Cross the privilege boundary deliberately

Prerequisites: Processor modes, instruction execution, and operating-system services.

Learning objectives

• Distinguish a system call, synchronous exception, and asynchronous interrupt.
• Explain why a trap saves architectural state.
• Identify validation and restart requirements at a kernel boundary.

Different events enter a shared mechanism

A synchronous exception arises from executing a particular instruction, such as an invalid operation or a page fault. An asynchronous interrupt is delivered because of an event external to the current instruction stream, such as a timer or device completion. A system call deliberately asks the operating system to perform a service through a defined entry mechanism. Architectures use different terminology, but these distinctions help identify cause and resumption behavior.

A trap transition changes control flow and privilege under hardware rules. The processor records enough information to identify the interrupted context and cause, then transfers to a configured handler. Operating-system entry code saves additional registers as needed and establishes a safe execution environment. An ordinary function call does not grant privileged access merely because it jumps to another address.

Preserve the point of explanation

Suppose a user instruction loads from a valid virtual address whose page is not currently resident. The fault handler determines whether the mapping is allowed, obtains the required page, updates the translation state, and arranges to retry the instruction when the architecture permits that restart. If the address violates the process’s mapping permissions, the handler may instead deliver an error or terminate the process.

These are different outcomes of the same broad entry mechanism. A page fault is not automatically a disk read, and not every exception is recoverable. Precise exceptions make the architectural state appear consistent with a well-defined boundary in the instruction stream. Internal pipeline work may have overlapped extensively, but the handler must receive a state that supports the architecture’s rules.

A system-call argument is untrusted input

Imagine a request to write bytes from a user buffer to a file descriptor. The kernel must interpret the requested operation, check the descriptor and permissions, validate or safely access the buffer, and report an outcome. A numeric pointer supplied by the caller is not proof that the bytes are mapped, readable, or stable throughout the operation.

The request may block while waiting for I/O, letting the scheduler run another thread. It may also complete only part of the requested transfer, depending on the API and circumstances. User code must follow the documented return-value and retry rules rather than assuming that crossing the boundary guarantees full success.

A useful trace therefore records the user instruction or event, saved state, handler decision, any scheduling transition, return status, and resume location. This exposes whether a problem comes from permission checks, mapping state, device behavior, or user-side handling. The privilege boundary is a controlled protocol with failure cases, not a magical extension of an ordinary function call.

Primary reading

• Devices and Interrupts (MIT OpenCourseWare, Computation Structures).
• I/O Devices (Arpaci-Dusseau and Arpaci-Dusseau, OSTEP).

Practice problem

Classify three events: a timer expires during arithmetic, a load accesses an unmapped address, and a program explicitly requests a file read. For the load, explain why resuming at the next instruction might be incorrect if the operating system repairs the missing mapping. For the file read, explain why the caller must inspect the returned byte count.

Worked solution

The timer event is an asynchronous interrupt because it is not caused by the particular arithmetic instruction. The load raises a synchronous exception tied to that instruction. The explicit file request is a system call. If the mapping fault is repairable, skipping the load would leave its destination without the value required by the program. A restartable architecture normally resumes in a way that retries the faulting instruction after the mapping is repaired. For a file read, a successful return can still report fewer bytes than requested, and zero can have a specific meaning such as end of file. The caller must use the returned count and documented error behavior rather than processing uninitialized or stale bytes as though the full request completed.

Check your understanding

Which event is synchronous with an instruction?

• A timer becoming due independently.
• An illegal-instruction fault.
• An unrelated device completing a transfer.
• A network packet arriving while the core is idle.

Explanation

The illegal instruction itself causes the exception.

Why must kernel code validate a user pointer?

• A system call makes every numeric address trustworthy.
• The pointer may identify inaccessible or unauthorized memory.
• All pointers are physical addresses.
• A valid file descriptor proves every buffer is valid.

Explanation

A caller-controlled address must be accessed under the process’s mapping and permission rules.

Primary reading

• Devices and Interrupts: MIT OpenCourseWare, Computation Structures
• I/O Devices: Arpaci-Dusseau and Arpaci-Dusseau, OSTEP

Open the study and save your work →