This is a note to let you know that I've just added the patch titled
tpm: Enable hwrng only for Pluton on AMD CPUs
to the 6.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
tpm-enable-hwrng-only-for-pluton-on-amd-cpus.patch
and it can be found in the queue-6.1 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 8f7f35e5aa6f2182eabcfa3abef4d898a48e9aa8 Mon Sep 17 00:00:00 2001
From: Jarkko Sakkinen <jarkko@xxxxxxxxxx>
Date: Mon, 4 Sep 2023 21:12:10 +0300
Subject: tpm: Enable hwrng only for Pluton on AMD CPUs
From: Jarkko Sakkinen <jarkko@xxxxxxxxxx>
commit 8f7f35e5aa6f2182eabcfa3abef4d898a48e9aa8 upstream.
The vendor check introduced by commit 554b841d4703 ("tpm: Disable RNG for
all AMD fTPMs") doesn't work properly on a number of Intel fTPMs. On the
reported systems the TPM doesn't reply at bootup and returns back the
command code. This makes the TPM fail probe on Lenovo Legion Y540 laptop.
Since only Microsoft Pluton is the only known combination of AMD CPU and
fTPM from other vendor, disable hwrng otherwise. In order to make sysadmin
aware of this, print also info message to the klog.
Cc: stable@xxxxxxxxxxxxxxx
Fixes: 554b841d4703 ("tpm: Disable RNG for all AMD fTPMs")
Reported-by: Todd Brandt <todd.e.brandt@xxxxxxxxx>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217804
Reported-by: Patrick Steinhardt <ps@xxxxxx>
Reported-by: Raymond Jay Golo <rjgolo@xxxxxxxxx>
Reported-by: Ronan Pigott <ronan@xxxxxx>
Reviewed-by: Jerry Snitselaar <jsnitsel@xxxxxxxxxx>
Signed-off-by: Jarkko Sakkinen <jarkko@xxxxxxxxxx>
Cc: Thorsten Leemhuis <regressions@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/char/tpm/tpm_crb.c | 33 ++++++++-------------------------
1 file changed, 8 insertions(+), 25 deletions(-)
--- a/drivers/char/tpm/tpm_crb.c
+++ b/drivers/char/tpm/tpm_crb.c
@@ -463,28 +463,6 @@ static bool crb_req_canceled(struct tpm_
return (cancel & CRB_CANCEL_INVOKE) == CRB_CANCEL_INVOKE;
}
-static int crb_check_flags(struct tpm_chip *chip)
-{
- u32 val;
- int ret;
-
- ret = crb_request_locality(chip, 0);
- if (ret)
- return ret;
-
- ret = tpm2_get_tpm_pt(chip, TPM2_PT_MANUFACTURER, &val, NULL);
- if (ret)
- goto release;
-
- if (val == 0x414D4400U /* AMD */)
- chip->flags |= TPM_CHIP_FLAG_HWRNG_DISABLED;
-
-release:
- crb_relinquish_locality(chip, 0);
-
- return ret;
-}
-
static const struct tpm_class_ops tpm_crb = {
.flags = TPM_OPS_AUTO_STARTUP,
.status = crb_status,
@@ -826,9 +804,14 @@ static int crb_acpi_add(struct acpi_devi
if (rc)
goto out;
- rc = crb_check_flags(chip);
- if (rc)
- goto out;
+#ifdef CONFIG_X86
+ /* A quirk for https://www.amd.com/en/support/kb/faq/pa-410 */
+ if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD &&
+ priv->sm != ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON) {
+ dev_info(dev, "Disabling hwrng\n");
+ chip->flags |= TPM_CHIP_FLAG_HWRNG_DISABLED;
+ }
+#endif /* CONFIG_X86 */
rc = tpm_chip_register(chip);
Patches currently in stable-queue which might be from jarkko@xxxxxxxxxx are
queue-6.1/tpm-enable-hwrng-only-for-pluton-on-amd-cpus.patch
queue-6.1/security-keys-perform-capable-check-only-on-privileg.patch
