Protected KVM on Arm64: pKVM Architecture and Guest Memory Protection

Used as a primary source for pKVM architecture in threads on Android virtualization and isolated VMs.

Quentin Perret of Google gives a technical deep dive into protected KVM (pKVM) on Arm64, a confidential computing approach for CPUs without hardware extensions. It explains how the nVHE hypervisor manages stage-2 MMU access control to protect guest memory.