English
Menu

Hardware Security: Advanced Topics and Trends

Which correctly describes the realm introduced in Arm CCA (Confidential Compute Architecture)?

  1. ABesides the Normal world and the Secure world, a world called the realm is provided for running virtual machines, so that a hypervisor can allocate resources to it but cannot touch its contents
  2. BIt is merely the Secure world of TrustZone renamed, in which small tasks such as fingerprint matching and payment on smartphones are performed by an OS provided by the device maker
  3. CPrograms in a realm receive no hardware protection and are protected only by the guest OS encrypting its own memory contents in software
Show answer and explanation

Answer: A. Besides the Normal world and the Secure world, a world called the realm is provided for running virtual machines, so that a hypervisor can allocate resources to it but cannot touch its contents

The Secure world of TrustZone is meant for a small trusted OS provided by the device maker and was not suited to users running their own virtual machines. CCA adds, besides the Normal and Secure worlds, a Realm world and a Root world that manages switching between worlds. Because the CPU checks in a table (the granule protection table) which world each region of memory belongs to, a hypervisor running in the Normal world can allocate memory and CPU time to a realm's virtual machine but cannot read or write its contents. Like AMD SEV-SNP and Intel TDX, it is a mechanism for realizing a VM-based TEE, here on the Arm architecture.

  • A. Correct. The right to manage resources is separated from the right to touch the contents.
  • B. A realm is a world separate from the Secure world, intended for running users' virtual machines.
  • C. Realm memory is protected in hardware by the CPU checking accesses per world.
Practice this topic Back to topic

Books on Hardware Security: Advanced Topics and Trends Ad

As an Amazon Associate I earn from qualifying purchases.

More Hardware Security: Advanced Topics and Trends questions

  1. Which correctly describes the capabilities used in the instruction-set extension called CHERI?
  2. In Arm MTE (Memory Tagging Extension), a 4-bit tag is attached to every 16 bytes of memory and a 4-bit tag is also placed in the upper bits of the pointer, and the CPU checks on every access whether the two match. Consider the error of accessing a freed region through an old pointer to it. If the new tag given when the region is reallocated is chosen uniformly at random from the 16 possibilities, what is the probability that the tags match by chance and the error is missed?
  3. Which correctly describes the mechanism of Arm pointer authentication (PAC)?
  4. Which correctly describes the hardware shadow stack adopted in Intel CET (Control-flow Enforcement Technology) and elsewhere?
  5. Regarding hardware features that support control-flow integrity, which correctly pairs what protects returns from functions with what protects indirect calls and jumps such as those through function pointers?