The kernel supports random.cpu=off and random.bootloader=off.
As TPM RNG is also registered as a hwrng, add the ability to
prevent registering the TPM RNG.
Suggested-by: Mateusz Schyboll <dragonn@xxxxx>
Signed-off-by: Mario Limonciello <mario.limonciello@xxxxxxx>
---
Documentation/admin-guide/kernel-parameters.txt | 5 +++++
drivers/char/tpm/tpm-chip.c | 10 ++++++++++
2 files changed, 15 insertions(+)
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index a1457995fd41c..9ff602c09f55c 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -4672,6 +4672,11 @@
passed by the bootloader (if available) to
initialize the kernel's RNG.
+ random.trust_tpm=off
+ [KNL] Disable trusting the use of the TPM's
+ random number generator (if available) to
+ initialize the kernel's RNG.
+
randomize_kstack_offset=
[KNL] Enable or disable kernel stack offset
randomization, which provides roughly 5 bits of
diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
index 8f61b784810d6..8fb42232bd7a5 100644
--- a/drivers/char/tpm/tpm-chip.c
+++ b/drivers/char/tpm/tpm-chip.c
@@ -32,6 +32,13 @@ struct class *tpm_class;
struct class *tpmrm_class;
dev_t tpm_devt;
+static bool trust_tpm __initdata = true;
+static int __init parse_trust_tpm(char *arg)
+{
+ return kstrtobool(arg, &trust_tpm);
+}
+early_param("random.trust_tpm", parse_trust_tpm);
+
static int tpm_request_locality(struct tpm_chip *chip)
{
int rc;
@@ -523,6 +530,9 @@ static int tpm_hwrng_read(struct hwrng *rng, void *data, size_t max, bool wait)
static int tpm_add_hwrng(struct tpm_chip *chip)
{
+ if (!trust_tpm)
+ chip->flags |= TPM_CHIP_FLAG_HWRNG_DISABLED;
+
if (!IS_ENABLED(CONFIG_HW_RANDOM_TPM) || tpm_is_firmware_upgrade(chip) ||
chip->flags & TPM_CHIP_FLAG_HWRNG_DISABLED)
return 0;
--
2.34.1
