mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-01 06:33:07 +00:00
7cf6a8a17f
- Strictened validation of key hashes for SYSTEM_BLACKLIST_HASH_LIST. An invalid hash format causes a compilation error. Previously, they got included to the kernel binary but were silently ignored at run-time. - Allow root user to append new hashes to the blacklist keyring. - Trusted keys backed with Cryptographic Acceleration and Assurance Module (CAAM), which part of some of the new NXP's SoC's. Now there is total three hardware backends for trusted keys: TPM, ARM TEE and CAAM. - A scattered set of fixes and small improvements for the TPM driver. Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org> -----BEGIN PGP SIGNATURE----- iIgEABYIADAWIQRE6pSOnaBC00OEHEIaerohdGur0gUCYoux6xIcamFya2tvQGtl cm5lbC5vcmcACgkQGnq6IXRrq9LTQgEA4zRrlmLPjhZ1iZpPZiyBBv5eOx20/c+y R7tCfJFB2+ABAOT1E885vt+GgKTY4mYloHJ+ZtnTIf1QRMP6EoSX+TwP =oBOO -----END PGP SIGNATURE----- Merge tag 'tpmdd-next-v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm updates from Jarkko Sakkinen: - Tightened validation of key hashes for SYSTEM_BLACKLIST_HASH_LIST. An invalid hash format causes a compilation error. Previously, they got included to the kernel binary but were silently ignored at run-time. - Allow root user to append new hashes to the blacklist keyring. - Trusted keys backed with Cryptographic Acceleration and Assurance Module (CAAM), which part of some of the new NXP's SoC's. Now there is total three hardware backends for trusted keys: TPM, ARM TEE and CAAM. - A scattered set of fixes and small improvements for the TPM driver. * tag 'tpmdd-next-v5.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: MAINTAINERS: add KEYS-TRUSTED-CAAM doc: trusted-encrypted: describe new CAAM trust source KEYS: trusted: Introduce support for NXP CAAM-based trusted keys crypto: caam - add in-kernel interface for blob generator crypto: caam - determine whether CAAM supports blob encap/decap KEYS: trusted: allow use of kernel RNG for key material KEYS: trusted: allow use of TEE as backend without TCG_TPM support tpm: Add field upgrade mode support for Infineon TPM2 modules tpm: Fix buffer access in tpm2_get_tpm_pt() char: tpm: cr50_i2c: Suppress duplicated error message in .remove() tpm: cr50: Add new device/vendor ID 0x504a6666 tpm: Remove read16/read32/write32 calls from tpm_tis_phy_ops tpm: ibmvtpm: Correct the return value in tpm_ibmvtpm_probe() tpm/tpm_ftpm_tee: Return true/false (not 1/0) from bool functions certs: Explain the rationale to call panic() certs: Allow root user to append signed hashes to the blacklist keyring certs: Check that builtin blacklist hashes are valid certs: Make blacklist_vet_description() more strict certs: Factor out the blacklist hash creation tools/certs: Add print-cert-tbs-hash.sh |
||
---|---|---|
.. | ||
atomic | ||
basic | ||
clang-tools | ||
coccinelle | ||
dtc | ||
dummy-tools | ||
gcc-plugins | ||
gdb | ||
genksyms | ||
kconfig | ||
ksymoops | ||
mod | ||
package | ||
selinux | ||
tracing | ||
.gitignore | ||
adjust_autoksyms.sh | ||
as-version.sh | ||
asn1_compiler.c | ||
bin2c.c | ||
bloat-o-meter | ||
bootgraph.pl | ||
bpf_doc.py | ||
cc-can-link.sh | ||
cc-version.sh | ||
check-blacklist-hashes.awk | ||
check-sysctl-docs | ||
check_extable.sh | ||
checkdeclares.pl | ||
checkincludes.pl | ||
checkkconfigsymbols.py | ||
checkpatch.pl | ||
checkstack.pl | ||
checksyscalls.sh | ||
checkversion.pl | ||
cleanfile | ||
cleanpatch | ||
coccicheck | ||
config | ||
const_structs.checkpatch | ||
decode_stacktrace.sh | ||
decodecode | ||
depmod.sh | ||
dev-needs.sh | ||
diffconfig | ||
documentation-file-ref-check | ||
export_report.pl | ||
extract-ikconfig | ||
extract-module-sig.pl | ||
extract-sys-certs.pl | ||
extract-vmlinux | ||
extract_xc3028.pl | ||
faddr2line | ||
file-size.sh | ||
find-unused-docs.sh | ||
gcc-goto.sh | ||
gcc-ld | ||
gcc-x86_32-has-stack-protector.sh | ||
gcc-x86_64-has-stack-protector.sh | ||
gen-randstruct-seed.sh | ||
gen_autoksyms.sh | ||
gen_ksymdeps.sh | ||
generate_initcall_order.pl | ||
get_abi.pl | ||
get_dvb_firmware | ||
get_feat.pl | ||
get_maintainer.pl | ||
gfp-translate | ||
headerdep.pl | ||
headers_install.sh | ||
insert-sys-cert.c | ||
jobserver-exec | ||
kallsyms.c | ||
Kbuild.include | ||
Kconfig.include | ||
kernel-doc | ||
ld-version.sh | ||
leaking_addresses.pl | ||
Lindent | ||
link-vmlinux.sh | ||
Makefile | ||
Makefile.asm-generic | ||
Makefile.build | ||
Makefile.clang | ||
Makefile.clean | ||
Makefile.compiler | ||
Makefile.debug | ||
Makefile.dtbinst | ||
Makefile.extrawarn | ||
Makefile.gcc-plugins | ||
Makefile.headersinst | ||
Makefile.host | ||
Makefile.kasan | ||
Makefile.kcov | ||
Makefile.kcsan | ||
Makefile.lib | ||
Makefile.modfinal | ||
Makefile.modinst | ||
Makefile.modpost | ||
Makefile.package | ||
Makefile.randstruct | ||
Makefile.ubsan | ||
Makefile.userprogs | ||
makelst | ||
markup_oops.pl | ||
min-tool-version.sh | ||
mkcompile_h | ||
mksysmap | ||
mkuboot.sh | ||
module.lds.S | ||
modules-check.sh | ||
nsdeps | ||
objdiff | ||
objdump-func | ||
pahole-flags.sh | ||
pahole-version.sh | ||
parse-maintainers.pl | ||
patch-kernel | ||
profile2linkerlist.pl | ||
prune-kernel | ||
recordmcount.c | ||
recordmcount.h | ||
recordmcount.pl | ||
remove-stale-files | ||
setlocalversion | ||
show_delta | ||
sign-file.c | ||
sorttable.c | ||
sorttable.h | ||
spdxcheck-test.sh | ||
spdxcheck.py | ||
spelling.txt | ||
sphinx-pre-install | ||
split-man.pl | ||
stackdelta | ||
stackusage | ||
subarch.include | ||
syscallhdr.sh | ||
syscallnr.sh | ||
syscalltbl.sh | ||
tags.sh | ||
test_fortify.sh | ||
tools-support-relr.sh | ||
unifdef.c | ||
ver_linux | ||
xen-hypercalls.sh | ||
xz_wrap.sh |