question upon RtlCopyMemory inside the BalloonFill

[jshen28]

Hello,

I am trying to learn the basics by reading the code. I am newbie to windows driver programming and would like to have one question get answered..

I believe that function BalloonFill is called for inflate the balloon by first requesting a memory region and send back the reserved memory address to the balloon backend device. I believe the memory is requested by calling MmAllocatePagesForMdlEx. What caused me confused is RtlCopyMemory(ctx->pfns_table, MmGetMdlPfnArray(pPageMdl), ctx->num_pfns * sizeof(PFN_NUMBER)), by searching the definition I think MmGetMdlPfnArray should return an array of physical memory addresses for the pPageMdl, so it should be physical memory already. Then why in BalloonTellHost, the address is translated again by calling VirtIOWdfDeviceGetPhysicalAddress?

Thank you very much in advance for the help.

Best,
Jiatong Shen

[viktor-prutyanov]

Hi @jshen28

MDL has guest physical addresses, but we must pass DMA addresses (or logical address in Windows DMA API terminology) to hypervisor.

The difference between these kinds of addresses will appear if you have an IOMMU device enabled in QEMU, for example intel-iommu, and DMA remapping enabled in Windows. IOMMU translates DMA addresses (by which devices do memory access) to physical addresses about the same as MMU translates virtual addresses to physical ones.

VirtIOWdfDeviceGetPhysicalAddress finds DMA address for a buffer obtained with DMA API in AllocateCommonBuffer. In DMA API, for WDFCOMMONBUFFER we can call WdfCommonBufferGetAlignedVirtualAddress to obtain the buffer's virtual address, which the driver can access, and WdfCommonBufferGetAlignedLogicalAddress to obtain the buffer's logical address (DMA address in Intel terminology), which the device can access.

For further information I suggest to read:

• Intel Virtualization
  Technology for Directed I/O (VT-d)
• Enabling DMA remapping for device drivers
• Using Common Buffers in WDF DMA API

[jshen28]

Hi @viktor-prutyanov ,

thank you very much for the detailed explanation. If I do not pass virtio-iommu or other iommu device to the qemu, then can I suggest guest physical address is equal to the DMA address?

Best,
Jiatong Shen

[viktor-prutyanov]

Yes

[vrozenfe]

@jshen28

To pass data from guest to host virtio uses some sort of DMA SGList abstraction. When it comes to building a SG element
https://github.com/virtio-win/kvm-guest-drivers-windows/blob/master/Balloon/sys/balloon.c#L281C89-L281C99
we need the physical address of the buffer that is going to be passed to QEMU and it's length. Eventually that physical address is the buffer's virtual address translated with nt!Mm(Mi)GetPhysicalAddress function.
Best,
Vadim.

[jshen28]

thank you very much. what confuses me is here in

kvm-guest-drivers-windows/Balloon/sys/balloon.c

Line 250 in 322f1a4

RtlCopyMemory(ctx->pfns_table, MmGetMdlPfnArray(pPageMdl),

, looks like pfns_table should be populated with return of MmGetMdlPfnArray which should be physical address? Then why this address is translated again with VirtIOWdfDeviceGetPhysicalAddress

[vrozenfe]

not sure if I fully understand the question.
pfns_table by itself is a virtual address of one page buffer. When inflating balloon, we allocate memory from non-paged pool, and filling up that buffer (pfns_tables) with the PFN array. But when we want to pass the content of pfns_table buffer to qemu as a SG element we need to convert pfns_table virtual address to physical address.
Hope it helps.
Cheers,
Vadim.