Copy and decrypt support for encrypted virtual machines
Systems and methods for copy and decrypt support for encrypted virtual machines are disclosed. An example method may include receiving, at a source host machine hosting a virtual machine (VM), a request to migrate the VM to a destination host machine, identifying a first page of memory of the VM on the source host machine for migration, write-protecting the first page, the first page of memory encrypted with a VM-specific encryption key, allocating a second page, executing a copy-and-reencrypt command using the first page and the second page as parameters for the copy-and-reencrypt command, the copy-and-reencrypt command to output the second page comprising contents of the first page re-encrypted with a migration key, and transmitting contents of the second page to the destination host machine.
1. A method comprising:
receiving, by a processing device at a source host machine hosting a virtual machine (VM), a request to migrate the VM to a destination host machine;
identifying a first page of memory of the VM on the source host machine for migration, the first page of memory encrypted with a VM-specific encryption key, wherein the VM-specific encryption key is generated and maintained by an encryption engine of the source host machine;
write-protecting the first page;
allocating a second page;
executing a copy-and-reencrypt command using the first page and the second page as parameters for the copy-and-reencrypt command, the copy-and-reencrypt command to output the second page comprising contents of the first page re-encrypted with a migration key while the first page of memory remains in place encrypted with the VM-specific encryption key, wherein the migration key is different than the VM-specific encryption key and comprises an encryption key generated using a cryptographic context that is established with the destination host machine, and wherein the copy-and-reencrypt command to cause the processing device to:
decrypt contents of the first page using the VM-specific encryption key;
encrypt the decrypted contents of the first page with the migration key; and
write the contents of the re-encrypted first page to the second page; and
transmitting contents of the second page to the destination host machine.
2. The method of claim 1 , wherein the first page is write-protected in an extended page table (EPT) maintained by the source host machine.
3. The method of claim 1 , wherein the VM is an encrypted VM.
4. The method of claim 1 , wherein the copy-and-reencrypt command comprises an instruction executable by an encryption engine comprising firmware installed on the source host machine.
5. The method of claim 1 , wherein the copy-and-reencrypt command comprises an instruction executable by the processing device, the copy-and-reencrypt command part of an instruction set of the processing device.
6. The method of claim 1 , wherein the receiving, identifying, write-protecting, allocating, executing, and transmitting are performed by a migration agent of a hypervisor of the source host machine.
7. The method of claim 1 , wherein the migration key is maintained in a hardware location of the source host machine.
8. The method of claim 1 , wherein the migration key is supplied as an additional parameter to the copy-and-encrypt command.
9. A source host machine, comprising,
a memory; and
a processing device operatively coupled to the memory, the processing device to:
receive a request to migrate an encrypted VM hosted by the source host machine to a destination host machine;
identify a first page of memory of the encrypted VM on the source host machine for migration, the first page of memory encrypted with a VM-specific encryption key, wherein the VM-specific encryption key is generated and maintained by an encryption engine of the source host machine;
write-protect the first page;
allocate a second page;
execute a copy-and-reencrypt command using the first page and the second page as parameters for the copy-and-reencrypt command, the copy-and-reencrypt command to output the second page comprising contents of the first page re-encrypted with a migration key while the first page of memory remains in place encrypted with the VM-specific encryption key, wherein the migration key is different than the VM-specific encryption key and comprises an encryption key generated using a cryptographic context that is established with the destination host machine, and wherein the copy-and-reencrypt command to cause the processing device to:
decrypt contents of the first page using the VM-specific encryption key;
encrypt the decrypted contents of the first page with the migration key; and
write the contents of the re-encrypted first page to the second page; and
transmit contents of the second page to the destination host machine.
10. The source host machine of claim 9 , wherein the first page is write-protected in an extended page table (EPT) maintained by the source host machine.
11. The source host machine of claim 9 , wherein the copy-and-reencrypt command comprises an instruction executable by an encryption engine comprising firmware installed on the source host machine.
12. The source host machine of claim 9 , wherein the copy-and-reencrypt command comprises an instruction executable by the processing device, the copy-and-reencrypt command part of an instruction set of the processing device.
13. The source host machine of claim 9 , wherein the receiving, identifying, write-protecting, allocating, executing, and transmitting are performed by a migration agent of a hypervisor of the source host machine.
14. The source host machine of claim 9 , wherein the migration key is maintained in a hardware location of the source host machine.
15. The source host machine of claim 9 , wherein the migration key is maintained in a hardware location of the source host machine.
16. A non-transitory machine-readable storage medium storing instructions that cause a processing device to:
receive, by the processing device of a source host machine hosting a virtual machine (VM), a request to migrate the VM to a destination host machine;
identify a first page of memory of the VM on the source host machine for migration, the first page of memory encrypted with a VM-specific encryption key, wherein the VM-specific encryption key is generated and maintained by an encryption engine of the source host machine;
write-protect the first page;
allocate a second page;
execute a copy-and-reencrypt command using the first page and the second page as parameters for the copy-and-reencrypt command, the copy-and-reencrypt command to output the second page comprising contents of the first page re-encrypted with a migration key while the first page of memory remains in place encrypted with the VM-specific encryption key, wherein the migration key is different than the VM-specific encryption key and comprises an encryption key generated using a cryptographic context that is established with the destination host machine, and wherein the copy-and-reencrypt command to cause the processing device to:
decrypt contents of the first page using the VM-specific encryption key;
encrypt the decrypted contents of the first page with the migration key; and
write the contents of the re-encrypted first page to the second page; and
transmitting contents of the second page to the destination host machine.
17. The non-transitory machine-readable storage medium of claim 16 , wherein the copy-and-reencrypt command comprises an instruction executable by an encryption engine comprising firmware installed on a computing device comprising the processing device.
18. The non-transitory machine-readable storage medium of claim 16 , wherein the copy-and-reencrypt command comprises an instruction executable by the processing device, the copy-and-reencrypt command part of an instruction set of the processing device.
19. The non-transitory machine-readable storage medium of claim 16 , wherein the receiving, identifying, write-protecting, allocating, executing, and transmitting are performed by a migration agent of a hypervisor of the source host machine.
20. The non-transitory machine-readable storage medium of claim 16 , wherein the first page is write-protected in an extended page table (EPT) maintained by the source host machine.