Yahoo Groups archive

Lpc2000

Index last updated: 2026-04-28 23:31 UTC

Message

re: CRP exploits using JTAG

2006-02-06 by Jayasooriah

Hi Tom,

If we accept what you say, it appears trading one instruction cycle off the 
window of opportunity for exception handling is a silly thing to do.

The designers made a deliberate tradeoff.  I am asking why.  Does this 
action dismiss the threat or does it just reduce the window of opportunity?

One can only draw inferences from Philips silence that the latter is the case.

Kind regards,

Jaya

PS1:  I am curious as to where it is stated that JTAG cannot run above the 
rate the CPU is running at.

PS2:  In counting instruction cycles, you have to take into account 
pipeline delays.

--- In lpc2000@yahoogroups.com, Tom Walsh <tom@...> wrote:
 > While I respect your desire to look into the CRP, I am not interested in
 > supposition.  As I understand it, the JTAG runs at a fractional rate vs
 > the CPU clock.  You cannot run the JTAG above the rate the CPU is
 > running at.  So, in my way of thinking, the time it would take you to
 > seize control via the JTAG, the processor has had ample time to execute
 > a few instructions to disable further use of the JTAG.
 >
 > I do believe that this is what Philips is doing.  Now, I would be
 > interested in some theoretical / empirical evidence that the JTAG can
 > stop the process in less than those 3 .. 4 opcode executions.  This
 > would evidence a problem indeed.

Send instant messages to your online friends http://au.messenger.yahoo.com

Attachments

Move to quarantaine

This moves the raw source file on disk only. The archive index is not changed automatically, so you still need to run a manual refresh afterward.