Generic TrustZone Driver Proposed For Linux Kernel

ARM's security extensions are in the process of being bettered on Linux.

TrustZone is the marketing name for ARM's security extensions. TrustZone exposes two virtual processors with hardware access controls to let the application core switch between the two virtual states to avoid potentially leaking any information from one state/world to the other. TrustZone has been around going back to the ARMv6 days and there's been Linux support but it's largely been platform specific. Now, however, a generic TrustZone driver might finally come to the Linux kernel.

Javier GonzÃlez on Friday posted the patches for a generic TrustZone Linux driver. Javier explained, "Today, TrustZone solutions are implementation specific. In user space, mobile devices are normally compliant with Global Platform's API. However, there is no common TrustZone interface for kernel space, as it exists for Trusted Computing Module (TPM). As a result, different TrustZone frameworks use different kernel loadable modules to provide the context to communicate with the Trusted Execution Environment leveraged by TrustZone's secure world."

In terms of the TrustZone use cases, "TrustZone has traditionally been used for offloading secure tasks to the secure world. Examples include banking applications, Digital Rights Management (DRM), or specific secure solutions. As more and more frameworks enabling TrustZone appear, new use cases are starting to emerge: key management, encryption, integrity checking, etc. Extreme cases today involve running a RTOS in the secure world, or using the secure world toimplement usage control policies governing the normal world. The advent of ARMv8 will only expand this list."

This generic TrustZone driver is designed to be flexible as to not introduce any policy regarding the TrustZone interface but instead tries for a rather universal fit that other specialized TZ drivers can utilize and in turn communicate with specific frameworks. This new driver patch series also introduces a new drivers/sechw area for the Linux kernel as a new subsystem intended for secure hardware drivers.

More information via this patch series.