Skip to content

Commit

Permalink
- update the wording
Browse files Browse the repository at this point in the history
  • Loading branch information
AoteJin committed Sep 25, 2024
1 parent 100a89b commit 85902da
Show file tree
Hide file tree
Showing 3 changed files with 4 additions and 4 deletions.
6 changes: 3 additions & 3 deletions appendix.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ This chapter explains the theory of operation for the External Debug Security Ex

=== Debug Security Control

As outlined in the specification, the dedicated debug security policy for a hart is enforced by platform state `nsecdbg`, hart's state `mdbgen`, and the `sdedbgalw` field inside the `msdcfg` CSR. Both the `nsecdbg` and `mdbgen` states can be accommodated in MMIO outside the harts, such as in the Debug Module registers, or implemented as fuses.
As outlined in the specification, the dedicated debug security policy for a hart is enforced by platform state `nsecdbg`, hart state `mdbgen`, and the `sdedbgalw` field inside the `msdcfg` CSR. Both the `nsecdbg` and `mdbgen` states can be accommodated in MMIO outside the harts, such as in the Debug Module registers, or implemented as fuses.

The security control logic validates all debug requests and triggers (with action=1) firing/matching based on `nsecdbg`, `mdbgen`, and `sdedbgalw` against the privilege level of the hart. Debug requests that fail validation will either be dropped or kept pending. Additionally, the platform-specific external trigger inputs must obey platform constraints, which must be carefully handled by the platform implementation.

Expand All @@ -27,6 +27,6 @@ image::external_debug_trace.png[title="The trace security control",align="center
[appendix]
== Execution Based Implementation with Sdsec

In an execution-based implementation, the code executing the "park loop" can always run with M-mode privilege to access the memory and CSR. However, once execution is dispatched to an abstract command or the program buffer, the privilege level for accessing memory and CSR should be restricted to <<dbgaccpriv, debug access privilege>>.
In an execution-based implementation, the code executing the "park loop" can always run with M-mode privilege to access the memory and CSR. However, once execution is dispatched to an Abstract Command or the program buffer, the privilege level for accessing memory and CSR should be restricted to <<dbgaccpriv, debug access privilege>>.

To achieve this, a Debug Mode only state element (e.g., a field in a custom CSR) may be introduced to control the privilege level in Debug Mode. When the state is set to 1, Debug Mode allows M-mode privilege; when cleared to 0, it enforces the <<dbgaccpriv, debug access privilege>>. The hardware sets this state to 1 upon entering the park loop and clears it to 0 by the final instruction of the park loop, right before execution is transferred to an abstract command or the program buffer.
To achieve this, a Debug Mode only state element (e.g., a field in a custom CSR) may be introduced to control the privilege level in Debug Mode. When the state is set to 1, Debug Mode allows M-mode privilege; when cleared to 0, it enforces the <<dbgaccpriv, debug access privilege>>. The hardware sets this state to 1 upon entering the park loop and clears it to 0 by the final instruction of the park loop, right before execution is transferred to an Abstract Command or the program buffer.
Binary file modified external-debug-security.pdf
Binary file not shown.
2 changes: 1 addition & 1 deletion intro.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ A summary of the changes introduced by _The RISC-V External Debug Security Speci
[cols="20%,80%"]
|=====================================================================================================================================================
| Abstract command | A high-level command in Debug Module used to interact with and control harts
| Debug Access Privilege | The privilege with which abstract commands or instructions in program buffers access hardware resources
| Debug Access Privilege | The privilege with which an Abstract Command or instructions in the Program Buffer access hardware resources
| Debug Mode | An additional privilege mode to support off-chip debugging
| Hart | A RISC-V hardware thread
| IOPMP | Input-Output Physical Memory Protection unit
Expand Down

0 comments on commit 85902da

Please sign in to comment.