Subsystem SVC screening
After you write an SVC routine and insert it into the system, the routine is generally available unless you take steps to regulate access to the routine. Subsystem SVC screening allows a system routine to define those SVCs that a specific task can validly issue. When SVC screening is active for a task, the system determines, for each SVC issued by that task, whether the task can request that SVC function. If the SVC request is invalid, control is given to a special error subroutine supplied by the routine that activated the screening function.
- TCBSVCS - A flag bit. When set to one, it indicates that screening is in effect for this task.
- TCBSVCA2 - Address of the subsystem screen table.
- TCBSVCSP - Propagation bit. When set to one, it indicates that ATTACH processing should pass the SVC screening information in these three fields to the attached task.
- Initializing the SVRB if the subroutine is to execute as a type 2, 3, or 4 SVC.
- Obtaining the LOCAL lock if the subroutine is to execute as a type 1 SVC.
- Acquiring all locks necessary for the subroutine's execution.
The subsystem that needs SVC screening obtains storage via GETMAIN for an area called the subsystem screen table. For non-extended SVC screening, the subsystem screen table is 264 bytes in size. For extended SVC screening, the subsystem screen table is 1288 bytes in size. To prevent a page fault, this area must come from the LSQA (subpool 253-255), the SQA (subpool 245), or must be in fixed storage. If the subsystem screen table is in fixed storage, the subsystem must ensure that the storage is protected from user modification. The subsystem screen table contains two areas as follows:
1) SSTSVCN -- Subsystem SVC entry (8 bytes)
Byte | Bit | Contents |
---|---|---|
0-3 | 0 | One of the following:
|
1-31 | Entry point address of the subsystem subroutine that will get control whenever a task has issued an SVC against which there is a screening restriction. | |
Byte 4 |
|
|
Byte 5 | One of the following:
|
|
Bytes 6-7 | Locks to be held on entry to the subroutine. If
the appropriate lock bit is one, the lock will be acquired by the
SVC FLIH. The lock bits are:
Bits 2–15 are always zero (off). |
2) SSTMASK -- SVC screening mask (256 bytes or 1280 bytes)
If you are not screening extended SVCs (bit 7 of byte 6 of the SSTSVCN is zero), then SSTMASK will be 256 bytes long. If you are screening extended SVCs (bit 7 of byte 6 of the SSTSVCN is one), then SSTMASK must be 1280 bytes long.
- Bytes
- Content
- 8-263
- Each byte corresponds to an SVC number in ascending order in the range 0-255. When the high order bit in a byte is one, the task may validly issue the respective SVC; when the bit is zero, there is a screening restriction that prohibits the task from issuing the SVC.
- 264-519
- Each byte corresponds to an SVC routing number in ascending order in the range 0-255 for SVC 109.
- 520-775
- Each byte corresponds to an SVC routing number in ascending order in the range 0-255 for SVC 116.
- 776-1031
- Each byte corresponds to an SVC routing number in ascending order in the range 0-255 for SVC 122.
- 1032-1287
- Each byte corresponds to an SVC routing number in ascending order in the range 0-255 for SVC 137.
When you use SVC screening with the ESR function, and a program issues an extended SVC, the system ignores the screening information provided for the SVC number itself (for example, 109). Instead, it looks only at the screening information provided for the particular routing code. See SVCUPDTE in z/OS MVS Programming: Authorized Assembler Services Reference SET-WTO for more information about specifying the ESR parameter.