I was going to guess they were using the improved support for things like shadow pagetables to help with live migration - but I'm not sure why they couldn't jus

I was going to guess they were using the improved support for things like shadow pagetables to help with live migration - but I'm not sure why they couldn't just do that with the existing user/kernel divide, as you say. Another possibility that occurs to me is that you might use the VT-d device-side stuff to provide some restricted directed access to containers (as you can for full VMs). I'm struggling to think of a device where that would be a significant improvement on what was already available, though...