Access permissions of /dev/mem

Question

I have a set of questions regarding /dev/mem:

Many articles on the net, seem to refer /dev/mem as the gateway to "Physical RAM". But if I am right, /dev/mem is the gateway to the "Physical Address Space" of the processor which might include control registers of many HW peripherals and not just the RAM? Please, correct me if I am wrong!
In order to prevent attackers from misusing /dev/mem and altering kernel memory, a flag CONFIG_STRICT_DEVMEM needs to be enabled which will prevent user apps from accessing physical address space beyond 1MB. I checked the config file on my PC (Ubuntu) and found that CONFIG_STRICT_DEVMEM = y. And I wrote a program which tries to read to physical memory beyond 1 MB and I was able to read! No segmentation fault or any Operation NOT Permitted error. How is this possible?

My program roughly looks like this:

fd = open ( "/dev/mem", O_RDWR);
ptr = (int*) mmap(0, MAP_SIZE, PROT_READ, fd, myAddress & (~MAP_MASK));
printf("%d", *ptr);

You are actually reading or just mmap-ing it? – Torp May 26 '11 at 07:26 — Torp, May 26 '11 at 07:26

score 14 · Accepted Answer · answered May 27 '11 at 05:53

Yes, you're right, /dev/mem allows you to map any physical address, including non-RAM memory mapped IO. This can can be useful for a quick and dirty hack to access some hardware device without writing a kernel driver.
CONFIG_STRICT_DEVMEM makes the kernel check addresses in /dev/mem with devmem_is_allowed() in arch/x86/mm/init.c, and the comment there explains:
```
* On x86, access has to be given to the first megabyte of ram because that area
* contains bios code and data regions used by X and dosemu and similar apps.
* Access has to be given to non-kernel-ram areas as well, these contain the PCI
* mmio resources as well as potential bios/acpi data regions.
```
your address 0xFFFF0000 is quite likely to be non-RAM, since BIOSes typically put IO memory just below 4GB, so that's why you're able to map it even with STRICT_DEVMEM.

score 3 · Answer 2 · answered May 26 '11 at 08:23

3

What does the follow yield:

cat /dev/mem | wc

I get:

cat: /dev/mem: Operation not permitted
   1908   11791 1048576

So for me it does stop at 1MB.

Note that cat uses open, not mmap so its not an identical test.

Are you sure you're reading beyond 1MB?

answered May 26 '11 at 08:23

linuts

This is the program I am running [link](http://designsomething.org/leopardboard/f/22/t/77.aspx) And then I run 'code'sudo ./a.out 0xFFFF0000'code' and I get the output as 'code'/dev/mem opened. Memory mapped at address 0x7fbf1409f000. Value at address 0x0 (0x7fbf1409f000): 0xF000E819'code' – Pavan Manjunath May 26 '11 at 09:04
I need to write a /dev/mem driver that will access all of physical memory, this is for a memory diagnostic tool. If I change CONFIG_STRICT_DEVMEM to =N, will that allow access to all phy. memory? Do I have to rebuild the kernel or just the mem driver module? thx – philbrooksjazz Dec 28 '15 at 23:32

2 Answers2