ZION: A Practical Confidential Virtual Machine Architecture on Commodity RISC-V Processors

A b stra ct-Trusted E xecu tion E nvironm ents (T E E s) p rovide robust h ardw are-based iso la tio n to m itigate d ata b reaches and privacy risk s. C onfid en tial V irtu al M achines (con fid en tial V M s o r CVM s) extend th ese ca p a b ilities b y u sin g V M s a s th e ir ex ecu tion ab straction , o fferin g su p erior com p atib ility over p rocess-based TEEs lik e In tel SG X . T he risin g dem and for C onfid en tial VM s h as spurred in novation s from m ajor ch ip m anu factu rers, such as AM D SEV, In tel TD X , an d A rm C C A , an d th e ir in teg ra tio n in to lea d in g d o u d p latform s, in du ctin g AW S, A zu re, and G oogle C loud. O n th e R ISC -V p latform , how ever, ex istin g TEE arehitectu res rely on p ro cess-level ab straction s o r cu stom hardw are, lea d in g to lim ited com p atib ility and scalab ility. T h is p ap er p resen ts Zion, a con fid en tial V M architecture fo r com m odity R ISC -V hardw are th a t o p erates w ith ou t cu s tom exten sion s. Zion en su res secu rity, flexib ility, an d efficien cy through a sh ort-p ath C V M m ode an d a secu re vC P U m echanism fo r p rotectin g an d efficien tly u p d atin g vC PU sta te s, en h ancing co n text-sw itch in g p erform ance. I t com b ines P h ysical M em ory P rotection (PM P) w ith p agin g fo r scalab le m em ory iso la tio n , em p loys a h ierarch ical m em ory stru ctu re fo r efficien t m anage m en t, and in trod u ces a sp lit-p age-tab le-b ased m echanism for secu re m em ory sh arin g w ith v ir tió d evices. E valu ation s show Zion ach ieves u n d er 5% overhead in real-w orld ap p lica tio n s, d em onstratin g its p racticality.