Secure Live Migration of Encrypted VMs
summary
Implements a firmware migration handler that runs inside a mirror VM sharing the SEV encryption context so pages can be exported wrapped with a PSP transport key rather than relying on slow PSP wrap throughput. Uses OVMF plus QEMU patches (edk2 and qemu lists) and an identity map with the C bit set to read encrypted GPAs, and a trampoline that migrates VMSAs for SEV‑ES. Works end to end in prototype, SN P’s RMP adjust and integrity features simplify and harden the process.
AI-written summary · about
chapters (11)
- 0:00Intro
- 0:55Confidential Computing
- 1:46SEV Live Migration
- 3:44Memory Encryption
- 4:59Firmware Migration Support
- 6:43Migration Handler
- 9:16Is it safe?
- 12:11SEV-ES Live Migration
- 13:54Trampoline
- 16:17SEV-SNP Live Migration
- 19:10Open Questions
related talks
20mSupporting Live Migration of Confidential VMs in KVM
18mSecurely booting confidential VMs with encrypting disk
33mAMD Encrypted Virtualization Update
42mProtected Execution Facility
28mProviding Confidential Guest Services with a Secure VM Service Module on AMD
41mProtected Execution Facility
24mThe Common Challenges of Secure VMs
11mTrusted in-guest hypervisor services with secure VM service module