Package: linux-image-arm64 Version: 7.0.13-1~bpo13+1 Severity: wishlist X-Debbugs-Cc: [email protected] User: [email protected] Usertags: arm64
Dear kernel team, please enable, on arm64 (and ideally generically): CONFIG_TCG_FTPM_TEE=m This single module is the only thing preventing a fully working TPM 2.0 on the growing class of ARM SBCs that ship a standards-compliant UEFI firmware (mainline TF-A + OP-TEE + U-Boot, SystemReady-IR style) with the Microsoft fTPM reference implementation running as a trusted application inside OP-TEE. On such boards the firmware performs TCG2 measured boot and hands Linux the event log (visible as the EFI TPMEventLog / TPMFinalLog config tables); systemd 257 in trixie is fully TPM2-capable (systemd-cryptenroll, pcrlock, LUKS2 token plugins). The missing driver is tpm_ftpm_tee. Details that make this a low-risk change: - drivers/char/tpm/tpm_ftpm_tee.c is a small, self-contained proxy driver. - It depends only on TEE && OPTEE, both already =m in the Debian config (CONFIG_OPTEE=m), so it adds a module and nothing else when built. - It has zero cost on systems without an OP-TEE fTPM: it binds via TEE-bus enumeration of the fTPM TA UUID (bc50d971-d4c9-42c4-82cb-343fb7f37896) and simply never probes if that TA is absent. - Upstream precedent: the arm64 defconfig gained it in Feb 2026 (patchew.org/linux/[email protected]/). Verified on a Radxa ROCK 5B running mainline-based UEFI firmware: with a DKMS build of exactly this module, /dev/tpm0 appears, the firmware event log populates /sys/kernel/security/tpm0/binary_bios_measurements, and "bootctl status" reports "TPM2 Support: yes". Shipping the module in the Debian kernel removes the need for any out-of-tree build. Optional, separate follow-up (NOT required for the above to work): CONFIG_RPMB=y This enables in-kernel RPMB routing so the fTPM's secure storage does not need a userspace tee-supplicant. Without it, RPMB is served by tee-supplicant, which works. If enabled it should be =y not =m, because MMC_BLOCK has "depends on RPMB || !RPMB" and RPMB=m would demote the built-in MMC_BLOCK; as =y it is a small in-kernel class with no cost on systems lacking RPMB hardware. Thanks! -- System Information: Debian Release: 13.6 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable') Architecture: arm64 (aarch64) Foreign Architectures: amd64 Kernel: Linux 7.0.13+deb13-arm64 (SMP w/8 CPU threads; PREEMPT) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages linux-image-arm64 depends on: ii linux-base-arm64 7.0.13-1~bpo13+1 ii linux-image-7.0.13+deb13-arm64 7.0.13-1~bpo13+1 linux-image-arm64 recommends no packages. linux-image-arm64 suggests no packages. -- no debconf information
