μUSB: Practical and Safe USB Driver Reuse for Arm TrustZone
Talkat 20th USENIX Symposium on Operating Systems Design and Implementation (OSDI '26) · 2026-07-13..07-15·
summary
μUSB generates TrustZone USB drivers by record, lift, replay of real Linux driver interactions, using a lightweight mutational recorder plus symbolic differential analysis and qualified taint tracking to produce cryptographically signed replay templates. Implementation is ~4,000 LOC on QEMU/KVM and Linux 5.6.8 and tested on a Raspberry Pi 5 across four classes (mass storage, video, audio, HID). Drivers generate in minutes, shrink TCB to tens of kilobytes, survive two-week stress tests, deliver near‑native throughput (storage almost identical, writes faster; cameras +3% and +20%; HID up to 4.5×).
AI-written summary · about
chapters (15)
- 0:00microUSB and TrustZone intro
- 1:22USB missing in TrustZone
- 3:13Limitations of USB drivers
- 4:38microUSB design insight
- 7:08USB tracing completeness
- 8:13Mutational recorder
- 9:16Trace generalization challenges
- 10:19Symbolic trace analysis
- 11:45Taint tracking for dependencies
- 12:29Implementation overview
- 13:55Safety and security benefits
- 14:38Correctness verification
- 15:45Performance comparison
- 16:28Memory footprint & dev experience
- 17:13Conclusion & future
related talks
25mDon't Trust Your USB! How to Find Bugs in USB Device Drivers
54mForging the USB Armory
33mMaking USB Great Again with USBFILTER
27mvTZ: Virtualizing ARM TrustZone
22mCharm: Facilitating Dynamic Analysis of Device Drivers of Mobile Systems
43mBreaking Samsung's ARM TrustZone
36mUSB Support in Zephyr OS
45mUSB Support in Zephyr OS