1*4882a593Smuzhiyun* ARM Secure world bindings 2*4882a593Smuzhiyun 3*4882a593SmuzhiyunARM CPUs with TrustZone support have two distinct address spaces, 4*4882a593Smuzhiyun"Normal" and "Secure". Most devicetree consumers (including the Linux 5*4882a593Smuzhiyunkernel) are not TrustZone aware and run entirely in either the Normal 6*4882a593Smuzhiyunworld or the Secure world. However some devicetree consumers are 7*4882a593SmuzhiyunTrustZone aware and need to be able to determine whether devices are 8*4882a593Smuzhiyunvisible only in the Secure address space, only in the Normal address 9*4882a593Smuzhiyunspace, or visible in both. (One example of that situation would be a 10*4882a593Smuzhiyunvirtual machine which boots Secure firmware and wants to tell the 11*4882a593Smuzhiyunfirmware about the layout of the machine via devicetree.) 12*4882a593Smuzhiyun 13*4882a593SmuzhiyunThe general principle of the naming scheme for Secure world bindings 14*4882a593Smuzhiyunis that any property that needs a different value in the Secure world 15*4882a593Smuzhiyuncan be supported by prefixing the property name with "secure-". So for 16*4882a593Smuzhiyuninstance "secure-foo" would override "foo". For property names with 17*4882a593Smuzhiyuna vendor prefix, the Secure variant of "vendor,foo" would be 18*4882a593Smuzhiyun"vendor,secure-foo". If there is no "secure-" property then the Secure 19*4882a593Smuzhiyunworld value is the same as specified for the Normal world by the 20*4882a593Smuzhiyunnon-prefixed property. However, only the properties listed below may 21*4882a593Smuzhiyunvalidly have "secure-" versions; this list will be enlarged on a 22*4882a593Smuzhiyuncase-by-case basis. 23*4882a593Smuzhiyun 24*4882a593SmuzhiyunDefining the bindings in this way means that a device tree which has 25*4882a593Smuzhiyunbeen annotated to indicate the presence of Secure-only devices can 26*4882a593Smuzhiyunstill be processed unmodified by existing Non-secure software (and in 27*4882a593Smuzhiyunparticular by the kernel). 28*4882a593Smuzhiyun 29*4882a593SmuzhiyunNote that it is still valid for bindings intended for purely Secure 30*4882a593Smuzhiyunworld consumers (like kernels that run entirely in Secure) to simply 31*4882a593Smuzhiyundescribe the view of Secure world using the standard bindings. These 32*4882a593Smuzhiyunsecure- bindings only need to be used where both the Secure and Normal 33*4882a593Smuzhiyunworld views need to be described in a single device tree. 34*4882a593Smuzhiyun 35*4882a593SmuzhiyunValid Secure world properties 36*4882a593Smuzhiyun----------------------------- 37*4882a593Smuzhiyun 38*4882a593Smuzhiyun- secure-status : specifies whether the device is present and usable 39*4882a593Smuzhiyun in the secure world. The combination of this with "status" allows 40*4882a593Smuzhiyun the various possible combinations of device visibility to be 41*4882a593Smuzhiyun specified. If "secure-status" is not specified it defaults to the 42*4882a593Smuzhiyun same value as "status"; if "status" is not specified either then 43*4882a593Smuzhiyun both default to "okay". This means the following combinations are 44*4882a593Smuzhiyun possible: 45*4882a593Smuzhiyun 46*4882a593Smuzhiyun /* Neither specified: default to visible in both S and NS */ 47*4882a593Smuzhiyun secure-status = "okay"; /* visible in both */ 48*4882a593Smuzhiyun status = "okay"; /* visible in both */ 49*4882a593Smuzhiyun status = "okay"; secure-status = "okay"; /* visible in both */ 50*4882a593Smuzhiyun secure-status = "disabled"; /* NS-only */ 51*4882a593Smuzhiyun status = "okay"; secure-status = "disabled"; /* NS-only */ 52*4882a593Smuzhiyun status = "disabled"; secure-status = "okay"; /* S-only */ 53*4882a593Smuzhiyun status = "disabled"; /* disabled in both */ 54*4882a593Smuzhiyun status = "disabled"; secure-status = "disabled"; /* disabled in both */ 55*4882a593Smuzhiyun 56*4882a593SmuzhiyunThe secure-chosen node 57*4882a593Smuzhiyun---------------------- 58*4882a593Smuzhiyun 59*4882a593SmuzhiyunSimilar to the /chosen node which serves as a place for passing data 60*4882a593Smuzhiyunbetween firmware and the operating system, the /secure-chosen node may 61*4882a593Smuzhiyunbe used to pass data to the Secure OS. Only the properties defined 62*4882a593Smuzhiyunbelow may appear in the /secure-chosen node. 63*4882a593Smuzhiyun 64*4882a593Smuzhiyun- stdout-path : specifies the device to be used by the Secure OS for 65*4882a593Smuzhiyun its console output. The syntax is the same as for /chosen/stdout-path. 66*4882a593Smuzhiyun If the /secure-chosen node exists but the stdout-path property is not 67*4882a593Smuzhiyun present, the Secure OS should not perform any console output. If 68*4882a593Smuzhiyun /secure-chosen does not exist, the Secure OS should use the value of 69*4882a593Smuzhiyun /chosen/stdout-path instead (that is, use the same device as the 70*4882a593Smuzhiyun Normal world OS). 71