Patent ID: 8181176

Claim:
A computing system including a processor package comprising: an operating system; a physical I/O device; a memory partitioned into a first portion for use by the operating system, a second portion for sharing data between the operating system and a partial virtual machine, and a third portion for use by the partial virtual machine, wherein the third portion is hidden from the operating system; and the partial virtual machine to instantiate a virtual I/O device corresponding to the physical I/O device, the virtual I/O device having a virtual I/O controller, comprising: an I/O port trap component to capture an I/O request to the virtual I/O device from the operating system; an I/O controller emulator component coupled to the I/O port trap component to handle an I/O control request to the virtual I/O controller, when the I/O request comprises an I/O control request; an I/O device emulator component coupled to the I/O port trap component to handle an I/O access request to communicate with the virtual I/O device, when the I/O request comprises an I/O access request; and a device driver component coupled to the I/O controller emulator component and the I/O device emulator component to communicate with the physical I/O device based at least in part on the I/O control request and the I/O access request; wherein the partial virtual machine executes within a secure enclave session within the processor package, preventing access to the partial virtual machine by the operating system.