Enabling communication between virtual machines and virtual devices by hypervisor-controlled firmware

A system, comprising:

• a memory;
• a processing device operatively coupled to the memory, the processing device configured to:
• initialize, by a firmware module associated with a virtual machine running on a host computer system, an exclusion range register associated with the virtual machine with a value specifying a first portion of a guest memory to be left unencrypted for guest-hypervisor communications between the virtual machine and a hypervisor, wherein the first portion of the guest memory comprises an exclusion range marked as reserved such that the hypervisor has access to the first portion of the guest memory, wherein a second portion of the guest memory is encrypted using an ephemeral encryption key such that the hypervisor does not have access to the second portion of the guest memory;
• identify, in the second portion of the guest memory, an instruction to a virtual device associated with the virtual machine;
• copy data, the data corresponding to the instruction, to the first portion of the guest memory;
• and
• alert the hypervisor of the data stored in the first portion of the guest memory.

A non-transitory machine-readable storage medium storing instructions that cause a processing device to:

• initialize, by a firmware module associated with a virtual machine running on a host computer system, an exclusion range register associated with the virtual machine with a value specifying a first portion of a guest memory to be left unencrypted for guest-hypervisor communications between the virtual machine and a hypervisor, wherein the first portion of the guest memory comprises an exclusion range marked as reserved such that the hypervisor has access to the first portion of the guest memory, wherein a second portion of the guest memory is encrypted using an ephemeral encryption key such that the hypervisor does not have access to the second portion of the guest memory;
• identify, in the second portion of the guest memory, an instruction to a virtual device associated with the virtual machine;
• copy data, the data corresponding to the instruction, to the first portion of the guest memory;
• and
• alert the hypervisor of the data stored in the first portion of the guest memory.