JPH04284555A - Processor and processing method for executing outside ring transition - Google Patents

Abstract

PURPOSE:To call a program from a high-order ring level to a low-order ring level without using any privilege instruction or the like concerning the processor and the processing method for executing outside ring transition at a computer system executing the execution limit/memory protection of the program by a ring protecting mechanism. CONSTITUTION:When calling a user program 19 to be operated at the low-order ring level, a calling source information saving part 14 saves information required for recovery to a calling source program 13, and an outside ring calling part 16 transits the ring to a low-order user program calling part 18. The user program calling part 18 calls the user program 19 and after the recovery, a calling source ring recovering part 17 is called. Then, a calling source information restorage part 15 of a high-order ring is uniquely called, and control is returned to a system program 13.

Description

[Detailed description of the invention]

0001

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a processing device and method for performing external ring transition in which a program calls a program operating at a lower ring level than the current ring level in a computer system having a ring protection mechanism.

[0002] In recent operating systems,
In order to speed up processing within a space (process), a function is provided to perform system services without changing the execution mode from general mode to privileged mode (kernel mode). Since the system programs that perform these system services operate within the same space specific area as the user program, it is necessary to protect the system work area from the user program. For this reason, the operating ring level of the system program is set higher than that of the user program by the ring protection mechanism.

However, in order to provide services to user programs, there is pre-processing and post-processing that the system program performs before and after execution of the user program, and routing processing that distributes user programs to be started depending on the content of request messages from other spaces. , or asynchronous schedule processing in which a user program is started in response to the occurrence of an asynchronous event, it is necessary to start a user program that operates at a lower ring level than the current ring level.

0004

2. Description of the Related Art FIG. 4 is an explanatory diagram of a ring protection mechanism related to the present invention, and FIG. 5 is an explanatory diagram of problems in the prior art. The ring protection mechanism allows programs at the lower ring level to
This is a protection mechanism that prevents the work area of a program at a higher ring level from being destroyed or from calling a program at a higher ring level in a way that is not normally allowed. For example, the ring levels range from 0 to 3, with the highest ring level 0 being assigned to a privileged mode kernel program, and the lowest ring level 3 being assigned to a normal user program.

[0005] As shown in FIGS. 4(a) and 4(b),
When a lower ring level program P1 calls a higher ring level program P2, an inter-ring transition instruction (referred to as a JRNG instruction) is used. In addition, when returning to the original program P1 from the called higher ring level program P2, an inter-ring return instruction (RR
(referred to as NG command).

The inter-ring transition instruction is an instruction that calls a program previously registered in the ring transition vector table as shown in FIG. 4(c) with inter-ring transition. When a program is called, the ring level of the calling program is saved in the called program's stack.

The inter-ring return instruction is an instruction in which a program called by an inter-ring transition instruction restores the old ring level to the calling program and returns. Return between rings is performed according to the ring level saved in the stack at the time of inter-ring transition. The ring transition vector table has a structure in which one entry corresponding to a program called by a ring transition instruction is shown in (c) of Figure 4.
The operating ring level and entry address of the program called by the inter-ring transition instruction are registered. It cannot be modified except by programs provided by the system and running in privileged mode.

[0008] In the conventional program calling method, in order to call a program running at a lower ring level, a kernel program running in a privileged mode dispatches a user program directly by using a privileged instruction that updates the PSW. was.

However, according to this method, execution of programs within the space-specific area must always be started at the access level of the user program in order to prevent the user program from being executed at an inappropriate access level. When a system program mechanism (hereinafter referred to as a routing processing section) such as pre-processing/post-processing before and after user program execution, routing processing, and asynchronous event scheduling is provided, a program that operates at a higher ring level may operate at a lower ring level. Since there is no mechanism to call a program that operates at the ring level and continue processing after returning, routing processing units that need to separate the protection ring level from the user program must be incorporated into the dispatcher unit of the kernel program to perform processing. I had to.

For example, in FIG. 5, the dispatcher section 5
0 runs on the kernel program 12 in privileged mode and dispatches the user program 19. The process of calling the system program 13 that operates at a higher ring level from the user program 19 that operates at a lower ring level can be executed by a normal system call because an inter-ring transition instruction and an inter-ring return instruction can be used. There is.

However, on the contrary, the process of calling and returning from the system program 13' of the higher ring level to the user program 19 of the lower ring level cannot be executed because there is no transition instruction to the lower ring level. For this reason, the routing processing unit 51' etc. are configured in the user program 1.
In the space 11 of 9, it was not possible to operate at a higher ring level than the user program 19, and only the kernel program 12 had to operate.

0012

As described above, according to the prior art, a program operating within a spatially specific area must always be started at the access level of the user program 19, and cannot be preempted by the system program 13'. Services such as processing/post-processing, routing processing, asynchronous event scheduling processing, etc. had to be performed by the kernel program 12.

However, as the number of types of routing processing units increases, the dispatch processing function tends to become larger and more complex. Therefore, in order to run all of them on the kernel program 12, the kernel program 12
There are problems in that the burden on staff becomes heavy and flexibility and flexibility are lacking.

[0014] The present invention aims to solve the above-mentioned problems, and allows a program operating within a space-specific area to operate at a lower ring level by using only ring transition instructions and inter-ring return instructions, which are provided as general instructions. The purpose of the present invention is to provide an external ring calling mechanism that can call a running program and perform subsequent processing at the original ring level even after the called program returns.

[0015]

[Means for Solving the Problems] FIG. 1 is a diagram illustrating the principle of the present invention. In FIG. 1, 10 is a processing unit consisting of a CPU and memory, 11 is a virtual memory space for each process, 12 is a kernel program that operates in a privileged mode at ring level 0, and 13 is a system program that provides system service functions. , 14 is a caller information saving section,
Reference numeral 15 represents a caller information restoration unit, 16 an external ring caller, 17 a caller ring return unit, 18 a user program caller, and 19 a user program operating at a lower ring level.

When the system program 13 operating at a higher ring level calls the user program 19 operating at a lower ring level, it calls the caller information saving unit 14. The call source information saving unit 14 performs a process of saving information necessary for restarting the processing of the system program 13 after the system program 13 returns from the called user program 19. After saving the information, the external ring calling unit 16 is called.

The external ring calling section 16 is called by the calling source information saving section 14 to start the user program calling section 18 so as to make a transition from a higher ring level to a lower ring level. When activated by the external ring calling unit 16, the user program calling unit 18 calls the user program 19 using a normal subroutine calling command or the like. When the user program 19 returns, the calling ring return unit 17 is called.

The calling source ring restoration section 17 performs a process of transitioning from a lower ring level to a higher ring level and calling the calling source information restoring section 15. As a result, when the caller information restoration unit 15 is called, the caller information restoration unit 15 restores information for restarting the processing of the system program 13, and
Resume the process in step 3.

[0019] Through these, external ring transition from the system program 13 to the user program 19 is realized.

[0020]

[Operation] The present invention focuses on the fact that the conventional inter-ring transition instruction is a transition instruction from a lower level to a higher ring level, and the inter-ring return instruction is an instruction for returning from a lower level to a higher ring level. In the external ring calling unit 16,
Prepare an environment for using the inter-ring return instruction, use the inter-ring return instruction in a state where the inter-ring transition instruction is not used, and when returning from the user program 19, the calling ring return unit 17 An inter-ring transition instruction is used to return to a higher ring level. The operation is as follows.

The restart information of the system program 13, which is the calling program, is saved in the system area by the calling source information saving section 14, and the user program calling section 18 is called using the external ring calling section 16. Start program 19. After returning from the user program 19, the user program calling unit 18
The caller ring recovery unit 17 is called from the caller ring recovery unit 17, and control is uniquely passed to the caller information restoration unit 15.

[0022] Therefore, when the user program 19 that operates at a lower ring level is started using these external ring call mechanisms, control is uniquely passed to the system program 13 that is the caller, and a malicious program prevents assigning an unreasonable access level to a user program even if a becomes possible.

[0023]

DESCRIPTION OF THE PREFERRED EMBODIMENTS FIG. 2 is a diagram showing an example of transition to a lower ring according to an embodiment of the present invention, and FIG. 3 is a diagram showing an example of returning from a lower ring according to an embodiment of the present invention. Below, Figures 2 and 3
Embodiments of the present invention will be described according to items ① to ② shown in .

(2) When the system program 13 calls the user program 19 operating at the lower ring level, the system program 13 calls the caller information saving unit 14. The calling source information saving unit 14 performs the following processing. (a) Record in a predetermined system area 21 that an external ring call will be made. That is, the save information valid display is set to "valid". This system area 21 is an area that cannot be updated from a lower ring level program.

(b) Next, the return address of the system program 13, which is the calling program, and the CPU register group are saved in the system area 21. (c) After that, start the external ring calling section 16.

[0026] When the external ring calling unit 16 is called by the calling source information saving unit 14, it performs the following processing. (a) Set the call destination ring level information and the execution address information of the user program calling unit 18 in the stack (not shown) according to the format formed by the inter-ring transition instructions. With this setting, although the inter-ring transition instruction is not actually used, the inter-ring transition instruction is used and it becomes as if the return instruction has not yet been used.

(b) Transfer control to the user program calling unit 18 of the called program by using an inter-ring return instruction. Here, a transition is made from a higher ring level to a lower ring level.

■ The user program calling unit 18:
The target user program 19 is started using a normal subroutine call instruction. This causes the user program 19 to operate at a lower ring level.

■ When control is passed to the user program calling unit 18 by a subroutine return command issued by the user program 19, the user program calling unit 18 calls the calling ring return unit 17.

■ In the ring transition vector table 22, the ring level of the system program 13 and the caller information restoration section 15 are registered in advance. The calling ring return unit 17 uses this ring transition vector table 22.
The caller information restoring unit 15 registered in this entry is called with an inter-ring transition command. This results in a transition from a lower ring level to a higher ring level.

[0031] When the caller information restoration unit 15 is activated by the caller ring recovery unit 17, it performs the following processing. (a) Refer to the system area 21 and check whether the save information is valid. If not “valid”, i.e. no external ring call was made previously, then
The call is considered invalid and an error is returned using the inter-ring return instruction. Alternatively, the transition request to the system program 13 is ignored.

(b) If the saved information is "valid", the saved information of the calling program is restored and control is passed to the system program 13 that is the calling source. As mentioned above, inter-ring return instructions, inter-ring transition instructions, etc.
By using these instructions in the reverse order, it is possible to transition from a higher ring level to a lower ring level and back from there. Therefore, routing processing etc. are not performed by the kernel program 12 but by the user program 19.
These functions can be realized by a system program 13 at a higher ring level.

[0033]

[Effect of the invention] As explained above, according to the present invention,
System programs within a space-specific area can call user programs that operate at a lower ring level, making it possible to provide flexibility in system service functions within a space and provide a wealth of functionality. , it greatly contributes to improved functionality.

[Brief explanation of the drawing]

FIG. 1 is a diagram explaining the principle of the present invention.

FIG. 2 is a diagram illustrating an example of transition to a lower ring according to an embodiment of the present invention.

FIG. 3 is a diagram illustrating an example of return from a lower ring according to an embodiment of the present invention.

FIG. 4 is an explanatory diagram of a ring protection mechanism related to the present invention.

FIG. 5 is a diagram illustrating problems in the prior art.

[Explanation of symbols]

10 Processing device 11 Space 12 Kernel program 13 System program 14 Calling source information saving section 15 Calling source information restoring section 16 External ring calling section 17 Calling source ring recovery section 18 User program calling section 19 User program

Claims (2)

[Claims] [Claim 1] In a processing device that performs ring level control in a computer system that has a program execution restriction and memory protection function using a ring protection mechanism, it is necessary after a calling program returns from a lower ring level program that it called. A caller information save unit (1) that saves information for restarting the process of the caller program.
4), a caller information restoring unit (15) that restores information for restarting the process of the caller program and restarting the process of the caller program, and being called by the caller information saving unit (14). The external ring calling unit (16) starts the program to transition from a higher ring level to a lower ring level, and the caller information restoration unit (15) transitions from a lower ring level to a higher ring level. ) and the external ring calling unit (16), the user program (19) is called by a normal call command, and the user program (
19), the calling ring return unit (19) returns from
A user program calling unit (18) that calls a user program (18) located at a lower ring level by calling the calling source information restoration unit (15) from a calling program located at a higher ring level.
9) A processing device for performing external ring transition, characterized in that the transition is made to: Claim 2: In a ring transition processing method in a computer system having a program execution restriction/memory protection function using a ring protection mechanism, a caller information saving unit (14) that saves caller information from a program operating at a higher ring level is provided. ), a process of saving information for restarting the processing of the calling program by the calling source information saving section (14), and a process of calling the calling source information saving section (14).
4), the process of activating the external ring calling unit (16), the process of transitioning from a higher ring level to a lower ring level by the external ring calling unit (16) and calling the user program calling unit (18), and The process of calling the user program (19) by the program calling unit (18) and calling the calling ring return unit (17) when returning from the user program (19), and the process of calling the calling ring return unit (17) at a lower ring level. to a higher ring level, and the caller information restoration unit (15
), and a process of restoring information for restarting the processing of the calling program by the calling source information restoration unit (15), and restarting the processing of the calling program, and is located at a higher ring level. From the calling program to the user program at the lower ring level (19
) is a processing method for performing an external ring transition.