diff --git a/src/include/cpu/intel/msr.h b/src/include/cpu/intel/msr.h
index 75c12a8be9..d3ff86dc32 100644
--- a/src/include/cpu/intel/msr.h
+++ b/src/include/cpu/intel/msr.h
@@ -15,6 +15,9 @@
 #define MSR_BC_PBEC		0x139
 #define  B_STOP_PBET		(1 << 0)
 
+#define MSR_IA32_DEBUG_INTERFACE	0xc80
+#define  MSR_IA32_DEBUG_INTERFACE_EN		(1 << 0)
+#define  MSR_IA32_DEBUG_INTERFACE_LOCK		(1 << 30)
 #define MSR_BOOT_GUARD_SACM_INFO	0x13a
 #define  V_TPM_PRESENT_MASK		0x06
 #define  B_BOOT_GUARD_SACM_INFO_NEM_ENABLED	(1 << 0)
diff --git a/src/soc/intel/cannonlake/fsp_params.c b/src/soc/intel/cannonlake/fsp_params.c
index df5fcee36f..f1db0f7d20 100644
--- a/src/soc/intel/cannonlake/fsp_params.c
+++ b/src/soc/intel/cannonlake/fsp_params.c
@@ -717,6 +717,15 @@ void platform_fsp_silicon_init_params_cb(FSPS_UPD *supd)
 	 */
 	s_cfg->SpiFlashCfgLockDown = lockdown_by_fsp;
 #endif
+	/*
+	 * IA32_DEBUG_INTERFACE_MSR has to be locked by coreboot,
+	 * because FSP does not do it unless DebugInterfaceEnable is 1.
+	 * But to use Intel TXT, the debug interface has to be disabled,
+	 * so let coreboot handle the IA32_DEBUG_INTERFACE_MSR programming.
+	 */
+	supd->FspsConfig.DebugInterfaceEnable = 0;
+	supd->FspsTestConfig.DebugInterfaceEnable = 0;
+	supd->FspsTestConfig.DebugInterfaceLockEnable = 0;
 
 #if !CONFIG(SOC_INTEL_COMETLAKE)
 	s_cfg->VrPowerDeliveryDesign = config->VrPowerDeliveryDesign;
diff --git a/src/soc/intel/cannonlake/lockdown.c b/src/soc/intel/cannonlake/lockdown.c
index 3205c7f303..c255858c57 100644
--- a/src/soc/intel/cannonlake/lockdown.c
+++ b/src/soc/intel/cannonlake/lockdown.c
@@ -1,11 +1,27 @@
 /* SPDX-License-Identifier: GPL-2.0-only */
 
+#include <cpu/intel/msr.h>
+#include <cpu/x86/msr.h>
 #include <device/mmio.h>
 #include <intelblocks/cfg.h>
 #include <intelblocks/pmclib.h>
 #include <intelpch/lockdown.h>
 #include <soc/pm.h>
 
+static void lock_debug_interface(void)
+{
+	msr_t msr = rdmsr(MSR_IA32_DEBUG_INTERFACE);
+
+	if (msr.lo & MSR_IA32_DEBUG_INTERFACE_LOCK)
+		return;
+
+	if (CONFIG(INTEL_TXT))
+		msr.lo &= ~MSR_IA32_DEBUG_INTERFACE_EN;
+
+	msr.lo |= MSR_IA32_DEBUG_INTERFACE_LOCK;
+	wrmsr(MSR_IA32_DEBUG_INTERFACE, msr);
+}
+
 static void pmc_lock_pmsync(void)
 {
 	uint8_t *pmcbase;
@@ -59,4 +75,5 @@ void soc_lockdown_config(int chipset_lockdown)
 {
 	/* PMC lock down configuration */
 	pmc_lockdown_cfg(chipset_lockdown);
+	lock_debug_interface();
 }