Re: IMA fails to see TPM chip (rpi3, linaro optee)

[Mimi Zohar <zohar@linux.ibm.com>]

[Cc'ing Jarkko]

On Tue, 2019-02-26 at 13:38 +0100, Ard Biesheuvel wrote:
> On Tue, 26 Feb 2019 at 13:14, Mimi Zohar <zohar@linux.ibm.com> wrote:
> >
> > On Tue, 2019-02-26 at 10:12 +0200, Markku Savela wrote:
> > > In case anyone is interested, I got IMA to accept TPM chip in my special
> > > case (linaro optee kernel) by changing
> > >
> > >    clk-bcm2835.c: core_initcall -> susbsys_initcall
> > >    raspberrypi.c: subsys_initcall -> core_initcall
> > >
> > > At first check, the system seems to be ok. Maybe some combination of
> > > initcalls could work, but this is enough for me.
> >
> > Thank you for sharing this!
> >
> > Mimi
> >
> 
> Hi Mimi, Markku,
> 
> I am not sure why I am being cc'ed on this thread, or if there is
> anything particular you would like my opinion on.

Hi Ard, thank you for responding.  The clk not being initialized early
enough has been a problem for years.  Because of the clk not being
initialized, the TPM initialization is deferred, causing IMA to go
into TPM-bypass mode.

> 
> In general, having to juggle initcall ordering like this is horrid, so
> while useful as a data point, I'd prefer fixing it properly instead.
> I.e., if the firmware driver relies on a clock having been enabled,
> this should be reflected in the DT, and supported in the firmware
> driver by deferring the probe until the clock becomes available.

If a DT change could resolve this problem, that would be wonderful.

Mimi

> 
> 
> > >
> > > diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
> > > index d6caac9c3..7cdd597f1 100644
> > > --- a/drivers/clk/bcm/clk-bcm2835.c
> > > +++ b/drivers/clk/bcm/clk-bcm2835.c
> > > @@ -2330,7 +2330,7 @@ static int __init __bcm2835_clk_driver_init(void)
> > >   {
> > >          return platform_driver_register(&bcm2835_clk_driver);
> > >   }
> > > -core_initcall(__bcm2835_clk_driver_init);
> > > +subsys_initcall(__bcm2835_clk_driver_init);
> > >
> > >   MODULE_AUTHOR("Eric Anholt <eric@anholt.net>");
> > >   MODULE_DESCRIPTION("BCM2835 clock driver");
> > > diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c
> > > index a82819a78..dfa362e1c 100644
> > > --- a/drivers/firmware/raspberrypi.c
> > > +++ b/drivers/firmware/raspberrypi.c
> > > @@ -457,7 +457,7 @@ static int __init rpi_firmware_init(void)
> > >   out1:
> > >          return ret;
> > >   }
> > > -subsys_initcall(rpi_firmware_init);
> > > +core_initcall(rpi_firmware_init);
> > >
> > >   static void __init rpi_firmware_exit(void)
> > >   {
> >
>