security/intel/txt: Add Intel TXT support

Add TXT ramstage driver:
 * Show startup errors
 * Check for TXT reset
 * Check for Secrets-in-memory
 * Add assembly for GETSEC instruction
 * Check platform state if GETSEC instruction is supported
 * Configure TXT memory regions
 * Lock TXT
 * Protect TSEG using DMA protected regions
 * Place SINIT ACM
 * Print information about ACMs

Extend the `security_clear_dram_request()` function:
 * Clear all DRAM if secrets are in memory

Add a config so that the code gets build-tested. Since BIOS and SINIT
ACM binaries are not available, use the STM binary as a placeholder.

Tested on OCP Wedge100s and Facebook Watson
 * Able to enter a Measured Launch Environment using SINIT ACM and TBOOT
 * Secrets in Memory bit is set on ungraceful shutdown
 * Memory is cleared after ungraceful shutdown

Change-Id: Iaf4be7f016cc12d3971e1e1fe171e6665e44c284
Signed-off-by: Philipp Deppenwiese <zaolin@das-labor.org>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/37016
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Christian Walter <christian.walter@9elements.com>

1 files changed, 27 insertions, 0 deletions

diff --git a/src/security/intel/txt/txt.h b/src/security/intel/txt/txt.h
new file mode 100644
index 0000000000..fc5c49e67e
--- /dev/null
+++ b/src/security/intel/txt/txt.h
@@ -0,0 +1,27 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+
+#ifndef SECURITY_INTEL_TXT_H_
+#define SECURITY_INTEL_TXT_H_
+
+#include <types.h>
+
+/* Error codes */
+#define ACM_E_TYPE_NOT_MATCH                0x01
+#define ACM_E_MODULE_SUB_TYPE_WRONG         0x02
+#define ACM_E_MODULE_VENDOR_NOT_INTEL       0x03
+#define ACM_E_SIZE_INCORRECT                0x04
+#define ACM_E_CANT_CALL_GETSEC              0x05
+#define ACM_E_NOT_FIT_INTO_CPU_ACM_MEM      0x06
+#define ACM_E_NO_INFO_TABLE                 0x07
+#define ACM_E_NOT_BIOS_ACM                  0x08
+#define ACM_E_UUID_NOT_MATCH                0x09
+#define ACM_E_PLATFORM_IS_NOT_PROD          0x10
+
+void intel_txt_log_bios_acm_error(void);
+int intel_txt_log_acm_error(const uint32_t acm_error);
+void intel_txt_log_spad(void);
+bool intel_txt_memory_has_secrets(void);
+int intel_txt_run_bios_acm(const u8 input_params);
+bool intel_txt_prepare_txt_env(void);
+
+#endif /* SECURITY_INTEL_TXT_H_ */