요약·해설과 원문, 전문 번역을 서로 분리했습니다. API 이름, symbol, source path는 원문 표기를 사용합니다.
1. 요약·해설
원문의 핵심 논리와 kernel programming 관점의 보충 설명입니다. 아래의 전문 번역과는 별도로 작성했습니다.
2. 영어 원문 전체
번역 기준이 된 Linux v6.18.37 원문입니다. 줄 번호는 이 버전의 파일 좌표입니다.
원문 전체 펼치기
1
.. SPDX-License-Identifier: GPL-2.0
2
.. tee:
4
==================================================
5
TEE (Trusted Execution Environment) Userspace API
6
==================================================
8
include/uapi/linux/tee.h defines the generic interface to a TEE.
10
User space (the client) connects to the driver by opening /dev/tee[0-9]* or
11
/dev/teepriv[0-9]*.
13
- TEE_IOC_SHM_ALLOC allocates shared memory and returns a file descriptor
14
which user space can mmap. When user space doesn't need the file
15
descriptor any more, it should be closed. When shared memory isn't needed
16
any longer it should be unmapped with munmap() to allow the reuse of
17
memory.
19
- TEE_IOC_VERSION lets user space know which TEE this driver handles and
20
its capabilities.
22
- TEE_IOC_OPEN_SESSION opens a new session to a Trusted Application.
24
- TEE_IOC_INVOKE invokes a function in a Trusted Application.
26
- TEE_IOC_CANCEL may cancel an ongoing TEE_IOC_OPEN_SESSION or TEE_IOC_INVOKE.
28
- TEE_IOC_CLOSE_SESSION closes a session to a Trusted Application.
30
There are two classes of clients, normal clients and supplicants. The latter is
31
a helper process for the TEE to access resources in Linux, for example file
32
system access. A normal client opens /dev/tee[0-9]* and a supplicant opens
33
/dev/teepriv[0-9].
35
Much of the communication between clients and the TEE is opaque to the
36
driver. The main job for the driver is to receive requests from the
37
clients, forward them to the TEE and send back the results. In the case of
38
supplicants the communication goes in the other direction, the TEE sends
39
requests to the supplicant which then sends back the result.
3. 한국어 전문 번역
영어 원문의 문단 순서와 의미를 유지한 전체 번역입니다. 코드, 함수명, symbol과 URL은 원문 표기를 유지합니다.
일반 TEE 인터페이스
1-12`include/uapi/linux/tee.h`는 Trusted Execution Environment, 즉 TEE의 일반 인터페이스를 정의합니다.
사용자 공간 client는 `/dev/tee[0-9]*` 또는 `/dev/teepriv[0-9]*`를 열어 driver에 연결합니다.
.. SPDX-License-Identifier: GPL-2.0
.. tee:
==================================================
TEE (Trusted Execution Environment) Userspace API
==================================================
include/uapi/linux/tee.h defines the generic interface to a TEE.
User space (the client) connects to the driver by opening /dev/tee[0-9]* or
/dev/teepriv[0-9]*.
TEE ioctl
13-29ioctl동작
`TEE_IOC_SHM_ALLOC`shared memory를 할당하고 mmap 가능한 FD를 반환합니다. FD가 필요 없으면 close하고 메모리가 필요 없으면 `munmap()`해 재사용을 허용합니다.
`TEE_IOC_VERSION`driver가 처리하는 TEE 종류와 capability 조회
`TEE_IOC_OPEN_SESSION`Trusted Application에 새 session 열기
`TEE_IOC_INVOKE`Trusted Application의 함수 호출
`TEE_IOC_CANCEL`진행 중인 OPEN_SESSION 또는 INVOKE 취소 가능
`TEE_IOC_CLOSE_SESSION`Trusted Application session 닫기
shared memory와 Trusted Application session 수명을 관리합니다.
- TEE_IOC_SHM_ALLOC allocates shared memory and returns a file descriptor
which user space can mmap. When user space doesn't need the file
descriptor any more, it should be closed. When shared memory isn't needed
any longer it should be unmapped with munmap() to allow the reuse of
memory.
- TEE_IOC_VERSION lets user space know which TEE this driver handles and
its capabilities.
- TEE_IOC_OPEN_SESSION opens a new session to a Trusted Application.
- TEE_IOC_INVOKE invokes a function in a Trusted Application.
- TEE_IOC_CANCEL may cancel an ongoing TEE_IOC_OPEN_SESSION or TEE_IOC_INVOKE.
- TEE_IOC_CLOSE_SESSION closes a session to a Trusted Application.
일반 client와 supplicant
30-39client에는 normal client와 supplicant 두 종류가 있습니다. supplicant는 TEE가 filesystem 같은 Linux resource에 접근하도록 돕는 helper process입니다. normal client는 `/dev/tee[0-9]*`, supplicant는 `/dev/teepriv[0-9]`를 엽니다.
client와 TEE 사이 통신의 대부분은 driver에 불투명합니다. normal client의 경우 driver는 client 요청을 받아 TEE로 전달하고 결과를 돌려줍니다. supplicant의 경우 방향이 반대로, TEE가 supplicant에 요청을 보내고 supplicant가 결과를 반환합니다.
Normal client -> TEE driver -> TEE -> result to normal client→TEE -> TEE driver -> supplicant -> result to TEE
client 종류에 따라 요청 시작점이 달라집니다.
There are two classes of clients, normal clients and supplicants. The latter is
a helper process for the TEE to access resources in Linux, for example file
system access. A normal client opens /dev/tee[0-9]* and a supplicant opens
/dev/teepriv[0-9].
Much of the communication between clients and the TEE is opaque to the
driver. The main job for the driver is to receive requests from the
clients, forward them to the TEE and send back the results. In the case of
supplicants the communication goes in the other direction, the TEE sends
requests to the supplicant which then sends back the result.
요약·해설
tee.rst:1-39TEE driver는 대부분의 payload를 해석하지 않고 normal client 요청을 TEE로 중계합니다. supplicant 경로는 TEE가 Linux resource를 요청하는 반대 방향이며, shared memory는 FD close와 `munmap()`의 수명을 각각 관리해야 합니다.