Arm Publishes Initial Confidential Compute Architecture "CCA" Code For Linux VMs

Arm ended out January by publishing an early request for comments (RFC) version of its Confidential Compute Architecture (CCA) support for the Linux kernel so there can be KVM virtualization integration around Arm CCA, a KVM user-space ABI for managing Realms, and Linux guest support for Arm Realms.

The RFC patch series sums up the Confidential Compute Architecture as:

The Arm CCA is a reference software architecture and implementation that builds on the Realm Management Extension (RME), enabling the execution of Virtual machines, while preventing access by more privileged software, such as hypervisor. The Arm CCA allows the hypervisor to control the VM, but removes the right for access to the code, register state or data that is used by VM.

The Arm CCA product page meanwhile characterizes it as:

Our vision for the Arm Confidential Compute Architecture (CCA) is to protect all data and code wherever computing happens – unlocking the power and potential of data and AI. Arm CCA is part of a series of hardware and software architecture innovations that enhances Arm support for confidential computing. Arm CCA is a key component of the Armv9-A architecture achieving our goal of delivering the benefits of confidential computing to every industry sector.

The CCA is basically Arm's play in the confidential computing game. Intel meanwhile has Software Guard Extensions (SGX) and Trust Domain Extensions (TDX) while AMD has Secure Encrypted Virtualization (SEV / SEV-ES / SEV-SNP).

Those wishing to learn more about Arm's early work on enabling the Confidential Compute Architecture within the Linux kernel and focused on Kernel-based Virtual Machine (KVM) usage, see the kernel patch series for this early stage effort.