RFC keeps KVM guests running across host kexec live updates

Pasha Tatashin has posted an early RFC proof of concept that lets KVM guests keep running through a host kernel live update instead of freezing for the full kexec window.

The work targets a long-standing pain point for live update: when the outgoing kernel and userspace VMM tear down and the incoming stack boots and re-attaches, preserved VMs are briefly orphaned. Today that usually means parked vCPUs. OrphanVM instead keeps selected guests executing on physical CPUs that survive the handover, under a slim on-core runtime Tatashin calls the KVM Caretaker.

Caretaker only activates when a live-update session has preserved both the vCPU and its backing physical CPU. Otherwise it falls back to ordinary RAM-only vCPU preservation. The stack spans CPU isolation from hotplug teardown, an on-core scheduler for those cores, guest memory and MMU handoff, and architecture hooks so exits that must be handled during the blackout (timers, basic MSRs, limited I/O) can be serviced without a full host. Optional telemetry records exit and stall stats across the kexec so the incoming kernel can inspect what happened while it was offline.

The series is deliberately not a merge candidate. Tatashin frames it as an end-to-end demo for the LPC’26 KVM Microconf, split into separate workstreams on preparation, CPU preservation, on-core execution, Caretaker core, and x86/arm64 backends. It builds on existing live-update and guest_memfd preservation work and has been exercised on Intel Granite Rapids, AMD EPYC Turin, and Arm Neoverse V2, plus QEMU and Simics, but he calls it very early WIP and nowhere near production ready.

If the approach lands, host kernel updates could stop imposing multi-second guest stalls on carefully prepared VMs, which matters for latency-sensitive and always-on virtualization fleets. The immediate goal is design review of the layering and the hard problems still open before full Caretaker support could live in mainline.