[comp.sys.att] Bug in /dev/mem driver on Unix PC, patch provided

ford@kenobi.UUCP (Mike Ditto) (10/23/87)

Unrelated-Comment: my 'renice' command is coming soon to a news site near you




I have discovered a bug in the device driver for /dev/mem on the Unix PC.
The bug prevents writing to /dev/mem.  /dev/kmem works fine, as does reading
from /dev/mem.  In case anyone has a need to write to /dev/mem, I am enclosing
a patch to the kernel which I wrote to fix the problem.  The script patches
/unix as well as the copy in memory, so no reboot is required.

Warning:  It is up to you to back up your /unix if you want to.


Technical description of the bug and the fix:

	The /dev/mem driver creates a pte (page table entry) for an unused
vertual address in the kernel, describing the physical page to be accessed.
It manipulates the actual hardware page table (at address 0x400000) to do
this.  Because these are hardware registers rather than real memory locations,
some restrictions apply to their use.  One restriction is that they must only
be written to with WORD-long instructions.  Unfortunately, the C compiler used
to compile the kernel doesn't know this, and it over-optimized the code into
some faster BYTE-long instructions, which do not work on these registers.
	My patch replaces the bad instructions with good ones, obviously 8-).
Fortunately, the code that was bad was also rather sloppy, so the fix is
smaller than the code it replaces.  In fact, the fix is two instructions
plus seven no-ops.


Here is the shell script, which must be run as root.

# ------------------------ cut here ------------------------
: kernel patch to allow writing to /dev/mem

if [ ! -w /unix ]
then
	echo "$0: no permission for /unix" 1>&2
	exit 1
fi

for MAP in '?' '/'
do
adb -w /unix /dev/kmem << Zippy_The_Pinhead
mmwrite+0c2${MAP}w 0041
mmwrite+0c4${MAP}w 0a000
mmwrite+0c6${MAP}w 3081
mmwrite+0c8${MAP}w 4e71
mmwrite+0ca${MAP}w 4e71
mmwrite+0cc${MAP}w 4e71
mmwrite+0ce${MAP}w 4e71
mmwrite+0d0${MAP}w 4e71
mmwrite+0d2${MAP}w 4e71
mmwrite+0d4${MAP}w 4e71
Zippy_The_Pinhead
done

exit
# ------------------------ cut here ------------------------

ford@crash.CTS.COM (Michael Ditto) (10/24/87)

In article <18@kenobi.UUCP> I posted a kernel patch to fix a bug in /dev/mem.
I very thoughtlessly neglected to say that this patch is only known to work
on 3.51 (or 3.51.1) of Unix.  If the driver was not changed between 3.5 and
3.51, then it should work on 3.5 as well, but I would have to disassemble
a few bytes out of the older kernel to see if the patch applies to it.

If anyone out there has a version other than 3.51 and needs this patch to
work, send me mail at the address below.
-- 

Mike Ditto					-=] Ford [=-
P.O. Box 1721					ford%kenobi@crash.CTS.COM
Bonita, CA 92002				ford@crash.CTS.COM