Technologies for trusted I/O with a channel identifier filter and processor-based cryptographic engine

A method comprising:

• receiving an unprivileged processor instruction with programming information, which is to have been generated by one or more unprivileged software components of a trusted execution environment, as a parameter, the programming information including a direct memory access (DMA) channel identifier and a channel key;
• generating wrapped programming information based on the programming information in response to the unprivileged processor instruction, wherein the channel key is to be encrypted using a key-wrapping key to generate an encrypted channel key, wherein the wrapped programming information includes the encrypted channel key and the DMA channel identifier, wherein a trusted input/output (I/O) processor reserved memory region has a plurality of ranges including a first range characterized by a first base and a first size mapped to the DMA channel identifier and a second range characterized by a second base and a second size mapped to another DMA channel identifier, and wherein the processor reserved memory region is inaccessible to the one or more unprivileged software components;
• and
• performing operations corresponding to a second instruction indicating the wrapped programming information, including decrypting the encrypted channel key to generate the channel key, programing the channel key to a cryptographic unit of a processor core that received the unprivileged processor instruction, and programing the DMA channel identifier into a channel filter.

At least one computer-readable medium having stored thereon instructions which, when executed, cause a computing device to perform operations including to:

• generate programming information by one or more unprivileged software components of a trusted execution environment;
• invoke an unprivileged processor instruction with the programming information as a parameter, the programming information including a direct memory access (DMA) channel identifier and a channel key;
• generate wrapped programming information based on the programming information in response to the unprivileged processor instruction, wherein the channel key is to be encrypted using a key-wrapping key to generate an encrypted channel key, wherein the wrapped programming information includes the encrypted channel key and the DMA channel identifier, wherein a trusted input/output (I/O) processor reserved memory region has a plurality of ranges including a first range characterized by a first base and a first size mapped to the DMA channel identifier and a second range characterized by a second base and a second size mapped to another DMA channel identifier, and wherein the processor reserved memory region is inaccessible to the one or more unprivileged software components;
• and
• perform operations corresponding to a second instruction that is to indicate the wrapped programming information, including to decrypt the encrypted channel key to generate the channel key, program the channel key to a cryptographic unit of a processor core that is to generate the wrapped programming information, and program the DMA channel identifier to a channel filter.