Arm CCA

About

• Arm Confidential Compute Architecture (CCA) provides hardware-backed confidential computing on Armv9-A
• Protects workload code and data from privileged software such as the host OS and Hypervisor
• Introduces isolated execution environments called Realms
• Built on RME and supports Attestation

Components

• Realm — isolated environment for confidential workloads
• RME — Realm Management Extension; hardware architecture enabling CCA isolation
• RMM — Realm Management Monitor; firmware that manages and isolates Realms
• RMI — Realm Management Interface; interface from the host/hypervisor to RMM
• RSI — Realm Service Interface; interface from a Realm to RMM

Architecture

                         +----------------+
                         |   Root World   |
                         |    Monitor     |
                         +-------+--------+
                                 |
          +----------------------+----------------------+
          |                                             |
+---------+----------+                         +---------+----------+
|   Normal World     |       RMI               |    Realm World     |
| Linux / Hypervisor | ----------------------> |       RMM          |
+--------------------+                         +---------+----------+
                                                      |
                                                     RSI
                                                      |
                                             +--------+--------+
                                             |      Realm      |
                                             |  Guest / App    |
                                             +-----------------+

                    RME provides hardware isolation

See also