Processors, methods and systems to allow secure communications between protected container memory and input/output devices

A method comprising:

• determining that a set of access control checks succeed, including:
• determining that a device protected container module (DPCM) and an input and/or output (I/O) device are mapped to one another;
• determining that an access address associated with an attempted access by one of the DPCM and the I/O device resolves into a protected container memory;
• determining that the access address matches an allowed physical address retrieved from a protected control structure;
• and
• determining that a page of the protected container memory into which the access address resolves allows for one of direct memory access (DMA) and memory-mapped input/output (MMIO);
• and
• after said determining that the set of access control checks succeed, allowing the DPCM and the I/O device to communicate securely with one another through the page of the protected container memory.

A system comprising:

• a memory to store a device protected container module (DPCM);
• an input and/or output (I/O) device to interface with a privileged-level portion of the DPCM;
• and
• a processor coupled with the memory and the I/O device, the processor to perform instructions of a protected container, the protected container to interface with a user-level portion of the DPCM, the processor to perform a set of access control checks to determine whether to allow the DPCM and the I/O device to communicate securely through one of direct memory access (DMA) and memory-mapped input/output (MMIO) after (MMIO), wherein the processor is to determine to allow the DPCM and the I/O device to said communicate securely if the set of access control checks determine that it has been determined that at least:
• the DPCM and the I/O device are mapped to one another;
• an access address used to said communicate securely resolves into a protected container memory;
• and
• a page of the protected container memory into which the access address resolves allows for said one of DMA and MMIO.