New Patches: AMD Live Migration Support For VMs With Secure Encrypted Virtualization

Beyond the Linux kernel patches presented earlier this week for AMD SEV-ES "Encrypted State" support, another Linux patch series out overnight provides another improvement to Secure Encrypted Virtualization with AMD EPYC server processors.

The newest open-source SEV work to report on this week is live migration support when making use of AMD Secure Encrypted Virtualization. Currently VMs can't be live migrated when making use of this hardware-backed encryption support of virtual machines, but a new patch series enables QEMU/KVM live migration to now work in the presence of SEV.

A set of 12 patches adding more than one thousand lines of new kernel code put the necessary bits into place for handling live migration under SEV. The patches basically allow for passing an encryption context with the hypervisor as well as the commands for copying into a new SEV guest memory space. While the initial work is focused on the Kernel-based Virtual Machine (KVM), this SEV live migration could be extended to other hypervisors as well.

Longtime upstream Linux kernel developer Andy Lutomirski so far has commented on the code and raised some concerns over the increasing complexity of AMD SEV within the Linux kernel, "To be blunt: if I had noticed how the SEV code worked before it was merged, I would have NAKed it. It's too late now to retroactively remove it from the kernel, but perhaps we could try not to pile more complexity on top of the unfortunate foundation we have."

We'll see if this SEV code gets cleaned up in time for the Linux 5.7 cycle this spring.