Re: [PATCH v5 09/10] tools/arm: tee: add "tee" option for xl.cfg

From: Ian Jackson <ian.jackson@citrix.com>
To: Volodymyr Babchuk <Volodymyr_Babchuk@epam.com>
Cc: "tee-dev@lists.linaro.org" <tee-dev@lists.linaro.org>,
	"xen-devel@lists.xenproject.org" <xen-devel@lists.xenproject.org>,
	Wei Liu <wei.liu2@citrix.com>
Subject: Re: [PATCH v5 09/10] tools/arm: tee: add "tee" option for xl.cfg
Date: Mon, 3 Jun 2019 15:47:26 +0100	[thread overview]
Message-ID: <23797.13054.100903.540173@mariner.uk.xensource.com> (raw)
In-Reply-To: <20190521212530.12706-10-volodymyr_babchuk@epam.com>

Volodymyr Babchuk writes ("[Xen-devel] [PATCH v5 09/10] tools/arm: tee: add "tee" option for xl.cfg"):
> This enumeration controls TEE type for a domain. Currently there is
> two possible options: either 'none' or 'optee'.
> 
> 'none' is the default value and it basically disables TEE support at
> all.
> 
> 'native' enables access to a "real" OP-TEE installed on a platform.
> 
> It is possible to add another types in the future.

Could improve this bit maybe ?

> +=item B<"optee">
> +
> +Allow guest to access to OP-TEE enabled on the platform. Guest will not be created
> +if platform does not have OP-TEE with virtualization feature or if OP-TEE will
> +deny access.

To me (who doesn't really understand this stuff very well) this
doesn't answer a very important question: if I enable this, what (if
any) host/machine/&c resources will this grant the guest access to ?

It sounds like the the answer should be "none", because if I search
for "op-tee" online I would get the impression that it is an
emulator.  Normally granting access to an emulator does not grant
access to host resources.

But in this series you talk about it being a mediator so I suspect
that is not right.

Ian.

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel