Hi Jarkko, > On Tue, Jun 10, 2025 at 07:03:32AM +0100, Yeoreum Yun wrote: > > To integrate a TPM device that uses CRB over FF-A with the IMA subsystem, > > both the tpm_crb and tpm_crb_ffa drivers must be built as built-in > > (i.e., ARM_FFA_TRANSPORT=y, CONFIG_TCG_CRB=y, and CONFIG_TCG_CRB_FFA=y), > > because IMA itself is built-in and the TPM device must be probed > > before ima_init() is invoked during IMA subsystem initialization. > > The description of the problem and motivation to solve it should be > first; not the actions taken.
Okay. I'll describe the problem first. > > > > > To ensure this works correctly, the following initcalls must be executed in > > order: > > 1. ffa_init() > > 2. tpm_crb_ffa_driver_init() > > 3. crb_acpi_driver_init() > > > > Unfortunately, the order of these device initcalls cannot be strictly > > controlled. > > As a result: > > 1. ffa_init() may be called after tpm_crb_ffa_driver_init() > > 2. tpm_crb_ffa_driver_init() may be called after > > crb_acpi_driver_init() > > > > For example, the following initcall sequence may occur: > > 0000000000000888 l .initcall6.init> crb_acpi_driver_init > > 000000000000088c l .initcall6.init> tpm_crb_ffa_driver_init > > This symbol does not exist. I don't know you said "This symbol does not exit". When CONFIG_TCG=CRB=y, CONFIG_TCG_CRB_FFA=y and ARM_FFA_TRANSPORT=y, above symbols exist. crb_acpi_driver_init() generated by module_acpi_driver(crb_acpi_driver); in tpm_crb.c and tpm_crb_ffa_driver_init() generated by module_ffa_driver(tpm_crb_ffa_driver); in tpm_crb_ffa.c so you can get the above symbols: $ llvm-readelf-21 --symbols vmlinux | grep crb | grep init 171332: ffff80008203ef08 56 FUNC LOCAL DEFAULT 19 crb_acpi_driver_init ... 370077: ffff800080d650d8 92 FUNC GLOBAL DEFAULT 2 tpm_crb_ffa_init > > > 0000000000000a9c l .initcall6.init> ffa_init > > > > In this situation, the IMA subsystem fails to integrate with the TPM device > > because the TPM was not available at the time ima_init() was called. > > As a result, you may see the following message in the kernel log: > > > > | ima: No TPM chip found, activating TPM-bypass! > > TPM initializes before IMA, so there should not be a problem. If you see my commit message it describes the situation why this happen. when crb_acpi_driver_init() is called but before tpm_crb_ffa_init() is called, the secure partition doesn't probe. so crb_acpi_driver_init() would be failed wiith -EPROBE. In this situation, init_ima() which call ima_init() can be called first. NOTE, init_ima() is deployed in late_initcall and the "deferred_probe device" is tried again in deferred_probe late initcall. However, even the deferred_probe can be call later then init_ima(). 000000000000012c l .initcall7.init>-------0000000000000000 init_ima 000000000000016c l .initcall7.init>-------0000000000000000 deferred_probe_initcall7 That's why init_ima() is failed to init with TPM when It is deffered. Would you let me know why you said it's not a problem? -- Sincerely, Yeoreum Yun
