Secure graphics processing unit (GPU) virtualization using sandboxing

A non-transitory computer readable storage medium having stored thereon instructions executable by a host system, the instructions embodying a method comprising:

• receiving, by a hypervisor of the host system, one or more first graphics or compute commands issued by a guest application running within a virtual machine (VM) of the host system;
• communicating, by the hypervisor, the one or more first graphics or compute commands to a sandboxed software process that is separate from the hypervisor;
• translating, by the sandboxed software process, the one or more first graphics or compute commands into one or more second graphics or compute commands;
• and
• issuing, by the sandboxed software process, one or more second graphics or compute commands for execution on a physical graphics processing unit (GPU).

A host system comprising:

• a hypervisor;
• and
• a non-transitory computer readable medium having stored thereon instructions that, when executed by the hypervisor, causes the hypervisor to:
• receive one or more first graphics or compute commands issued by a guest application running within a virtual machine (VM) of the host system;
• and
• communicate the one or more first graphics or compute commands to a sandboxed software process that is separate from the hypervisor,
• wherein upon receiving the one or more first graphics or compute commands, the sandboxed software process translates the one or more first graphics or compute commands into one or more second graphics or compute commands and issues the one or more second graphics or compute commands for execution on a physical graphics processing unit (GPU).