Re: [PATCH] MIPS: Add support for partial kernel mode on Xburst CPUs

[Paul Cercueil]

Le jeu. 25 juil. 2019 à 12:59, Paul Burton <paul.burton@xxxxxxxx> a 
écrit :
> Hi Paul,
>
> On Wed, Jul 24, 2019 at 07:46:54PM -0400, Paul Cercueil wrote:
> >  Support partial kernel mode of Xburst CPUs found in Ingenic SoCs.
> >  Partial kernel mode means the userspace applications have access to
> >  the TCSM0 banks of the VPU,
>
> So far so (reasonably) good :)
>
> >  and can execute cache instructions.
>
> Aaaah! Scary!
>
> Does this allow *all* cache instructions? If so that's a big security 
> &
> stability hole - if userland can invalidate kernel data or data from
> other programs then it can create all sorts of chaos.

It looked a bit fishy to me as well, but I couldn't point a finger to
the exact problem. I don't exactly know what it allows and what it
doesn't.

> Also do you know which Ingenic SoCs this is available on? I see it
> documented in the JZ4780 Programming Manual, but Config7 bit 6 is 
> shown
> as reserved in my copy of the XBurst1 CPU Core Programming Manual.

I have no idea. I assume all SoCs with a VPU. I know the JZ4770 has it.

> I notice the JZ4780 documentation says it allows access "including 
> TCSM,
> CACHE instructions" which is scary too since it doesn't say that's 
> *all*
> it allows access to. Though just cache instructions by themselves are
> enough to be game over for any notion of security as mentioned above.
>
> What is it you want to do with this? I'm wondering if we could achieve
> your goal is in a safer way.

The plan was to be able to communicate with the firmware running on the
VPU without going through expensive context switches all the time.

I guess we could mmap() the TCSM memories, but we'd need to bypass the
data cache (is there a flag for that?).

> Thanks,
>     Paul