# US 2019/0173678 A1 · Systems and methods for providing i/o state protections in a virtualized environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0173678 A1 - Document ID: US20190173678A1 - Status: Published application - Kind: A1 - Application number: 16/264,888 - Filed: 2019-02-01 - Published: 2019-06-06 - Earliest claimed: 2017-02-27 - Assignees: Red Hat, Inc. - Applicants: Red Hat, Inc. - Inventors: Michael Tsirkin; Karen Noel - Web page: https://patentgrep.com/patent/US20190173678A1 ## CPC - H04L 9/3247: {involving digital signatures} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 21/602: {Providing cryptographic facilities or services} - G06F 21/72: in cryptographic circuits - H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD} - G06F 2009/45579: {I/O management, e.g. providing access to device drivers or storage} - G06F 2009/45587: {Isolation or security of virtual machine instances} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods, systems, and computer program products are included for providing I/O state protections to a virtualized environment. An example method includes configuring, by a hypervisor, a processor to execute instructions corresponding to a guest of a virtual machine (VM). As part of a transition of operations from the VM to the hypervisor, the guest specifies a first register of the processor. The processor then provides the hypervisor with access to non-encrypted data stored in first register, while data stored in non-specified registers is maintained in the processor in an encrypted format. The hypervisor receives the non-encrypted data from the first register. ## Claims ### Claim 1 A method comprising: configuring, by a hypervisor, a central processing unit (CPU) to execute instructions corresponding to a guest of a virtual machine (VM), wherein the CPU includes a plurality of registers; and detecting, by the hypervisor, a transition from the VM to the hypervisor, the transition including: specifying, by the guest, a first register of the plurality of registers, wherein a second register of the plurality of registers is not specified; providing, by the CPU, access to data stored in the plurality of registers, wherein data stored in the first register includes non-encrypted data, and wherein data stored in a remainder of the plurality of registers includes encrypted data; and receiving, by the hypervisor, the non-encrypted data. ### Claim 2 (depends on 1) The method of claim 1 further comprising: based on the specifying, encrypting data stored in the second register. ### Claim 3 (depends on 1) The method of claim 1 further comprising: modifying, by the hypervisor, the non-encrypted data; and transitioning from the hypervisor to the VM, the transitioning including: loading the modified non-encrypted data into the first register; and decrypting, by the CPU, the encrypted data stored in the second register. ### Claim 4 (depends on 1) The method of claim 1 further comprising: identifying the first register as storing data that corresponds to an input/output (I/O) operation of the VM. ### Claim 5 (depends on 1) The method of claim 1, further comprising: triggering, by a hypercall, the transition from the VM to the hypervisor; identifying the first register as a register that is affected by the hypercall; and responsive to the identifying, specifying the first register. ### Claim 6 (depends on 1) The method of claim 1, wherein the specifying of the first register includes specifying a set of registers, and wherein data stored in the specified set of registers is accessible to the hypervisor. ### Claim 7 (depends on 1) The method of claim 1, wherein the specifying of the first register includes verifying that a cryptographic signature or a hash corresponding to the first register matches an expected value. ### Claim 8 A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause at least one machine to perform operations comprising: configuring, by a hypervisor, a processor to execute instructions corresponding to a guest of a virtual machine (VM), wherein the processor includes a plurality of registers; and detecting, by the hypervisor, a transition from the VM to the hypervisor, the transition including: specifying, by the guest, one of the plurality of registers; providing, by the processor, access to data stored in the plurality of registers, wherein data stored in a first register of the plurality of registers includes non-encrypted data, and wherein data stored in each non-specified register of the plurality of registers includes encrypted data; and receiving, by the hypervisor, the non-encrypted data. ### Claim 9 (depends on 8) The non-transitory machine-readable medium of claim 8, the operations further comprising: based on the specifying, encrypting data stored in a second register. ### Claim 10 (depends on 8) The non-transitory machine-readable medium of claim 8, the operations further comprising: modifying, by the hypervisor, the non-encrypted data; and transitioning from the hypervisor to the VM, the transitioning including: loading the modified non-encrypted data into the first register; and decrypting, by the processor, the encrypted data stored in a second register. ### Claim 11 (depends on 8) The non-transitory machine-readable medium of claim 8, the operations further comprising: identifying the first register as storing data that corresponds to an input/output (I/O) operation of the VM. ### Claim 12 (depends on 8) The non-transitory machine-readable medium of claim 8, the operations further comprising: triggering, by a hypercall, the transition from the VM to the hypervisor; identifying the first register as a register that is affected by the hypercall; and responsive to the identifying, specifying the first register. ### Claim 13 (depends on 8) The non-transitory machine-readable medium of claim 8, wherein the specifying of the first register includes specifying a set of registers, and wherein data stored in the specified set of registers is accessible to the hypervisor. ### Claim 14 (depends on 8) The non-transitory machine-readable medium of claim 8, wherein the specifying of the first register includes verifying that a cryptographic signature or a hash corresponding to the first register matches an expected value. ### Claim 15 A system comprising: a processor coupled to at least one non-transitory memory, the processor including a plurality of registers; a hypervisor that configures the processor to execute instructions corresponding to a guest of a virtual machine (VM), the hypervisor to detect a transition from the VM to the hypervisor, the transition including: specifying, by the guest, a first register of the plurality of registers, wherein a remainder of the plurality of registers is not specified; providing, by the processor, the hypervisor with access to data stored in the plurality of registers, wherein data stored in the first register includes non-encrypted data, and wherein data stored in the remainder of the plurality of registers includes encrypted data; and loading, by the hypervisor, the non-encrypted data. ### Claim 16 (depends on 15) The system of claim 15, the transition further including: based on the specifying, encrypting data stored in a second register. ### Claim 17 (depends on 15) The system of claim 15, the hypervisor further to: modify the non-encrypted data; and trigger a transition from the hypervisor to the VM, the transition including: loading the modified non-encrypted data into the first register; and decrypting, by the processor, the encrypted data stored in a second register. ### Claim 18 (depends on 15) The system of claim 15, the guest of the virtual machine to perform operations comprising: triggering, by a hypercall, the transition from the VM to the hypervisor; identifying the first register as a register that is affected by the hypercall; and responsive to the identifying, specifying the first register. ### Claim 19 (depends on 15) The system of claim 15, wherein the specifying of the first register includes specifying a set of registers, and wherein data stored in the specified set of registers is accessible to the hypervisor. ### Claim 20 (depends on 15) The system of claim 15, wherein the specifying of the first register includes verifying that a cryptographic signature or a hash corresponding to the first register matches an expected value.