AMD's Trusted Execution Environment Is Coming With Linux 5.6

Last week I wrote about the AMD Secure Processor support for Linux 5.6 being queued as part of the cryptography subsystyem work with supporting the PSP / Secure Processor of Raven Ridge APUs. That AMD Secure Processor support is now rounded out with the Trusted Execution Environment (TEE) driver being queued for wiring into that subsystem.

Added this Saturday morning to the crypto queue for Linux 5.6 was the AMD-TEE driver, complementing last week's queuing of the CCP support and PSP related bits for Raven Ridge APUs. The Trusted Execution Environment subsystem has been around in the mainline kernel for several years now for Arm SoCs and this new driver extends the support to the AMD processors with their Secure Processor built off Arm TrustZone.

The AMD-TEE driver is focused on AMD APU support, supports sharing memory between the normal and secure worlds, and acts as a "Rich Execution Environment" communication agent for submitting commands to execute on the secure processor. Running on the AMD Secure Processor meanwhile is the "AMD-TEE Trusted OS" that is loaded via firmware.

The AMD-TEE driver supports the GlobalPlatform TEE Client API in user-space as the generic means of interacting with the AMD support. The driver allows loading Trusted Application binaries into the environment, mapping/unmapping shared memory, and session handling with the loaded Trusted Application. The TEE is designed for areas like content protection / digital rights management, identification / authentication purposes, and other access rights handling.

As covered in previous articles, this AMD Trusted Execution support for their recent APUs appear to be part of AMD's Chromebook play in meeting the requirements set forth by Google, similar to AMD recently adding HDCP (High-bandwidth Digital Content Protection) support for Raven to their Linux driver. For those frightened by Trusted Execution / Secure Processor talk, on Linux 5.6+ you can always build your kernel with AMDTEE disabled so the AMD-TEE support will not be built.