Apparatus and method for converting a logical address into a physical address

Abstract

A method for operating virtual machines obtained by logically dividing a physical computing device and converting a logical address into a physical address in memory that the virtual machine uses to access a memory, the method comprising in response to a request for a physical address by a guest partition (192) of the virtual machine, providing the logical corresponding address; Sending the logical address information by the guest partition (192) to a central unit (10) of the data processing device, wherein the central unit converts the logical address information into encrypted physical address information (S101); Sending the encrypted physical address information by the central unit (10) to the guest partition (192) of the virtual machine; Sending the encrypted physical address information from the guest partition (192) of the virtual machine to an accelerator (20) without knowing the physical address information in the encrypted physical address information; in response to receipt (S201) of the encrypted physical address information from the guest partition (192) of the virtual machine by the accelerator (20), Decrypting the encrypted physical address information by the accelerator (20) into a set of physical address information without using a hypervisor (191) to perform the address conversion; and Accessing a storage unit in the data processing system within the data processing facility by the accelerator (20) using the physical address contained in the set of physical address information.

Description

Field of the invention

[0001] The present invention relates to an apparatus and method for converting a logical address into a physical address. More specifically, the present invention relates to an apparatus and method for operating virtual machines obtained by logically dividing a physical machine and converting a logical address used by the machine to access memory into a physical address in the memory. State of the art

[0002] With the development of virtualization technology, it has become possible in recent years to use a hypervisor to logically divide a single physical machine and then run the resulting machines as multiple virtual machines. The virtual machines are separated from each other using the hypervisor, so that one virtual machine cannot access a memory area of ​​another virtual machine. This is achieved through address translation, as described below.

[0003] When using a logically partitioned CPU, memory is accessed using two types of addresses. Among these, a physical address is usable only by a hypervisor. Meanwhile, an address used by a program such as an operating system (hereinafter referred to as the "guest partition") is a logical address. When the guest partition accesses memory, the CPU or hypervisor converts the logical address into a physical address according to a conversion table.

[0004] Meanwhile, as a method for increasing the speed of specific processing, there is a method for offloading a specific workload using a hardware accelerator (hereinafter referred to simply as "accelerator") or other units connected to the CPU. For example, the "Power7" (trademark) or "PowerEN" (trademark) chip is capable of invoking the accelerator using an ICSWX instruction. When the virtual machine executes the ICSWX instruction, the virtual machine ID (LPARID) and the addresses where parameters are located on the memory are sent to a target accelerator.

[0005] In this environment, data is generally exchanged between the guest partition and the accelerator via memory or, in the case of large data, a cache. Furthermore, if the data is complex, it is necessary to use a data structure such as a linked list, tree, or the like, and to place pointers to other memory locations within the data. In this case, the guest partition prepares the data structure, and therefore the pointers point to logical addresses. However, the accelerator requires a physical address to access the memory, and therefore it is necessary to inform the accelerator in some way about the correspondence between the physical address and the logical address. Hereinafter, the process of "informing the accelerator about the correspondence between the physical address and the logical address" is referred to as "mapping."

[0006] Generally, the mapping is performed by a hypervisor.

[0007] Incidentally, among the techniques described in unofficial publications, there is a technique in which address conversion is performed between an address in a partition and an address common to partitions (see, for example, Patent Document 1).

[0008] In the technique in Patent Document 1, in order to obtain shared memory between partitions by dividing the inside of the hierarchical bus SMP into a plurality of partitions, a means for bidirectionally converting an address in a shared region between an address in a partition and an address of shared memory space common to partitions is provided at the input of each node. Reference to the prior artPatent Document 1

[0009] Japanese patent JP 4 123 621 B2

[0010] In addition to this Japanese patent document, there are other documents worth mentioning in the context of the concept presented here. Document US 4 347 565 A describes an address control system for software simulations in a virtual machine system. When a simulation program simulates an instruction of a program being simulated, an address translation of an operand address is achieved using a translation lookaside buffer. This can reduce the overhead of the program being simulated. Document US 2010 / 0 281 257 A1 describes a confidential communication method within the framework of "onion routing." A data source uses encrypted random numbers and calculates a hash value using the corresponding public key of an associated, connected information server. Finally, document US 2003 / 0154 390 A1 describes a content distribution system.A recording management system ensures that specific content is stored in the memory of a first access device. When a second access device wants to access this content, the recording management system ensures that the corresponding address is transmitted to the first access device. Brief description of the invention

[0011] Problems to be solved by the invention:

[0012] As described above, traditionally a hypervisor has performed mapping when there is a need to forward a physical address to an accelerator or the like.

[0013] However, when the hypervisor performs a mapping, a context switch occurs between the guest partition and the hypervisor each time the mapping is performed, which problematically slows performance.

[0014] As long as the guest partition is able to be informed of the physical address, the guest partition is also able to perform the mapping. However, if the accelerator is informed of a mismatch in the mapping, the accelerator will access memory allocated to another guest partition, causing another problem in that the separation between partitions could be violated.

[0015] The technique disclosed in Patent Document 1 does not provide a solution to these problems.

[0016] Accordingly, it is an object of the present invention to securely perform a conversion from a logical address to a physical address without reducing performance. Means to solve the problems

[0017] The above-mentioned problem is solved by the subject matter of the independent patent claims. Further embodiments are derived from the dependent patent claims.

[0018] To achieve the above object, the present invention provides an apparatus and a method for operating virtual machines obtained by logically dividing a physical machine and converting a logical address used by the virtual machine to access a memory into a physical address in the memory, the apparatus comprising: an accepting unit for accepting the logical address from the virtual machine when the virtual machine executes an instruction executable by the virtual machine and used to convert the logical address into the physical address; a converting unit for converting the logical address accepted by the accepting unit into the physical address previously assigned to the logical address;an encrypted information generation unit for generating encrypted information by encrypting physical address information including the physical address obtained from the conversion performed by the conversion unit; and an output unit for outputting the encrypted information generated by the encrypted information generation unit to the virtual machine.

[0019] Here, the device may include a hash value generation unit for generating a hash value for a bit string including the physical address obtained from the conversion performed by the conversion unit; and a concatenation unit for concatenating the hash value generated by the hash value generation unit with the physical address so that the hash value is included in the physical address information.

[0020] In this case, the concatenation unit can still concatenate the virtual machine identifier with the physical address so that the identifier is included in the physical address information.

[0021] Further, the hash value generation unit may generate a hash value for the bit string, which still contains the identifier.

[0022] Furthermore, the present invention provides an apparatus for operating virtual machines obtained by logically dividing a physical machine and for converting a logical address used by the virtual machine to access a memory into a physical address in the memory, the apparatus comprising: an accepting unit for accepting the logical address from the virtual machine when the virtual machine executes an instruction executable by the virtual machine and used to convert the logical address into the physical address; a converting unit for converting the logical address accepted by the accepting unit into a bit string containing the identifier of the virtual machine and the physical address previously assigned to the logical address;a hash value generation unit for generating a hash value for the bit string obtained from the conversion performed by the conversion unit; a concatenation unit for concatenating the bit string obtained from the conversion performed by the conversion unit with the hash value generated by the hash value generation unit; an encrypted information generation unit for generating encrypted information by encrypting physical address information obtained from the concatenation performed by the concatenation unit; and an output unit for outputting the encrypted information generated by the encrypted information generation unit to the virtual machine.

[0023] Furthermore, the present invention provides a system comprising: a central processing unit (CPU) for operating virtual machines obtained by logically dividing a physical machine; and an access unit for accessing a memory using a physical address in the memory that corresponds to a logical address used by the virtual machine to access the memory, the central processing unit comprising: an accepting unit for accepting the logical address from the virtual machine when the virtual machine executes an instruction executable by the virtual machine and used to convert the logical address into the physical address; a converting unit for converting the logical address accepted by the accepting unit into the physical address previously assigned to the logical address;an encrypted information generation unit for generating encrypted information by encrypting physical address information including the physical address obtained from the conversion performed by the conversion unit; and an output unit for outputting the encrypted information generated by the encrypted information generation unit to the virtual machine, and wherein the access unit comprises: a receiving unit for receiving the encrypted information from the virtual machine that has received the encrypted information output by the output unit; an acquiring unit for acquiring the physical address information by decrypting the encrypted information received by the receiving unit;and an access unit for accessing the memory using the physical address included in the physical address information acquired by the acquisition unit;

[0024] This system may be configured such that the CPU includes: a first hash value generation unit for generating a first hash value, which is a hash value for a bit string containing the physical address obtained from the conversion performed by the conversion unit; and a concatenation unit for concatenating the first hash value with the physical address such that the first hash value generated by the first hash value generation unit is included in the physical address information, and such that the access unit includes: a second hash value generation unit for generating a second hash value, which is a hash value for a bit string containing the physical address included in the physical address information acquired by the acquisition unit;a comparison unit for comparing the first hash value contained in the physical address information acquired by the acquisition unit with the second hash value generated by the second hash value generation unit; and a control unit for controlling the physical address contained in the physical address information to be used by the access unit in the case where a result of the comparison performed by the comparison unit shows that the first hash value matches the second hash value.

[0025] In this case, the system may be configured such that the concatenation unit further concatenates a first identifier, which is the identifier of the virtual machine, with the physical address such that the first identifier is included in the physical address information, such that the receiving unit further receives a second identifier, which is the identifier of the virtual machine, from the virtual machine, such that the comparing unit further compares the first identifier included in the physical address information with the second identifier received by the receiving unit, and such that the controlling unit controls the physical address included in the physical address information to be used by the accessing unit in the event that a result of the comparison performed by the comparing unit shows that the first identifier matches the second identifier.

[0026] Furthermore, the system may be configured such that the first hash value generation unit generates the first hash value, which is the hash value for the bit string further containing the first identifier, and such that the second hash value generation unit generates the second hash value, which is a hash value for a bit string containing the physical address and the first identifier included in the physical address information acquired by the acquisition unit.

[0027] Still further, the system may further include a storage unit that cannot be used by devices other than the CPU and the access unit, and may be configured such that the encrypted information generating unit encrypts the physical address information using the encryption key stored in the storage unit, and such that the acquiring unit decrypts the encrypted information using the encryption key stored in the storage unit or a decryption key corresponding to the encryption key.

[0028] Still further, the present invention provides a method for operating virtual machines obtained by logically dividing a physical machine and converting a logical address used by the virtual machine to access memory into a physical address in memory, the method comprising the steps of: accepting the logical address from the virtual machine upon execution by the virtual machine of an instruction executable by the virtual machine and used to convert the logical address into the physical address; converting the logical address accepted in the accepting step into the physical address previously assigned to the logical address; generating encrypted information by encrypting physical address information including the physical address obtained from the conversion performed in the converting step;and outputting the encrypted information generated in the step of generating encrypted information to the virtual machine; Advantages of the invention

[0029] According to the present invention, conversion from a logical address to a physical address can be performed safely without reducing performance. Brief description of the drawings Fig. 1 is a block diagram illustrating a configuration example of a system to which the embodiment of the present invention is applied; Fig. 2 is a diagram illustrating the outline of an operation performed when a guest partition converts a logical address into an encrypted real address and forwards the encrypted real address to an accelerator in the embodiment of the present invention; Fig. 3 is a diagram illustrating the processing contents in which the CPU converts the logical address into the encrypted real address information in an embodiment of the present invention; Fig. 4 is a block diagram illustrating a functional configuration example of the CPU in the embodiment of the present invention; Fig. 5 is a flowchart illustrating a typical operation of the CPU in the embodiment of the present invention; Fig. 6 is a diagram schematically illustrating the processing contents in which the accelerator converts the encrypted real address information into the real address information in an embodiment of the present invention; Fig. Fig. 7 is a block diagram illustrating a functional configuration example of the accelerator in the embodiment of the present invention; and Fig. 8 is a flowchart illustrating a typical operation of the accelerator in the embodiment of the present invention. Embodiment of the invention

[0030] Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

[0031] Fig. 1 is a block diagram illustrating the configuration example of a system to which this embodiment is applied.

[0032] As illustrated, this system includes a central processing unit (CPU) 10, accelerators 20a and 20b, a memory 30, a memory control unit 40, and an encryption key storage area 50, which are connected via a bus 60. Although in Fig. 1, the accelerators 20a and 20b are depicted, they may in some cases also be referred to as one accelerator 20 if there is no need to distinguish between them. Furthermore, the number of accelerators 20 is not limited to two and may be one or three or more, although in Fig. 1 two accelerators are shown.

[0033] The CPU 10 is a unit for controlling the operation of the entire system. Specifically, in this embodiment, the hypervisor is used to run a plurality of virtual machines on the physical machine, so that the operating system (OS) and applications run on each virtual machine.

[0034] The accelerator 20 is a unit that increases system throughput by performing a portion of specific processing to be performed by the CPU for the CPU. Here, the specific processing is illustrated as data encryption, compression, decompression, or the like. Furthermore, although the accelerator 20 is provided as an example of the access unit that accesses the memory 30 in this embodiment, a unit other than the accelerator 20 may be provided.

[0035] Memory 30 is a unit for storing data used by CPU 10 during processing or data obtained as a processing result. Specifically, in this embodiment, memory 30 stores data to be forwarded by CPU 10 to accelerator 20. Here, memory 30 may be, for example, a dynamic random access memory (DRAM).

[0036] The memory control unit 40 is a unit that controls the writing and reading of data to and from the memory 30.

[0037] The encryption key storage area 50 is for use in storing an encryption key used in encryption processing by the CPU 10 and decryption processing by the accelerator 20, which will be described later. It is assumed that the encryption key storage area 50 is accessible only from the CPU 10 and the accelerator 20. This type of area is achievable, for example, by a trusted platform module (TPM). In this embodiment, the encryption key storage area 50 is provided as an example of a storage unit that cannot be used by units other than the CPU and an access unit.

[0038] Assuming that the hypervisor converts a logical address to a real address (physical address) in this system, a context switch occurs between the guest partition and the hypervisor, reducing performance. Therefore, in this embodiment, the guest partition converts the logical address to the real address for the hypervisor. Specifically, a conversion instruction (hereinafter referred to as the "LTOR instruction") from the logical address executable by the guest partition to the real address is added to the CPU 10.

[0039] However, if the guest partition is able to convert the logical address to the real address, the guest partition may intentionally or inadvertently communicate an invalid real address to the accelerator, thereby violating the memory allocated to another guest partition. Therefore, in this embodiment, an encrypted real address (hereinafter referred to as an "encrypted real address") is passed to the guest partition to protect the memory allocated to each guest partition.

[0040] Fig. Figure 2 schematically illustrates the situation that arises when the guest partition converts a logical address into an encrypted real address using the LTOR instruction and forwards the encrypted real address to the accelerator 20.

[0041] As illustrated, CPU 10 operates a hypervisor 191 and operates guest partitions 192a, 192b, and 192c under the control of hypervisor 191. Although guest partitions 192a, 192b, and 192c are depicted in the diagram, in some cases they may be referred to as guest partition 192 when there is no need to distinguish the guest partitions from one another. Although three guest partitions 192 are depicted in the diagram, the number of guest partitions 192 is not limited to three, but may be one, two, or four or more.

[0042] Here, it is assumed that the guest partition 192a executes, for example, the LTOR instruction. Then, the CPU 10 receives the logical address from the guest partition 192a and converts the logical address into a physical address. In this embodiment, however, the CPU 10 does not return the physical address directly to the guest partition 192a, but instead returns an encrypted physical address as described above. As a result, the guest partition 192a forwards the address to the accelerator via bus 60 without knowing the physical address.

[0043] Meanwhile, the accelerator 20, which has received the encrypted real address, converts the encrypted real address into a real address using an encryption key and then accesses the memory 30 using the real address (see Fig. 1).

[0044] Here, it is assumed that the encryption key used by the CPU 10 for encryption and by the accelerator 20 for decryption is stored in the encryption key storage area 50 as described above (see Fig. 1) which is only accessible by the CPU 10 and the accelerator 20.

[0045] As described above, this embodiment includes executing processing in which the CPU 10 converts the logical address into the encrypted real address, and processing in which the accelerator 20 converts the encrypted real address into the real address. Therefore, the following description is given for each of them.

[0046] Processing in which the CPU 10 converts the logical address into the encrypted real address

[0047] Fig. 3 shows a diagram schematically illustrating the situation that arises when this type of processing is carried out.

[0048] First, the guest partition 192 executes the LTOR instruction, which sends the logical address from the guest partition 192 to the CPU 10 (1A).

[0049] Then, the CPU 10 converts the logical address into real address information (1B) based on an address conversion table. Here, the real address information includes, from the left, an encryption bit, fill characters, an LPARID, and an effective address to the real address (hereinafter referred to simply as the "effective address"). The encryption bit indicates whether the real address information is encrypted: "1" indicates that the real address information is encrypted; and "0" indicates that the real address information is not encrypted. Since the real address information is not encrypted immediately after conversion to 1B, the encryption bit is "0." In addition, LPARID is an identifier (ID) of the guest partition 192, which is a logical partition (LPAR). Fig. 3 the LPARID is abbreviated with “L”.

[0050] In addition, the CPU 10 generates a hash value by applying a hash function such as a secure hash algorithm 1 (SHA-1) to a bit string formed from the LPARID in the real address information and an effective address, and then embeds the hash value in the padding position to generate a bit string concatenated with the hash value (1C).

[0051] Further, the CPU 10 encrypts a bit string composed of a hash value in the bit string concatenated with a hash value, the LPARID, and an effective address according to the advanced encryption standard (AES) or the like, and changes the encryption bit to "1" to generate encrypted real address information (hereinafter referred to as "encrypted real address information") (1D).

[0052] Thereby, the CPU 10 sends the encrypted real address information to the guest partition 192, and the guest partition 102 receives the encrypted real address information (1E).

[0053] The following is a description of the functional configuration of the CPU 10, which enables processing as in Fig. 3 illustrates.

[0054] Fig. 4 shows a block diagram illustrating a functional configuration example of the CPU 10.

[0055] As illustrated, the CPU 10 includes an instruction decoder 11, an authorization determination circuit 12, an operand fetching circuit 13, an address conversion circuit 14, an address conversion table 141, and a status register 142. In addition, the CPU 10 includes a hash value circuit 15, a concatenation circuit 16, an encryption circuit 17, an encryption key receiving circuit 171, and a bit changing circuit 18.

[0056] The instruction decoder 11 decodes an instruction executed by the hypervisor 191 or the guest partition 192.

[0057] The authorization determination circuit 12 determines whether the instruction decoded by the instruction decoder 11 was executed by software with the authority to execute the instruction. Specifically, if the instruction decoded by the instruction decoder 11 is an LTOR instruction, the authorization determination circuit 12 determines whether the instruction was executed by the guest partition 192.

[0058] The operand fetch circuit 13 fetches an operand of the instruction decoded by the instruction decoder 11. Specifically, when the instruction decoded by the instruction decoder 11 is an LTOR instruction, the operand fetch circuit 13 fetches a logical address as an operand. In this embodiment, the operand fetch circuit 13 is provided as an example of an accepting unit that accepts the logical address.

[0059] The address conversion circuit 14 converts the logical address fetched by the operand fetching circuit 13 into real address information. The real address information includes, as described above, an encryption bit, padding characters, an LPARID, and an effective address. In this embodiment, the effective address is used as an example of a physical address, and the LPARID is used as an example of a virtual machine identifier. Furthermore, the address conversion circuit 14 is provided as an example of a conversion unit that converts a logical address into a physical address, or a conversion unit that converts a logical address into a bit string including a virtual machine identifier and a physical address, and is further provided as an example of a concatenation unit that concatenates an identifier with a physical address.

[0060] The address conversion table 141 is looked up when the address conversion circuit 14 converts the logical address into the real address information. The address conversion table 141 maintains the correspondence between the logical address and the effective address to the real address (in Fig. 4 simply referred to as “real address”).

[0061] Status register 142 is referenced when address conversion circuit 14 converts the logical address into physical address information. When CPU 10 receives an instruction, status register 142 maintains the LPARID of guest partition 192 that executed the instruction.

[0062] The hash value circuit 15 generates a hash value that, after the conversion performed by the address conversion circuit 14, represents a part in the physical address information formed by the LPARID and the effective address. In this embodiment, the LPARID and the effective address in the physical address information are used as an example of a bit string containing the physical address. Furthermore, the hash value circuit 15 is provided as an example of a hash value generation unit or a first hash value generation unit that generates a hash value of a bit string.

[0063] The concatenation circuit 16 generates a hash-concatenated bit string by concatenating the encryption bit, the LPARID, and the effective address in the real address information after the conversion performed by the address conversion circuit 14 with the hash value generated by the hash value circuit 15, thereby generating a hash-concatenated bit string. In this embodiment, the concatenation circuit 16 is provided as an example of the concatenation unit that concatenates the hash value with the physical address or the concatenation unit that concatenates the bit string with the hash value.

[0064] The encryption circuit 17 encrypts the part consisting of the hash value, the LPARID, and the effective address in the hash-concatenated bit string generated by the concatenation circuit 16. In this embodiment, the part consisting of the hash value, the LPARID, and the effective address in the hash-concatenated bit string is used as an example of the physical address information including the physical address, and the part consisting of the encrypted hash value, the encrypted LPARID, and the encrypted effective address is used as an example of the encrypted information. Furthermore, the encryption circuit 17 is provided as an example of an encrypted information generation unit that generates the encrypted information by encrypting the physical address information.

[0065] The encryption key receiving circuit 171 receives from the encryption key storage area 50 an encryption key which is used when the encryption circuit 17 performs encryption (see Fig. 1).

[0066] The bit changing circuit 18 generates the encrypted real address information by changing the encryption bit in the real address information encrypted by the encryption circuit 17. In this embodiment, the bit changing circuit 18 is provided as an example of an output unit that outputs the encrypted information.

[0067] The following describes the operation of the CPU 10, which performs the processing as in Fig. 3 illustrates.

[0068] In the CPU 10, the instruction decoder 11 first decodes an instruction, and then the authority determination circuit 12 determines whether software with authority to execute the instruction has executed the instruction. In this embodiment, if the instruction decoded by the instruction decoder 11 is an LTOR instruction and the guest partition 192 has executed the LTOR instruction, in other words, if the OS or the application in the guest partition 192 has executed the LTOR instruction with the logical address as an argument, which needs to be converted into the encrypted real address information, the following processing is performed.

[0069] Fig. 5 is a flowchart illustrating a typical operation of the CPU 10 in the above case.

[0070] As illustrated, in the CPU 10, the operand fetch circuit 13 first receives the logical address (step 101).

[0071] Then, the address conversion circuit 14 converts the logical address received in step 101 into real address information (step 102). Specifically, the address conversion circuit 14 converts the logical address into an effective address based on the address conversion table 141 and adds an encryption bit, padding characters, and the LPARID stored in the status register 142 to the effective address to obtain the real address information.

[0072] Subsequently, the hash value circuit 15 generates a hash value (digest) which is a part formed from the LPARID and the effective address in the real address information obtained in step 102 (step 103).

[0073] In addition, the concatenation circuit 16 generates a bit string concatenated with a hash value in which the real address information obtained in step 102 is concatenated with the hash value (excerpt) generated in step 103.

[0074] Further, the encryption circuit 17 encrypts the portion formed from the hash value, the LPARID, and the effective address in the hash-concatenated bit string generated in step 104 (step 105). Specifically, the encryption circuit 17 encrypts the portion according to AES or another standard using the encryption key received by the encryption key receiving circuit 171 from the encryption key storage area 50.

[0075] Then, after the encryption step 105, the bit change circuit 18 changes the first encryption bit of the bit string concatenated with a hash value from “0” to “1” to generate the encrypted real address information (step 106).

[0076] The real address information generated by the above processing is returned to the guest partition 192. Thereafter, the OS or the application in the guest partition 192 receives the encrypted real address information and sends the encrypted real address information to the accelerator 20 using the ICSWX instruction or the like. Hereinafter, the ICSWX instruction will be described as an example of an instruction used by the guest partition 192 to send the encrypted real address information to the accelerator 20.

[0077] Processing by the accelerator 20 to convert an encrypted real address into a real address

[0078] Fig. Figure 6 is a diagram schematically illustrating the situation that arises when the above processing is performed.

[0079] First, the OS or application in guest partition 192 requests processing from accelerator 20 using an ICSWX instruction. At this time, the LPARID in the guest partition is passed to accelerator 20 as an argument of the ICSWX instruction. Furthermore, the ICSWX instruction is executed, which passes the encrypted real address information from guest partition 192 to accelerator 20 (Figure 2A). Specifically, the encrypted real address information is passed to accelerator 20 as the argument of the ICSWX instruction or as data stored at the memory address specified by the argument of the ICSWX instruction.

[0080] In other words, upon finding the argument of the ICSWX instruction or the encrypted real address information in the memory 30, the accelerator 20 performs a decryption process described below.

[0081] First, the accelerator 20 generates a decrypted bit string by decrypting the encrypted bit string formed from the hash value, the LPARID, and the effective address in the encrypted real address information according to AES or another standard (2B).

[0082] The accelerator 20 then generates a hash value by applying a hash function such as SHA-1 to the bit string formed from the LPARID and the effective address in the decrypted bit string (2C).

[0083] The accelerator 20 compares the hash value in the decrypted bit string with the hash value generated in 2C (2D). If the hash values ​​match, processing proceeds to the next step. Otherwise, an error is considered, and subsequent processing is not performed.

[0084] Furthermore, in 2D, the LPARID in guest partition 192 that executed the ICSWX instruction is compared with the LPARID in the decrypted bit string, although this is not shown. If the previous LPARID matches the last LPARID, processing proceeds to the next step. Otherwise, an error is considered, and subsequent processing is not performed.

[0085] If the hash values ​​and the LPARIDs match in 2D, the accelerator 20 fills the hash values ​​in the decrypted bit string with zeros (2E).

[0086] In addition, the accelerator 20 changes the encryption bit in the decrypted bit string to zero to generate real address information (2F).

[0087] Then, the accelerator 20 finally accesses the memory 30 using the real address information generated in 2F (2G).

[0088] The following describes the functional configuration of the accelerator 20, which performs the processing as in Fig. 6 illustrates.

[0089] Fig. 7 shows a block diagram illustrating the functional configuration example of the accelerator 20.

[0090] As illustrated, the accelerator 20 includes an instruction decoder 21, an operand fetch circuit 22, a decryption circuit 23, a decryption key receiving circuit 231, a hash value circuit 24, and a comparator circuit 25. In addition, the accelerator 20 includes a stuffing circuit 26, a bit change circuit 27, and a memory access circuit 28.

[0091] The instruction decoder 21 receives and decodes an instruction sent from the CPU 10 using the ICSWX instruction. The sent instruction includes, in addition to instructions regarding processing contents, an LPARID in the sender's guest partition.

[0092] The operand fetching circuit 22 fetches an operand of the instruction decoded by the instruction decoder 21 and the LPARID. In many cases, the operand contains encrypted real address information. In this embodiment, the operand fetching circuit 22 is provided as an example of a receiving unit for receiving encrypted information or a receiving unit for receiving the identifier of a virtual machine.

[0093] The decryption circuit 23 generates a decrypted bit string by decrypting the encrypted part composed of the hash value, the LPARID, and the effective address in the encrypted physical address information retrieved by the operand retrieval circuit 22. In this embodiment, the encrypted part composed of the hash value, the LPARID, and the effective address is used as an example of the encrypted information, and the decrypted bit string is used as an example of the physical address information. Furthermore, the decryption circuit 23 is provided as an example of an acquisition unit for acquiring physical address information by decrypting the encrypted information.

[0094] The encryption key receiving circuit 231 receives from the encryption key storage area 50 the encryption key for use in the decryption performed by the decryption circuit 23 (see Fig. 1).

[0095] The hash value circuit 24 generates a hash value formed from the LPARID and the effective address in the decrypted bit string generated by the decryption circuit 23. In this embodiment, the part formed from the LPARID and the effective address in the decrypted bit string is used as an example of the bit string containing the physical address. Furthermore, the hash value circuit 24 is provided as an example of a second hash value generation unit that generates a hash value of a bit string.

[0096] The comparator circuit 25 compares the hash value in the decrypted bit string generated by the decryption circuit 23 with the hash value generated by the hash value circuit 24, and compares the LPARID in the decrypted bit string generated by the decryption circuit 23 with the LPARID retrieved by the operand retrieval circuit 22. If the results of these comparisons show that both hash values ​​and LPARIDs match, the operation is performed in the circuits described below. In this embodiment, the comparator circuit 25 is provided as an example of a comparison unit that compares hash values ​​or a comparison unit that compares identifiers, and as an example of a control unit that controls the physical address for use by the access unit.

[0097] The filling circuit 26 fills the part formed from the hash value in the decrypted bit string generated by the decryption circuit 23 with zeros.

[0098] The bit changing circuit 27 generates real address information by changing the encryption bit in the decrypted bit string filled by the filling circuit 26.

[0099] The memory access circuit 28 accesses the memory 30 using the physical address information generated by the bit change circuit 27. In this embodiment, the memory access circuit 28 is provided as an example of an access unit that accesses the memory using the physical address.

[0100] The following describes the operation of the accelerator 20, which performs the processing as in Fig. 6 illustrates.

[0101] In the accelerator 20, the instruction decoder 21 first decodes an instruction. In this embodiment, the accelerator 20 performs the processing described below when the operand of the instruction decoded by the instruction decoder 21 contains encrypted real address information.

[0102] Fig. Figure 8 shows a flow chart illustrating the typical operation of the accelerator 20 in this case.

[0103] As illustrated, in the accelerator 20, the operand fetch circuit 22 first receives the LPARID and the encrypted real address information (step 201). Here, the encryption bit in the encrypted real address information is "0." Access to the memory 30 can be performed in an existing method, and therefore, its description will be omitted. A description will be given below for a case where the encryption bit in the encrypted real address information is "1."

[0104] In this case, the decryption circuit 23 first generates a decrypted bit string by decrypting the encrypted part formed from the hash value, the LPARID, and the effective address in the encrypted real address information (step 202). Specifically, the decryption circuit 23 performs decryption according to AES or another standard using the encryption key received by the encryption key receiving circuit 231 from the encryption key storage area 50. However, it should be noted that decryption may be performed using the decryption key corresponding to an encryption key different from the encryption key used for the encryption performed by the encryption circuit 17.

[0105] Subsequently, the hash value circuit 24 generates a hash value (extract) formed from the LPARID and the effective address in the decrypted bit string obtained in step 202 (step 203).

[0106] The comparator circuit 25 compares the hash value in the decrypted bit string generated in step 202 with the hash value generated in step 203 to determine whether these hash values ​​coincide with each other (step 204).

[0107] As a result, if it is determined that the hash values ​​do not match, the LPARID or the effective address in the real address information in the guest partition 192 may be changed, and therefore, processing ends. Meanwhile, if it is determined that the hash values ​​match, the comparator circuit 25 compares the LPARID received in step 201 with the LPARID in the decrypted bit string generated in step 202 to determine whether the LPARIDs match (step 205).

[0108] As a result, if it is determined that the LPARIDs do not match each other, the LPARID can be rewritten, and therefore, processing is terminated. Meanwhile, if it is determined that the LPARIDs match each other, processing proceeds to the step of the filling circuit 26 and subsequent steps.

[0109] In other words, the filling circuit 26 fills the hash value in the decrypted bit string generated in step 202 with zeros (step 206).

[0110] In addition, the bit changing circuit 27 changes the first encryption bit of the decrypted bit string from “1” to “0” after filling in step 206 to generate the real address information (step 207).

[0111] Furthermore, the memory access circuit 28 accesses the memory 30 using the effective address in the real address information generated in step 207 (step 208).

[0112] As described above, in this embodiment, the CPU 10 encrypts the physical address and informs the guest partition 192 of the encrypted physical address instead of directly transmitting the physical address. This allows the guest partition 192 to directly handle the physical address, thereby reducing the allocation overhead.

[0113] Furthermore, this embodiment takes measures to prevent the use of an invalid encrypted address. Specifically, it checks whether the LPARID in the real address matches the LPARID in the sender's guest partition 192, and whether the real address matches the digest. This allows the receiver to detect the change even if the real address has been changed, preventing the guest partition 192 from forwarding an invalid real address to the accelerator 20.

[0114] Although in this embodiment, the processing object for generating a hash value is the part formed by the LPARID and the effective address, the processing object may only be the effective address. In other words, a hash value containing only the effective address may be generated.

[0115] Further, although in this embodiment the real address information includes the LPARID and the hash value, it is possible to use an illustrative embodiment in which the real address information does not include at least one of the LPARID and the hash value.

[0116] Although the present invention has been described above by means of the embodiment, the technical scope of the present invention is not limited to the description of the aforementioned embodiment. It will be apparent to those skilled in the art that various modifications or alternative embodiments may be employed without departing from the spirit and scope of the present invention. Description of reference symbols 10 CPU 11, 21 Instruction decoder 12 Authorization determination circuit 13, 22 Operand fetch circuit 14 Address conversion circuit 141 Address conversion table 142 status registers 15, 24 Hash value circuit 16 chain connection 17 Encryption circuit 171, 231 Encryption key receiving circuit 18, 27 Bit change circuit 20 accelerators 23 Decryption circuit 25 Comparator circuit 26 Filling circuit 28 Memory access circuit 30 storage 40 memory control unit 50 encryption key storage area 60 buses

Claims

[1] A method for operating virtual machines obtained by logically dividing a physical data processing device and converting a logical address into a physical address in memory that the virtual machine uses to access a memory, the method comprising in response to a request for a physical address by a guest partition (192) of the virtual machine, providing the logical corresponding address; Sending the logical address information by the guest partition (192) to a central unit (10) of the data processing device, wherein the central unit converts the logical address information into encrypted physical address information (S101); Sending the encrypted physical address information by the central unit (10) to the guest partition (192) of the virtual machine; Sending the encrypted physical address information from the guest partition (192) of the virtual machine to an accelerator (20) without knowing the physical address information in the encrypted physical address information; in response to receipt (S201) of the encrypted physical address information from the guest partition (192) of the virtual machine by the accelerator (20), Decrypting the encrypted physical address information by the accelerator (20) into a set of physical address information without using a hypervisor (191) to perform the address conversion; and Accessing a storage unit in the data processing system within the data processing facility by the accelerator (20) using the physical address contained in the set of physical address information. [2] The method according to claim 1, wherein the conversion of the logical address into the encrypted physical address information by the central unit (10) further comprises Converting the logical address into physical address information (S102); and Encrypting the physical address information to form the encrypted physical address information. [3] The method of claim 2, wherein the physical address information includes an encryption bit, padding characters, an identifier for the guest partition (192), and an effective address of the real address. [4] The method of claim 3, wherein the method further comprises padding the padding characters with a plurality of hash bits by applying a hash function to the guest partition identifier and the effective address of the physical address. [5] The method according to claim 4, wherein the decryption by the accelerator (20) of the encrypted real address information using physical address information additionally comprises Decrypting (S202) the encrypted physical address information into a decrypted bit string that identifies the hash bits, the guest partition identifier, and an effective address; generating (203) a second hash value by the accelerator using the identifier for the guest partition (192) and the effective address; Determining (204) whether the second hash value matches the hash bits or not; and while determining (S204) that the second hash value matches the hash bits, generating (S206, S207) the set of physical address information by replacing the hash value with zeros; and while determining that the second hash value does not match the hash bits, generating an error message. [6] A system comprising a central unit (10) for operating virtual machines obtained by logically dividing a physical machine, the system being adapted to carry out the method according to any one of claims 1 to 5.

Images