International Business Machines Corporation

Jonathan D Bradbury

Michael K Gschwind

Timothy John Slegel

Eric M Schwarz

Christian Jacobi

Lisa Cranton Heller

Fadi Y Busaba

Chung-Lung K Shum

Donald W Schmidt

Dan F Greiner

Mark S Farrell

Charles W Gainey, Jr

Damian Leo Osisek

Anthony Saporito

Jeffrey Paul Kubala

Reinhard Theodor Buendgen

Matthias Klein

Steven R Carlough

Valentina Salapura

Reid T Copeland

Aditya Nitin Puranik

Silvia Melitta Mueller

Christian Zoellin

Jonathan R Fry

Christian Borntraeger

Michael R Kane

Brian Robert Prasky

Anthony Thomas Sofia

Bruce C Giamei

Maged M Michael

Cedric Lichtenau

Christoph Raisch

Marco Kraemer

Martin Recktenwald

Frank Siegfried Lehnert

Peter Dana Driever

Brenton F Belmar

Claudio Imbrenda

Giles R Frazier

Laith M AlBarakat

Jane Helen Bartik

Daniel V Rosa

Markus Helms

Edward Thomas Malley

Martin Schwidefsky

Timothy J Siegel

Robert F Enenkel

Janosch Andreas Frank

Peter Grimm Sutton

Utz Bacher

Petra Leber

Peter Jeremy Relson

Younes Manton

Simon Weishaupt

Xin Guo

Heiko Carstens

David F Craddock

Harold Wade Cain, Iii

Jeb R Linton

Dimitrios Pendarakis

Richard Harold Boivie

James A O'Connor

William Eric Hall

Jentje Leenstra

Ashutosh Misra

Guerney D H Hunt

Elaine Rivette Palmer

Stefan Payer

Carsten Otte

James H Mulder

Gary M King

Razvan Peter Figuli

Joachim Von Buttlar

Deepankar Bhattacharjee

Viktor Mihajlovski

Li Feng Zhang

Ronald Morton Smith, Sr

David Arlen Elko

Tamas Visegrady

Brett Olsson

Scott M Carlson

David Harold Surman

Richard Victor Kisley

Bernd Nerz

Girish Gopala Kurup

Michael Klein

Donald Crabtree

Klaus Werner

Nicolas Maeding

Denise M Sevigny

Joran S C Siu

Mahmoud Amin

Andrew M Sica

Volker Urban

Volodymyr Paprotski

Harald Freudenberger

Seth E Lederer

Michel Henri Théodore Hack

Hunter J Kauffman

Trevor E Carlson

Deferred reclaiming of secure guest resources within a computing environment is provided, which includes initiating, by a host of the computing environment, removal of a secure guest from the computing environment, while leaving one or more resources of the secure guest to be reclaimed asynchronous to the removal of the secure guest. The deferring also includes reclaiming the one or more secure guest resources asynchronous to the removal of the secure guest, where the one or more secure guest resources are available for reuse as the one or more secure guest resources are reclaimed asynchronous to the removal of the secure guest.

Deferred reclaiming of secure guest resources

Storage accesses for merge operations are minimized. A plurality of records of a plurality of input lists are merged. The merging includes determining that an input list of the plurality of input lists has become empty, and checking, based on determining that the input list has become empty, a control specific for the input list. The control is used to determine how to proceed, such as whether to end merging or continue merging.

Controlling storage accesses for merge operations

A trusted execution environment obtains an attestation request. The attestation request includes at least an attestation key. Based on obtaining the attestation request, one or more integrity measurements are computed, and the computing uses at least the attestation key. The one or more integrity measurements are provided to an entity, and the one or more integrity measurements are to be used to verify that a secure guest has been started using a selected secure guest image and selected secure guest metadata.

Attestation of a secure guest

A method, system, and computer program product implement a three-factor authorization in a trusted computing environment. The method includes triggering, by a hypervisor, a start of a secure guest by passing control regarding an image of the secure guest and metadata of the secure guest to a trusted firmware, where the secure guest is designed to access a hardware security module (HSM). Upon a successful integrity check of the metadata of the secure guest by the trusted firmware, the secure guest is started using the hypervisor and any sensitive request from the secure guest to the HSM is blocked. The secure guest submits a request with a request structure including a third authorization secret and a characterization of a requested HSM to the trusted firmware. The method also includes binding each HSM protected key generated in the requested HSM in response to the request to the third authorization secret.

Extending secure guest metadata to bind the secure guest to a hardware security module

A secure guest generates an updated image for the secure guest, and computes one or more measurements for the updated image. The secure guest provides the one or more measurements to a trusted execution environment and obtains from the trusted execution environment metadata for the updated image. The metadata is generated based on metadata of the secure guest and obtaining the one or more measurements.

Secure guest image and metadata update

A computer-implemented method for providing a system-specific secret to a computing system having a plurality of computing components is disclosed. The method includes storing permanently a component-specific import key as part of a computing component and storing the component-specific import key in a manufacturing-side storage system. Upon a request for the system-specific secret for a computing system, the method includes identifying the computing component comprised in the computing system, retrieving a record relating to the identified computing component, determining the system-specific secret protected by a hardware security module and determining a system-specific auxiliary key. Furthermore, the method includes encrypting the system-specific auxiliary key with the retrieved component-specific import key, thereby creating a auxiliary key bundle, encrypting the system-specific secret and storing the auxiliary key bundle and a system record in a storage medium of the computing system.

Deploying a system-specific secret in a highly resilient computer system

A query operation is performed to obtain information for a select entity of a computing environment. The information includes boost information of one or more boost features currently available for the select entity. The one or more boost features are to be used to temporarily adjust one or more processing attributes of the select entity. The boost information obtained from performing the query operation is provided in an accessible location to be used to perform one or more actions to facilitate processing in the computing environment.

Query and update of processor boost information

A conversion operation is performed which includes a plurality of conversion actions. A conversion action includes processing an instruction to convert selected data from a source data type to a target data type. The processing includes determining whether a data type indicated using the instruction is a valid data type for a select machine. The data type is a selected data type selected from the source data type or the target data type. The selected data is converted from the source data type to the target data type, based on determining that the data type is a valid data type for the select machine. An indicator is set to a select value to indicate the data type is an invalid data type, based on determining that the data type is an invalid data type for the select machine. The indicator is checked at an end of the conversion operation.

Detection of invalid machine-specific data types during data conversion

A method, computer program product, and a system where a secure interface control determines functionality of a secure guest based on metadata. The secure interface control ('SC') obtains metadata linked to an image of a secure guest to be started by an owner and managed by the hypervisor, where the metadata comprises control(s) that indicate whether a secure guest generated with the image is permitted to obtain a response to a particular request. The SC intercepts, from the secure guest generated with the image, during runtime, a request. The SC determines, based on the control(s), if the secure guest is permitted to obtain a response to the request. If permitted, the SC commences fulfillment of the request, within the computing system. If not permitted, the SC ignores the request.

Secure execution guest owner controls for secure interface control

A virtual machine is dispatched and based on the dispatch, a determination is made as to whether a select area of memory expected to be accessible to the virtual machine and used in communication between the virtual machine and an operating system is accessible to the virtual machine. Based on determining that the select area of memory is inaccessible to the virtual machine, virtual machine execution is exited with a select interception code.

Inaccessible prefix pages during virtual machine execution

At least one request to store diagnostic state of a virtual machine is obtained. Based on obtaining the at least one request, a store of diagnostic state of the virtual machine is performed to provide stored diagnostic state of the virtual machine. The performing the store includes encrypting the diagnostic state of the virtual machine that is unencrypted and being stored to prevent a reading of the diagnostic state of the virtual machine by an untrusted entity prior to encrypting the diagnostic state of the virtual machine that is unencrypted and being stored.

Storing diagnostic state of secure virtual machines

A secure guest of a computing environment requests confidential data. The confidential data is included in metadata of the secure guest, which is stored in a trusted execution environment of the computing environment. Based on the request, the confidential data is obtained from the metadata of the secure guest that is stored in the trusted execution environment.

Confidential data provided to a secure guest via metadata

A trusted execution environment obtains a secure guest image and metadata to be used to start a secure guest. The metadata includes multiple parts and a plurality of integrity measures. A first part of the metadata includes one or more integrity measures of the plurality of integrity measures, and a second part of the metadata includes customized confidential data of the secure guest and one or more other integrity measures of the plurality of integrity measures. The trusted execution environment is used to verify at least one select part of the metadata using at least one integrity measure of the plurality of integrity measures of the metadata. Based on successful verification of the at least one select part of the metadata, the trusted execution environment starts the secure guest using the secure guest image and at least a portion of the metadata.

Customization of multi-part metadata of a secure guest

An indication of a function to be executed is obtained, in which the function is one function of an instruction and configured to perform multiple operations. A determination is made of an operation of the multiple operations to be performed, and a set of function-specific parameters is validated using a set of values and a corresponding set of relationships. The set of values and corresponding set of relationships are based on the operation to be performed. One set of values and corresponding set of relationships are to be used for the operation to be performed, and another set of values and corresponding set of relationships are to be used for another operation of the multiple operations.

Single function to perform multiple operations with distinct operation parameter validation

An input/output store instruction is handled. A data processing system includes a system nest communicatively coupled to at least one input/output bus by an input/output bus controller. The data processing system further includes at least a data processing unit including a core, system firmware and an asynchronous core-nest interface. The data processing unit is communicatively coupled to the system nest via an aggregation buffer. The system nest is configured to asynchronously load from and/or store data to an external device which is communicatively coupled to the input/output bus. The data processing unit is configured to complete the input/output store instruction before an execution of the input/output store instruction in the system nest is completed.

Handling an input/output store instruction

Growing community of inventors

Poughkeepsie, NY, United States of America

Jonathan D Bradbury