Kernel TEE Subsystem Evolution
summary
Kernel TEE support started introduced in Linux 4.12 (2017) and now runs multiple backends: OP-TEE (mainline), AMD’s Trusted OS (mailbox-based), plus a Qualcomm/Qt driver under review; RPMB is merged, RPMB merged enabling OP-TEE fTPM and a firmware TPM implementation is upstream. The kernel adds a T bus for in-kernel clients (hardware RNG, trusted keys, secure firmware loading) and a protected-DMA-bufs design that keeps vendor metadata in the T backend, exposing a protected DMA-bufs with T-managed metadata heap for secure media pipelines and crypto accelerators.
AI-written summary · about
chapters (20)
- 0:00Trusted Execution Environments intro
- 1:51TEE overview
- 3:14ARM TrustZone hardware
- 5:25GlobalPlatform specs
- 6:50TEE system architecture
- 9:02Kernel TEE subsystem role
- 10:55TEE hardware realizations
- 14:06OP-TEE trusted OS
- 17:01OP-TEE kernel integration
- 19:10Kernel TEE in Linux 4.12
- 20:56AMD Trusted OS evolution
- 22:00TEE bus introduction
- 25:34TEE bus RNG use case
- 26:41Trusted keys with TEE backend
- 29:08Firmware TPM on OP-TEE
- 30:35SCMI and EFI runtime services
- 32:25Trusted Services over FFA
- 33:49Protected DMA buffers
- 37:46Secure video pipeline demo
- 39:33Future TEE ecosystem
