Patent Publication Number: US-4093987-A

Title: Hardware control storage area protection method and means

Description:
INTRODUCTION 
     This invention relates generally to the protection of a critical storage area in a data processing system from being adversely changed by addressing errors in system control programs operating in the same key area. 
     SUMMARY OF THE INVENTION 
     The invention provides a method and means in a data processing system for protecting a hardware control area (HCA) in main storage for a data processor from being erroneously changed by execution of programs in other storage areas assigned to the same protection key as the HCA. 
     It has been found that under the pragmatic conditions of modifying system control programs (SCP) in data processing machines that address errors unfortunately occur which adversely change the critical HCA area, and that such changes stop the machine operation and are extremely difficult to detect. It is the primary object of this invention to prevent such SCP addressing errors from adversely affecting machine operation. 
     The embodiment provides a bit position in a system control register (CR) which is set to enable, and is reset to disable, the HCA protect means. An AND gate has an input which receives the enablement or disablement signal from the control register HCA protect bit position. The AND gate also receives the store requests from the processor, and further receives a signal common to all addresses in the HCA area such as all zeros for address bits 8 through 22 to signal the first 512 bytes in main storage which in current IBM S/370 machines contains the HCA, which is also called the program save area (PSA). The AND gate is normally disabled by the CR bit and provides an inverted output to a store request gate which normally provides store requests to the processor store access controls. Writing into the HCA is only permitted under special programmed conditions when the control register bit is set to disable the HCA protect means. Whenever the HCA protection is enabled, the AND gate is enabled to provide a HCA store violation signal, which actuates a protection interrupt code generator to generate a storage protect interrupt code in the PSW (Program Status Word) that causes the processor to test each store request into the HCA. 
     Other objects, features and advantages of the present invention will become more apparent in the light of the following detailed description of a preferred embodiment thereof, as illustrated in the drawings. 
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS 
     FIG. 1 illustrates hardware control area (HCA) protection circuits used by this invention. 
     FIG. 2 is representative of programs which are permitted to contain code that can store into the hardware control area (HCA). 
     FIG. 3 illustrates how the control register protect bit 3 is set to enabled or disabled state. 
    
    
     DESCRIPTION OF THE DETAILED EMBODIMENT 
     FIG. 1 illustrates circuitry for protecting the hardware save area (HCA), comprising byte real addresses 0 through 511. It contains a processor 11 having I and E units which generate store request signals on a line 14 and fetch request signals on a line 16. Executing instructions in processor 11 are represented by instruction stream 18 from which is derived addresses to be accessed in main storage, which are provided to a storage address register 19. These addresses are the real addresses applied to storage which are obtained as a result of translation in a system using logical addresses, or are derived directly from the instructions when there is no dynamic address translation, in the conventional manner for example done by a IBM System/370 Model 168 CPU. The invention controls only the HCA subset of addresses having store requests. The HCA addresses are sensed by an OR circuit 22 which senses high order bits 8 through 22 of the storage address register 19. An address is in the HCA whenever all of bits 8 through 22 are zero, and then an OR circuit 22 provides an output signal to an inverter 23. Its output 23A provides an HCA address signal to an AND gate 26, which also receives the store request signal on line 14. 
     The enablement and disablement of the HCA protection function is performed by the setting of bit 3 within control register O(CRO) in FIG. 1. Output line 24 conditions AND gate 26 when bit 3 is set to 1 state, and disables gate 26 when set to O state. 
     An inverter 27 receives the output signal from AND circuit 26 and inverts it to provide an input to a second AND gate 33 which also receives the store request signal line 14. If a store address is within the HCA area, line 23A and store request gate 26 conditions AND gate 26, which however will be blocked while the enable protect state is provided by bit 3 of CRφ on line 24 which then enables AND gate 33 to block any storage request to the processor storage access controls to prohibit the access. 
     The output signal from AND gate 26 is also provided to protection interrupt code generator 28 in the processor to generate a protect violation interruption code, which is put into the interrupt code 30 of the program status word (PSW) of the processor. 
     FIG. 3 illustrates how CR0 can be set or reset to enablement or disablement states from a PSACROSV address in real page 0 in main storage. It will be noted that this PSACROSV area is outside of the HCA protected area and therefore may be accessed without use of the controls shown in FIG. 1. 
     FIG. 2 illustrates in a general way the system control program well known as the IBM OS/370 system control program, which has only a very small amount of code (e.g. less than 1%) which can legitimately change the HCA. For example, the HCA can legitimately be changed by code for setting a new channel address word (CAW), or loading a new PSW. 
     The invention in controlled from within the system control program by recognizing only those parts of the code which are permitted to make a change into the HCA, and then immediately preceding each such HCA legitimate change code with a few instructions that set bit 3 to 0 (enablement state), and immediately following the HCA change code with a few instructions which resets bit 3 to 1 (disabled state) which is the normal state. As a result, well over 99 percent of the system control program is not able to store into the HCA. This bounded set of HCA enabled code is called a window. 
     Accordingly, if something goes wrong in the system control program in the 99+ percent of the code which is not permitted to change the HCA, and it attempts to make an HCA change, the change is prohibited and the HCA cannot be effected and its integrity is maintained. The following table illustrates how bit 3 of CR0 is set and reset within the system control program to form a few small windows within the SCP capable of legitimately storing into the HCA. 
     
                       TABLE                                                       
______________________________________                                    
               ##STR1##         Store CRφ into lo- cation             
                               PSACRφSV in HCA (Bit 3 is 1).          
CRφ       NI PSACRφSV, 11101111                                   
                               Sets Bit 3 to 0 (off                       
Bit 3                          state) in location                         
Disable                        PSACRφSV.                              
Operation     LCTL 0,0,PSACRφSV                                       
                               Load CRφ with Bit                      
                               3 in off state.                            
Store         Instructions which store one or more                        
HCA           values in HCA, e.g. store new PSW, CAW,                     
Window        etc.                                                        
CRφ       OI PSACRφSV, 00010000                                   
                               Sets Bit 3 to 1 (on                        
Bit 3                          state) in location                         
Enable                         PSACRφSV.                              
Operation     LCTL 0,0,PSACRφSV                                       
                               Load CRφwith Bit                       
                               3 in on state.                             
               ##STR2##                                                   
______________________________________                                    
 
    
     Although the invention has been shown and described with respect to a preferred embodiment thereof, it should be understood by those skilled in the art that various changes and omissions in the form and details of the invention may be made therein without departing from the spirit and the scope of the invention, which is to be limited only as set forth in the following claims.