RISC-V pKVM - Protected KVM for Confidential Virtual Machines

Learn about RISC-V pKVM (Protected KVM) implementation in this 31-minute conference talk that explores how confidential virtual machines are enabled through RISC-V hypervisor extensions. Discover how the initialization process deprivileges Linux into a virtual machine while ensuring pKVM executes exclusively in hypervisor mode, creating secure isolation for untrusted system components. Examine the binary interfaces that cross architectural boundaries including userspace ABI, guest SBI, and hypervisor SBI, with particular focus on how hypervisor SBI functions as an internal kernel API for enhanced flexibility. Explore the code reuse potential between RISC-V KVM and other Protected KVM solutions, understand the design decisions behind the current implementation approach, and learn why Rust wasn't chosen for development. Gain insights into upcoming KVM-based solutions that will utilize future ISA extensions, providing a comprehensive overview of RISC-V virtualization security architecture and its evolution.