an incredibly dangerous idea, since it blows security out of
the
water. What happens if the device has DMA or an interrupt, the user
app
will be able to crash the OS anytime it wants. While there are a few
devices where mapping a large memory region from PCI space to user
space is
justified, it is rare.

Tell us why you need such an unsecure and broken architecture, and
maybe we
will help.


Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
http://www.windrvr.com
Remove StopSpam from the email to reply

“Arif Golde” wrote in message
news:xxxxx@ntdev…
> Hi everybody,
> I would want to write a memory mapper driver. This driver should be
able
> to find the physical base address from the configuration register of
a PCI
> device. After this it should be able to read and write to register’s
at an
> offset to this. The user should only need to provide the Subsystem
vendor
> ID and Subsystem device ID. The driver enumerates the PCI bus and
finds
> the device.
>
> CM_PARTIAL_RESOURCE_DESCRIPTOR p_mem_res ; // i get by iterating
though
> the CM_RESOURCE_LIST
> if( p_res->Type == CmResourceTypeMemory )
>
> _p_reg_base = (BYTE
)MmMapIoSpace( p_mem_res->u.Memory.Start,
> p_mem_res->u.Memory.Length,
> MmNonCached );
>
> now this would give me a virtual base address in kernel space. How
would a
> user mode application able to address it. Honestly I don’t understand
the
> concept of kernel memory mapping and MDL’s?
> Can somebody patiently answer this.
>
> Also would this work with PCIe?
>
> Thanks
> Arif
>
> _________________________________________________________________
> Express yourself instantly with MSN Messenger! Download today - it’s
FREE!
> http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/
>
>


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Arif Golde wrote:

Hi everybody,
I would want to write a memory mapper driver. This driver should be
able to find the physical base address from the configuration register
of a PCI device. After this it should be able to read and write to
register’s at an offset to this. The user should only need to provide
the Subsystem vendor ID and Subsystem device ID. The driver enumerates
the PCI bus and finds the device.

CM_PARTIAL_RESOURCE_DESCRIPTOR *p_mem_res ; // i get by iterating
though the CM_RESOURCE_LIST
if( p_res->Type == CmResourceTypeMemory )

_p_reg_base = (BYTE*)MmMapIoSpace( p_mem_res->u.Memory.Start,
p_mem_res->u.Memory.Length,
MmNonCached );

now this would give me a virtual base address in kernel space. How
would a user mode application able to address it. Honestly I don’t
understand the concept of kernel memory mapping and MDL’s?
Can somebody patiently answer this.

MDLs are not relevant to this operation. MDLs are generally used in the
opposite situation, when you have a user-mode buffer that you need to
lock down for use by hardware.

Memory mapping is not that hard of a concept. The resource descriptor
gives you a physical address, one which has meaning on the PCI bus. To
access that from software, you have to get a virtual address. Kernel
mode and user mode have separate address spaces, so you have to have
separate mappings for kernel access and user access.

Right now, you have a kernel virtual address, so your kernel driver can
access the memory. Your driver will need to support an ioctl
(IRP_MJ_DEVICE_CONTROL), which is how the application will call in.
Your driver can use ZwMapViewOfSection to map the memory to user-mode.
Google can help you find samples of this. You must remember to unmap
the view later on, even if the app closes unexpectedly.

Also would this work with PCIe?

On all non-beta Windows operating systems, PCIExpress is 100% identical
to PCI.


Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

I need a mechanism by which our application developers
can access registers of all PCI/PCIe/USB devices we
make using a memory driver. They have a database of
all the register offset and descriptions. This memory
driver would be common for all the devices and provide
only memory access functionality. In this way the HW
groups can tweek registers without installing beta
quality complete device drivers.

Since the applications would be tightly coupled with
the drivers security can be ensured.

Thanks
Arif
— Don Burn wrote:

> This is an incredibly dangerous idea, since it blows
> security out of the
> water. What happens if the device has DMA or an
> interrupt, the user app
> will be able to crash the OS anytime it wants.
> While there are a few
> devices where mapping a large memory region from PCI
> space to user space is
> justified, it is rare.
>
> Tell us why you need such an unsecure and broken
> architecture, and maybe we
> will help.
>
>
>
> –
> Don Burn (MVP, Windows DDK)
> Windows 2k/XP/2k3 Filesystem and Driver Consulting
> http://www.windrvr.com
> Remove StopSpam from the email to reply
>
>
> “Arif Golde” wrote in
> message news:xxxxx@ntdev…
> > Hi everybody,
> > I would want to write a memory mapper driver. This
> driver should be able
> > to find the physical base address from the
> configuration register of a PCI
> > device. After this it should be able to read and
> write to register’s at an
> > offset to this. The user should only need to
> provide the Subsystem vendor
> > ID and Subsystem device ID. The driver enumerates
> the PCI bus and finds
> > the device.
> >
> > CM_PARTIAL_RESOURCE_DESCRIPTOR p_mem_res ; // i
> get by iterating though
> > the CM_RESOURCE_LIST
> > if( p_res->Type == CmResourceTypeMemory )
> >
> > _p_reg_base = (BYTE
)MmMapIoSpace(
> p_mem_res->u.Memory.Start,
> >
> p_mem_res->u.Memory.Length,
> > MmNonCached
> );
> >
> > now this would give me a virtual base address in
> kernel space. How would a
> > user mode application able to address it. Honestly
> I don’t understand the
> > concept of kernel memory mapping and MDL’s?
> > Can somebody patiently answer this.
> >
> > Also would this work with PCIe?
> >
> > Thanks
> > Arif
> >
> >
>
_______________
> > Express yourself instantly with MSN Messenger!
> Download today - it’s FREE!
> >
>
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/
> >
> >
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR
> Online at
> http://www.osronline.com/page.cfm?name=ListServer
>


Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com

An in-house diagnostic utility for your own hardware is a legitimate use. Ny
the way, USB devices don’t actually have registers that are memory mapped
that you can tweak: they respond to URBs sent across the USB serial bus
instead.

Since this is a diagnostic utility I would suggest building a simple KMDF
driver for your PCI devices that exposes an IOCTL based API for modifying
the registers on the device. Performance is not an issue. There really is no
need to map the device memory into user mode in order to run diagnostics on
it. Just provide an abstraction of register access in the api and present it
to the user in either a gui or a command line interface and let the driver
do the actual access.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Saurabh
Sent: Saturday, May 27, 2006 4:17 PM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] WDM Memory Mapper Driver for PCI

I need a mechanism by which our application developers can
access registers of all PCI/PCIe/USB devices we make using a
memory driver. They have a database of all the register
offset and descriptions. This memory driver would be common
for all the devices and provide only memory access
functionality. In this way the HW groups can tweek registers
without installing beta quality complete device drivers.

Since the applications would be tightly coupled with the
drivers security can be ensured.

Thanks
Arif
— Don Burn wrote:
>
> > This is an incredibly dangerous idea, since it blows
> security out of
> > the water. What happens if the device has DMA or an interrupt, the
> > user app will be able to crash the OS anytime it wants.
> > While there are a few
> > devices where mapping a large memory region from PCI space to user
> > space is justified, it is rare.
> >
> > Tell us why you need such an unsecure and broken architecture, and
> > maybe we will help.
> >
> >
> >
> > –
> > Don Burn (MVP, Windows DDK)
> > Windows 2k/XP/2k3 Filesystem and Driver Consulting
> > http://www.windrvr.com Remove StopSpam from the email to reply
> >
> >
> > “Arif Golde” wrote in message
> > news:xxxxx@ntdev…
> > > Hi everybody,
> > > I would want to write a memory mapper driver. This
> > driver should be able
> > > to find the physical base address from the
> > configuration register of a PCI
> > > device. After this it should be able to read and
> > write to register’s at an
> > > offset to this. The user should only need to
> > provide the Subsystem vendor
> > > ID and Subsystem device ID. The driver enumerates
> > the PCI bus and finds
> > > the device.
> > >
> > > CM_PARTIAL_RESOURCE_DESCRIPTOR p_mem_res ; // i
> > get by iterating though
> > > the CM_RESOURCE_LIST
> > > if( p_res->Type == CmResourceTypeMemory )
> > >
> > > _p_reg_base = (BYTE
)MmMapIoSpace(
> > p_mem_res->u.Memory.Start,
> > >
> > p_mem_res->u.Memory.Length,
> > > MmNonCached
> > );
> > >
> > > now this would give me a virtual base address in
> > kernel space. How would a
> > > user mode application able to address it. Honestly
> > I don’t understand the
> > > concept of kernel memory mapping and MDL’s?
> > > Can somebody patiently answer this.
> > >
> > > Also would this work with PCIe?
> > >
> > > Thanks
> > > Arif
> > >
> > >
> >
> _______________
> > > Express yourself instantly with MSN Messenger!
> > Download today - it’s FREE!
> > >
> >
> http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/
> > >
> > >
> >
> >
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> > http://www.osronline.com/article.cfm?id=256
> >
> > To unsubscribe, visit the List Server section of OSR Online at
> > http://www.osronline.com/page.cfm?name=ListServer
> >
>
>
>

> Do You Yahoo!?
> Tired of spam? Yahoo! Mail has the best spam protection around
> http://mail.yahoo.com
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online
> at http://www.osronline.com/page.cfm?name=ListServer
>

You have a number of problems:

  1. USB does not have registers.

  2. You still have all the security problems, how do you ensure that only
    your application gets access to this stuff. You are opening a fantastic
    hole for security, please identify the devices so a lot of us can avoid ever
    buying them.

3, All these devices are Plug and Play with power management? How do you
plan to support this?

This is a really stupid idea, that if you can make it work at all will
cripple the system it is running on, and make it open to any security breach
imaginable.


Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
http://www.windrvr.com
Remove StopSpam from the email to reply

“Saurabh” wrote in message news:xxxxx@ntdev…
>I need a mechanism by which our application developers
> can access registers of all PCI/PCIe/USB devices we
> make using a memory driver. They have a database of
> all the register offset and descriptions. This memory
> driver would be common for all the devices and provide
> only memory access functionality. In this way the HW
> groups can tweek registers without installing beta
> quality complete device drivers.
>
> Since the applications would be tightly coupled with
> the drivers security can be ensured.
>
> Thanks
> Arif
> — Don Burn wrote:
>
>> This is an incredibly dangerous idea, since it blows
>> security out of the
>> water. What happens if the device has DMA or an
>> interrupt, the user app
>> will be able to crash the OS anytime it wants.
>> While there are a few
>> devices where mapping a large memory region from PCI
>> space to user space is
>> justified, it is rare.
>>
>> Tell us why you need such an unsecure and broken
>> architecture, and maybe we
>> will help.
>>
>>
>>
>> –
>> Don Burn (MVP, Windows DDK)
>> Windows 2k/XP/2k3 Filesystem and Driver Consulting
>> http://www.windrvr.com
>> Remove StopSpam from the email to reply
>>
>>
>> “Arif Golde” wrote in
>> message news:xxxxx@ntdev…
>> > Hi everybody,
>> > I would want to write a memory mapper driver. This
>> driver should be able
>> > to find the physical base address from the
>> configuration register of a PCI
>> > device. After this it should be able to read and
>> write to register’s at an
>> > offset to this. The user should only need to
>> provide the Subsystem vendor
>> > ID and Subsystem device ID. The driver enumerates
>> the PCI bus and finds
>> > the device.
>> >
>> > CM_PARTIAL_RESOURCE_DESCRIPTOR p_mem_res ; // i
>> get by iterating though
>> > the CM_RESOURCE_LIST
>> > if( p_res->Type == CmResourceTypeMemory )
>> >
>> > _p_reg_base = (BYTE
)MmMapIoSpace(
>> p_mem_res->u.Memory.Start,
>> >
>> p_mem_res->u.Memory.Length,
>> > MmNonCached
>> );
>> >
>> > now this would give me a virtual base address in
>> kernel space. How would a
>> > user mode application able to address it. Honestly
>> I don’t understand the
>> > concept of kernel memory mapping and MDL’s?
>> > Can somebody patiently answer this.
>> >
>> > Also would this work with PCIe?
>> >
>> > Thanks
>> > Arif
>> >
>> >
>>
> _______________
>> > Express yourself instantly with MSN Messenger!
>> Download today - it’s FREE!
>> >
>>
> http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/
>> >
>> >
>>
>>
>>
>> —
>> Questions? First check the Kernel Driver FAQ at
>> http://www.osronline.com/article.cfm?id=256
>>
>> To unsubscribe, visit the List Server section of OSR
>> Online at
>> http://www.osronline.com/page.cfm?name=ListServer
>>
>
>
>

> Do You Yahoo!?
> Tired of spam? Yahoo! Mail has the best spam protection around
> http://mail.yahoo.com
>

Windows has no support for drivers to access arbitrary PCI devices. The
driver can only access its device, the one for which it is installed.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Arif Golde”
To: “Windows System Software Devs Interest List”
Sent: Saturday, May 27, 2006 6:02 AM
Subject: [ntdev] WDM Memory Mapper Driver for PCI

> Hi everybody,
> I would want to write a memory mapper driver. This driver should be able to
> find the physical base address from the configuration register of a PCI
> device. After this it should be able to read and write to register’s at an
> offset to this. The user should only need to provide the Subsystem vendor ID
> and Subsystem device ID. The driver enumerates the PCI bus and finds the
> device.
>
> CM_PARTIAL_RESOURCE_DESCRIPTOR p_mem_res ; // i get by iterating though the
> CM_RESOURCE_LIST
> if( p_res->Type == CmResourceTypeMemory )
>
> _p_reg_base = (BYTE
)MmMapIoSpace( p_mem_res->u.Memory.Start,
> p_mem_res->u.Memory.Length,
> MmNonCached );
>
> now this would give me a virtual base address in kernel space. How would a
> user mode application able to address it. Honestly I don’t understand the
> concept of kernel memory mapping and MDL’s?
> Can somebody patiently answer this.
>
> Also would this work with PCIe?
>
> Thanks
> Arif
>
> _________________________________________________________________
> Express yourself instantly with MSN Messenger! Download today - it’s FREE!
> http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/
>
>
> —
> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Well, this is not complex at all. Expose IOCTL_MYDEVICE_MAP_MEMORY to the
app, and call MmMapLockedPages(UserMode…) in it.
Do not forget to destroy the mapping when the file handle used for IOCTL is
closed (MJ_CLEANUP path), or you will have PROCESS_HAS_LOCKED_PAGES BSOD.

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “Saurabh”
To: “Windows System Software Devs Interest List”
Sent: Sunday, May 28, 2006 12:16 AM
Subject: Re:[ntdev] WDM Memory Mapper Driver for PCI

> I need a mechanism by which our application developers
> can access registers of all PCI/PCIe/USB devices we
> make using a memory driver. They have a database of
> all the register offset and descriptions. This memory
> driver would be common for all the devices and provide
> only memory access functionality. In this way the HW
> groups can tweek registers without installing beta
> quality complete device drivers.
>
> Since the applications would be tightly coupled with
> the drivers security can be ensured.
>
> Thanks
> Arif
> — Don Burn wrote:
>
> > This is an incredibly dangerous idea, since it blows
> > security out of the
> > water. What happens if the device has DMA or an
> > interrupt, the user app
> > will be able to crash the OS anytime it wants.
> > While there are a few
> > devices where mapping a large memory region from PCI
> > space to user space is
> > justified, it is rare.
> >
> > Tell us why you need such an unsecure and broken
> > architecture, and maybe we
> > will help.
> >
> >
> >
> > –
> > Don Burn (MVP, Windows DDK)
> > Windows 2k/XP/2k3 Filesystem and Driver Consulting
> > http://www.windrvr.com
> > Remove StopSpam from the email to reply
> >
> >
> > “Arif Golde” wrote in
> > message news:xxxxx@ntdev…
> > > Hi everybody,
> > > I would want to write a memory mapper driver. This
> > driver should be able
> > > to find the physical base address from the
> > configuration register of a PCI
> > > device. After this it should be able to read and
> > write to register’s at an
> > > offset to this. The user should only need to
> > provide the Subsystem vendor
> > > ID and Subsystem device ID. The driver enumerates
> > the PCI bus and finds
> > > the device.
> > >
> > > CM_PARTIAL_RESOURCE_DESCRIPTOR p_mem_res ; // i
> > get by iterating though
> > > the CM_RESOURCE_LIST
> > > if( p_res->Type == CmResourceTypeMemory )
> > >
> > > _p_reg_base = (BYTE
)MmMapIoSpace(
> > p_mem_res->u.Memory.Start,
> > >
> > p_mem_res->u.Memory.Length,
> > > MmNonCached
> > );
> > >
> > > now this would give me a virtual base address in
> > kernel space. How would a
> > > user mode application able to address it. Honestly
> > I don’t understand the
> > > concept of kernel memory mapping and MDL’s?
> > > Can somebody patiently answer this.
> > >
> > > Also would this work with PCIe?
> > >
> > > Thanks
> > > Arif
> > >
> > >
> >
> _______________
> > > Express yourself instantly with MSN Messenger!
> > Download today - it’s FREE!
> > >
> >
> http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/
> > >
> > >
> >
> >
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> > http://www.osronline.com/article.cfm?id=256
> >
> > To unsubscribe, visit the List Server section of OSR
> > Online at
> > http://www.osronline.com/page.cfm?name=ListServer
> >
>
>
>

> Do You Yahoo!?
> Tired of spam? Yahoo! Mail has the best spam protection around
> http://mail.yahoo.com
>
> —
> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

You don’t actually BELIEVE this, do you? Seriously, THINK about what somebody could do with such a driver by spending a few days sending arbitrary IOCTLs to it.

Diagnostics are often inherently not secure. Just please don’t ship this driver to customers, OK?

Peter
OSR