JPH0412861B2 - - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION [Summary] This is an access control method for executing a virtual machine in a computer that performs access control by comparing a storage protection key with an access key when accessing a main storage device. When the access key of the virtual machine and the access key of the monitor program are different, when the monitor program accesses the virtual machine area in order to execute the virtual machine on behalf of the virtual machine, access is controlled using the access key of the virtual machine. Therefore, the tag bit corresponding to the address register is held in the register, and when accessing the main memory using the address register specified by the tag, it is switched to the access key of the virtual machine. The above control reduces the overhead of the monitor program checking the access key of the virtual machine.

[Industrial application field]

The present invention relates to an access control method for executing a virtual machine in a computer that performs access control by comparing a storage protection key with an access key when accessing a main storage device.

In computers, methods for controlling one or more other virtual computer systems, so-called virtual computers, are well known.

In that case, each virtual machine uses a monitor program (hereinafter referred to as
A virtual machine that is under the control of a virtual machine (referred to as a VM monitor) and to which control is handed over by the VM monitor is executed on the central processing unit of the real machine.

In a virtual machine, the operating system of the virtual system performs system management of the virtual machine, but the VM monitor intervenes in cases where the results of its control may affect other virtual machines. It is necessary to maintain the integrity of the entire actual computer system by

However, such intervention generally increases control overhead and tends to be a factor in degrading the performance of the virtual machine.

[Problems to be solved by conventional technology and invention]

FIG. 2 is a block diagram showing an example of the configuration of a computer system.

The central processing unit 1 executes the program of the VM monitor 3 on the main storage device 2 and operates the virtual machines by passing control to the program in the virtual machine area 4 allocated to each virtual machine.

As is well known, the central processing unit 1 has a system that restricts access to the main storage device 2 for each appropriate area of the main storage device 2 based on the qualifications of the access source.
It has an access control function for so-called memory protection.

For example, if a memory protection key consisting of 4 bits is set for each 4-kilobyte area of the main storage device 2, and an access request is made, the accessing program will use the program status word (hereinafter referred to as
an access key 7 held in the PSW) 5;
The storage protection key of the storage area to which access is requested is checked, and only when the two keys match, a predetermined access to the area is executed.

Note that in case it is necessary to access all areas, such as programs for management functions, for example, if the value of the access key is "0", access is enabled regardless of the mismatch of keys.

As is well known, by executing an instruction, the main memory 2
The storage address when accessing is specified by the address register specifying section 19 and displacement section 20 of the operand of the instruction held in the instruction register 18.

That is, it is obtained by adding the displacement value of the displacement section 20 and, if necessary, an index value, etc. specified separately, to the contents of one register of the general-purpose register group 14 specified by the address register specification section 19, using the address adder 21. Transfer the storage address to the access control unit 10.

At this point, the access key 7 input via the control line 11 is compared with the storage protection key of the area including the specified address, and it is determined whether access is possible or not according to the above-mentioned rules.

In the virtual machine as well, the mechanism of the central processing unit 1 is used to perform access control for storage protection when accessing the virtual machine area 4.

As mentioned above, it is necessary for the VM monitor 3 to intervene and simulate the necessary processing of the virtual machine, and in this case, as is known, for example, the VM latch 22 is set in transferring control to the VM monitor. By doing so, the PSW for VM monitor can be used instead of PSW5 and general-purpose register group 14, etc.
15, general-purpose register group 16, etc. are enabled.

VM monitor 3 normally sets access key 17 to '0'
As a result, all areas of the main storage device 2 can be accessed.

However, when the VM monitor 3 accesses the virtual machine area 4 in order to perform processing on behalf of the virtual machine, it is necessary to perform access control using the access key specified by the virtual machine.

For this reason, when the VM monitor 3 accesses the virtual machine area 4 of the main storage device 2, the access key 7 of the virtual machine is read out and held in an appropriate register, and before executing the main storage device access. For example, it is necessary to specify the register to be accessed, execute a key check instruction, and then actually execute the access only after determining that the access is permitted. was reducing the efficiency of virtual machine control.

[Means for solving problems]

FIG. 1 is a block diagram showing the configuration of the present invention.

In the figure, 30 is a tag register, and 31 is an access detection section.

[Effect]

The tag register 30 has tag bits corresponding to each general-purpose register, and the required bits are set in advance by the VM monitor 3.

The access detection unit 31 normally sets '0' to the control line 11 as an access key when executing the VM monitor.
However, when it is detected that the general-purpose register specified by the tag register 30 is specified by the address register specification part 19 of the instruction, the access key 7 of the PSW 5 of the virtual machine is set as the access key. Switch and output.

As described above, when the VM monitor 3 accesses the virtual machine area during execution, access control as a virtual machine is automatically performed, and the overhead for the VM monitor to perform a key check for each access is eliminated.

〔Example〕

In FIG. 1, the PSW 5 of the central processing unit 1,
15. It is assumed that the access control unit 10 and the like operate in the same manner as before except as described below.

The tag register 30 holds, for example, 16 tag bits corresponding to each general-purpose register, and the VM monitor 3 stores general-purpose registers that are scheduled to become address registers that hold storage addresses for accessing the virtual machine area during processing. (general-purpose register for VM monitor) is set to on in advance.

In the access detection section 31, by selecting the tag bit of the tag register 30 by the selector 33 under the control of the instruction address register specifying section 19, for example, one of the general-purpose registers specified in the tag register 30 is set as the instruction address register specifying section 19. It is detected that the address register designation unit 19 of

The gate 32 is controlled by the output of the selector 33, and the access key 7 of the virtual machine is transferred to the control line 1.
Pass to 1.

Therefore, while the VM monitor 3 is running, '0' is always input as an access key to the access control unit 10, and the general-purpose register specified by the tag register 30 is used as an address register to generate an access address. Switches to the virtual machine access key only when specified.

The access control unit 10 uses the control line 1 as in the conventional case.
Access control is executed using the access key input from 1.

As a result of the above, while VM Monitor 3 is running,
When accessing the virtual machine area, access control is performed using the access key of the virtual machine, eliminating the need for the VM monitor 3 to check the key, and improving control efficiency.

〔Effect of the invention〕

As is clear from the above explanation, in a computer system running a virtual machine, the key check overhead when accessing the virtual machine area in the VM monitor is reduced, so it is a significant industrial advantage to improve the performance of the virtual machine. effective.

[Brief explanation of drawings]

Fig. 1 is a block diagram of an embodiment of the present invention;
The figure is a block diagram of an example of a conventional configuration. In the figure, 1 is a processing device, 2 is a main storage device,
3 is VM monitor, 4 is virtual computer area, 5, 15
is a PSW, 10 is an access control unit, 7 and 17 are access keys, 14 and 16 are a group of general-purpose registers, 19
is an address register designation part, 20 is a displacement part, 21
22 is an address adder, 22 is a VM latch, 30 is a tag register, 31 is an access detection section, 32 is a gate, and 33 is a selector.

Claims (1)

[Claims] 1. An address register that holds a storage address used for main storage access, and a function to perform access control by checking a storage protection key and an access key, and to control a virtual computer and the virtual computer. In a computer that executes a monitor program, the tag register 30 holds tag bits that individually specify the address register 16, and the address register specified by the tag bit is determined by the operand address of the instruction executed by the monitor program. An access control system characterized in that: means 31 for detecting designation is provided, and the access key is switched to the access key of the virtual machine based on an output signal of the detecting means.