Skip to content

Commit

Permalink
Update naming and fix typos
Browse files Browse the repository at this point in the history
  • Loading branch information
Aote Jin committed Apr 22, 2024
1 parent 75c3255 commit 209953f
Show file tree
Hide file tree
Showing 2 changed files with 3 additions and 3 deletions.
4 changes: 2 additions & 2 deletions appendix.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ This chapter explains the theory of operation for the External Debug Security Ex

=== Debug Module security control

As outlined in the specification, the security control on the Debug Module can vary for each hart. The dedicated security policy for hart i is enforced by the input port mdbgen[i] and the `sdbgen` field inside the mseccfg CSR. The security control logic examines all debug operations and triggers (with action=1) firing/matching based on mdbgen[i], `sdbgen`, and the privilege level of the hart. The failed action will either be dropped or pending. Additionally, the platform-specific external trigger inputs must obey to platform constraints, which must be carefully handled by platform owner. The mdbgen[i] be bundled in an MMIO (Memory-Mapped I/O) outside the hart, such as in the Debug Module or implemented as fuses.
As outlined in the specification, the security control on the Debug Module can vary for each hart. The dedicated security policy for hart i is enforced by the input port mdbgen[i] and the `sdedbgalw` field inside CSR msdcfg. The security control logic examines all debug operations and triggers (with action=1) firing/matching based on mdbgen[i], `sdedbgalw`, and the privilege level of the hart. The failed action will either be dropped or pending. Additionally, the platform-specific external trigger inputs must obey to platform constraints, which must be carefully handled by platform owner. The mdbgen[i] can be bundled in an MMIO (Memory-Mapped I/O) outside the hart, such as in the Debug Module, or implemented as fuses.

The privilege level of the hart is determined by code execution, while the debug requests are validated against the privilege level generated by the hart. This process involves two actors, which may lead to a potential Time-of-Check Time-of-Use (TOCTOU) issue. To mitigate this, the implementation must ensure that the inspection and execution of debug requests occur within the same privilege level of the hart. Failure to do so could result in debug requests bypassing access controls intended for higher privilege levels. If the accesses fail the security check, it must prompt an immediate termination of access to prevent any information leakage.

Expand All @@ -17,7 +17,7 @@ image::external_debug_dm.png[title="The security control on Debug Module",align=

=== Trace Encoder security control

Similar to the Debug Module, the trace encoder is controlled by the mtrcen[i] and `strcen` in mseccfg CSR for each hart i. The halted sideband signal to the trace encoder is determined by <<trcctl>>.
Similar to the Debug Module, the trace encoder is controlled by the mtrcen[i] and `sdetrcalw` in CSR msdcfg for each hart i. The halted sideband signal to the trace encoder is determined by <<trcctl>>.

image::external_debug_trace.png[title="The security control on trace module",align="center"]

Expand Down
2 changes: 1 addition & 1 deletion chapter3.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ The field `aamvirtual` in command (at 0x17) determines whether physical or virtu
System Bus Access enables direct reading/writing of memory space without involving the hart. However, it must always be checked by bus initiator protection mechanisms such as IOPMP, WorldGuard, etc. If these protections are not implemented or not deployed for Debug Module, System Bus Access must not be Supported. Failed system bus access attempts result in a bus security fault error (sberror 6).

[NOTE]
In scenarios where a Debug Module lacks System Bus Access, memory access by the debugger can be achieved through the use of abstract commands. These commands provide a secure means of accessing memory.
In scenarios where a Debug Module lacks System Bus Access, memory access by the debugger can be achieved through the use of abstract commands. These commands provide secure means of accessing memory.

[NOTE]
Trusted entities like RoT should configure IOPMP or equivalent protection before granting debug access to machine mode. Similarly, machine mode should apply the protection before enabling submachine mode debug.
Expand Down

0 comments on commit 209953f

Please sign in to comment.