TDX Live Migration
summary
Implements live migration for Intel TDX by adding a microTD helper that establishes a secure migration key and uses TD module sim calls to export/import encrypted private guest pages; KVM/QEMU keep shared pages on the normal path. First release has no zero-page optimization and no PML; emulated tests on an E5/DDR4 setup (10 Gbit link) add ~200–400 cycles per page and roughly +10 s to migration time versus non-TDX, with default 300 ms downtime. Enabling multi-IO threads (4) recovers much of the throughput; max migratable dirty rate is lower than legacy.
AI-written summary · about
chapters (8)
- 0:00Introduction to TDX
- 0:50TDX architectural basics
- 5:04Deep dive into migration
- 10:39TDX migration workflow
- 15:32Data transport mechanisms
- 17:46Confidential guest framework
- 20:05Performance results
- 26:03Status and future plans
related talks
20mIntel Virtualization Technology Extensions to Enable Hardware Isolated VMs
27mIntel Trusted Domain Extensions (TDX) Host Kernel Support
23mAllowing an Intel TDX Module to Run Without SEAM
31mIntel Trust Domain Extensions
25mExploring I/O Support for Virtualization-Based Trusted Execution Environment
41mIntroducing IO Devices into Trusted Execution Environments
22mSupporting TEE on x86 Client Platforms with pKVM
26mVirtual TPM based attestation for Intel Trust Domain Extensions