Memory encryption for virtual machines by hypervisor-controlled firmware

A system, comprising:

• a memory;
• a processing device operatively coupled to the memory, the processing device configured to:
• initialize, by a firmware module associated with a virtual machine running on a host computer system, an exclusion range register associated with the virtual machine with a value specifying a first portion of guest memory, wherein the first portion of the guest memory comprises an exclusion range marked as reserved;
• encrypt, by the firmware using an ephemeral encryption key, a second portion of the guest memory;
• boot, by a hypervisor of the host computer system, the virtual machine;
• and
• responsive to intercepting, by the hypervisor, a privileged instruction executed by the virtual machine, perform at least one of:
• copying data for performing the privileged instruction to the first portion of the guest memory or copying data for performing the privileged instruction from the first portion of the guest memory.

A non-transitory machine-readable storage medium storing instructions that cause a processing device to:

• initialize, by a firmware module associated with a virtual machine running on a host computer system, an exclusion range register associated with the virtual machine with a value specifying a first portion of guest memory, wherein the first portion of the guest memory comprises an exclusion range marked as reserved;
• encrypt, by the firmware using an ephemeral encryption key, a second portion of the guest memory;
• boot the virtual machine;
• and
• responsive to intercepting a privileged instruction executed by the virtual machine, perform at least one of:
• copy data for performing the privileged instruction to the first portion of the guest memory or copy data for performing the privileged instruction from the first portion of the guest memory.