| Message ID | 20190619175333.29938-2-volodymyr_babchuk@epam.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | TEE mediator (and OP-TEE) support in XEN | expand |
Hello Ian, Do you have a couple of minutes to check this and the following patches? > This enumeration controls TEE type for a domain. Currently there is > two possible options: either 'none' or 'optee'. > > 'none' is the default value and it basically disables TEE support at > all. > > 'optee' enables access to the OP-TEE running on a host machine. This > requires special OP-TEE build with virtualization support enabled. > > Signed-off-by: Volodymyr Babchuk <volodymyr_babchuk@epam.com> > > --- > > Changes from v6: > - Updated documentation according to Julien Grall's suggestions, > add link to OP-TEE documentation > > Changes from v5: > - Replaced "native" with "optee" in the commit description. > - Updated and extended documentation based on Julien Grall's > and Ian Jackson's suggestions. > > Changes from v4: > - "native" option was replaced with "optee" > - "tee" property was moved from arch-specific section to the > global one. Documentation moved inside "Devices" section. > > Changes from v3: > - tee_enabled renamed to tee_type. Currently two types are supported > as described in the commit message > - Add LIBXL_HAVE_BUILDINFO_ARCH_ARM_TEE definition > > Changes from v2: > - Use arch.tee_enabled instead of separate domctl > --- > docs/man/xl.cfg.5.pod.in | 29 +++++++++++++++++++++++++++++ > tools/libxl/libxl.h | 5 +++++ > tools/libxl/libxl_arm.c | 13 +++++++++++++ > tools/libxl/libxl_types.idl | 6 ++++++ > tools/xl/xl_parse.c | 9 +++++++++ > 5 files changed, 62 insertions(+) > > diff --git a/docs/man/xl.cfg.5.pod.in b/docs/man/xl.cfg.5.pod.in > index c99d40307e..e71b3b411d 100644 > --- a/docs/man/xl.cfg.5.pod.in > +++ b/docs/man/xl.cfg.5.pod.in > @@ -1544,6 +1544,35 @@ Set maximum height for pointer device. > > =back > > +=item B<tee="STRING"> > + > +B<Arm only.> Set TEE type for the guest. TEE is a Trusted Execution > +Environment -- separate secure OS found on some platforms. B<STRING> can be one of the: > + > +=over 4 > + > +=item B<none> > + > +"Don't allow the guest to use TEE if present on the platform. This is > +the default value. > + > +=item B<optee> > + > +Allow a guest to access the host OP-TEE OS. Xen will mediate the > +access to OP-TEE and the resource isolation will be provided directly > +by OP-TEE. OP-TEE itself may limit the number of guests that can > +concurrently use it. This requires a virtualization-aware OP-TEE for > +this to work. > + > +You can refer to > +L<OP-TEE documentation|https://optee.readthedocs.io/architecture/virtualization.html> > +for more information about how to enable and configure virtualization support > +in OP-TEE. > + > +This feature is a B<technology preview>. > + > +=back > + > =back > > =head2 Paravirtualised (PV) Guest Specific Options > diff --git a/tools/libxl/libxl.h b/tools/libxl/libxl.h > index 9bacfb97f0..1fe6ea2bd8 100644 > --- a/tools/libxl/libxl.h > +++ b/tools/libxl/libxl.h > @@ -273,6 +273,11 @@ > */ > #define LIBXL_HAVE_BUILDINFO_ARM_GIC_VERSION 1 > > +/* > + * libxl_domain_build_info has the arch_arm.tee field. > + */ > +#define LIBXL_HAVE_BUILDINFO_ARCH_ARM_TEE 1 > + > /* > * LIBXL_HAVE_SOFT_RESET indicates that libxl supports performing > * 'soft reset' for domains and there is 'soft_reset' shutdown reason > diff --git a/tools/libxl/libxl_arm.c b/tools/libxl/libxl_arm.c > index 141e159043..6b72c00960 100644 > --- a/tools/libxl/libxl_arm.c > +++ b/tools/libxl/libxl_arm.c > @@ -89,6 +89,19 @@ int libxl__arch_domain_prepare_config(libxl__gc *gc, > return ERROR_FAIL; > } > > + switch (d_config->b_info.tee) { > + case LIBXL_TEE_TYPE_NONE: > + config->arch.tee_type = XEN_DOMCTL_CONFIG_TEE_NONE; > + break; > + case LIBXL_TEE_TYPE_OPTEE: > + config->arch.tee_type = XEN_DOMCTL_CONFIG_TEE_OPTEE; > + break; > + default: > + LOG(ERROR, "Unknown TEE type %d", > + d_config->b_info.tee); > + return ERROR_FAIL; > + } > + > return 0; > } > > diff --git a/tools/libxl/libxl_types.idl b/tools/libxl/libxl_types.idl > index b61399ce36..fa5ee65463 100644 > --- a/tools/libxl/libxl_types.idl > +++ b/tools/libxl/libxl_types.idl > @@ -460,6 +460,11 @@ libxl_gic_version = Enumeration("gic_version", [ > (0x30, "v3") > ], init_val = "LIBXL_GIC_VERSION_DEFAULT") > > +libxl_tee_type = Enumeration("tee_type", [ > + (0, "none"), > + (1, "optee") > + ], init_val = "LIBXL_TEE_TYPE_NONE") > + > libxl_rdm_reserve = Struct("rdm_reserve", [ > ("strategy", libxl_rdm_reserve_strategy), > ("policy", libxl_rdm_reserve_policy), > @@ -537,6 +542,7 @@ libxl_domain_build_info = Struct("domain_build_info",[ > ("nested_hvm", libxl_defbool), > ("apic", libxl_defbool), > ("dm_restrict", libxl_defbool), > + ("tee", libxl_tee_type), > ("u", KeyedUnion(None, libxl_domain_type, "type", > [("hvm", Struct(None, [("firmware", string), > ("bios", libxl_bios_type), > diff --git a/tools/xl/xl_parse.c b/tools/xl/xl_parse.c > index e105bda2bb..0604374ef3 100644 > --- a/tools/xl/xl_parse.c > +++ b/tools/xl/xl_parse.c > @@ -2691,6 +2691,15 @@ skip_usbdev: > } > } > > + if (!xlu_cfg_get_string (config, "tee", &buf, 1)) { > + e = libxl_tee_type_from_string(buf, &b_info->tee); > + if (e) { > + fprintf(stderr, > + "Unknown tee \"%s\" specified\n", buf); > + exit(-ERROR_FAIL); > + } > + } > + > parse_vkb_list(config, d_config); > > xlu_cfg_destroy(config);
Volodymyr Babchuk writes ("[PATCH v7 1/5] tools/arm: tee: add "tee" option for xl.cfg"):
> This enumeration controls TEE type for a domain. Currently there is
> two possible options: either 'none' or 'optee'.
>
> 'none' is the default value and it basically disables TEE support at
> all.
>
> 'optee' enables access to the OP-TEE running on a host machine. This
> requires special OP-TEE build with virtualization support enabled.
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
diff --git a/docs/man/xl.cfg.5.pod.in b/docs/man/xl.cfg.5.pod.in index c99d40307e..e71b3b411d 100644 --- a/docs/man/xl.cfg.5.pod.in +++ b/docs/man/xl.cfg.5.pod.in @@ -1544,6 +1544,35 @@ Set maximum height for pointer device. =back +=item B<tee="STRING"> + +B<Arm only.> Set TEE type for the guest. TEE is a Trusted Execution +Environment -- separate secure OS found on some platforms. B<STRING> can be one of the: + +=over 4 + +=item B<none> + +"Don't allow the guest to use TEE if present on the platform. This is +the default value. + +=item B<optee> + +Allow a guest to access the host OP-TEE OS. Xen will mediate the +access to OP-TEE and the resource isolation will be provided directly +by OP-TEE. OP-TEE itself may limit the number of guests that can +concurrently use it. This requires a virtualization-aware OP-TEE for +this to work. + +You can refer to +L<OP-TEE documentation|https://optee.readthedocs.io/architecture/virtualization.html> +for more information about how to enable and configure virtualization support +in OP-TEE. + +This feature is a B<technology preview>. + +=back + =back =head2 Paravirtualised (PV) Guest Specific Options diff --git a/tools/libxl/libxl.h b/tools/libxl/libxl.h index 9bacfb97f0..1fe6ea2bd8 100644 --- a/tools/libxl/libxl.h +++ b/tools/libxl/libxl.h @@ -273,6 +273,11 @@ */ #define LIBXL_HAVE_BUILDINFO_ARM_GIC_VERSION 1 +/* + * libxl_domain_build_info has the arch_arm.tee field. + */ +#define LIBXL_HAVE_BUILDINFO_ARCH_ARM_TEE 1 + /* * LIBXL_HAVE_SOFT_RESET indicates that libxl supports performing * 'soft reset' for domains and there is 'soft_reset' shutdown reason diff --git a/tools/libxl/libxl_arm.c b/tools/libxl/libxl_arm.c index 141e159043..6b72c00960 100644 --- a/tools/libxl/libxl_arm.c +++ b/tools/libxl/libxl_arm.c @@ -89,6 +89,19 @@ int libxl__arch_domain_prepare_config(libxl__gc *gc, return ERROR_FAIL; } + switch (d_config->b_info.tee) { + case LIBXL_TEE_TYPE_NONE: + config->arch.tee_type = XEN_DOMCTL_CONFIG_TEE_NONE; + break; + case LIBXL_TEE_TYPE_OPTEE: + config->arch.tee_type = XEN_DOMCTL_CONFIG_TEE_OPTEE; + break; + default: + LOG(ERROR, "Unknown TEE type %d", + d_config->b_info.tee); + return ERROR_FAIL; + } + return 0; } diff --git a/tools/libxl/libxl_types.idl b/tools/libxl/libxl_types.idl index b61399ce36..fa5ee65463 100644 --- a/tools/libxl/libxl_types.idl +++ b/tools/libxl/libxl_types.idl @@ -460,6 +460,11 @@ libxl_gic_version = Enumeration("gic_version", [ (0x30, "v3") ], init_val = "LIBXL_GIC_VERSION_DEFAULT") +libxl_tee_type = Enumeration("tee_type", [ + (0, "none"), + (1, "optee") + ], init_val = "LIBXL_TEE_TYPE_NONE") + libxl_rdm_reserve = Struct("rdm_reserve", [ ("strategy", libxl_rdm_reserve_strategy), ("policy", libxl_rdm_reserve_policy), @@ -537,6 +542,7 @@ libxl_domain_build_info = Struct("domain_build_info",[ ("nested_hvm", libxl_defbool), ("apic", libxl_defbool), ("dm_restrict", libxl_defbool), + ("tee", libxl_tee_type), ("u", KeyedUnion(None, libxl_domain_type, "type", [("hvm", Struct(None, [("firmware", string), ("bios", libxl_bios_type), diff --git a/tools/xl/xl_parse.c b/tools/xl/xl_parse.c index e105bda2bb..0604374ef3 100644 --- a/tools/xl/xl_parse.c +++ b/tools/xl/xl_parse.c @@ -2691,6 +2691,15 @@ skip_usbdev: } } + if (!xlu_cfg_get_string (config, "tee", &buf, 1)) { + e = libxl_tee_type_from_string(buf, &b_info->tee); + if (e) { + fprintf(stderr, + "Unknown tee \"%s\" specified\n", buf); + exit(-ERROR_FAIL); + } + } + parse_vkb_list(config, d_config); xlu_cfg_destroy(config);
This enumeration controls TEE type for a domain. Currently there is two possible options: either 'none' or 'optee'. 'none' is the default value and it basically disables TEE support at all. 'optee' enables access to the OP-TEE running on a host machine. This requires special OP-TEE build with virtualization support enabled. Signed-off-by: Volodymyr Babchuk <volodymyr_babchuk@epam.com> --- Changes from v6: - Updated documentation according to Julien Grall's suggestions, add link to OP-TEE documentation Changes from v5: - Replaced "native" with "optee" in the commit description. - Updated and extended documentation based on Julien Grall's and Ian Jackson's suggestions. Changes from v4: - "native" option was replaced with "optee" - "tee" property was moved from arch-specific section to the global one. Documentation moved inside "Devices" section. Changes from v3: - tee_enabled renamed to tee_type. Currently two types are supported as described in the commit message - Add LIBXL_HAVE_BUILDINFO_ARCH_ARM_TEE definition Changes from v2: - Use arch.tee_enabled instead of separate domctl --- docs/man/xl.cfg.5.pod.in | 29 +++++++++++++++++++++++++++++ tools/libxl/libxl.h | 5 +++++ tools/libxl/libxl_arm.c | 13 +++++++++++++ tools/libxl/libxl_types.idl | 6 ++++++ tools/xl/xl_parse.c | 9 +++++++++ 5 files changed, 62 insertions(+)