To generate the boot_aggregate log in the IMA subsystem with TPM PCR values,
the TPM driver must be built as built-in and
must be probed before the IMA subsystem is initialized.
However, when the TPM device operates over the FF-A protocol using the CRB
interface,
probing fails and returns -EPROBE_DEFER if
the tpm_crb_ffa device — an FF-A device that provides the communication
interface to the tpm_crb driver — has not yet been probed.
To ensure the TPM device operating over the FF-A protocol with
the CRB interface is probed before IMA initialization,
the following conditions must be met:
1. The corresponding ffa_device must be registered,
which is done via ffa_init().
2. The tpm_crb_driver must successfully probe this device via
tpm_crb_ffa_init().
3. The tpm_crb driver using CRB over FF-A can then
be probed successfully. (See crb_acpi_add() and
tpm_crb_ffa_init() for reference.)
Unfortunately, ffa_init(), tpm_crb_ffa_init(), and crb_acpi_driver_init() are
all registered with device_initcall, which means crb_acpi_driver_init() may
be invoked before ffa_init() and tpm_crb_ffa_init() are completed.
When this occurs, probing the TPM device is deferred.
However, the deferred probe may happen after
the IMA subsystem has already been initialized,
since IMA initialization is performed during late_initcall,
and deferred probing is handled asynchronously via a workqueue.
This patch addresses the issue by ensuring timely probing of
the tpm_crb_ffa device during TPM initialization:
Patch #1: Change the initcall level of ffa_init() to rootfs_initcall,
so that the FF-A device is created before any FF-A drivers are
loaded.
Patch #2: When built as built-in, call ffa_register() within
tpm_crb_ffa_init()
to ensure the Secure Partition used by tpm_crb_ffa is already
registered
before the TPM device is probed.
==============
Patch History
==============
Since v3:
- remove BUG_ON.
- https://lore.kernel.org/all/20250611112448.17751-1-yeoreum....@arm.com/
Since v2:
- rewrite cover letter and commit message:
- https://lore.kernel.org/all/aegwpxxftxw6j...@e129823.arm.com/
Since v1:
- rewrite commit message.
- https://lore.kernel.org/all/20250606105754.1202649-1-yeoreum....@arm.com/
Yeoreum Yun (2):
firmware: arm_ffa: Change initcall level of ffa_init() to
rootfs_initcall
tpm: tpm_crb_ffa: try to probe tpm_crb_ffa when it's built-in
drivers/char/tpm/tpm_crb_ffa.c | 19 ++++++++++++++++---
drivers/firmware/arm_ffa/driver.c | 2 +-
2 files changed, 17 insertions(+), 4 deletions(-)
--
LEVI:{C3F47F37-75D8-414A-A8BA-3980EC8A46D7}
