Technologies for filtering memory access transactions received from one or more i/o devices

An apparatus comprising:

• one or more processors having filter circuitry to:
• receive a first key identifier from the processor, wherein the first key identifier is indicative of a shared memory range includes a shared key identifier range to be used for untrusted input/output (I/O) devices;
• receive a transaction from the I/O device, wherein the transaction includes a second key identifier and a trust device ID indicator associated with the I/O device;
• determine whether the transaction is asserted with the trust device ID indicator indicative of whether the I/O device is assigned to a trust domain;
• and
• perform a secure I/O with the trust domain.

A method comprising:

• receiving, by one or more processors of a compute device, a first key identifier from a processor of the compute device, wherein the first key identifier indicative of a shared memory range includes a shared key identifier range to be used for untrusted input/output (I/O) devices;
• receiving, by the one or more processors, a transaction from an input/output (I/O) device, wherein the transaction includes a second key identifier and a trust device ID indicator associated with the I/O device;
• determining, by the one or more processors, whether the transaction is asserted with the trust device ID indicator indicative of whether the I/O device is assigned to a trust domain;
• and
• performing a secure I/O with the trust domain.

A computer-readable medium having stored thereon instructions which, when executed, cause a computing device to perform operations comprising:

• receiving, by one or more processors of a compute device, a first key identifier from a processor of the compute device, wherein the first key identifier indicative of a shared memory range includes a shared key identifier range to be used for untrusted input/output (I/O) devices;
• receiving, by the one or more processors, a transaction from an input/output (I/O) device, wherein the transaction includes a second key identifier and a trust device ID indicator associated with the I/O device;
• determining, by the one or more processors, whether the transaction is asserted with the trust device ID indicator indicative of whether the I/O device is assigned to a trust domain;
• and
• performing a secure I/O with the trust domain.