Re: [virtio-dev] [PATCH v2] virtio-tee: Reserve device ID 46 for TEE device

[Sumit Garg <sumit.garg@linaro.org>]

+cc Jens

> In a virtual environment, an application running in guest VM may want
> to delegate security sensitive tasks to a Trusted Application (TA)
> running within a Trusted Execution Environment (TEE). A TEE is a trusted
> OS running in some secure environment, for example, TrustZone on ARM
> CPUs, or a separate secure co-processor etc.

I have been exploring this area quite recently with an effort to have a common VIRIO interface which can support different trusted OS implementations. I guess you intend to test it with AMD-TEE, right? Any plans to test it with OP-TEE? As currently we have these two supported upstream.

Do you currently have any virtio frontend/backend implementations for this?

> 
> A virtual TEE device emulates a TEE within a guest VM. Such a virtual
> TEE device supports multiple operations such as:
> 
> VIRTIO_TEE_CMD_OPEN_DEVICE â Open a communication channel with virtio
>                              TEE device.
> VIRTIO_TEE_CMD_CLOSE_DEVICE â Close communication channel with virtio
>                               TEE device.
> VIRTIO_TEE_CMD_GET_VERSION â Get version of virtio TEE.
> VIRTIO_TEE_CMD_OPEN_SESSION â Open a session to communicate with
>                               trusted application running in TEE.
> VIRTIO_TEE_CMD_CLOSE_SESSION â Close a session to end communication
>                                with trusted application running in TEE.
> VIRTIO_TEE_CMD_INVOKE_FUNC â Invoke a command or function in trusted
>                              application running in TEE.
> VIRTIO_TEE_CMD_CANCEL_REQ â Cancel an ongoing command within TEE.
> 

How about shared memory support? We would like to register guest pages with the trusted OS.

-Sumit

> We would like to reserve device ID 46 for Virtio-TEE device.
> 
> Signed-off-by: Jeshwanth Kumar <jeshwanthkumar.nk@amd.com>
> ---
>  content.tex | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/content.tex b/content.tex
> index 0a62dce..644aa4a 100644
> --- a/content.tex
> +++ b/content.tex
> @@ -739,6 +739,8 @@ \chapter{Device Types}\label{sec:Device Types}
>  \hline
>  45         &   SPI master \\
>  \hline
> +46         &   TEE device \\
> +\hline
> \end{tabular}
> 
>  Some of the devices above are unspecified by this document,