Kernel TEE subsystem BoF

on YouTube ↗44m

" summary

Kernel TEE subsystem now contains merged support for protected DMA buffers (reference patchset landed but not yet deployed), and an upstream RPMB in-kernel support that already handles eMMC and UFS and enables OP-TEE fTPM and EFI secure variables without a userspace daemon. Real work needed: user-space ABI changes for GStreamer/V4L2/display to allocate and tag protected buffers, silicon-specific device-side MMU or FFA handling, and addressing kernel mapping issues via options like DMA_ATTR_NO_KERNEL_MAPPING. Qualcomm QT driver merged; RISC‑V kernel glue still pending.

AI-written summary · about

" chapters (12)

1. 0:00Introduction and overview
2. 1:02Trusted Execution Environment basics
3. 6:20Protected DMA buffers
4. 16:18Dynamic buffer protection challenges
5. 22:29T-Bus devices and DT dependency
6. 25:21QT driver and RPMBB subsystem
7. 30:07TEE implementation revision
8. 34:11RISC-V TEE driver API
9. 36:44Architecture-independent TEE support
10. 40:41CI testing and RISC-V support
11. 41:04Trusted services and EFI variables
12. 43:12Virtualization with OP-TEE

" related talks

• 48mKernel TEE Subsystem EvolutionSumit Garg · Open Source Summit India 2025
• 39mKernel TEE subsystem evolutionSumit Garg · Linux Plumbers Conference 2022
• 22mSupporting TEE on x86 Client Platforms with pKVMJason Chen · KVM Forum 2022
• 26mArm64 Linux Kernel Architecture updateMatteo Carlini · Linaro Tech Days 2020
• 17mStatus Update on TDX SupportIsaku Yamahata · KVM Forum 2021
• 49mQualcomm Upstream Status BoFRajendra Nayak · Linaro Connect Hong Kong 2018
• 26mSecurity WG Lightning talksJoakim Bech, Jens Wiklander, Jerome Forissier · Linaro Connect Bangkok 2019
• 16mUnifying KVM API for protected VM and utilitiesIsaku Yamahata · Linux Plumbers Conference 2023