# US 11,907,377 B2 · Supporting self-modifying graphics workloads in fully virtualized graphics architectures > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,907,377 B2 - Document ID: US11907377B2 - Status: Granted - Kind: B2 - Application number: 17/251,307 - Filed: 2018-10-30 - Published: 2021-08-19 - Granted: 2024-02-20 - Earliest claimed: 2018-10-30 - Assignees: Intel Corporation - Applicants: Intel Corporation - Inventors: Weinan Li; Yan Zhao; Zhi Wang - Web page: https://patentgrep.com/patent/US11907377B2 ## CPC - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 9/30087: {Synchronisation or serialisation instructions} - G06F 21/84: output devices, e.g. displays or monitors - G06T 1/20: Processor architectures; Processor configuration, e.g. pipelining - G06T 1/60: Memory management - G06F 2009/45579: {I/O management, e.g. providing access to device drivers or storage} - G06F 2009/45583: {Memory management, e.g. access or allocation} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06T: IMAGE DATA PROCESSING OR GENERATION, IN GENERAL ## Abstract Systems, apparatuses and methods may provide for technology that sets a write protection flag in a guest command buffer associated with a virtual machine and injects a semaphore command into a shadow command buffer in response to a fault. The fault is to correspond to a write of a graphics command to the guest command buffer by code executing in graphics hardware. In one example, the technology also conducts a security scan of the graphics command in response to a context switch in the graphics hardware, wherein the context switch is to be associated with the semaphore command. ## Claims ### Claim 1 A computing system comprising: graphics hardware; a guest command buffer to be associated with a virtual machine; and a processor including a shadow command buffer and logic to: set a write protection flag in the guest command buffer, inject a semaphore command into the shadow command buffer in response to a fault, wherein the fault is to correspond to a write of a graphics command to the guest command buffer by code executing in the graphics hardware, conduct a security scan of the graphics command in response to a context switch in the graphics hardware, wherein the context switch is to be associated with the semaphore command, and overwrite the semaphore command with the graphics command if the security scan does not detect a security risk in the graphics command. ### Claim 2 (depends on 1) The computing system of claim 1, wherein the semaphore command is injected into a command area of the shadow command buffer if the fault occurred with respect to a command area in the guest command buffer, and wherein the semaphore command is injected into a command area adjacent to a data area of the shadow command buffer if the fault occurred with respect to a data area in the guest command buffer. ### Claim 3 (depends on 2) The computing system of claim 2, wherein the logic is to determine, based on a command boundary bitmap, whether the fault occurred with respect to the command area in the guest command buffer or the data area in the guest command buffer. ### Claim 4 (depends on 1) The computing system of claim 1, wherein the code executing in the graphics hardware is to be self-modifying code. ### Claim 5 (depends on 1) The computing system of claim 1, wherein the code executing in the graphics hardware is to be privileged code. ### Claim 6 A semiconductor apparatus comprising: one or more substrates; and logic coupled to the one or more substrates, wherein the logic is implemented at least partly in one or more of configurable logic or fixed-functionality hardware logic, the logic coupled to the one or more substrates to: set a write protection flag in a guest command buffer associated with a virtual machine, inject a semaphore command into a shadow command buffer in response to a fault, wherein the fault is to correspond to a write of a graphics command to the guest command buffer by code executing in graphics hardware, conduct a security scan of the graphics command in response to a context switch in the graphics hardware, wherein the context switch is to be associated with the semaphore command, and overwrite the semaphore command with the graphics command if the security scan does not detect a security risk in the graphics command. ### Claim 7 (depends on 6) The semiconductor apparatus of claim 6, wherein the semaphore command is injected into a command area of the shadow command buffer if the fault occurred with respect to a command area in the guest command buffer, and wherein the semaphore command is injected into a command area adjacent to a data area of the shadow command buffer if the fault occurred with respect to a data area in the guest command buffer. ### Claim 8 (depends on 7) The semiconductor apparatus of claim 7, wherein the logic coupled to the one or more substrates is to determine, based on a command boundary bitmap, whether the fault occurred with respect to the command area in the guest command buffer or the data area in the guest command buffer. ### Claim 9 (depends on 6) The semiconductor apparatus of claim 6, wherein the code executing in the graphics hardware is to be one or more of self-modifying code or privileged code. ### Claim 10 (depends on 6) The semiconductor apparatus of claim 6, wherein the logic coupled to the one or more substrates includes transistor channel regions that are positioned within the one or more substrates. ### Claim 11 At least one non-transitory computer readable storage medium comprising a set of executable program instructions, which when executed by a computing system, cause the computing system to: set a write protection flag in a guest command buffer associated with a virtual machine; inject a semaphore command into a shadow command buffer in response to a fault, wherein the fault is to correspond to a write of a graphics command to the guest command buffer by code executing in graphics hardware; conduct a security scan of the graphics command in response to a context switch in the graphics hardware, wherein the context switch is to be associated with the semaphore command; and overwrite the semaphore command with the graphics command if the security scan does not detect a security risk in the graphics command. ### Claim 12 (depends on 11) The at least one non-transitory computer readable storage medium of claim 11, wherein the semaphore command is injected into a command area of the shadow command buffer if the fault occurred with respect to a command area in the guest command buffer, and wherein the semaphore command is injected into a command area adjacent to a data area of the shadow command buffer if the fault occurred with respect to a data area in the guest command buffer. ### Claim 13 (depends on 12) The at least one non-transitory computer readable storage medium of claim 12, wherein the executable program instructions, when executed, cause the computing system to determine, based on a command boundary bitmap, whether the fault occurred with respect to the command area in the guest command buffer or the data area in the guest command buffer. ### Claim 14 (depends on 11) The at least one non-transitory computer readable storage medium of claim 11, wherein the code executing in the graphics hardware is to be self-modifying code. ### Claim 15 (depends on 11) The at least one non-transitory computer readable storage medium of claim 11, wherein the code executing in the graphics hardware is to be privileged code. ### Claim 16 A method comprising: setting a write protection flag in a guest command buffer associated with a virtual machine; injecting a semaphore command into a shadow command buffer in response to a fault, wherein the fault corresponds to a write of a graphics command to the guest command buffer by code executing in graphics hardware; conducting a security scan of the graphics command in response a context switch in the graphics hardware, wherein the context switch is associated with the semaphore command; and overwriting the semaphore command with the graphics command if the security scan does not detect a security risk in the graphics command. ### Claim 17 (depends on 16) The method of claim 16, wherein the semaphore command is injected into a command area of the shadow command buffer if the fault occurred with respect to a command area in the guest command buffer, and wherein the semaphore command is injected into a command area adjacent to a data area of the shadow command buffer if the fault occurred with respect to a data area in the guest command buffer. ### Claim 18 (depends on 17) The method of claim 17, further including determining, based on a command boundary bitmap, whether the fault occurred with respect to the command area in the guest command buffer or the data area in the guest command buffer. ### Claim 19 (depends on 16) The method of claim 16, wherein the code executing in the graphics hardware is self-modifying code. ### Claim 20 (depends on 16) The method of claim 16, wherein the code executing in the graphics hardware is privileged code.