9 ms·
Could this a debugging instruction that was mistakenly left enabled in production or possibly even an intentional backdoor? Most modern ISAs like RISC-V provid
by devit 2y ago
Could this a debugging instruction that was mistakenly left enabled in production or possibly even an intentional backdoor?
Most modern ISAs like RISC-V provide no way of directly accessing physical memory regardless of privilege (you have to either disable paging or setup page tables to point to the physical memory you want), so it seems unlikely that one could accidentally implement one.
In case of an intentional backdoor it seems surprising that it would not be authenticated with a secret key, but maybe they are very incompetent.
- akira2501 2y ago> Could this a debugging instruction Highly unlikely. It's an actual vector instruction that you would otherwise use. The problem is it bypasses page table protections when invoked with memory operands. There is no debugging utility in this mechanism.
- dpeckett 2y agoSecondly the extension is explicitly marked as experimental and is disabled on pretty much all kernel builds. Some of these platforms are incredibly janky atm, so I'm not at all surprised that something like this could slip through. The real surprise is scaleway rushing them into production.
- devit 2y agoIt seems it's an invalid encoding if I understand the article correctly. There seems to be some debugging utility in such a mechanism, e.g. you could use it to run CPU tests, benchmarks or debug code in userspace of a stock OS and then directly communicate with serial port MMIO without needing to pollute the CPU state with a system call or change the kernel to directly map the MMIO into userspace.