1 .. SPDX-License-Identifier: GPL-2.0
2
3 =============================================
4 AMD-TEE (AMD's Trusted Execution Environment)
5 =============================================
6
7 The AMD-TEE driver handles the communication w
8 TEE environment is provided by AMD Secure Proc
9
10 The AMD Secure Processor (formerly called Plat
11 is a dedicated processor that features ARM Tru
12 software-based Trusted Execution Environment (
13 third-party Trusted Applications. This feature
14 APUs.
15
16 The following picture shows a high level overv
17
18 |
19 x86 |
20 |
21 User space (Kernel space) |
22 ~~~~~~~~~~ ~~~~~~~~~~~~~~ |
23 |
24 +--------+ |
25 | Client | |
26 +--------+ |
27 /\ |
28 || |
29 || |
30 || |
31 || |
32 || |
33 || |
34 \/ |
35 +---------+ +-----------+---------+
36 | TEE | | TEE | AMD-TEE |
37 | Client | | subsystem | driver |
38 | API | | | |
39 +---------+-----------+----+------+---------+
40 | Generic TEE API | | ASP |
41 | IOCTL (TEE_IOC_*) | | driver |
42 +--------------------------+ +---------+
43
44 At the lowest level (in x86), the AMD Secure P
45 CPU to PSP mailbox register to submit commands
46 command buffer is opaque to the ASP driver. It
47 the secure processor and return results to AMD
48 between AMD-TEE driver and AMD Secure Processo
49
50 The AMD-TEE driver packages the command buffer
51 The command buffer format for the different TE
52
53 The TEE commands supported by AMD-TEE Trusted
54
55 * TEE_CMD_ID_LOAD_TA - loads a Truste
56 TEE environmen
57 * TEE_CMD_ID_UNLOAD_TA - unloads TA bin
58 * TEE_CMD_ID_OPEN_SESSION - opens a sessio
59 * TEE_CMD_ID_CLOSE_SESSION - closes session
60 * TEE_CMD_ID_INVOKE_CMD - invokes a comm
61 * TEE_CMD_ID_MAP_SHARED_MEM - maps shared me
62 * TEE_CMD_ID_UNMAP_SHARED_MEM - unmaps shared
63
64 AMD-TEE Trusted OS is the firmware running on
65
66 The AMD-TEE driver registers itself with TEE s
67 following driver function callbacks:
68
69 * get_version - returns the driver implementat
70 * open - sets up the driver context data struc
71 * release - frees up driver resources.
72 * open_session - loads the TA binary and opens
73 * close_session - closes session with loaded
74 * invoke_func - invokes a command with loaded
75
76 cancel_req driver callback is not supported by
77
78 The GlobalPlatform TEE Client API [3] can be u
79 talk to AMD's TEE. AMD's TEE provides a secure
80 a session, invoking commands and closing sessi
81
82 References
83 ==========
84
85 [1] include/linux/psp-tee.h
86
87 [2] drivers/tee/amdtee/amdtee_if.h
88
89 [3] http://www.globalplatform.org/specificatio
90 "TEE Client API Specification v1.0" and cl
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.