[Skiboot] [PATCH v2 07/12] core/flash.c: add SECBOOT read and write support

[Stefan Berger]

On 1/19/20 9:36 PM, Eric Richter wrote:
> From: Claudio Carvalho <cclaudio at linux.ibm.com>
>
> In secure boot enabled systems, the petitboot linux kernel verifies the
> OS kernel against x509 certificates that are wrapped in secure variables
> controlled by OPAL. These secure variables are stored in the PNOR SECBOOT
> partition, as well as the updates submitted for them using userspace
> tools.
>
> This patch adds read and write support to the PNOR SECBOOT partition in
> a similar fashion to that of NVRAM, so that OPAL can handle the secure
> variables.
>
> V2:
>   - lowered logging level for secboot_probe
>
> Signed-off-by: Claudio Carvalho <cclaudio at linux.ibm.com>
> Signed-off-by: Eric Richter <erichte at linux.ibm.com>
> ---
>   core/flash.c       | 130 +++++++++++++++++++++++++++++++++++++++++++++
>   include/platform.h |   4 ++
>   2 files changed, 134 insertions(+)
>
> diff --git a/core/flash.c b/core/flash.c
> index 7fbfca22..5fbc395a 100644
> --- a/core/flash.c
> +++ b/core/flash.c
> @@ -59,6 +59,10 @@ static struct lock flash_lock;
>   static struct flash *nvram_flash;
>   static u32 nvram_offset, nvram_size;
>   
> +/* secboot-on-flash support */
> +static struct flash *secboot_flash;
> +static u32 secboot_offset, secboot_size;
> +
>   bool flash_reserve(void)
>   {
>   	bool rc = false;
> @@ -93,6 +97,91 @@ bool flash_unregister(void)
>   	return true;
>   }
>   
> +static int flash_secboot_info(uint32_t *total_size)
> +{
> +	int rc;
> +
> +	lock(&flash_lock);
> +	if (!secboot_flash) {
> +		rc = OPAL_HARDWARE;
> +	} else if (secboot_flash->busy) {
> +		rc = OPAL_BUSY;
> +	} else {
> +		*total_size = secboot_size;
> +		rc = OPAL_SUCCESS;
> +	}
> +	unlock(&flash_lock);
> +
> +	return rc;
> +}
> +
> +static int flash_secboot_read(void *dst, uint32_t src, uint32_t len)
> +{
> +	int rc;
> +
> +	if (!try_lock(&flash_lock))
> +		return OPAL_BUSY;


Why not just a lock() here like in flash_secboot_info()? Would waiting 
for the lock take too long?


> +
> +	if (!secboot_flash) {
> +		rc = OPAL_HARDWARE;
> +		goto out;
> +	}
> +
> +	if (secboot_flash->busy) {
> +		rc = OPAL_BUSY;
> +		goto out;
> +	}
> +
> +	if ((src + len) > secboot_size) {
> +		prerror("FLASH_SECBOOT: read out of bound (0x%x,0x%x)\n",
> +			src, len);
> +		rc = OPAL_PARAMETER;
> +		goto out;
> +	}
> +
> +	secboot_flash->busy = true;
> +	unlock(&flash_lock);
> +
> +	rc = blocklevel_read(secboot_flash->bl, secboot_offset + src, dst, len);
> +
> +	lock(&flash_lock);
> +	secboot_flash->busy = false;
> +out:
> +	unlock(&flash_lock);
> +	return rc;
> +}
> +
> +static int flash_secboot_write(uint32_t dst, void *src, uint32_t len)
> +{
> +	int rc;
> +
> +	if (!try_lock(&flash_lock))
> +		return OPAL_BUSY;


Same here.