  Trusted execution environments in several existing and upcoming CPUs
demonstrate the success of confidential computing, with the caveat that tenants
cannot securely use accelerators such as GPUs and FPGAs. In this paper, we
reconsider the Arm Confidential Computing Architecture (CCA) design, an
upcoming TEE feature in Armv9-A, to address this gap. We observe that CCA
offers the right abstraction and mechanisms to allow confidential VMs to use
accelerators as a first-class abstraction. We build ACAI, a CCA-based solution,
with a principled approach of extending CCA security invariants to device-side
access to address several critical security gaps. Our experimental results on
GPU and FPGA demonstrate the feasibility of ACAI while maintaining security
guarantees.
