Computer with virtual machine mode and multiple protection rings

• US 4,787,031 A
• Filed: 01/04/1985
• Issued: 11/22/1988
• Est. Priority Date: 01/04/1985
• Status: Expired due to Fees

• Current Assignee: Digital Equipment Corporation (HP Inc.)
• Original Assignee: Digital Equipment Corporation (HP Inc.)
• Inventors: Mason, Andrew H., Karger, Paul A., Leonard, Timothy E.
• Primary Examiner(s): Shaw, Gareth D.
• Assistant Examiner(s): Fairbanks, Jonathan C.
• Application Number:
  US06/688,702
• Time in Patent Office: 1,418 Days
• Field of Search: 364/200 MS File, 364/900 MS File
• US Class Current: 718/100
• CPC Class Codes: G06F 12/1491 in a hierarchical protection system, e.g. privilege levels, memory rings
• CPC Class Codes: G06F 2009/45566 Nested virtual machines
• CPC Class Codes: G06F 2009/45583 Memory management, e.g. access or allocation
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

A computer system including a processor and memory, the processor having a virtual mode of operation in which it uses a virtual machine monitor which allows it to service a plurality of users contemporaneously in a multiplexed manner, and a non-virtual, or real, mode of operation. The computer system has a set of at least three operation mode protection rings representing a hierarchy of access privilege levels in both the real and virtual modes, with the number of privilege levels in both the real and virtual modes being the same. The privilege levels govern the accessibility of memory locations to programs and the executability of certain privileged instructions, which cause control to be transferred to the virtual machine monitor when the processor is in a virtual mode. The two most privileged levels in the virtual mode are both treated as corresponding to the second most privileged level in the real mode, whereby if the processor is in the most privileged virtual operating mode, access to memory locations is permitted only if the location is accessible to the second most privileged mode. When an instruction is retrieved, the processor first performs a probe operation to determine whether it can access any required memory locations in response to its current privilege level, and then determines whether it is in a privilege level which allows it to process the instruction.

Claims

1. A processor for use in a computer system, (a) the processor including processing means for processing instructions in at least three protection ring operating modes each associated with one of a hierarchy of privilege levels (b) said computer system including a memory means which includes a plurality of addressable storage locations for storing instructions requiring access to the memory locations, said memory means being comprised of plural groups of memory locations, wherein the number of memory locations in each memory group may vary, each memory group having an associated privilege means for identifying the protection ring operating modes in which the processor can access any memory location in the group, (c) said processor further comprising:

A. means connected to said processing means and for connection to said memory means for iteratively retrieving instructions from the memory means requiring access to a location in memory;

B. operating mode indicating means for identifying the privilege level of the current protection ring operating mode of said processor;

C. virtual mode indicating means for indicating whether or not said processor is operating in a virtual mode;

D. compression means connected to said operating mode indicating means for identifying a virtual mode operating mode in response to the current protection ring operating mode identified by said operating mode indicating means, said compression means operating in accordance with a compression function "F" which maps a set A=(0, 1, . . . , N) into a second set B=(0, 1, . . . , N), each element of the set A identifying one of the privilege levels when the processor is operating in the virtual mode and each element of the set B identifying one of the privilege levels when the processor is not operating in the virtual mode, the successive elements of each set corresponding to protection rings of progressively lower privilege, such that in each set "0" identifies the most privileged level and "N" identifies the least privileged level, said compression function F satisfying the following conditions;

i. F (0)=1, and

ii. If "i" is greater than "0" and less than or equal to "N", thnn F (i)=i;

E. selection means connected to said operating mode indicating means, said virtual mode indicating means and said compression means for selectively transmitting as an output the privilege level identified by said compression means in response to said virtual mode indicating means indicating that said processor is operating in a virtual mode, and otherwise transmitting the privilege level identified by said operating mode indicating means;

F. comparison means for comparing the output of said selection means to the privilege means of the location in memory to which the processor requires access to determine whether the processor can access the required memory location; and

G. means responsive to a successful comparison by said comparison means for enabling the processing means to access the required memory location and execute the instruction.

17. A processor as defined in any of claim 1, 2, 6, 8 or 10 wherein said processing means includes:

A. internal register means including;

i. real register means;

ii. virtual register means;

B. arithmetic and logic means connected to said real register means and said virtual register means for selectively performing operations on the contents thereof; and

C. control means connected to said real register means, said virtual register means, said arithmetic and logic means, and said virtual mode indicating means for enabling the arithmetic and logic means to perform operations on the contents of selected ones of said real register means or said virtual register means in response to the condition of said virtual mode indicating means.

18. A processor as defined in claim 17 wherein said internal register means further includes general purpose register means, said control means enabling said arithmetic and logic means to perform operations on the contents of selected ones of the general purpose register means regardless of the condition of the virtual mode indicating means.

19. A processor as defined in claim 17 wherein said internal register means further includes status register means comprising:

A. processor status register means and

B. virtual status register means;

said control means selectively using the contents of processor status register means or virtual status register means in response to the condition of said virtual mode indicating means.

2. A processor for use in a computer system, (a) the processor including processing means for processing instructions in at least three protection ring operating modes each associated with one of a hierarchy of privilege levels (b) said computer system including a memory means which includes a plurality of addressable storage locations for storing instruction requiring access to the memory locations, said memory means being comprised of plural groups of memory locations, wherein the number of memory locations in each memory group may vary, each memory group having an associated privilege means for identifying the protection ring operating modes in which the processor can access any memory location in the group, (c) said processor further comprising:

A. means connected to said processing means and for connection to said memory means for iteratively retrieving instructions from the memory means requiring access to a location in memory;

B. operating mode indicating means for identifying the privilege level of the current protection ring operating mode of said processor;

C. virtual mode indicating means for indicating whether or not said processor is operating in a virtual mode;

D. compression means connected to said operating mode indicating means for identifying a virtual mode operating mode in response to the current protection ring operating mode identified by said operating mode indicating means, said compression means operating in accordance with a compression function "F" which maps a set A=(0, 1, . . . , N) into a second set B=(0, 1, . . . , N), each element of the set A identifying one of the privilege levels when the processor is operating in the virtual mode and each element of the set B identifying one of the privilege levels when the processor is not operating in the virtual mode, the successive elements of each set corresponding to protection rings of progressively lower privilege, such that in each set "0" identifies the most privileged level and "N" identifies the least privileged level, said compression function F satisfying the following conditions;

i. F (0) is greater than "0", and

ii. if "i" and "j" are elements of set "A" such that "i" is greater than or equal to "j", then F (i) is greater than or equal to F (j);

E. selection means connected to said operating mode indicating means, said virtual mode indicating means and said compression means for selectively transmitting as an output the privilege level identified by said compression means in response to said virtual mode indicating means indicating that said processor is operating in a virtual mode, and otherwise transmitting the privilege level identified by said operating mode indicating means;

F. comparison means for comparing the output of said selection means to the privilege means to determine whether the processor can access the required memory location; and

G. means responsive to a successful comparison by said comparison means for enabling the processing means to access the required memory location and execute the instruction.

3. A processor for use in a computer system, (a) the processor including processing means for processing instructions in "N" protection ring operating modes each associated with one of a hierarchy of privilege levels, where "N" is at least three, said processor operating in a virtual mode and in a real mode, (b) said computer system including a memory means which includes a plurality of addressable storage locations for storing instructions requiring access to the memory locations, said memory means being comprised of plural groups of memory locations, wherein the number of memory locations in each memory group may vary, each memory group having an associated privilege means for identifying the protection ring operating modes in which the processor can access any memory location in the group and an associated virtual mode privilege means for identifying the virtual mode protection ring operating modes in which the processor can access any memory location when in the virtual mode, (c) said processor further comprising compression means for establishing a privilege level for storage in said virtual mode privilege means in response to the current protection ring operating mode identified by said operating mode indicating means, said compression means operating in accordance with a compression function "F" which maps a set A=(0, 1, . . . , N) into a second set B=(0, 1, . . . , N), each element of the set A identifying one of the privilege levels when the processor is operating in the virtual mode and each element of the set B identifying one of the privilege levels when the processor is not operating in the virtual mode, the successive elements of each set corresponding to protection rings of progressively lower privilege, such that in each set "0" identifies the most privileged level and "N" identifies the least privileged level, said compression function F satisfying the following conditions:

i. F (0)=0, and

ii. If "i" is greater than "0" and less than or equal to "N", then F (i)=i.

13. A processor as defined in any of claims 3, 4, 7, 9 or further comprising means connected to said compression means and for connection to said virtual mode privilege means for storing the privilege level generated by the compression means in the virtual mode privilege means.

14. A processor as defined in claim 13 wherein said processor includes virtual mode indicating means for indicating whether or not said processor is operating in a virtual mode, said processing means further comprising:

A. internal register means including;

i. real register means;

ii. virtual register means;

B. arithmetic and logic means connected to said real register means and said virtual register means for selectively performing operations on the contents thereof; and

C. control means connected to said real register means, said virtual register means, said arithmetic and logic means, and said virtual mode indicating means for enabling the arithmetic and logic means to perform operations on the contents of selected ones of said real register means or said virtual register means in response to the condition of said virtual mode indicating means.

15. A processor as defined in claim 14 wherein said internal register means further includes general purpose register means, said control means enabling said arithmetic and logic means to perform operations on the contents of selected ones of the general purpose register means regardless of the condition of the virtual mode indicating means.

16. A processor as defined in claim 14 wherein said internal register means further includes status register means comprising:

A. processor status register means and

B. virtual status register means;

said control means selectively using the contents of processor status register means or virtual status register means in response to the condition of said virtual mode indicating means.

4. A processor for use in a computer system, (a) the processor including processing means for processing instructions in "N" protection ring operating modes each associated with one of a hierarchy of privilege levels, where "N" is at least three, said processor operating in a virtual mode and in a real mode, (b) said computer system including a memory means which includes a plurality of addressable storage locations for storing instructions requiring access to the memory locations, said memory means being comprised of plural groups of memory locations, wherein the number of memory locations in each memory group may vary, each memory group having an associated privilege means for identifying the protection ring operating modes in which the processor can access any memory location in the group and an associated virtual mode privilege means for identifying the virtual mode protection ring operating modes in which the processor can access any memory location when in the virtual mode, (c) said processor further comprising compression means for establishing a privilege level for storage in said virtual mode privilege means in response to the current protection ring operating mode identified by said operating mode indicating means, said compression means operating in accordance with a compression function "F" which maps a set A=(0, 1, . . . , N) into a second set B=(0, 1, . . . , N), each element of the set A identifying one of the privilege levels when the processor is operating in the virtual mode and each element of the set B identifying one of the privilege levels when the processor is not operating in the virtual mode, the successive elements of each set corresponding to protection rings of progressively lower privilege, such that in each set "0" identifies the most privileged level and "N" identifies the least privileged level, said compression function F satisfying the following conditions:

i. F (0) is greater than "0", and

ii. if "i" and "j" are elements of set "A" such that "i" is greater than or equal to "j", then F (i) is greater than or equal to F (j).

5. A processor for use in a computer system, (a) the processor including processing means for processing instructions in "N" protection ring operating modes each associated with one of a hierarchy of privilege levels, where "N" is at least three, (b) said computer system including a memory means which includes a plurality of addressable storage locations for storing instruction requiring access to the memory locations, said memory means being comprised of plural groups of memory locations, wherein the number of memory locations in each memory group may vary, each memory group having an associated privilege means for identifying the protection ring operating modes in which the processor can access any memory location in the group, (c) said processor further comprising:

a. inhibiting means connected to said processing means for inhibiting said processing means from executing at least some of the instructions unless the processor is in an operating mode having a selected privilege level;

b. operating mode indicating means for identifying the privilege level of the current operating mode of said processor;

c. instruction retrieval means for connection to the memory for iteratively retrieving instructions from the memory;

d. operand probe means including;

i. operand privilege retrieval means connected to said instruction retrieving means and responsive to the retrieval of an instruction for obtaining the privilege means associated with a memory location identified by an operand specifier;

ii. operand privilege comparison means connected to said operating mode indicating means and said operand privilege retrieval means for determining if the privilege level of the current operating mode is at least as high as the privilege level obtained by said operand privilege retrieval means; and

e. instruction probe means connected to said operand probe means, said operating mode indicating means, said instruction retrieval means, and said inhibiting means and responsive to a successful determination by said operand privilege comparison means for enabling said inhibiting means to inhibit execution of a retrieved instruction by said processing means if said operating mode indicating means does not identify a mode having the required privilege level for the instruction.

12. A processor as defined in claim 5 further including virtual machine monitor means for determining the privilege level to be assigned to the contents of each memory location and means for enabling the privilege means to identify a lower privileged operating mode level if the contents of the memory location is to have assigned thereto the most privileged operation mode, and otherwise establishing the privilege means to identify the operating mode level to be assigned thereto.

6. A processor for use in a computer system, (a) the processor including processing means for processing instructions in at least three protection ring operating modes each associated with one of a hierarchy of privilege levels (b) said computer system including a memory means which includes a plurality of addressable storage locations for storing instructions requiring access to the memory locations, said memory means being comprised of plural groups of memory locations, wherein the number of memory locations in each memory group may vary, each memory group having an associated privilege means for identifying the protection ring operating modes in which the processor can access any memory location in the group, (c) said processor further comprising:

A. means connected to said processing means and for connection to said memory means for iteratively retrieving instructions from the memory means requiring access to a location in memory;

B. operating mode indicating means for identifying the privilege level of the current protection ring operating mode of said processor;

C. virtual mode indicating means for indicating whether or not said processor is operating in a virtual mode;

D. compression means connected to said operating mode indicating means for identifying a virtual mode operating mode in response to the current protection ring operating mode identified by said operating mode indicating means, said compression means operating in accordance with a compression function "F" which maps a set A=(0, 1, . . . , N) into a second set B=(0, 1, . . . , M), "N" greater than "M", with each element of the set A identifying one of the privilege levels when the processor is operating in the virtual mode and each element of the set B identifying one of the privilege levels when the processor is not operating in the virtual mode, the successive elements of each set corresponding to protection rings of progressively lower privilege, such that in each set "0" identifies the most privileged level and "N" and "M" identify the least privileged level, said compression function F satisfying the following conditions;

i. F (0) is greater than "0";

ii. F (N) is less than or equal to M; and

iii. if "i" and "j" are elements of set "A" such that "i" is greater than or equal to "j", then F (i) is greater than or equal to F (j);

E. selection means connected to said operating mode indicating means, said virtual mode indicating means and said compression means for selectively transmitting as an output the privilege level identified by said compression means in response to said virtual mode indicating means indicating that said processor is operating in a virtual mode, and otherwise transmitting the privilege level identified by said operating mode indicating means;

F. comparison means for comparing the output of said selection means to the privilege means of the location in memory to which the processor requires access to determine whether the processor can access the required memory location; and

G. means responsive to a successful comparison by said comparison means for enabling the processing means to access the required memory location and execute the instruction.

7. A processor for use in a computer system, (a) the processor including processing means for processing instructions in at least three protection ring operating modes each associated with one of a hierarchy of privilege levels, said processor operating in a virtual mode and in a real mode, (b) said computer system including a memory means which includes a plurality of addressable storage locations for storing instructions requiring access to the memory locations, said memory means being comprised of plural groups of memory locations, wherein the number of memory locations in each memory group may vary, each memory group having an associated privilege means for identifying the protection ring operating modes in which the processor can access any memory location in the group and an associated virtual mode privilege means for identifying the virtual mode protection ring operating modes in which the processor can access any memory location when in the virtual mode, (c) said processor further comprising compression means for establishing a privilege level for storage in said virtual mode privilege means in response to the current protection ring operating mode identified by said operating mode indicating means, said compression means operating in accordance with a compression function "F" which maps a set A=(0, 1, . . . , N) into a second set B=(0, 1, . . . , M), "N" greater than "M", with each element of the set A identifying one of the privilege levels when the processor is operating in the virtual mode and each element of the set B identifying one of the privilege levels when the processor is not operating in the virtual mode, the successive elements of each set corresponding to protection rings of progressively lower privilege, such that in each set "0" identifies the most privileged level and "N" and "M" identify the least privileged level, said compression function F satisfying the following conditions:

i. F (0) is greater than "0";

ii. F (N) is less than or equal to M; and

iii. if "i" and "j" are elements of set "A" such that "i" is greater than or equal to "j", then F (i) is greater than or equal to F (j).

8. A processor for use in a computer system, (a) the processor including processing means for processing instructions in at least three protection ring operating modes each associated with one of a hierarchy of privilege levels (b) said computer system including a memory means which includes a plurality of addressable storage locations for storing instructions requiring access to the memory locations, said memory means being comprised of plural groups of memory locations, wherein the number of memory locations in each memory group may vary, each memory group having an associated privilege means for identifying the protection ring operating modes in which the processor can access any memory location in the group, (c) said processor further comprising:

A. means connected to said processing means and for connection to said memory means for iteratively retrieving instructions from the memory means requiring access to a location in memory;

B. operating mode indicating means for identifying the privilege level of the current protection ring operating mode of said processor;

C. virtual mode indicating means for indicating whether or not said processor is operating in a virtual mode;

D. compression means connected to said operating mode indicating means for identifying a virtual mode operating mode in response to the current protection ring operating mode identified by said operating mode indicating means, said compression means operating in accordance with a compression function "F" which maps a set A=(0, 1, . . . , N) into a second set B=(0, 1, . . . , M), "M" greater than "N", with each element of the set A identifying one of the privilege levels when the processor is operating in the virtual mode and each element of the set B identifying one of the privilege levels when the processor is not operating in the virtual mode, the successive elements of each set corresponding to protection rings of progressively lower privilege, such that in each set "0" identifies the most privileged level and "N" and "M" identify the least privileged level, said compression function F satisfying the following conditions;

i. F (0) is greater than "0";

ii. if "i" is greater than or equal to "j", then F (i) is greater than or equal to F (j);

iii. for at least one "i" and "j", "i" not equal to "j", F (i) is equal to F (j); and

iv. if "i" and "j" are elements of set "A" such that "i" is greater than or equal to "j", then F (i) is greater than or equal to F (j).

E. selection means connected to said operating mode indicating means, said virtual mode indicating means and said compression means for selectively transmitting as an output the privilege level identified by said compression means in response to said virtual mode indicating means indicating that said processor is operating in a virtual mode, and otherwise transmitting the privilege level identified by said operating mode indicating means;

F. comparison means for comparing the output of said selection means to the privilege means of the location in memory to which the processor requires access to determine whether the processor can access the required memory location; and

G. means responsive to a successful comparison by said comparison means for enabling the processing means to access the required memory location and execute the instruction.

9. A processor for use in a computer system, (a) the processor including processing means for processing instructions in at least three protection ring operating modes each associated with one of a hierarchy of privilege levels, said processor operating in a virtual mode and in a real mode, (b) said computer system including a memory means which includes a plurality of addressable storage locations for storing instructions requiring access to the memory locations, said memory means being comprised of plural groups of memory locations, wherein the number of memory locations in each memory group may vary, each memory group having an associated privilege means for identifying the protection ring operating modes in which the processor can access any memory location in the group and an associated virtual mode privilege means for identifying the virtual mode protection ring operating modes in which the processor can access any memory location when in the virtual mode, (c) said processor further comprising compression means for establishing a privilege level for storage in said virtual mode privilege means in response to the current protection ring operating mode identified by said operating mode indicating means, said compression means operating in accordance with a compression function "F" which maps a set A=(0, 1, . . . , N) into a second set B=(0, 1, . . . , M), "M" greater than "N", with each element of the set A identifying one of the privilege levels when the processor is operating in the virtual mode and each element of the set B identifying one of the privilege levels when the processor is not operating in the virtual mode, the successive elements of each set corresponding to protection rings of progressively lower privilege, such that in each set "0" identifies the most privileged level and "N" and "M" identify the least privileged level, said compression function F satisfying the following conditions:

i. F (0) is greater than "0";

ii. if "i" is greater than or equal to "j", then F (i) is greater than or equal to F (j);

iii. for at least one "i" and "j", "i" not equal to "j", F (i) is equal to F (j); and

iv. if "i" and "j" are elements of set "A" such that "i" is greater than or equal to "j", then F (i) is greater than or equal to F (j).

10. A processor for use in a computer system, said processor including processing means for processing instructions in at least three protection ring operating modes each associated with one of a hierarchy of privilege levels, the computer system further including a memory including a plurality of addressable storage locations for storing instructions requiring access to memory locations and including operation code means identifying the operation to be performed, each memory location having an associated privilege means for identifying the protection ring operating modes in which the processor can access the memory location, said processor further including:

a. means for iteratively retrieving instructions from the memory;

b. operating mode indicating means for identifying the privilege level of the current operating mode of said processor;

c. virtual mode indicating means having a set condition when said processor is operating in a virtual mode and otherwise having a clear condition; and

d. probe means connected to said processing means, said instruction retrieval means, said operating mode indicating means, said virtual mode indicating means and for connection to the memory for comparing the contents of the operating mode indicating means to a less privileged operating mode level if the indicating means has a set condition and the operating mode indicating means identifies the most privileged operating mode, and for comparing the contents of the operating mode indicating means to at least the least privileged operating mode level if the indicating means has a set condition and the operating mode indicating means identifies a less privileged operating mode to determine whether the processor can access the required memory locations for enabling said processing means to execute the instruction in response to a successful comparison.

11. A processor for use in a computer system, said processor including processing means for processing instructions in at least three protection ring operating modes each associated with one of a hierarchy of privilege level, each memory location having an associated privilege means for identifying the protection ring operating modes in which the processor can access the memory location, said processor further including virtual machine monitor means for establishing the protection ring operating mode in said privilege means including means for determining the privilege level to be assigned to the contents of each said memory location and means for enabling the privilege means to identify the second most privileged operating mode level if the contents of the memory location is to have assigned thereto the most privileged operating mode, and otherwise establishing the privilege means to identify the operating mode level to be assigned thereto.