blob: 6ce86a3e918a8e8146186d5969224219a5cc6be6 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
|
/* SPDX-License-Identifier: GPL-2.0-only */
#include <arch/cpu.h>
#include <cpu/intel/common/common.h>
#include <cpu/x86/msr.h>
#include <device/mmio.h>
#include <security/intel/txt/txt.h>
#include <security/tpm/tis.h>
#include <timer.h>
#include "txtlib.h"
#include "txt_register.h"
bool is_establishment_bit_asserted(void)
{
struct stopwatch timer;
uint8_t access;
/* Spec says no less than 30 milliseconds */
stopwatch_init_msecs_expire(&timer, 50);
while (true) {
access = read8p(TPM_ACCESS_REG);
/* Register returns all ones if TPM is missing */
if (access == 0xff)
return false;
if (access & TPM_ACCESS_VALID)
break;
/* On timeout, assume that the TPM is not working */
if (stopwatch_expired(&timer))
return false;
}
/* This bit uses inverted logic: if cleared, establishment is asserted */
return !(access & TPM_ACCESS_ESTABLISHMENT);
}
bool is_txt_cpu(void)
{
const uint32_t ecx = cpu_get_feature_flags_ecx();
return (ecx & (CPUID_SMX | CPUID_VMX)) == (CPUID_SMX | CPUID_VMX);
}
static void unlock_txt_memory(void)
{
msr_t msrval = {0};
wrmsr(IA32_LT_UNLOCK_MEMORY, msrval);
}
void disable_intel_txt(void)
{
/* Return if the CPU doesn't support TXT */
if (!is_txt_cpu()) {
printk(BIOS_DEBUG, "Abort disabling TXT, as CPU is not TXT capable.\n");
return;
}
/*
* Memory is supposed to be locked if system is TXT capable
* As per TXT BIOS spec Section 6.2.5 unlock memory
* when security (TPM) is set and TXT is not enabled.
*/
if (!is_establishment_bit_asserted()) {
unlock_txt_memory();
printk(BIOS_INFO, "TXT disabled successfully - Unlocked memory\n");
}
}
|