Enter your search terms Submit search form
	Web pdp-10.trailing-edge.com

			4.2 VS. 5.2...
			--------------

	At the end of April 79 Mark Tighe (DDC) sent a memo to Gary
Clearwater (FS) detailing  some possible security risks embedded in
the 8080 Microcode.  These consisted of the following problems:

  (1) One can dial up on the Klinik line and just hit a character and
	the repeat button.  The KS-10 will respond with a ?NA as fast
	as it can.  This will cause all output to stop to the CTY and
	since TOPS-20 cannot  now do anything with the CTY the system
	may crash. What the 8080 should do is hangup the line so that
	this is not possible  and the person on the remote line would
	have to dial up again.
      This was fixed by causing the 8080 to hang up the line after the
	?NA.  The place in the  code  where this got fixed was at line
	number 2201 label MODE0:.  Instead of just returning to caller
	via RET this section (after it prints ?NA) goes to KILL.KLINIK
	to actually hang up the line.  It now  does a JMP KILL.KLINIK.
	In addition another fix would  have  cured the problem anyway.
	This was to allow  simultaneous  output to both CTY and KLINIK
	without causing KLINIK output to delay CTY output  until done.
	Before, the KLINIK had a higher priority  than CTY for output.
	Now, the KLINIK  still  has a higher priority but if both want
	output the time is shared  equally between CTY and KLINIK.  So
	for that situation they are of equal priority.

  (2) One can dial up the KS-10 and as a User Mode KLINIK lockout the
	CTY from output.  This is described in the previous paragraph
	and is fixed as follows:  In 'KS10 to 8080 Character Service'
	the last thing done was to do a JMP TTOCOM which writes  data
	into one of the reserved words (word 31..35) so  that TOPS-20
	can do whatever it wants with it.  Then the 8080 went back to
	null job and picked up another character and since the KLINIK
	was a highest priority took it from there.  So  the CTY never
	got serviced.  The correction in the  code  was to change the
	JMP TTOCOM  to CALL TTOCOM to  output the  character, then to
	return to calling point and to a DI.  Control would just pass
	through the following code which just happened to  be the CTY
	character handling code.  The DI was to  turn  off interrupts
	while the CTY character (if  there was one) was being handled
	so that output  would  alternate between KLINIK character and
	CTY character.  The JMP TTOCOM code used  the  TTOCOM code to
	return. Doing the CALL TTOCOM will use the same return to get
	back to calling point - then the return in the  CTY  code  is
	used as the final return. The CALL TTOCOM, DI code is located
	at line number 2073 at label NULKL:.

  (3) If someone had dialed in on KLINIK (KL 1) and gave password and
	so forth in Protect Mode, someone else could  call  in  after
	and fiddle with the system without being asked for  password.
	This occurred because various places did  not  cause the 8080
	to do a reexamination of the mode it was in when carrier went
	away or someone on KLINIK just hung up.  To fix the following
	sections of code were modified:

	Line 979 was CNZ HANGUP (in the Null job)
	Line 2061 was CALL HANGUP (in the 8080/KS10 character service
	  code where 8080 realizes that the KLINIK comm word  has a 2
	  which indicates 'hangup')
	These lines changed  to CNZ KILL.KLINIK and CALL KILL.KLINIK.
	  KILL.KLINIK is located directly before HANGUP:  and says to
	  clear KLINIK status word via CLRB KLNKSW.  This  will cause
	  a reexamination of the status of the 8080 and KLINIK. Hence
	  a password will be requested in the future.

  (4) DTR would be lost if KS10 was running stand alone (ie. at  the
	KS10> prompt), KLINIK line was active, and carrier went away
	for some reason. Since DTR was gone no one trying to call up
	the KS10 on the KLINIK would succeed. This problem was fixed
	by adding two lines of code to the routine at  label KLNKLT:.
	This routine reexamines the switches and makes sure that DTR
	does not go away - it does LDA STATE followed by OUT DTR.

  (5) TT command does not cause a proper mode change.  If someone at
	the CTY resets password (hangs up the KLINIK line also) then
	says TT, someone can call back and not get  challenged for a
	password.  This is because TT automatically put KLINIK  into
	mode 2 (assumes that a password has already  been  given and
	it was correct) rather  than  putting  it  into  mode 2 if a
	a password has been given but putting it into mode 1 if not.
	This was fixed by adding a  little  code  to  the TT command
	to check to see if the  current  mode is 0 or 1 (no password
	given yet) and not  putting it into mode 2 unless already in
	mode 2 or 3.  The code is as follows:
		LDA	CSLMODE	;Get current mode
		SUI	.MODE2	;Is it less than mode 2
		JP	SETM2	;If no go set mode 2
		CLRB	KLNKSW	;If no clear KLINIK status to force
				;  reexamination of switches..
		RET		;Return

	(Note - in this note when originally written - JP was JM)
 

	The above constitutes the changes made to obtain 5.2 from 4.2
plus an extra one (the last bit of code).  There is another problem
which has come up due to the above fixes.  That is that giving a c-z
on the CTY will cause someone on the KLINIK line to have to type in the
password again, since the KLINIK status word got cleared and 8080 will
not let KLINIK user back on.