0.7.3 msu update #109
0.7.3 msu update #109
Conversation
- Added Erik Kraft and Thomas Roecker to the contributors list. - Expanded the documentation on S-mode, VS-mode, and U-mode debug control, detailing the new fields introduced by the Smsdedbg and Smvsdedbg extensions. - Clarified the maximum allowed privilege mode and debug access privilege configurations in the sdsec.adoc file. - Updated the external-debug-security.pdf to reflect changes in the documentation.
…c as it is - Complete the S/HS-mode debug control
sdsec.adoc
Outdated
| | 1 | Don't care | Don't care | Don't care | M-Mode | ||
| | 0 | 1 | Don't care | Dont care | S/HS-Mode | ||
| | 0 | 0 | 1 | Don't care | VS-Mode | ||
| | 0 | 0 | 0 | 1 | U/VU-Mode |
There was a problem hiding this comment.
Imagine that an external debugger is debugging a VU-mode process inside a guest VM. Does this line mean that the external debugger can change the V bit and break out of that VM and into a U mode process that's running directly under the hypervisor?
There was a problem hiding this comment.
The text below mandates that when the VS/VU is allowed for debugging, the external debugger cannot modify the V bit, and the debug scope is contained within VM. Do you think it solves the issue?
There was a problem hiding this comment.
@pdonahue-ventana are you okay to resolve this comment now?
sdsec.adoc
Outdated
| [[Sdseccsr]] | ||
| === Debug Control CSR | ||
|
|
||
| The CSR `msdcfg`, which holds the debug and trace control fields (<<dbgctlcsr>>), is defined in the RISC-V Supervisor Domains Access Protection specification cite:[smmtt]. The Smsdedbg and/or Smsdetrc extensions must be implemented to support security control for debugging and/or tracing in the corresponding privilege modes. |
There was a problem hiding this comment.
It seems that the debug and trace control fields were renamed in the "RISC-V Supervisor Domains Access Protection" specification (e.g., SDEDBGALW to SEDA). Further, the control bits for the lower levels anyway do not exist there. I think it would be cleaner if the CSR and necessary fields for external debug and trace access control would be defined in this specification (with the new optional extensions it covers more use cases then supervisor domains). The "RISC-V Supervisor Domains Access Protection" specification could then just refer to the extension it requires and link the related control bits with msdcfg.{SEDA,SETA}.
|
I read through the specification and noticed some other parts that should be updated to reflect the optional debug access control extensions:
|
The introduction and SBA part are updated. I left the appendix untouched and will update it when the spec become stabilized. |
…urity Extension documentation. - Adjust descriptions for debug and trace control fields to enhance readability and precision. - Ensure proper formatting and grammatical accuracy throughout the document.
- fix typo
…cumentation. Update descriptions for `SDEDBGALW`, `VSEDBGALW`, `USEDBGALW`, `SDETRCALW`, `VSETRCALW`, and `USETRCALW` to specify that they only take effect when certain conditions are met, enhancing accuracy and readability.
This pull request introduces significant updates and clarifications to the Sdsec (ISA extension) documentation for RISC-V, focusing on privilege-based debug and trace control. The changes expand and clarify the specification, introduce new configuration tables, and provide detailed descriptions of privilege levels, debug access, and control registers. Additionally, contributor acknowledgments and documentation resources have been updated.
Major documentation improvements and clarifications:
Extension overview and privilege-based debug control
Sdsecextension, clarifying its security enhancements, mandatory and optional controls for different privilege modes (M/S/VS/U), and added summary tables for debug/trace controls and valid implementation combinations.Privilege and debug access model
mdbgenstate on debug mode entry, halt requests, trigger behavior, and single-stepping, including behavior when transitioning between privilege modes.Optional extension controls and memory access
Smsdedbg), VS-mode (Smvsdedbg), and U-mode (Smudedbg) debug controls, including how each extension manages privilege and access.DMPRVfield in various CSRs (sdcsr,vsdcsr) modifies the effective debug access privilege for memory operations in debug mode, and added a detailed table for theDMPRVfield. [1] [2]Contributor and resource updates
contributors.adocfile.docs-resources.These changes provide a more robust, clear, and comprehensive specification for the Sdsec extension and its related privilege and debug control mechanisms.