Back to results
US 12,737,210 B2Granted
Secure management device control information in confidential computing environments
AssigneesAdvanced Micro Devices, Inc., ATI Technologies ULC
InventorsPhilip Ng, Nippon Raval, Jeremy W. Powell, Donald Matthews, Jr., David Kaplan
Life of this patent
Estimating the term…
Abstract
A processor includes a security processor and an input-output memory management unit (IOMMU). The security processor is configured to maintain device control information in a secure data structure and prevent a hypervisor from accessing the secure data structure. The IOMMU is configured to process at least one device request targeting a virtual machine from an input/output device based on the secure data structure.
Claims20
A method comprising:
- maintaining device control information in a secure data structure, wherein a hypervisor is prevented from accessing the secure data structure and the device control information controlling access of an input/output (I/O) device to a virtual machine (VM);
- and
- processing at least one device request targeting a VM from an I/O device based on the secure data structure.
A method comprising:
- responsive to assigning an input/output (I/O) device to a virtual machine (VM), updating an entry in a secure data structure maintaining device control information for the I/O device to include an indication that the I/O device has been assigned to the VM, wherein the secure data structure is not accessible to a hypervisor;
- and
- responsive to receiving a device request targeting a VM from the I/O device, processing the device request based on the secure data structure.
A processor comprising:
- a security processor configured to maintain device control information in a secure data structure, wherein a hypervisor is prevented from accessing the secure data structure, the device control information controlling access of an input/output (I/O) device to a virtual machine (VM);
- and
- an input-output memory management unit (IOMMU) configured to:
- process at least one device request targeting a VIM from an I/O device based on the secure data structure.
1 more element
Dependencies are inferred from the claim text.