CCX: Enabling Unmodified Intel SGX Applications on Arm CCA

Technical Summary: CCX – Enabling Unmodified Intel SGX Applications on Arm CCA

Problem Statement
Confidential computing has evolved to include technologies like Intel TDX, AMD SEV, and Arm Confidential Compute Architecture (CCA), which protect entire virtual machines (cVMs). However, these cVM solutions operate at a coarse granularity, resulting in a larger Trusted Computing Base (TCB) and lacking support for fine-grained intra-process isolation. Consequently, Intel Software Guard Extensions (SGX) remains the preferred choice for many cloud applications (e.g., confidential services, secure payments, privacy-preserving advertising) due to its minimal trust boundaries and precise execution model.

A significant portability challenge arises as Arm CPUs gain traction in cloud environments. Existing SGX applications are tightly coupled to SGX-specific APIs, execution semantics, and microcode instructions, making them incompatible with Arm architectures. While previous efforts have ported SGX to AMD platforms via virtualization, these approaches rely on shared x86-64 architecture and cannot provide hardware-enforced security guarantees equivalent to SGX. Furthermore, existing Arm enclave frameworks (e.g., SHELTER, NanoZone, HiveTEE) offer intra-process isolation but require developers to adopt new, immature programming models and SDKs, necessitating costly source code modifications and undermining the value of the existing SGX ecosystem.

Methodology
The authors present CCX, a framework designed to enable the transparent migration of existing SGX applications to Arm CCA systems without source code modifications. CCX achieves this by reimplementing the SGX instruction interface within the Arm CCA firmware (specifically at Exception Level 3, EL3) and adapting the SGX software stack (SDK, kernel module, and compiler) to the Arm architecture.

Key design principles and implementation details include:

• EL3 Implementation (CCX-Core): Unlike prior work that places enclave logic in hypervisors or the Realm Management Monitor (RMM), CCX implements the core SGX microcode emulation at EL3. This leverages the EL3 firmware's privileged position to enforce isolation while minimizing the TCB to the Monitor alone, as the RMM is considered untrusted.
• Instruction Trapping: To intercept SGX instructions without source code changes, CCX utilizes specific hardware mechanisms:
  • ENCLS calls: Intercepted via the SMC (Secure Monitor Call) instruction from the OS.
  • ENCLU calls: Intercepted from user space (EL0) by repurposing the Performance Monitoring Unit (PMU) register access. The authors configure the system to trap EL0 access to specific PMU registers to EL3, using this as a gadget to trigger the CCX handler.
  • CPUID calls: Emulated directly within the EL3 handler.
• Memory Management (Multi-GPT): CCX adapts SGX's Enclave Page Cache (EPC) to Arm's Granule Protection Table (GPT). Instead of a fixed EPC region, CCX dynamically maps pages into the Realm world. To prevent cross-enclave attacks, CCX employs a multi-GPT approach where each enclave is assigned a dedicated GPT. Pages are marked as accessible only in the enclave's specific GPT and inaccessible in the system-wide GPT used by the RMM. This eliminates the need for expensive page swapping (EWB/ELDB) required by SGX when the EPC is full.
• Toolchain Adaptation: The authors ported the Intel SGX SDK, kernel module, and compiler to Arm. This involved modifying approximately 6,000 lines of SDK code and 650 lines of kernel code to replace x86-specific assembly and context management with Arm equivalents, while preserving API compatibility.
• Attestation: CCX implements local attestation fully. Remote attestation is currently limited due to the lack of CCA hardware and a corresponding provisioning ecosystem, but the authors provide a theoretical framework for implementing it using CCA's Platform Attestation Key (CPAK) once hardware becomes available.

Key Contributions

1. Framework Design and Implementation: The design and implementation of CCX, which allows existing SGX applications to run on Arm CCA without source code changes.
2. Software Stack Porting: The successful adaptation of the SGX software stack (SDK, kernel module, compiler) to Arm CCA, demonstrating extensibility and practicality.
3. Prototypes and Evaluation: The construction of two prototypes (QEMU emulator and Nitrogen8M development board) and a comprehensive evaluation using diverse open-source SGX applications (e.g., cryptographic libraries, databases, federated learning).

Results

• Functionality: The authors successfully executed a diverse set of open-source SGX applications (including SampleEnclave, TaLoS, SGX SQLite, and TrustFL) on Arm systems without any source code modifications. The applications exhibited behavior identical to their execution on native SGX hardware.
• Performance:
  • Microbenchmarks: CCX demonstrated near-native performance for most enclave operations. The overhead for enclave entry and exit (EENTER/EEXIT) was approximately 17.5 µs.
  • Macrobenchmarks: Using the NBench suite, CCX achieved near-native performance on Arm hardware. In most cases, CCX outperformed or matched the performance of native SGX on Intel hardware. Notable exceptions included BITFIELD and FOURIER tests, where performance was lower due to less-optimized mathematical functions in the SGX SDK's trusted standard library.
  • Comparison: Compared to related work, CCX incurred approximately 1% overhead (excluding unoptimized library cases), which is significantly lower than VSGX (>200%) and competitive with other Arm enclave designs (e.g., SHELTER 5.2–15%, NanoZone 20%).
• TCB Analysis: CCX added approximately 4,462 lines of code (SLOC) to the EL3 Monitor. Relative to the total TF-A implementation, this represents a TCB increase of less than 1%. This is the smallest TCB increase among comparable SGX reimplementations.

Significance and Claims
The paper claims that CCX effectively brings the security and maturity of SGX's intra-process isolation to Arm-based cloud environments. By preserving the SGX execution model and API, CCX eliminates the engineering cost and ecosystem fragmentation associated with porting applications to new enclave frameworks.

The authors emphasize that CCX provides security guarantees comparable to Intel SGX by relying on a minimal TCB (the EL3 Monitor) and leveraging hardware-enforced memory isolation via the GPT. While the paper acknowledges limitations—such as the current lack of public CCA hardware for full validation and the theoretical nature of some security analyses regarding side-channels—it asserts that the firmware-based design offers greater flexibility for future updates and vulnerability mitigation compared to hardware-microcode-based solutions. The work is open-sourced to foster further research and development in confidential computing on Arm architectures.