NACRE Makes a Group of Host-Managed Linux Processes the Hardware Protection Unit, at Under 3.5% Syscall Overhead

arXiv 2609.03849·medium signalXBlueskyLinkedInCopy link

arXiv 2609.03849 argues existing confidential computing protects either an enclave address space or a whole guest OS, while recent container-granularity systems still add a separate protection context, so none makes a dynamic group of host-managed Linux processes the architectural protection unit. This RISC-V hardware-software co-design separates the host's authority to manage resources from its authority to access or commit protected state, with hardware-recognized container identities directing protected traps to an isolated S-mode agent and an M-mode monitor committing identity, mapping and page transitions. Prototyped by extending QEMU, OpenSBI, Linux, a trusted agent and runc, three-run means across five lmbench syscall and pipe metrics stayed within 3.5% of the runc baseline.