cid d2d56d986e2b88394e8d6c857b7d3f464c4d714710c2197db2cc483089c30f6c · original · open access · via openalex
Title: Optimizing Launch Latency for Confidential VMs with Device Passthrough in the Linux KVM Hypervisor Authors: H. C. Wei; Shih-Wei Li Venue: Workshop on System Software for Trusted Execution (SysTEX) Year: 2026 Canonical: doi:10.1145/3805690.3805730 URL: https://doi.org/10.1145/3805690.3805730 Collector: openalex OA: true ABSTRACT Confidential Virtual Machines (CVMs) provide a secure execution environment for sensitive cloud workloads. However, when hosted on commodity Linux KVM hypervisors, their use of high-performance passthrough devices via the VFIO driver introduces significant latency at launch because Virtual Function I/O (VFIO) must allocate and map the entire CVM memory to the I/O Memory Management Unit (IOMMU). In this work, we analyze the start-up overhead of CVMs with device passthrough on a predominant KVM-based CVM implementation with AMD SEV-SNP. We propose an optimization, Targeted VFIO Mapping, which leverages the insight that mapping only the bounce buffers to the IOMMU—rather than the entire guest memory—is sufficient to support functional and secure device passthrough, while greatly reducing start-up latency. Our evaluation demonstrates that Targeted VFIO Mapping significantly streamlines initialization, yielding up to a 55% reduction in start-up time of Linux-based CVMs on KVM.