Efficient migration for encrypted virtual machines by active page copying

1. A method comprising:

receiving, by a source host machine hosting a virtual machine (VM), a request to migrate the VM to a destination host machine;

identifying a first page of memory of the VM on the source host machine for migration, the first page of memory encrypted with a guest-specific encryption key;

preventing the VM from accessing the first page;

executing, by the source host machine, a send command to modify the first page from encrypted with the guest-specific encryption key to encrypted with a migration key while the first page remains in place in the memory of the source host machine;

allocating a second page in a buffer maintained in hypervisor memory of a hypervisor managing the VM;

copying contents of the first page to the second page;

executing, by the source host machine, a receive command to modify the first page from encrypted with the migration key to encrypted with the guest-specific encryption key while the first page remains in place in the memory of the source host machine and to restore the access by the VM to the first page;

restoring, subsequent to executing the receive command, access by the VM to the first page so that the first page is accessible by the VM at the source host machine during migration of the VM; and

transmitting contents of the second page to the destination host machine.

2. The method of claim 1 , wherein the first page is protected from access by the VM via an extended page table (EPT) maintained by the source host machine.

3. The method of claim 1 , wherein executing the send command further comprises:

decrypting the first page with the guest-specific encryption key; and

encrypting the decrypted first page with the migration key.

4. The method of claim 1 , wherein executing the receive command further comprises:

decrypting the first page with the migration key; and

encrypting the decrypted first page with the guest-specific encryption key.

5. The method of claim 1 , wherein the VM-specific encryption key is generated and maintained by an encryption engine of the source host machine.

6. The method of claim 5 , wherein the migration key comprises an encryption key generated using a cryptographic context that is established with the destination host machine, and wherein the migration key is different than the VM-specific encryption key.

7. The method of claim 1 , wherein the hypervisor executes a migration agent to perform a migration process to migrate the VM.

8. A non-transitory machine-readable storage medium storing instructions that cause a processing device to:

receive, by a source host machine hosting a virtual machine (VM), a request to migrate the VM to a destination host machine;

identify a first page of memory of the VM on the source host machine for migration, the first page of memory encrypted with a guest-specific encryption key;

prevent the VM from accessing the first page;

allocate a second page in a buffer maintained in hypervisor memory;

copying contents of the first page to the second page;

modify, by the source host machine, the first page from encrypted with the guest-specific encryption key to encrypted with a migration key while the first page remains in place in the memory of the source host machine;

subsequent to modifying the first page, transmit contents of the first page to the destination host machine;

subsequent to transmitting the contents of the first page, executing, by the source host machine, a swap command to switch the contents of the first page and contents of the second page; and

subsequent to execution of the swap command, restore the access by the VM to the first page so that the first page is accessible by the VM at the source host machine during migration of the VM.

9. The non-transitory machine-readable storage medium of claim 8 , wherein the first page is protected from access by the VM via an extended page table (EPT) maintained by the source host machine.

10. The non-transitory machine-readable storage medium of claim 8 , wherein the processing device to modify the first page further comprises the processing device to:

decrypt the first page with the guest-specific encryption key; and

encrypt the decrypted first page with the migration key.

11. The non-transitory machine-readable storage medium of claim 8 , wherein the VM-specific encryption key is generated and maintained by an encryption engine of the source host machine, and wherein the migration key comprises an encryption key generated using a cryptographic context that is established with the destination host machine, and wherein the migration key is different than the VM-specific encryption key.

12. A source host machine, comprising,

a memory to store virtual machine (VM) memory and hypervisor memory; and

a processing device operatively coupled to the memory, the processing device to:

receive a request to migrate the VM to a destination host machine;

identify a first page of memory of the VM in the VM memory for migration, the first page of memory encrypted with a guest-specific encryption key;

prevent the VM from accessing the first page;

modify the first page from encrypted with the guest-specific encryption key to encrypted with a migration key while the first page remains in place in the memory of the source host machine;

allocate a second page in a buffer maintained in the hypervisor memory of a hypervisor managing the VM;

copy contents of the first page to the second page;

subsequent to copying the contents, modify the first page from encrypted with the migration key to encrypted with the guest-specific encryption key while the first page remains in place in the memory of the source host machine;

subsequent to modifying the first page from encrypted with the migration key to encrypted with the guest-specific encryption key, restore the access by the VM to the first page so that the first page is accessible by the VM at the source host machine during migration of the VM; and

transmit contents of the second page to the destination host machine.

13. The source host machine of claim 12 , wherein the first page is protected from access by the VM via an extended page table (EPT) maintained by the source host machine.

14. The source host machine of claim 12 , wherein the processing device to modify the first page from encrypted with the guest-specific encryption key to encrypted with the migration key further comprises executing a send command.

15. The source host machine of claim 14 , wherein the send command to cause to the processing device to:

decrypt the first page with the guest-specific encryption key; and

encrypt the decrypted first page with the migration key.

16. The source host machine of claim 12 , wherein the processing device to modify the first page from encrypted with the migration key to encrypted with the guest-specific encryption key further comprises executing a receive command.

17. The source host machine of claim 16 , wherein the receive command to cause the processing device to:

decrypt the first page with the migration key; and

encrypt the decrypted first page with the guest-specific encryption key.

18. The non-transitory machine-readable storage medium of claim 8 , wherein the VM-specific encryption key is generated and maintained by an encryption engine of the source host machine.

19. The source host machine of claim 12 , wherein the VM-specific encryption key is generated and maintained by an encryption engine of the source host machine.