AMD's Trusted Execution Environment Is Coming With Linux 5.6

Written by Michael Larabel in AMD on 4 January 2020 at 08:43 AM EST. 38 Comments
Last week I wrote about the AMD Secure Processor support for Linux 5.6 being queued as part of the cryptography subsystyem work with supporting the PSP / Secure Processor of Raven Ridge APUs. That AMD Secure Processor support is now rounded out with the Trusted Execution Environment (TEE) driver being queued for wiring into that subsystem.

Added this Saturday morning to the crypto queue for Linux 5.6 was the AMD-TEE driver, complementing last week's queuing of the CCP support and PSP related bits for Raven Ridge APUs. The Trusted Execution Environment subsystem has been around in the mainline kernel for several years now for Arm SoCs and this new driver extends the support to the AMD processors with their Secure Processor built off Arm TrustZone.

The AMD-TEE driver is focused on AMD APU support, supports sharing memory between the normal and secure worlds, and acts as a "Rich Execution Environment" communication agent for submitting commands to execute on the secure processor. Running on the AMD Secure Processor meanwhile is the "AMD-TEE Trusted OS" that is loaded via firmware.

The AMD-TEE driver supports the GlobalPlatform TEE Client API in user-space as the generic means of interacting with the AMD support. The driver allows loading Trusted Application binaries into the environment, mapping/unmapping shared memory, and session handling with the loaded Trusted Application. The TEE is designed for areas like content protection / digital rights management, identification / authentication purposes, and other access rights handling.

As covered in previous articles, this AMD Trusted Execution support for their recent APUs appear to be part of AMD's Chromebook play in meeting the requirements set forth by Google, similar to AMD recently adding HDCP (High-bandwidth Digital Content Protection) support for Raven to their Linux driver. For those frightened by Trusted Execution / Secure Processor talk, on Linux 5.6+ you can always build your kernel with AMDTEE disabled so the AMD-TEE support will not be built.
Related News
About The Author
Michael Larabel

Michael Larabel is the principal author of and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and automated benchmarking software. He can be followed via Twitter, LinkedIn, or contacted via

Popular News This Week