From fbd755341a45dc18a636d4c580e18f4343e16c82 Mon Sep 17 00:00:00 2001 From: Sean Rhodes Date: Sun, 1 Feb 2026 21:21:57 +0000 Subject: [PATCH] security/tcg: add OPAL S3 unlock Kconfig Add a generic configuration option for SMM-assisted TCG OPAL NVMe unlock on S3 resume. This also defines the APMC command IDs and the payload->SMM ABI structure used to pass the OPAL password into SMM. TEST=tested with rest of patch train Change-Id: Id99ace7c17a311b65519023be4118c5b20ddecf9 Signed-off-by: Sean Rhodes Reviewed-on: https://review.coreboot.org/c/coreboot/+/91043 Reviewed-by: Angel Pons Tested-by: build bot (Jenkins) --- src/include/cpu/x86/smm.h | 2 ++ src/include/security/tcg/opal_s3.h | 47 ++++++++++++++++++++++++++++ src/security/Kconfig | 1 + src/security/Makefile.mk | 1 + src/security/tcg/Kconfig | 7 +++++ src/security/tcg/Makefile.mk | 3 ++ src/security/tcg/opal_s3/Kconfig | 16 ++++++++++ src/security/tcg/opal_s3/Makefile.mk | 1 + 8 files changed, 78 insertions(+) create mode 100644 src/include/security/tcg/opal_s3.h create mode 100644 src/security/tcg/Kconfig create mode 100644 src/security/tcg/Makefile.mk create mode 100644 src/security/tcg/opal_s3/Kconfig create mode 100644 src/security/tcg/opal_s3/Makefile.mk diff --git a/src/include/cpu/x86/smm.h b/src/include/cpu/x86/smm.h index 26fc1d4abb..834874095f 100644 --- a/src/include/cpu/x86/smm.h +++ b/src/include/cpu/x86/smm.h @@ -28,6 +28,8 @@ #define APM_CNT_MBI_UPDATE 0xeb #define APM_CNT_SMMINFO 0xec #define APM_CNT_SMMSTORE 0xed +#define APM_CNT_OPAL_S3_UNLOCK 0xe9 +#define APM_CNT_OPAL_SVC 0xee #define APM_CNT_ELOG_GSMI 0xef #define APM_STS 0xb3 diff --git a/src/include/security/tcg/opal_s3.h b/src/include/security/tcg/opal_s3.h new file mode 100644 index 0000000000..666723c596 --- /dev/null +++ b/src/include/security/tcg/opal_s3.h @@ -0,0 +1,47 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ + +#ifndef SECURITY_TCG_OPAL_S3_H +#define SECURITY_TCG_OPAL_S3_H + +#include +#include + +/* + * ABI between payload software and the SMM OPAL S3 unlock handler. + * + * The payload is expected to place this structure in normal RAM and pass its + * address in RBX when calling call_smm(APM_CNT_OPAL_SVC, OPAL_SMM_SUBCMD_*, ctx). + */ + +#define OPAL_SMM_SUBCMD_SET_SECRET 0x01 +#define OPAL_SMM_SUBCMD_CLEAR_SECRET 0x02 + +#define OPAL_S3_SMM_CTX_SIGNATURE 0x3353504f /* "OPS3" */ +#define OPAL_S3_SMM_CTX_VERSION 0x0001 +/* + * Fixed size for a stable payload<->SMM ABI. + * + * Keep this as a constant (not a Kconfig option): changing it requires a + * coordinated payload update. + */ +#define OPAL_S3_MAX_PASSWORD_LEN 32 + +struct opal_s3_smm_ctx { + u32 signature; + u16 version; + u16 size; + + u8 bus; + u8 dev; + u8 func; + u8 reserved0; + + u16 base_comid; + u16 reserved1; + + u8 password_len; + u8 reserved2[3]; + u8 password[OPAL_S3_MAX_PASSWORD_LEN]; +} __packed; + +#endif diff --git a/src/security/Kconfig b/src/security/Kconfig index abbd0b86b8..b2f08e46dd 100644 --- a/src/security/Kconfig +++ b/src/security/Kconfig @@ -6,6 +6,7 @@ source "src/lib/Kconfig.cbfs_verification" source "src/security/vboot/Kconfig" source "src/security/tpm/Kconfig" +source "src/security/tcg/Kconfig" source "src/security/memory/Kconfig" source "src/security/intel/Kconfig" source "src/security/lockdown/Kconfig" diff --git a/src/security/Makefile.mk b/src/security/Makefile.mk index b7922d41d5..8892f0c1de 100644 --- a/src/security/Makefile.mk +++ b/src/security/Makefile.mk @@ -5,3 +5,4 @@ subdirs-y += tpm subdirs-y += memory subdirs-y += intel subdirs-y += lockdown +subdirs-y += tcg diff --git a/src/security/tcg/Kconfig b/src/security/tcg/Kconfig new file mode 100644 index 0000000000..78f78f81c2 --- /dev/null +++ b/src/security/tcg/Kconfig @@ -0,0 +1,7 @@ +# SPDX-License-Identifier: GPL-2.0-only + +menu "TCG storage" + +source "src/security/tcg/opal_s3/Kconfig" + +endmenu diff --git a/src/security/tcg/Makefile.mk b/src/security/tcg/Makefile.mk new file mode 100644 index 0000000000..69fc122b4e --- /dev/null +++ b/src/security/tcg/Makefile.mk @@ -0,0 +1,3 @@ +## SPDX-License-Identifier: GPL-2.0-only + +subdirs-y += opal_s3 diff --git a/src/security/tcg/opal_s3/Kconfig b/src/security/tcg/opal_s3/Kconfig new file mode 100644 index 0000000000..a34f34234e --- /dev/null +++ b/src/security/tcg/opal_s3/Kconfig @@ -0,0 +1,16 @@ +# SPDX-License-Identifier: GPL-2.0-only + +config TCG_OPAL_S3_UNLOCK + bool "SMM-assisted OPAL NVMe unlock on S3 resume" + depends on ARCH_X86 + depends on HAVE_SMI_HANDLER + depends on HAVE_ACPI_RESUME + depends on PCI + select SMM_OPAL_S3_SCRATCH_CBMEM + help + Provide an SMM handler that accepts an OPAL password for the current + sleep cycle and performs an NVMe Security Send/Receive unlock on S3 + resume. + + This is intended to be used by payloads which prompt the user for the + OPAL password and pass it to SMM before entering S3. diff --git a/src/security/tcg/opal_s3/Makefile.mk b/src/security/tcg/opal_s3/Makefile.mk new file mode 100644 index 0000000000..dc3225a9ec --- /dev/null +++ b/src/security/tcg/opal_s3/Makefile.mk @@ -0,0 +1 @@ +## SPDX-License-Identifier: GPL-2.0-only