Commit 451819aa authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'tpmdd-next-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd 

Pull tpm driver updates from Jarkko Sakkinen:
 "The highlights are:

   - Support for signing LKM's with ECDSA keys

   - An integer overflow bug fix in pkey"

* tag 'tpmdd-next-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:
  crypto: public_key: fix overflow during implicit conversion
  tpm: ibmvtpm: Avoid error message when process gets signal while waiting
  certs: Add support for using elliptic curve keys for signing modules
  certs: Trigger creation of RSA module signing key if it's not an RSA key
  char: tpm: cr50_i2c: convert to new probe interface
  char: tpm: Kconfig: remove bad i2c cr50 select
parents 4520dcbe f985911b

certs/Kconfig

+26 −0
Original line number Diff line number Diff line
@@ -15,6 +15,32 @@ config MODULE_SIG_KEY 
         then the kernel will automatically generate the private key and

         certificate as described in Documentation/admin-guide/module-signing.rst



choice

	prompt "Type of module signing key to be generated"

	default MODULE_SIG_KEY_TYPE_RSA

	help

	 The type of module signing key type to generate. This option

	 does not apply if a #PKCS11 URI is used.



config MODULE_SIG_KEY_TYPE_RSA

	bool "RSA"

	depends on MODULE_SIG || (IMA_APPRAISE_MODSIG && MODULES)

	help

	 Use an RSA key for module signing.



config MODULE_SIG_KEY_TYPE_ECDSA

	bool "ECDSA"

	select CRYPTO_ECDSA

	depends on MODULE_SIG || (IMA_APPRAISE_MODSIG && MODULES)

	help

	 Use an elliptic curve key (NIST P384) for module signing. Consider

	 using a strong hash like sha256 or sha384 for hashing modules.



	 Note: Remove all ECDSA signing keys, e.g. certs/signing_key.pem,

	 when falling back to building Linux 5.14 and older kernels.



endchoice



config SYSTEM_TRUSTED_KEYRING

	bool "Provide system-wide ring of trusted keys"

	depends on KEYS

certs/Makefile

+21 −0
Original line number Diff line number Diff line
@@ -57,11 +57,31 @@ endif 
redirect_openssl	= 2>&1

quiet_redirect_openssl	= 2>&1

silent_redirect_openssl = 2>/dev/null

openssl_available       = $(shell openssl help 2>/dev/null && echo yes)



# We do it this way rather than having a boolean option for enabling an

# external private key, because 'make randconfig' might enable such a

# boolean option and we unfortunately can't make it depend on !RANDCONFIG.

ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem")



ifeq ($(openssl_available),yes)

X509TEXT=$(shell openssl x509 -in "certs/signing_key.pem" -text 2>/dev/null)

endif



# Support user changing key type

ifdef CONFIG_MODULE_SIG_KEY_TYPE_ECDSA

keytype_openssl = -newkey ec -pkeyopt ec_paramgen_curve:secp384r1

ifeq ($(openssl_available),yes)

$(if $(findstring id-ecPublicKey,$(X509TEXT)),,$(shell rm -f "certs/signing_key.pem"))

endif

endif # CONFIG_MODULE_SIG_KEY_TYPE_ECDSA



ifdef CONFIG_MODULE_SIG_KEY_TYPE_RSA

ifeq ($(openssl_available),yes)

$(if $(findstring rsaEncryption,$(X509TEXT)),,$(shell rm -f "certs/signing_key.pem"))

endif

endif # CONFIG_MODULE_SIG_KEY_TYPE_RSA



$(obj)/signing_key.pem: $(obj)/x509.genkey

	@$(kecho) "###"

	@$(kecho) "### Now generating an X.509 key pair to be used for signing modules."
@@ -75,6 +95,7 @@ $(obj)/signing_key.pem: $(obj)/x509.genkey 
		-batch -x509 -config $(obj)/x509.genkey \

		-outform PEM -out $(obj)/signing_key.pem \

		-keyout $(obj)/signing_key.pem \

		$(keytype_openssl) \

		$($(quiet)redirect_openssl)

	@$(kecho) "###"

	@$(kecho) "### Key pair generated."

crypto/asymmetric_keys/pkcs7_parser.c

+8 −0
Original line number Diff line number Diff line
@@ -269,6 +269,14 @@ int pkcs7_sig_note_pkey_algo(void *context, size_t hdrlen, 
		ctx->sinfo->sig->pkey_algo = "rsa";

		ctx->sinfo->sig->encoding = "pkcs1";

		break;

	case OID_id_ecdsa_with_sha1:

	case OID_id_ecdsa_with_sha224:

	case OID_id_ecdsa_with_sha256:

	case OID_id_ecdsa_with_sha384:

	case OID_id_ecdsa_with_sha512:

		ctx->sinfo->sig->pkey_algo = "ecdsa";

		ctx->sinfo->sig->encoding = "x962";

		break;

	default:

		printk("Unsupported pkey algo: %u\n", ctx->last_oid);

		return -ENOPKG;

drivers/char/tpm/Kconfig

+0 −1
Original line number Diff line number Diff line
@@ -89,7 +89,6 @@ config TCG_TIS_SYNQUACER 
config TCG_TIS_I2C_CR50

	tristate "TPM Interface Specification 2.0 Interface (I2C - CR50)"

	depends on I2C

	select TCG_CR50

	help

	  This is a driver for the Google cr50 I2C TPM interface which is a

	  custom microcontroller and requires a custom i2c protocol interface

drivers/char/tpm/tpm_ibmvtpm.c

+15 −11
Original line number Diff line number Diff line
@@ -106,17 +106,12 @@ static int tpm_ibmvtpm_recv(struct tpm_chip *chip, u8 *buf, size_t count) 
{

	struct ibmvtpm_dev *ibmvtpm = dev_get_drvdata(&chip->dev);

	u16 len;

	int sig;



	if (!ibmvtpm->rtce_buf) {

		dev_err(ibmvtpm->dev, "ibmvtpm device is not ready\n");

		return 0;

	}



	sig = wait_event_interruptible(ibmvtpm->wq, !ibmvtpm->tpm_processing_cmd);

	if (sig)

		return -EINTR;



	len = ibmvtpm->res_len;



	if (count < len) {
@@ -237,7 +232,7 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count) 
	 * set the processing flag before the Hcall, since we may get the

	 * result (interrupt) before even being able to check rc.

	 */

	ibmvtpm->tpm_processing_cmd = true;

	ibmvtpm->tpm_processing_cmd = 1;



again:

	rc = ibmvtpm_send_crq(ibmvtpm->vdev,
@@ -255,7 +250,7 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count) 
			goto again;

		}

		dev_err(ibmvtpm->dev, "tpm_ibmvtpm_send failed rc=%d\n", rc);

		ibmvtpm->tpm_processing_cmd = false;

		ibmvtpm->tpm_processing_cmd = 0;

	}



	spin_unlock(&ibmvtpm->rtce_lock);
@@ -269,7 +264,9 @@ static void tpm_ibmvtpm_cancel(struct tpm_chip *chip) 


static u8 tpm_ibmvtpm_status(struct tpm_chip *chip)

{

	return 0;

	struct ibmvtpm_dev *ibmvtpm = dev_get_drvdata(&chip->dev);



	return ibmvtpm->tpm_processing_cmd;

}



/**
@@ -457,7 +454,7 @@ static const struct tpm_class_ops tpm_ibmvtpm = { 
	.send = tpm_ibmvtpm_send,

	.cancel = tpm_ibmvtpm_cancel,

	.status = tpm_ibmvtpm_status,

	.req_complete_mask = 0,

	.req_complete_mask = 1,

	.req_complete_val = 0,

	.req_canceled = tpm_ibmvtpm_req_canceled,

};
@@ -550,7 +547,7 @@ static void ibmvtpm_crq_process(struct ibmvtpm_crq *crq, 
		case VTPM_TPM_COMMAND_RES:

			/* len of the data in rtce buffer */

			ibmvtpm->res_len = be16_to_cpu(crq->len);

			ibmvtpm->tpm_processing_cmd = false;

			ibmvtpm->tpm_processing_cmd = 0;

			wake_up_interruptible(&ibmvtpm->wq);

			return;

		default:
@@ -688,8 +685,15 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev, 
		goto init_irq_cleanup;

	}



	if (!strcmp(id->compat, "IBM,vtpm20")) {



	if (!strcmp(id->compat, "IBM,vtpm20"))

		chip->flags |= TPM_CHIP_FLAG_TPM2;



	rc = tpm_get_timeouts(chip);

	if (rc)

		goto init_irq_cleanup;



	if (chip->flags & TPM_CHIP_FLAG_TPM2) {

		rc = tpm2_get_cc_attrs_tbl(chip);

		if (rc)

			goto init_irq_cleanup;