JPS5847799B2 - memory protection device - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION The present invention relates to an improvement of a memory protection device in a computer system that has supervisor mode and user mode as process execution modes and employs ring protection as a memory protection method.

The ring protection method, known as one of the memory protection methods, defines a set of programs or data as a segment, assigns a ring number to each of these segments, and also assigns a ring number to the process that is the main body of program execution. When a process tries to access a segment, the ring number of this process is compared with the ring number of the segment it is trying to access, and the ring number of the process is determined by the ring number of the segment. This method allows access only when the value is less than or equal to the value, and disallows access when the value is greater.

This process will be explained in detail with reference to FIG.

Segment attributes such as ring numbers and segment start addresses for all segments are stored together in a segment table 105 in advance.

In the table 105, 106 stores the ring number, and 107 stores the segment start address.

In each program, the address format for accessing a memory not shown in FIG. 1 takes the format shown at 102, which is called a logical address or segment address.

Of these, 103 represents the segment number, and 104 represents the relative address within this segment.

By referring to the segment table 105 using the segment unit 103 of this logical address, attributes for the corresponding segment are obtained.

In the case of FIG. 1, 109 is the starting address of the segment, and this value and the relative address 104 within the logical address 102 are added by an adder 112.

The value 113 obtained by the adder 112 becomes a real memory address and is supplied to the memory.

At the same time, in this process, the ring number 108 read from the segment table 105 and the ring number 101 of the currently executing process are compared in size by the comparator 110 using the method described above, and a permission signal for access to this segment is issued. 111 is generated.

If access permission is not obtained as a result of this comparison, the memory is not accessed and an interrupt occurs.

With this method, by giving a small ring number to the core segment of the system, a small ring number to the core process of the system, and a large ring number to the user process, users can accidentally It is possible to avoid breaking the core segment.

Traditionally, this ring number was assigned to a process by the system supervisor, and it was prohibited to change it in user mode.

This is natural because if the user changes the ring number without permission, there is a risk of destroying the core of the system.

However, there are cases where it is desired to change the ring number even in user mode.

For example, when a part of a program in a user's process has not yet been debugged and you want to prevent this part from destroying the core data of the user process.

Specifically, as shown in FIG. 2, the program 201 in the user process 200 has three parts 202-2.
04, and 2030 parts have not been debugged yet.

Assume that 205 is the core segment of the user process and that it is not desired to be accessed from the program portion 203 to prevent destruction.

Now, to express this using ring protection without using any other memory protection method, you can do the following.

That is, the ring number may be changed at the end of the program 202, the program portion 203 may make the segment 205 inaccessible, and the ring number may be returned to the original ring number at the entrance to the program 2040.

Furthermore, it can be determined by the method described above whether the program portion 203 has correctly branched to the 2040 portion.

That is, if the program section 2040 entry is not correctly branched, the ring number remains changed at the end of the program section 202 and can be determined when the program section 204 is executed.

When using ring protection like these, changing the ring number in the user program allows you to check for program runaway in more detail.
It is also found to be useful for program debugging.

However, with the conventional method, the ring number cannot be changed in user mode, so it was necessary for the supervisor to change the ring number one by one.

This method requires complicated management of the ring number of the user program, takes a long time to execute, and is not a good idea.

Furthermore, in order to perform fine-grained memory protection, it may be possible to use a method other than the ring protection method, but this is not preferable as it would increase the amount of hardware.

The reason why the ring number of a process cannot be changed in conventional user mode is to prevent the user program from destroying the core of the system, as described above.

However, as explained above, if it became possible to change the ring number even in user mode, it would be very useful for debugging user programs without adding much new hardware.

The present invention has been made in view of the above circumstances, and in a memory protection method that employs ring protection, the ring number can be easily changed even in user mode, thereby making it useful for debugging user programs, etc. The object of the present invention is to provide a memory protection device that prevents a program from running out of control that may occur due to changing the ring number, and does not destroy the core of the system.

The present invention has a first register that stores a ring number, and a second register that also stores a ring number, separate from the first register.
The first register can be changed only in supervisor mode, the second register can be changed even in user mode, and the larger of the contents of the two registers is used as the process ring number. This makes it possible to freely change the ring number within the user program without breaking the core of the system.

An embodiment of the present invention will be described in detail below with reference to the drawings.

FIG. 3 is a diagram showing an embodiment of the present invention.

301 is a first ring number register that can be updated only in supervisor mode, and 302 is a second ring number register that can be updated also in user mode.

307 is a comparator that compares which of the contents of these two registers 30L302 is larger.

The multiplexer 309 selects the larger ring number based on the comparison result signal 308.

Ring number 310 selected by multiplexer 309
is compared by a comparator 311 with a ring number 313 of the segment obtained from a segment table (not shown).

An output signal 312 of comparator 311 indicates whether or not memory (not shown) can be accessed.

The setting conditions of the first ring number register 301 are limited by a flip-flop 303 that stores an execution mode.

That is, the set signal 305 for the first ring number register 301 is applied to the AND gate 304 only when the flip-flop 303 is in the supervisor mode.
controlled by

This circuit prevents the first ring number register 301 from being updated in user mode.

On the other hand, the second ring number register 302 can be freely updated by the set signal 306 regardless of the execution mode.

As mentioned above, the second ring number register can be set freely even in user mode, but the comparator 307,
Because of the multiplexer 309, the ring number of its own process cannot be set to a value smaller than the ring number determined by the supervisor.

That is, the output 308 of the comparator 307 is sent to the multiplexer 3
090 output 310 is determined to select the larger of the two ring number registers.

This shows that no matter how much the user program tries to change the ring number, it cannot be made smaller than the one determined by the supervisor, and therefore there is no risk of destroying the core of the system.

Now suppose that the program 404 of the user process 400 can be divided into three parts 405 to 407 as shown in FIG. 4, and the supervisor assigns ring number 1 to this process.
Assume that 14” is given.

Specifically, 1141 is stored in the first ring number register 401.
Set.

Further, a ring number 3 is given to the core segment 403 of the system to prevent it from being destroyed by a user program.

By doing this, no matter how the user program changes the contents of the second ring number register 402, the core of the system will not be destroyed.

Program portion 406 in user program 404
If debugging has not yet been completed, there is a risk that the core segment with ring number "411" 408 (for example, the data segment) will be destroyed.

Therefore, the program portion 406 must be prohibited from accessing the core segment 408 of the user program.

At this time, enter the ring number in the user program 404 as follows.
You can control it with.

That is, the program part 4060 entrance, in other words 4
In the last step of step 05, the ring number register 402 is
I'll change it to I6 1+.

Then, in the program part 406, when the core segment 408 is accessed, the ring number of the process becomes "61",
Since it is larger than II 4 1+ of the data segment, access is prohibited.

If the program portion 406 mistakenly attempts to access segment 408, an interrupt will occur, the mistaken access will be detected, and the instruction at which address will be used to access segment 408 by mistake.
I can tell if he tried to destroy 08.

Furthermore, the exit of the program portion 406, in other words 40
If the second ring number register 402 is returned to 141 at the entrance of 7, the program section 407 can freely access the segment 408.

During these processes, even if the user program accidentally
4 A value smaller than 11 is stored in the second ring number register 40.
According to the present invention, even if set to 2, it cannot be smaller than the value of the first ring number register 401, so II 4 1+, which the supervisor stored in the first ring number register, is adopted as the ring number of the process. The core segment 403 of the system cannot be accessed.

According to the present invention, in a system that has a supervisor mode and a user program mode and employs ring protection as a memory protection method, it is possible to change the ring number even in the user mode. Ring numbers can be set for each user program section without the help of a supervisor.

As a result, memory can be protected even in the user program, providing an effective means for debugging and the like.

Furthermore, since the supervisor does not have any involvement when changing the ring number in the user program, even if the memory protection device according to the present invention is employed, there is no effect on the supervisor.

Furthermore, in a system that implements ring protection, the present invention can be implemented with a slight increase in hardware.

Note that another embodiment in which the present invention can be realized is shown in FIG.

501 and 502 are first and second ring number registers, respectively; 501 can be updated only in supervisor mode, and 502 can also be set in user mode.

A flip-flop 503 indicates a mode and controls a set signal 505 to the ring number register 501.

These are exactly the same as those described in FIG.

The ring number 513 of the segment and the ring number registers 501 and 502 are compared separately by comparators 507 and 508, and the comparison results are output to signals 509 and 510, and both signals are the contents of the ring number registers 501 and 502. The access permission signal 512 is excited only when it is determined that the segment ring number 513 is smaller than the ring number 513 of the segment.

511 is an AND circuit that realizes this.

It is clear that this embodiment makes exactly the same determination as the embodiment shown in FIG. 3, which has been described in detail above.

It goes without saying that various other modifications can be made.

[Brief explanation of drawings]

Figures 1 and 2 are diagrams for explaining the prior art, Figure 3
The figures show one embodiment of the invention, FIG. 4 is a diagram for explaining the operation of one embodiment of the invention, and FIG. 5 is a diagram showing another embodiment of the invention. 301, 302...Ring number register, 30
3...Mode flip flow). 7', 307,
311...Comparator, 313...Set
Ring number, 401, 402... Ring number register, 403, 408... Data segment, 404... Program.

Claims (1)

[Claims] 1. In a computer system that has a supervisor mode and a user mode as process execution modes and employs ring protection as a memory protection method, a ring number of a running process that can be updated only in the supervisor mode is stored. 1st
and a second ring number register that can be updated even in the user mode, and the larger of the contents of the first and second ring number registers is set as the ring number of the currently executing process. A memory protection device characterized by: