Eric Lee / smarc-fsl-linux-kernel

25 Sep, 2020

1 commit

  • 77ebdabe8   crypto: af_alg - add extra parameters for DRBG interface ... Browse Code »

    Extend the user-space RNG interface:
    1. Add entropy input via ALG_SET_DRBG_ENTROPY setsockopt option;
    2. Add additional data input via sendmsg syscall.

    This allows DRBG to be tested with test vectors, for example for the
    purpose of CAVP testing, which otherwise isn't possible.

    To prevent erroneous use of entropy input, it is hidden under
    CRYPTO_USER_API_RNG_CAVP config option and requires CAP_SYS_ADMIN to
    succeed.

    Signed-off-by: Elena Petrova
    Acked-by: Stephan Müller
    Reviewed-by: Eric Biggers
    Signed-off-by: Herbert Xu

    Elena Petrova
     

05 Aug, 2020

1 commit

  • 2324d50d0   Merge tag 'docs-5.9' of git://git.lwn.net/linux ... Browse Code »

    Pull documentation updates from Jonathan Corbet:
    "It's been a busy cycle for documentation - hopefully the busiest for a
    while to come. Changes include:

    - Some new Chinese translations

    - Progress on the battle against double words words and non-HTTPS
    URLs

    - Some block-mq documentation

    - More RST conversions from Mauro. At this point, that task is
    essentially complete, so we shouldn't see this kind of churn again
    for a while. Unless we decide to switch to asciidoc or
    something...:)

    - Lots of typo fixes, warning fixes, and more"

    * tag 'docs-5.9' of git://git.lwn.net/linux: (195 commits)
    scripts/kernel-doc: optionally treat warnings as errors
    docs: ia64: correct typo
    mailmap: add entry for
    doc/zh_CN: add cpu-load Chinese version
    Documentation/admin-guide: tainted-kernels: fix spelling mistake
    MAINTAINERS: adjust kprobes.rst entry to new location
    devices.txt: document rfkill allocation
    PCI: correct flag name
    docs: filesystems: vfs: correct flag name
    docs: filesystems: vfs: correct sync_mode flag names
    docs: path-lookup: markup fixes for emphasis
    docs: path-lookup: more markup fixes
    docs: path-lookup: fix HTML entity mojibake
    CREDITS: Replace HTTP links with HTTPS ones
    docs: process: Add an example for creating a fixes tag
    doc/zh_CN: add Chinese translation prefer section
    doc/zh_CN: add clearing-warn-once Chinese version
    doc/zh_CN: add admin-guide index
    doc:it_IT: process: coding-style.rst: Correct __maybe_unused compiler label
    futex: MAINTAINERS: Re-add selftests directory
    ...

    Linus Torvalds
     

23 Jul, 2020

1 commit

  • 9332a9e73   crypto: Replace HTTP links with HTTPS ones ... Browse Code »

    Rationale:
    Reduces attack surface on kernel devs opening the links for MITM
    as HTTPS traffic is much harder to manipulate.

    Deterministic algorithm:
    For each file:
    If not .svg:
    For each line:
    If doesn't contain `\bxmlns\b`:
    For each link, `\bhttp://[^# \t\r\n]*(?:\w|/)`:
    If neither `\bgnu\.org/license`, nor `\bmozilla\.org/MPL\b`:
    If both the HTTP and HTTPS versions
    return 200 OK and serve the same content:
    Replace HTTP with HTTPS.

    Signed-off-by: Alexander A. Klimov
    Signed-off-by: Herbert Xu

    Alexander A. Klimov
     

20 Jun, 2020

4 commits

  • 740369c57   docs: crypto: descore-readme.txt: convert to ReST format ... Browse Code »

    Convert this readme file to ReST file format, preserving its
    contents as-is as much as possible. The only changes are:

    - Added chapter and title markups;
    - Added blank lines where needed;
    - Added list markups where needed;
    - Use a table markup;
    - replace markups like `foo' to ``foo``;
    - add one extra literal markup to avoid warnings.

    Signed-off-by: Mauro Carvalho Chehab
    Link: https://lore.kernel.org/r/1426be1c7758c0224418352665040220b8a31799.1592203650.git.mchehab+huawei@kernel.org
    Signed-off-by: Jonathan Corbet

    Mauro Carvalho Chehab
     
  • ddc92399c   docs: crypto: convert async-tx-api.txt to ReST format ... Browse Code »

    - Place the txt index inside a comment;
    - Use title and chapter markups;
    - Adjust markups for numbered list;
    - Mark literal blocks as such;
    - Use tables markup.
    - Adjust indentation when needed.

    Acked-By: Vinod Koul # dmaengine
    Signed-off-by: Mauro Carvalho Chehab
    Link: https://lore.kernel.org/r/98977242130efe86d1200f7a167299d4c1c205c5.1592203650.git.mchehab+huawei@kernel.org
    Signed-off-by: Jonathan Corbet

    Mauro Carvalho Chehab
     
  • 5846551bb   docs: crypto: convert api-intro.txt to ReST format ... Browse Code »

    - Change title markups;
    - Mark literal blocks;
    - Use list markups at authors/credits;
    - Add blank lines when needed;
    - Remove trailing whitespaces.

    Signed-off-by: Mauro Carvalho Chehab
    Link: https://lore.kernel.org/r/c71e2c73a787ec7814db09bec3c1359779785bfa.1592203650.git.mchehab+huawei@kernel.org
    Signed-off-by: Jonathan Corbet

    Mauro Carvalho Chehab
     
  • 0efaaa865   docs: crypto: convert asymmetric-keys.txt to ReST ... Browse Code »

    This file is almost compatible with ReST. Just minor changes
    were needed:

    - Adjust document and titles markups;
    - Adjust numbered list markups;
    - Add a comments markup for the Contents section;
    - Add markups for literal blocks.

    Acked-by: Jarkko Sakkinen
    Signed-off-by: Mauro Carvalho Chehab
    Link: https://lore.kernel.org/r/c2275ea94e0507a01b020ab66dfa824d8b1c2545.1592203650.git.mchehab+huawei@kernel.org
    Signed-off-by: Jonathan Corbet

    Mauro Carvalho Chehab
     

20 Dec, 2019

1 commit

  • c6d633a92   crypto: algapi - make unregistration functions return void ... Browse Code »

    Some of the algorithm unregistration functions return -ENOENT when asked
    to unregister a non-registered algorithm, while others always return 0
    or always return void. But no users check the return value, except for
    two of the bulk unregistration functions which print a message on error
    but still always return 0 to their caller, and crypto_del_alg() which
    calls crypto_unregister_instance() which always returns 0.

    Since unregistering a non-registered algorithm is always a kernel bug
    but there isn't anything callers should do to handle this situation at
    runtime, let's simplify things by making all the unregistration
    functions return void, and moving the error message into
    crypto_unregister_alg() and upgrading it to a WARN().

    Signed-off-by: Eric Biggers
    Signed-off-by: Herbert Xu

    Eric Biggers
     

11 Dec, 2019

1 commit

17 Nov, 2019

1 commit

01 Nov, 2019

2 commits

  • c65058b75   crypto: skcipher - remove the "blkcipher" algorithm type ... Browse Code »

    Now that all "blkcipher" algorithms have been converted to "skcipher",
    remove the blkcipher algorithm type.

    The skcipher (symmetric key cipher) algorithm type was introduced a few
    years ago to replace both blkcipher and ablkcipher (synchronous and
    asynchronous block cipher). The advantages of skcipher include:

    - A much less confusing name, since none of these algorithm types have
    ever actually been for raw block ciphers, but rather for all
    length-preserving encryption modes including block cipher modes of
    operation, stream ciphers, and other length-preserving modes.

    - It unified blkcipher and ablkcipher into a single algorithm type
    which supports both synchronous and asynchronous implementations.
    Note, blkcipher already operated only on scatterlists, so the fact
    that skcipher does too isn't a regression in functionality.

    - Better type safety by using struct skcipher_alg, struct
    crypto_skcipher, etc. instead of crypto_alg, crypto_tfm, etc.

    - It sometimes simplifies the implementations of algorithms.

    Also, the blkcipher API was no longer being tested.

    Signed-off-by: Eric Biggers
    Signed-off-by: Herbert Xu

    Eric Biggers
     
  • cec0cb8a2   crypto: skcipher - remove crypto_has_ablkcipher() ... Browse Code »

    crypto_has_ablkcipher() has no users, and it does the same thing as
    crypto_has_skcipher() anyway. So remove it. This also removes the last
    user of crypto_skcipher_type() and crypto_skcipher_mask(), so remove
    those too.

    Signed-off-by: Eric Biggers
    Signed-off-by: Herbert Xu

    Eric Biggers
     

19 Sep, 2019

1 commit

  • 8b53c7653   Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 ... Browse Code »

    Pull crypto updates from Herbert Xu:
    "API:
    - Add the ability to abort a skcipher walk.

    Algorithms:
    - Fix XTS to actually do the stealing.
    - Add library helpers for AES and DES for single-block users.
    - Add library helpers for SHA256.
    - Add new DES key verification helper.
    - Add surrounding bits for ESSIV generator.
    - Add accelerations for aegis128.
    - Add test vectors for lzo-rle.

    Drivers:
    - Add i.MX8MQ support to caam.
    - Add gcm/ccm/cfb/ofb aes support in inside-secure.
    - Add ofb/cfb aes support in media-tek.
    - Add HiSilicon ZIP accelerator support.

    Others:
    - Fix potential race condition in padata.
    - Use unbound workqueues in padata"

    * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (311 commits)
    crypto: caam - Cast to long first before pointer conversion
    crypto: ccree - enable CTS support in AES-XTS
    crypto: inside-secure - Probe transform record cache RAM sizes
    crypto: inside-secure - Base RD fetchcount on actual RD FIFO size
    crypto: inside-secure - Base CD fetchcount on actual CD FIFO size
    crypto: inside-secure - Enable extended algorithms on newer HW
    crypto: inside-secure: Corrected configuration of EIP96_TOKEN_CTRL
    crypto: inside-secure - Add EIP97/EIP197 and endianness detection
    padata: remove cpu_index from the parallel_queue
    padata: unbind parallel jobs from specific CPUs
    padata: use separate workqueues for parallel and serial work
    padata, pcrypt: take CPU hotplug lock internally in padata_alloc_possible
    crypto: pcrypt - remove padata cpumask notifier
    padata: make padata_do_parallel find alternate callback CPU
    workqueue: require CPU hotplug read exclusion for apply_workqueue_attrs
    workqueue: unconfine alloc/apply/free_workqueue_attrs()
    padata: allocate workqueue internally
    arm64: dts: imx8mq: Add CAAM node
    random: Use wait_event_freezable() in add_hwgenerator_randomness()
    crypto: ux500 - Fix COMPILE_TEST warnings
    ...

    Linus Torvalds
     

15 Aug, 2019

1 commit

17 Jul, 2019

1 commit

03 Jul, 2019

2 commits

13 Jun, 2019

1 commit

  • 03d66cfa2   crypto: doc - improve the skcipher API example code ... Browse Code »

    Rewrite the skcipher API example, changing it to encrypt a buffer with
    AES-256-XTS. This addresses various problems with the previous example:

    - It requests a specific driver "cbc-aes-aesni", which is unusual.
    Normally users ask for "cbc(aes)", not a specific driver.

    - It encrypts only a single AES block. For the reader, that doesn't
    clearly distinguish the "skcipher" API from the "cipher" API.

    - Showing how to encrypt something with bare CBC is arguably a poor
    choice of example, as it doesn't follow modern crypto trends. Now,
    usually authenticated encryption is recommended, in which case the
    user would use the AEAD API, not skcipher. Disk encryption is still a
    legitimate use for skcipher, but for that usually XTS is recommended.

    - Many other bugs and poor coding practices, such as not setting
    CRYPTO_TFM_REQ_MAY_SLEEP, unnecessarily allocating a heap buffer for
    the IV, unnecessary NULL checks, using a pointless wrapper struct, and
    forgetting to set an error code in one case.

    Signed-off-by: Eric Biggers
    Acked-by: Ard Biesheuvel
    Signed-off-by: Herbert Xu

    Eric Biggers
     

30 May, 2019

1 commit

25 Apr, 2019

1 commit

  • 877b5691f   crypto: shash - remove shash_desc::flags ... Browse Code »

    The flags field in 'struct shash_desc' never actually does anything.
    The only ostensibly supported flag is CRYPTO_TFM_REQ_MAY_SLEEP.
    However, no shash algorithm ever sleeps, making this flag a no-op.

    With this being the case, inevitably some users who can't sleep wrongly
    pass MAY_SLEEP. These would all need to be fixed if any shash algorithm
    actually started sleeping. For example, the shash_ahash_*() functions,
    which wrap a shash algorithm with the ahash API, pass through MAY_SLEEP
    from the ahash API to the shash API. However, the shash functions are
    called under kmap_atomic(), so actually they're assumed to never sleep.

    Even if it turns out that some users do need preemption points while
    hashing large buffers, we could easily provide a helper function
    crypto_shash_update_large() which divides the data into smaller chunks
    and calls crypto_shash_update() and cond_resched() for each chunk. It's
    not necessary to have a flag in 'struct shash_desc', nor is it necessary
    to make individual shash algorithms aware of this at all.

    Therefore, remove shash_desc::flags, and document that the
    crypto_shash_*() functions can be called from any context.

    Signed-off-by: Eric Biggers
    Signed-off-by: Herbert Xu

    Eric Biggers
     

23 Dec, 2018

1 commit

  • c79b411ea   crypto: skcipher - remove remnants of internal IV generators ... Browse Code »

    Remove dead code related to internal IV generators, which are no longer
    used since they've been replaced with the "seqiv" and "echainiv"
    templates. The removed code includes:

    - The "givcipher" (GIVCIPHER) algorithm type. No algorithms are
    registered with this type anymore, so it's unneeded.

    - The "const char *geniv" member of aead_alg, ablkcipher_alg, and
    blkcipher_alg. A few algorithms still set this, but it isn't used
    anymore except to show via /proc/crypto and CRYPTO_MSG_GETALG.
    Just hardcode "" or "" in those cases.

    - The 'skcipher_givcrypt_request' structure, which is never used.

    Signed-off-by: Eric Biggers
    Signed-off-by: Herbert Xu

    Eric Biggers
     

26 Oct, 2018

2 commits

  • 3c58b2362   KEYS: Implement PKCS#8 RSA Private Key parser [ver #2] ... Browse Code »

    Implement PKCS#8 RSA Private Key format [RFC 5208] parser for the
    asymmetric key type. For the moment, this will only support unencrypted
    DER blobs. PEM and decryption can be added later.

    PKCS#8 keys can be loaded like this:

    openssl pkcs8 -in private_key.pem -topk8 -nocrypt -outform DER | \
    keyctl padd asymmetric foo @s

    Signed-off-by: David Howells
    Tested-by: Marcel Holtmann
    Reviewed-by: Marcel Holtmann
    Reviewed-by: Denis Kenzior
    Tested-by: Denis Kenzior
    Signed-off-by: James Morris

    David Howells
     
  • 5a3077183   KEYS: Provide missing asymmetric key subops for new key type ops [ver #2] ... Browse Code »

    Provide the missing asymmetric key subops for new key type ops. This
    include query, encrypt, decrypt and create signature. Verify signature
    already exists. Also provided are accessor functions for this:

    int query_asymmetric_key(const struct key *key,
    struct kernel_pkey_query *info);

    int encrypt_blob(struct kernel_pkey_params *params,
    const void *data, void *enc);
    int decrypt_blob(struct kernel_pkey_params *params,
    const void *enc, void *data);
    int create_signature(struct kernel_pkey_params *params,
    const void *data, void *enc);

    The public_key_signature struct gains an encoding field to carry the
    encoding for verify_signature().

    Signed-off-by: David Howells
    Tested-by: Marcel Holtmann
    Reviewed-by: Marcel Holtmann
    Reviewed-by: Denis Kenzior
    Tested-by: Denis Kenzior
    Signed-off-by: James Morris

    David Howells
     

09 Jul, 2018

1 commit

  • 85d7311f1   crypto: remove redundant type flags from tfm allocation ... Browse Code »

    Some crypto API users allocating a tfm with crypto_alloc_$FOO() are also
    specifying the type flags for $FOO, e.g. crypto_alloc_shash() with
    CRYPTO_ALG_TYPE_SHASH. But, that's redundant since the crypto API will
    override any specified type flag/mask with the correct ones.

    So, remove the unneeded flags.

    This patch shouldn't change any actual behavior.

    Signed-off-by: Eric Biggers
    Signed-off-by: Herbert Xu

    Eric Biggers
     

15 Jun, 2018

1 commit

08 May, 2018

1 commit

31 Mar, 2018

1 commit

  • 0550f5a5f   crypto: doc - clarify hash callbacks state machine ... Browse Code »

    Add a note that it is perfectly legal to "abandon" a request object:
    - call .init() and then (as many times) .update()
    - _not_ call any of .final(), .finup() or .export() at any point in
    future

    Link: https://lkml.kernel.org/r/20180222114741.GA27631@gondor.apana.org.au
    Signed-off-by: Horia Geantă
    Signed-off-by: Herbert Xu

    Horia Geantă
     

15 Feb, 2018

1 commit

03 Nov, 2017

1 commit

  • aba973c69   crypto: doc - adapt api sample to use async. op wait ... Browse Code »

    The code sample is waiting for an async. crypto op completion.
    Adapt sample to use the new generic infrastructure to do the same.

    This also fixes a possible data coruption bug created by the
    use of wait_for_completion_interruptible() without dealing
    correctly with an interrupt aborting the wait prior to the
    async op finishing.

    Signed-off-by: Gilad Ben-Yossef
    Signed-off-by: Herbert Xu

    Gilad Ben-Yossef
     

14 Jul, 2017

1 commit

06 Jul, 2017

1 commit

  • 8ad06e56d   Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 ... Browse Code »

    Pull crypto updates from Herbert Xu:
    "Algorithms:
    - add private key generation to ecdh

    Drivers:
    - add generic gcm(aes) to aesni-intel
    - add SafeXcel EIP197 crypto engine driver
    - add ecb(aes), cfb(aes) and ecb(des3_ede) to cavium
    - add support for CNN55XX adapters in cavium
    - add ctr mode to chcr
    - add support for gcm(aes) to omap"

    * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (140 commits)
    crypto: testmgr - Reenable sha1/aes in FIPS mode
    crypto: ccp - Release locks before returning
    crypto: cavium/nitrox - dma_mapping_error() returns bool
    crypto: doc - fix typo in docs
    Documentation/bindings: Document the SafeXel cryptographic engine driver
    crypto: caam - fix gfp allocation flags (part II)
    crypto: caam - fix gfp allocation flags (part I)
    crypto: drbg - Fixes panic in wait_for_completion call
    crypto: caam - make of_device_ids const.
    crypto: vmx - remove unnecessary check
    crypto: n2 - make of_device_ids const
    crypto: inside-secure - use the base_end pointer in ring rollback
    crypto: inside-secure - increase the batch size
    crypto: inside-secure - only dequeue when needed
    crypto: inside-secure - get the backlog before dequeueing the request
    crypto: inside-secure - stop requeueing failed requests
    crypto: inside-secure - use one queue per hw ring
    crypto: inside-secure - update the context and request later
    crypto: inside-secure - align the cipher and hash send functions
    crypto: inside-secure - optimize DSE bufferability control
    ...

    Linus Torvalds
     

22 Jun, 2017

1 commit

19 Jun, 2017

1 commit

19 May, 2017

2 commits

  • 6312811be   Merge remote-tracking branch 'mauro-exp/docbook3' into death-to-docbook ... Browse Code »

    Mauro says:

    This patch series convert the remaining DocBooks to ReST.

    The first version was originally
    send as 3 patch series:

    [PATCH 00/36] Convert DocBook documents to ReST
    [PATCH 0/5] Convert more books to ReST
    [PATCH 00/13] Get rid of DocBook

    The lsm book was added as if it were a text file under
    Documentation. The plan is to merge it with another file
    under Documentation/security, after both this series and
    a security Documentation patch series gets merged.

    It also adjusts some Sphinx-pedantic errors/warnings on
    some kernel-doc markups.

    I also added some patches here to add PDF output for all
    existing ReST books.

    Jonathan Corbet
     
  • b68101a1e   doc: ReSTify keys.txt ... Browse Code »

    This creates a new section in the security development index for kernel
    keys, and adjusts for ReST markup.

    Cc: David Howells
    Signed-off-by: Kees Cook
    Signed-off-by: Jonathan Corbet

    Kees Cook
     

16 May, 2017

1 commit

03 May, 2017

1 commit

  • 0302e28de   Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security ... Browse Code »

    Pull security subsystem updates from James Morris:
    "Highlights:

    IMA:
    - provide ">" and " of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (98 commits)
    tpm: Fix reference count to main device
    tpm_tis: convert to using locality callbacks
    tpm: fix handling of the TPM 2.0 event logs
    tpm_crb: remove a cruft constant
    keys: select CONFIG_CRYPTO when selecting DH / KDF
    apparmor: Make path_max parameter readonly
    apparmor: fix parameters so that the permission test is bypassed at boot
    apparmor: fix invalid reference to index variable of iterator line 836
    apparmor: use SHASH_DESC_ON_STACK
    security/apparmor/lsm.c: set debug messages
    apparmor: fix boolreturn.cocci warnings
    Smack: Use GFP_KERNEL for smk_netlbl_mls().
    smack: fix double free in smack_parse_opts_str()
    KEYS: add SP800-56A KDF support for DH
    KEYS: Keyring asymmetric key restrict method with chaining
    KEYS: Restrict asymmetric key linkage using a specific keychain
    KEYS: Add a lookup_restriction function for the asymmetric key type
    KEYS: Add KEYCTL_RESTRICT_KEYRING
    KEYS: Consistent ordering for __key_link_begin and restrict check
    KEYS: Add an optional lookup_restriction hook to key_type
    ...

    Linus Torvalds
     

05 Apr, 2017

3 commits