Hi,
On Tue, Jun 13, 2023 at 10:38 PM Rob Herring <robh@xxxxxxxxxx> wrote:
>
> On Mon, Jun 12, 2023 at 10:29 PM Yi Chou <yich@xxxxxxxxxxxx> wrote:
> >
> > Hi, Linux device tree maintainers,
>
> devicetree-spec is not Linux specific.
>
> > I am writing to you today to request a review of some custom device
> > tree bindings that we have developed. These bindings are not used by
> > the Linux kernel, but they are used by OP-TEE[1], a secure execution
> > environment for embedded systems.
> >
> > We have placed these bindings under the "chosen" node in the device
> > tree, as suggested by Jeffrey Kardatzke.[2]
> > The full bindings path would be "chosen/widevine/{tpm-auth-pk, huk,
> > widevine-dice, widevine-ta-key}".
>
> I would advise against using /chosen as it is pretty much geared to be
> consumed by a single client (typically "the OS"). Instead, /options
> node[1] may be a better option which is what we did for u-boot
> configuration. It somewhat depends on what components consume the DT.
> If the DT is only ever going to be consumed by OP-TEE, then using
> /chosen is probably fine. However, if say TF-A and OP-TEE use the same
> DT, then you have 2 components to configure.
In our use case, the TF-A will generate the DT, and the DT will only be
consumed by the OP-TEE. The Linux kernel should not see these data for
security reasons, I'm still not sure if it is a good idea to put the bindings
in the Linux source tree.
>
> > We would like to have our bindings reviewed by a device tree
> > maintainer to ensure that they are correct. We would also like to get
> > your feedback on the best way to document these bindings.
> >
> > Thank you for your time and consultation.
> >
> > Sincerely,
> > Yi
> >
> > [1]: https://github.com/OP-TEE/optee_os
> > [2]: https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/20442
>
> I don't see any bindings here. Am I supposed to study the code to
> figure out the binding? Please write a binding doc/schema if you want
> it reviewed.
>
> Rob
>
> [1] https://github.com/devicetree-org/dt-schema/blob/main/dtschema/schemas/options.yaml
Here is the patch of the binding, but I'm still not sure where is the
correct place to put the binding.
>From 2b828cc3c5aad0ff2c5bc2baea874d3a3fe8f1c3 Mon Sep 17 00:00:00 2001
From: Yi Chou <yich@xxxxxxxxxx>
Date: Wed, 14 Jun 2023 14:49:46 +0800
Subject: [PATCH] dt-bindings: Add Google Widevine initialize parameters
The necessary fields to initialize the widevine related functions in OP-TEE.
Change-Id: Iceb6c533bcb60034e811d4fdf9310d9df48507de
Signed-off-by: Yi Chou <yich@xxxxxxxxxx>
---
.../bindings/chosen/google,widevine.yaml | 61 +++++++++++++++++++
1 file changed, 61 insertions(+)
create mode 100644
Documentation/devicetree/bindings/chosen/google,widevine.yaml
diff --git a/Documentation/devicetree/bindings/chosen/google,widevine.yaml
b/Documentation/devicetree/bindings/chosen/google,widevine.yaml
new file mode 100644
index 0000000000000..2fc16b1a1fcc4
--- /dev/null
+++ b/Documentation/devicetree/bindings/chosen/google,widevine.yaml
@@ -0,0 +1,61 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/chosen/google,widevine.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Google Widevine initialize parameters.
+
+maintainers:
+ - Jeffrey Kardatzke <jkardatzke@xxxxxxxxxxxx>
+ - Yi Chou <yich@xxxxxxxxxxxx>
+
+description:
+ The necessary fields to initialize the widevine related functions in
+ OP-TEE. This node does not represent a real device, but serves as a
+ place for passing data between firmware and OP-TEE.
+
+properties:
+ compatible:
+ const: google,widevine
+
+ huk:
+ $ref: /schemas/types.yaml#/definitions/string
+ description:
+ The encryption key of the Widevine OP-TEE storage.
+
+ tpm-auth-pk:
+ $ref: /schemas/types.yaml#/definitions/string
+ description:
+ The TPM auth public key. Used to communicate the TPM from OP-TEE.
+
+ widevine-dice:
+ $ref: /schemas/types.yaml#/definitions/string
+ description:
+ The Widevine boot certificate chain(Device Identifier Composition
+ Engine) of this device. Used to provision the device status with
+ the Widevine server in OP-TEE.
+
+ widevine-ta-key:
+ $ref: /schemas/types.yaml#/definitions/string
+ description:
+ The Widevine private key corresponding to the widevine-dice.
+ Used to signing the widevine request in OP-TEE.
+
+required:
+ - compatible
+
+additionalProperties: false
+
+examples:
+ - |+
+ chosen {
+ widevine: {
+ compatible = "google,widevine";
+
+ huk = [00 de ad be af aa bb cc],
+ tpm-auth-pk = [00 de ad be af aa bb cc],
+ widevine-dice = [00 de ad be af aa bb cc],
+ widevine-ta-key = [00 de ad be af aa bb cc],
+ };
+ };
--
2.39.2
Sincerely,
Yi
