[GIT PULL] TPM DEVICE DRIVER changes for v7.4-rc1

[GIT PULL] TPM DEVICE DRIVER changes for v7.4-rc1

[Jarkko Sakkinen]

The following changes since commit 722658cac48a6ba49f5506fd74d010ad9dbb2f05:

  keys/trusted_keys: reuse TPM version in option handling (2026-10-20 18:15:40 +0300)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd.git tags/tpm-v7.4-rc1

for you to fetch changes up to 836952696d0260cca1de6d3300cd8fcd5687fe67:

  tpm: reject duplicate PCR banks in tpm2_get_pcr_allocation (2026-10-21 13:20:58 +0300)

----------------------------------------------------------------
tpm: changes for v7.4-rc1

FEATURES AND IMPROVEMENTS
=========================

- tpm_crb behaviour was improved by putting the chip into an idle state for
  each transmission. This improves firmware behavior as the kernel now
  better cancels its state as if it had never touched it in the first
  place.
- One spurious (but harmless) wmb() was dropped from tpm_pm_resume().
- tpm_tis_i2c now requests the optional reset control and deasserts it
  before communicating with the TPM.
- SIMPLE_DEV_PM_OPS was replaced with DEFINE_SIMPLE_DEV_PM_OPS across the
  whole driver stack.

BUGS
====

- tpm2_probe() misinterpreted a transport error on TPM2_GetCapability
  as the chip not being probed, and the chip was detected as a TPM 1 chip.
  This can happen in reality only in the extremely rare case of bus
  corruption. Despite the odds, a fix was landed, as it is still
  technically a legit bug fix.
- It is not really worth the time and energy to go into details as tpm_nsc
  is a somewhat legacy driver, but one null pointer dereference bug and
  another causing use-after-free were fixed.
- read() of /dev/tpm{,rm}0 with zero size caused a pending response to be
  consumed. This was fixed simply by an immediate return.

Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>

----------------------------------------------------------------
Alexander Sverdlin (1):
      tpm: tpm2_probe: propagate transport errors

Li Jun (2):
      char: tpm: Use SIMPLE_DEV_PM_OPS for ibmvtpm power management
      tpm: use DEFINE_SIMPLE_DEV_PM_OPS and pm_sleep_ptr()

Mario Limonciello (1):
      tpm: Call cmd_ready/go_idle for each command transmission

Pei Xiao (3):
      tpm: tpm_nsc: fix NULL pointer dereference on init failure
      tpm: tpm_nsc: stop using the cleanup callback as dev.release
      tpm: fix zero-length read discarding the pending response

Richard Lyu (1):
      tpm: Remove ineffective wmb() from tpm_pm_resume()

Stefano Radaelli (1):
      tpm: tis_i2c: Deassert optional reset line before probing

Yuqi Xu (1):
      tpm: reject duplicate PCR banks in tpm2_get_pcr_allocation

 drivers/char/tpm/tpm-chip.c          | 24 ------------------------
 drivers/char/tpm/tpm-dev-common.c    |  3 +++
 drivers/char/tpm/tpm-interface.c     | 28 ++++++++++++++++++++++------
 drivers/char/tpm/tpm2-cmd.c          | 21 ++++++++++++++++++++-
 drivers/char/tpm/tpm_atmel.c         |  4 ++--
 drivers/char/tpm/tpm_i2c_atmel.c     |  4 ++--
 drivers/char/tpm/tpm_i2c_infineon.c  |  4 ++--
 drivers/char/tpm/tpm_i2c_nuvoton.c   |  4 ++--
 drivers/char/tpm/tpm_ibmvtpm.c       |  5 +----
 drivers/char/tpm/tpm_infineon.c      |  7 +++----
 drivers/char/tpm/tpm_nsc.c           | 12 ++++++++----
 drivers/char/tpm/tpm_tis.c           |  4 ++--
 drivers/char/tpm/tpm_tis_core.h      |  2 --
 drivers/char/tpm/tpm_tis_i2c.c       | 16 ++++++++++++++--
 drivers/char/tpm/tpm_tis_i2c_cr50.c  |  4 ++--
 drivers/char/tpm/tpm_tis_spi_main.c  |  4 ++--
 drivers/char/tpm/tpm_tis_synquacer.c |  4 ++--
 17 files changed, 87 insertions(+), 63 deletions(-)

Re: [GIT PULL] TPM DEVICE DRIVER changes for v7.4-rc1

[Jarkko Sakkinen]

On Fri, Oct 23, 2026 at 06:05:05PM +0300, Jarkko Sakkinen wrote:
> The following changes since commit 722658cac48a6ba49f5506fd74d010ad9dbb2f05:
> 
>   keys/trusted_keys: reuse TPM version in option handling (2026-10-20 18:15:40 +0300)
> 
> are available in the Git repository at:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd.git tags/tpm-v7.4-rc1
> 
> for you to fetch changes up to 836952696d0260cca1de6d3300cd8fcd5687fe67:
> 
>   tpm: reject duplicate PCR banks in tpm2_get_pcr_allocation (2026-10-21 13:20:58 +0300)
> 
> ----------------------------------------------------------------
> tpm: changes for v7.4-rc1
> 
> FEATURES AND IMPROVEMENTS
> =========================
> 
> - tpm_crb behaviour was improved by putting the chip into an idle state for
>   each transmission. This improves firmware behavior as the kernel now
>   better cancels its state as if it had never touched it in the first
>   place.
> - One spurious (but harmless) wmb() was dropped from tpm_pm_resume().
> - tpm_tis_i2c now requests the optional reset control and deasserts it
>   before communicating with the TPM.
> - SIMPLE_DEV_PM_OPS was replaced with DEFINE_SIMPLE_DEV_PM_OPS across the
>   whole driver stack.
> 
> BUGS
> ====
> 
> - tpm2_probe() misinterpreted a transport error on TPM2_GetCapability
>   as the chip not being probed, and the chip was detected as a TPM 1 chip.
>   This can happen in reality only in the extremely rare case of bus
>   corruption. Despite the odds, a fix was landed, as it is still
>   technically a legit bug fix.
> - It is not really worth the time and energy to go into details as tpm_nsc
>   is a somewhat legacy driver, but one null pointer dereference bug and
>   another causing use-after-free were fixed.
> - read() of /dev/tpm{,rm}0 with zero size caused a pending response to be
>   consumed. This was fixed simply by an immediate return.
> 
> Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
> 
> ----------------------------------------------------------------
> Alexander Sverdlin (1):
>       tpm: tpm2_probe: propagate transport errors
> 
> Li Jun (2):
>       char: tpm: Use SIMPLE_DEV_PM_OPS for ibmvtpm power management
>       tpm: use DEFINE_SIMPLE_DEV_PM_OPS and pm_sleep_ptr()
> 
> Mario Limonciello (1):
>       tpm: Call cmd_ready/go_idle for each command transmission
> 
> Pei Xiao (3):
>       tpm: tpm_nsc: fix NULL pointer dereference on init failure
>       tpm: tpm_nsc: stop using the cleanup callback as dev.release
>       tpm: fix zero-length read discarding the pending response
> 
> Richard Lyu (1):
>       tpm: Remove ineffective wmb() from tpm_pm_resume()
> 
> Stefano Radaelli (1):
>       tpm: tis_i2c: Deassert optional reset line before probing
> 
> Yuqi Xu (1):
>       tpm: reject duplicate PCR banks in tpm2_get_pcr_allocation
> 
>  drivers/char/tpm/tpm-chip.c          | 24 ------------------------
>  drivers/char/tpm/tpm-dev-common.c    |  3 +++
>  drivers/char/tpm/tpm-interface.c     | 28 ++++++++++++++++++++++------
>  drivers/char/tpm/tpm2-cmd.c          | 21 ++++++++++++++++++++-
>  drivers/char/tpm/tpm_atmel.c         |  4 ++--
>  drivers/char/tpm/tpm_i2c_atmel.c     |  4 ++--
>  drivers/char/tpm/tpm_i2c_infineon.c  |  4 ++--
>  drivers/char/tpm/tpm_i2c_nuvoton.c   |  4 ++--
>  drivers/char/tpm/tpm_ibmvtpm.c       |  5 +----
>  drivers/char/tpm/tpm_infineon.c      |  7 +++----
>  drivers/char/tpm/tpm_nsc.c           | 12 ++++++++----
>  drivers/char/tpm/tpm_tis.c           |  4 ++--
>  drivers/char/tpm/tpm_tis_core.h      |  2 --
>  drivers/char/tpm/tpm_tis_i2c.c       | 16 ++++++++++++++--
>  drivers/char/tpm/tpm_tis_i2c_cr50.c  |  4 ++--
>  drivers/char/tpm/tpm_tis_spi_main.c  |  4 ++--
>  drivers/char/tpm/tpm_tis_synquacer.c |  4 ++--
>  17 files changed, 87 insertions(+), 63 deletions(-)
> 

My templates are a bit out-of-sync, thus the divergence in subject
lines. I'm working on my pull request scripts, and address this while at
it so that subjects, tags etc. have same stuff in the same format. Just
started distract me when I realized this after looking at what went to
lore so though to mention.

Br, Jarkko

Re: [GIT PULL] TPM DEVICE DRIVER changes for v7.4-rc1

[Jarkko Sakkinen]

On Fri, Oct 23, 2026 at 06:11:03PM +0300, Jarkko Sakkinen wrote:
> On Fri, Oct 23, 2026 at 06:05:05PM +0300, Jarkko Sakkinen wrote:
> > The following changes since commit 722658cac48a6ba49f5506fd74d010ad9dbb2f05:
> > 
> >   keys/trusted_keys: reuse TPM version in option handling (2026-10-20 18:15:40 +0300)
> > 
> > are available in the Git repository at:
> > 
> >   git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd.git tags/tpm-v7.4-rc1
> > 
> > for you to fetch changes up to 836952696d0260cca1de6d3300cd8fcd5687fe67:
> > 
> >   tpm: reject duplicate PCR banks in tpm2_get_pcr_allocation (2026-10-21 13:20:58 +0300)
> > 
> > ----------------------------------------------------------------
> > tpm: changes for v7.4-rc1
> > 
> > FEATURES AND IMPROVEMENTS
> > =========================
> > 
> > - tpm_crb behaviour was improved by putting the chip into an idle state for
> >   each transmission. This improves firmware behavior as the kernel now
> >   better cancels its state as if it had never touched it in the first
> >   place.
> > - One spurious (but harmless) wmb() was dropped from tpm_pm_resume().
> > - tpm_tis_i2c now requests the optional reset control and deasserts it
> >   before communicating with the TPM.
> > - SIMPLE_DEV_PM_OPS was replaced with DEFINE_SIMPLE_DEV_PM_OPS across the
> >   whole driver stack.
> > 
> > BUGS
> > ====
> > 
> > - tpm2_probe() misinterpreted a transport error on TPM2_GetCapability
> >   as the chip not being probed, and the chip was detected as a TPM 1 chip.
> >   This can happen in reality only in the extremely rare case of bus
> >   corruption. Despite the odds, a fix was landed, as it is still
> >   technically a legit bug fix.
> > - It is not really worth the time and energy to go into details as tpm_nsc
> >   is a somewhat legacy driver, but one null pointer dereference bug and
> >   another causing use-after-free were fixed.
> > - read() of /dev/tpm{,rm}0 with zero size caused a pending response to be
> >   consumed. This was fixed simply by an immediate return.
> > 
> > Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
> > 
> > ----------------------------------------------------------------
> > Alexander Sverdlin (1):
> >       tpm: tpm2_probe: propagate transport errors
> > 
> > Li Jun (2):
> >       char: tpm: Use SIMPLE_DEV_PM_OPS for ibmvtpm power management
> >       tpm: use DEFINE_SIMPLE_DEV_PM_OPS and pm_sleep_ptr()
> > 
> > Mario Limonciello (1):
> >       tpm: Call cmd_ready/go_idle for each command transmission
> > 
> > Pei Xiao (3):
> >       tpm: tpm_nsc: fix NULL pointer dereference on init failure
> >       tpm: tpm_nsc: stop using the cleanup callback as dev.release
> >       tpm: fix zero-length read discarding the pending response
> > 
> > Richard Lyu (1):
> >       tpm: Remove ineffective wmb() from tpm_pm_resume()
> > 
> > Stefano Radaelli (1):
> >       tpm: tis_i2c: Deassert optional reset line before probing
> > 
> > Yuqi Xu (1):
> >       tpm: reject duplicate PCR banks in tpm2_get_pcr_allocation
> > 
> >  drivers/char/tpm/tpm-chip.c          | 24 ------------------------
> >  drivers/char/tpm/tpm-dev-common.c    |  3 +++
> >  drivers/char/tpm/tpm-interface.c     | 28 ++++++++++++++++++++++------
> >  drivers/char/tpm/tpm2-cmd.c          | 21 ++++++++++++++++++++-
> >  drivers/char/tpm/tpm_atmel.c         |  4 ++--
> >  drivers/char/tpm/tpm_i2c_atmel.c     |  4 ++--
> >  drivers/char/tpm/tpm_i2c_infineon.c  |  4 ++--
> >  drivers/char/tpm/tpm_i2c_nuvoton.c   |  4 ++--
> >  drivers/char/tpm/tpm_ibmvtpm.c       |  5 +----
> >  drivers/char/tpm/tpm_infineon.c      |  7 +++----
> >  drivers/char/tpm/tpm_nsc.c           | 12 ++++++++----
> >  drivers/char/tpm/tpm_tis.c           |  4 ++--
> >  drivers/char/tpm/tpm_tis_core.h      |  2 --
> >  drivers/char/tpm/tpm_tis_i2c.c       | 16 ++++++++++++++--
> >  drivers/char/tpm/tpm_tis_i2c_cr50.c  |  4 ++--
> >  drivers/char/tpm/tpm_tis_spi_main.c  |  4 ++--
> >  drivers/char/tpm/tpm_tis_synquacer.c |  4 ++--
> >  17 files changed, 87 insertions(+), 63 deletions(-)
> > 
> 
> My templates are a bit out-of-sync, thus the divergence in subject
> lines. I'm working on my pull request scripts, and address this while at
> it so that subjects, tags etc. have same stuff in the same format. Just
> started distract me when I realized this after looking at what went to
> lore so though to mention.
> 
> Br, Jarkko

I need to redo this PR mishap happened with linux-next so please ignore.
I had my own tree in wrong state.

For tags and subject I'll use MAINTAINERS defined subsystem name.

Br, Jarkko

[GIT PULL] TPM DEVICE DRIVER changes for v7.4-rc1

[Jarkko Sakkinen]

I double-checked that this is now in-sync with linux-next.

I'll address this issue permanently by implementing linux-next
validation to my script that prepares the PR, as that would
have prevented this from happening.

The following changes since commit a1c2b1da93f5f612aa7a33190c4900c98e51f6da:

  Merge tag 'for-linus-tsm' of https://github.com/jgunthorpe/linux (2026-10-22 10:41:18 -1000)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd.git tags/tpm-v7.4-rc1-rebased

for you to fetch changes up to 071aa806f00cf2948ce8082102d5f64515f53215:

  tpm: reject duplicate PCR banks in tpm2_get_pcr_allocation (2026-10-23 00:59:21 +0300)

----------------------------------------------------------------
[GIT PULL] TPM DEVICE DRIVER changes for v7.4-rc1

I had to revise my pull request because it came out with a stale tag.
Apologies for that. While at it I refined my scripts to not have coherency
issues.

All the content remains the same with no changes but I noticed one entry
missing from the list in the next section, so I added that.

FEATURES AND IMPROVEMENTS
=========================

- tpm_crb behaviour was improved by putting the chip into an idle state for
  each transmission. This improves firmware behavior as the kernel now
  better cancels its state as if it had never touched it in the first
  place.
- One spurious (but harmless) wmb() was dropped from tpm_pm_resume().
- tpm_tis_i2c now requests the optional reset control and deasserts it
  before communicating with the TPM.
- SIMPLE_DEV_PM_OPS was replaced with DEFINE_SIMPLE_DEV_PM_OPS across the
  whole driver stack.
- Validate during driver initialization that no duplicate banks are
  received. It's unlikely corruption but since it happening would
  cause oops I decided to retain it as a sanity check.

BUGS
====

- tpm2_probe() misinterpreted a transport error on TPM2_GetCapability
  as the chip not being probed, and the chip was detected as a TPM 1 chip.
  This can happen in reality only in the extremely rare case of bus
  corruption. Despite the odds, a fix was landed, as it is still
  technically a legit bug fix.
- It is not really worth the time and energy to go into details as tpm_nsc
  is a somewhat legacy driver, but one null pointer dereference bug and
  another causing use-after-free were fixed.
- read() of /dev/tpm{,rm}0 with zero size caused a pending response to be
  consumed. This was fixed simply by an immediate return.

Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>

----------------------------------------------------------------
Alexander Sverdlin (1):
      tpm: tpm2_probe: propagate transport errors

Li Jun (2):
      char: tpm: Use SIMPLE_DEV_PM_OPS for ibmvtpm power management
      tpm: use DEFINE_SIMPLE_DEV_PM_OPS and pm_sleep_ptr()

Mario Limonciello (1):
      tpm: Call cmd_ready/go_idle for each command transmission

Pei Xiao (3):
      tpm: tpm_nsc: fix NULL pointer dereference on init failure
      tpm: tpm_nsc: stop using the cleanup callback as dev.release
      tpm: fix zero-length read discarding the pending response

Richard Lyu (1):
      tpm: Remove ineffective wmb() from tpm_pm_resume()

Stefano Radaelli (1):
      tpm: tis_i2c: Deassert optional reset line before probing

Yuqi Xu (1):
      tpm: reject duplicate PCR banks in tpm2_get_pcr_allocation

 drivers/char/tpm/tpm-chip.c          | 24 ------------------------
 drivers/char/tpm/tpm-dev-common.c    |  3 +++
 drivers/char/tpm/tpm-interface.c     | 28 ++++++++++++++++++++++------
 drivers/char/tpm/tpm2-cmd.c          | 21 ++++++++++++++++++++-
 drivers/char/tpm/tpm_atmel.c         |  4 ++--
 drivers/char/tpm/tpm_i2c_atmel.c     |  4 ++--
 drivers/char/tpm/tpm_i2c_infineon.c  |  4 ++--
 drivers/char/tpm/tpm_i2c_nuvoton.c   |  4 ++--
 drivers/char/tpm/tpm_ibmvtpm.c       |  5 +----
 drivers/char/tpm/tpm_infineon.c      |  7 +++----
 drivers/char/tpm/tpm_nsc.c           | 12 ++++++++----
 drivers/char/tpm/tpm_tis.c           |  4 ++--
 drivers/char/tpm/tpm_tis_core.h      |  2 --
 drivers/char/tpm/tpm_tis_i2c.c       | 16 ++++++++++++++--
 drivers/char/tpm/tpm_tis_i2c_cr50.c  |  4 ++--
 drivers/char/tpm/tpm_tis_spi_main.c  |  4 ++--
 drivers/char/tpm/tpm_tis_synquacer.c |  4 ++--
 17 files changed, 87 insertions(+), 63 deletions(-)