Designing and Implementing Live Migration Support for Arm-based Confidential VMs

Confidential virtual machines (CVMs) are increasingly deployed to protect users' code and data in use against attackers with hypervisor privileges. Given Arm's growing adoption, various implementations have extended commodity hypervisors like KVM to support CVMs on Arm. However, none of these implementations supports live migration, a crucial virtualization feature. This work presents the first design of live migration support for Arm-based CVMs. The design utilizes functionality for migrating regular VMs from commodity hypervisors to simplify development efforts while preserving CVMs' safety. We extended two KVM-based CVM implementations for Arm to prototype the design to support existing live migration approaches from QEMU, including pre-copy, post-copy, and parallel migration.