Apparatus and Method for an Operating System Supervisor in a Data Processing System

1. Field of the Invention

This invention relates generally to the control of the execution of instructions by a data processing system and more particularly to a data processing system capable of sharing a plurality of operating systems.

2. Description of the Related Art

It is known in the related art to provide a data processing system capable of execution of an instruction set under control of a single operating system. Each operating system has an interior decor, including a distinctive address formation and instruction processing characterists, that prohibit easy portability of operating systems. In order to utilize a plurality of operating systems, it has been necessary to alter the operating systems or add additional apparatus to operate additional apparatus. In addition, it is frequently necessary to reinitialize the data processing system each time a different operating system was activated. Frequently, improvements in operating systems require a change in apparatus and can cause problems in data systems. In addition, fault procedures residing in the memory unit have the characteristics of a specialized operating system.

Therefore, the need has existed for a data processing system capable of sharing a plurality of operating systems.

It is therefore an object of the present invention to provide an improved data processing system.

It is a further object of the present invention to permit a data processing system to operate under control of a plurality of operating systems.

It is a particular object of the present invention to permit the isolation of a pluralilty of operating systems.

It is another particular object of the present invention to ensure that unpermitted instructions are not executed by a currently active operating system.

It is yet another object of the present invention to provide a procedure for terminating operation of a currently active operating system and initialize operation of a different operating system.

The aforementioned and other objects of the present invention are accomplished by providing apparatus which will support the execution of instructions from a plurality of operating systems. Apparatus is also provided to isolate the operating systems and to ensure that only the instructions of the currently active operating system are executed. A memory space, unavailable to the plurality of operating systems is available for each operating system to permit an orderly exchange of operating systems.

These and other features of the invention will be clear upon reading of the specification along with the figures.

FIG. 1 is a block diagram of a data processing system.

FIG. 2 is a flow diagram of the transfer of control of a data processing system from a first operating system to a second operating system.

FIG. 3 is a schematic diagram of the use of selected memory files in transferring from a first operating system to a second operating system.

FIG. 4 is a schematic diagram demonstrating how memory is accessed by a first and a second operating system.

FIG. 5 is a block diagram showing the use of the supervisor base address register and the supervisor bound address register for isolation of the memory locations of an operating system.

FIG. 6 is a block diagram of the format of reserved memory for each operating system.

Referring to FIG. 1, the central processing unit 1 is the principle portion of the data processing unit for the manipulation of information signal groups. The central processing unit includes a central unit for sequencing the entire unit and further includes a cache unit and an instruction unit. The cache unit obtains instruction signal groups and data signal groups from main memory unit 3 through the control interface unit 2. Instruction signal groups are retained in an instruction cache, operand signal groups in an operand cache and paging information in a paging buffer. The instruction unit stores prefetched instructions and signal groups in an instruction stack. The instruction represents the current instruction stream and prefetch alternate streams or indirect words predicted by the batch table. The instructions are decoded and operand or branch target instruction addresses generated in a pipeline which accepts instructions for an instruction stack. The final stage of the pipeline sends instructions and operands to one of a group of specialized execution units. The pipeline, address adder and instruction stack can be considered another logical execution unit, which handles transfer class instructions as well as instruction address, or state-related situations.

The main memory unit 3 provides the central processing unit 1 with the principle storage of information signal groups used by the central processing unit. The information signals are entered into or extracted from the main memory unit under control of the control interface unit 2.

The control interface unit 2 controls the transfer of information signals between the main memory unit 3, the input/output multiplexer 4 and the central processing unit 1. Thus, the control interface unit 2 prioritizes requests to the control interface unit and prioritizes the output to the input/output unit multiplexer. The control interface unit 2 provides a buffer unit for information signals transferred therethrough. In addition, the control interface unit 2 controls the queque for system interrupts under which words are stored in the main memory unit as well as other interrupt activity. The error detection and correction processes for data transferred into and out of the main memory unit 3 is contained in the control interface unit 2. The output interface unit also provides apparatus to insure that no block access conflict exists among hierarchy commands.

The input/output multiplexer 4 is utilized to satisfy the throughput requirements of the data processing system. The operating system prepares the required control words and assigns a buffer area for the data to be transferred. After the control words are prepared, the operating system initiates an input/output activity by issuing a connect instruction. The control interface unit 2 recognizes the connect instruction and passes the connect information to the input/output multiplexer controller. The input/output multiplexer retains the mailbox address and other pertinent information from the connect control word in the addressed channel's scratchpad memory and passes the connect command to the addressed channel in a channel adapter unit 5.

The addressed channel notifies the identified peripheral device that a channel program is waiting. After notification to the identified peripheral device, the channel adapter unit 5 requests the input/output multiplexer to pull the channel mailbox. In response to this request, the input/output multiplexer loads the first eight words of the channel mailbox into scratchpad memory. The channel program subsequently requests the input/output multiplex to `move pointer forward`. In response to this request, the input/output multiplex performs a list service and sends the Instruction Data Control Word (IDCW) to the channel adapter unit 5. The first DCW of the channel program must be an IDCW. The channel adapter unit passes the IDCW to the peripheral device and, on demand from the peripheral subsystem, requests a data list service. Using the List Pointer Word (LPW) from the channel mailbox, the input/output multiplexer retrieves the next DCW. The input/output multiplexer retains the DCW in scratchpad memory and sends the pertinent information from the DCW to the channel adapter unit 5. With the DCW information, the channel adapter unit 5 requests the necessary data services to satisfy the channel program. The input/output multiplexer 4 executes the data services by maintaining the current DCW and PTW in scratchpad memory and performs any required list services for additional DCW's. After the channel program has been satisfied, the channel requests a status store service. The input/output multiplexer 4 places the termination status in the channel mailbox and restores the mailbox to memory. After completion of the status service, the channel requests a terminate interrupt service. In performing the service, the input/output multiplexer 4 interrogates the mailbox link word. If the interrupt inhibit bit is `ON`, the interrupt is not reported. If the interrupt inhibit bit is `OFF`, the interrupt is reported using the interrupt level specified in the mailbox link word. If the link word specifies a continuation, the input/output multiplexer issues a connect to the channel.

The channel adapter unit 5 provides the interface between the input/output multiplexer 4 and the peripheral subsystem 6. In addition to the activity described in relation to the input/output multiplexer, the channel adapter interface unit provides a logic implementation conversion, CML in the input/output multiplexer 4 and TTL in the channel adapter unit 5. The channel adapter unit 4 serves as a buffer device between the peripheral system 6 and the input/output processor, permitting the input/output multiplexer to transfer information efficiently and asynchronously with a multiplicy of peripheral systems 6.

The peripheral system 6 can be any of that typical subsystem such as magnetic tape units, disc storage unit, terminal interfaces, etc. The peripheral subsystems serve as mass storage devices and devices to provide external communication with the data processing system.

Referring to FIGS. 2 and 3, the steps in inactivating a currently active operating system (1) and activating another operating system is illustrated. In step 201, the data processing system is currently executing instructions under the control of operating system 1. A fault or interrupt condition for supervisor procedures is identified in step 202. The identified condition must be a preselected condition in which the result is an exchange of operating systems controlling the data processing system. The preselected fault or interrupt condition will cause a predetermined location in the reserved memory space of operating system 1 to be addressed indicated as step 203 in FIG. 2. This process is shown as path 301 from operating system 1 memory 312 to operating system reserve memory 301. The location in reserve memory has a series of steps, the most significant being the storage of register contents in the central processing unit, step 205, the register parameters will be stored in reserve memory so that upon restoration of operating system 1 as the currently active operating system, the data processing unit will be returned to this state. After execution of the fault entry programs, a location in switching entry section of the operating system reserve memory 1 is executed. The instructions in this location allow the operating system 2 reserve memory to be addressed in a location in the operating system 2 switching entry location, i.e., step 206. This transfer to operating system 2 is shown as path 302 in FIG. 3. The instructions in the switching entry portion of operating system 2 cause, in step 207, the stored parameters of operating system 2 to be entered in the appropriate registers in the data processing thus initializing the system or restoring the system to the last previous state of operating system 2. The final step 208 and path 303 transfers control of the central processing unit to operating system 2. In this manner, the control of the central processing unit 1 has been transferred from operating system 1 to operating system 2. In FIG. 3, paths 304, 305, and 206 illustrate the process by which control of the central processing unit 1 is transferred back to operating system 1. Also shown in FIG. 3 is the possibility that each operating system can control a plurality of central processing units. For that situation, the other central processing units will switch between operating systems in a similar manner.

In dealing with a data processing unit sharing operating systems, it is necessary that memory space alloted to each operating system be inaccessible to the other operating systems. FIG. 4 indicates the manner in which this may be accomplished. A page table for the operating system is shown with locations associated with each of two operating systems. The address associated with operating system 1 will point to a group of locations in the physical memory 403. Similarly, the addresses stored in the group of locations associated with operating system 2 indicate a different group of memory locations. Thus, the physical memory 403 is divided in groups of memory addresses which are the result of a paging operation in the page table 402. Thus, operating system 1, or operating system 2, can be addressed in contiguous locations (i.e., for each operating system), but the groups of physical memory addresses associated with each page table address can be located throughout the physical memory address space. One advantage of the paging is that "holes" in the physical memory space (i.e., such as can result from an error in the memory unit) can be avoided when the page table is formed during an initialization process. FIG. 4 also illustrates the important feature that the reserved memory spaces 410 and 411 for operating system 1 and operating system 2 are unavailable to the operating system. Furthermore, the reserve memory spaces can be located anywhere in the physical memory.

Referring next to FIG. 5, the use of the supervisor base address and the supervisor bound for the isolation of operating system is shown. A supervisor page table directory 764 is provided during initialization, and provides the correspondence between an operating system address and an address in physical memory. During initialization or re-activation of each operating system, the supervisor base register 761 and the supervisor bound register 762 have data entered therein. In this preferred embodiment the first twelve bits of an address developed during normal execution of instruction provides an off-set from the base address. The base address is determined by the currently active operating system, i.e., each operating system will have a predetermined base address in the supervisor page table directory. The supervisor bound quantity will determine the number of page table directory location allocated to the operating system. Thus, when a 26 bit real address 763 is applied to the supervisor paging apparatus, the first 12 bits point to location 770, i.e., the address in the page address register plus the off-set defined by the highest order bit of the real address. The quantity in the bound register ensures that the location 770 is with contiguous directory location allocated to the operating system. The contents of location 770 are a 12 bit quantity which replaces the 12 bit off-set quantity in the address to provide an address in physical memory.

Referring to FIG. 6, the general format of the reserved memory 650 for each operating system is shown. The supervisor switcher 651 portion of the reserved memory contains the program necessary for interruption or for initialization of an operating system. A more detailed description of this memory area will be given. Reserved memory portion labelled interrupt queues 652 are hardware loaded prioritized interrupts that are received by an operating system which is currently inactive. When the operating system becomes active, these queues will be interrogated and appropriate responses enabled. Hardware configuration 653 portion of the reserved memory is loaded upon initialization and provides a record of the resources (i.e., data processing system components) available to the operating system. The connect tables 654 portion of reserved memory provides a list of the resources currently available to the operating systems. Summarizing, the reserved memory is devoted to storing information necessary to maintain the isolation of the operating systems.

Referring to the supervisor switches 651 portion of reserved memory 650, the data stored therein provides the coded signals to process the change from one operating system to a second operating system. Included therein are the entry location (into the reserved memory switches) and the exit location from the reserved memory. Locations are included to safestore the contents of the central processing unit registers. Thus safestore locations are loaded by the initialization procedures, and when the operating system is activated, these locations provide the initialization. When the operating system asssociated with reserve memory is inactivated, these locations are filled with the contents of the central processing unit so that when the operating system is reactivated, the central processing unit will return to the state existing at the time it was inactivated. Also stored in the supervisor switches of the reserved memory are the quantities for the supervisor base and the supervisor bound. During initialization of a central processing unit, a supervisor page table direction is established. Each supervisor page generally consists of a multiplicity of normal pages. Moreover, the supervisor page table directory is used in the final translation from the address used by the operating system to the location in physical memory is performed through the supervisor page table. The supervisor base address points to the first in a series of sequential locations in the supervisor page table location. The operating system address contains an offset which indicates which location in the sequential supervisor page table directory the address refers. The supervisor bound ensures that off-set does not exceed the locations in the supervisor page table directory allocated to the operating system. If this occurred, the physical memory location addressed would be outside the area reserved for the operating system. The supervisor base and bound address are stored in registers in the central unit pipeline structure when the operating system is activated. The reserved memory supervisor switches includes a reserved memory base address and a bound. Again, these quantities are stored in the central unit pipeline structure (in the descriptor stack in the preferred embodiment) and provides the address of reserved memory when a predetermined fault is detected. Indeed in the preferred embodiment, the off-set from the base address in the reserved memory for handling of faults requiring attention of the supervisory processes is the same off-set from the operating base addressed as is used in the normal fault handling procedures. Also included in the reserved memory is the code allowing entry into the connect table. A memory location holds a quantity that will be loaded in a supervisor fault enable register. The quantity has a pattern which defines all the fault conditions that require a response from the supervisor procedures. When a fault condition is defined by signal pattern, this pattern is compared with the contents of the supervisor fault enable register to determine if the supervisor procedures or the normal operating procedures should be used to respond to the condition. A reserved memory location is used to store the faults pending register. These contents are re-entered into faults pending register when the operating system is reactivated so that conditions originally existing for the operating system are restored. Other reserved memory locations implement the use of a supervisor timer so that at the end of a predetermined number of clock cycles, the currently active operating system will receive a fault condition causing a new operating system to be activated. Thus one of the locations will have a (clock) count determining the time that the operating system will be active. Still another location contains data to be entered in the option register. This register contains signals control certain decor dependent variables. For example, a decor code is included. This code is compared in an operation code to ensure that the instruction is permitted in the decor of the operating system. Another quantity that can be stored is whether intermediate paging (not the supervisor paging) is employed. Other register locations include other decor dependent data that are loaded into the hardware apparatus to make the central processing unit decor consistent with the active operating system. For example, in virtual address formation, a working space number is required, while other operating systems may not require this quantity to be available to the operating system i.e., loaded in preselected register locations. Finally, an offset for the hardware configuration table is present.

The above summary is a partial list of data entered in the reserved memory. It will be clear that other data and procedures may be available for an operating system supervisor procedures.

A more detailed use of the supervisor procedures will now be given by way of illustration. When appropriate conditions occur in the central processing unit, such as the supervisor clock reaching a predetermined number of counts, the operating system reaching a point where it will voluntarily relinquish control of the central processing unit etc, a set of signals indicating a fault condition is entered in the fault register. The signals in the fault register are compared with signals that have been previously entered in the supervisor fault enable register. When a coincidence is detected, a different operating system is to be activated through the supervisor procedures, and a supervisor fault procedure is enabled. The supervisor fault procedure uses the reserved memory base address, stored in the central unit pipeline structure (i.e., in the descriptor stack) combined in a constant offset number to enter the reserved memory unit of the currently active operating system. The procedures beginning with the entry address cause the storage quantities, in registers in the central processing unit, in the appropriate locations in the reserved memory. In addition, the contents of the faults pending register are stored. These quantities allow the operating system being deactivated, to resume in the state when the operating system is reactivated. When this storage is complete, the reserved memory exits from a location that addresses an entry in the reserved memory of a second operating system. The second operating system loads the base and bound address of the reserved memory associated with the second operating system into the central unit pipeline structure (i.e., the descriptor stack) so that the instructions executed using the supervisor procedures can have the appropriate address formation. The supervisor base and bound is loaded in the final paging registers thus providing the mechanism for addressing only the physical memory associated with the second operating system and effectively isolating non-associated physical memory from the second operating system. The procedures of the reserved memory load the option register, which in addition to other decor-dependent information, provides the code that determines when a non-permitted instruction (e.g., because of incorrect decor requirements) has entered execution. The procedures of the reserved memory cause the fault pending register to be loaded and the decor-dependent quantities are entered in appropriate registers in the central processing unit. The central processing unit is now either initialized with respect to the second operating system or the previous state, from which the second operating system exited, has been reestablished. The reserved memory of the second operating system now executes a procedure by which the memory associated with the second operating system is entered and control of this data processing unit is now with the second operating system.

The above description is included to illustrate the operation of the preferred embodiment and is not meant to limit the scope of the invention. The scope of the invention is to be limited only by the following claims. From the foregoing discussion, many variations would be apparent to one skilled in the art that would yet be encompassed by the spirit and scope of the invention.