Use busybox devmem

This commit is contained in:
Ciro Santilli
2017-08-08 11:56:01 +01:00
parent 68af3477cc
commit 8d668d6ed3
9 changed files with 35 additions and 144 deletions

View File

@@ -1,7 +1,7 @@
/*
Automatically create the device under /dev on insmod, and remove on rmmod.
https://stackoverflow.com/questions/5970595/how-to-create-a-device-node-from-the-init-module-code-of-a-linux-kernel-module
https://stackoverflow.com/questions/5970595/how-to-create-a-device-node-from-the-init-module-code-of-a-linux-kernel-module/45531867#45531867
*/
#include <linux/cdev.h>

View File

@@ -63,7 +63,7 @@ TODO: does it have any side effects? Set in the edu device at:
## Play with registers from the CLI
Use setpci, devmem2 and /sys.
Use setpci, devmem and /sys.
*/
#include <asm/uaccess.h> /* put_user */

View File

@@ -12,7 +12,7 @@ Expected outcome after insmod:
Also without insmodding this module, try:
devmem2 0x101e9000 w 0x12345678
devmem 0x101e9000 w 0x12345678
which touches from userland through /dev/mem.
*/

View File

@@ -1,106 +0,0 @@
/*
Adapted from: http://free-electrons.com/pub/mirror/devmem2.c
Forked because of the unpredictable access widths:
https://bugs.busybox.net/show_bug.cgi?id=10171
*/
#include <ctype.h>
#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <termios.h>
#include <unistd.h>
#define FATAL do { fprintf(stderr, "Error at line %d, file %s (%d) [%s]\n", \
__LINE__, __FILE__, errno, strerror(errno)); exit(1); } while(0)
int main(int argc, char **argv) {
int access_type = 'w';
unsigned long map_size, map_mask;
off_t target;
uintmax_t read_result, writeval;
int fd;
void *map_base, *virt_addr;
map_size = sysconf(_SC_PAGE_SIZE);
map_mask = map_size - 1;
if(argc < 2) {
fprintf(stderr, "\nUsage:\t%s { address } [ type [ data ] ]\n"
"\taddress : memory address to act upon\n"
"\ttype : access operation type : [b]yte, [h]alfword, [w]ord\n"
"\tdata : data to be written\n\n",
argv[0]);
exit(1);
}
target = strtoul(argv[1], 0, 0);
if(argc > 2)
access_type = tolower(argv[2][0]);
if((fd = open("/dev/mem", O_RDWR | O_SYNC)) == -1) FATAL;
printf("/dev/mem opened.\n");
fflush(stdout);
/* Map one page */
map_base = mmap(0, map_size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, target & ~map_mask);
if(map_base == (void *) -1) FATAL;
printf("Memory mapped at address %p.\n", map_base);
fflush(stdout);
virt_addr = map_base + (target & map_mask);
switch(access_type) {
case 'b':
read_result = *((uint8_t *) virt_addr);
break;
case 'h':
read_result = *((uint16_t *) virt_addr);
break;
case 'w':
read_result = *((uint32_t *) virt_addr);
break;
case 'q':
read_result = *((uint64_t *) virt_addr);
break;
default:
fprintf(stderr, "Illegal data type '%c'.\n", access_type);
exit(2);
}
printf("Value at address 0x%jX (%p): 0x%jX\n", (uintmax_t)target, virt_addr, (uintmax_t)read_result);
fflush(stdout);
if(argc > 3) {
writeval = strtoul(argv[3], 0, 0);
switch(access_type) {
case 'b':
*((uint8_t *) virt_addr) = writeval;
read_result = *((uint8_t *) virt_addr);
break;
case 'h':
*((uint16_t *) virt_addr) = writeval;
read_result = *((uint16_t *) virt_addr);
break;
case 'w':
*((uint32_t *) virt_addr) = writeval;
read_result = *((uint32_t *) virt_addr);
break;
case 'q':
*((uint64_t *) virt_addr) = writeval;
read_result = *((uint64_t *) virt_addr);
break;
}
printf("Written 0x%jX; readback 0x%jX\n", (uintmax_t)writeval, (uintmax_t)read_result);
fflush(stdout);
}
if(munmap(map_base, map_size) == -1) FATAL;
close(fd);
return 0;
}

View File

@@ -48,7 +48,7 @@ see: https://stackoverflow.com/questions/11891979/how-to-access-mmaped-dev-mem-w
Then:
devmem2 0x7c7b800
devmem 0x7c7b800
Possible output:
@@ -60,7 +60,7 @@ to our physical address and given to the process that mapped /dev/mem.
And finally, let's change the value!
devmem2 0x7c7b800 w 0x9abcdef0
devmem 0x7c7b800 w 0x9abcdef0
After one second, we see on the screen: