[PATCH 2/3] tpm: Add command line for not trusting tpm for RNG

[Mario Limonciello <mario.limonciello@amd.com>]

The kernel supports random.cpu=off and random.bootloader=off.
As TPM RNG is also registered as a hwrng, add the ability to
prevent registering the TPM RNG.

Suggested-by: Mateusz Schyboll <dragonn@op.pl>
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
---
 Documentation/admin-guide/kernel-parameters.txt |  5 +++++
 drivers/char/tpm/tpm-chip.c                     | 10 ++++++++++
 2 files changed, 15 insertions(+)

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index a1457995fd41c..9ff602c09f55c 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -4672,6 +4672,11 @@
 			passed by the bootloader (if available) to
 			initialize the kernel's RNG.
 
+	random.trust_tpm=off
+			[KNL] Disable trusting the use of the TPM's
+			random number generator (if available) to
+			initialize the kernel's RNG.
+
 	randomize_kstack_offset=
 			[KNL] Enable or disable kernel stack offset
 			randomization, which provides roughly 5 bits of
diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
index 8f61b784810d6..8fb42232bd7a5 100644
--- a/drivers/char/tpm/tpm-chip.c
+++ b/drivers/char/tpm/tpm-chip.c
@@ -32,6 +32,13 @@ struct class *tpm_class;
 struct class *tpmrm_class;
 dev_t tpm_devt;
 
+static bool trust_tpm __initdata = true;
+static int __init parse_trust_tpm(char *arg)
+{
+	return kstrtobool(arg, &trust_tpm);
+}
+early_param("random.trust_tpm", parse_trust_tpm);
+
 static int tpm_request_locality(struct tpm_chip *chip)
 {
 	int rc;
@@ -523,6 +530,9 @@ static int tpm_hwrng_read(struct hwrng *rng, void *data, size_t max, bool wait)
 
 static int tpm_add_hwrng(struct tpm_chip *chip)
 {
+	if (!trust_tpm)
+		chip->flags |= TPM_CHIP_FLAG_HWRNG_DISABLED;
+
 	if (!IS_ENABLED(CONFIG_HW_RANDOM_TPM) || tpm_is_firmware_upgrade(chip) ||
 	    chip->flags & TPM_CHIP_FLAG_HWRNG_DISABLED)
 		return 0;
-- 
2.34.1