[Skiboot] [PATCH v2 0/9] Add Secure Variable Support

[Eric Richter]

The previous implementation "Initial Skiboot Secure Variable Support"
tied the OPAL runtime service API too tightly to the variable processing
backend. Therefore, if the variable processing design had to be changed
or updated, so did the API. This patch set redesigns the previous set to
support a generic OPAL API, and pluggable drivers for persistent variable
storage and variable processing.

Platforms may support different storage hardware, therefore a platform
must be able to select the proper storage driver for persisting variables. 

Platforms may also select the backend used to manipulate secure variables.
The backend determines the format in which the variables are stored, and
how the variables are authenticated and updated. 

This patch set includes the base implementation to support secure
variables, and the updated OPAL runtime service API. This set also
includes draft implementations for a pnor-based storage driver, and an
edk2-derived backend driver. This backend driver depends on mbedtls-based
crypto support, which will be in a separate forthcoming patch set. The
draft implementation of the backend driver has the crypto-dependent code
commented out for sake of compilation.

Changes in V2:
 - ibm,secureboot compatible is set to -v3
 - added secvar device tree node
 - removed opal_secvar_backend
 - added API and secvar DT node documentation
 - minor fixes/changes (see patch descriptions)

Claudio Carvalho (1):
  core/flash.c: add SECBOOT read and write support

Eric Richter (6):
  libstb/secvar: add secure variable internal abstraction
  secureboot: initialize secure variables if supported by the platform
  libstb/secvar: add secvar api implementation
  doc: add opal secure variable documentation
  secvar/storage: add draft secvar storage driver for pnor-based p9
    platforms
  witherspoon: enable secvar for witherspoon platform

Nayna Jain (2):
  secvar/backend: add edk2 headers to support edk2 derived backend
  secvar/backend: add edk2 derived key updates processing

 ccan/list/list.h                              |  38 ++
 core/flash.c                                  | 130 +++++
 doc/device-tree/ibm,secureboot.rst            |  10 +
 doc/device-tree/secvar.rst                    |  40 ++
 doc/opal-api/opal-secvar.rst                  | 267 +++++++++
 include/opal-api.h                            |   6 +-
 include/platform.h                            |   5 +
 include/secvar.h                              |  49 ++
 libstb/Makefile.inc                           |   3 +-
 libstb/secureboot.c                           |  23 +
 libstb/secvar/Makefile.inc                    |  14 +
 libstb/secvar/backend/Makefile.inc            |  11 +
 libstb/secvar/backend/edk2-compat/data.h      |  70 +++
 .../secvar/backend/edk2-compat/edk2-compat.c  | 536 ++++++++++++++++++
 libstb/secvar/backend/edk2-compat/edk2.h      | 249 ++++++++
 libstb/secvar/secvar.h                        |  75 +++
 libstb/secvar/secvar_api.c                    | 215 +++++++
 libstb/secvar/secvar_main.c                   | 117 ++++
 libstb/secvar/secvar_util.c                   |  88 +++
 libstb/secvar/storage/Makefile.inc            |  11 +
 libstb/secvar/storage/secboot_p9.c            | 242 ++++++++
 platforms/astbmc/witherspoon.c                |   7 +
 22 files changed, 2204 insertions(+), 2 deletions(-)
 create mode 100644 doc/device-tree/secvar.rst
 create mode 100644 doc/opal-api/opal-secvar.rst
 create mode 100644 include/secvar.h
 create mode 100644 libstb/secvar/Makefile.inc
 create mode 100644 libstb/secvar/backend/Makefile.inc
 create mode 100644 libstb/secvar/backend/edk2-compat/data.h
 create mode 100644 libstb/secvar/backend/edk2-compat/edk2-compat.c
 create mode 100644 libstb/secvar/backend/edk2-compat/edk2.h
 create mode 100644 libstb/secvar/secvar.h
 create mode 100644 libstb/secvar/secvar_api.c
 create mode 100644 libstb/secvar/secvar_main.c
 create mode 100644 libstb/secvar/secvar_util.c
 create mode 100644 libstb/secvar/storage/Makefile.inc
 create mode 100644 libstb/secvar/storage/secboot_p9.c

-- 
2.20.1