TPM DEVICE DRIVER changes for v7.4-rc1
Subsystems (2)
Jarkko Sakkinen
maintainerThe following changes since commit 722658cac48a6ba49f5506fd74d010ad9dbb2f05:
keys/trusted_keys: reuse TPM version in option handling (2026-10-20 18:15:40 +0300)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd.git tags/tpm-v7.4-rc1
for you to fetch changes up to 836952696d0260cca1de6d3300cd8fcd5687fe67:
tpm: reject duplicate PCR banks in tpm2_get_pcr_allocation (2026-10-21 13:20:58 +0300)
----------------------------------------------------------------
tpm: changes for v7.4-rc1
FEATURES AND IMPROVEMENTS
=========================
- tpm_crb behaviour was improved by putting the chip into an idle state for each transmission. This improves firmware behavior as the kernel now better cancels its state as if it had never touched it in the first place.
- One spurious (but harmless) wmb() was dropped from tpm_pm_resume().
- tpm_tis_i2c now requests the optional reset control and deasserts it before communicating with the TPM.
- SIMPLE_DEV_PM_OPS was replaced with DEFINE_SIMPLE_DEV_PM_OPS across the whole driver stack.
BUGS
====
- tpm2_probe() misinterpreted a transport error on TPM2_GetCapability as the chip not being probed, and the chip was detected as a TPM 1 chip. This can happen in reality only in the extremely rare case of bus corruption. Despite the odds, a fix was landed, as it is still technically a legit bug fix.
- It is not really worth the time and energy to go into details as tpm_nsc is a somewhat legacy driver, but one null pointer dereference bug and another causing use-after-free were fixed.
- read() of /dev/tpm{,rm}0 with zero size caused a pending response to be consumed. This was fixed simply by an immediate return.
----------------------------------------------------------------
Alexander Sverdlin (1):
tpm: tpm2_probe: propagate transport errors
Li Jun (2):
char: tpm: Use SIMPLE_DEV_PM_OPS for ibmvtpm power management
tpm: use DEFINE_SIMPLE_DEV_PM_OPS and pm_sleep_ptr()
Mario Limonciello (1):
tpm: Call cmd_ready/go_idle for each command transmission
Pei Xiao (3):
tpm: tpm_nsc: fix NULL pointer dereference on init failure
tpm: tpm_nsc: stop using the cleanup callback as dev.release
tpm: fix zero-length read discarding the pending response
Richard Lyu (1):
tpm: Remove ineffective wmb() from tpm_pm_resume()
Stefano Radaelli (1):
tpm: tis_i2c: Deassert optional reset line before probing
Yuqi Xu (1):
tpm: reject duplicate PCR banks in tpm2_get_pcr_allocation
drivers/char/tpm/tpm-chip.c | 24 ------------------------ drivers/char/tpm/tpm-dev-common.c | 3 +++ drivers/char/tpm/tpm-interface.c | 28 ++++++++++++++++++++++------ drivers/char/tpm/tpm2-cmd.c | 21 ++++++++++++++++++++- drivers/char/tpm/tpm_atmel.c | 4 ++-- drivers/char/tpm/tpm_i2c_atmel.c | 4 ++-- drivers/char/tpm/tpm_i2c_infineon.c | 4 ++-- drivers/char/tpm/tpm_i2c_nuvoton.c | 4 ++-- drivers/char/tpm/tpm_ibmvtpm.c | 5 +---- drivers/char/tpm/tpm_infineon.c | 7 +++---- drivers/char/tpm/tpm_nsc.c | 12 ++++++++---- drivers/char/tpm/tpm_tis.c | 4 ++-- drivers/char/tpm/tpm_tis_core.h | 2 -- drivers/char/tpm/tpm_tis_i2c.c | 16 ++++++++++++++-- drivers/char/tpm/tpm_tis_i2c_cr50.c | 4 ++-- drivers/char/tpm/tpm_tis_spi_main.c | 4 ++-- drivers/char/tpm/tpm_tis_synquacer.c | 4 ++-- 17 files changed, 87 insertions(+), 63 deletions(-)
Jarkko Sakkinen
maintainerQuoted 79 lines · Jarkko Sakkinen
The following changes since commit
722658cac48a6ba49f5506fd74d010ad9dbb2f05:keys/trusted_keys: reuse TPM version in option handling (2026-10-20 18:15:40 +0300)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd.gittags/tpm-v7.4-rc1for you to fetch changes up to
836952696d0260cca1de6d3300cd8fcd5687fe67:tpm: reject duplicate PCR banks in
tpm2_get_pcr_allocation(2026-10-21 13:20:58 +0300)----------------------------------------------------------------
tpm: changes for v7.4-rc1FEATURES AND IMPROVEMENTS
=========================-
tpm_crbbehaviour was improved by putting the chip into an idle state for each transmission. This improves firmware behavior as the kernel now better cancels its state as if it had never touched it in the first place.
- One spurious (but harmless)wmb()was dropped fromtpm_pm_resume().
-tpm_tis_i2cnow requests the optional reset control and deasserts it before communicating with the TPM.
-SIMPLE_DEV_PM_OPSwas replaced withDEFINE_SIMPLE_DEV_PM_OPSacross the whole driver stack.BUGS
====-
tpm2_probe()misinterpreted a transport error onTPM2_GetCapabilityas the chip not being probed, and the chip was detected as a TPM 1 chip. This can happen in reality only in the extremely rare case of bus corruption. Despite the odds, a fix was landed, as it is still technically a legit bug fix.
- It is not really worth the time and energy to go into details astpm_nscis a somewhat legacy driver, but one null pointer dereference bug and another causing use-after-free were fixed.
-read()of/dev/tpm{,rm}0with zero size caused a pending response to be consumed. This was fixed simply by an immediate return.Signed-off-by Jarkko Sakkinen <[email protected]>----------------------------------------------------------------
Alexander Sverdlin (1):
tpm:tpm2_probe: propagate transport errorsLi Jun (2):
char: tpm: UseSIMPLE_DEV_PM_OPSfor ibmvtpm power management
tpm: useDEFINE_SIMPLE_DEV_PM_OPSandpm_sleep_ptr()Mario Limonciello (1):
tpm: Call cmd_ready/go_idle for each command transmissionPei Xiao (3):
tpm:tpm_nsc: fix NULL pointer dereference on init failure
tpm:tpm_nsc: stop using the cleanup callback as dev.release
tpm: fix zero-length read discarding the pending responseRichard Lyu (1):
tpm: Remove ineffectivewmb()fromtpm_pm_resume()Stefano Radaelli (1):
tpm:tis_i2c: Deassert optional reset line before probingYuqi Xu (1):
tpm: reject duplicate PCR banks intpm2_get_pcr_allocationdrivers/char/tpm/tpm-chip.c | 24 ------------------------ drivers/char/tpm/tpm-dev-common.c | 3 +++ drivers/char/tpm/tpm-interface.c | 28 ++++++++++++++++++++++------ drivers/char/tpm/tpm2-cmd.c | 21 ++++++++++++++++++++- drivers/char/tpm/tpm_atmel.c | 4 ++-- drivers/char/tpm/tpm_i2c_atmel.c | 4 ++-- drivers/char/tpm/tpm_i2c_infineon.c | 4 ++-- drivers/char/tpm/tpm_i2c_nuvoton.c | 4 ++-- drivers/char/tpm/tpm_ibmvtpm.c | 5 +---- drivers/char/tpm/tpm_infineon.c | 7 +++----
Quoted 9 lines
drivers/char/tpm/tpm_nsc.c | 12 ++++++++---- drivers/char/tpm/tpm_tis.c | 4 ++-- drivers/char/tpm/tpm_tis_core.h | 2 -- drivers/char/tpm/tpm_tis_i2c.c | 16 ++++++++++++++-- drivers/char/tpm/tpm_tis_i2c_cr50.c | 4 ++-- drivers/char/tpm/tpm_tis_spi_main.c | 4 ++-- drivers/char/tpm/tpm_tis_synquacer.c | 4 ++-- 17 files changed, 87 insertions(+), 63 deletions(-)
My templates are a bit out-of-sync, thus the divergence in subject lines. I'm working on my pull request scripts, and address this while at it so that subjects, tags etc. have same stuff in the same format. Just started distract me when I realized this after looking at what went to lore so though to mention.
Br, Jarkko
Jarkko Sakkinen
maintainerQuoted 90 lines · Jarkko Sakkinen
Quoted 79 lines · Jarkko Sakkinen
The following changes since commit
722658cac48a6ba49f5506fd74d010ad9dbb2f05:keys/trusted_keys: reuse TPM version in option handling (2026-10-20 18:15:40 +0300)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd.gittags/tpm-v7.4-rc1for you to fetch changes up to
836952696d0260cca1de6d3300cd8fcd5687fe67:tpm: reject duplicate PCR banks in
tpm2_get_pcr_allocation(2026-10-21 13:20:58 +0300)----------------------------------------------------------------
tpm: changes for v7.4-rc1FEATURES AND IMPROVEMENTS
=========================-
tpm_crbbehaviour was improved by putting the chip into an idle state for each transmission. This improves firmware behavior as the kernel now better cancels its state as if it had never touched it in the first place.
- One spurious (but harmless)wmb()was dropped fromtpm_pm_resume().
-tpm_tis_i2cnow requests the optional reset control and deasserts it before communicating with the TPM.
-SIMPLE_DEV_PM_OPSwas replaced withDEFINE_SIMPLE_DEV_PM_OPSacross the whole driver stack.BUGS
====-
tpm2_probe()misinterpreted a transport error onTPM2_GetCapabilityas the chip not being probed, and the chip was detected as a TPM 1 chip. This can happen in reality only in the extremely rare case of bus corruption. Despite the odds, a fix was landed, as it is still technically a legit bug fix.
- It is not really worth the time and energy to go into details astpm_nscis a somewhat legacy driver, but one null pointer dereference bug and another causing use-after-free were fixed.
-read()of/dev/tpm{,rm}0with zero size caused a pending response to be consumed. This was fixed simply by an immediate return.Signed-off-by Jarkko Sakkinen <[email protected]>----------------------------------------------------------------
Alexander Sverdlin (1):
tpm:tpm2_probe: propagate transport errorsLi Jun (2):
char: tpm: UseSIMPLE_DEV_PM_OPSfor ibmvtpm power management
tpm: useDEFINE_SIMPLE_DEV_PM_OPSandpm_sleep_ptr()Mario Limonciello (1):
tpm: Call cmd_ready/go_idle for each command transmissionPei Xiao (3):
tpm:tpm_nsc: fix NULL pointer dereference on init failure
tpm:tpm_nsc: stop using the cleanup callback as dev.release
tpm: fix zero-length read discarding the pending responseRichard Lyu (1):
tpm: Remove ineffectivewmb()fromtpm_pm_resume()Stefano Radaelli (1):
tpm:tis_i2c: Deassert optional reset line before probingYuqi Xu (1):
tpm: reject duplicate PCR banks intpm2_get_pcr_allocationdrivers/char/tpm/tpm-chip.c | 24 ------------------------ drivers/char/tpm/tpm-dev-common.c | 3 +++ drivers/char/tpm/tpm-interface.c | 28 ++++++++++++++++++++++------ drivers/char/tpm/tpm2-cmd.c | 21 ++++++++++++++++++++- drivers/char/tpm/tpm_atmel.c | 4 ++-- drivers/char/tpm/tpm_i2c_atmel.c | 4 ++-- drivers/char/tpm/tpm_i2c_infineon.c | 4 ++-- drivers/char/tpm/tpm_i2c_nuvoton.c | 4 ++-- drivers/char/tpm/tpm_ibmvtpm.c | 5 +---- drivers/char/tpm/tpm_infineon.c | 7 +++----Quoted 9 lines
drivers/char/tpm/tpm_nsc.c | 12 ++++++++---- drivers/char/tpm/tpm_tis.c | 4 ++-- drivers/char/tpm/tpm_tis_core.h | 2 -- drivers/char/tpm/tpm_tis_i2c.c | 16 ++++++++++++++-- drivers/char/tpm/tpm_tis_i2c_cr50.c | 4 ++-- drivers/char/tpm/tpm_tis_spi_main.c | 4 ++-- drivers/char/tpm/tpm_tis_synquacer.c | 4 ++-- 17 files changed, 87 insertions(+), 63 deletions(-)
Quoted 7 lines
My templates are a bit out-of-sync, thus the divergence in subject lines. I'm working on my pull request scripts, and address this while at it so that subjects, tags etc. have same stuff in the same format. Just started distract me when I realized this after looking at what went to lore so though to mention.
Br, Jarkko
I need to redo this PR mishap happened with linux-next so please ignore. I had my own tree in wrong state.
For tags and subject I'll use MAINTAINERS defined subsystem name.
Br, Jarkko