TEE Driver API

TEE driver API와 bus infrastructure

이 문서는 `GPL-2.0` SPDX license를 사용하는 TEE(Trusted Execution Environment) driver API guide입니다.

Kernel은 Trusted Application을 UUID(Universally Unique Identifier)로 식별되는 device로 표현하는 TEE bus infrastructure를 제공합니다. Client driver는 자신이 지원하는 device UUID table을 등록합니다.

TEE bus의 `match()` API는 client driver UUID table을 순회해 device UUID와 대응하는 항목을 찾습니다. Match가 있으면 client driver가 등록한 probe API로 해당 device를 probe합니다.

이 matching·probe 과정은 TEE bus에 device 또는 client driver가 등록될 때마다 수행됩니다.

`uevent()` API는 새 device가 TEE bus에 등록될 때 userspace의 udev에 알려 modular client driver가 자동으로 load되게 합니다.

TEE bus device enumeration 방식은 기반 TEE implementation에 따라 다르므로, 각 TEE driver가 대응 구현을 제공하도록 열어 둡니다.

Match된 뒤 TEE client driver는 `include/linux/tee_drv.h`에 나열된 API를 사용해 Trusted Application과 통신할 수 있습니다.

.. SPDX-License-Identifier: GPL-2.0

===============================================
TEE (Trusted Execution Environment) driver API
===============================================

Kernel provides a TEE bus infrastructure where a Trusted Application is
represented as a device identified via Universally Unique Identifier (UUID) and
client drivers register a table of supported device UUIDs.

TEE bus infrastructure registers following APIs:

match():
  iterates over the client driver UUID table to find a corresponding
  match for device UUID. If a match is found, then this particular device is
  probed via corresponding probe API registered by the client driver. This
  process happens whenever a device or a client driver is registered with TEE
  bus.

uevent():
  notifies user-space (udev) whenever a new device is registered on
  TEE bus for auto-loading of modularized client drivers.

TEE bus device enumeration is specific to underlying TEE implementation, so it
is left open for TEE drivers to provide corresponding implementation.

Then TEE client driver can talk to a matched Trusted Application using APIs
listed in include/linux/tee_drv.h.

TEE client driver 등록 예제

예제는 UUID `ac6a4085-0e82-4c33-bf98-8eb8e118b6c2`인 Trusted Application과 통신할 TEE client driver를 등록합니다.

`client_id_table`은 `struct tee_client_device_id` array이며 `UUID_INIT()`으로 UUID를 구성하고 빈 sentinel entry로 끝냅니다.

`MODULE_DEVICE_TABLE(tee, client_id_table)`은 module device table을 TEE bus용으로 내보냅니다.

`struct tee_client_driver client_driver`는 `id_table`을 연결하고 내장 `driver`에 `DRIVER_NAME`, `tee_bus_type`, `client_probe`, `client_remove`를 설정합니다.

Module init function `client_init()`은 `driver_register(&client_driver.driver)`를 호출하고, exit function `client_exit()`은 `driver_unregister(&client_driver.driver)`를 호출합니다. 마지막으로 `module_init()`과 `module_exit()`이 두 function을 module lifecycle에 연결합니다.

TEE client driver example
-------------------------

Suppose a TEE client driver needs to communicate with a Trusted Application
having UUID: ``ac6a4085-0e82-4c33-bf98-8eb8e118b6c2``, so driver registration
snippet would look like::

        static const struct tee_client_device_id client_id_table[] = {
                {UUID_INIT(0xac6a4085, 0x0e82, 0x4c33,
                           0xbf, 0x98, 0x8e, 0xb8, 0xe1, 0x18, 0xb6, 0xc2)},
                {}
        };

        MODULE_DEVICE_TABLE(tee, client_id_table);

        static struct tee_client_driver client_driver = {
                .id_table        = client_id_table,
                .driver                = {
                        .name                = DRIVER_NAME,
                        .bus                = &tee_bus_type,
                        .probe                = client_probe,
                        .remove                = client_remove,
                },
        };

        static int __init client_init(void)
        {
                return driver_register(&client_driver.driver);
        }

        static void __exit client_exit(void)
        {
                driver_unregister(&client_driver.driver);
        }

        module_init(client_init);
        module_exit(client_exit);