[PATCH v3 0/4] tpm: Cache ACPI TPM2 start method and gate tpm_crb_ffa probe

[PATCH v3 0/4] tpm: Cache ACPI TPM2 start method and gate tpm_crb_ffa probe

[Siddharth Chintamaneni]

This series caches the ACPI TPM2 start method in tpm_init() and uses
the cached tpm2_acpi_start_method value across tpm_crb_ffa, tpm_tis,
and tpm_crb.

Patch 1 caches the ACPI TPM2 start method once in tpm_init() into
tpm2_acpi_start_method (defaulting to ACPI_TPM2_NOT_ALLOWED when
absent or invalid) and logs it when a TPM2 ACPI table is present.
Patch 2 checks tpm2_acpi_start_method in tpm_crb_ffa_probe() and
returns -ENODEV unless ACPI advertises ACPI_TPM2_CRB_WITH_ARM_FFA,
skipping FF-A probing on non-FF-A platforms while keeping modular
tpm_crb/tpm_crb_ffa loading intact.
Patches 3 and 4 update tpm_tis and tpm_crb to use the cached
tpm2_acpi_start_method value directly.

Changes in v3:
- Log tpm2_acpi_start_method in tpm_init() after acpi_put_table() and
  use a single-line acpi_get_table() call with typeof(tbl->header)
  cast (Jarkko Sakkinen).
- Remove check_acpi_tpm2() in tpm_tis and open-code the check in
  tpm_tis_init(), dropping dev_err() and returning -ENODEV (Jarkko
  Sakkinen).
- Remove priv->sm and local sm in tpm_crb, use tpm2_acpi_start_method
  throughout, drop the probe dev_err() messages, and return -ENODEV
  (Jarkko Sakkinen).

Changes in v2:
- Expand into a 4-patch series caching tpm2_acpi_start_method in
  tpm_init() and converting tpm_crb_ffa, tpm_tis, and tpm_crb to use
  it (Jarkko Sakkinen).
- Move the tpm_crb_ffa start_method check from module_init into
  tpm_crb_ffa_probe() so tpm_crb.ko and tpm_crb_ffa.ko still load
  cleanly on non-FF-A systems when built as modules.

v2: https://lore.kernel.org/linux-integrity/20261114193434.117714-1-sidchintamaneni@gmail.com/
v1: https://lore.kernel.org/linux-integrity/20261112233807.70664-1-sidchintamaneni@gmail.com/

Jarkko Sakkinen (1):
  tpm: Cache TPM2 start method

Siddharth Chintamaneni (3):
  tpm: tpm_crb_ffa: Only probe when ACPI TPM2 uses FF-A
  tpm: tpm_tis: Use cached tpm2_acpi_start_method
  tpm: tpm_crb: Use cached tpm2_acpi_start_method

 drivers/char/tpm/tpm-interface.c | 21 ++++++++
 drivers/char/tpm/tpm.h           |  1 +
 drivers/char/tpm/tpm_crb.c       | 82 +++++++++++++++-----------------
 drivers/char/tpm/tpm_crb_ffa.c   |  5 ++
 drivers/char/tpm/tpm_tis.c       | 45 +++---------------
 5 files changed, 71 insertions(+), 83 deletions(-)


base-commit: 7e52fc165aa50e70e8df3c879d04fc0ff1673d4a
-- 
2.45.4

[PATCH v3 1/4] tpm: Cache TPM2 start method

[Siddharth Chintamaneni]

From: Jarkko Sakkinen <jarkko@kernel.org>

Both tpm_tis and tpm_crb retrieve the start method from the ACPI TPM2
table during device probe, and tpm_crb_ffa also needs it before chip
allocation.

Cache the start method in tpm2_acpi_start_method during tpm_init(), log
it when a TPM2 ACPI table is present, and export it for the leaf
drivers, defaulting to ACPI_TPM2_NOT_ALLOWED when the table is absent or
invalid.

Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Co-developed-by: Siddharth Chintamaneni <sidchintamaneni@gmail.com>
Signed-off-by: Siddharth Chintamaneni <sidchintamaneni@gmail.com>
---
 drivers/char/tpm/tpm-interface.c | 21 +++++++++++++++++++++
 drivers/char/tpm/tpm.h           |  1 +
 2 files changed, 22 insertions(+)

diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
index e0385b16616b..c18b060d7da2 100644
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -534,8 +534,17 @@ int tpm_get_random(struct tpm_chip *chip, u8 *out, size_t max)
 }
 EXPORT_SYMBOL_GPL(tpm_get_random);
 
+#ifdef CONFIG_ACPI
+u32 tpm2_acpi_start_method = ACPI_TPM2_NOT_ALLOWED;
+EXPORT_SYMBOL_GPL(tpm2_acpi_start_method);
+#endif
+
 static int __init tpm_init(void)
 {
+#ifdef CONFIG_ACPI
+	struct acpi_table_tpm2 *tbl;
+	acpi_status status;
+#endif
 	int rc;
 
 	rc = class_register(&tpm_class);
@@ -562,6 +571,18 @@ static int __init tpm_init(void)
 		goto out_unreg_chrdev;
 	}
 
+#ifdef CONFIG_ACPI
+	if (!acpi_disabled) {
+		status = acpi_get_table(ACPI_SIG_TPM2, 1, (typeof(tbl->header) **)&tbl);
+		if (ACPI_SUCCESS(status)) {
+			if (tbl->header.length >= sizeof(*tbl))
+				tpm2_acpi_start_method = tbl->start_method;
+			acpi_put_table((struct acpi_table_header *)tbl);
+			pr_info("tpm: TPM2 ACPI start method: 0x%02x\n", tpm2_acpi_start_method);
+		}
+	}
+#endif
+
 	return 0;
 
 out_unreg_chrdev:
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index fa554c5ad80b..212ca2410c93 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -100,6 +100,7 @@ void tpm_sysfs_add_device(struct tpm_chip *chip);
 
 
 #ifdef CONFIG_ACPI
+extern u32 tpm2_acpi_start_method;
 extern void tpm_add_ppi(struct tpm_chip *chip);
 #else
 static inline void tpm_add_ppi(struct tpm_chip *chip)

base-commit: 7e52fc165aa50e70e8df3c879d04fc0ff1673d4a
-- 
2.45.4

[PATCH v3 2/4] tpm: tpm_crb_ffa: Only probe when ACPI TPM2 uses FF-A

[Siddharth Chintamaneni]

Prior to commit 677042afb97a ("tpm: tpm_crb_ffa: revert defered_probed
when tpm_crb_ffa is built-in"), built-in tpm_crb_ffa only registered
tpm_crb_ffa_driver from tpm_crb_ffa_init() after crb_acpi_probe()
confirmed start_method == ACPI_TPM2_CRB_WITH_ARM_FFA. After that
commit, tpm_crb_ffa unconditionally registers on the FF-A bus at
device_initcall time (and when loaded as a module) without checking
the platform's ACPI TPM2 start method.

A platform's firmware may expose a TPM CRB over FF-A Secure Partition
for UEFI boot services while advertising a non-FF-A start method to
the OS in the ACPI TPM2 table. When the ACPI TPM2 table designates a
non-FF-A start method, Linux has no consumer for tpm_crb_ffa and
should not probe the FF-A TPM service.

On Microsoft Cobalt 200 systems, the ACPI TPM2 table does not use
ACPI_TPM2_CRB_WITH_ARM_FFA, yet ffa_init() discovers the FF-A TPM
partition and tpm_crb_ffa_probe() unconditionally sends
CRB_FFA_GET_INTERFACE_VERSION via FFA_MSG_SEND_DIRECT_REQ2/REQ SMC.
That request wedges the calling CPU in Secure World (with Non-Secure
interrupts and GICv3 pseudo-NMIs masked), hanging boot with an RCU CPU
stall:

  [    5.507519] ARM FF-A: Driver version 1.2
  [    5.507519] ARM FF-A: Firmware version 1.2 found
  [    5.507551] ARM FF-A: Notification setup failed -61, not enabled
  [    7.150580] Freeing initrd memory: 293640K
  [   65.515248] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
  [   65.521346] rcu:     10-...0: (3 GPs behind) idle=dd9c/1/0x4000000000000000 softirq=37/37 fqs=5262
  [   65.530031] rcu:              hardirqs   softirqs   csw/system
  [   65.535589] rcu:      number:        0          0            0
  [   65.541146] rcu:     cputime:        0          0            0   ==> 30028(ms)
  [   65.548102] rcu:     (detected by 66, t=15010 jiffies, g=-951, q=1384 ncpus=132)
  [   65.555228] Sending NMI from CPU 66 to CPUs 10:
  [   75.560686] After 10 seconds, these CPUS still haven't responded to the NMI: 10

Check tpm2_acpi_start_method in tpm_crb_ffa_probe() and return -ENODEV
unless it equals ACPI_TPM2_CRB_WITH_ARM_FFA. Checking in probe() rather
than module_init allows tpm_crb_ffa.ko to load as a symbol dependency
of tpm_crb.ko on non-FF-A platforms when built as modules, while
skipping FF-A TPM requests unless ACPI advertises the FF-A start
method.

Fixes: eb93f0734ef1 ("tpm_crb: ffa_tpm: Implement driver compliant to CRB over FF-A")
Signed-off-by: Siddharth Chintamaneni <sidchintamaneni@gmail.com>
---
 drivers/char/tpm/tpm_crb_ffa.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/char/tpm/tpm_crb_ffa.c b/drivers/char/tpm/tpm_crb_ffa.c
index 025c4d4b17ca..da676da6f3f0 100644
--- a/drivers/char/tpm/tpm_crb_ffa.c
+++ b/drivers/char/tpm/tpm_crb_ffa.c
@@ -9,9 +9,11 @@
 
 #define pr_fmt(fmt) "CRB_FFA: " fmt
 
+#include <linux/acpi.h>
 #include <linux/arm_ffa.h>
 #include <linux/delay.h>
 #include <linux/moduleparam.h>
+#include "tpm.h"
 #include "tpm_crb_ffa.h"
 
 static unsigned int busy_timeout_ms = 2000;
@@ -324,6 +326,9 @@ static int tpm_crb_ffa_probe(struct ffa_device *ffa_dev)
 	struct tpm_crb_ffa *p;
 	int rc;
 
+	if (tpm2_acpi_start_method != ACPI_TPM2_CRB_WITH_ARM_FFA)
+		return -ENODEV;
+
 	/* only one instance of a TPM partition is supported */
 	if (tpm_crb_ffa && !IS_ERR_VALUE(tpm_crb_ffa))
 		return -EEXIST;
-- 
2.45.4

[PATCH v3 3/4] tpm: tpm_tis: Use cached tpm2_acpi_start_method

[Siddharth Chintamaneni]

Use the cached tpm2_acpi_start_method value instead of mapping and
unmapping the ACPI TPM2 table again during probe. Remove
check_acpi_tpm2() and open-code the start method check directly in
tpm_tis_init(), returning -ENODEV when the device does not use
ACPI_TPM2_MEMORY_MAPPED.

Signed-off-by: Siddharth Chintamaneni <sidchintamaneni@gmail.com>
---
 drivers/char/tpm/tpm_tis.c | 45 +++++---------------------------------
 1 file changed, 6 insertions(+), 39 deletions(-)

diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
index 6f8344894ea5..df2d8c1c2be0 100644
--- a/drivers/char/tpm/tpm_tis.c
+++ b/drivers/char/tpm/tpm_tis.c
@@ -127,45 +127,11 @@ static inline int is_itpm(struct acpi_device *dev)
 #endif
 
 #if defined(CONFIG_ACPI)
-#define DEVICE_IS_TPM2 1
-
 static const struct acpi_device_id tpm_acpi_tbl[] = {
-	{"MSFT0101", DEVICE_IS_TPM2},
+	{"MSFT0101"},
 	{},
 };
 MODULE_DEVICE_TABLE(acpi, tpm_acpi_tbl);
-
-static int check_acpi_tpm2(struct device *dev)
-{
-	const struct acpi_device_id *aid = acpi_match_device(tpm_acpi_tbl, dev);
-	struct acpi_table_tpm2 *tbl;
-	acpi_status st;
-	int ret = 0;
-
-	if (!aid || aid->driver_data != DEVICE_IS_TPM2)
-		return 0;
-
-	/* If the ACPI TPM2 signature is matched then a global ACPI_SIG_TPM2
-	 * table is mandatory
-	 */
-	st = acpi_get_table(ACPI_SIG_TPM2, 1, (struct acpi_table_header **)&tbl);
-	if (ACPI_FAILURE(st) || tbl->header.length < sizeof(*tbl)) {
-		dev_err(dev, FW_BUG "failed to get TPM2 ACPI table\n");
-		return -EINVAL;
-	}
-
-	/* The tpm2_crb driver handles this device */
-	if (tbl->start_method != ACPI_TPM2_MEMORY_MAPPED)
-		ret = -ENODEV;
-
-	acpi_put_table((struct acpi_table_header *)tbl);
-	return ret;
-}
-#else
-static int check_acpi_tpm2(struct device *dev)
-{
-	return 0;
-}
 #endif
 
 static int tpm_tcg_read_bytes(struct tpm_tis_data *data, u32 addr, u16 len,
@@ -222,11 +188,12 @@ static int tpm_tis_init(struct device *dev, struct tpm_info *tpm_info)
 {
 	struct tpm_tis_tcg_phy *phy;
 	int irq = -1;
-	int rc;
 
-	rc = check_acpi_tpm2(dev);
-	if (rc)
-		return rc;
+#ifdef CONFIG_ACPI
+	if (acpi_match_device(tpm_acpi_tbl, dev) &&
+	    tpm2_acpi_start_method != ACPI_TPM2_MEMORY_MAPPED)
+		return -ENODEV;
+#endif
 
 	phy = devm_kzalloc_obj(dev, struct tpm_tis_tcg_phy);
 	if (phy == NULL)
-- 
2.45.4

Re: [PATCH v3 3/4] tpm: tpm_tis: Use cached tpm2_acpi_start_method

[Jarkko Sakkinen]

On Sun, Nov 15, 2026 at 01:34:55AM +0000, Siddharth Chintamaneni wrote:
> Use the cached tpm2_acpi_start_method value instead of mapping and
> unmapping the ACPI TPM2 table again during probe. Remove
> check_acpi_tpm2() and open-code the start method check directly in
> tpm_tis_init(), returning -ENODEV when the device does not use
> ACPI_TPM2_MEMORY_MAPPED.
> 
> Signed-off-by: Siddharth Chintamaneni <sidchintamaneni@gmail.com>
> ---
>  drivers/char/tpm/tpm_tis.c | 45 +++++---------------------------------
>  1 file changed, 6 insertions(+), 39 deletions(-)
> 
> diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
> index 6f8344894ea5..df2d8c1c2be0 100644
> --- a/drivers/char/tpm/tpm_tis.c
> +++ b/drivers/char/tpm/tpm_tis.c
> @@ -127,45 +127,11 @@ static inline int is_itpm(struct acpi_device *dev)
>  #endif
>  
>  #if defined(CONFIG_ACPI)
> -#define DEVICE_IS_TPM2 1
> -
>  static const struct acpi_device_id tpm_acpi_tbl[] = {
> -	{"MSFT0101", DEVICE_IS_TPM2},
> +	{"MSFT0101"},
>  	{},
>  };
>  MODULE_DEVICE_TABLE(acpi, tpm_acpi_tbl);
> -
> -static int check_acpi_tpm2(struct device *dev)
> -{
> -	const struct acpi_device_id *aid = acpi_match_device(tpm_acpi_tbl, dev);
> -	struct acpi_table_tpm2 *tbl;
> -	acpi_status st;
> -	int ret = 0;
> -
> -	if (!aid || aid->driver_data != DEVICE_IS_TPM2)
> -		return 0;


Jason, can you remind me what was the deal with this flag?

> -
> -	/* If the ACPI TPM2 signature is matched then a global ACPI_SIG_TPM2
> -	 * table is mandatory
> -	 */
> -	st = acpi_get_table(ACPI_SIG_TPM2, 1, (struct acpi_table_header **)&tbl);
> -	if (ACPI_FAILURE(st) || tbl->header.length < sizeof(*tbl)) {
> -		dev_err(dev, FW_BUG "failed to get TPM2 ACPI table\n");
> -		return -EINVAL;
> -	}
> -
> -	/* The tpm2_crb driver handles this device */
> -	if (tbl->start_method != ACPI_TPM2_MEMORY_MAPPED)
> -		ret = -ENODEV;
> -
> -	acpi_put_table((struct acpi_table_header *)tbl);
> -	return ret;
> -}
> -#else
> -static int check_acpi_tpm2(struct device *dev)
> -{
> -	return 0;
> -}
>  #endif
>  
>  static int tpm_tcg_read_bytes(struct tpm_tis_data *data, u32 addr, u16 len,
> @@ -222,11 +188,12 @@ static int tpm_tis_init(struct device *dev, struct tpm_info *tpm_info)
>  {
>  	struct tpm_tis_tcg_phy *phy;
>  	int irq = -1;
> -	int rc;
>  
> -	rc = check_acpi_tpm2(dev);
> -	if (rc)
> -		return rc;
> +#ifdef CONFIG_ACPI
> +	if (acpi_match_device(tpm_acpi_tbl, dev) &&
> +	    tpm2_acpi_start_method != ACPI_TPM2_MEMORY_MAPPED)
> +		return -ENODEV;
> +#endif
>  
>  	phy = devm_kzalloc_obj(dev, struct tpm_tis_tcg_phy);
>  	if (phy == NULL)
> -- 
> 2.45.4
> 

Br, Jarkko

[PATCH v3 4/4] tpm: tpm_crb: Use cached tpm2_acpi_start_method

[Siddharth Chintamaneni]

Replace priv->sm and the local sm variable in crb_acpi_probe() with
tpm2_acpi_start_method across tpm_crb so the cached global serves as
the single source for the ACPI TPM2 start method.

Check tpm2_acpi_start_method at the start of crb_acpi_probe() and
return -ENODEV before mapping the ACPI TPM2 table when the table is
absent or uses ACPI_TPM2_MEMORY_MAPPED.

Signed-off-by: Siddharth Chintamaneni <sidchintamaneni@gmail.com>
---
 drivers/char/tpm/tpm_crb.c | 82 ++++++++++++++++++--------------------
 1 file changed, 38 insertions(+), 44 deletions(-)

diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
index 4749a9183726..8585c73fb25b 100644
--- a/drivers/char/tpm/tpm_crb.c
+++ b/drivers/char/tpm/tpm_crb.c
@@ -98,7 +98,6 @@ enum crb_status {
 };
 
 struct crb_priv {
-	u32 sm;
 	const char *hid;
 	struct crb_regs_head __iomem *regs_h;
 	struct crb_regs_tail __iomem *regs_t;
@@ -138,11 +137,11 @@ struct tpm2_crb_pluton {
 /*
  * Returns true if the start method supports idle.
  */
-static inline bool tpm_crb_has_idle(u32 start_method)
+static inline bool tpm_crb_has_idle(void)
 {
-	return !(start_method == ACPI_TPM2_START_METHOD ||
-	       start_method == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD ||
-	       start_method == ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC);
+	return !(tpm2_acpi_start_method == ACPI_TPM2_START_METHOD ||
+		 tpm2_acpi_start_method == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD ||
+		 tpm2_acpi_start_method == ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC);
 }
 
 static bool crb_wait_for_reg_32(u32 __iomem *reg, u32 mask, u32 value,
@@ -166,7 +165,7 @@ static bool crb_wait_for_reg_32(u32 __iomem *reg, u32 mask, u32 value,
 
 static int crb_try_pluton_doorbell(struct crb_priv *priv, bool wait_for_complete)
 {
-	if (priv->sm != ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON)
+	if (tpm2_acpi_start_method != ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON)
 		return 0;
 
 	if (!crb_wait_for_reg_32(priv->pluton_reply_addr, ~0, 1, TPM2_TIMEOUT_C))
@@ -204,12 +203,12 @@ static int __crb_go_idle(struct device *dev, struct crb_priv *priv, int loc)
 {
 	int rc;
 
-	if (!tpm_crb_has_idle(priv->sm))
+	if (!tpm_crb_has_idle())
 		return 0;
 
 	iowrite32(CRB_CTRL_REQ_GO_IDLE, &priv->regs_t->ctrl_req);
 
-	if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) {
+	if (tpm2_acpi_start_method == ACPI_TPM2_CRB_WITH_ARM_FFA) {
 		rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_COMMAND, loc);
 		if (rc)
 			return rc;
@@ -258,12 +257,12 @@ static int __crb_cmd_ready(struct device *dev, struct crb_priv *priv, int loc)
 {
 	int rc;
 
-	if (!tpm_crb_has_idle(priv->sm))
+	if (!tpm_crb_has_idle())
 		return 0;
 
 	iowrite32(CRB_CTRL_REQ_CMD_READY, &priv->regs_t->ctrl_req);
 
-	if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) {
+	if (tpm2_acpi_start_method == ACPI_TPM2_CRB_WITH_ARM_FFA) {
 		rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_COMMAND, loc);
 		if (rc)
 			return rc;
@@ -303,7 +302,7 @@ static int __crb_request_locality(struct device *dev,
 
 	iowrite32(CRB_LOC_CTRL_REQUEST_ACCESS, &priv->regs_h->loc_ctrl);
 
-	if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) {
+	if (tpm2_acpi_start_method == ACPI_TPM2_CRB_WITH_ARM_FFA) {
 		rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_LOCALITY_REQUEST, loc);
 		if (rc)
 			return rc;
@@ -337,7 +336,7 @@ static int __crb_relinquish_locality(struct device *dev,
 
 	iowrite32(CRB_LOC_CTRL_RELINQUISH, &priv->regs_h->loc_ctrl);
 
-	if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) {
+	if (tpm2_acpi_start_method == ACPI_TPM2_CRB_WITH_ARM_FFA) {
 		rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_LOCALITY_REQUEST, loc);
 		if (rc)
 			return rc;
@@ -530,18 +529,18 @@ static int tpm_crb_start(struct tpm_chip *chip, u32 start_cmd)
 	 * report only ACPI start but in practice seems to require both
 	 * CRB start, hence invoking CRB start method if hid == MSFT0101.
 	 */
-	if (priv->sm == ACPI_TPM2_COMMAND_BUFFER ||
-	    priv->sm == ACPI_TPM2_MEMORY_MAPPED ||
+	if (tpm2_acpi_start_method == ACPI_TPM2_COMMAND_BUFFER ||
+	    tpm2_acpi_start_method == ACPI_TPM2_MEMORY_MAPPED ||
 	    !strcmp(priv->hid, "MSFT0101"))
 		iowrite32(start_cmd, &priv->regs_t->ctrl_start);
-	if (priv->sm == ACPI_TPM2_START_METHOD ||
-	    priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD)
+	if (tpm2_acpi_start_method == ACPI_TPM2_START_METHOD ||
+	    tpm2_acpi_start_method == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD)
 		rc = crb_do_acpi_start(chip);
-	if (priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC) {
+	if (tpm2_acpi_start_method == ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC) {
 		iowrite32(start_cmd, &priv->regs_t->ctrl_start);
 		rc = tpm_crb_smc_start(&chip->dev, priv->smc_func_id);
 	}
-	if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) {
+	if (tpm2_acpi_start_method == ACPI_TPM2_CRB_WITH_ARM_FFA) {
 		iowrite32(start_cmd, &priv->regs_t->ctrl_start);
 		rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_COMMAND, chip->locality);
 	}
@@ -622,7 +621,7 @@ static int crb_send(struct tpm_chip *chip, u8 *buf, size_t bufsiz, size_t len)
 	}
 
 	/* Seems to be necessary for every command */
-	if (priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON)
+	if (tpm2_acpi_start_method == ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON)
 		__crb_cmd_ready(&chip->dev, priv, chip->locality);
 
 	if (len <= priv->cmd_size)
@@ -638,12 +637,12 @@ static void crb_cancel(struct tpm_chip *chip)
 
 	iowrite32(CRB_CANCEL_INVOKE, &priv->regs_t->ctrl_cancel);
 
-	if ((priv->sm == ACPI_TPM2_START_METHOD ||
-	     priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD) &&
-	     crb_do_acpi_start(chip))
+	if ((tpm2_acpi_start_method == ACPI_TPM2_START_METHOD ||
+	     tpm2_acpi_start_method == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD) &&
+	    crb_do_acpi_start(chip))
 		dev_err(&chip->dev, "ACPI Start failed\n");
 
-	if (priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA) {
+	if (tpm2_acpi_start_method == ACPI_TPM2_CRB_WITH_ARM_FFA) {
 		rc = tpm_crb_ffa_start(CRB_FFA_START_TYPE_COMMAND, chip->locality);
 		if (rc)
 			dev_err(&chip->dev, "FF-A Start failed\n");
@@ -762,7 +761,7 @@ static int crb_map_io(struct device *dev, struct crb_priv *priv,
 	 * Pluton sometimes does not define ACPI memory regions.
 	 * Mapping is then done in crb_map_pluton
 	 */
-	if (priv->sm != ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON) {
+	if (tpm2_acpi_start_method != ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON) {
 		INIT_LIST_HEAD(&acpi_resource_list);
 		ret = acpi_dev_get_resources(device, &acpi_resource_list,
 					     crb_check_resource, iores_array);
@@ -804,9 +803,9 @@ static int crb_map_io(struct device *dev, struct crb_priv *priv,
 	 * the control area, as one nice sane region except for some older
 	 * stuff that puts the control area outside the ACPI IO region.
 	 */
-	if (priv->sm == ACPI_TPM2_COMMAND_BUFFER ||
-	    priv->sm == ACPI_TPM2_CRB_WITH_ARM_FFA ||
-	    priv->sm == ACPI_TPM2_MEMORY_MAPPED) {
+	if (tpm2_acpi_start_method == ACPI_TPM2_COMMAND_BUFFER ||
+	    tpm2_acpi_start_method == ACPI_TPM2_CRB_WITH_ARM_FFA ||
+	    tpm2_acpi_start_method == ACPI_TPM2_MEMORY_MAPPED) {
 		if (iores &&
 		    buf->control_address == iores->start +
 		    sizeof(*priv->regs_h))
@@ -938,25 +937,21 @@ static int crb_acpi_probe(struct platform_device *pdev)
 	struct tpm2_crb_ffa *crb_ffa;
 	struct tpm2_crb_pluton *crb_pluton;
 	acpi_status status;
-	u32 sm;
 	int rc;
 
 	device = ACPI_COMPANION(dev);
 	if (!device)
 		return -ENODEV;
 
-	status = acpi_get_table(ACPI_SIG_TPM2, 1,
-				(struct acpi_table_header **) &buf);
-	if (ACPI_FAILURE(status) || buf->header.length < sizeof(*buf)) {
-		dev_err(dev, FW_BUG "failed to get TPM2 ACPI table\n");
-		return -EINVAL;
-	}
+	if (tpm2_acpi_start_method == ACPI_TPM2_NOT_ALLOWED ||
+	    tpm2_acpi_start_method == ACPI_TPM2_MEMORY_MAPPED)
+		return -ENODEV;
 
-	/* Should the FIFO driver handle this? */
-	sm = buf->start_method;
-	if (sm == ACPI_TPM2_MEMORY_MAPPED) {
-		rc = -ENODEV;
-		goto out;
+	status = acpi_get_table(ACPI_SIG_TPM2, 1, (typeof(buf->header) **)&buf);
+	if (ACPI_FAILURE(status) || buf->header.length < sizeof(*buf)) {
+		if (ACPI_SUCCESS(status))
+			acpi_put_table((struct acpi_table_header *)buf);
+		return -ENODEV;
 	}
 
 	priv = devm_kzalloc_obj(dev, struct crb_priv);
@@ -965,7 +960,7 @@ static int crb_acpi_probe(struct platform_device *pdev)
 		goto out;
 	}
 
-	if (sm == ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC) {
+	if (tpm2_acpi_start_method == ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC) {
 		if (buf->header.length < (sizeof(*buf) + sizeof(*crb_smc))) {
 			dev_err(dev,
 				FW_BUG "TPM2 ACPI table has wrong size %u for start method type %d\n",
@@ -978,7 +973,7 @@ static int crb_acpi_probe(struct platform_device *pdev)
 		priv->smc_func_id = crb_smc->smc_func_id;
 	}
 
-	if (sm == ACPI_TPM2_CRB_WITH_ARM_FFA) {
+	if (tpm2_acpi_start_method == ACPI_TPM2_CRB_WITH_ARM_FFA) {
 		if (buf->header.length < (sizeof(*buf) + sizeof(*crb_ffa))) {
 			dev_err(dev,
 				FW_BUG "TPM2 ACPI table has wrong size %u for start method type %d\n",
@@ -999,7 +994,7 @@ static int crb_acpi_probe(struct platform_device *pdev)
 		}
 	}
 
-	if (sm == ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON) {
+	if (tpm2_acpi_start_method == ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON) {
 		if (buf->header.length < (sizeof(*buf) + sizeof(*crb_pluton))) {
 			dev_err(dev,
 				FW_BUG "TPM2 ACPI table has wrong size %u for start method type %d\n",
@@ -1014,7 +1009,6 @@ static int crb_acpi_probe(struct platform_device *pdev)
 			goto out;
 	}
 
-	priv->sm = sm;
 	priv->hid = acpi_device_hid(device);
 
 	rc = crb_map_io(dev, priv, buf);
@@ -1038,7 +1032,7 @@ static int crb_acpi_probe(struct platform_device *pdev)
 #ifdef CONFIG_X86
 	/* A quirk for https://www.amd.com/en/support/kb/faq/pa-410 */
 	if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD &&
-	    priv->sm != ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON) {
+	    tpm2_acpi_start_method != ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON) {
 		dev_info(dev, "Disabling hwrng\n");
 		chip->flags |= TPM_CHIP_FLAG_HWRNG_DISABLED;
 	}
-- 
2.45.4