Capability-Based Instruction Set Change Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In capability-based architectures, the ability to change instruction sets can undermine security benefits by allowing inadvertent or malicious changes in the interpretation of instruction data, potentially leading to undesirable operational behavior.
Innovation Solution
A capability-based mechanism is employed to control changes in instruction sets by performing a bounded pointer check operation on the program counter capability, ensuring that only valid capabilities can update the instruction set, and taking exceptions when invalid attempts occur.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the ability to change instruction set is provided in a capability-based architecture, then adaptability and versatility are improved, but security and reliability deteriorate due to potential inadvertent or malicious changes in instruction interpretation
Solution Approach 1:
The patent applies preliminary action by performing a bounded pointer check operation on the program counter capability before allowing the instruction set change to take effect. This pre-validation ensures that only authorized capability values can trigger instruction set switching, preventing security violations before they occur. The check verifies that the capability value falls within an authorized range, and only if this preliminary check passes is the instruction set identifier updated.
Solution Approach 2:
The patent introduces an intermediary mechanism in the form of a bounded pointer check operation that mediates between the capability value and the instruction set change. This intermediary validation step acts as a gatekeeper, ensuring that the program counter capability contains an authorized value before permitting the instruction set identifier to be updated. This mediator prevents direct, unauthorized instruction set changes while allowing legitimate transitions.
2Reliability
If bounded pointer checks are performed on program counter capability to prevent unauthorized instruction set changes, then security is improved, but device complexity increases due to additional validation mechanisms
Solution Approach 1:
The patent applies universality by using the existing bounded pointer check mechanism, already established for memory access validation in the capability-based architecture, for the dual purpose of both memory access control and instruction set change validation. This existing capability validation infrastructure is repurposed to also validate program counter capability values, avoiding the need for entirely separate validation logic and reducing overall system complexity.
Solution Approach 2:
The patent applies self-service by having the program counter capability validation utilize the same bounded pointer check operation that the capability-based architecture already employs for memory access control. The existing validation infrastructure serves itself by handling both traditional memory access validation and the new instruction set change validation, eliminating the need for additional dedicated validation hardware or software components.
Data Source
Figure 1
Figure 2A~2B
Figure 3
AI summary
An apparatus and method are provided for controlling a change in instruction set. The apparatus has processing circuitry to execute instructions of an instruction set, with the processing circuitry being arranged to operate in a capability domain comprising capabilities used to constrain operations performed by the processing circuitry when executing the instructions. A program counter capability storage element is used to store a program counter capability used by the processing circuitry to determined a program counter value. The processing circuitry is arranged to employ a capability based mechanism to change the instruction set. In particular, in response to execution of at least one type of instruction that is used to load an identified capability into the program counter capability storage element, the processing circuitry is arranged to invoke the capability based mechanism in order to perform a capability check operation in respect of the identified capability, and to cause the instruction set to be identified by an instruction set identifier field from the identified capability provided the capability check operation is passed. This provides a controlled mechanism for allowing the instruction set to be changed, thereby alleviating the risk of inadvertent or malicious attempts to change the instruction set.