Arm Trusted Services TEE driver (TS-TEE over FF-A)
Linux-side bridge that lets userspace talk to Trusted Services Secure Partitions running in the secure world of modern Arm systems, using the Arm Firmware Framework (FF-A) as the transport. It exposes those secure-world services through the standard TEE interface, similar in spirit to OP-TEE but for the Arm Trusted Services project rather than a single TEE OS.
recommendation
Worth keeping but flagging as niche and new: it landed in Linux 6.10 in April 2024, targets a specific Arm secure-world protocol (Trusted Services over FF-A) that nothing else in the tree implements, and is aimed at modern Arm platforms still being designed and shipped today. Deployment is currently low simply because the ecosystem is young, and there is no removal discussion upstream — annotation as a recent, specialised Arm secure-firmware interface is more useful than deprecation.
repository signals
sources
- docs.kernel.org
Upstream kernel documentation describes TS-TEE as the Linux-side TEE driver for Trusted Services Secure Partitions over Arm FF-A.
- cateee.net
LKDDb shows CONFIG_ARM_TSTEE as a current in-tree kernel option/module (`arm-tstee`) present from Linux 6.10 onward.
- trusted-services.readthedocs.io
The driver targets the Trusted Services RPC ABI, indicating a protocol-specific interface rather than a generic legacy hardware block.
- lwn.net
The public patch series in March 2024 introduced the driver; the lore-oriented search surfaced introduction coverage, not removal discussion.
codex reasoning notes (technical)
Real driver, not a helper library: local `rg` on drivers/tee/tstee shows `module_ffa_driver(tstee_driver)` and FF-A probe/remove hooks. Local `git log/show` shows one real functional commit adding the driver on 2024-04-03 and only later treewide mechanical churn. URLs were obtained via `web.search_query` (docs.kernel.org, LKDDb, LWN) and from a URL embedded in the local source via `rg` (trusted-services.readthedocs.io). Assessment: this is a very new, niche Arm FF-A/Trusted-Services driver with low but current deployment potential on modern Arm platforms, no natural replacement driver for the same protocol, and no surfaced removal activity; annotate as niche/new rather than deprecate.