Linux Security Modules development
 help / color / mirror / Atom feed
From: Jarkko Sakkinen <jarkko@kernel.org>
To: Yeoreum Yun <yeoreum.yun@arm.com>
Cc: Sudeep Holla <sudeep.holla@kernel.org>,
	linux-security-module@vger.kernel.org,
	linux-kernel@vger.kernel.org, linux-integrity@vger.kernel.org,
	paul@paul-moore.com, zohar@linux.ibm.com,
	roberto.sassu@huaweicloud.com, noodles@earth.li,
	jmorris@namei.org, serge@hallyn.com, dmitry.kasatkin@gmail.com,
	eric.snowberg@oracle.com, jgg@ziepe.ca
Subject: Re: [PATCH v4 3/3] tpm: tpm_crb_ffa: revert defered_probed when tpm_crb_ffa is built-in
Date: Tue, 2 Jun 2026 04:55:35 +0300	[thread overview]
Message-ID: <ah44F7qkpUOltuJ5@kernel.org> (raw)
In-Reply-To: <ah1YjJJmrkecklko@e129823.arm.com>

On Mon, Jun 01, 2026 at 11:01:48AM +0100, Yeoreum Yun wrote:
> > On Mon, Jun 01, 2026 at 08:17:13AM +0100, Yeoreum Yun wrote:
> > > Hi Jarkko,
> > > 
> > > Sorry for late answer.
> > > 
> > > > On Mon, May 25, 2026 at 08:54:04AM +0100, Yeoreum Yun wrote:
> > > > > commit 746d9e9f62a6 ("tpm: tpm_crb_ffa: try to probe tpm_crb_ffa when it's build_in")
> > > > > probe tpm_crb_ffa forcefully when it's built-in to integrate with IMA.
> > > > > 
> > > > > However, IMA now provides the IMA_INIT_LATE_SYNC build option, which
> > > > > initialises IMA at the late_initcall_sync level, so this change is no
> > > > > longer required.
> > > > > 
> > > > > Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
> > > > > ---
> > > > >  drivers/char/tpm/tpm_crb_ffa.c | 18 +++---------------
> > > > >  1 file changed, 3 insertions(+), 15 deletions(-)
> > > > > 
> > > > > diff --git a/drivers/char/tpm/tpm_crb_ffa.c b/drivers/char/tpm/tpm_crb_ffa.c
> > > > > index 99f1c1e5644b..025c4d4b17ca 100644
> > > > > --- a/drivers/char/tpm/tpm_crb_ffa.c
> > > > > +++ b/drivers/char/tpm/tpm_crb_ffa.c
> > > > > @@ -177,23 +177,13 @@ static int tpm_crb_ffa_to_linux_errno(int errno)
> > > > >   */
> > > > >  int tpm_crb_ffa_init(void)
> > > > >  {
> > > > > -	int ret = 0;
> > > > > -
> > > > > -	if (!IS_MODULE(CONFIG_TCG_ARM_CRB_FFA)) {
> > > > > -		ret = ffa_register(&tpm_crb_ffa_driver);
> > > > > -		if (ret) {
> > > > > -			tpm_crb_ffa = ERR_PTR(-ENODEV);
> > > > > -			return ret;
> > > > > -		}
> > > > > -	}
> > > > > -
> > > > >  	if (!tpm_crb_ffa)
> > > > > -		ret = -ENOENT;
> > > > > +		return -ENOENT;
> > > > >  
> > > > >  	if (IS_ERR_VALUE(tpm_crb_ffa))
> > > > > -		ret = -ENODEV;
> > > > > +		return -ENODEV;
> > > > >  
> > > > > -	return ret;
> > > > > +	return 0;
> > > > >  }
> > > > >  EXPORT_SYMBOL_GPL(tpm_crb_ffa_init);
> > > > >  
> > > > > @@ -405,9 +395,7 @@ static struct ffa_driver tpm_crb_ffa_driver = {
> > > > >  	.id_table = tpm_crb_ffa_device_id,
> > > > >  };
> > > > >  
> > > > > -#ifdef MODULE
> > > > >  module_ffa_driver(tpm_crb_ffa_driver);
> > > > > -#endif
> > > > >  
> > > > >  MODULE_AUTHOR("Arm");
> > > > >  MODULE_DESCRIPTION("TPM CRB FFA driver");
> > > > > -- 
> > > > > LEVI:{C3F47F37-75D8-414A-A8BA-3980EC8A46D7}
> > > > > 
> > > > 
> > > > How we would sync up this patch? Through which tree etc.
> > > 
> > > IMHO, the IMA relevant thing would be into IMA tree,
> > > However I think this patch would be much easier to sync into Sudeep's
> > > FF-A tree where ff-a initilisation is reverted to device_initcall
> > > unless you're uncomfortable.
> > > 
> > > For this, It might be better to split this patch from this series
> > > since by above and defer probe of ff-a would make a register failure
> > > of registering tpm_crb_ffa driver which is built-in.
> > > 
> > > @Sudeep what do you think?
> > > 
> > 
> > IIRC, there is/was no dependency between these and FF-A patches that are
> > queued in terms of build. I agree there may be dependency to get all the
> > functionality but we can resort to linux-next for that. FF-A is not enabled
> > in the defconfig, so anyone working on FF-A + TPM must enable then and can
> > rely on -next IMHO.
> > 
> > That said, I have already sent PR for FF-A to SoC team and it is already
> > queued for v7.2. I don't have any other plans unless they are fixes.
> 
> Thanks. Then I think it's enough to merge this patch to TPM tree
> when this patchset is approved once.

Oops, sorry I've forgot to tag this although I've mentally accepted
this (which does not unfortunately help move things forward):

It's probably better just put SOB to the tail, or least messiest
I think:

Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>

> 
> -- 
> Sincerely,
> Yeoreum Yun

BR, Jarkko

  reply	other threads:[~2026-06-02  1:55 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-05-25  7:54 [PATCH v4 0/3] introduce IMA_INIT_LATE_SYNC option Yeoreum Yun
2026-05-25  7:54 ` [PATCH v4 1/3] security: lsm: Allow LSMs to register for late_initcall_sync init Yeoreum Yun
2026-05-25  7:54 ` [PATCH v4 2/3] security: ima: introduce IMA_INIT_LATE_SYNC option Yeoreum Yun
2026-05-27 14:30   ` Mimi Zohar
2026-05-27 14:44     ` Yeoreum Yun
2026-05-25  7:54 ` [PATCH v4 3/3] tpm: tpm_crb_ffa: revert defered_probed when tpm_crb_ffa is built-in Yeoreum Yun
2026-05-29 22:46   ` Jarkko Sakkinen
2026-06-01  7:17     ` Yeoreum Yun
2026-06-01  8:54       ` Sudeep Holla
2026-06-01 10:01         ` Yeoreum Yun
2026-06-02  1:55           ` Jarkko Sakkinen [this message]
2026-06-02  1:50         ` Jarkko Sakkinen
2026-06-02  9:57           ` Sudeep Holla
2026-06-02  1:45       ` Jarkko Sakkinen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=ah44F7qkpUOltuJ5@kernel.org \
    --to=jarkko@kernel.org \
    --cc=dmitry.kasatkin@gmail.com \
    --cc=eric.snowberg@oracle.com \
    --cc=jgg@ziepe.ca \
    --cc=jmorris@namei.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=noodles@earth.li \
    --cc=paul@paul-moore.com \
    --cc=roberto.sassu@huaweicloud.com \
    --cc=serge@hallyn.com \
    --cc=sudeep.holla@kernel.org \
    --cc=yeoreum.yun@arm.com \
    --cc=zohar@linux.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox