VM Memory Migration via Copy-and-Reencrypt Instruction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional encrypted virtualization systems lack support for live migration of virtual machines, resulting in degraded performance and increased downtime due to the inability to access memory pages during the migration process.
Innovation Solution
The implementation of a copy-and-encrypt command as a new processor instruction that decrypts and re-encrypts VM memory pages in place, allowing for efficient migration by creating a copy of the memory page for transmission while keeping the original encrypted page accessible, thereby reducing downtime and improving migration efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional decryption and re-encryption methods are used during VM migration, then memory pages can be transferred to destination host, but source VM cannot access its memory pages during migration causing degraded performance and increased downtime
Solution Approach 1:
The migration process is segmented into multiple phases: identifying memory pages for migration, creating encrypted copies of selected pages, transferring copies to destination host, and updating page tables. This segmentation allows source VM to continue accessing original pages while migration progresses, eliminating downtime.
Solution Approach 2:
Memory pages are identified and prepared for migration in advance before actual transfer begins. The system pre-identifies candidate pages, allocates destination buffers, and sets up encryption contexts beforehand, so that when migration starts, the source VM can continue operating without interruption.
Solution Approach 3:
Instead of moving original memory pages, the system creates encrypted copies of selected pages and transfers these copies to the destination host. The source VM continues accessing original pages while destination VM can access copies, eliminating the access conflict that causes downtime in conventional approaches.
2Productivity
If all memory pages are decrypted and re-encrypted during migration, then complete VM state can be transferred, but system performance degrades due to increased processing overhead
Solution Approach 1:
The system performs partial migration by selecting and migrating only specific memory pages that are identified as candidates for migration, rather than migrating all pages. This selective approach reduces processing overhead while still achieving effective VM migration over time through iterative page transfers.
Solution Approach 2:
Migration occurs in periodic batches rather than all at once. The system iteratively identifies candidate pages, migrates them in groups, and repeats the process until migration is complete. This periodic approach distributes processing overhead over time, preventing performance degradation during any single migration phase.
Data Source
AI summary
Systems and methods for copy and decrypt support for encrypted virtual machines are disclosed. An example method may include receiving, at a source host machine hosting a virtual machine (VM), a request to migrate the VM to a destination host machine, identifying a first page of memory of the VM on the source host machine for migration, write-protecting the first page, the first page of memory encrypted with a VM-specific encryption key, allocating a second page, executing a copy-and-reencrypt command using the first page and the second page as parameters for the copy-and-reencrypt command, the copy-and-reencrypt command to output the second page comprising contents of the first page re-encrypted with a migration key, and transmitting contents of the second page to the destination host machine.