Security and support for trust domain operation

One or more non-transitory computer-readable storage mediums having stored thereon executable computer program instructions that, when executed by one or more processors, cause the one or more processors to perform operations including to:

• authenticate a boot time configuration to determine if a host system supports a trust domain;
• process workloads for guests of the host system, including transfer of one or more compute workloads to an accelerator;
• transition the trust domain to a secure state;
• downgrade register access privileges of a plurality of registers of the accelerator from being accessible by both the trust domain and a privilege level more privileged than an access by the trust domain to being accessible by the trust domain but not by the privilege level;
• and
• upon the trust domain transitioning to the secure state, process the workloads in accordance with the trust domain.

An apparatus comprising:

• one or more processors including a graphics processing unit (GPU), wherein the GPU supports one or more trust domains (TD);
• and
• a graphics security microcontroller including trusted firmware;
• wherein the GPU is to:
• process one or more compute workloads received from a host system;
• upon receiving a notification that a trust domain of the host system has transitioned to a secure state, transition an original set of register access privileges for the GPU to a downgraded set of register access privileges, wherein the original set of register access privileges allow a plurality of registers to be accessed by the trust domain and from a privilege level more privileged than an access by the trust domain, and wherein the downgraded set of register access privileges do not allow the plurality of registers to be accessed from the privilege level but allow the plurality of registers to be accessed by the trust domain;
• upon receiving a command from the host system for the trust domain, processing the command in accordance with the trust domain;
• and
• upon receiving a request from the host system to access a register:
• for a register included in an allowed list of registers for access, allow access to the register, and
• for a register that is not within the allowed list of registers for access, disallow access to the register.