Yahoo Groups archive

Lpc2000

Index last updated: 2026-04-28 23:31 UTC

Message

Re: [lpc2000] re: CRP exploits using JTAG

2006-02-05 by Tom Walsh

Jayasooriah wrote:

>What is of concern is that the boot loader designers have chosen to move 
>the code up so that they now disable JTAG in three instructions in stead of 
>four.  This must mean that they are aware of JTAG exploits that defeat CRP.
>
>For those skeptics who said that they consider CRP safe until someone posts 
>the exploit here in the forum, here is another compelling argument to think 
>again.
>
>  
>
While I respect your desire to look into the CRP, I am not interested in 
supposition.  As I understand it, the JTAG runs at a fractional rate vs 
the CPU clock.  You cannot run the JTAG above the rate the CPU is 
running at.  So, in my way of thinking, the time it would take you to 
seize control via the JTAG, the processor has had ample time to execute 
a few instructions to disable further use of the JTAG.

I do believe that this is what Philips is doing.  Now, I would be 
interested in some theoretical / empirical evidence that the JTAG can 
stop the process in less than those 3 .. 4 opcode executions.  This 
would evidence a problem indeed.

Regards,

TomW


-- 
Tom Walsh - WN3L - Embedded Systems Consultant
http://openhardware.net, http://cyberiansoftware.com
"Windows? No thanks, I have work to do..."
----------------------------------------------------

Attachments

Move to quarantaine

This moves the raw source file on disk only. The archive index is not changed automatically, so you still need to run a manual refresh afterward.