To integrate a TPM device that uses CRB over FF-A with the IMA subsystem,
both the tpm_crb and tpm_crb_ffa drivers must be built as built-in
(i.e., ARM_FFA_TRANSPORT=y, CONFIG_TCG_CRB=y, and CONFIG_TCG_CRB_FFA=y),
because IMA itself is built-in and the TPM device must be probed
before ima_init() is invoked during IMA subsystem initialization.
To ensure this works correctly, the following initcalls must be executed in
order:
1. ffa_init()
2. tpm_crb_ffa_driver_init()
3. crb_acpi_driver_init()
Unfortunately, the order of these device initcalls cannot be strictly
controlled.
As a result:
1. ffa_init() may be called after tpm_crb_ffa_driver_init()
2. tpm_crb_ffa_driver_init() may be called after
crb_acpi_driver_init()
For example, the following initcall sequence may occur:
0000000000000888 l .initcall6.init> crb_acpi_driver_init
000000000000088c l .initcall6.init> tpm_crb_ffa_driver_init
0000000000000a9c l .initcall6.init> ffa_init
In this situation, the IMA subsystem fails to integrate with the TPM device
because the TPM was not available at the time ima_init() was called.
As a result, you may see the following message in the kernel log:
| ima: No TPM chip found, activating TPM-bypass!
To resolve this issue:
Patch #1: change the initcall level of ffa_init() to rootfs_initcall,
so that the FF-A device is created before any FF-A drivers are
loaded.
Patch #2: call ffa_register() in tpm_crb_ffa_init() when it is built as
built-in,
ensuring that the Secure Partition used by tpm_crb_ffa
is already registered when the TPM device is probed.
==============
Patch History
==============
Since v1:
- rewrite commit message.
- https://lore.kernel.org/all/20250606105754.1202649-1-yeoreum....@arm.com/
Yeoreum Yun (2):
firmware: arm_ffa: Change initcall level of ffa_init() to
rootfs_initcall
tpm: tpm_crb_ffa: maunally register tpm_crb_ffa driver when it's
built-in
drivers/char/tpm/tpm_crb_ffa.c | 22 +++++++++++++++++-----
drivers/firmware/arm_ffa/driver.c | 2 +-
2 files changed, 18 insertions(+), 6 deletions(-)
--
LEVI:{C3F47F37-75D8-414A-A8BA-3980EC8A46D7}
