OpenCCA: An Open Framework to Enable Arm CCA Research

2025-06-05

AI Summary

CCA research on Arm platforms has long been hindered by the lack of accessible, standardized hardware, resulting in redundant prototyping efforts, inconsistent performance evaluation, and high entry barriers. This paper introduces OpenCCA—the first open-source CCA research platform designed for commodity Armv8.2 hardware (e.g., a $250 Rockchip development board). Its core innovation lies in software-based simulation of essential CCA components—including Realm Management, the Realm Management Monitor (RMM), and Secure Partition communication—while providing unified integration across bootloader, SPM firmware, KVM hypervisor, and Linux kernel to eliminate stack fragmentation. OpenCCA fully implements the CCA lifecycle and enables reproducible validation and fair performance comparison across multiple state-of-the-art works. It achieves both functional correctness and evaluation consistency on low-cost hardware.

Technology Category

• Machine Learning: Hardware-aware ML
• Computer Vision: Adversarial Attacks & Robustness
• Cognitive Modeling & Cognitive Systems: (Computational) Cognitive Architectures

Application Category

• Security and Privacy: Large-scale security measurements
• Systems and Infrastructure for Web, Mobile and WoT: Energy management for devices in mobile Web and WoT environments
• Responsible Web: Measurement, analysis, and circumvention of Web censorship

Abstract

Confidential computing has gained traction across major architectures with Intel TDX, AMD SEV-SNP, and Arm CCA. Unlike TDX and SEV-SNP, a key challenge in researching Arm CCA is the absence of hardware support, forcing researchers to develop ad-hoc performance prototypes on non-CCA Arm boards. This approach leads to duplicated efforts, inconsistent performance comparisons, and high barriers to entry. To address this, we present OpenCCA, an open research platform that enables the execution of CCA-bound code on commodity Armv8.2 hardware. By systematically adapting the software stack -- including bootloader, firmware, hypervisor, and kernel -- OpenCCA emulates CCA operations for performance evaluation while preserving functional correctness. We demonstrate its effectiveness with typical life-cycle measurements and case-studies inspired by prior CCA-based papers on a easily available Armv8.2 Rockchip board that costs $250.

Problem

• Lack of hardware support for Arm CCA research
• Inconsistent performance comparisons due to ad-hoc prototypes
• High barriers to entry for Arm CCA experimentation

Innovation

• OpenCCA enables CCA research on commodity Armv8.2 hardware
• Adapts bootloader, firmware, hypervisor, and kernel for emulation
• Provides consistent performance evaluation with functional correctness