/dev/mem permissions

pavan8085 · 05-26-2011, 01:49 AM

Hi All,

I've a set of questions regarding /dev/mem-

1. Many articles on the net, seem to refer /dev/mem as the gateway to "Physical RAM". But if I am right, /dev/mem is the gateway to the "Physical Address Space" of the processor which might include control registers of many HW peripherals and not just the RAM? Please correct me if I am wrong!

2. In order to prevent attackers from misusing /dev/mem and altering kernel memory, a flag CONFIG_STRICT_DEVMEM needs to be enabled which will prevent user apps from accessing physical address space beyond 1MB. I checked the config file on my PC ( Ubuntu ) and found that CONFIG_STRICT_DEVMEM = y. And I wrote a program which tries to read to physical memory beyond 1 MB and I was able to read!! No segmentation fault or any operation permitted error. How is this possible?
(
My program roughly looks like this-
fd=open ( "/dev/mem", O_RDWR);
ptr=(int*)mmap(0,MAP_SIZE,PROT_READ, fd, myAddress & (~MAP_MASK));
printf("%d",*ptr);
)

Thanks,
Pavan

neonsignal · 05-27-2011, 11:13 AM

Quote:

/dev/mem is the gateway to the "Physical Address Space" of the processor which might include control registers of many HW peripherals and not just the RAM?

Yes it does include peripherals, because there is a preference for using memory mapped I/O in x86 systems. It is still the physical memory space, so the name of the device is reasonable (see also /dev/port).

A segmentation fault won't happen until the read occurs (I'm not clear what values you are using for 'myAddress' and 'MAP_MASK'. But you will need to check the result of the mmap. On my system it is accessible up to 0x101000.

For example, the following code fragment would typically fail, since the CONFIG_STRICT_DEVMEM=y will cause the mmap to fail:

Code:

   int fd = open("/dev/mem", O_RDWR);
   char *ptr = mmap(0, 0x180000, PROT_READ, MAP_PRIVATE, fd, 0);
   printf("%u\n", (unsigned int) ptr);
   return *ptr;