none
IoGetDmaAdapter block too few pages RRS feed

  • Question

  • Hello,

    I have created a PCI interface board that xmits lots of data from the physical RAM to an external device by a DMA transfer.
    I did a kernel driver for Windows 7 (32 bits) which works perfectly.

    Now I am trying to use the same kernel driver with Windows 10 (32 bits) but I get unexpected results.
    I was using the original (non modified) driver and also re-compiled it with the newest DDK (both behave identical)
    Then I tested them on a couple of PCs. Here my headache:

    Case 1: PC#1: Works ok.
    Case 2: PC#2: does not work.

    Digging into the reasons by logfiles, I found that a call to IoGetDmaAdapter delivers in its return parameter “NumberOfMapRegisters” far less pages (~some thousand) than expected.
    On the ‘working’ PC, the value is at least 10 if not 100 times bigger.

    I think I can exclude a severe programming error, since the driver has been working for years without any problem and the driver even passed the WHQL test lab years ago.

    Now my questions:
    Q1: What influences the value that IoGetDmaAdapter returns in its NumberOfMapRegisters value.
    It certainly will depend on the amount of RAM on that system (PC#1 and PC#2 have same amount 2 GB) but what else might lead to such a significant difference?

    Q2: I simply have no idea what might cause this big difference. Does any have a guess, or even know?

    Thx

    George

    --- For your reference ---
    The IoGetDmaAdapter routine returns a pointer to the DMA adapter structure for a physical device object.

    struct _DMA_ADAPTER* IoGetDmaAdapter(
      _In_opt_ PDEVICE_OBJECT             PhysicalDeviceObject,
      _In_     struct _DEVICE_DESCRIPTION *DeviceDescription,
      _Out_    PULONG                     NumberOfMapRegisters
    );

    Thursday, August 2, 2018 6:06 PM

Answers

  • DMA capabilities vary widely across systems, and depends upon things like bus bridge capabilities, amount of physical memory, and how many DMAs are currently in progress. Ultimately, your driver has no control over how many map registers you are given and you must live with what you get. Yes, that means that your performance may vary wildly across platforms, even those that are seemingly similar.

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting. Blog at www.azius.com/blog


    Thursday, August 2, 2018 6:33 PM
    Moderator

All replies

  • DMA capabilities vary widely across systems, and depends upon things like bus bridge capabilities, amount of physical memory, and how many DMAs are currently in progress. Ultimately, your driver has no control over how many map registers you are given and you must live with what you get. Yes, that means that your performance may vary wildly across platforms, even those that are seemingly similar.

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting. Blog at www.azius.com/blog


    Thursday, August 2, 2018 6:33 PM
    Moderator
  • thanks Brian.

    I forgot to mention that "the old" driver works (=gets the exepcted number of NumberOfMapRegisters) on both PCs, if they run Windows 7
    The difference appears once switched to Windows 10 (32 bit) w/o changing the hardware.

    Do you have any idea how to find out what specifically causes the reduction?
    Can I measure the number of DMA tasks running (why should there be more in Windows 10?).

    I simply do not want to give up, yet.

    - George

    Thursday, August 2, 2018 8:47 PM
  • DMA is one of the areas where there is very little visibility into what is going on, principally because the hardware resources are managed at a very low level (HAL and root bus) and the code doesn't output much tracing. I could see the symptoms happening if the failing PC is very old, because they made changes in how legacy systems are supported in Win10 to make them more reliable. Beyond that, I don't know. Unfortunately, the !dma command no longer works reliably.

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting. Blog at www.azius.com/blog

    Thursday, August 2, 2018 8:54 PM
    Moderator
  • Hello,

    in the meantime we got the very computer here in our lab.

    We replaced the HDD (to make sure the original one was not altered) and installed a completely new Windows 10 (32 bit) on the computer.

    Result: It worked (=NumberOfMapRegisters >> 10000).

    We assume the the previous installation has been done by "updating" a Windows 7 installation to Windows 10 and thus leaving 'uncompatible' drivers behind.

    Maybe someone can conjecture what that might have been.

    Thx

    - George

    Wednesday, August 15, 2018 4:32 PM
  • postscriptum:

    We did some more 'research' on this and we found that the amount of RAM memory is a critical factor.
    The 'funny' thing is, that 2 GB RAM works whereas 4 GB does not.

    We were able to work around that by using the proper BCDEdit command.

    I did not *really* understand why Windows behaves like that (and why this was different in Windows 7) but at least the kernel is working again.

    - Georg

    Thursday, November 22, 2018 5:22 PM
  • It also matters where the memory is located in the address space, e.g. how much is above or below the 4GB boundary

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting. Blog at www.azius.com/blog

    Thursday, November 22, 2018 6:26 PM
    Moderator
  • The 'funny' thing is, that 2 GB RAM works whereas 4 GB does not.

    Part of the 4GB RAM needs to be relocated up to make a hole for I/O, and it makes a trouble on this machine? Is this machine too old for 4G RAM?

    -- pa


    • Edited by Pavel A Thursday, November 22, 2018 6:44 PM
    Thursday, November 22, 2018 6:43 PM
  • Is this machine too old for 4G RAM?


    No, it is not. 4GB is detected and works, as far as I can see. The computer, however, is approx eight years old.

    I was told that the phenomenon was not confined to this very computer but could also be observed on other machines.

    After I finally found the workaround I did not spend too much more effort into it ... just kept wondering.

    - Georg

    Thursday, November 29, 2018 12:44 PM