1
+ =============
1
2
TEE subsystem
3
+ =============
4
+
2
5
This document describes the TEE subsystem in Linux.
3
6
4
7
A TEE (Trusted Execution Environment) is a trusted OS running in some
@@ -80,27 +83,27 @@ The GlobalPlatform TEE Client API [5] is implemented on top of the generic
80
83
TEE API.
81
84
82
85
Picture of the relationship between the different components in the
83
- OP-TEE architecture.
84
-
85
- User space Kernel Secure world
86
- ~~~~~~~~~~ ~~~~~~ ~~~~~~~~~~~~
87
- +--------+ +-------------+
88
- | Client | | Trusted |
89
- +--------+ | Application |
90
- /\ +-------------+
91
- || +----------+ /\
92
- || |tee- | ||
93
- || |supplicant| \/
94
- || +----------+ +-------------+
95
- \/ /\ | TEE Internal|
96
- +-------+ || | API |
97
- + TEE | || +--------+--------+ +-------------+
98
- | Client| || | TEE | OP-TEE | | OP-TEE |
99
- | API | \/ | subsys | driver | | Trusted OS |
100
- +-------+----------------+----+-------+----+-----------+-------------+
101
- | Generic TEE API | | OP-TEE MSG |
102
- | IOCTL (TEE_IOC_*) | | SMCCC (OPTEE_SMC_CALL_*) |
103
- +-----------------------------+ +------------------------------+
86
+ OP-TEE architecture::
87
+
88
+ User space Kernel Secure world
89
+ ~~~~~~~~~~ ~~~~~~ ~~~~~~~~~~~~
90
+ +--------+ +-------------+
91
+ | Client | | Trusted |
92
+ +--------+ | Application |
93
+ /\ +-------------+
94
+ || +----------+ /\
95
+ || |tee- | ||
96
+ || |supplicant| \/
97
+ || +----------+ +-------------+
98
+ \/ /\ | TEE Internal|
99
+ +-------+ || | API |
100
+ + TEE | || +--------+--------+ +-------------+
101
+ | Client| || | TEE | OP-TEE | | OP-TEE |
102
+ | API | \/ | subsys | driver | | Trusted OS |
103
+ +-------+----------------+----+-------+----+-----------+-------------+
104
+ | Generic TEE API | | OP-TEE MSG |
105
+ | IOCTL (TEE_IOC_*) | | SMCCC (OPTEE_SMC_CALL_*) |
106
+ +-----------------------------+ +------------------------------+
104
107
105
108
RPC (Remote Procedure Call) are requests from secure world to kernel driver
106
109
or tee-supplicant. An RPC is identified by a special range of SMCCC return
@@ -109,10 +112,16 @@ kernel are handled by the kernel driver. Other RPC messages will be forwarded to
109
112
tee-supplicant without further involvement of the driver, except switching
110
113
shared memory buffer representation.
111
114
112
- References:
115
+ References
116
+ ==========
117
+
113
118
[1] https://github.com/OP-TEE/optee_os
119
+
114
120
[2] http://infocenter.arm.com/help/topic/com.arm.doc.den0028a/index.html
121
+
115
122
[3] drivers/tee/optee/optee_smc.h
123
+
116
124
[4] drivers/tee/optee/optee_msg.h
125
+
117
126
[5] http://www.globalplatform.org/specificationsdevice.asp look for
118
127
"TEE Client API Specification v1.0" and click download.
0 commit comments