how can a TCM backdoor be used?

76 views
0 Comments

Hello

I am a software engineer and recently came accross something called TCM backdoors while reading a linker script. Although I tried reading about it online I didn’t quite understand what it is nor how it can be used precisely. Could someone please eli5 this?

I always thought backdoors were some breach hackers found in software

Thank you

Edit: this is the exact line I found

/* 0x20100000 0x2010FFFF 64KB TCM Backdoor */

In: 4

1 Answer

Anonymous 0 Comments

TCM is “tightly coupled memory”. It is ultra-fast memory which is very tightly integrated into a CPU core. It’s very similar to CPU cache, except cache is just a convenient copy of data in main RAM/flash, whereas TCM is it’s own RAM with it’s own memory address range. This way a programmer has complete control over what goes into TCM.

TCM is useful in CPUs intended for control systems, because the CPU is guaranteed to have very fast access to data in TCM. Access to data or program code in TCM is much faster than access to system RAM or flash memory. TCM therefore ensures faster execution of time critical code, and more importantly, it ensures consistent timing of code execution – code or data in regular RAM or flash may or may not be in the CPU cache and therefore may have either slow or fast execution.

The drawback of TCM is that it is tightly integrated into the CPU core – this means that peripherals outside the CPU core may not have access to it. For example, if you have a USB port, which can stream data direct from RAM via DMA, it may not be able to access TCM, because the TCM is not connected to the main system bus with the rest of the RAM.

The same issue can occur on multi-CPU or multi-core systems. Now consider the situation where an OS is booting up on core 0, and as part of start up it is loading up a critical driver which will run directly from TCM on core 1. How does core 0 access TCM on core 1, if it is internal to core 1?

The answer is that there is a backdoor from the TCM onto the main system bus, so that other cores and peripherals are able to access it if needed – but the backdoor is a slow approach, so would not be the normal way the TCM is accessed from it’s own core.