I double-checked that this is now in-sync with linux-next. I'll address this issue permanently by implementing linux-next validation to my script that prepares the PR, as that would have prevented this from happening.
The following changes since commit a1c2b1da93f5f612aa7a33190c4900c98e51f6da: Merge tag 'for-linus-tsm' of https://github.com/jgunthorpe/linux (2026-10-22 10:41:18 -1000) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd.git tags/tpm-v7.4-rc1-rebased for you to fetch changes up to 071aa806f00cf2948ce8082102d5f64515f53215: tpm: reject duplicate PCR banks in tpm2_get_pcr_allocation (2026-10-23 00:59:21 +0300) ---------------------------------------------------------------- [GIT PULL] TPM DEVICE DRIVER changes for v7.4-rc1 I had to revise my pull request because it came out with a stale tag. Apologies for that. While at it I refined my scripts to not have coherency issues. All the content remains the same with no changes but I noticed one entry missing from the list in the next section, so I added that. FEATURES AND IMPROVEMENTS ========================= - tpm_crb behaviour was improved by putting the chip into an idle state for each transmission. This improves firmware behavior as the kernel now better cancels its state as if it had never touched it in the first place. - One spurious (but harmless) wmb() was dropped from tpm_pm_resume(). - tpm_tis_i2c now requests the optional reset control and deasserts it before communicating with the TPM. - SIMPLE_DEV_PM_OPS was replaced with DEFINE_SIMPLE_DEV_PM_OPS across the whole driver stack. - Validate during driver initialization that no duplicate banks are received. It's unlikely corruption but since it happening would cause oops I decided to retain it as a sanity check. BUGS ==== - tpm2_probe() misinterpreted a transport error on TPM2_GetCapability as the chip not being probed, and the chip was detected as a TPM 1 chip. This can happen in reality only in the extremely rare case of bus corruption. Despite the odds, a fix was landed, as it is still technically a legit bug fix. - It is not really worth the time and energy to go into details as tpm_nsc is a somewhat legacy driver, but one null pointer dereference bug and another causing use-after-free were fixed. - read() of /dev/tpm{,rm}0 with zero size caused a pending response to be consumed. This was fixed simply by an immediate return. Signed-off-by: Jarkko Sakkinen <[email protected]> ---------------------------------------------------------------- Alexander Sverdlin (1): tpm: tpm2_probe: propagate transport errors Li Jun (2): char: tpm: Use SIMPLE_DEV_PM_OPS for ibmvtpm power management tpm: use DEFINE_SIMPLE_DEV_PM_OPS and pm_sleep_ptr() Mario Limonciello (1): tpm: Call cmd_ready/go_idle for each command transmission Pei Xiao (3): tpm: tpm_nsc: fix NULL pointer dereference on init failure tpm: tpm_nsc: stop using the cleanup callback as dev.release tpm: fix zero-length read discarding the pending response Richard Lyu (1): tpm: Remove ineffective wmb() from tpm_pm_resume() Stefano Radaelli (1): tpm: tis_i2c: Deassert optional reset line before probing Yuqi Xu (1): tpm: reject duplicate PCR banks in tpm2_get_pcr_allocation drivers/char/tpm/tpm-chip.c | 24 ------------------------ drivers/char/tpm/tpm-dev-common.c | 3 +++ drivers/char/tpm/tpm-interface.c | 28 ++++++++++++++++++++++------ drivers/char/tpm/tpm2-cmd.c | 21 ++++++++++++++++++++- drivers/char/tpm/tpm_atmel.c | 4 ++-- drivers/char/tpm/tpm_i2c_atmel.c | 4 ++-- drivers/char/tpm/tpm_i2c_infineon.c | 4 ++-- drivers/char/tpm/tpm_i2c_nuvoton.c | 4 ++-- drivers/char/tpm/tpm_ibmvtpm.c | 5 +---- drivers/char/tpm/tpm_infineon.c | 7 +++---- drivers/char/tpm/tpm_nsc.c | 12 ++++++++---- drivers/char/tpm/tpm_tis.c | 4 ++-- drivers/char/tpm/tpm_tis_core.h | 2 -- drivers/char/tpm/tpm_tis_i2c.c | 16 ++++++++++++++-- drivers/char/tpm/tpm_tis_i2c_cr50.c | 4 ++-- drivers/char/tpm/tpm_tis_spi_main.c | 4 ++-- drivers/char/tpm/tpm_tis_synquacer.c | 4 ++-- 17 files changed, 87 insertions(+), 63 deletions(-)
