Granted Patent B2

US 12,399,732 · App. 17/644,598 · Granted Aug 26, 2025

Inventors: Louis P. Gomes (Poughkeepsie, NY); Richard John Moore (Waterlooville, GB); Klaus Paul Werner (Moetzingen, DE)

Assignee: International Business Machines Corporation

G06F9/45558G06F2009/45587

Abstract

Claims (91)

1. A method, comprising:

a machine hypervisor building and enqueuing a zeroize adjunct processor (AP) domain (ZAPD) common command request message to a target AP domain queue;

machine firmware validating the enqueued ZAPD common command request message on the target AP domain queue;

processor millicode converting the enqueued ZAPD common command request message to a format corresponding to a configured mode of an AP crypto adapter command request message;

executing the converted enqueued ZAPD common command request message at an AP crypto adapter of the target AP domain, wherein the crypto adapter is assigned to a virtual machine, and wherein the executing includes zeroizing a storage area of the AP crypto adapter by deleting secret keys assigned to the virtual machine from the AP crypto adapter; and

returning execution results to the machine hypervisor.

2. The method of claim 1 , wherein building and enqueuing the ZAPD command request message further comprises:

verifying a ZAPD command is installed for the target AP domain, and that a control domain and a usage domain are enabled for the target AP domain;

building, by the machine hypervisor, an abstracted common command request message wherein a format of the ZAPD common command request message is independent of a configuration mode of an AP crypto adapter;

setting an indicator in the ZAPD common command request message to bypass parsing of the ZAPD common command request message; and

setting an AP queue index to target AP domain, wherein the AP queue index corresponds to a domain number within the AP crypto adapter.

3. The method of claim 1 , wherein the validating further comprises:

based on having both control domain and usage domain access, storing the ZAPD common command request message on the AP crypto adapter of the target AP domain;

in response to a mismatch between the setting of the indicator in the ZAPD common command request message and the ZAPD common command request being ZAPD, generating a common command reply message, wherein a header of the common command reply message includes an error reply code; and

storing the ZAPD common command request message on the AP crypto adapter of the target AP domain.

4. The method of claim 1 , wherein the converting the enqueued ZAPD common command request message further comprises:

based on a configuration mode of the AP crypto adapter being accelerator mode, simulating the ZAPD common command request as a non-operation;

generating a common command reply message, wherein a normal completion reply code is stored in a header of the common command reply message; and

storing the common command reply message on the AP crypto adapter of the target AP domain.

5. The method of claim 4 , further comprising:

based on the configuration mode of the AP crypto adapter being other than accelerator mode, executing the ZAPD common command request message; and

firmware parsing the ZAPD common command request message and generating a resulting ZAPD command request message in a format corresponding to the configuration mode of the AP crypto adapter.

6. The method of claim 1 , wherein executing the command request message at an AP crypto adapter of the target AP domain further comprises:

validating, then executing, contents of the command request message;

in response to an error in the executing, the AP crypto adapter storing an error reply code in a connectivity programming request block of the command reply message;

based on the command request message being ZAPD, converting the command reply message to a common command reply message format corresponding to the configuration mode of the AP crypto adapter;

in response to a machine failure being returned for a ZAPD error, storing the machine failure in a header of the common command reply message; and dequeuing the command reply message from the AP crypto adapter of the target domain.

7. The method of claim 1 , wherein the configuration mode of an AP crypto adapter includes accelerator, Common Cryptographic Architecture (CCA, and Public-Key Cryptographic Standards (PKCS) #11 (XCP).

8. A computer program product, the computer program product comprising a non-transitory tangible storage device having program code embodied therewith, the program code executable by a processor of a computer to perform a method, the method comprising:

a machine hypervisor building and enqueuing a zeroize adjunct processor (AP) domain (ZAPD) common command request message to a target AP domain queue;

machine firmware validating the enqueued common command request message on the target AP domain queue;

machine firmware converting the enqueued common ZAPD command request message to a mode-specific form of the domain zeroize request;

executing the converted enqueued ZAPD command request message at an AP crypto adapter of the target AP domain, wherein the crypto adapter is assigned to a virtual machine, and wherein the executing includes zeroizing a storage area of the AP crypto adapter by deleting secret keys assigned to the virtual machine from the AP crypto adapter;

the AP crypto adapter returning execution results to the machine firmware;

machine firmware converting the AP crypto adapter ZAPD command reply message into the common ZAPD command reply message; and

returning final execution results including the converted common ZAPD command reply message to the machine hypervisor.

9. The computer program product of claim 8 , wherein building and enqueuing the ZAPD command request message further comprises:

verifying a ZAPD command is installed for the target AP domain, and that a control domain and a usage domain are enabled for the target AP domain;

building, by the machine hypervisor, an abstracted common command request message wherein a format of the ZAPD common command request message is independent of a configuration mode of an AP crypto adapter;

setting an indicator in the ZAPD common command request message to bypass parsing of the ZAPD common command request message; and

setting an AP queue index to target AP domain, wherein the AP queue index corresponds to a domain number within the AP crypto adapter.

10. The computer program product of claim 8 , wherein the validating further comprises:

based on having both control domain and usage domain access, storing the ZAPD common command request message on the AP crypto adapter of the target AP domain;

in response to a mismatch between the setting of the indicator in the ZAPD common command request message and the ZAPD common command request being ZAPD, generating a common command reply message, wherein a header of the common command reply message includes an error reply code; and

storing the ZAPD common command request message on the AP crypto adapter of the target AP domain.

11. The computer program product of claim 8 , wherein the converting the enqueued ZAPD common command request message further comprises:

based on a configuration mode of the AP crypto adapter being accelerator mode, simulating the ZAPD common command request as a non-operation;

generating the ZAPD common command reply message, wherein a normal completion reply code is stored in a header of the common command reply message; and

storing the common command reply message on the AP crypto adapter of the target AP domain.

12. The computer program product of claim 11 , further comprising:

based on the configuration mode of the AP crypto adapter being other than accelerator mode, executing the ZAPD common command request message;

firmware parsing the ZAPD common command request message and generating a resulting ZAPD command request message in a format corresponding to the configuration mode of the AP crypto adapter; and

firmware signing the ZAPD command request message using secret keys of the AP target domain.

13. The computer program product of claim 8 , wherein executing the command request message at an AP crypto adapter of the target AP domain further comprises:

validating, then executing, contents of the command request message;

in response to an error in the executing, the AP crypto adapter storing an error reply code in a connectivity programming request block of the command reply message;

based on the command request message being ZAPD, converting the command reply message to the ZAPD common command reply message format corresponding to a configuration mode of the AP crypto adapter;

in response to a machine failure being returned for a ZAPD error, storing the machine failure in in the a header of the common command reply message; and

dequeuing the command reply message from the AP crypto adapter of the target domain.

14. A computer system, comprising:

one or more processors;

a memory coupled to at least one of the processors;

a set of computer program instructions stored in the memory and executed by at least one of the processors in order to perform actions of:

a machine hypervisor building and enqueuing a zeroize adjunct processor (AP) domain (ZAPD) common command request message to a target AP domain queue;

machine firmware validating the enqueued ZAPD common command request message on the target AP domain queue;

processor millicode converting the enqueued ZAPD common command request message to a format corresponding to a configured mode of an AP crypto adapter command request message;

executing the converted enqueued ZAPD common command request message, including executing the converted enqueued ZAPD common request message at an AP crypto adapter of the target AP domain, wherein the crypto adapter is assigned to a virtual machine, and wherein the executing includes zeroizing a storage area of the AP crypto adapter by deleting secret keys assigned to the virtual machine from the AP crypto adapter; and

returning execution results to the machine hypervisor.

15. The computer system of claim 14 , wherein building and enqueuing the ZAPD command request message further comprises:

verifying a ZAPD command is installed for the target AP domain, and that a control domain and a usage domain are enabled for the target AP domain;

building, by the machine hypervisor, an abstracted ZAPD common command request message wherein a format of the ZAPD common command request message is independent of a configuration mode of an AP crypto adapter;

setting an indicator in the ZAPD common command request message to bypass parsing of the ZAPD common command request message; and

setting an AP queue index to target AP domain, wherein the AP queue index corresponds to a domain number within the AP crypto adapter.

16. The computer system of claim 14 , wherein the validating and further comprises:

based on having both control domain and usage domain access, storing the ZAPD common command request message on the AP crypto adapter of the target AP domain;

in response to a mismatch between the setting of the indicator and the ZAPD common command request being ZAPD, generating a common command reply message, wherein a header of the common command reply message includes an error reply code; and

storing the ZAPD common command request message on the AP crypto adapter of the target AP domain.

17. The computer system of claim 14 , wherein the converting the enqueued ZAPD common command request message further comprises:

based on the configuration mode of the AP crypto adapter being accelerator mode, simulating the ZAPD common command request as a non-operation;

generating a common command reply message, wherein a normal completion reply code is stored in a header of the common command reply message; and

storing the common command reply message on the AP crypto adapter of the target AP domain.

18. The computer system of claim 17 , further comprising:

based on the configuration mode of the AP crypto adapter being other than accelerator mode, executing the ZAPD common command request message; and

firmware parsing the ZAPD common command request message and generating a resulting ZAPD command request message in a format corresponding to the configuration mode of the AP crypto adapter.

19. The computer system of claim 14 , wherein executing the command request message at an AP crypto adapter of the target AP domain further comprises:

validating, then executing, contents of the command request message;

in response to an error in the executing, the AP crypto adapter storing an error reply code in a connectivity programming request block of the command reply message;

based on the command request message being ZAPD, converting the command reply message to the ZAPD common command reply message format corresponding to the configuration mode of the AP crypto adapter;

in response to a machine failure being returned for a ZAPD error, storing the machine failure in in the a header of the common command reply message; and

dequeuing the command reply message from the AP crypto adapter of the target domain.

20. The computer system of claim 14 , wherein the configuration mode of an AP crypto adapter includes accelerator, Common Cryptographic Architecture (CCA, and Public-Key Cryptographic Standards (PKCS) #11 (XCP).

Assignments (1)

Continuity (1)

References Cited (19)