Enabling New Security Frontiers: Deep-Dive Into Implementing Confidential Computing on RISC-V
summary
RISC‑V adds a proposal called Supervisor Domains plus modular ISA hooks: a scalable memory tracking table (smmt) that maps system physical addresses to per‑domain access and an smsi CSR set to lock interrupt files to domains. The recently ratified IMMU and AIA specs integrate with these hooks. A reference CoVE ABI split (CoveH/CoveG), an open‑source R‑based TSM called Salis and a QEMU smmt prototype exist now, and the pieces interoperate in early open implementations.
AI-written summary · about
chapters (15)
- 0:00Confidential computing on RISC-V
- 6:18What is confidential computing
- 10:54Threat model and requirements
- 14:00RISC-V ISA and security extensions
- 17:34CoVE confidential VM extension
- 21:44Supervisor memory isolation with MTT
- 28:26Supervisor identifiers and fences
- 31:19IOMMU and device isolation
- 33:27Secure interrupt architecture
- 35:31Interrupt isolation with SMSI
- 37:57TSM and guest OS interfaces
- 40:43Device isolation and attestation
- 42:29Hardware root of trust
- 43:54Mitigations for platform threats
- 45:45Summary and call to action
related talks
23mTowards Scalable Confidential Computing on RISC-V
21mScaling Data Analytics Via Confidential Computing on RISC-V
01h 05mConfidential Computing for RISC-V-based Platforms
31mConfidential Computing for RISC-V-based Platforms
18mIntroducing RISC-V Confidential Computing for IoT Devices
13mRISC-V: Securing the Future of Open Source Computing
10mUpdate on RISC-V Confidential VM Extension (CoVE)
19mAn Open Source Approach to System Security