BATTLE OF SKM AND IUM

HOW DOES IT ALL WORK?
• Hypervisor now associates a Virtual Trust Level (VTL) with each Virtual Processor (VP)
• Two VTLs defined today (higher is more privileged) – more are supported by the architecture
• VTL 0, which is the Normal World
• VTL 1, which is the Secure World
• Hypervisor uses Enhanced Page Tables (EPT) which now have essentially a “VTL” associated with them
• VTL 0 access to VTL 1 pages can be controlled
• Blocking +R -> allows hiding cryptographic secrets (Credential Guard)
• Blocking +RX (or +RWX) -> allows preventing execution of code, or modification of code (Device Guard)
• Blocking +W -> allows preventing modification of executable pages shared with VTL 1