1 files changed, 18 insertions, 0 deletions

diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 14daf4848f09..f802dbce41ae 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -2690,6 +2690,24 @@ static unsigned int ata_scsi_pass_thru(struct ata_queued_cmd *qc)
         if ((tf->protocol = ata_scsi_map_proto(cdb[1])) == ATA_PROT_UNKNOWN)
                 goto invalid_fld;
 
+        /*
+         * Filter TPM commands by default. These provide an
+         * essentially uncontrolled encrypted "back door" between
+         * applications and the disk. Set libata.allow_tpm=1 if you
+         * have a real reason for wanting to use them. This ensures
+         * that installed software cannot easily mess stuff up without
+         * user intent. DVR type users will probably ship with this enabled
+         * for movie content management.
+         *
+         * Note that for ATA8 we can issue a DCS change and DCS freeze lock
+         * for this and should do in future but that it is not sufficient as
+         * DCS is an optional feature set. Thus we also do the software filter
+         * so that we comply with the TC consortium stated goal that the user
+         * can turn off TC features of their system.
+         */
+        if (tf->command >= 0x5C && tf->command <= 0x5F && !libata_allow_tpm)
+                goto invalid_fld;
+
         /* We may not issue DMA commands if no DMA mode is set */
         if (tf->protocol == ATA_PROT_DMA && dev->dma_mode == 0)
                 goto invalid_fld;