src/security/intel/txt/txtlib.c

   1 /* SPDX-License-Identifier: GPL-2.0-only */
   2
   3 #include <arch/cpu.h>
   4 #include <cpu/intel/common/common.h>
   5 #include <cpu/x86/msr.h>
   6 #include <device/mmio.h>
   7 #include <security/intel/txt/txt.h>
   8 #include <security/tpm/tis.h>
   9 #include <timer.h>
  10
  11 #include "txtlib.h"
  12 #include "txt_register.h"
  13
  14 bool is_establishment_bit_asserted(void)
  15 {
  16         struct stopwatch timer;
  17         uint8_t access;
  18
  19         /* Spec says no less than 30 milliseconds */
  20         stopwatch_init_msecs_expire(&timer, 50);
  21
  22         while (true) {
  23                 access = read8p(TPM_ACCESS_REG);
  24
  25                 /* Register returns all ones if TPM is missing */
  26                 if (access == 0xff)
  27                         return false;
  28
  29                 if (access & TPM_ACCESS_VALID)
  30                         break;
  31
  32                 /* On timeout, assume that the TPM is not working */
  33                 if (stopwatch_expired(&timer))
  34                         return false;
  35         }
  36
  37         /* This bit uses inverted logic: if cleared, establishment is asserted */
  38         return !(access & TPM_ACCESS_ESTABLISHMENT);
  39 }
  40
  41 bool is_txt_cpu(void)
  42 {
  43         const uint32_t ecx = cpu_get_feature_flags_ecx();
  44
  45         return (ecx & (CPUID_SMX | CPUID_VMX)) == (CPUID_SMX | CPUID_VMX);
  46 }
  47
  48 static void unlock_txt_memory(void)
  49 {
  50         msr_t msrval = {0};
  51
  52         wrmsr(IA32_LT_UNLOCK_MEMORY, msrval);
  53 }
  54
  55 void disable_intel_txt(void)
  56 {
  57         /* Return if the CPU doesn't support TXT */
  58         if (!is_txt_cpu()) {
  59                 printk(BIOS_DEBUG, "Abort disabling TXT, as CPU is not TXT capable.\n");
  60                 return;
  61         }
  62
  63         /*
  64          * Memory is supposed to be locked if system is TXT capable
  65          * As per TXT BIOS spec Section 6.2.5 unlock memory
  66          * when security (TPM) is set and TXT is not enabled.
  67          */
  68         if (!is_establishment_bit_asserted()) {
  69                 unlock_txt_memory();
  70                 printk(BIOS_INFO, "TXT disabled successfully - Unlocked memory\n");
  71         }
  72 }