Microsoft Technology Licensing, LLC

Alexander Daniel Grest

David Hepkin

Jin Lin

Michael Bishop Ebersol

Xin Zhang

Steve Pronovost

Jonathan E Lange

Bruce John Sherwin, Jr

Kevin Michael Broas

Jason Stewart Wohlgemuth

Aditya Bhandari

Wen Jia Liu

Kapil Vaswani

Attilio Mainetti

Steven Adrian West

Antoine Jean Denis Delignat-lavaud

Emily Cara Clemens

Dexuan Cui

Michael Halstead Kelley

Sarah Elizabeth Stephenson

Carolina Cecilia Perez-vargas

Stephanie Sumyi Luck

Isolating resources of a virtual machine (VM) guest from a host operating system. A computer system receives an acceptance request from a guest partition corresponding to an isolated VM. The acceptance request identifies a guest memory page that is mapped into a guest physical address space of the guest partition, and a memory page visibility class. The computer system determines whether a physical memory page that is mapped to the guest memory page meets the memory page visibility class. The computer system sets a page acceptance indication for the guest memory page from an unaccepted state to an accepted state based on the physical memory page meeting the memory page visibility class.

Software isolation of virtual machine resources

Methods, systems, and computer program products for direct assignment of physical devices to confidential virtual machines (VMs). At a first guest privilege context of a guest partition, a direct assignment of a physical device associated with a host computer system to the guest partition is identified. The guest partition includes the first guest privilege context and a second guest privilege context, which is restricted from accessing memory associated with the first guest privilege context. The guest partition corresponds to a confidential VM, such that a memory region associated with the guest partition is inaccessible to a host operating system. It is determined, based on a policy, that the physical device is allowed to be directly assigned to the guest partition. Communication between the physical device and the second guest privilege context is permitted, such as by exposing the physical device on a virtual bus and/or forwarding an interrupt.

Direct assignment of physical devices to confidential virtual machines

Growing community of inventors

Redmond, WA, United States of America

Alexander Daniel Grest