JPH0212545A - System shared control block control system - Google Patents

Abstract

PURPOSE:To prevent the destruction of a system shared control block and the runaway of a system due to unauthorized access from being generated by making access to the system shared control block used in an operating system by another address, and checking whether or not access is authorized access. CONSTITUTION:When a new instruction for the system shared control block is issued, a new instruction decoder 11 interprets the fact that an issued new instruction is an instruction to make access to the system shared control block used in the operating system. And a user check means 12 checks whether or not the access by a user is authorized setting the user and the control block as address constituents according to access right information stored for checking in an access right check memory 13. In such a way, it is possible to prevent the destruction of the system shared control block and the runaway of the system due to the unauthorized access from being generated.

Description

DETAILED DESCRIPTION OF THE INVENTION [Field of Industrial Application] The present invention relates to a method for controlling a system-shared control block of an operating system by a computer hardware mechanism.

〔overview〕

The present invention relates to a system-shared control block control method for a computer operating system, in which the system-shared control block used within the operating system is accessed using a separate address, and the access mechanism is separated from general programs and data manipulation instructions. By checking whether the user's access is legitimate, it is possible to prevent the destruction of the system-shared control block and the system runaway due to unauthorized access.

[Conventional technology]

Conventional protection units are large, ranging from several kilobytes to several megabytes, since they are performed in units of programs and user data, and they are not suitable for use in operating systems because they only divide programs into several levels of protection. For reasons of sufficiency, traditional system-shared control block protection has been done at the software level.

[Problem that the invention seeks to solve]

The conventional protection unit described above has the disadvantage that the unit is too large to protect the control block, and it is not possible to check out the control block sufficiently. Furthermore, the protection level was one-dimensional, either high or low, and was insufficient to maintain complex protection relationships.

The present invention uses a system-shared control block (usually a few bytes to several hundred bytes), in addition to the old memory protection means and atto-system conversion means, in which the unit of protection is the conventional program or user data (usually several kilobytes or more). This method attempts to resolve the shortcomings of the conventional hardware by using a memory protection method with a protection unit of 100% as a unit of protection, in parallel with old hardware, and is capable of preventing destruction of system-shared control blocks and runaway of the system due to unauthorized access. The purpose is to provide

[Means for solving problems]

The present invention includes an address array and a cache memory that are connected to a main memory and improve the effective speed of the main memory, an instruction decoder that interprets general instructions, and address conversion means that converts addresses for general instructions. In the virtual address system shared control block control method, a new instruction decoder that interprets a new instruction for accessing the system shared control block, a user check means that checks whether the user's access is correct, and an access right check memory that records access right information and is separated from the main memory and can be accessed at high speed; The present invention is characterized by comprising memory protection means including address translation means and an address translation table referred to by this means.

[Effect]

When new instructions for system-shared control blocks are provided,
The new instruction decoder interprets that the provided new instruction is an instruction for accessing a system-shared control block used by the operating system, and the user check means is stored in the access right check memory for checking. According to the access right information, the user and its control block as address components,
Check whether the user's access is legitimate.

This protects the system-shared control block from access from unlimited users or access outside the period of use, and prevents destruction of the system-shared control block and runaway of the system due to unauthorized access.

〔Example〕

Next, embodiments of the present invention will be described based on the drawings.

FIG. 1 is a block diagram showing the configuration of an embodiment of the present invention.

The embodiment of the present invention includes an address array 2 and a cache memory 3 connected to a main memory 1 to improve the effective speed of the main memory IJ1, a memory protection means 5, an instruction decoder 6 for interpreting general instructions, and a general instruction decoder 6 for interpreting general instructions. The present invention also includes a new instruction decoder 11 that interprets a new instruction for accessing a system-shared control block, and a new instruction decoder 11 that interprets a new instruction for accessing a system-shared control block, and determines whether the user's access is correct. an access tower check memory 13 that is referenced by the user check means 12, records access right information, and is separated from the main memory 1 and is capable of high-speed access, and indicates the location of a system-shared control block. New address switch Vk14 that converts logical addresses to addresses on main memory
and an address translation table 15 referred to by this new address translation means 14.

The operation of the embodiment of the present invention configured as described above will be explained. When a new instruction for a system-shared control block is provided to software using hardware according to an embodiment of the present invention, the new instruction decoder 11 is a part that interprets this instruction.

The format of the command and an example of its usage are shown in FIG. This is an example of manipulating system-shared control blocks used within the operating system. A module unit within the operating system is defined as a user, and an index indicating the user is called a user ID.

The DEFINE USER command declares the module to run from here, ie, the user ID. G.E.
A control block of the necessary size is secured by the TCB instruction. At this time, a logical address for accessing the secured control block is returned. FIG. 3 shows the configuration of the logical address.

5TORE when storing data to control block
CB instruction: When referring to data from a control block, a LOAD CB instruction is used.

Since high-speed access to control block addresses is required, the new address conversion means 10 creates a conversion table from logical addresses to real addresses on the main memory 1 in the format shown in FIG. 4, separate from the main memory 1. have in memory.

At this time, each entry in the conversion table 15 has an indication of the presence or absence of a user and a control block, and if an entry indicated as none is accessed, LOAD CB,
Each instruction of 5TORE CB determines that an exception has occurred, causes an interrupt, and notifies unauthorized access.

In addition, for access by a module other than the module indicated by DEFINE USER, the user checking means 12 checks the access right check memory 1 having the table shown in the table below.
3, check whether the user on the referenced side that the subject is trying to access has read/write rights. In this case as well, unauthorized access is notified by interrupt. In the table, F indicates that the control block can be released, and R
indicates IJ + permission, W indicates write permission, and N indicates access prohibition.

access rights) Setting/changing the contents of the memory 13
For deletion, CHANGE ACCESSRIGH
This is done by the T command. The control block secured by the GET CB command in the module defined by DEFINEUSER is CF! ANGE ACCESS RIGH
It cannot be used by other modules unless access rights are granted with the T command.

The control block is released using the FREE CB command.
At this time, there must be an indication that the access right check memory 13 can be released. If an attempt is made to release it illegally, an interrupt will be generated and the illegal release will be notified.

When exiting from the module, use the END USER command to declare the use authority to be revoked. When the ENDUSER command is issued, operations on all control blocks are treated as unauthorized operations and an interrupt is generated. For conventional instructions, the instruction decoder 6,
It is processed by address conversion means 4 and memory protection means 5.

The address array 2 is used in common with conventional processing, and checks whether the main memory address after address conversion exists in the cache memory 3. If not, it loads and references data from the main memory to the cache memory 3. Since the control block is stored in the main memory like normal program and data, the main memory size for the control block is DE.
It is necessary to initialize using the FINEINF command. Incidentally, at this time, in order to initialize the access right check memory 13, the maximum number of users is also specified.

Table [Effects of the Invention] As explained above, according to the present invention, a system-shared control block used within an operating system can be accessed at a different address than in the past, and the access mechanism can be used by general programs and data manipulation commands. This has the effect of preventing destruction of the system-shared control block and runaway of the system by separating it from the system and eliminating unauthorized access.

[Brief explanation of the drawing]

FIG. 1 is a block diagram showing the overall configuration of an embodiment of the present invention. FIG. 2 is an instruction sequence when the operating system uses the instructions of the embodiment of the present invention. FIG. 3 is a diagram showing the configuration of logical addresses of control blocks. FIG. 4 is a diagram showing a conversion table for converting a logical address of a control block into an address on the main memory. ■...Main memory, 2...Address array, 3...
Cache memory, 4...address converter L 5.1
0...Memory protection means, 6...Instruction decoder, 11
. . . new instruction decoder, 12 . . . user check means, 13 . . . access right check memory, 14 .

Claims (1)

[Claims] 1. An address array (2) and a cache memory (3) that are connected to a main memory (1) and improve the effective speed of the main memory, and an instruction decoder (6) that interprets general instructions. , address translation means (4) for translating addresses for general instructions, and a new instruction decoder (11) for interpreting new instructions for accessing the system common control block. ) and user checking means (
12), an access right check memory (13) which is referenced by this means and records access right information and which can be accessed at high speed and is separated from the main memory, and a logical address indicating the location of the system shared control block on the main memory. New address conversion means (
14); and an address translation table (15) referred to by this means.