Cannot get I/O access to '/dev/mem'

[Ricky-Tigg]

Hello. My attempt to get I/O access to '/dev/mem' fails. May the details provided be somehow useful to investigate what prevents it.

$ hostnamectl | sed -n '8p;12p' | awk '$1=$1'
Operating System: Fedora Linux 44 (Workstation Edition)
Kernel: Linux 7.1.7-200.fc44.x86_64

Parameters the kernel was compiled with that are relevant for this report:

$ grep _STRICT_DEVMEM /boot/config-$(uname -r)
CONFIG_STRICT_DEVMEM=y
CONFIG_IO_STRICT_DEVMEM=y

I learned that the main kernel configuration option for controlling I/O access to '/dev/mem' is 'CONFIG_STRICT_DEVMEM'. Lacking knowledge to recompile the kernel, thus my alternative was to add the parameter/key 'strict-devmem=0' to my kernel cmdline:

$ cat /etc/kernel/cmdline
root=UUID=(...) ro rootflags=subvol=root rhgb quiet strict-devmem=0

Test

$ sudo dd if=/dev/mem of=/dev/null
dd: error reading '/dev/mem': Operation not permitted
2048+0 records in
2048+0 records out
1048576 bytes (1.0 MB, 1.0 MiB) copied, 0.0943418 s, 11.1 MB/s

This program

$ file -b avml
ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), static-pie linked, BuildID[sha1]=669c613fbe2bc57310816a6071922ee2203ed86f, stripped
$ stat avml | sed -n '3,4p'
Device: 0,53	Inode: 831989      Links: 1
Access: (0755/-rwxr-xr-x)  Uid: (1000/...)   Gid: (1000/...)

No permission correlated

$ ./avml acquire --source /dev/mem mem_dump
Error: error: unable to parse /proc/iomem
caused by:
    0: need CAP_SYS_ADMIN to read /proc/iomem

Expected!

$ sudo !!
sudo ./avml acquire --source /dev/mem mem_dump
Error: error: unable to read memory
caused by:
    0: unable to create memory snapshot from source: /dev/mem
    1: unable to create memory snapshot
    2: write block failed: 1048576..2483167231
    3: io error: unable to read memory page
    4: Operation not permitted (os error 1)

I cannot say whether the layout that is presented in 'cat /proc/iomem' represents what is readable within that limit. That seems to me out of topic though.

So, I thought I could expect that the operation would be at last permitted. Since it is not, it's still limited to the first megabyte, which is as expected on a recent Linux kernel. May I ask, do you happen to have a suggestion on this matter?

[Ricky-Tigg]

I will continue my investigation; you mustn't think you have to conduct it all alone. I note that the results of './avml acquire --source /dev/mem /dev/null > /dev/null' and of the same run with 'sudo' indicate that the expression 'error:' is iterated. One mention of it in each stderr is certainly enough to be meaningful, therefore there should be no need for iteration.

[Ricky-Tigg]

Despite being as root, my kernel may still prevent access to I/O according to a default security policy. Since the date of the report, I appended 'iomem=relaxed' to /etc/default/grub's parameter GRUB_CMDLINE_LINUX.

$ cat /proc/cmdline 
BOOT_IMAGE=(hd0,gpt2)/vmlinuz-7.1.8-200.fc44.x86_64 root=UUID=(...) ro rootflags=subvol=root rhgb quiet strict-devmem=0 iomem=relaxed

Not yet the solution.

Regarding the message that is emitted, it could be about I/O ports but not MMIO (devmem), and relating to one of those parameters:

$ grep ^CONFIG_ /boot/config-$(uname -r) \
| grep -E 'STRICT_DEVMEM|LOCK_DOWN'
CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y
CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
CONFIG_STRICT_DEVMEM=y
CONFIG_IO_STRICT_DEVMEM=y

Logs

While running this program

$ sudo journalctl --no-pager -f -p 7
(...) sudo[17340]:       (_user_) : TTY=pts/2 ; PWD=/home/(...) ; USER=root ; COMMAND=./avml acquire --source /dev/mem /dev/null
(...) systemd-logind[763]: Existing logind session ID 21 used by new audit session, ignoring.
(...) systemd-logind[763]: New session 'c52' of user 'root' with class 'user-early' and type 'tty'.
(...) systemd[1]: Started session-c52.scope - Session c52 of User root.
(...) sudo[17340]: pam_systemd(sudo:session): Failed to check if /run/user/0/bus exists, ignoring: Permission denied
(...) sudo[17340]: pam_unix(sudo:session): session opened for user root(uid=0) by yk(uid=1000)
(...) sudo[17340]: pam_unix(sudo:session): session closed for user root
(...) systemd[1]: session-c52.scope: Deactivated successfully.
(...) systemd-logind[763]: Session c52 logged out. Waiting for processes to exit.
(...) systemd-logind[763]: Removed session c52.

And if needed

$ sudo journalctl --no-pager -k -p 3 -p 4
(...) kernel: i915 0000:00:02.0: [drm] *ERROR* Atomic update failure on pipe A (start=254979 end=254980) time 123 us, min 1073, max 1079, scanline start 1072, end 1080
(...) fedora kernel: [Firmware Bug]: TSC ADJUST differs: CPU0 0 --> -292677912. Restoring
(...) fedora kernel: xhci_hcd 0000:00:14.0: xHC error in resume, USBSTS 0x411, Reinit
(...) fedora kernel: usb 1-8: WARN: invalid context state for evaluate context command.