International Business Machines Corporation

Marco Kraemer

Christoph Raisch

Peter Dana Driever

Carsten Otte

Donald W Schmidt

Bernd Nerz

Matthias Klein

Frank Siegfried Lehnert

Jonathan D Bradbury

Christian Jacobi

Brenton F Belmar

Jakob Christopher Lang

David F Craddock

Angel Nunez Mencias

Beth A Glendening

Sascha Junghans

Dale Francis Riedy, Jr

Anthony Thomas Sofia

Christine Axnix

Thomas Pohl

Dirk Bolte

Deborah A Furman

Martin Troester

Juan J Ruiz

Stefan Roscher

Hoang-Nam Nguyen

Gerd Konrad Bayer

Stefan Usenbinz

Franz Hardt

Hubertus Franke

Bulent Abali

Peter Kenneth Szwed

Steven G Glassen

John C Dayka

Michael J Jordan

Klaus Werner

Thomas B Mathias

Edward W Chencinski

Matteo Michel

Jan-Bernd Themann

James Richard Coon

Garry Joseph Sullivan

Richard J Gusefski

Jens Mehler

Christoph Vincent Schlameuss

Matthias Brachmann

Robert Kieninger

An apparatus, a method, and a computer program product are provided that provide confidential computing on virtual machines by securing input/output operations between a virtual machine and a device. The method includes receiving an input/output (I/O) transaction from an I/O device requesting data stored memory from a virtual machine. The I/O transaction includes a virtual memory address and a bus device function. The method also includes associating the I/O transaction with a key slot associated with the virtual machine and retrieving, using the key slot, an encryption key used to encrypt and decrypt the data. The method further includes retrieving the data located at a physical memory address in physical memory relating to the virtual memory address of the data being requested and decrypting, during a read operation, the data using the encryption key for I/O transmission. The method also includes transmitting the decrypted data to the I/O device.

Secure communication of virtual machine encrypted memory

A processor receives an interrupt signal. The interrupt signal is received with an interrupt target ID identifying a target processor for handling the interrupt signal. The processor is a target of the interrupt signal directly. A check is made as to whether the processor is the target processor identified by the interrupt target ID. The checking includes performing a comparison of the interrupt target ID with a current interrupt target ID assigned to the processor. Based on the checking being successful, the interrupt signal is accepted for handling by the processor.

Directed interrupt virtualization with fallback

An interrupt signal is provided to a first guest operating system. A bus attachment device receives an interrupt signal from a bus connected module with an interrupt target ID identifying a processor assigned for use by the guest operating system as a target processor for handling the interrupt signal. The bus attachment device checks whether the target processor is scheduled for usage by the guest operating system. If the target processor is not scheduled for usage, the bus attachment device forwards the interrupt signal using broadcasting and updates a forwarding vector entry stored in a memory section assigned to a second guest operating system hosting the first guest operating system. The update is used for indicating to the first operating system that there is a first interrupt signal addressed to the interrupt target ID to be handled.

Directed interrupt for multilevel virtualization

An input/output store instruction is handled. A data processing system includes a system nest communicatively coupled to at least one input/output bus by an input/output bus controller. The data processing system further includes at least a data processing unit including a core, system firmware and an asynchronous core-nest interface. The data processing unit is communicatively coupled to the system nest via an aggregation buffer. The system nest is configured to asynchronously load from and/or store data to an external device which is communicatively coupled to the input/output bus. The data processing unit is configured to complete the input/output store instruction before an execution of the input/output store instruction in the system nest is completed.

Handling an input/output store instruction

An interrupt signal is provided to a guest operating system. A bus connected module is operationally connected with a plurality of processors via a bus attachment device. The bus attachment device receives an interrupt signal from the bus connected module with an interrupt target ID identifying one of the processors assigned for use by the guest operating system as a target processor for handling the interrupt signal. The bus attachment device checks whether the target processor is running using a running indicator provided by an interrupt table entry stored in a memory operationally connected with the bus attachment device. If the target processor is running, the bus attachment device forwards the interrupt signal to the target processor for handling. A translation of the interrupt target ID to a logical processor ID of the target processor is used to address the target processor directly.

Directed interrupt virtualization with running indicator

Embodiments are disclosed for merging data structure definitions. The techniques include generating a first memory layout definition based on a first data structure definition that is written in a first programming language. The techniques further include generating a second memory layout definition based on a second data structure definition that is written in a second programming language. Additionally, the techniques include merging the first memory layout definition and the second memory layout definition into a merged memory layout definition. Further, the techniques include generating a merged data structure definition based on the merged memory layout definition.

Merging data structure definitions

An interrupt signal is provided to a first guest operating system. A bus attachment device receives an interrupt signal from a bus connected module with an interrupt target ID identifying a processor assigned for use by the guest operating system as a target processor for handling the interrupt signal. The bus attachment device translates the received interrupt target ID to a logical processor ID of the target processor using an interrupt table entry stored in a memory section assigned to a second guest operating system hosting the first operating system and forwards the interrupt signal to the target processor for handling. The logical processor ID of the target processor is used to address the target processor directly.

Directed interrupt for multilevel virtualization with interrupt table

An interrupt signal is provided to an operating system executed using one or more processors of a plurality of processors. A bus attachment device receives an interrupt signal with an interrupt target ID identifying a processor assigned for use as a target processor for handling the interrupt signal. The bus attachment device translates the received interrupt target ID to a processor ID using an interrupt table entry and forwards the interrupt signal to the target processor for handling. The processor ID is used to address the target processor directly.

Directed interrupt virtualization with interrupt table

An input/output store instruction is handled. A data processing system includes a system nest coupled to at least one input/output bus by an input/output bus controller. The data processing system further includes at least a data processing unit including a core, system firmware and an asynchronous core-nest interface. The data processing unit is coupled to the system nest via an aggregation buffer. The system nest is configured to asynchronously load from and/or store data to at least one external device which is coupled to the at least one input/output bus. The data processing unit is configured to complete the input/output store instruction before an execution of the input/output store instruction in the system nest is completed. The asynchronous core-nest interface includes an input/output status array with multiple input/output status buffers. The system firmware includes a retry buffer and the core includes an analysis and retry logic.

An input/output store instruction is handled. A data processing system includes a system nest coupled to at least one input/output bus by an input/output bus controller. The data processing system further includes at least a data processing unit including a core, system firmware and an asynchronous core-nest interface. The data processing unit is coupled to the system nest via an aggregation buffer. The system nest is configured to asynchronously load from and/or store data to at least one external device which is coupled to the at least one input/output bus. The data processing unit is configured to complete the input/output store instruction before an execution of the input/output store instruction in the system nest is completed. The asynchronous core-nest interface includes an input/output status array with multiple input/output status buffers.

A method for processing an instruction by a processor operationally connected to one or more buses comprises determining the instruction is to access an address of an address space that maps a memory and comprises a range of MMIO addresses. The method determines the address being accessed is within the range of MMIO addresses and generates, based on the determination, a first translation of the address being accessed to a bus identifier identifying one of the buses and a bus address of a bus address space. The bus address resulting from the translation is assigned to a device accessible via the identified bus. The method generates an entry in a translation lookaside buffer. A request directed to the device is sent via the identified bus to the bus address resulting from the translation.

MMIO addressing using a translation lookaside buffer

An interrupt signal is provided to a target processor. An interrupt signal is received with an interrupt target ID identifying a processor as a target processor for handling the interrupt signal. The interrupt signal is forwarded to the target processor for handling. A translation of the interrupt target ID to a logical processor ID of the target processor is used to address the target processor directly. The bus attachment device updates a directed interrupt signal indicator of a directed interrupt signal vector assigned to the target processor in order to indicate that there is an interrupt signal addressed to the respective interrupt target ID to be handled.

Interrupt signaling for directed interrupt virtualization

Growing community of inventors

Sindelfingen, Germany

Marco Kraemer