Skip to content

Commit a4ff2be

Browse files
torvaldstorvalds
committed
Merge tag 'v7.3-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
Pull crypto update from Herbert Xu: "API: - Add af_alg_restrict sysctl and white list - Fix potential suspend/resume races in hwrng Algorithms: - Optimize vli additive operations using compiler builtins in ecc Drivers: - Remove unsafe/deprecated algorithms from qce - Mark qce as BROKEN - Add runtime PM and interconnect bandwidth scaling support to qce - Remove crypto_rng from qcom, sun8i and caam - Fix SG list issues in iaa - Fix SEV init path bugs in ccp" * tag 'v7.3-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (122 commits) crypto: lskcipher - propagate errors from unaligned crypt crypto: keembay - use crypto_memneq() to compare CCM AEAD tags crypto: keembay - use crypto_memneq() to compare GCM AEAD tags crypto: sa2ul - use crypto_memneq() to compare AEAD tag hwrng: drivers - use named initializers for acpi_device_id crypto: qce - fix CCM AAD buffer underallocation crypto: iaa - unmap dst before software fallback on decompress crypto: iaa - use bounce buffer for multi-sg decompress input crypto: iaa - avoid counting fallback decompression bytes crypto: iaa - fall back to software for multi-entry scatterlists hwrng: core - Stop/start hwrng_fillfn() kthread before/after suspend-resume crypto: hisilicon/sec2 - fix CCM algorithm long packet failure crypto: eip93 - use struct_size() and flexible array for ring allocation crypto: krb5 - use kfree_sensitive() for derived key buffers crypto: af_alg - Stop after finding name in allowlist crypto: af_alg - Replace 'bool privileged' with flags crypto: af_alg - Make cbc(paes) privileged-only hwrng: imx-rngc - Disable clock on registration failure crypto: qat - remove dead ADF_HEX code crypto: qce - simplify qce_handle_request ...
2 parents a51ec5e + 7537036 commit a4ff2be

135 files changed

Lines changed: 1405 additions & 2019 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎Documentation/ABI/testing/sysfs-firmware-sev-vulnerabilities‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
What: /sys/firmware/sev/vulnerabilities/supported_mitigations
2+
Date: June 2026
3+
Contact: linux-crypto@vger.kernel.org
4+
Description:
5+
Read-only interface that reports the vector of SEV-SNP
6+
firmware vulnerability mitigations supported by the firmware.
7+
8+
What: /sys/firmware/sev/vulnerabilities/verified_mitigations
9+
Date: June 2026
10+
Contact: linux-crypto@vger.kernel.org
11+
Description:
12+
Read/write interface that reports the vector of SEV-SNP
13+
firmware vulnerability mitigations already verified by the
14+
firmware. Writing a vector value requests the firmware to
15+
VERIFY the corresponding mitigation bit(s).
16+
17+
The list of supported mitigations and the meaning of each
18+
vector bit are both platform- and bug-specific and are
19+
published as part of the AMD Security Bulletin.

‎Documentation/admin-guide/sysctl/crypto.rst‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,42 @@ kernel configuration:
77

88
.. contents:: :local:
99

10+
.. _af_alg_restrict:
11+
12+
af_alg_restrict
13+
===============
14+
15+
Controls the level of restriction of AF_ALG.
16+
17+
AF_ALG is a deprecated and rarely-used userspace interface that is a
18+
frequent source of vulnerabilities. It also unnecessarily exposes a
19+
large number of kernel implementation details. For more information
20+
about AF_ALG, see :ref:`Documentation/crypto/userspace-if.rst
21+
<crypto_userspace_interface>`.
22+
23+
Starting in Linux v7.3, AF_ALG supports only a limited set of
24+
algorithms by default. This sysctl allows the system administrator to
25+
remove this restriction when needed for compatibility reasons, or to
26+
go further and disable AF_ALG entirely. The default value is 1.
27+
28+
=== ==================================================================
29+
0 AF_ALG is unrestricted.
30+
31+
1 AF_ALG is supported with a limited list of algorithms. The list
32+
is designed for compatibility with known users such as iwd and
33+
bluez that haven't yet been fixed to use userspace crypto code.
34+
35+
Specifically, there is an allowlist for unprivileged processes
36+
and a somewhat longer allowlist for processes that hold
37+
CAP_SYS_ADMIN or CAP_NET_ADMIN in the initial user namespace.
38+
39+
Attempts to bind() an AF_ALG socket with a disallowed algorithm
40+
fail with ENOENT.
41+
42+
2 AF_ALG is completely disabled. Attempts to create an AF_ALG
43+
socket fail with EAFNOSUPPORT.
44+
=== ==================================================================
45+
1046
fips_enabled
1147
============
1248

‎Documentation/crypto/architecture.rst‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ additional templates may enclose other templates, such as
9595

9696
::
9797

98-
template1(template2(single block cipher)))
98+
template1(template2(single block cipher))
9999

100100

101101
The kernel crypto API may provide multiple implementations of a template

‎Documentation/crypto/userspace-if.rst‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
.. _crypto_userspace_interface:
2+
13
User Space Interface
24
====================
35

@@ -12,9 +14,14 @@ AF_ALG is insecure and is deprecated. Originally added to the kernel in 2010,
1214
most kernel developers now consider it to be a mistake. Support for hardware
1315
accelerators, which was the original purpose of AF_ALG, has been removed.
1416

15-
AF_ALG continues to be supported only for backwards compatibility. On systems
16-
where no programs using AF_ALG remain, the support for it should be disabled by
17-
disabling ``CONFIG_CRYPTO_USER_API_*``.
17+
AF_ALG continues to be supported only for backwards compatibility.
18+
19+
Starting in Linux v7.3, the set of algorithms supported by AF_ALG is limited by
20+
default. See :ref:`/proc/sys/crypto/af_alg_restrict <af_alg_restrict>`.
21+
22+
On systems where no programs using AF_ALG remain, the support for it should be
23+
disabled entirely by setting ``/proc/sys/crypto/af_alg_restrict`` to 2 or by
24+
disabling ``CONFIG_CRYPTO_USER_API_*`` in the kernel configuration.
1825

1926
Deprecation
2027
-----------

‎Documentation/devicetree/bindings/crypto/qcom,inline-crypto-engine.yaml‎

Lines changed: 21 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -16,15 +16,19 @@ properties:
1616
- qcom,eliza-inline-crypto-engine
1717
- qcom,hawi-inline-crypto-engine
1818
- qcom,kaanapali-inline-crypto-engine
19+
- qcom,maili-inline-crypto-engine
1920
- qcom,milos-inline-crypto-engine
21+
- qcom,nord-inline-crypto-engine
2022
- qcom,qcs8300-inline-crypto-engine
2123
- qcom,sa8775p-inline-crypto-engine
2224
- qcom,sc7180-inline-crypto-engine
2325
- qcom,sc7280-inline-crypto-engine
26+
- qcom,shikra-inline-crypto-engine
2427
- qcom,sm8450-inline-crypto-engine
2528
- qcom,sm8550-inline-crypto-engine
2629
- qcom,sm8650-inline-crypto-engine
2730
- qcom,sm8750-inline-crypto-engine
31+
- qcom,x1e80100-inline-crypto-engine
2832
- const: qcom,inline-crypto-engine
2933

3034
reg:
@@ -55,14 +59,25 @@ required:
5559

5660
additionalProperties: false
5761

62+
# Do not extend the list.
63+
# Legacy SoCs are allowed for single clock.
64+
# New SoCs must provide both clocks and power domains.
5865
allOf:
5966
- if:
60-
properties:
61-
compatible:
62-
contains:
63-
enum:
64-
- qcom,eliza-inline-crypto-engine
65-
- qcom,milos-inline-crypto-engine
67+
not:
68+
properties:
69+
compatible:
70+
contains:
71+
enum:
72+
- qcom,kaanapali-inline-crypto-engine
73+
- qcom,qcs8300-inline-crypto-engine
74+
- qcom,sa8775p-inline-crypto-engine
75+
- qcom,sc7180-inline-crypto-engine
76+
- qcom,sc7280-inline-crypto-engine
77+
- qcom,sm8450-inline-crypto-engine
78+
- qcom,sm8550-inline-crypto-engine
79+
- qcom,sm8650-inline-crypto-engine
80+
- qcom,sm8750-inline-crypto-engine
6681

6782
then:
6883
required:

‎Documentation/devicetree/bindings/crypto/qcom,prng.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,13 +23,15 @@ properties:
2323
- qcom,ipq5424-trng
2424
- qcom,ipq9574-trng
2525
- qcom,kaanapali-trng
26+
- qcom,maili-trng
2627
- qcom,milos-trng
2728
- qcom,nord-trng
2829
- qcom,qcs615-trng
2930
- qcom,qcs8300-trng
3031
- qcom,sa8255p-trng
3132
- qcom,sa8775p-trng
3233
- qcom,sc7280-trng
34+
- qcom,shikra-trng
3335
- qcom,sm8450-trng
3436
- qcom,sm8550-trng
3537
- qcom,sm8650-trng

‎Documentation/devicetree/bindings/crypto/qcom-qce.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@ properties:
5454
- qcom,qcs8300-qce
5555
- qcom,sa8775p-qce
5656
- qcom,sc7280-qce
57+
- qcom,shikra-qce
5758
- qcom,sm6350-qce
5859
- qcom,sm8250-qce
5960
- qcom,sm8350-qce

‎Documentation/devicetree/bindings/rng/inside-secure,safexcel-eip76.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
$id: http://devicetree.org/schemas/rng/inside-secure,safexcel-eip76.yaml#
55
$schema: http://devicetree.org/meta-schemas/core.yaml#
66

7-
title: Inside-Secure HWRNG Module
7+
title: Inside-Secure SafeXcel EIP-76 HWRNG Module
88

99
maintainers:
1010
- Jayesh Choudhary <j-choudhary@ti.com>

‎MAINTAINERS‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11848,7 +11848,7 @@ W: http://www.hisilicon.com
1184811848
F: drivers/spi/spi-hisi-sfc-v3xx.c
1184911849

1185011850
HISILICON ZIP Controller DRIVER
11851-
M: Yang Shen <shenyang39@huawei.com>
11851+
M: Chenghai Huang<huangchenghai2@huawei.com>
1185211852
M: Zhou Wang <wangzhou1@hisilicon.com>
1185311853
L: linux-crypto@vger.kernel.org
1185411854
S: Maintained

‎arch/arm/configs/multi_v7_defconfig‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -407,6 +407,7 @@ CONFIG_ASPEED_KCS_IPMI_BMC=m
407407
CONFIG_ASPEED_BT_IPMI_BMC=m
408408
CONFIG_HW_RANDOM=y
409409
CONFIG_HW_RANDOM_ST=y
410+
CONFIG_HW_RANDOM_QCOM=m
410411
CONFIG_TCG_TPM=m
411412
CONFIG_TCG_TIS_I2C_INFINEON=m
412413
CONFIG_I2C_CHARDEV=y
@@ -1322,8 +1323,6 @@ CONFIG_CRYPTO_DEV_ATMEL_AES=m
13221323
CONFIG_CRYPTO_DEV_ATMEL_TDES=m
13231324
CONFIG_CRYPTO_DEV_ATMEL_SHA=m
13241325
CONFIG_CRYPTO_DEV_MARVELL_CESA=m
1325-
CONFIG_CRYPTO_DEV_QCE=m
1326-
CONFIG_CRYPTO_DEV_QCOM_RNG=m
13271326
CONFIG_CRYPTO_DEV_ROCKCHIP=m
13281327
CONFIG_CRYPTO_DEV_STM32_HASH=m
13291328
CONFIG_CRYPTO_DEV_STM32_CRYP=m

0 commit comments

Comments
 (0)