요약·해설과 원문, 전문 번역을 서로 분리했습니다. API 이름, symbol, source path는 원문 표기를 사용합니다.
1. 요약·해설
원문의 핵심 논리와 kernel programming 관점의 보충 설명입니다. 아래의 전문 번역과는 별도로 작성했습니다.
2. 영어 원문 전체
번역 기준이 된 Linux v6.18.37 원문입니다. 줄 번호는 이 버전의 파일 좌표입니다.
원문 전체 펼치기
.. SPDX-License-Identifier: GPL-2.0
========================
TPM CRB over FF-A Driver
========================
The TPM Command Response Buffer (CRB) interface is a standard TPM interface
defined in the TCG PC Client Platform TPM Profile (PTP) Specification [1]_.
The CRB provides a structured set of control registers a client uses when
interacting with a TPM as well as a data buffer for storing TPM commands and
responses. A CRB interface can be implemented in:
- hardware registers in a discrete TPM chip
- in memory for a TPM running in isolated environment where shared memory
allows a client to interact with the TPM
The Firmware Framework for Arm A-profile (FF-A) [2]_ is a specification
that defines interfaces and protocols for the following purposes:
- Compartmentalize firmware into software partitions that run in the Arm
Secure world environment (also know as TrustZone)
- Provide a standard interface for software components in the Non-secure
state, for example OS and Hypervisors, to communicate with this firmware.
A TPM can be implemented as an FF-A secure service. This could be a firmware
TPM or could potentially be a TPM service that acts as a proxy to a discrete
TPM chip. An FF-A based TPM abstracts hardware details (e.g. bus controller
and chip selects) away from the OS and can protect locality 4 from access
by an OS. The TCG-defined CRB interface is used by clients to interact
with the TPM service.
The Arm TPM Service Command Response Buffer Interface Over FF-A [3]_
specification defines FF-A messages that can be used by a client to signal
when updates have been made to the CRB.
How the Linux CRB driver interacts with FF-A is summarized below:
- The tpm_crb_ffa driver registers with the FF-A subsystem in the kernel
with an architected TPM service UUID defined in the CRB over FF-A spec.
- If a TPM service is discovered by FF-A, the probe() function in the
tpm_crb_ffa driver runs, and the driver initializes.
- The probing and initialization of the Linux CRB driver is triggered
by the discovery of a TPM advertised via ACPI. The CRB driver can
detect the type of TPM through the ACPI 'start' method. The start
method for Arm FF-A was defined in TCG ACPI v1.4 [4]_.
- When the CRB driver performs its normal functions such as signaling 'start'
and locality request/relinquish it invokes the tpm_crb_ffa_start() funnction
in the tpm_crb_ffa driver which handles the FF-A messaging to the TPM.
References
==========
.. [1] **TCG PC Client Platform TPM Profile (PTP) Specification**
https://trustedcomputinggroup.org/resource/pc-client-platform-tpm-profile-ptp-specification/
.. [2] **Arm Firmware Framework for Arm A-profile (FF-A)**
https://developer.arm.com/documentation/den0077/latest/
.. [3] **Arm TPM Service Command Response Buffer Interface Over FF-A**
https://developer.arm.com/documentation/den0138/latest/
.. [4] **TCG ACPI Specification**
https://trustedcomputinggroup.org/resource/tcg-acpi-specification/
3. 한국어 전문 번역
영어 원문의 문단 순서와 의미를 유지한 전체 번역입니다. 코드, 함수명, symbol과 URL은 원문 표기를 유지합니다.
CRB interface 구현 형태
1-17TPM Command Response Buffer(CRB)는 TCG PC Client Platform TPM Profile(PTP) Specification이 정의하는 표준 TPM interface다. Client가 TPM과 상호 작용할 때 사용하는 구조화 control register와 TPM command·response를 저장하는 data buffer를 제공한다.
CRB는 discrete TPM chip의 hardware register로 구현할 수 있다. 또는 isolated environment에서 실행되는 TPM을 위해 memory에 구현하고 shared memory로 client와 TPM을 연결할 수도 있다.
동일한 TCG CRB interface를 물리·격리 환경에 적용한다.
.. SPDX-License-Identifier: GPL-2.0
========================
TPM CRB over FF-A Driver
========================
The TPM Command Response Buffer (CRB) interface is a standard TPM interface
defined in the TCG PC Client Platform TPM Profile (PTP) Specification [1]_.
The CRB provides a structured set of control registers a client uses when
interacting with a TPM as well as a data buffer for storing TPM commands and
responses. A CRB interface can be implemented in:
- hardware registers in a discrete TPM chip
- in memory for a TPM running in isolated environment where shared memory
allows a client to interact with the TPM
FF-A secure service와 locality 4
18-37Firmware Framework for Arm A-profile(FF-A)는 firmware를 Arm Secure world, 즉 TrustZone에서 실행되는 software partition으로 격리하고, OS·hypervisor 같은 Non-secure state component가 이 firmware와 통신하는 표준 interface와 protocol을 정의한다.
TPM은 FF-A secure service로 구현할 수 있다. Firmware TPM일 수도 있고 discrete TPM chip으로 요청을 전달하는 proxy service일 수도 있다. FF-A TPM은 bus controller·chip select 같은 hardware 세부 정보를 OS에서 숨기며 OS가 locality 4에 접근하지 못하도록 보호할 수 있다.
Client는 TCG CRB interface로 TPM service와 상호 작용한다. Arm TPM Service Command Response Buffer Interface Over FF-A 사양은 client가 CRB update를 알릴 때 사용하는 FF-A message를 정의한다.
Non-secure client와 Secure world TPM 사이에서 표준 CRB와 FF-A message를 결합한다.
The Firmware Framework for Arm A-profile (FF-A) [2]_ is a specification
that defines interfaces and protocols for the following purposes:
- Compartmentalize firmware into software partitions that run in the Arm
Secure world environment (also know as TrustZone)
- Provide a standard interface for software components in the Non-secure
state, for example OS and Hypervisors, to communicate with this firmware.
A TPM can be implemented as an FF-A secure service. This could be a firmware
TPM or could potentially be a TPM service that acts as a proxy to a discrete
TPM chip. An FF-A based TPM abstracts hardware details (e.g. bus controller
and chip selects) away from the OS and can protect locality 4 from access
by an OS. The TCG-defined CRB interface is used by clients to interact
with the TPM service.
The Arm TPM Service Command Response Buffer Interface Over FF-A [3]_
specification defines FF-A messages that can be used by a client to signal
when updates have been made to the CRB.
Linux CRB와 FF-A 상호 작용
38-54`tpm_crb_ffa` driver는 CRB over FF-A 사양이 정의한 architected TPM service UUID로 kernel FF-A subsystem에 등록한다. FF-A가 TPM service를 발견하면 driver의 `probe()`가 실행되어 초기화한다.
Linux CRB driver의 probe와 초기화는 ACPI가 광고한 TPM을 발견할 때 시작된다. CRB driver는 ACPI `start` method로 TPM 유형을 판별하며 Arm FF-A용 start method는 TCG ACPI v1.4에 정의되어 있다.
CRB driver가 `start` signal이나 locality request·relinquish 같은 일반 기능을 수행하면 `tpm_crb_ffa_start()`를 호출한다. 이 함수가 TPM service를 향한 FF-A messaging을 담당한다.
ACPI discovery와 FF-A service discovery를 연결해 TPM driver를 초기화한다.
How the Linux CRB driver interacts with FF-A is summarized below:
- The tpm_crb_ffa driver registers with the FF-A subsystem in the kernel
with an architected TPM service UUID defined in the CRB over FF-A spec.
- If a TPM service is discovered by FF-A, the probe() function in the
tpm_crb_ffa driver runs, and the driver initializes.
- The probing and initialization of the Linux CRB driver is triggered
by the discovery of a TPM advertised via ACPI. The CRB driver can
detect the type of TPM through the ACPI 'start' method. The start
method for Arm FF-A was defined in TCG ACPI v1.4 [4]_.
- When the CRB driver performs its normal functions such as signaling 'start'
and locality request/relinquish it invokes the tpm_crb_ffa_start() funnction
in the tpm_crb_ffa driver which handles the FF-A messaging to the TPM.
FF-A CRB 관련 사양
55-65참고 문서는 TCG PTP specification, Arm FF-A specification, Arm TPM Service CRB over FF-A specification, TCG ACPI specification 네 가지다. 각각 CRB register model, Secure·Non-secure partition 통신, TPM service message, ACPI discovery·start method를 규정한다.
Linux driver가 의존하는 표준의 역할이다.
References
==========
.. [1] **TCG PC Client Platform TPM Profile (PTP) Specification**
https://trustedcomputinggroup.org/resource/pc-client-platform-tpm-profile-ptp-specification/
.. [2] **Arm Firmware Framework for Arm A-profile (FF-A)**
https://developer.arm.com/documentation/den0077/latest/
.. [3] **Arm TPM Service Command Response Buffer Interface Over FF-A**
https://developer.arm.com/documentation/den0138/latest/
.. [4] **TCG ACPI Specification**
https://trustedcomputinggroup.org/resource/tcg-acpi-specification/
요약·해설
tpm_ffa_crb.rst:1-65Arm FF-A secure service로 제공되는 TPM의 CRB interface, ACPI discovery와 tpm_crb_ffa message 경로를 설명합니다.