Kernel TEE subsystem evolution
summary
Kernel TEE support now ships mainline with OP-TEE and upstream AMD drivers and early work toward Qualcomm, moving from reserved shared memory to registered shared memory for zero‑copy buffers and adding a kernel internal API so RNG, crypto and storage subsystems talk to TAs. A new TBus lets drivers probe by UUID matching and enumerate pseudo and early TAs. Upstream use cases include Hardware RNG, trusted keys using a hardware unique key, firmware TPM and PKCS#11 tokens. Proposal adds kernel runtime attestation via T-held keys, nonces, and randomized measurements.
AI-written summary · about
chapters (14)
- 0:00Introduction and speaker intro
- 2:25What is a TEE
- 6:06OptiTEE open source TEE
- 9:17Kernel TEE subsystem overview
- 11:25TEE communication flow
- 12:50Shared memory evolution
- 13:54Internal API and TEE bus
- 17:13Hardware RNG use case
- 18:38Trusted keys use case
- 20:03Firmware TPM use case
- 21:10PKCS#11 token use case
- 22:39Kernel runtime measurements proposal
- 32:19Future work and open source
- 33:01Q&A session
related talks
48mKernel TEE Subsystem Evolution
44mKernel TEE subsystem BoF
46mTPM in TEE
40mWhat should I know about secure boot and TEEs?
50mUsing OP-TEE as a Cryptography Engine
22mSupporting TEE on x86 Client Platforms with pKVM
36mEverybody is talking about Confidential Computing - the minimum Devs should know
41mPanel: A New Root Of Trust: Changing Computing With TEE