Managing access, by operating system images of a computing environment, of input/output resources of the computing environment

• US 7,177,961 B2
• Filed: 05/12/2003
• Issued: 02/13/2007
• Est. Priority Date: 05/12/2003
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Yudenfriend, Harry M., Wyman, Leslie W., Shapley, Charles E., Carlson, Scott M., Lu, Tan, Oakes, Kenneth J., Brice, Frank W. Jr., Gainey, Charles W. Jr., Easton, Janet R., Kubala, Jeffrey P., Halma, Marten J.
• Primary Examiner(s): Nguyen; Tanh Q.
• Application Number:
  US10/436,240
• Publication Number:
  US 20040230757A1
• Time in Patent Office: 1,373 Days
• Field of Search: 713/1, 713/2, 713/100, 710/36, 710/37
• US Class Current: 710/36
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/82 Protecting input, output or interconnection devices

Abstract

An input/output subsystem is configured as a plurality of input/output subsystem images, each of which appears to a program as an independent input/output subsystem. In response to an operating system image submitting an input/output (I/O) request requesting access to an input/output subsystem image, a determination is made as to whether the operating system image is authorized to access the input/output subsystem image. In response to the access being authorized, the I/O request is authorized.

Claims

1. A method of managing access, by operating system images of a computing environment, of input/output resources of the computing environment, said method comprising:

submitting an input/output (I/O) request by an operating system image requesting access to an input/output subsystem image of a plurality of input/output subsystem images of the computing environment;

determining whether the operating system image is authorized to access the input/output subsystem image, wherein the determining comprises checking an authorization vector created in response to a request by the operating system image to enable access of the operating system image to multiple input/output subsystem images of the plurality of input/output subsystem images; and

authorizing the I/O request, in response to the operating system image being authorized to access the input/output subsystem image.

2. The method of claim 1, wherein the checking comprises:

using an identification of the input/output subsystem image as an index into the authorization vector; and

employing a value of the entry of the authorization vector indexed by the identification to determine authorization.

3. The method of claim 2, wherein the value indicates that the operating system image is not authorized to access the input/output subsystem image.

4. The method of claim 2, wherein the value indicates that the operating system image is authorized to access the input/output subsystem image.

5. The method of claim 4, wherein the value indicates a multiple image facility image identification to be used in the access.

6. A system of managing access, by operating system images of a computing environment, of input/output resources of the computing environment, said system comprising:

means for submitting an input/output (I/O) request by an operating system image requesting access to an input/output subsystem image of a plurality of input/output subsystem images of the computing environment;

means for determining whether the operating system image is authorized to access the input/output subsystem image, wherein the means for determining comprises means for checking an authorization vector created in response to a request by the operating system image to enable access of the operating system image to a multiple input/output subsystem images of the plurality of input/output subsystem images; and

means for authorizing the I/O request, in response to the operating system image being authorized to access the input/output subsystem image.

7. The system of claim 6, wherein the means for checking comprises:

means for using an identification of the input/output subsystem image as an index into the authorization vector; and

means for employing a value of the entry of the authorization vector indexed by the identification to determine authorization.

8. The system of claim 7, wherein the value indicates that the operating system image is not authorized to access the input/output subsystem image.

9. The system of claim 7, wherein the value indicates that the operating system image is authorized to access the input/output subsystem image.

10. The system of claim 9, wherein the value indicates a multiple image facility image identification to be used in the access.

11. A system of managing access, by operating system images of a computing environment, of input/output resources of the computing environment, said system comprising:

an input/output subsystem configured as a plurality of input/output subsystem images, wherein each input/output subsystem image of multiple input/output subsystem images of the plurality of input/output subsystem images comprises a plurality of communications adapters to access one or more input/output devices of the computing environment;

an operating system image to submit an input/output (I/O) request requesting access to particular input/output subsystem image of the plurality of input/output subsystem images of the computing environment, said I/O request explicitly including an identification of the particular I/O subsystem image to be accessed; and

a program to determine whether the operating system image is authorized to access the particular input/output subsystem image, wherein the program checks an authorization vector created in response to a request by the operating system image to enable access of the operating system image to more than one input/output subsystem images of the plurality of input/output subsystem images, and wherein the I/O request is authorized, in response to the operating system image being authorized to access the particular input/output subsystem image.

12. At least one program storage device readable by a machine embodying at least one program of instructions executable by the machine to perform a method of managing access, by operating system images of a computing environment, of input/output resources of the computing environment, said method comprising:

submitting an input/output (I/O) request by an operating system image requesting access to an input/output subsystem image of a plurality of input/output subsystem images of the computing environment;

determining whether the operating system image is authorized to access the input/output subsystem image, wherein the determining comprises checking an authorization vector created in response to a request by the operating system image to enable access of the operating system image to a multiple input/output subsystem images of the plurality of input/output subsystem images; and

authorizing the I/O request, in response to the operating system image being authorized to access the input/output subsystem image.

13. The at least one program storage device of claim 12, wherein the checking comprises:

using an identification of the input/output subsystem image as an index into the authorization vector; and

employing a value of the entry of the authorization vector indexed by the identification to determine authorization.

14. The at least one program storage device of claim 13, wherein the value indicates that the operating system image is not authorized to access the input/output subsystem image.

15. The at least one program storage device of claim 13, wherein the value indicates that the operating system image is authorized to access the input/output subsystem image.

16. The at least one program storage device of claim 15, wherein the value indicates a multiple image facility image identification to be used in the access.