Home / ubuntu / Questions / 736778
Accepted
Pilot6
Asked: 2016-02-20 11:43:50 +0800 CST

What is ValleyView encryption controller?

  • 772

I see this in lspci

00:1a.0 Encryption controller: Intel Corporation ValleyView SEC (rev 0e)
    Subsystem: ASUSTeK Computer Inc. Device 15bd
    Kernel driver in use: mei_txe

It has a dedicated kernel module.

What is this device and how is it used in linux?

Here is modinfo that may give some clue.

pilot6@X200MA:~$ modinfo mei_txe
filename:       /lib/modules/4.2.0-27-generic/kernel/drivers/misc/mei/mei-txe.ko
license:        GPL v2
description:    Intel(R) Trusted Execution Environment Interface
author:         Intel Corporation
srcversion:     7984C0CD09F1D84152FAB4E
alias:          pci:v00008086d00002298sv*sd*bc*sc*i*
alias:          pci:v00008086d00000F18sv*sd*bc*sc*i*
depends:        mei
intree:         Y
vermagic:       4.2.0-27-generic SMP mod_unload modversions
kernel

1 Answers

  1. Best Answer

    As comments above mentioned, ValleyView is tablet sub-family of Bay Trail family SoC. Among other functionality, it has on-board hardware implementation of TEE (Trusted Execution Environment).

    Since TEE is rather industry-wide catch-all term, not a standard at least, most of this implementations are OEM-specific. Main use cases are DRM, mobile finance, authentication, enterprise/government.

    The presence of TEE on system had been not caused by Linux, rather by other concerns of industry. Linux only adopted to its presence and made it accessible and usable.

    As any security feature with hardening options, it has benefits and risks. Industrial lobby is concentrated on benefits, from higher security here and there, and down to pragmatical "small gifts" e.g. your fingerprint image in finger scanner can not be easily changed or read. Security research community more often points to risks, from unpleasant potential of getting rootkit which would be extremely difficult to get rid off, to ransomware and limit is only imagination.

    In case of this device/hardware/software combination, you may enjoy reading piece of kernel documentation along driver mei_txe. It clearly states functionality provided by Intel and has contact from intel at bottom. They state three main applications with detailed description and reference in that article :

    1. Intel Local Management Service (Intel LMS)
    2. Intel AMT Remote configuration using a Local Agent
    3. Intel AMT OS Health Watchdog

    In theory, you can blacklist this device as it most probably does not carry on much of value while constitutes certain risks. However, they clearly state in driver documentation:

    The feature set depends on the Intel chipset SKU.

    So your particular case is hardware-specific

    • 2