1 /* SPDX-License-Identifier: GPL-2.0-only */ 2 3 #include <arch/cpu.h> 4 #include <cpu/intel/common/common.h> 5 #include <cpu/x86/msr.h> 6 #include <device/mmio.h> 7 #include <security/intel/txt/txt.h> 8 #include <security/tpm/tis.h> 9 #include <timer.h> 10 11 #include "txtlib.h" 12 #include "txt_register.h" 13 is_establishment_bit_asserted(void)14bool is_establishment_bit_asserted(void) 15 { 16 struct stopwatch timer; 17 uint8_t access; 18 19 /* Spec says no less than 30 milliseconds */ 20 stopwatch_init_msecs_expire(&timer, 50); 21 22 while (true) { 23 access = read8p(TPM_ACCESS_REG); 24 25 /* Register returns all ones if TPM is missing */ 26 if (access == 0xff) 27 return false; 28 29 if (access & TPM_ACCESS_VALID) 30 break; 31 32 /* On timeout, assume that the TPM is not working */ 33 if (stopwatch_expired(&timer)) 34 return false; 35 } 36 37 /* This bit uses inverted logic: if cleared, establishment is asserted */ 38 return !(access & TPM_ACCESS_ESTABLISHMENT); 39 } 40 is_txt_cpu(void)41bool is_txt_cpu(void) 42 { 43 const uint32_t ecx = cpu_get_feature_flags_ecx(); 44 45 return (ecx & (CPUID_SMX | CPUID_VMX)) == (CPUID_SMX | CPUID_VMX); 46 } 47 unlock_txt_memory(void)48static void unlock_txt_memory(void) 49 { 50 msr_t msrval = {0}; 51 52 wrmsr(IA32_LT_UNLOCK_MEMORY, msrval); 53 } 54 disable_intel_txt(void)55void disable_intel_txt(void) 56 { 57 /* Return if the CPU doesn't support TXT */ 58 if (!is_txt_cpu()) { 59 printk(BIOS_DEBUG, "Abort disabling TXT, as CPU is not TXT capable.\n"); 60 return; 61 } 62 63 /* 64 * Memory is supposed to be locked if system is TXT capable 65 * As per TXT BIOS spec Section 6.2.5 unlock memory 66 * when security (TPM) is set and TXT is not enabled. 67 */ 68 if (!is_establishment_bit_asserted()) { 69 unlock_txt_memory(); 70 printk(BIOS_INFO, "TXT disabled successfully - Unlocked memory\n"); 71 } 72 } 73