lkml.org 
[lkml]   [2019]   [Jul]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] MIPS: Add support for partial kernel mode on Xburst CPUs


Le jeu. 25 juil. 2019 à 12:59, Paul Burton <paul.burton@mips.com> a
écrit :
> Hi Paul,
>
> On Wed, Jul 24, 2019 at 07:46:54PM -0400, Paul Cercueil wrote:
>> Support partial kernel mode of Xburst CPUs found in Ingenic SoCs.
>> Partial kernel mode means the userspace applications have access to
>> the TCSM0 banks of the VPU,
>
> So far so (reasonably) good :)
>
>> and can execute cache instructions.
>
> Aaaah! Scary!
>
> Does this allow *all* cache instructions? If so that's a big security
> &
> stability hole - if userland can invalidate kernel data or data from
> other programs then it can create all sorts of chaos.

It looked a bit fishy to me as well, but I couldn't point a finger to
the exact problem. I don't exactly know what it allows and what it
doesn't.

> Also do you know which Ingenic SoCs this is available on? I see it
> documented in the JZ4780 Programming Manual, but Config7 bit 6 is
> shown
> as reserved in my copy of the XBurst1 CPU Core Programming Manual.

I have no idea. I assume all SoCs with a VPU. I know the JZ4770 has it.

> I notice the JZ4780 documentation says it allows access "including
> TCSM,
> CACHE instructions" which is scary too since it doesn't say that's
> *all*
> it allows access to. Though just cache instructions by themselves are
> enough to be game over for any notion of security as mentioned above.
>
> What is it you want to do with this? I'm wondering if we could achieve
> your goal is in a safer way.

The plan was to be able to communicate with the firmware running on the
VPU without going through expensive context switches all the time.

I guess we could mmap() the TCSM memories, but we'd need to bypass the
data cache (is there a flag for that?).

> Thanks,
> Paul


\
 
 \ /
  Last update: 2019-07-25 22:43    [W:0.060 / U:0.044 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site