On Tue, Jun 10, 2025 at 07:03:32AM +0100, Yeoreum Yun wrote: > To integrate a TPM device that uses CRB over FF-A with the IMA subsystem, > both the tpm_crb and tpm_crb_ffa drivers must be built as built-in > (i.e., ARM_FFA_TRANSPORT=y, CONFIG_TCG_CRB=y, and CONFIG_TCG_CRB_FFA=y), > because IMA itself is built-in and the TPM device must be probed > before ima_init() is invoked during IMA subsystem initialization.
The description of the problem and motivation to solve it should be first; not the actions taken. > > To ensure this works correctly, the following initcalls must be executed in > order: > 1. ffa_init() > 2. tpm_crb_ffa_driver_init() > 3. crb_acpi_driver_init() > > Unfortunately, the order of these device initcalls cannot be strictly > controlled. > As a result: > 1. ffa_init() may be called after tpm_crb_ffa_driver_init() > 2. tpm_crb_ffa_driver_init() may be called after > crb_acpi_driver_init() > > For example, the following initcall sequence may occur: > 0000000000000888 l .initcall6.init> crb_acpi_driver_init > 000000000000088c l .initcall6.init> tpm_crb_ffa_driver_init This symbol does not exist. > 0000000000000a9c l .initcall6.init> ffa_init > > In this situation, the IMA subsystem fails to integrate with the TPM device > because the TPM was not available at the time ima_init() was called. > As a result, you may see the following message in the kernel log: > > | ima: No TPM chip found, activating TPM-bypass! TPM initializes before IMA, so there should not be a problem. BR, Jarkko
