linux.git/drivers/char/tpm, branch v6.15

tpm: tis: Double the timeout B to 4s

2025-05-15T01:49:15+00:00

With some Infineon chips the timeouts in tpm_tis_send_data (both B and
C) can reach up to about 2250 ms.

Timeout C is retried since
commit de9e33df7762 ("tpm, tpm_tis: Workaround failed command reception on Infineon devices")

Timeout B still needs to be extended.

The problem is most commonly encountered with context related operation
such as load context/save context. These are issued directly by the
kernel, and there is no retry logic for them.

When a filesystem is set up to use the TPM for unlocking the boot fails,
and restarting the userspace service is ineffective. This is likely
because ignoring a load context/save context result puts the real TPM
state and the TPM state expected by the kernel out of sync.

Chips known to be affected:
tpm_tis IFX1522:00: 2.0 TPM (device-id 0x1D, rev-id 54)
Description: SLB9672
Firmware Revision: 15.22

tpm_tis MSFT0101:00: 2.0 TPM (device-id 0x1B, rev-id 22)
Firmware Revision: 7.83

tpm_tis MSFT0101:00: 2.0 TPM (device-id 0x1A, rev-id 16)
Firmware Revision: 5.63

Link: https://lore.kernel.org/linux-integrity/Z5pI07m0Muapyu9w@kitsune.suse.cz/
Signed-off-by: Michal Suchanek 
Reviewed-by: Jarkko Sakkinen 
Signed-off-by: Jarkko Sakkinen

char: tpm: tpm-buf: Add sanity check fallback in read helpers

2025-05-15T01:47:14+00:00

Fix Smatch-detected issue:

drivers/char/tpm/tpm-buf.c:208 tpm_buf_read_u8() error:
uninitialized symbol 'value'.
drivers/char/tpm/tpm-buf.c:225 tpm_buf_read_u16() error:
uninitialized symbol 'value'.
drivers/char/tpm/tpm-buf.c:242 tpm_buf_read_u32() error:
uninitialized symbol 'value'.

Zero-initialize the return values in tpm_buf_read_u8(), tpm_buf_read_u16(),
and tpm_buf_read_u32() to guard against uninitialized data in case of a
boundary overflow.

Add defensive initialization ensures the return values are always defined,
preventing undefined behavior if the unexpected happens.

Signed-off-by: Purva Yeshi 
Reviewed-by: Stefano Garzarella 
Reviewed-by: Jarkko Sakkinen 
Signed-off-by: Jarkko Sakkinen

tpm: Mask TPM RC in tpm2_start_auth_session()

2025-05-15T01:47:14+00:00

tpm2_start_auth_session() does not mask TPM RC correctly from the callers:

[   28.766528] tpm tpm0: A TPM error (2307) occurred start auth session

Process TPM RCs inside tpm2_start_auth_session(), and map them to POSIX
error codes.

Cc: stable@vger.kernel.org # v6.10+
Fixes: 699e3efd6c64 ("tpm: Add HMAC session start and end functions")
Reported-by: Herbert Xu 
Closes: https://lore.kernel.org/linux-integrity/Z_NgdRHuTKP6JK--@gondor.apana.org.au/
Reviewed-by: Stefano Garzarella 
Signed-off-by: Jarkko Sakkinen

treewide: Switch/rename to timer_delete[_sync]()

2025-04-05T08:30:12+00:00

timer_delete[_sync]() replaces del_timer[_sync](). Convert the whole tree
over and remove the historical wrapper inlines.

Conversion was done with coccinelle plus manual fixups where necessary.

Signed-off-by: Thomas Gleixner 
Signed-off-by: Ingo Molnar

tpm: Make chip->{status,cancel,req_canceled} opt

2025-03-27T15:10:43+00:00

tpm_ftpm_tee does not require chip->status, chip->cancel and
chip->req_canceled. Make them optional.

Reviewed-by: Stefano Garzarella 
Signed-off-by: Jarkko Sakkinen 
Signed-off-by: Jarkko Sakkinen

tpm: End any active auth session before shutdown

2025-03-27T13:34:05+00:00

Lazy flushing of TPM auth sessions can interact badly with IMA + kexec,
resulting in loaded session handles being leaked across the kexec and
not cleaned up. Fix by ensuring any active auth session is ended before
the TPM is told about the shutdown, matching what is done when
suspending.

Before:

root@debian-qemu-efi:~# tpm2_getcap handles-loaded-session
root@debian-qemu-efi:~# tpm2_getcap handles-saved-session
root@debian-qemu-efi:~# kexec --load --kexec-file-syscall …
root@debian-qemu-efi:~# systemctl kexec
…
root@debian-qemu-efi:~# tpm2_getcap handles-loaded-session
- 0x2000000
root@debian-qemu-efi:~# tpm2_getcap handles-saved-session
root@debian-qemu-efi:~#
(repeat kexec steps)
root@debian-qemu-efi:~# tpm2_getcap handles-loaded-session
- 0x2000000
- 0x2000001
root@debian-qemu-efi:~# tpm2_getcap handles-saved-session
root@debian-qemu-efi:~#

After:

root@debian-qemu-efi:~# tpm2_getcap handles-loaded-session
root@debian-qemu-efi:~# tpm2_getcap handles-saved-session
root@debian-qemu-efi:~# kexec --load --kexec-file-syscall …
root@debian-qemu-efi:~# systemctl kexec
…
root@debian-qemu-efi:~# tpm2_getcap handles-loaded-session
root@debian-qemu-efi:~# tpm2_getcap handles-saved-session
root@debian-qemu-efi:~#

Signed-off-by: Jonathan McDowell 
Signed-off-by: Jarkko Sakkinen

tpm_crb: Add support for the ARM FF-A start method

2025-03-27T13:34:05+00:00

The TCG ACPI spec v1.4 defines a start method for the TPMs implemented with
the ARM CRB over FF-A ABI.

Add support for the FF-A start method, and use interfaces provided by the
ffa_crb driver to interact with the FF-A based TPM.

[jarkko: Fine-tuned the commit message.]

Reviewed-by: Jarkko Sakkinen 
Signed-off-by: Stuart Yoder 
Signed-off-by: Jarkko Sakkinen

tpm_crb: Clean-up and refactor check for idle support

2025-03-27T13:34:05+00:00

Refactor TPM idle check to tpm_crb_has_idle(), and reduce paraentheses
usage in start method checks

[jarkko: Fine-tuned the commit message.]

Reviewed-by: Jarkko Sakkinen 
Signed-off-by: Stuart Yoder 
Signed-off-by: Jarkko Sakkinen

tpm_crb: ffa_tpm: Implement driver compliant to CRB over FF-A

2025-03-27T13:34:05+00:00

The ARM specification TPM Service CRB over FF-A specification defines the
FF-A messages to interact with a CRB-based TPM implemented as an FF-A
secure partition.

See: https://developer.arm.com/documentation/den0138/latest/

This driver is probed when a TPM Secure Partition is discovered by the FF-A
subsystem. It exposes APIs used by the TPM CRB driver to send notifications
to the TPM.

[jarkko: Fine-tuned the commit message.]

Acked-by: Sudeep Holla 
Reviewed-by: Jarkko Sakkinen 
Signed-off-by: Stuart Yoder 
Signed-off-by: Jarkko Sakkinen

tpm/tpm_ftpm_tee: fix struct ftpm_tee_private documentation

2025-03-27T13:34:05+00:00

The `state` member in `struct ftpm_tee_private` is in the documentation,
but it has never been in the implementation since the commit 09e574831b27
("tpm/tpm_ftpm_tee: A driver for firmware TPM running inside TEE") that
introduced it.

Remove it to have a match between documentation and implementation.

Signed-off-by: Stefano Garzarella 
Reviewed-by: Jarkko Sakkinen 
Signed-off-by: Jarkko Sakkinen