Abstract: A method for testing storage protection hardware includes receiving by a non-trusted entity that is executing on a host server, a request to dispatch a secure entity. It is determined, by a secure interface control of the host server, whether the host server is in an auxiliary-secure (AS) debug mode for testing an AS entity. Based on determining that the host server is in the AS debug mode, a secure guest entity state is loaded from a state descriptor for the secure entity into an AS entity state in hardware to test, upon dispatch of the secure entity, accesses to pages in a memory that are registered as secure and as belonging to the AS entity.

Abstract: An computer-implemented method according to examples includes receiving, by a secure interface control of a computing system, a request by a requestor to access a page in a memory of the computing system. The method further includes, responsive to determining that the requestor is a non-secure requestor and responsive to a secure-storage bit being set, prohibiting access to the page without performing an authorization check. The method further includes, responsive to determining that the requestor is a secure requestor, performing the authorization check.

Abstract: An example computer-implemented method includes presenting, by a hardware control of a computing system, an exception to an untrusted entity when the untrusted entity accesses a secure page stored in a memory of the computing system, the exception preventing the untrusted entity from accessing the secure page. The method further includes, in response to the exception, issuing, by the untrusted entity, an export call routine. The method further includes executing, by a secure interface control of the computing system, the export call routine.

Abstract: According to one or more embodiments of the present invention, a computer implemented method includes initiating, by a non-secure entity that is executing on a host server, a secure entity, the non-secure entity prohibited from directly accessing any data of the secure entity. The method further includes injecting, into the secure entity, an interrupt that is generated by the host server. The injecting includes adding, by the non-secure entity, information about the interrupt into a portion of non-secure storage, which is then associated with the secure entity. The injecting further includes injecting, by a secure interface control of the host server, the interrupt into the secure entity.

Abstract: A method is provided. The method is implemented by a secure interface control of a computer that prevents unauthorized accesses to locations in a memory of the computer. The secure interface control determines that a host absolute page is not previously mapped to a virtual page in accordance with securing the host absolute page and a host virtual page is not already mapped to an absolute page in accordance with securing the host absolute page.

Abstract: A method is provided. A secure interface control in communication with an untrusted entity perform the method. In this regard, the secure interface control implements an initialization instruction to set donated storage as secure. The implementing of the initialization instruction is responsive to an instruction call issued from the untrusted entity.

Abstract: According to one or more embodiments of the present invention, a computer implemented method includes receiving a query for an amount of storage in memory of a computer system to be donated to a secure interface control of the computer system. The secure interface control can determine the amount of storage to be donated based on a plurality of secure entities supported by the secure interface control as a plurality of predetermined values. The secure interface control can return a response to the query indicative of the amount of storage as a response to the query. A donation of storage to secure for use by the secure interface control can be received based on the response to the query.

Abstract: According to one or more embodiments of the present invention, a computer implemented method includes enabling, by a secure interface control of a computer system, a non-secure entity of the computer system to access a page of memory shared between the non-secure entity and a secure domain of the computer system based on the page being marked as non-secure with a secure storage protection indicator of the page being clear. The secure interface control can verify that the secure storage protection indicator of the page is clear prior to allowing the non-secure entity to access the page. The secure interface control can provide a secure entity of the secure domain with access to the page absent a check of the secure storage protection indicator of the page.

Abstract: According to one or more embodiments of the present invention, a computer implemented method includes receiving a request from a requestor, to access a page of memory. The requestor is either a secure entity of a computer system or a secure interface control of the computer system. The request is tagged as a secure request from a secure domain of the computer system. It is verified that the request is making an access to a page that is both registered as secure and registered as belonging to the secure domain. The requestor is provided access to the page based at least in part on the page being registered as secure and as belonging to the secure domain. The requestor is prevented from accessing the page, based on one or both of the page not being registered as secure, and the page not being registered as belonging to the secure domain.

Abstract: Management of storage used by pageable guests of a computing environment is facilitated. A query instruction is provided that details information regarding the storage location indicated in the query. It specifies whether the storage location, if protected, is protected by host-level protection or guest-level protection.

Abstract: Increasing the scope of local purges of structures associated with address translation. A hardware thread of a physical core of a machine configuration issues a purge request. A determination is made as to whether the purge request is a local request. Based on the purge request being a local request, entries of a structure associated with address translation are purged on at least multiple hardware threads of a set of hardware threads of the the machine configuration.

Abstract: Increasing the scope of local purges of structures associated with address translation. A hardware thread of a physical core of a machine configuration issues a purge request. A determination is made as to whether the purge request is a local request. Based on the purge request being a local request, entries of a structure associated with address translation are purged on at least multiple hardware threads of a set of hardware threads of the the machine configuration.

Abstract: In a processor supporting execution of a plurality of functions of an instruction, an instruction blocking value is set for blocking one or more of the plurality of functions, such that an attempt to execute one of the blocked functions, will result in a program exception and the instruction will not execute, however the same instruction will be able to execute any of the functions that are not blocked functions.

Abstract: A marking capability is used to provide an indication of whether a block of memory is being used by a guest control program to back an address translation structure. The marking capability includes setting an indicator in one or more locations associated with the block of memory. In a further aspect, the marking capability includes an invalidation facility based on the setting of the indicators.

Abstract: Management of storage used by pageable guests of a computing environment is facilitated. A query instruction is provided that details information regarding the storage location indicated in the query. It specifies whether the storage location, if protected, is protected by host-level protection or guest-level protection.

Abstract: Selective purging of entries of structures associated with address translation. A request to purge entries of a structure associated with address translation is obtained. Based on obtaining the request, a determination is made as to whether selective purging of the structure associated with address translation is to be performed. Based on determining that selective purging is to be performed, one or more entries of the structure associated with address translation are purged. The selectively purging includes clearing the one or more entries of the structure associated with address translation for a host of the computing environment and leaving one or more entries of one or more guest operating systems in the structure associated with address translation. The one or more guest operating systems are managed by the host.

Abstract: Increasing the scope of local purges of structures associated with address translation. A hardware thread of a physical core of a machine configuration issues a purge request. A determination is made as to whether the purge request is a local request. Based on the purge request being a local request, entries of a structure associated with address translation are purged on at least multiple hardware threads of a set of hardware threads of the the machine configuration.

Abstract: Management of storage used by pageable guests of a computing environment is facilitated. A query instruction is provided that details information regarding the storage location indicated in the query. It specifies whether the storage location, if protected, is protected by host-level protection or guest-level protection.

Abstract: Increasing the scope of local purges of structures associated with address translation. A hardware thread of a physical core of a machine configuration issues a purge request. A determination is made as to whether the purge request is a local request. Based on the purge request being a local request, entries of a structure associated with address translation are purged on at least multiple hardware threads of a set of hardware threads of the the machine configuration.

Abstract: A marking capability is used to provide an indication of whether a block of memory is being used by a guest control program to back an address translation structure. The marking capability includes setting an indicator in one or more locations associated with the block of memory. In a further aspect, the marking capability includes an invalidation facility based on the setting of the indicators.