linux-kernel - [PATCH] fTPM: make sure TEE is initialized before fTPM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20210116001301.16861-1-wei.liu@kernel.org>
Date:   Sat, 16 Jan 2021 00:12:59 +0000
From:   Wei Liu <wei.liu@...nel.org>
To:     Linux Kernel List <linux-kernel@...r.kernel.org>
Cc:     tyhicks@...ux.microsoft.com, Wei Liu <wei.liu@...nel.org>,
        "Michael S. Tsirkin" <mst@...hat.com>,
        Jason Wang <jasowang@...hat.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Arnd Bergmann <arnd@...db.de>,
        Randy Dunlap <rdunlap@...radead.org>,
        Christian Gromm <christian.gromm@...rochip.com>
Subject: [PATCH] fTPM: make sure TEE is initialized before fTPM

For built-in drivers, the order of initialization function invocation is
determined by their link order.

The original code linked TPM drivers before TEE driver when they were
both built in. That caused fTPM's initialization to be deferred to a
worker thread instead of running on PID 1.

That is problematic because IMA's initialization routine, which runs on
PID 1 as a late initcall, needs to have access to the default TPM
instance. If fTPM's initialization is deferred, IMA will not be able to
get hold of a TPM instance in time.

Fix this by modifying Makefile to make sure TEE is initialized before
fTPM when they are both built in.

Signed-off-by: Wei Liu <wei.liu@...nel.org>
---
 drivers/Makefile | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/Makefile b/drivers/Makefile
index fd11b9ac4cc3..45ea5ec9d0fd 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -180,6 +180,11 @@ obj-$(CONFIG_NVMEM)		+= nvmem/
 obj-$(CONFIG_FPGA)		+= fpga/
 obj-$(CONFIG_FSI)		+= fsi/
 obj-$(CONFIG_TEE)		+= tee/
+
+# TPM drivers must come after TEE, otherwise fTPM initialization will be
+# deferred, which causes IMA to not get a TPM device in time
+obj-$(CONFIG_TCG_TPM)		+= char/tpm/
+
 obj-$(CONFIG_MULTIPLEXER)	+= mux/
 obj-$(CONFIG_UNISYS_VISORBUS)	+= visorbus/
 obj-$(CONFIG_SIOX)		+= siox/
-- 
2.20.1