Atomic System Call Instructions for Robust Kernel Transitions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing control transfer instructions in computer architectures are vulnerable to faults and attacks, leading to potential system crashes or privilege escalation, as they require a sequence of instructions for mode transitions between supervisor and user modes, which can execute with a non-supervisory state if a fault occurs.
Innovation Solution
The introduction of 'RBSTCALL' and 'RBSTRET' instructions, which perform control transfers between supervisor and user modes in a single atomic instruction, ensuring robustness against malicious attacks and improving performance by validating target selectors and addresses, thereby preventing execution with an invalid state.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If existing control transfer instructions are used for system calls, then performance is improved by avoiding interrupt overhead, but reliability deteriorates due to vulnerability to faults and attacks
Solution Approach 1:
The patent combines multiple control transfer operations into a single atomic instruction. The new control transfer instruction integrates privilege level switching, stack pointer switching, and return address loading into one indivisible operation, eliminating the sequence of separate instructions in existing architectures. This merging ensures that either all operations complete successfully or none execute, preventing the vulnerability where a fault could leave the system in an inconsistent state with supervisor mode execution using a non-supervisor stack.
2Adaptability or versatility
If a sequence of instructions is used for mode transition, then flexibility is improved, but reliability deteriorates due to execution windows with invalid state
Solution Approach 1:
The patent implements a single atomic control transfer instruction that executes all mode transition operations in one indivisible step, effectively 'skipping' over the vulnerable intermediate states that would otherwise exist during a multi-instruction sequence. The instruction atomically switches privilege levels, updates stack pointers, and loads return addresses simultaneously, eliminating the time window where a fault could occur with the system in an invalid hybrid state.
3Manufacturing precision
If control stacks are switched during system call, then correctness is improved, but vulnerability increases during the transition window
Solution Approach 1:
The patent merges control stack switching with privilege level transitions into a single atomic operation. The instruction simultaneously updates the stack pointer to the appropriate kernel or user stack and changes the privilege level, ensuring that the stack switch cannot occur independently or partially. This eliminates the attack surface where malicious code on the user stack could be executed if a fault occurred after stack switching but before privilege level changes in existing multi-instruction sequences.
Data Source
AI summary
Robust system call and system return instructions are executed by a processor to transfer control between a requester and an operating system kernel. The processor includes execution circuitry and registers that store pointers to data structures in memory. The execution circuitry receives a system call instruction from a requester to transfer control from a first privilege level of the requester to a second privilege level of an operating system kernel. In response, the execution circuitry swaps the data structures that are pointed to by the registers between the requester and the operating system kernel in one atomic transition.