【45】busybox devmem 访问所有地址（内存+MMIO）

逃离我推掉我的手 2023-06-19 09:47 9阅读 0赞

调试amd\_iommu时想看一下iommu的device table中存的数据，通过busybox 访问amd\_iommu的BAR的0地址，然后可以获取device table的地址（0x6800 01FF），但是device table是个全局的数组，其地址是内存中预留的，这个地址devmem是没有权限访问的，正如图中那样，访问该地址话，busybox提示**operation not permitted**。那么怎么可能访问到内存的地址呢？  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xpbmppYXNlbg_size_16_color_FFFFFF_t_70]  
 &emsp查看config文件中，CONFIG\_STRICT\_DEVMEM为，限制用户态通过dev/mem访问所有memroy地址。  
If this option is **disabled**, you allow **userspace (root) access to all of memory**, including **kernel and userspace memory**. Accidental access to this is obviously disastrous, but specific access can be used by people debugging the kernel. Note that with PAT support enabled, even in this case there are restrictions on /dev/mem use due to the cache aliasing requirements.

If this option is switched on, the /dev/mem file only allows userspace access to PCI space and the BIOS code and data regions. This is sufficient for dosemu and X and all common users of /dev/mem.

If in doubt, say Y.  
![在这里插入图片描述][2019120517074294.png]  
可以看到devmem访问时被限制的，需要重新编译内核打开限制  
make menuconfig，然后输入/ 搜索STRICT\_DEVMEM，可以看到在kernel hacking有对应配置  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xpbmppYXNlbg_size_16_color_FFFFFF_t_70 1]  
进入 kernel hacking把  
\[ \] Filter access to /dev/mem  
\[ \] Filter I/O access to /dev/mem (NEW)  
前面的\*点掉（上下键选中，然后敲空格）  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xpbmppYXNlbg_size_16_color_FFFFFF_t_70 2]  
vim .config查看CONFIG\_STRICT\_DEVMEM是没有set的，剩下的就是编译内核了  
[编译内核的方式][Link 1]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xpbmppYXNlbg_size_16_color_FFFFFF_t_70 3]  
起来后访问内存还是不行，但是提示从没有权限变成了invalid argument  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xpbmppYXNlbg_size_16_color_FFFFFF_t_70 4]  
对应这个问题linux/lib/Kconfig.debug有说明  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xpbmppYXNlbg_size_16_color_FFFFFF_t_70 5]  
我们需要在配置kernel时，关闭CONFIG\_X86\_PAT=n，同时开启CONFIG\_EXPERT  
或者直接在cmdline加上nopat的配置 \[X86\] Disable PAT (page attribute table extension of pagetables) support.  
![在这里插入图片描述][20191205192107304.png]  
重启系统后，可以正常访问内存的地址了  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xpbmppYXNlbg_size_16_color_FFFFFF_t_70 6]  
我们可以看到devmem读取的和直接hexdump /dev/mem是一样的，只是大小端显示不同。  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xpbmppYXNlbg_size_16_color_FFFFFF_t_70 7]

参考  
https://lwn.net/Articles/267427/  
http://blog.sina.com.cn/s/blog\_6f5b220601012xbc.html  
https://blog.csdn.net/anzhuangguai/article/details/54316206

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xpbmppYXNlbg_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20191205170531645.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xpbmppYXNlbg==,size_16,color_FFFFFF,t_70
[2019120517074294.png]: https://img-blog.csdnimg.cn/2019120517074294.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xpbmppYXNlbg_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20191205171505950.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xpbmppYXNlbg==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xpbmppYXNlbg_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20191205171441578.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xpbmppYXNlbg==,size_16,color_FFFFFF,t_70
[Link 1]: https://blog.csdn.net/linjiasen/article/details/89850357
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xpbmppYXNlbg_size_16_color_FFFFFF_t_70 3]: https://img-blog.csdnimg.cn/20191205171906820.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xpbmppYXNlbg==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xpbmppYXNlbg_size_16_color_FFFFFF_t_70 4]: https://img-blog.csdnimg.cn/20191205191021531.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xpbmppYXNlbg==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xpbmppYXNlbg_size_16_color_FFFFFF_t_70 5]: https://img-blog.csdnimg.cn/20191205191636798.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xpbmppYXNlbg==,size_16,color_FFFFFF,t_70
[20191205192107304.png]: https://img-blog.csdnimg.cn/20191205192107304.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xpbmppYXNlbg_size_16_color_FFFFFF_t_70 6]: https://img-blog.csdnimg.cn/20191205192303394.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xpbmppYXNlbg==,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xpbmppYXNlbg_size_16_color_FFFFFF_t_70 7]: https://img-blog.csdnimg.cn/20191205192706768.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2xpbmppYXNlbg==,size_16,color_FFFFFF,t_70