AMD's TEE Driver For Loading "Trusted Applications" On Their Secure Processor Under Linux
The AMD Secure Processor / PSP is what's been built into their processors for a half-decade now for providing a secure hardware environment similar to Intel's Management Engine. This ARM-based secure processor is now seeing a Trusted Execution Environment driver for Linux.
The AMD-TEE driver is for volleying sensitive data / secure trusted applications. One of the motivating factors for this AMD APU TEE driver is for writing a trusted application providing Digital Rights Management for multimedia content protection. This goes along with what we've been seeing recently with the AMD graphics driver adding HDCP support and these security / rights management bits seemingly being done for the likes of AMD-powered Google Chromebooks.
It wouldn't be surprising if this TEE-based DRM is also being pursued for the Chromebooks use-case... There isn't much of an AMD APU desktop use-case otherwise for TEE/DRM and likely explains why this driver is only coming now while the AMD Secure Processor has been in hardware for years.
Their TEE driver amounts to just over one thousand lines of new code, building upon the kernel's existing TEE subsystem that to date has been mostly led by the ARM stakeholders. The driver allows for loading trusted application binaries into the trusted environment, starting/closing sessions, mapping shared memory, and related operations.
For those not fond of these trusted/secure features, once this code makes it into the mainline kernel can be disabled with the AMDTEE Kconfig switch.
9 Comments
