# US 11,308,229 B2 · Program interruptions for page importing/exporting > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,308,229 B2 - Document ID: US11308229B2 - Status: Granted - Kind: B2 - Application number: 16/296,352 - Filed: 2019-03-08 - Published: 2020-09-10 - Granted: 2022-04-19 - Earliest claimed: 2019-03-08 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Jonathan D. Bradbury; Martin Schwidefsky; Christian Borntraeger; Lisa Cranton Heller; Heiko Carstens; Fadi Y. Busaba - Web page: https://patentgrep.com/patent/US11308229B2 ## CPC - G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself} - G06F 21/00: Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity - G06F 21/60: Protecting data - G06F 21/602: {Providing cryptographic facilities or services} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2212/65: Details of virtual memory and virtual address translation - G06F 2221/2147: Locking files - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An example computer-implemented method includes presenting, by a hardware control of a computing system, an exception to an untrusted entity when the untrusted entity accesses a secure page stored in a memory of the computing system, the exception preventing the untrusted entity from accessing the secure page. The method further includes, in response to the exception, issuing, by the untrusted entity, an export call routine. The method further includes executing, by a secure interface control of the computing system, the export call routine. ## Claims ### Claim 1 A computer-implemented method comprising: presenting, by a hardware control of a computing system, an exception to an untrusted entity when the untrusted entity accesses a secure page stored in a memory of the computing system, the exception preventing the untrusted entity from accessing the secure page; in response to the exception, issuing, by the untrusted entity, an export call routine, wherein the export call routine comprises registering, by a secure interface control of the computing system, the secure page to the secure interface control in a zone-security table thereby preventing a secure guest from accessing the secure page, wherein the zone-security table comprises a secure domain identifier, a secure interface control bit, a disable address compare bit, a shared bit, and a host virtual address; and executing, by the secure interface control of the computing system, the export call routine. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the export call routine comprises: encrypting, by the secure interface control, the secure page. ### Claim 3 (depends on 2) The computer-implemented method of claim 2, wherein the export call routine comprises: prior to the encrypting, locking, by the secure interface control, the secure page; and subsequent to the encrypting, unlocking, by the secure interface control, the secure page. ### Claim 4 (depends on 2) The computer-implemented method of claim 2, wherein the export call routine comprises: performing the registering prior to the encrypting. ### Claim 5 (depends on 2) The computer-implemented method of claim 2, wherein the export call routine comprises: capturing, by the secure interface control, a hash of encrypted contents of the secure page. ### Claim 6 (depends on 2) The computer-implemented method of claim 2, wherein the export call routine comprises: subsequent to the encrypting, marking, by the secure interface control, a host absolute page as non-secure. ### Claim 7 (depends on 2) The computer-implemented method of claim 2, wherein the export call routine comprises: subsequent to the encrypting, registering, by the secure interface control, the host absolute page as non-secure in the zone-security table. ### Claim 8 (depends on 3) The computer-implemented method of claim 3, further comprising: prior to locking the secure page, determining whether the secure page is locked; responsive to determining that the secure page is locked, generating a busy indicator to the untrusted entity; and waiting a delay period. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, wherein the secure interface control comprises firmware, hardware, or a combination of firmware and hardware; and the untrusted entity comprises a hypervisor. ### Claim 10 A system comprising: a memory comprising computer readable instructions; and a processing device for executing the computer readable instructions for performing a method comprising: presenting, by a hardware control of a computing system, an exception to an untrusted entity when the untrusted entity accesses a secure page stored in a memory of the computing system, the exception preventing the untrusted entity from accessing the secure page, wherein the zone-security table comprises a secure domain identifier, a secure interface control bit, a disable address compare bit, a shared bit, and a host virtual address; in response to the exception, issuing, by the untrusted entity, an export call routine, wherein the export call routine comprises registering, by a secure interface control of the computing system, the secure page to the secure interface control in a zone-security table thereby preventing a secure guest from accessing the secure page; and executing, by the secure interface control of the computing system, the export call routine. ### Claim 11 (depends on 10) The system of claim 10, wherein the export call routine comprises: encrypting, by the secure interface control, the secure page. ### Claim 12 (depends on 11) The system of claim 11, wherein the export call routine comprises: prior to the encrypting, locking, by the secure interface control, the secure page; and subsequent to the encrypting, unlocking, by the secure interface control, the secure page. ### Claim 13 (depends on 11) The system of claim 11, wherein the export call routine comprises: performing the registering prior to the encrypting. ### Claim 14 (depends on 11) The system of claim 11, wherein the export call routine comprises: capturing, by the secure interface control, a hash of encrypted contents of the secure page. ### Claim 15 (depends on 11) The system of claim 11, wherein the export call routine comprises: subsequent to the encrypting, marking, by the secure interface control, a host absolute page as non-secure. ### Claim 16 (depends on 11) The system of claim 11, wherein the export call routine comprises: subsequent to the encrypting, registering, by the secure interface control, the host absolute page as non-secure in the zone-security table. ### Claim 17 (depends on 12) The system of claim 12, further comprising: prior to locking the secure page, determining whether the secure page is locked; responsive to determining that the secure page is locked, generating a busy indicator to the untrusted entity; and waiting a delay period. ### Claim 18 (depends on 10) The system of claim 10, wherein the secure interface control comprises firmware, hardware, or a combination of firmware and hardware; and the untrusted entity comprises a hypervisor. ### Claim 19 A computer program product comprising: a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processing device to cause the processing device to perform a method comprising: presenting, by a hardware control of a computing system, an exception to an untrusted entity when the untrusted entity accesses a secure page stored in a memory of the computing system, the exception preventing the untrusted entity from accessing the secure page; in response to the exception, issuing, by the untrusted entity, an export call routine, wherein the export call routine comprises registering, by a secure interface control of the computing system, the secure page to the secure interface control in a zone-security table thereby preventing a secure guest from accessing the secure page, wherein the zone-security table comprises a secure domain identifier, a secure interface control bit, a disable address compare bit, a shared bit, and a host virtual address; and executing, by the secure interface control of the computing system, the export call routine. ### Claim 20 A computer-implemented method comprising: responsive to a secure entity accessing a page that has been paged-in by a untrusted entity of a computing system but is not yet secure, presenting, by a hardware control of the computing system, an exception to the untrusted entity of the computing system, the exception preventing the untrusted entity from accessing the page; and responsive to the exception, issuing, by the untrusted entity, an import call routine; and executing, by a secure interface control of the computing system, the import call routine. ### Claim 21 (depends on 20) The computer-implemented method of claim 20, wherein the import call routine comprises: determining, by a secure interface control of the computing system, whether the page is a shared page. ### Claim 22 (depends on 21) The computer-implemented method of claim 21, wherein the import call routine further comprises: responsive to determining that the secure page is not a shared secure page, marking, by the secure interface control, the secure page as secure. ### Claim 23 (depends on 21) The computer-implemented method of claim 21, wherein the import call routine further comprises: registering, by the secure interface control, the secure page to the secure interface control in a zone-security table. ### Claim 24 (depends on 21) The computer-implemented method of claim 21, wherein the import call routine further comprises: decrypting, by the secure interface control, the secure page. ### Claim 25 A computer program product comprising: a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processing device to cause the processing device to perform a method comprising: responsive to a secure entity accessing a page that has been paged-in by a untrusted entity of a computing system but is not yet secure, presenting, by a hardware control of the computing system, an exception to the untrusted entity of the computing system, the exception preventing the untrusted entity from accessing the page; and responsive to the exception, issuing, by the untrusted entity, an import call routine; and executing, by a secure interface control of the computing system, the import call routine.