Linkage mechanism for program isolation5220669Abstract A computer system has general purpose registers, control registers and access registers for containing information to allow address space capability. A linkage stack uses protected address space to store state information during program call and program return operations. The linkage stack contains information relating to state entries for the saved information and header and trailer entries to point to other linkage stack sections. A control register contains the pointer to the current linkage stack entry and is changed as the program call or return moves through the stack. Claims Having thus described our invention, what we claim as new and desire to secure by Letters Patent is: Description CROSS REFERENCE TO RELATED APPLICATIONS
______________________________________
0000001 Header entry
0000010 Trailer entry
0000100 Branch state entry
0000101 Program call state entry
______________________________________
Bits 8-15 of the entry descriptor are a section identification (SI) provided by the control program. In the entry formed by a stacking process, the process sets the SI equal to the SI of the preceding linkage-stack entry. Bits 16-31 of the entry descriptor form the remaining free space (RFS) field which specifies the number of bytes between the end of this entry and the beginning of the trailer entry in the same linkage stack section. Bits 32-47 of the entry descriptor form the next entry size (NES) field which specifies the size, in bytes, of the next linkage stack entry, other than a trailer entry, in the same linkage stack section. When a new state entry is to be formed in the linkage stack during the stacking process, the new entry is placed immediately after the entry descriptor of the current linkage stack entry, providing that there is enough remaining free space in the current linkage stack section to contain the new entry. If there is not enough remaining free space in the current section, and if the trailer entry in the current section indicates that another section follows the current section, the new entry is placed immediately after the entry descriptor of the header entry of that following section, provided that there is enough remaining free space in that section. If the trailer entry indicates that there is not a following section, an exception is recognized, and a program interruption occurs. The control program then allocates another section, chains it to the current section, and causes the stacking operation to be reexecuted. If there is a following section but there is not enough free space in it, an exception is recognized. When the stacking operation is successful in forming a new state entry 44, it updates the linkage-stack-entry address in control register 15 so that the address designates the leftmost byte of the entry descriptor of the new entry, which thus becomes the new current linkage-stack entry. When a state entry is created during the stacking process, zeros are placed in the NES field in the created entry, and the length of the created state entry is placed in the NES field of the preceding entry. During a return operation, the contents of the general registers, access registers, and various contents of the control registers are restored from the linkage-stack-state entry 44, and the linkage-stack-entry address in control register 15 is changed to point to the previous linkage-stack entry. When the state entry is logically deleted during the unstacking process of a return operation, zeros are placed in the NES field in the preceding entry. It will thus be understood that the use of the linkage stack allows the operating environment and authorization level of the calling program to be reinstated when program control is returned from the called program by a return instruction. Thus, the linkage operation is both retraceable to the beginning point and enforceable against the user to that invalid changes may not occur. An ASN number is assigned by the control program for each address space which contains programs. The ASN may be translated during a PC-ss operation as described in connection with the DAS facility. However, since the ASTE address is found in the ETE (see FIG. 8), access to the ASTE may be made directly through the ETE in a PC-ss operation without ASN translation. The control program associates a STD, an AT, and a linkage table with each ASN by placing pointers in the ASTE associated with the address space. Data in these address spaces may also be accessed by having the control program construct an access list entry pointing to the ASTE. Certain address spaces may contain only data, no programs. These address spaces do not have ASNs. In the case of data only spaces, only the ASTE, STD, AT, and ALE are used. FIGS. 11 and 12 show the format of entries in the ASN first table and ASN second table, respectively, and are very similar to those of the aforementioned DAS facility. Each entry in the ASN tables of FIGS. 11 and 12 represent an address space and are established by the control program to provide linkage and authorize addressability to the associated address space. FIG. 12 shows the format of an ASTE. Bit 0 of the ASTE is an invalid bit for indicating the validity of the ASTE. The authority table origin (ATO) and the authority table length (ATL) indicate the authority table designation (ATD) of the associated authority table. Bits 96-127 contain the associated linkage-table designation (LTD) and bits 128-160 contain the associated access-list designation. Bits 160-191 contain an ASTE sequence number (ASTESN) for the ASTE. Since the ASTE may be reallocated as address spaces are created and deleted by the control program, each newly created ASTE has a new, unique ASTESN assigned to it. When an ART operation takes place, the ASTESN in the access-list is compared with the ASTESN in the ASTE as a validity check so that the ASTE may safely be reused for a different address space or different authority. FIG. 13 shows an authority table which is associated with each ASTE. As with the DAS facility, each authority table entry has a P bit and a S bit. The entries in the authority table are indexed such that there is one entry in the authority table for each of the values of EAX in use to access the associated address space. As will be discussed, the entry of the authority table which corresponds to the value of EAX in control register 8 may be used to determine if a program is authorized to access the address space associated with the ASTE. FIG. 14 shows the format of the dispatchable unit control table (DUCT) whose address is located in control register 2, as previously discussed. The dispatchable-unit-access-list designation is stored in bytes 16-19 of the DUCT. The other bytes of the DUCT are not used in the MAS facility, and will not be discussed further. The PROGRAM CALL instruction has been enhanced to improve the function of the linkage facility. If the T bit, bit 128, of the ETE (see FIG. 8) is one, a stacking PROGRAM CALL operation is performed responsive to a PROGRAM CALL instruction. A stacking PROGRAM CALL (stacking PC) is authorized to enter at a point in an entry table by the authorization key mask in the entry table entry. A stacking PC with space switching, among other operations, may place a new EAX (associated with the new program) in control register 8. The stacking PC saves the contents of general registers 0-15, the contents of access registers 0-15, the complete PSW with an updated instruction address (the return address), the primary and secondary ASNs, the PKM, the EAX, an indication that the entry was formed by PROGRAM CALL, the PC number used, and a two word modifiable area in the entry. The purpose of the modifiable area is to allow a program to "footprint" its progress so that appropriate recovery actions can be taken if a failure of the program occurs. Two new instructions have been added to improve linkage function:
______________________________________
BRANCH AND STACK
PROGRAM RETURN
______________________________________
The BRANCH AND STACK instruction changes the instruction address in the PSW, and forms a state entry, called a branch state entry in the linkage stack of FIG. 9. The branch state entry is the same as a program call state entry except that it indicates that it was formed by BRANCH AND STACK and contains the branch address instead of the PC number. The BRANCH AND STACK instruction can be used either in the calling program or at (or near) the entry point of the called program. The BRANCH AND STACK instruction at an entry point allows the linkage stack to be used without changing old calling programs. The PROGRAM RETURN instruction is used to return from a program given control by means of either a stacking PROGRAM CALL or a BRANCH AND STACK instruction. PROGRAM RETURN logically deletes the last linkage-stack state entry, which may be either a program call state entry or a branch state entry. If the last state entry is a program call state entry, PROGRAM RETURN restores all of the state information that was saved in the entry, and the contents of general registers 2-14 and access registers 2-14. General and access registers 0, 1 and 15 are unchanged by PROGRAM RETURN. If the last state entry is a branch state entry, PROGRAM RETURN restores only the complete PSW (subject to one exception noted) and the contents of general registers 2-14 and access registers 2-14. However, the PER mask bit R, FIG. 4, is not restored by the PR operation. The combination of a stacking PROGRAM CALL and a PROGRAM RETURN permits non hierarchical program linkage, that is, linkage from a program with some amount of authority to a program with less, more or completely different authority. FIGS. 15, 16 and 17 present the logic flow of the steps necessary to execute a stacking PC operation. It will be noted that the logic flow of FIGS. 15, 16 and 17 can also be used to execute a DAS PROGRAM CALL instruction. The textual information in the figures describe how various values may be mathematically manipulated to form addresses. Referring back to FIG. 3, if bit 15 of control register 0 (CR0.15) is equal to zero, ETE is 16 bytes and only a DAS PROGRAM CALL operation can be performed. If CR0.15 is one, ETE is 32 bytes, and ETE bit 128 controls whether a DAS PC or a stacking PC is performed. FIG. 15 is a logic flow diagram of the PC number translation operation of a program call. If CR0.15=1, the ASTE pointed at by the PASTEO entry in control register 5 (see FIG. 3) is fetched. This primary-ASTE includes an LTD at bits 96-127 (see FIG. 12). If the PROGRAM CALL is a DAS PROGRAM CALL (CR0.15=0) the LTD is located in control register 5 as in a normal DAS operation. The PROGRAM CALL instruction 50 includes an LX 51 and an EX 52, similar to that discussed in connection with the DAS facility. The LX 51 is joined with the linkage-table origin (LTO) 53 by an adder operation 53 to give the real address of a linkage table entry 55. The entry-table origin (ETO) of the linkage table entry 55 is joined with the EX52 by an adder operation 56 to give the real address of an entry-table entry (ETE) 57 in the entry table. FIG. 16 is a logic flow of the steps which are executed in addition to the those shown in FIG. 15 for performing a stacking PROGRAM CALL to current primary (PC-cp) and a stacking PROGRAM CALL with space switching (PC-ss). As previously discussed, if the T bit 60 of the ETE 57 is equal to 1, a stacking operation is to be conducted. First, the value of the AKM 62 is ANDed at 63 with the PKM in control register 3 as it existed before the execution of the PROGRAM CALL instruction in the problem state, as shown at 64. If the result of the ANDing operation at 63 gives all zeroes, the PROGRAM CALL instruction is not authorized to enter at this point, and the PROGRAM CALL operation is terminated. If any one of the bits match in the ANDing operation of 63, the program is authorized to make the PROGRAM CALL at this entry, and the operation continues. If the PROGRAM CALL is authorized, the PSW at 65, the EAX at 66, the PKM 64, the SASN 68, and the PASN 69 as they all existed before the PROGRAM CALL are placed on the linkage stack. Also placed on the linkage stack, but not shown, are the contents of the general registers, the contents of the access registers, and the PC number (see FIG. 10). The addressing mode bit A and the entry instruction address are placed in the PSW at 70 and 71. The P-bit and C-bit of the ETE 57 are placed in the PSW at 72 and 73. If the K-bit is equal to 1, the entry key of the ETE 57 is placed in the key of the PSW at 74. If the E-bit is equal to 1, the entry EAX is placed in control register 8 at 75. The entry parameter (EP) is placed in general register 4 at 76. If the M bit of the ETE 57 is equal to 1, the entry key mask (EKM) replaces the PKM at 77 in the control register 3. If, however, the M bit is equal to 0, the EKM is ORed into the PKM of control register 3 by the ORing operation 78. If a PC-cp operation is being executed or a stacking PC-ss is being conducted and the S-bit is equal to 0, the PASN at 69 replaces the SASN at 79 in control register 3, and the PSTD at 80 in control register 1 replaces the SSTD 81 in control register 7. If a stacking PC-ss is being conducted and the S bit is equal to 1, the SASN in control register 3 is replaced by the new PASN and the SSTD in control register 7 is replaced by the new PSTD. After these operations, the ASN of ETE 56 is tested at 83. If the ASN is equal to 0, a PC-cp operation is being conducted and is complete. If, however, the ASN is not equal to 0, a PC-ss operation is being conducted and the ASTE is obtained for the destination space. The PROGRAM CALL may change the PSW key 74 with the EK (K bit=1) to give access to fetch protected code of the next instruction. By changing the EAX in control register 8 (see 75), each program executed to perform the work of the dispatchable unit can be differently authorized to use the ALEs in the DUAL and the PSAL. The EAX 75 in control register 8 can be set equal to the EEAX by a stacking PROGRAM CALL (E bit=1). The original EAX will then be restored from the linkage stack by a PROGRAM RETURN. Thus, each program can be executed with an EAX that is specified in the ETE that is used to call the program. Alternately, the EAX can remain unchanged during a calling linkage (E bit=0), allowing the called program to have the same authority as its caller. By setting the PKM 77 in control register 3 equal to the EKM by a PROGRAM CALL (M bit=1), the called program has a PKM that is independent of the PKM of the calling program. This allows the called program to have less authority, in terms of the PSW key values it can set, than the calling program. Alternately, the new PKM 77 may be set equal to the OR of the old PKM 64 and the EKM (M bit=0), if desired (see 78). Setting the new SASN and new SSTD equal to the new PASN and new PSTD, respectively (S=1), prevents the called program from automatically having access, through the use of ALET 00000001 hex, to the caller's primary address space (access capability still may be obtainable by means of either an ALE or the DAS SET SECONDARY ASN instruction). This is another way in which the authority of the called program can be less than that of the caller. Alternately, the new SASN at 79 and the new SSTD at 81 may be set equal to the old PASN at 69 and the old PSTD at 80, respectively (S bit=0). FIG. 17 is a logic flow of the steps of an ASN translation. As in the DAS facility, each address space containing programs is assigned an ASN, whose value is stored at 90 in the corresponding ETE 57. Also as in DAS, the ASN at 90 consists of two numbers, an AFX 91 and an ASX 92. Control register 14 includes an ASN-first-table origin (AFTO) 93 which, when joined with the AFX at 91 by an adder operation at 94 gives the real address of an AFTE 95 in the ASN first table. The AFTE 95 includes an ASN-second-table origin (ASTO) 96 which, when joined with the ASX 92 by the adder operation at 97, forms the real address of the ASTE 98 in the ASN second table 30, also discussed in connection with FIG. 2. Since the ASTE address 100 is located in the ETE 57 when CR0.15 is one, it may be used in place of the ASN translation described. Control bit T, 101, located at bit 12 of control register 14 is an ASN translation bit. If bit 12 of control register 14 is zero, neither the ASTE address 100 nor the ASN 90 can be used. If bit 12 is one, either can be used. The AX 102 of ASTE 98 and the ASN 90 of ETE 57 are placed in control register 4 at respectively, for PC-ss operations. The STD 105 of the ASTE 98 is placed in control register 1 at 106. If CR0.15=1, the ASTE address is placed in control register 5 at 107 as the PASTEO. If CR0.15=0, the LTD at 108 of ASTE 98 is placed in control register 5 at 107. It can thus be seen that the ASN translation of FIG. 17 provides for either DAS or MAS operations. The PC-ss operation discussed in connection with FIGS. 15, 16 and 17 may be used to transfer control to a new address space for instruction fetching operations, thereby establishing the new address space as the primary address space. Typically, when the PC number, the entry-table entry and the linkage-table entry are established by a service provider, an AKM is specified for setting the authority of programs calling that PC number. If a calling program has the authority to enter the program defined by the entry-table entry, as determined by the ANDing operation 63 of FIG. 16, the PC operation may change the EAX stored in control register 8. For example, the PC operation may also be used to call a system service to add a new ALE to one of the access lists 24 or 25, as discussed in connection with the access list entry of FIG. 6. The service program can establish a new access list entry and provide a new ALET for use in access register mode operations by the calling user. When an access list entry is formed, the EAX from the callers control register 8 is placed in the ALE as the ALEAX. Once the ALE is created, the service program returns the ALET for that ALE to the user program. The ALET may then be stored, or passed to other address spaces, in any convenient manner for use in fetching or storing operands. The described authorization procedures prevent an unauthorized program from using an ALET. Some access list entries may be designated by their owners at the time of creation either as private entries to provide address space access only by the owner or an authorized user, or as public entries open to all users. In the case of public entries (P-bit, bit 7 is zero), the ALE is open and free to be used by any program. If the P-bit (bit 7) of the ALE is set to one, the ALE is to be used only by authorized programs. The control program provides facilities for adding entries to the AT of the associated address space if more than one EAX is to be allowed to use the ALE. FIG. 18 is a diagrammatic illustration of the access-register translation with program authorization checks. When an ALET is used in an access register operation to fetch or store an operand, bits 0-6 of the ALET are examined at 115 to insure that the ALET is valid. If the P-bit 116 in the ALET is 0, the access list is a DUAL, and if the P-bit 116 is 1, the access list is a PSAL. If the access list is a DUAL, the effective ALD is fetched from the DUCT whose address is stored in control register 2. If the access list is a PSAL, the effective ALD is fetched from the primary ASTE (PASTE) whose address is stored in control register 5. The effective ALD includes an access list origin and an access list length (ALL). At 117, the ALEN is compared to the ALL to determine that the ALEN is not outside the bounds of the access list. If the ALEN passes this validity check, the effective access-list origin is joined with the ALEN by an adder operation at 119 to find the address of the ALE 120 in the access list 121. The invalid bit, bit 0 of the ALE 120, is checked at 121 to see if it is 0, thereby determining if the ALE 120 is valid. If the ALE 120 is valid, the ALESN 122 of the ALET is compared to the ALESN 123 of the ALE 120 at 124. If the ALESN 122 is equal to the ALESN 123, the ALET is still authorized to designate the ALE 120, and the ASTE address 125 is used to fetch the ASTE 126. The validity of the ASTE 126 is confirmed by checking the invalid bit 127 at 128. If the ASTE 126 is valid, the ASTESN 130 is compared with the ASTESN 131 at 132 to insure that the ALE 120 is still authorized to designate the ASTE 126. These checks complete the validity portion of the ART. The authority of the calling program to access the address space is now checked. The first check is made at 135 to determine if the P bit 136 is 0. If the P bit of 136 is 0, all programs are authorized to access the address space associated with the ALE, and no further checks are made. If the P bit 136 is 1, the ALEAX 137 is compared to the EAX 138 in control register 8 by the comparator 139. If the comparison at 139 is equal, then the program is specifically authorized to access the address space, and no further checks are made. If the comparison at 139 is not equal, then an ASN extended authorization check is made at 140. The ASN extended authorization check 140 is made by comparing the EAX in control register 8 with the authority table length (ATL) 141 to make sure that the EAX does not designate an entry outside of the bounds of the authority table. The EAX located in control register 8 is used as an index into the authority table whose origin is ATO 142. If the S bit in the authority table is set equal to 1 for that EAX, then the program is authorized to have access into the address space. If the program is authorized to have access to the address space, as described, the STD 144 is provided for the DAT operation at 145. The private bit and the ALEAX field in the access list entry provide high performance authorization mechanisms to grant or prohibit a program's access to an address space represented by the ALE. The private bit can be 0, thus allowing all programs which execute with the access list to access the address space represented by the ALE. The ALE private bit can be 1 and the user's EAX in control register 8 can be equal to the ALEAX field. This allows programs with a particular EAX to access the address space represented by the ALE. Finally, the ALE private bit can be one and the user's control register 8 EAX can select an entry in the target space's authority table which has the S-bit equal to one. This allows multiple programs running with different EAXs to access the address space represented by the ALE. FIG. 19A and 19B, when taken together, form a flow chart of the access register translation steps and exceptions. When the ART logic is invoked, a check is made at 150 to determine if access register 0 has been designated. If access register 0 has been designated, a check is made at 151 to determine if the ART was invoked by a TEST ACCESS operation (to be described). If access register 0 was not designated, or if this is a TEST ACCESS operation, the ALET in the access register is designated for use at 152. If access register 0 is designated and this is not a TEST ACCESS operation, a 00000000 hex is assigned to the ALET at 153. A check is made at 154 to determine if the ALET is equal to 00000000 hex. If yes, the STD for the primary address space is obtained from control register 1 at 155. At 156, a check is made to determine if the ALET has a value of 00000001 hex. If yes, the STD for the secondary address space is obtained from control register 7 at 157. A check is made at 158 to determine if bits 0-6 of the ALET are equal to 0. If bits 0-6 are not equal to 0, the assigned value of the ALET is not valid and an ALET specification exception is raised at 159 and the operation is suppressed. A check is made at 160 to determine if the ALET bit 7 is 1. If it is, the PASTEO entry in control register 5 is decoded at 161 and the effective ALD is fetched for the PSAL. If the ALET bit 7 is equal to 0, the DUCTO entry in control register 2 is decoded at 162, and the effective ALD is fetched for the DUAL. If the fetching address is not valid at 163, an addressing exception is raised at 164, and the operation is suppressed. If the address is valid at 163, a check is made at 165 to determine if the ALEN of the ALET is outside the range of the effective ALL (bits 25-31 of the effective ALD). If it is, an ALEN translation exception is raised at 166, and operation is nullified. If the answer at 165 is no, the ALE is located at 167 and a check is made to see if the ALE address is valid. If the ALE address is not valid, an addressing exception is raised at 168 and the operation is suppressed. If the address is valid at 167, the valid bit in the ALE is checked at 169 to see if the ALE is valid. If the ALE is not valid, an ALEN translation exception is recognized at 170, and the operations is nullified. If the ALE is valid at 169, the ALESN of the ALET is compared to the ALESN of the ALE at 171. If the comparison at 171 is not equal, an ALE sequence exception is recognized at 172, and the operation is nullified. If there is an equal compare at 171, the ASTE is located at 173 using the ASTE address in the ALE. A check is made to determine if the ASTE address is valid. If the address is not valid, an addressing exception is raised at 174 and the operation is suppressed. If the ASTE address is valid at 173, the validity bit of the ASTE is checked at 175 to determine if the ASTE is valid. If the ASTE is not valid, an ASTE validity exception is raised at 176, and the operation is nullified. At 177, the ASTESN of the ALE is compared with the ASTESN of the ASTE. If there is not an equal comparison at 177, an ASTE sequence exception is raised at 178, and the operation is nullified. The previous blocks 163-178 thus determine if the entries obtained are valid. At 179, the private bit of the ALE, bit 7, is checked to see if it is equal to 0. Also at 179, the ALEAX entry in the ALE is compared to the EAX in control register 8. If either of the checks are equal, the STD for the operand is obtained from the ASTE of the address space, as shown at 180. When the private bit is 0, the program is authorized, and the authorization step of the access register translation is completed. When the private bit is 1 but the ALEAX is equal to the EAX, the program is also authorized, and the authorization step of the access register translation is completed. If the program is not yet authorized at 179, then at 181, the validity of the ASTE is checked by determining if the ASTE bits 30, 31, and 60-63 are 0. If not, an ASN translation specification exception is raised at 182 and the operation is suppressed. At 183, the value of the EAX bits 0-11 in control register 8 is compared against the length of the authority table to make sure that the EAX does not designate an entry outside of the bounds of the authority table. If the comparison at 183 is yes, an extended authorization exception is raised at 184 and the operation is suppressed. If the EAX designates an entry within the bounds of the authority table, the associated EAX entry is located in the authority table at 185. If the address of the authority table entry is not valid, an addressing exception is raised at 186 and the operation is suppressed. An extended authorization check is made at 187 by determining if the secondary authorization bit (S-bit) of the authority table entry located at 185 is equal to 1. If the check at 187 is yes, the program is one of those authorized by the authority table associated with the address space, and the STD for the address space is obtained from the ASTE at 188. If the comparison at 187 is no, the program is not authorized and an extended authority exception is recognized at 189, and the operation is nullified. The MAS facility includes a TEST ACCESS REGISTER (TAR) instruction for performing the mentioned test access operation. TEST ACCESS has the following format: TAR A1, R2 The ALET specified as being in the access register of the first operand A1 is checked for ALET translation exceptions using the EAX in the general register specified by the second operand R2. As shown in FIGS. 19A and 19B, the TEST ACCESS REGISTER instruction, as determined in 151 of FIG. 19A, causes an ART operation to be performed. The TAR instruction returns the following results of the test in the PSW condition code (CC) see FIG. 4. 0=ALET specified is 0 and is valid for access. 1=ALET specified is not 0 or 1, is in the DUAL addressed by control register 2, and is valid for access with the specified EAX. 2=ALET specified is not 0 or 1, is in the PSAL addressed by control means of register 5, and is valid for access with the specified EAX. 3=ALET specified either is 1 or is invalid for access with the specified EAX. The ability to test an ALET for authorization exceptions using an input EAX allows the program to determine if the ALET references the caller's PASN (ALET=0), or if the ALET references the DUAL, or if the ALET references the caller's PSAL. This allows the program to be independent of the internal format of the ALET. When the TAR instruction is used and ART is performed, an ALB entry is created. Thus, when the ALET in the AR is actually used, the ALB contains the entry, provided no exception occurred during ART. FIG. 20 shows an example use of the TAR instruction. A dispatchable unit task control block TCB1, while executing at 200, has an EAX of 5. This EAX allows the program to use specific entries on its dispatchable unit access list for TCB1. At 201, the first program makes a PC call to a second program which resides in address space ASN2, and the first program passes an ALET which the second program in ASN2 must use. At 202, the program in ASN2 is executed with an EAX=8, which is different from its caller's EAX. If at 202, the program used the ALET provided by the calling program, there could be a system integrity problem. The calling program may not have had the EAX authority to reference the ALET, but the ASN2 program does. The ASN2 program must perform a validity check to determine if the caller had the authority to use the ALET that is passed. At 203, the program in ASN2 makes the validity check using the TAR instruction with the input ALET and the EAX=5 of the caller. The caller's EAX is obtained from the linkage stack entry made on the program call to ASN2. If the TAR instruction gives a condition code which states that the caller was authorized to use the ALET, then the ASN2 program will continue to perform its function. If the caller was not authorized, then the ASN2 program will either ABEND the caller, or return to the caller with a return code which indicates that the call was not successful. When control returns at 204 by means of a RETURN instruction, the callers EAX (EAX=5) is restored from the stack, and the ASN1 program continues to execute with that EAX. The ALET validity check function is needed quite frequently. In the example of FIG. 20, it is needed on every call to the program in ASN2. This function could be provided by an operating system service routine, however, the performance overhead would be excessive. If the TAR function is not provided, programs which must reference a caller's ALET and change the EAX, may need to use two PC instructions. The first PC would not change the EAX and the caller's parameters would be referenced with the callers EAX. Later, a second PC would be executed to provide the new EAX for the called program to use. The called service may require a different EAX to do its function and this mechanism allows use of the correct EAX. The TAR function thus provides a more efficient performance. It will be understood that, although the example of FIG. 20 shows the TAR instruction used with an ALET on the DUAL, the TAR instruction can be used with ALETs on both the DUAL and PSAL. Referring to FIGS. 21-25, the access register translation (ART) mechanism normally is implemented such that access list designations and information specified in access lists, ASN second tables, and authority tables are maintained in a special buffer, referred to as the ART lookaside buffer (ALB) previously shown at 199 in FIG. 2. Access list designations, access list entries, ASN second table entries, and authority table entries are collectively referred to as ART table entries. The CPU necessarily refers to an ART table entry in real storage only for the initial access to that entry. The information in the entry may be placed in the ALB, and subsequent ART operations may be performed using the information in the ALB. The presence of the ALB affects the ART process to the extent that a modification of an ALD, ALE, ASTE, or ATE entry in real storage does not necessarily have an immediate, if any, effect on the translation. The size and the structure of the ALB depend on various possible embodiments. For instance, the ALB may be implemented such as to contain at most 15 entries corresponding one to one with access registers 1-15, with each entry consisting of only a segment table designation (see FIG. 24); or it may contain arrays of values which are selected on the basis of an ALET, the current dispatchable unit control table origin or primary ASTE origin, and the current extended authorization index. In the first case, an ALB entry is cleared when the corresponding access register is reloaded, and the entire ALB is cleared upon a change to the contents of control register 2, 5 or 8. In the second case, information in the ALB persists despite changes of access register contents or control register contents. Entries within the ALB are not explicitly addressable by the program. Information is not necessarily retained in the ALB under all conditions for which such retention is possible. Furthermore, information in the ALB may be cleared under conditions additional to those for which clearing is mandatory. All information in the ALB is necessarily cleared only by execution of PURGE ALB or SET PREFIX or by a CPU reset. An ALB entry contains information fetched from an ART table entry in real storage and also the information used to select the ART table entry in real storage. An access list designation source origin (ALDSO) is used to select an ALD in real storage. The ALDSO is the dispatchable unit control table origin in control register 2 if the primary list bit in the ALET being translated is zero, or it is the primary ASN second table entry origin in control register 5 if the primary list bit in the ALET is one. The access list origin part of an ALD, along with an ALET, is used to select an ALE in real storage. The ASTE address in an ALE is used to select an ASTE in real storage. The authority table origin in an ASTE, along with the EAX in control register 8, is used to select an ATE in real storage. Referring to FIG. 21, in a first embodiment of an ALB, the ALB-ALD and the ALB-ALE are combined into an ALB-ALD/ALE so that the access list origin need not be in the ALB entry. If the ALDSO and ALET for the ART request match the content of the ALB entry, then the ALB provides the following information: P bit, the ALEAX, the ASTE address and the ASTESN, all from the ALE. Thus, this entry type allows the verification of authority to be relooked at and access to ASTE for the STD, with verification of the ASTESN entry, to be made at time of use. This provides efficient use of the ALB because different ALETS may point to the same ASTE and STD. Thus, this design of the ALB substitutes for use of the proper access list and determination of the ALE. However, the ASTE and authority mechanisms are used as before. Referring now to FIG. 22, the function of the ASTE may also be combined into a different embodiment of the ALB so that the STD is directly obtained from the ALB. Thus, the ALDSO and ALET, if a match exists in the ALB, provide the following information: P-bit, ALEAX, authority table origin (ATO), authority table length (ATL) and STD. Thus, the ASTE is not accessed for the STD, ATO and ATL because it has been retained in the ALB. However, if an ASTESN is changed in the ASTE, the ALB must be purged because the ALB contains the STD without reverification of the capability through the ASTESN. Referring to FIG. 23 a third embodiment of an ALB combines into a single ALB entry the information and the attributes from the ALD, ALE, ASTE and ATE so that the ALB entry shown in the figure is all that is necessary. To further simplify, if the embodiment of FIG. 23 automatically clears the ALB of all entries whenever an ALD source origin is changed in control register 2 or 5, then the ALDSO field is not required in any ALB entry. As an additional simplification, the P, ALEAX, EAX and S fields need not be implemented if the machine clears the ALB of entries whenever the EAX field is changed in control register 8. Such a simplified embodiment is shown in FIG. 24 where each ALET simply fetches an STD, dependent on the necessary ALB purge operations to protect the STD's from improper use. Finally, if each entry corresponds one to one with one of access registers 1-15 and is cleared when the access register is reloaded, the ALET field is not required. Translations of ALET values of zero and one are not permitted to use the ALB. If the actual implementation has additional copies of the contents of control registers 1 and 7, the machine may have to perform some type of special action in order to track changes to these control registers. The formation of ALB entries and the effect of any manipulation of an ART table entry in real storage by the program depend on whether the ART table entry is attached to a particular CPU and on whether the entry is valid. The attached state of an ART table entry denotes that the CPU to which the entry is attached can attempt to use the entry for access register translation. The ART table entry may be attached to more than one CPU at a time. An access list entry or ASN second table entry is valid when the invalid bit associated with the entry is zero. Access list designations and authority table entries have no invalid bit and are always valid. The primary space access list designation is valid regardless of the value of the invalid bit in the primary ASTE. An ART table entry may be placed in the ALB whenever the entry is attached and valid. An access list designation is attached to a CPU when the designation is within the dispatchable unit control table specified by the dispatchable unit control table origin in control register 2 or is within the primary ASTE specified by the primary ASTE origin (PASTEO) in control register 5. Control register 5 is considered to contain the primary ASTE origin regardless of the value of the multiple address space control, bit 15 of control register 0. Referring now to FIG. 25, the preferred embodiment of an ALB is shown in which the ALB consists of several different tables which are accessed separately and sequentially during ALB usage and can thus provide more than one path to an STD. In the first step, a table or array referred to as an ALB-ALD/ALE table is accessed by an entry consisting of an ALDSO and an ALET which is compared (in the blocks labeled C) with all table entries and if a match is found the correct result is gated at blocks G to the next step. The ALB-ALD/ALE table entries provide as resultant information the P-bit (private bit), the ALEAX, the ASTE address and the ASTESN. In the second step, the ASTE address is used as the search term in an ALB-ASTE table or array, again shown by the C compare blocks. If a match is found, an ALB-ASTE entry is gated, as shown by G, consisting of an ASTESN, an ATO, and ATL and an STD. The ASTESN is in turn compared with the ASTESN provided from the ALB-ALD/ALE entry and there must be a match or the ALB process will not continue. If the P bit from the ALB-ALD/ALE entry is one and the EAX in CR8 does not equal the ALEAX in the ALB-ALD/ALE entry, then, as a last step, authority is checked using an ALB-ATE table or array. The ATO and EAX are together used as a search key. The EAX is determined from control register 8 and the ATO is used from the result found in the second step. Again if a match is found, an entry consisting of a secondary bit, S bit, from the ATE is gated as the result for testing authority. An ASN second table entry is attached to a CPU when it is designated by the ASTE address in either an ALB-ALD/ALE array entry or an attached and valid ALE. An authority table entry is attached to a CPU when it is within the authority table designated by either an ALB-ASTE array entry or an attached and valid ASTE. An ALB-ALD/ALE entry may be used for ART only when all of the following conditions are met: 1. The ALET to be translated has a value larger than 1. (If the ALET is 0 or 1, the contents of CR1 or CR7 are used.) 2. The ALDSO field in the ALB-ALD/ALE matches the ALDSO field in the ALD being used. 3. The ALET field in the ALB-ALD/ALE matches the ALET to be translated. 4. The ALB-ALD/ALE entry passes the ALE authorization test; that is, one of the following conditions is true: a. The private bit in the ALB-ALD/ALE entry is zero. b. The ALEAX in the ALB-ALD/ALE entry equals the current EAX. c. The current EAX selects a secondary bit(s) that is one for the authority table designated by the ASTE that is addressed by the ALB-ALD/ALE. An ALB-ASTE entry may be used for ART whenever the ASTE address and ASTESN in the ALB-ASTE entry match the ASTE address and ASTESN in the ALE or ALB-ALD/ALE being used. In addition, two or more ALB-ALD/ALE entries may designate the same ALB-ASTE entry, thus providing more paths to the ALB-ASTE array and justifying the use of separate array types in the ALB. An ALB-ATE entry may be used for ART when both of the following conditions are met: 1. The ATO in the ALB-ATE entry matches the ATO in the ASTE or ALB-ASTE entry being used. 2. The EAX in the ALB-ATE entry matches the current EAX. When an attached but invalid ART table entry is made valid, or when an unattached but valid ART table entry is made attached, and no usable entry formed from the ART table entry is already in the ALB, the change takes effect no later than the end of the current instruction. The contents of the ALB need not be affected by a change of AR contents. The ALB can contain information pertaining to different AR contents or different EAX domains having different dispatchable units all at the same time. If a task is redispatched after being undispatched the ALB may still contain usable entries for ART. When an attached and valid ART table entry is changed, and when, before the ALB is cleared of copies of that entry, an attempt is made to perform ART requiring that entry, unpredictable results may occur, to the following extent. The use of the new value may begin between instructions or during the execution of an instruction, including the instruction that caused the change. Moreover, until the ALB is cleared of copies of the entry, the ALB may contain both the old and the new values, and it is unpredictable whether the old or new value is selected for a particular ART operation. When LOAD ACCESS MULTIPLE or LOAD CONTROL changes the parameters associated with ART, the values of these parameters at the start of the operation are in effect for the duration of the operation. All entries are cleared from the ALB by the execution of PURGE ALB and SET PREFIX instructions and by a CPU reset. These instructions will have to be used to prevent undesired conditions in the ALB. The multiple address space (MAS) facility offers improvements in two major areas: 1. Data Accessing: Data in up to 16 different address spaces, including the instruction space, can be accessed concurrently by the program without changing any control parameters. This facility is provided by means of 16 new registers named access registers. Still more address spaces can be accessed by changing the contents of the access registers. 2. Program Linkage: The contents of an entry table entry are extended to allow increased status changing during a program call operation. A linkage stack is provided for saving status during program call and for restoring it by means of a new instruction named program return. There is also a new branch type linkage that uses the linkage stack. MAS provides sixteen 32-bit access registers numbered 0-15. Access registers are used to address storage operands in a new addressing mode called the access register mode. The access register mode results from new bit settings in the PSW. In the access register mode, an instruction B or R field that designates a general register containing a storage operand address also designates the same numbered access register. The contents of the access register are used in a process called access register translation (ART) to obtain the segment table designation that will be used to translate, by means of DAT, the storage operand address. An address space specified by means of an access register is called an AR specified address space. Access registers apply only to data addresses, not instruction addresses. In the access register mode, instructions are always fetched from the primary address space. (It is not possible to branch from one address space to another.) The contents of the access register designated by the X field of a format RX instruction are ignored; only the access register designated by the B or R field is used in ART. Through the use of access registers, data can be moved between any two address spaces and the complete instruction set can be used to operate on data in multiple different spaces all at the same time. The DAS instructions Move to Primary and Move to Secondary are not allowed to be executed in the access register mode. However, the DAS instruction Move with Key can be executed, so that the ability to have different access keys for the source and target data areas still is available. The contents of an access register are called an access-list-entry token (ALET) because, in the general case, they designate an entry in a data area called an access list. ART uses the contents of the designated access list entry to obtain the segment table designation that will be used by DAT. The term "token" is used because an ALET does not directly convey any capability to access an address space; it only designates an access list entry, which represents the actual capability. ALETs are manipulable as ordinary data. MAS includes instructions for transferring ALETs between access registers, general registers, and storage. Specifically, a called program can save the contents of the access registers in storage, load the access registers for its own purposes, and then restore the original contents so that the calling program will find them unchanged. An ALET can be transferred to and from access register 0 even though access register 0 does not participate in the addressing of a storage operand. There are two special values of the ALET, 0 and 1, that specify the primary space and secondary space, respectively, without the use of an access list entry. Thus, a program can have access to its own instruction address space without the need to form an access list entry that designates the space, and, after a space switching program call, the called program can similarly have access to the caller's space. A called program can be denied access to its callers space. Entries in the access list are the addressing capabilities that are usable by means of access registers. The access list is intended to be protected from the problem state program to ensure the integrity of the addressing capabilities. The control program will provide a service that allocates an access list entry and returns an ALET designating the entry. The ALET can then be used by the requesting program to access the address space designated by the entry. The control program will also provide a service for deallocating an access list entry so the entry can be reused. An access list entry is marked invalid when it is not in the allocated state. An exception is recognized on an attempt to use an invalid access list entry. There are actually two access lists available to a program at the same time. One is called the dispatchable unit access list and the other the primary space access list. The dispatchable unit access list is intended to be permanently associated with the dispatchable unit (the architectural term meaning "task" or "process") on behalf of which the program is being executed. The primary space access list is a property of the primary address space in which the program is being executed. A bit in the ALET specifies which one of the dispatchable unit and primary space access lists is designated by the ALET. A bit in the access list entry specifies whether the entry is public or private. No authorization is required for the use of a public access list entry. The use of a private access list entry must be authorized by an extended authorization index (EAX). The extended authorization index may be a property of either the dispatchable unit or the program, as will be described. It is not a property of the primary space in which the program is executed. Through the use of the extended authorization index, an entry in a dispatchable unit access list may be usable by some, but not all, of the programs that are executed to perform the work of the dispatchable unit. Similarly, an entry on a primary space access list may be usable by some, but not all, of the programs that are executed in the corresponding primary space. The DAS authorization index has a bearing on the use of access registers since it authorizes the use of set secondary ASN in establishing a secondary space, and the secondary space can be accessed by means of an ALET of 1. As has been said, the authorization index is a property of the primary space. With MAS, program call is changed to test a new bit, named the PC type bit, in the entry table entry. If this bit is zero, program call performs the DAS operation described in DAS program linkage which is now called the basic operation. If the bit is one, program call performs a new operation called the stacking operation. The stacking operation makes some state changes differently than the basic operation, and it saves the old state in an entry it forms in a linkage stack. The linkage stack state entry is logically deleted, and the old state is restored, by a new instruction named program return. It is intended that there be a separate linkage stack for each dispatchable unit and that the linkage stack be protected from direct manipulation by the dispatchable unit. MAS includes instructions for extracting information from a state entry and for modifying one field in the entry. MAS includes the branch and stack instruction, which may be used in place of branch and link. The only state information changed by branch and stack is the instruction address in the PSW. Branch and stack forms a state entry, called a branch state entry, that is the same as a program call state entry, except that it indicates that it was formed by branch and stack and contains the branch address instead of a PC number. The addressing mode bit and instruction address that are part of the complete PSW saved in a branch state entry can be either the current values in the PSW or can be specified in a register as an operand of branch and stack. This register can be one that had link information placed in it by a branch and link, branch and save, branch and save and set mode, or branch and set mode instruction. Thus, branch and stack can be used either in a calling program or at (or near) the entry point of a called program, and in either case, a program return at the end of the called program will return correctly to the calling program. The ability to use branch and stack at an entry point allows the linkage stack to be used without changing old calling programs. The MAS instruction program return (PR) is used to return from a program given control by means of either stacking program call or branch and stack. Program return logically deletes the last linkage stack state entry, which may be either a program call state entry or a branch state entry. If the last state entry is a program call state entry, program return restores all of the state information that was saved in the entry, except that it leaves the contents of general registers 15, 0 and 1 and access registers 15, 0 and 1 unchanged. If the last state entry is a branch state entry, program return restores only the complete PSW and the contents of general registers 2-14 and access registers 2-14. However, program return always leaves the PER mask in the PSW unchanged in order not to counteract a PER enablement or disablement that may have occurred while the called program was being executed. A bit can be set to one in a linkage stack state entry to cause a program interruption if program return operates on the entry. The control program may set this bit to one to guard against an erroneous use of program return, for example, when the last linkage instruction executed was a supervisor call instruction in which case the exit service of the control program should be used before program return. When a job step is started, which at least initially is a single dispatchable unit, it does so in an address space that is unique to the job step. This address space is called the home address space of the job step. The system places the principal control blocks that represent the job step (for example, where status is saved when the job step is undispatched) in the home address space of the job step. If the job step uses program call to give control to another space and then an I/O or external interruption occurs, the control register contents must, without MAS, be changed in order to gain access to the home address space so it can save the status of the step. To improve the efficiency of accessing the home address space, MAS includes a home segment table designation and another address space mode, named the home space mode, which is conditioned by bit settings in the PSW. The new PSW that is loaded by the machine when an interruption occurs can specify the home space mode to provide immediate access to the home address space. Access registers are 32-bit hardware registers available to the problem program. An access register (AR) may be used to associate an operand base register with an address space when storage is referenced. The basic function of ARs is to extend the 370-XA instruction set to operate on instructions and storage operands in multiple spaces. There are sixteen ARs, each one being directly associated with a GPR; i.e., ARO with GPRO, AR1 with GPR1, . . . , AR15 with GPR15. ARs are only involved in the addressing mechanism when the CPU is running in access register mode as determined by program status word (PSW) bits 16 and 17. The general attributes of ARs are as follows: 1. The contents of access registers may be freely manipulated by a program in problem or supervisor state, whether in access register mode or not. 2. Instructions in the architecture are provided to load and store AR contents from storage, transfer the contents from ARs to GPRs and vice versa, and to copy values from one access register to another. 3. The content of an access register is a token which can determine an address space via a hardware table lookup process: access register translation ART. This token is called an Access List Entry Token (ALET). 4. The hardware associates the ALET value, in an AR, with an address space when storage references are made in access register mode. The access register is implicitly determined in the hardware by the base register field of the instruction when used. The implicit designation of the AR allows the multiple address space access function to be extended to existing 370-XA instructions without modifying their machine code format. 5. The AR corresponding to the GPR specified in the index register field of an RX instruction does not participate in the selection of an address space. 6. All instructions and the target of an Execute instruction are always fetched from the primary address space when running in access register mode. 7. The same ALET value can be in more than one AR. 8. AR usage for addressing is done only in access register mode, when PSW bits 16 and 17 are 0 and 1 respectively. The Access List (AL) is an addressing capability table that is used with access registers (ARs) and which is in the form of a dispatchable unit access list (DUAL) or a primary space access list (PSAL). The entries in the AL define the address spaces that can be addressed via ARs for a given DU. When a storage reference instruction is executed in access register mode, the base register field of each operand is associated with an entry in the AL determined by the Access List Entry Token (ALET) contained in the corresponding access register. An access list represents a list of addressing capabilities. These capabilities define address spaces that can be accessed by the associated dispatchable unit. During addressing in access register mode, access list entries provide the means for the hardware to locate an alternate segment table origin to use for Dynamic Address Translation with respect to a storage operand of an instruction. An access list entry allows this by containing the real address of an Address Space Second Table Entry (ASTE) which in turn contains the addresses of the segment table and authority table associated with the address space.
______________________________________
GLOSSARY
______________________________________
AKM Authorization Key Mask
AL Access List - An addressing capability table.
AR Access Register - each access register is
associated with a GPR.
ART Access Register Translation - A method of
associating a STD - segment table designation
with an access register.
AX Authorization Index
ALB ART Lookaside Buffer - ART occurs each time
an AR is designated by a B field storage operand
reference in a GPR, and the ALB reduces
storage references during ART.
ALE Access List Entry
ALEAX Access List Entry Authorization Index
ALEN Access List Entry Number - Bits 16-31 of the
ALET are the access list entry number of the
designated ALE.
ALL Access List Length - Stored in a control
register as a predetermined number and can at
most permit 1024 access list entries.
ALET Access List Entry Token - An ALET designates
an entry in an access list.
ALESN Access List Entry Sequence Number - Bits 8-15
of the ALET and of the ALE.
ASN Address Space Number - Represents an address
space.
ASTE ASN Second Table Entry - This is an expression
of the 370/XA ASTE shown in the prior art and
includes an I bit and an STD.
ASTESN ASTE Sequence Number - The ASTESN in
the ALE is tested for equality with
ASTESN in ASTE.
ATL Authority Table Length.
DAS Dual Address Space
DASD Direct Access storage device.
DAT Dynamic Address Translation - Uses an STD to
convert virtual address to real storage
addresses.
DUAL Dispatchable Unit Access List
DUALD DUAL designation consisting of the real origin
and length of the DUAL
DUCT Dispatchable Unit Control Table - contains
DUALD and specified by CR2
EAX Extended Authorization Index
EKM Entry Key Mask
ETE Entry Table Entry
GPR General Purpose Register for containing
operands and addresses
LTD Linkage Table Designation
MAS Multiple Address Space
P Bit Bit in ALET that selects between DUAL and
PSAL
PRIVATE-Bit
Bit P in the ALE that designates whether
all users may have access or an authority
mechanism is invoked.
PASTE Primary ASN second table entry - contains
PSAL and LTD
PC-cp Program Call to Current Primary
PC-ss Program Call with Space Switching
PKM PSW Key Mask
PSAL Primary Space Access List
PSALD PSAL Designation consisting of the real origin
and length found in the primary ASTE
PSTD Primary Segment Table Designation
PSW Program Status Word
SSTD Secondary Segment Table Designation
STD Segment Table Designation
______________________________________
While the invention has been described with reference to the preferred embodiments thereof, various modifications and changes may be made by those skilled in the art without departing from the true spirit and scope of the invention as defined by the claims hereof.
|
Same subclass | ||||||||||