Secure drivers for confidential virtual machines
AssigneeRed Hat, Inc.
InventorMichael Tsirkin
Life of this patent
Estimating the term…
Abstract
Secure drivers for confidential virtual machines. A communication channel is established by a first device driver executing in a memory of a virtual machine manager (VMM) with a second device driver executing in a private memory of a user space memory of a confidential virtual machine that was initiated by the VMM. The private memory is inaccessible by the VMM. The first device driver provides the data over the communication channel to the second device driver within the user space memory. The second device driver receives the data. The second device driver modifies the private memory to include the data or prevents the data from being written to the private memory based on a criterion.
Claims20
A method comprising:
- establishing, by a first device driver executing in a memory of a virtual machine manager (VMM), a first communication channel with a second device driver executing in a private memory of a user space memory of a confidential virtual machine that was initiated by the VMM, wherein the private memory is inaccessible by the VMM;
- providing, by the first device driver, data over the first communication channel to the second device driver within the user space memory;
- receiving, by the second device driver, the data;
- and
- modifying the private memory to include the data or preventing the data from being written to the private memory, by the second device driver, based on a criterion.
A method of comprising:
- establishing, by a first device driver executing in a memory of an intermediate virtual machine, a first communication channel with a second device driver executing in a private memory of a user space memory of a confidential virtual machine that was initiated by the intermediate virtual machine, wherein the private memory is inaccessible by the intermediate virtual machine;
- providing, by the first device driver, data over the first communication channel to the second device driver within the user space memory;
- receiving, by the second device driver, the data;
- and modifying the private memory to include the data or preventing the data from being written to the private memory, by the second device driver, based on a first criterion.
A computing device, comprising:
- a memory;
- and
- a processor device coupled to the memory to:
- establish, by a first device driver executing in a memory of a virtual machine manager (VMM), a first communication channel with a second device driver executing in a private memory of a user space memory of a confidential virtual machine that was initiated by the VMM, wherein the private memory is inaccessible by the VMM;
- provide, by the first device driver, data over the first communication channel to the second device driver within the user space memory;
- receive, by the second device driver, the data;
- and
- modify the private memory to include the data or preventing the data from being written to the private memory, by the second device driver, based on a criterion.
Dependencies are inferred from the claim text.