Sounds like a good reason to ditch ARM, and roll out their own solution for it.

In regards to Mali, why can't ARM support open source driver effort? Qualcomm for example are not against Freedreno, to the point that Google wants to make it the primary supported driver now. And Qualcomm are quite nasty in general, when it comes to patents and stuff. So why not the same thing with Mali?

This doesn't sound right. The PSP is an ARM core, but the firmware running on it is likely mostly written by AMD. Also, license agreements can be negotiated.

AMD states that the PSP is "ARM TrustZone ... An Industry Standard Approach" right on their website: https://www.amd.com/en/technologies/security

Wrt renegotiating with ARM, there is no leverage for AMD. TrustZone is already baked into their chips for the next 2 to 3 years, and if the negotiations go badly then ARM could block AMD from selling any processors for at least a year.

AMD did hire a security consultant (due to the Change.org petition) that told them TrustZone was vulnerable, but this means they need to implement their own PSP which is something that will take 3 years or more (silicon has a very elongated development cycle).

Had AMD not been on death's doorstep for the years preceding the new Zen architecture, they likely would have built their own PSP. Being financially insolvent and desperate to meet the requirements of their OEM partners forced them to license a pre-built PSP.

ARM TrustZone is basically just a hypervisor-like execution level that runs above the actual hypervisor called the "secure world", along with ways of calling into it. There's already open-source implementations of the firmware for the secure world on ARM chips, including one from ARM themselves: https://github.com/ARM-software/arm-trusted-firmware

All of the really super-secret security and DRM critical stuff is in the vendor's hardware and code.

This the first time I heard about a change.org petition having any effect.

Major parts of the firmware were licensed, I assume for time-to-market reasons. Some of the license issues are also AFAIK due to how, somehow, we let entertainment industry strangle hold us - both ME and PSP now have code involved in setting up "protected av path" which is queried by streaming services et al - and if it's not found, you don't get to play 4k media (at least, afaik, with Netflix, it's 4k).

AMD could release a friendlier version but it would not be able to do what majoroty of the market expects it to do.

n.b. there are license-built cpus that have alternative firmware in PSP, but it's also closed and they are not really available on open market.

AMD doesn't have the code nor the documentation from ARM to release a minimal PSP, and any attempt by them to do so will end with an injunction against AMD selling processors with TrustZone embedded, meaning they will have a yearlong gap before they can retool and start shipping any PSP-less processors (lead times on silicon changes are loooong).

Had AMD not been broke prior to the launch of Zen, they would have likely built their PSP in house, but they were so desperate to stay alive that they sold the 1st gen Zen CPU designs to a Chinese joint venture for $200 million (which kept AMD from bankruptcy).

That all makes sense for the vendors.. but what does ARM get out of it? A false sense of security?

An excuse for AMD to switch to a secure enclave based on RISC-V.

I wish..

The good feeling of cooperating with the agencies.

thats the billion dollar question! not having the clear answer even in public traded companies is a travesty.