Messages in this thread | | | Date | Thu, 25 Jul 2019 16:42:11 -0400 | From | Paul Cercueil <> | Subject | Re: [PATCH] MIPS: Add support for partial kernel mode on Xburst CPUs |
| |
Le jeu. 25 juil. 2019 à 12:59, Paul Burton <paul.burton@mips.com> a écrit : > Hi Paul, > > On Wed, Jul 24, 2019 at 07:46:54PM -0400, Paul Cercueil wrote: >> Support partial kernel mode of Xburst CPUs found in Ingenic SoCs. >> Partial kernel mode means the userspace applications have access to >> the TCSM0 banks of the VPU, > > So far so (reasonably) good :) > >> and can execute cache instructions. > > Aaaah! Scary! > > Does this allow *all* cache instructions? If so that's a big security > & > stability hole - if userland can invalidate kernel data or data from > other programs then it can create all sorts of chaos.
It looked a bit fishy to me as well, but I couldn't point a finger to the exact problem. I don't exactly know what it allows and what it doesn't.
> Also do you know which Ingenic SoCs this is available on? I see it > documented in the JZ4780 Programming Manual, but Config7 bit 6 is > shown > as reserved in my copy of the XBurst1 CPU Core Programming Manual.
I have no idea. I assume all SoCs with a VPU. I know the JZ4770 has it.
> I notice the JZ4780 documentation says it allows access "including > TCSM, > CACHE instructions" which is scary too since it doesn't say that's > *all* > it allows access to. Though just cache instructions by themselves are > enough to be game over for any notion of security as mentioned above. > > What is it you want to do with this? I'm wondering if we could achieve > your goal is in a safer way.
The plan was to be able to communicate with the firmware running on the VPU without going through expensive context switches all the time.
I guess we could mmap() the TCSM memories, but we'd need to bypass the data cache (is there a flag for that?).
> Thanks, > Paul
| |