Hi Volodymyr,
On 6/11/19 7:46 PM, Volodymyr Babchuk wrote:
This enumeration controls TEE type for a domain. Currently there is
two possible options: either 'none' or 'optee'.
'none' is the default value and it basically disables TEE support at
all.
'optee' enables access to the OP-TEE running on a host machine. This
requires special OP-TEE build with virtualization support enabled.
Signed-off-by: Volodymyr Babchuk <volodymyr_babc...@epam.com>
---
All the patches to optee.c should be merged together. They were
split to ease up review. But they depend heavily on each other.
Changes from v5:
- Replaced "native" with "optee" in the commit description.
- Updated and extended documentation based on Julien Grall's
and Ian Jackson's suggestions.
Changes from v4:
- "native" option was replaced with "optee"
- "tee" property was moved from arch-specific section to the
global one. Documentation moved inside "Devices" section.
Changes from v3:
- tee_enabled renamed to tee_type. Currently two types are supported
as described in the commit message
- Add LIBXL_HAVE_BUILDINFO_ARCH_ARM_TEE definition
Changes from v2:
- Use arch.tee_enabled instead of separate domctl
---
docs/man/xl.cfg.5.pod.in | 21 +++++++++++++++++++++
tools/libxl/libxl.h | 5 +++++
tools/libxl/libxl_arm.c | 13 +++++++++++++
tools/libxl/libxl_types.idl | 6 ++++++
tools/xl/xl_parse.c | 9 +++++++++
5 files changed, 54 insertions(+)
diff --git a/docs/man/xl.cfg.5.pod.in b/docs/man/xl.cfg.5.pod.in
index c99d40307e..e65ab6111f 100644
--- a/docs/man/xl.cfg.5.pod.in
+++ b/docs/man/xl.cfg.5.pod.in
@@ -1544,6 +1544,27 @@ Set maximum height for pointer device.
=back
+=item B<tee="STRING">
+
+B<Arm only.> Set TEE type for the guest. TEE is a Trusted Execution
+Environment -- separate secure OS found on some platforms. B<STRING> can be
one of the:
+
+=over 4
+
+=item B<none>
+
+Disable TEE support at all. This is the default value.
How about "Don't allow the guest to use TEE if present on the platform.
This is the default value.".
+
+=item B<optee>
+
+Allow a guest to use OP-TEE. Note that a virtualization-aware OP-TEE
+is required for this. If this option is selected, guest will be able
OOI, what happen if OP-TEE does not support virtualization. Will Xen
forbid to use it?
+to access to the real OP-TEE OS running on the host. Guest creation
s/real// it is redundant with the rest of the sentence. However, it does
not really answer to the question regarding isolation.
+will fail if OP-TEE have no resources for a new guest. Number of supported
+guests depends on OP-TEE configuration.
How about the following description (correct me if my understanding is
wrong):
"Allow a guest to access the host OP-TEE OS. Xen will mediate the access
to OP-TEE and the resource isolation will be provided directly by
OP-TEE. OP-TEE itself may limit the number of guests that can
concurrently use it. This requires a virtualization-aware OP-TEE for
this to work.
This feature is a B<technology preview>."
How can a user know whether OP-TEE supports virtualization? Is it
configurable at build?
Cheers,
--
Julien Grall
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
