Program interruptions for page importing/exporting

Patent metadata

Field	Value
Publication number	US-2020285762-A1
Application number	US-201916296352-A
Country	US
Kind code	A1
Filing date	Mar 8, 2019
Priority date	Mar 8, 2019
Publication date	Sep 10, 2020
Grant date	—

Abstract

An example computer-implemented method includes presenting, by a hardware control of a computing system, an exception to an untrusted entity when the untrusted entity accesses a secure page stored in a memory of the computing system, the exception preventing the untrusted entity from accessing the secure page. The method further includes, in response to the exception, issuing, by the untrusted entity, an export call routine. The method further includes executing, by a secure interface control of the computing system, the export call routine.

First claim

What is claimed is:

1 . A computer-implemented method comprising:
presenting, by a hardware control of a computing system, an exception to an untrusted entity when the untrusted entity accesses a secure page stored in a memory of the computing system, the exception preventing the untrusted entity from accessing the secure page; in response to the exception, issuing, by the untrusted entity, an export call routine; and executing, by a secure interface control of the computing system, the export call routine.

2 . The computer-implemented method of claim 1 , wherein the export call routine comprises:
encrypting, by the secure interface control, the secure page.

3 . The computer-implemented method of claim 2 , wherein the export call routine comprises:
prior to the encrypting, locking, by the secure interface control, the secure page; and subsequent to the encrypting, unlocking, by the secure interface control, the secure page.

4 . The computer-implemented method of claim 2 , wherein the export call routine comprises:
prior to the encrypting, registering, by the secure interface control, the secure page to the secure interface control in a zone-security table.

5 . The computer-implemented method of claim 2 , wherein the export call routine comprises:
capturing, by the secure interface control, a hash of encrypted contents of the secure page.

6 . The computer-implemented method of claim 2 , wherein the export call routine comprises:
subsequent to the encrypting, marking, by the secure interface control, a host absolute page as non-secure.

7 . The computer-implemented method of claim 2 , wherein the export call routine comprises:
subsequent to the encrypting, registering, by the secure interface control, the host absolute page as non-secure in a zone-security table.

8 . The computer-implemented method of claim 3 , further comprising:
prior to locking the secure page, determining whether the secure page is locked; responsive to determining that the secure page is locked, generating a busy indicator to the untrusted entity; and waiting a delay period.

9 . The computer-implemented method of claim 1 , wherein the secure interface control comprises firmware, hardware, or a combination of firmware and hardware; and the untrusted entity comprises a hypervisor.

10 . A system comprising:
a memory comprising computer readable instructions; and a processing device for executing the computer readable instructions for performing a method comprising:
presenting, by a hardware control of a computing system, an exception to an untrusted entity when the untrusted entity accesses a secure page stored in a memory of the computing system, the exception preventing the untrusted entity from accessing the secure page;
in response to the exception, issuing, by the untrusted entity, an export call routine; and
executing, by a secure interface control of the computing system, the export call routine.

11 . The system of claim 10 , wherein the export call routine comprises:
encrypting, by the secure interface control, the secure page.

12 . The system of claim 11 , wherein the export call routine comprises:
prior to the encrypting, locking, by the secure interface control, the secure page; and subsequent to the encrypting, unlocking, by the secure interface control, the secure page.

13 . The system of claim 11 , wherein the export call routine comprises:
prior to the encrypting, registering, by the secure interface control, the secure page to the secure interface control in a zone-security table.

14 . The system of claim 11 , wherein the export call routine comprises:
capturing, by the secure interface control, a hash of encrypted contents of the secure page.

15 . The system of claim 11 , wherein the export call routine comprises:
subsequent to the encrypting, marking, by the secure interface control, a host absolute page as non-secure.

16 . The system of claim 11 , wherein the export call routine comprises:
subsequent to the encrypting, registering, by the secure interface control, the host absolute page as non-secure in a zone-security table.

17 . The system of claim 12 , further comprising:
prior to locking the secure page, determining whether the secure page is locked; responsive to determining that the secure page is locked, generating a busy indicator to the untrusted entity; and waiting a delay period.

18 . The system of claim 10 , wherein the secure interface control comprises firmware, hardware, or a combination of firmware and hardware; and the untrusted entity comprises a hypervisor.

19 . A computer program product comprising:
a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processing device to cause the processing device to perform a method comprising:
presenting, by a hardware control of a computing system, an exception to an untrusted entity when the untrusted entity accesses a secure page stored in a memory of the computing system, the exception preventing the untrusted entity from accessing the secure page;
in response to the exception, issuing, by the untrusted entity, an export call routine; and
executing, by a secure interface control of the computing system, the export call routine.

20 . A computer-implemented method comprising:
responsive to a secure entity accessing a page that has been paged-in by a untrusted entity of a computing system but is not yet secure, presenting, by a hardware control of the computing system, an exception to the untrusted entity of the computing system, the exception preventing the untrusted entity from accessing the page; and responsive to the exception, issuing, by the untrusted entity, an import call routine; and executing, by a secure interface control of the computing system, the import call routine.

21 . The computer-implemented method of claim 20 , wherein the import call routine comprises:
determining, by a secure interface control of the computing system, whether the secure page is a shared page.

22 . The computer-implemented method of claim 21 , wherein the import call routine further comprises:
responsive to determining that the secure page is not a shared secure page, marking, by the secure interface control, the secure page as secure.

23 . The computer-implemented method of claim 21 , wherein the import call routine further comprises:
registering, by the secure interface control, the secure page to the secure interface control in a zone-security table.

24 . The computer-implemented method of claim 21 , wherein the import call routine further comprises:
decrypting, by the secure interface control, the secure page.

25 . A computer program product comprising:
a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processing device to cause the processing device to perform a method comprising:
responsive to a secure entity accessing a page that has been paged-in by a untrusted entity of a computing system but is not yet secure, presenting, by a hardware control of the computing system, an exception to the untrusted entity of the computing system, the exception preventing the untrusted entity from accessing the page; and
responsive to the exception, issuing, by the untrusted entity, an import call routine; and
executing, by a

Assignees

• IBM

Inventors

• Bradbury Jonathan D
• Schwidefsky Martin
• Borntraeger Christian
• Heller Lisa Cranton
• Carstens Heiko
• Busaba Fadi Y

Classifications

• G06F2212/657

  Virtual address space management · CPC title

• G06F2212/656

  Address space sharing · CPC title

• G06F2212/152

  Virtualized environment, e.g. logically partitioned system · CPC title

• G06F2212/1048

  Scalability · CPC title

• G06F2212/1024

  Latency reduction · CPC title