security/tcg: add OPAL S3 unlock Kconfig

Add a generic configuration option for SMM-assisted TCG OPAL NVMe
unlock on S3 resume.

This also defines the APMC command IDs and the payload->SMM ABI
structure used to pass the OPAL password into SMM.

TEST=tested with rest of patch train

Change-Id: Id99ace7c17a311b65519023be4118c5b20ddecf9
Signed-off-by: Sean Rhodes <sean@starlabs.systems>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/91043
Reviewed-by: Angel Pons <th3fanbus@gmail.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>

src/include/cpu/x86/smm.h

@@ -28,6 +28,8 @@
 #define APM_CNT_MBI_UPDATE	0xeb
 #define APM_CNT_SMMINFO		0xec
 #define APM_CNT_SMMSTORE	0xed
+#define APM_CNT_OPAL_S3_UNLOCK	0xe9
+#define APM_CNT_OPAL_SVC	0xee
 #define APM_CNT_ELOG_GSMI	0xef
 #define APM_STS		0xb3
 

src/include/security/tcg/opal_s3.h

@@ -0,0 +1,47 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+#ifndef SECURITY_TCG_OPAL_S3_H
+#define SECURITY_TCG_OPAL_S3_H
+
+#include <stddef.h>
+#include <types.h>
+
+/*
+ * ABI between payload software and the SMM OPAL S3 unlock handler.
+ *
+ * The payload is expected to place this structure in normal RAM and pass its
+ * address in RBX when calling call_smm(APM_CNT_OPAL_SVC, OPAL_SMM_SUBCMD_*, ctx).
+ */
+
+#define OPAL_SMM_SUBCMD_SET_SECRET   0x01
+#define OPAL_SMM_SUBCMD_CLEAR_SECRET 0x02
+
+#define OPAL_S3_SMM_CTX_SIGNATURE 0x3353504f /* "OPS3" */
+#define OPAL_S3_SMM_CTX_VERSION   0x0001
+/*
+ * Fixed size for a stable payload<->SMM ABI.
+ *
+ * Keep this as a constant (not a Kconfig option): changing it requires a
+ * coordinated payload update.
+ */
+#define OPAL_S3_MAX_PASSWORD_LEN 32
+
+struct opal_s3_smm_ctx {
+	u32 signature;
+	u16 version;
+	u16 size;
+
+	u8 bus;
+	u8 dev;
+	u8 func;
+	u8 reserved0;
+
+	u16 base_comid;
+	u16 reserved1;
+
+	u8 password_len;
+	u8 reserved2[3];
+	u8 password[OPAL_S3_MAX_PASSWORD_LEN];
+} __packed;
+
+#endif

src/security/Kconfig

@@ -6,6 +6,7 @@ source "src/lib/Kconfig.cbfs_verification"
 
 source "src/security/vboot/Kconfig"
 source "src/security/tpm/Kconfig"
+source "src/security/tcg/Kconfig"
 source "src/security/memory/Kconfig"
 source "src/security/intel/Kconfig"
 source "src/security/lockdown/Kconfig"

src/security/Makefile.mk

@@ -5,3 +5,4 @@ subdirs-y += tpm
 subdirs-y += memory
 subdirs-y += intel
 subdirs-y += lockdown
+subdirs-y += tcg

src/security/tcg/Kconfig

@@ -0,0 +1,7 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+menu "TCG storage"
+
+source "src/security/tcg/opal_s3/Kconfig"
+
+endmenu

src/security/tcg/Makefile.mk

@@ -0,0 +1,3 @@
+## SPDX-License-Identifier: GPL-2.0-only
+
+subdirs-y += opal_s3

src/security/tcg/opal_s3/Kconfig

@@ -0,0 +1,16 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+config TCG_OPAL_S3_UNLOCK
+	bool "SMM-assisted OPAL NVMe unlock on S3 resume"
+	depends on ARCH_X86
+	depends on HAVE_SMI_HANDLER
+	depends on HAVE_ACPI_RESUME
+	depends on PCI
+	select SMM_OPAL_S3_SCRATCH_CBMEM
+	help
+	  Provide an SMM handler that accepts an OPAL password for the current
+	  sleep cycle and performs an NVMe Security Send/Receive unlock on S3
+	  resume.
+
+	  This is intended to be used by payloads which prompt the user for the
+	  OPAL password and pass it to SMM before entering S3.

src/security/tcg/opal_s3/Makefile.mk

@@ -0,0 +1 @@
+## SPDX-License-Identifier: GPL-2.0-only