archive mirror
 help / color / mirror / Atom feed
From: "Richard B. Johnson" <>
To: Linux kernel <>
Subject: Linux 2.4.20 RTC Timer bug
Date: Wed, 16 Jul 2003 16:31:15 -0400 (EDT)	[thread overview]
Message-ID: <Pine.LNX.4.53.0307161626240.30604@chaos> (raw)

#if 0

In Linux 2.4.20, some rogue is incrementing the value
in register 0x71 at about 1 second intervals!  This
port is the index register for the CMOS timer chip
and it must be left alone when the chip is not being
accessed and it must be left at an unused offset,
typically 0xff, after access. This is to prevent
destruction of CMOS data during the power-down

This code clearly shows that somebody is mucking with
this chip. Here, I have reviewed the only drivers
installed, SCSI and network, and have not found anybody
messing with this chip so I think it must be something
in the kernel proper. The numbers increase at 1 second
intervals from 0 to 89 and then restart. This shows that
it is not residual from the system clock code that will
read only the timer registers.

These are the only modules installed...

Module                  Size  Used by
ipchains               41400   7
3c59x                  28224   1  (autoclean)
nls_cp437               4376   4  (autoclean)
BusLogic               35768   7
sd_mod                 10184  14
scsi_mod               54572   2  [BusLogic sd_mod]

This running of the CMOS timer index register is the
reason why the CMOS checksum and parameters are being
lost on several systems that run 2.4.20. If any of
these system are turned off when the index register
points to checksummed data, the byte at that location
will get smashed to whatever is on the bus when the
power fails. To non-believers, note that the chip-select
goes low to enable ... and that's what a power failure
does ... goes low, while internally, the chip still has
power from its battery.


#include <stdio.h>

__inline__ int inb()
	register int eax = 0;
	__asm__ volatile ("inb	$0x71, %%al" : "=eax" (eax));
	return eax;

extern int iopl(int);
extern int usleep(int);

int main()

        printf("%d\n", inb());

Dick Johnson
Penguin : Linux version 2.4.20 on an i686 machine (797.90 BogoMips).
            Note 96.3% of all statistics are fiction.

             reply	other threads:[~2003-07-16 20:13 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2003-07-16 20:31 Richard B. Johnson [this message]
2003-07-16 21:18 ` Linux 2.4.20 RTC Timer bug Willy Tarreau
2003-07-17 11:25   ` Richard B. Johnson
2003-07-17 19:17     ` Willy Tarreau
     [not found]       ` <Pine.LNX.4.53.0307171624510.12702@chaos>
     [not found]         ` <20030718043129.GA3229@alpha.home.local>
2003-07-18 12:39           ` Richard B. Johnson

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=Pine.LNX.4.53.0307161626240.30604@chaos \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).