linux-kernel - [GIT PULL] tpmdd: changes for v6.4-rc1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <20230424144130.1084795-1-jarkko@kernel.org>
Date:   Mon, 24 Apr 2023 17:41:30 +0300
From:   Jarkko Sakkinen <jarkko@...nel.org>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     Jarkko Sakkinen <jarkko@...nel.org>,
        David Howells <dhowells@...hat.com>,
        Mimi Zohar <zohar@...ux.ibm.com>,
        Eric Snowberg <eric.snowberg@...cle.com>,
        Lino Sanfilippo <l.sanfilippo@...bus.com>,
        Martin Dimov <martin@...rto.com>,
        linux-integrity@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [GIT PULL] tpmdd: changes for v6.4-rc1

The following changes since commit 457391b0380335d5e9a5babdec90ac53928b23b4:

  Linux 6.3 (2023-04-23 12:02:52 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd.git/ tags/tpmdd-v6.4-rc1

for you to fetch changes up to bd8621ca1510e6e802df9855bdc35a04a3cfa932:

  tpm: Add !tpm_amd_is_rng_defective() to the hwrng_unregister() call site (2023-04-24 16:15:53 +0300)

----------------------------------------------------------------
Two major features are included into this pull request. The links for
the landed patch sets are below.

The .machine keyring, used for Machine Owner Keys (MOK), acquired the
ability to store only CA enforced keys, and put rest to the .platform
keyring, thus separating the code signing keys from the keys that are
used to sign certificates. This essentially unlocks the use of the
.machine keyring as a trust anchor for IMA. It is an opt-in feature,
meaning that the additional contraints won't brick anyone who does not
care about them.

The 2nd feature is the enablement of interrupt based transactions with
discrete TPM chips (tpm_tis). There was code for this existing but it
never really worked so I consider this a new feature rather than a bug
fix. Before the driver just falled back to the polling mode.

Link: https://lore.kernel.org/linux-integrity/a93b6222-edda-d43c-f010-a59701f2aeef@gmx.de/
Link: https://lore.kernel.org/linux-integrity/20230302164652.83571-1-eric.snowberg@oracle.com/

----------------------------------------------------------------
Eric Snowberg (6):
      KEYS: Create static version of public_key_verify_signature
      KEYS: Add missing function documentation
      KEYS: X.509: Parse Basic Constraints for CA
      KEYS: X.509: Parse Key Usage
      KEYS: CA link restriction
      integrity: machine keyring CA configuration

Haris Okanovic (1):
      tpm_tis: fix stall after iowrite*()s

Jarkko Sakkinen (1):
      tpm: Add !tpm_amd_is_rng_defective() to the hwrng_unregister() call site

Krzysztof Kozlowski (2):
      tpm: st33zp24: Mark ACPI and OF related data as maybe unused
      tpm: tpm_tis_spi: Mark ACPI and OF related data as maybe unused

Lino Sanfilippo (14):
      tpm, tpm_tis: Avoid cache incoherency in test for interrupts
      tpm, tpm_tis: Claim locality before writing TPM_INT_ENABLE register
      tpm, tpm_tis: Disable interrupts if tpm_tis_probe_irq() failed
      tpm, tpm_tis: Do not skip reset of original interrupt vector
      tpm, tpm_tis: Claim locality before writing interrupt registers
      tpm, tpm_tis: Only handle supported interrupts
      tpm, tpm_tis: Move interrupt mask checks into own function
      tpm, tpm_tis: do not check for the active locality in interrupt handler
      tpm, tpm: Implement usage counter for locality
      tpm, tpm_tis: Request threaded interrupt handler
      tpm, tpm_tis: Claim locality in interrupt handler
      tpm, tpm_tis: Claim locality when interrupts are reenabled on resume
      tpm, tpm_tis: startup chip before testing for interrupts
      tpm, tpm_tis: Enable interrupt test

Mark Hasemeyer (1):
      tpm: cr50: i2c: use jiffies to wait for tpm ready irq

Uwe Kleine-König (3):
      tpm/tpm_ftpm_tee: Convert to platform remove callback returning void
      tpm/tpm_tis: Convert to platform remove callback returning void
      tpm/tpm_tis_synquacer: Convert to platform remove callback returning void

Yu Zhe (1):
      tpm: remove unnecessary (void*) conversions

 certs/system_keyring.c                    |  14 +-
 crypto/asymmetric_keys/restrict.c         |  40 ++++
 crypto/asymmetric_keys/x509_cert_parser.c |  50 +++++
 drivers/char/tpm/eventlog/common.c        |   6 +-
 drivers/char/tpm/st33zp24/i2c.c           |   4 +-
 drivers/char/tpm/st33zp24/spi.c           |   4 +-
 drivers/char/tpm/tpm-chip.c               |  41 ++--
 drivers/char/tpm/tpm.h                    |   1 +
 drivers/char/tpm/tpm_ftpm_tee.c           |   6 +-
 drivers/char/tpm/tpm_tis.c                |  51 ++++-
 drivers/char/tpm/tpm_tis_core.c           | 299 ++++++++++++++++++------------
 drivers/char/tpm/tpm_tis_core.h           |   5 +-
 drivers/char/tpm/tpm_tis_i2c_cr50.c       |   3 +-
 drivers/char/tpm/tpm_tis_spi_main.c       |   4 +-
 drivers/char/tpm/tpm_tis_synquacer.c      |   6 +-
 include/crypto/public_key.h               |  28 +++
 security/integrity/Kconfig                |  23 ++-
 security/integrity/digsig.c               |   8 +-
 18 files changed, 431 insertions(+), 162 deletions(-)