PC freezes totally while accessing physical memory on Ubuntu 10.04(64-bit machine)

Question

I am trying to access the physical memory of my PC using this program which uses mmap()-

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <errno.h>
#include <signal.h>
#include <fcntl.h>
#include <ctype.h>
#include <termios.h>
#include <sys/types.h>
#include <sys/mman.h>

#define FATAL do { fprintf(stderr, "Error at line %d, file %s (%d) [%s]\n", \
  __LINE__, __FILE__, errno, strerror(errno)); exit(1); } while(0)

#define MAP_SIZE 4096UL
#define MAP_MASK (MAP_SIZE - 1)

int main(int argc, char **argv) {
    int fd;
    void *map_base, *virt_addr;
    unsigned long read_result, writeval;
    off_t target;
    int access_type = 'w';

    if(argc < 2) {
        fprintf(stderr, "\nUsage:\t%s { address } [ type [ data ] ]\n"
            "\taddress : memory address to act upon\n"
            "\ttype    : access operation type : [b]yte, [h]alfword, [w]ord\n"
            "\tdata    : data to be written\n\n",
            argv[0]);
        exit(1);
    }
    target = strtoul(argv[1], 0, 0);

    if(argc > 2)
        access_type = tolower(argv[2][0]);


    if((fd = open("/dev/mem", O_RDWR | O_SYNC)) == -1) FATAL;
    printf("/dev/mem opened.\n");
    fflush(stdout);

    /* Map one page */
    map_base = mmap(0, MAP_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, fd, target & ~MAP_MASK);
    if(map_base == (void *) -1) FATAL;
    printf("Memory mapped at address %p.\n", map_base);
    fflush(stdout);

    virt_addr = map_base + (target & MAP_MASK);
    switch(access_type) {
        case 'b':
            read_result = *((unsigned char *) virt_addr);
            break;
        case 'h':
            read_result = *((unsigned short *) virt_addr);
            break;
        case 'w':
            read_result = *((unsigned long *) virt_addr);
            break;
        default:
            fprintf(stderr, "Illegal data type '%c'.\n", access_type);
            exit(2);
    }
    printf("Value at address 0x%X (%p): 0x%X\n", target, virt_addr, read_result);
    fflush(stdout);

    if(argc > 3) {
        writeval = strtoul(argv[3], 0, 0);
        switch(access_type) {
            case 'b':
                *((unsigned char *) virt_addr) = writeval;
                read_result = *((unsigned char *) virt_addr);
                break;
            case 'h':
                *((unsigned short *) virt_addr) = writeval;
                read_result = *((unsigned short *) virt_addr);
                break;
            case 'w':
                *((unsigned long *) virt_addr) = writeval;
                read_result = *((unsigned long *) virt_addr);
                break;
        }
        printf("Written 0x%X; readback 0x%X\n", writeval, read_result);
        fflush(stdout);
    }

    if(munmap(map_base, MAP_SIZE) == -1) FATAL;
    close(fd);
    return 0;
}

When I run this program as sudo./a.out 0xfdff8000, my system simply hangs. Mouse, keyboard, display everything freeze. Restart is the only option. I checked for 0xfdff8000 in /proc/iomem. It corresponds to ICH HD audio. I am not sure what this means, Also kmsg, dmesg and /var/log/messages are not throwing any hints!

Answer 1

You're reading a word from someplace in your chipset's IO memory. I can't tell you exactly why this freezes your system, but peeking and poking into IO memory without knowing what hardware register is at the address or what the right way to program the hardware in question is quite likely to freeze your system.

Answer 2

You should not be accessing physical memory directly. What is likely happening is that a page table entry is set up with that address that's a memory mapped pointer to a device. Reading from it without permission will crash the system as it will send the OS an interrupt error that it is not expecting.

Remember that physical addresses and virtual addresses are completely different. The addresses which your program reads are all virtual and I believe the only way to get the physical address (which you cannot access unless mapped) is to do a linear address conversion which is hardware dependent (for example x86 kernel function convert_ip_to_linear).

The likely crash cause is unsafe access because drivers usually run one ring level higher than userspace and you are causing an access violation trying to read that from userspace instead of driver level space.