AMD-TEE (AMD Trusted Execution Environment) | Linux 6.18.37

요약·해설과 원문, 전문 번역을 서로 분리했습니다. API 이름, symbol, source path는 원문 표기를 사용합니다.

1. 요약·해설

원문의 핵심 논리와 kernel programming 관점의 보충 설명입니다. 아래의 전문 번역과는 별도로 작성했습니다.

요약·해설

amd-tee.rst:1-90

AMD Secure Processor의 mailbox protocol과 ASP driver를 통해 Trusted Application을 실행하는 AMD-TEE 계층, command, callback을 설명합니다.

2. 영어 원문 전체

번역 기준이 된 Linux v6.18.37 원문입니다. 줄 번호는 이 버전의 파일 좌표입니다.

원문 전체 펼치기

1 .. SPDX-License-Identifier: GPL-2.0

3 =============================================

4 AMD-TEE (AMD's Trusted Execution Environment)

5 =============================================

7 The AMD-TEE driver handles the communication with AMD's TEE environment. The

8 TEE environment is provided by AMD Secure Processor.

10 The AMD Secure Processor (formerly called Platform Security Processor or PSP)

11 is a dedicated processor that features ARM TrustZone technology, along with a

12 software-based Trusted Execution Environment (TEE) designed to enable

13 third-party Trusted Applications. This feature is currently enabled only for

14 APUs.

16 The following picture shows a high level overview of AMD-TEE::

18 |

19 x86 |

20 |

21 User space (Kernel space) | AMD Secure Processor (PSP)

22 ~~~~~~~~~~ ~~~~~~~~~~~~~~ | ~~~~~~~~~~~~~~~~~~~~~~~~~~

23 |

24 +--------+ | +-------------+

25 | Client | | | Trusted |

26 +--------+ | | Application |

27 /\ | +-------------+

28 || | /\

29 || | ||

30 || | \/

31 || | +----------+

32 || | | TEE |

33 || | | Internal |

34 \/ | | API |

35 +---------+ +-----------+---------+ +----------+

36 | TEE | | TEE | AMD-TEE | | AMD-TEE |

38 | API | | | | | OS |

39 +---------+-----------+----+------+---------+---------+----------+

40 | Generic TEE API | | ASP | Mailbox |

42 +--------------------------+ +---------+--------------------+

44 At the lowest level (in x86), the AMD Secure Processor (ASP) driver uses the

45 CPU to PSP mailbox register to submit commands to the PSP. The format of the

46 command buffer is opaque to the ASP driver. It's role is to submit commands to

47 the secure processor and return results to AMD-TEE driver. The interface

48 between AMD-TEE driver and AMD Secure Processor driver can be found in [1].

50 The AMD-TEE driver packages the command buffer payload for processing in TEE.

51 The command buffer format for the different TEE commands can be found in [2].

53 The TEE commands supported by AMD-TEE Trusted OS are:

55 * TEE_CMD_ID_LOAD_TA - loads a Trusted Application (TA) binary into

56 TEE environment.

57 * TEE_CMD_ID_UNLOAD_TA - unloads TA binary from TEE environment.

58 * TEE_CMD_ID_OPEN_SESSION - opens a session with a loaded TA.

59 * TEE_CMD_ID_CLOSE_SESSION - closes session with loaded TA

60 * TEE_CMD_ID_INVOKE_CMD - invokes a command with loaded TA

61 * TEE_CMD_ID_MAP_SHARED_MEM - maps shared memory

62 * TEE_CMD_ID_UNMAP_SHARED_MEM - unmaps shared memory

64 AMD-TEE Trusted OS is the firmware running on AMD Secure Processor.

66 The AMD-TEE driver registers itself with TEE subsystem and implements the

67 following driver function callbacks:

69 * get_version - returns the driver implementation id and capability.

70 * open - sets up the driver context data structure.

71 * release - frees up driver resources.

72 * open_session - loads the TA binary and opens session with loaded TA.

73 * close_session - closes session with loaded TA and unloads it.

74 * invoke_func - invokes a command with loaded TA.

76 cancel_req driver callback is not supported by AMD-TEE.

78 The GlobalPlatform TEE Client API [3] can be used by the user space (client) to

79 talk to AMD's TEE. AMD's TEE provides a secure environment for loading, opening

80 a session, invoking commands and closing session with TA.

82 References

83 ==========

85 [1] include/linux/psp-tee.h

87 [2] drivers/tee/amdtee/amdtee_if.h

89 [3] http://www.globalplatform.org/specificationsdevice.asp look for

90 "TEE Client API Specification v1.0" and click download.

3. 한국어 전문 번역

영어 원문의 문단 순서와 의미를 유지한 전체 번역입니다. 코드, 함수명, symbol과 URL은 원문 표기를 유지합니다.

AMD Secure Processor 기반 TEE

1-14

AMD-TEE driver는 AMD Secure Processor가 제공하는 TEE 환경과 Linux 사이의 통신을 담당한다.

AMD Secure Processor는 과거 Platform Security Processor 또는 PSP라고 불렸으며, ARM TrustZone 기술과 software 기반 TEE를 갖춘 전용 processor다. 이 환경은 third-party Trusted Application을 실행하도록 설계되었고 현재는 APU에서만 활성화된다.

AMD-TEE 핵심 구성

구성 요소역할

AMD-TEE driverLinux TEE subsystem과 AMD TEE 사이의 command 변환

AMD Secure ProcessorTrusted OS와 Trusted Application을 실행하는 전용 processor

APU현재 AMD-TEE 기능이 활성화되는 platform

일반 실행 환경과 보안 실행 환경의 역할을 구분한다.

.. SPDX-License-Identifier: GPL-2.0

=============================================
AMD-TEE (AMD's Trusted Execution Environment)
=============================================

The AMD-TEE driver handles the communication with AMD's TEE environment. The
TEE environment is provided by AMD Secure Processor.

The AMD Secure Processor (formerly called Platform Security Processor or PSP)
is a dedicated processor that features ARM TrustZone technology, along with a
software-based Trusted Execution Environment (TEE) designed to enable
third-party Trusted Applications. This feature is currently enabled only for
APUs.

Client에서 PSP mailbox까지의 계층

15-51

user space client는 GlobalPlatform 계열 TEE Client API와 generic TEE IOCTL `TEE_IOC_*`를 사용한다. kernel의 TEE subsystem은 요청을 AMD-TEE driver에 넘기고, AMD-TEE driver는 ASP driver를 통해 secure processor 쪽 AMD-TEE Trusted OS와 통신한다.

x86 쪽 최하위 계층에서 AMD Secure Processor(ASP) driver는 CPU-to-PSP mailbox register로 PSP에 command를 제출한다. command buffer 형식은 ASP driver에 opaque하며, ASP driver의 책임은 buffer를 secure processor로 전달하고 결과를 AMD-TEE driver에 돌려주는 것이다. 두 driver 사이의 interface는 `[1]`의 `include/linux/psp-tee.h`에 정의된다.

AMD-TEE driver는 TEE가 처리할 command buffer payload를 구성한다. command 종류별 buffer 형식은 `[2]`의 `drivers/tee/amdtee/amdtee_if.h`에서 확인할 수 있다.

AMD-TEE 호출 경로

User clientTEE Client APIGeneric TEE API / TEE_IOC_*

Generic TEE API / TEE_IOC_*TEE subsystemAMD-TEE driver

AMD-TEE driverASP driverMailbox register protocol

Mailbox register protocolAMD-TEE Trusted OSTEE Internal APITrusted Application

원문의 ASCII 아키텍처를 실행 영역과 protocol 계층으로 재구성했다.

실행 영역별 구성

영역구성

x86 user spaceClient, TEE Client API

x86 kernel spaceTEE subsystem, AMD-TEE driver, ASP driver

AMD Secure ProcessorMailbox protocol, AMD-TEE Trusted OS, TEE Internal API, Trusted Application

원문의 세 영역을 같은 의미의 구조화 표로 옮겼다.


The following picture shows a high level overview of AMD-TEE::

                                             |
    x86                                      |
                                             |
 User space            (Kernel space)        |    AMD Secure Processor (PSP)
 ~~~~~~~~~~            ~~~~~~~~~~~~~~        |    ~~~~~~~~~~~~~~~~~~~~~~~~~~
                                             |
 +--------+                                  |       +-------------+
 | Client |                                  |       | Trusted     |
 +--------+                                  |       | Application |
     /\                                      |       +-------------+
     ||                                      |             /\
     ||                                      |             ||
     ||                                      |             \/
     ||                                      |         +----------+
     ||                                      |         |   TEE    |
     ||                                      |         | Internal |
     \/                                      |         |   API    |
 +---------+           +-----------+---------+         +----------+
 | TEE     |           | TEE       | AMD-TEE |         | AMD-TEE  |
 | Client  |           | subsystem | driver  |         | Trusted  |
 | API     |           |           |         |         |   OS     |
 +---------+-----------+----+------+---------+---------+----------+
 |   Generic TEE API        |      | ASP     |      Mailbox       |
 |   IOCTL (TEE_IOC_*)      |      | driver  | Register Protocol  |
 +--------------------------+      +---------+--------------------+

At the lowest level (in x86), the AMD Secure Processor (ASP) driver uses the
CPU to PSP mailbox register to submit commands to the PSP. The format of the
command buffer is opaque to the ASP driver. It's role is to submit commands to
the secure processor and return results to AMD-TEE driver. The interface
between AMD-TEE driver and AMD Secure Processor driver can be found in [1].

The AMD-TEE driver packages the command buffer payload for processing in TEE.
The command buffer format for the different TEE commands can be found in [2].

AMD-TEE Trusted OS command

52-67

AMD-TEE Trusted OS는 TA binary load와 unload, loaded TA와의 session open과 close, TA command invoke, shared memory map과 unmap을 지원한다. AMD-TEE Trusted OS 자체는 AMD Secure Processor에서 실행되는 firmware다.

AMD-TEE driver는 Linux TEE subsystem에 자신을 등록하고 driver callback을 구현한다.

지원 TEE command

Command동작

TEE_CMD_ID_LOAD_TATrusted Application binary를 TEE 환경에 load

TEE_CMD_ID_UNLOAD_TATA binary를 TEE 환경에서 unload

TEE_CMD_ID_OPEN_SESSIONload된 TA와 session open

TEE_CMD_ID_CLOSE_SESSIONTA session close

TEE_CMD_ID_INVOKE_CMDload된 TA의 command invoke

TEE_CMD_ID_MAP_SHARED_MEMshared memory map

TEE_CMD_ID_UNMAP_SHARED_MEMshared memory unmap

command ID와 Trusted OS에서 수행하는 동작이다.


The TEE commands supported by AMD-TEE Trusted OS are:

* TEE_CMD_ID_LOAD_TA          - loads a Trusted Application (TA) binary into
                                TEE environment.
* TEE_CMD_ID_UNLOAD_TA        - unloads TA binary from TEE environment.
* TEE_CMD_ID_OPEN_SESSION     - opens a session with a loaded TA.
* TEE_CMD_ID_CLOSE_SESSION    - closes session with loaded TA
* TEE_CMD_ID_INVOKE_CMD       - invokes a command with loaded TA
* TEE_CMD_ID_MAP_SHARED_MEM   - maps shared memory
* TEE_CMD_ID_UNMAP_SHARED_MEM - unmaps shared memory

AMD-TEE Trusted OS is the firmware running on AMD Secure Processor.

The AMD-TEE driver registers itself with TEE subsystem and implements the
following driver function callbacks:

Driver callback과 client API

68-90

`get_version`은 driver 구현 ID와 capability를 반환하고, `open`은 driver context 자료 구조를 준비하며, `release`는 driver resource를 해제한다.

`open_session`은 TA binary를 load하고 해당 TA와 session을 연다. `close_session`은 session을 닫고 TA를 unload하며, `invoke_func`는 load된 TA에 command를 호출한다. AMD-TEE는 `cancel_req` callback을 지원하지 않는다.

user space client는 `[3]`의 GlobalPlatform TEE Client API를 이용해 AMD TEE와 통신할 수 있다. AMD TEE는 TA load, session open, command invoke, session close를 위한 secure environment를 제공한다.

AMD-TEE callback

Callback역할 또는 상태

get_versionimplementation ID와 capability 반환

open / releasedriver context 준비 / resource 해제

open_session / close_sessionTA load와 session open / session close와 TA unload

invoke_funcTA command invoke

cancel_req지원하지 않음

TEE subsystem에 등록되는 callback과 지원 여부다.

TA session 수명 주기

Load TAOpen sessionInvoke commandClose sessionUnload TA

GlobalPlatform client가 이용하는 기본 순서다.


* get_version - returns the driver implementation id and capability.
* open - sets up the driver context data structure.
* release - frees up driver resources.
* open_session - loads the TA binary and opens session with loaded TA.
* close_session -  closes session with loaded TA and unloads it.
* invoke_func - invokes a command with loaded TA.

cancel_req driver callback is not supported by AMD-TEE.

The GlobalPlatform TEE Client API [3] can be used by the user space (client) to
talk to AMD's TEE. AMD's TEE provides a secure environment for loading, opening
a session, invoking commands and closing session with TA.

References
==========

[1] include/linux/psp-tee.h

[2] drivers/tee/amdtee/amdtee_if.h

[3] http://www.globalplatform.org/specificationsdevice.asp look for
    "TEE Client API Specification v1.0" and click download.