Back to results
US 11,599,621 B2Granted
Apparatuses, methods, and systems for verification of input-output memory management unit to device attachment
AssigneeIntel Corporation
InventorsVedvyas Shanbhogue, Rajesh Sankaran, Abhishek Basak, Pradeep Pappachan, Utkarsh Y. Kakaiya, Ravi Sahita, Rupin Vakharwala
Life of this patent
Estimating the term…
Abstract
Systems, methods, and apparatuses relating to performing an attachment of an input-output memory management unit (IOMMU) to a device, and a verification of the attachment. In one embodiment, a protocol and IOMMU extensions are used by a secure arbitration mode (SEAM) module and/or circuitry to determine if the IOMMU that is attached to the device requested to be mapped to a trusted domain.
Claims24
An apparatus comprising:
- a first input-output memory management circuit to couple a first device to memory;
- a second input-output memory management circuit to couple a second device to the memory;
- and
- a processor to:
- execute a virtual machine monitor that is not in a trusted computing base for one or more virtual machines to be managed by the virtual machine monitor, and
- execute secure arbitration mode firmware, separate from the virtual machine monitor, to cause a first unique identification value to be assigned for the first input-output memory management circuit, a second unique identification value to be assigned for the second input-output memory management circuit, send the first unique identification value to the first device during a secure assignment of the first device to a first trusted domain of the memory, and send the second unique identification value to the second device during a secure assignment of the second device to a second trusted domain of the memory.
3 more elements
A method comprising:
- coupling a first device to memory with a first input-output memory management circuit;
- coupling a second device to the memory with a second input-output memory management circuit;
- assigning a first unique identification value for the first input-output memory management circuit by a processor in a secure arbitration mode separate from a virtual machine monitor, of the processor, that is removed from a trusted computing base for one or more virtual machines managed by the virtual machine monitor;
- assigning a second unique identification value for the second input-output memory management circuit by the processor in the secure arbitration mode separate from the virtual machine monitor, of the processor, that is removed from the trusted computing base for the one or more virtual machines managed by the virtual machine monitor;
- sending the first unique identification value to the first device during a secure assignment of the first device to a first trusted domain of the memory by the processor in the secure arbitration mode;
- and
- sending the second unique identification value to the second device during a secure assignment of the second device to a second trusted domain of the memory by the processor in the secure arbitration mode.
4 more elements
A non-transitory machine readable medium that stores code that when executed by a machine causes the machine to perform a method comprising:
- coupling a first device to memory with a first input-output memory management circuit;
- coupling a second device to the memory with a second input-output memory management circuit;
- assigning a first unique identification value for the first input-output memory management circuit by a processor in a secure arbitration mode separate from a virtual machine monitor, of the processor, that is removed from a trusted computing base for one or more virtual machines managed by the virtual machine monitor;
- assigning a second unique identification value for the second input-output memory management circuit by the processor in the secure arbitration mode separate from the virtual machine monitor, of the processor, that is removed from the trusted computing base for the one or more virtual machines managed by the virtual machine monitor;
- sending the first unique identification value to the first device during a secure assignment of the first device to a first trusted domain of the memory by the processor in the secure arbitration mode;
- and
- sending the second unique identification value to the second device during a secure assignment of the second device to a second trusted domain of the memory by the processor in the secure arbitration mode.
4 more elements
Dependencies are inferred from the claim text.