Firmware Runtime Service Upcall via Privilege Level Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing firmware runtime services, such as UEFI, face challenges when executing in the same privilege level as the operating system, leading to issues like failure to preserve CPU state and incorrect pointer conversions, which can result in the need for physical addressing and workarounds.
Innovation Solution
Implementing runtime service stubs that execute upcall instructions to a higher privilege level, allowing the handling of firmware runtime services to be moved to a more privileged level, thereby isolating them from the operating system and enabling correct virtual address management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If firmware runtime services are executed in the same privilege level as the operating system, then the runtime services can be accessed directly without privilege transitions, but CPU state preservation fails and pointer conversions become incorrect
Solution Approach 1:
The system is segmented into multiple privilege levels (EL1 for OS, EL3 for secure firmware). Runtime service stubs reside in the OS privilege level while actual runtime services execute in the secure firmware privilege level. This segmentation allows direct access from the OS while ensuring correct execution in the appropriate privilege context, resolving both the ease of access and reliability issues.
Solution Approach 2:
Runtime service stubs act as intermediaries between the operating system and the actual runtime services. The stubs execute in the OS privilege level, perform necessary setup operations, and then trigger execution of the actual runtime services in the secure firmware privilege level. This intermediary approach enables correct CPU state preservation and pointer conversion while maintaining ease of access for the OS.
2Adaptability or versatility
If firmware runtime services execute in the operating system's virtual address space, then virtual addressing can be used, but incorrect pointer conversions occur without proper privilege level handling
Solution Approach 1:
The address space management is segmented across privilege levels. The OS virtual address space is used at EL1, while the secure firmware at EL3 has its own address space view. The runtime service stubs handle the transition and ensure correct pointer conversions by executing in the appropriate privilege level context, maintaining both virtual addressing capability and pointer conversion accuracy.
Solution Approach 2:
The privilege level parameter changes from EL1 to EL3 during runtime service execution. This parameter change triggers the appropriate address space translation and pointer conversion mechanisms specific to each privilege level, ensuring accurate pointer conversions while maintaining virtual addressing versatility.
3Device complexity
If physical addressing is used for runtime services to avoid workarounds, then addressing simplicity is maintained, but the system loses the ability to use virtual addressing benefits
Solution Approach 1:
The addressing mechanism is segmented by privilege level. The OS uses virtual addressing at EL1, while the secure firmware uses appropriate addressing at EL3. The runtime service stubs manage the transition between these segmented addressing modes, maintaining both the simplicity of physical addressing where needed and the versatility of virtual addressing where appropriate.
Solution Approach 2:
The system adds the privilege level dimension to address space management. Instead of choosing between physical and virtual addressing, the system uses privilege level transitions to switch between different address space configurations, enabling both addressing modes to coexist and be used appropriately in different contexts.
Data Source
AI summary
An example method of implementing firmware runtime services in a computer system having a processor with a plurality of hierarchical privilege levels, the method including: calling, from software executing at a first privilege level of the processor, a runtime service stub in a firmware of the computer system; executing, by the runtime service stub, an upcall instruction from the first privilege level to a second privilege level of the processor that is more privileged than the first privilege level; and executing, by a handler, a runtime service at the second privilege level in response to execution of the upcall instruction.