Changes in Kconfig

7a0e692a0381254b2f77c54dec100cd3325a6fdf - Merge branch 'next' into for-linus

Tue, 23 Jun 2026 08:10:08 +0200

Merge branch 'next' into for-linusPrepare input updates for 7.2 merge window. List of files: /linux/security/integrity/ima/Kconfig

0798268aa4c26ece25020b3ddeeef9a5941209c0 - Merge tag 'integrity-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity

Fri, 19 Jun 2026 20:32:05 +0200

Merge tag 'integrity-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrityPull IMA updates from Mimi Zohar: - Introduce IMA and EVM post-quantum ML-DSA signature support ML-DSA signature support for IMA and EVM is limited to sigv3 signatures, which calculates and verifies a hash of a compact structure containing the file data/metadata hash, hash type, and hash algorithm. IMA and EVM still calculate the file data/metadata hashes respectively. - Introduce support for removing IMA measurement list records stored in kernel memory The IMA measurement list can grow large depending on policy, but removing records breaks remote attestation, unless they are safely preserved and made available for attestation requests. Until environments are prepared to preserve the measurement records, a new CONFIG_IMA_STAGING Kconfig option is introduced to guard against deletion. Several approaches for removing measurement list records were evaluated but rejected due to filesystem constraints, the introduction of a new critical data record, and locking concerns. Two methods are being upstreamed: staged deletion with confirmation, and staged deletion of N records without confirmation. Both methods minimize the period during which new measurements are blocked from being appended to the measurement list by staging the measurement list. A comparison of the two methods is included in the documentation. - Some code cleanup, and a couple of bug fixes* tag 'integrity-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: doc: security: Add documentation of exporting and deleting IMA measurements ima: Support staging and deleting N measurements records ima: Add support for flushing the hash table when staging measurements ima: Add support for staging measurements with prompt ima: Introduce ima_dump_measurement() ima: Use snprintf() in create_securityfs_measurement_lists ima: Mediate open/release method of the measurements list ima: Introduce _ima_measurements_start() and _ima_measurements_next() ima: Introduce per binary measurements list type binary_runtime_size value ima: Introduce per binary measurements list type ima_num_records counter ima: Replace static htable queue with dynamically allocated array ima: Remove ima_h_table structure evm: terminate and bound the evm_xattrs read buffer integrity: Add support for sigv3 verification using ML-DSA keys integrity: Refactor asymmetric_verify for reusability integrity: Check that algo parameter is within valid range integrity: Check for NULL returned by asymmetric_key_public_key ima: return error early if file xattr cannot be changed ima: Fix sigv3 signature handling for EVM_IMA_XATTR_DIGSIG List of files: /linux/security/integrity/ima/Kconfig

fcb0318a29696c13c9f8af0109855793a34371e6 - ima: Support staging and deleting N measurements records

Fri, 05 Jun 2026 19:22:35 +0200

ima: Support staging and deleting N measurements recordsAdd support for sending a value N between 1 and ULONG_MAX to the IMAoriginal measurement interface. This value represents the number ofmeasurements that should be deleted from the current measurements list. Inthis case, measurements are staged in an internal non-user visible list,and immediately deleted.This staging method allows the remote attestation agents to easily separatethe measurements that were verified (staged and deleted) from those thatweren't due to the race between taking a TPM quote and reading themeasurements list.In order to minimize the locking time of ima_extend_list_mutex, deletingN records is realized by doing a lockless walk in the current measurementslist to determine the N-th entry to cut, to cut the current measurementslist under the lock, and by deleting the excess records after releasing thelock.Flushing the hash table is not supported for N records, since it wouldrequire removing the N records one by one from the hash table under theima_extend_list_mutex lock, which would increase the locking time.Link: https://github.com/linux-integrity/linux/issues/1Co-developed-by: Steven Chen Signed-off-by: Steven Chen Signed-off-by: Roberto Sassu Signed-off-by: Mimi Zohar List of files: /linux/security/integrity/ima/Kconfig

e9b491e27bf6b9401e2e521955787a7a6e2bf808 - ima: Add support for staging measurements with prompt

Fri, 05 Jun 2026 19:22:33 +0200

ima: Add support for staging measurements with promptIntroduce the ability of staging the IMA measurement list and deleting themwith a prompt.Staging means moving the current measurement list records to a separatelocation, and allowing users to read and delete it. This causes the currentmeasurement list to be emptied (since records were moved) and newmeasurements to be added on the empty list. Staging can be done only onceat a time. In the event of kexec(), staging is aborted and staged recordswill be carried over to the new kernel.Introduce ascii_runtime_measurements__staged andbinary_runtime_measurements__staged interfaces to access and deletethe measurements.Use 'echo A > ' and'echo D > ' to respectively stage and delete theentire measurements list. Locking of these interfaces is also mediated witha call to _ima_measurements_open() and with ima_measurements_release().Implement the staging functionality by introducing the new globalmeasurements list ima_measurements_staged, and ima_queue_stage() andima_queue_staged_delete_all() to respectively move measurements from thecurrent measurements list to the staged one, and to move stagedmeasurements to the ima_measurements_trim list for deletion. Introduceima_queue_delete() to delete the measurements.Staging is forbidden after measurement is suspended, and between stagingand deleting, so that walking the staged and current measurements list canbe done locklessly in ima_dump_measurement_list(). Strict ordering ofsuspending and dumping is enforced by two reboot notifiers with differentpriority. Refusing to delete staged measurements also signals to user spacethat those measurements are already carried over to the secondary kernel,so that it does not save them twice.Finally, introduce the BINARY_STAGED and BINARY_FULL binary measurementslist types, to maintain the counters and the binary size of stagedmeasurements and the full measurements list (including records that werestaged). BINARY still represents the current binary measurements list.Use the binary size for the BINARY + BINARY_STAGED types inima_add_kexec_buffer(), since both measurements list types are copied tothe secondary kernel during kexec. Use BINARY_FULL inima_measure_kexec_event(), to generate a critical data record.It should be noted that the BINARY_FULL counter is not passed throughkexec. Thus, the number of records included in the kexec critical datarecords refers to the records since the critical data records generatedfrom the previous kexec event.Note: This code derives from the Alt-IMA Huawei project, whose license is GPL-2.0 OR MIT.Link: https://github.com/linux-integrity/linux/issues/1Suggested-by: Gregory Lumen (staging revert)Signed-off-by: Roberto Sassu Tested-by: Stefan Berger Signed-off-by: Mimi Zohar List of files: /linux/security/integrity/ima/Kconfig

fff88709f9a9153af85b5224b4594caa5387ca60 - Merge tag 'v7.1-rc6' into next

Mon, 01 Jun 2026 04:43:25 +0200

Merge tag 'v7.1-rc6' into nextSync up with mainline to pull in a fix to IMS PCU driver and otherenhancements. List of files: /linux/security/integrity/ima/Kconfig

5c8cbca290acdd49a694b36c0af76ba0c00bbf12 - Merge branch '20260507-ubwc-rework-v4-4-c19593d20c1d@oss.qualcomm.com' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into HEAD

Thu, 21 May 2026 22:36:50 +0200

Merge branch '20260507-ubwc-rework-v4-4-c19593d20c1d@oss.qualcomm.com' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into HEADMerge the branch with the soc/qcom changes, required for the next UBWCpatches.Signed-off-by: Dmitry Baryshkov List of files: /linux/security/integrity/ima/Kconfig

09d6818d3bdc1ea6e49a425040528cbdbc97bc0a - Merge branch 'linus' into timers/clocksource

Mon, 18 May 2026 11:01:07 +0200

Merge branch 'linus' into timers/clocksource... to bring it up to date for new changes. List of files: /linux/security/integrity/ima/Kconfig

658a6021492ad3b1b8a6e9a83963a1fad35a2af8 - Merge drm/drm-next into drm-intel-next

Fri, 15 May 2026 13:01:15 +0200

Merge drm/drm-next into drm-intel-nextSome Display Port Adaptive Sync depends on drm work.Signed-off-by: Rodrigo Vivi List of files: /linux/security/integrity/ima/Kconfig

8edf8b09fc44990977b3fbcb708035b1740d0b7e - Merge drm/drm-next into drm-intel-gt-next

Tue, 12 May 2026 10:16:35 +0200

Merge drm/drm-next into drm-intel-gt-nextBackmerging to pull in commit 5401b9adebc9 ("i915: don't usea vma that didn't match the context VM") to revert it.Signed-off-by: Joonas Lahtinen List of files: /linux/security/integrity/ima/Kconfig

c53ed3e99920df6a90553c89a1c053aa0776841e - Merge drm/drm-next into drm-xe-next

Fri, 08 May 2026 16:19:45 +0200

Merge drm/drm-next into drm-xe-nextBringing in recent display changes.Signed-off-by: Thomas Hellström List of files: /linux/security/integrity/ima/Kconfig

cafac16b6207b88ad92fbba1169ae4f43865cb0d - Merge drm/drm-next into drm-misc-next

Mon, 27 Apr 2026 10:49:13 +0200

Merge drm/drm-next into drm-misc-nextGetting fixes and updates from v7.1-rc1.Signed-off-by: Thomas Zimmermann List of files: /linux/security/integrity/ima/Kconfig

0fc8f6200d2313278fbf4539bbab74677c685531 - Merge drm/drm-fixes into drm-misc-fixes

Mon, 27 Apr 2026 10:26:49 +0200

Merge drm/drm-fixes into drm-misc-fixesGetting fixes and updates from v7.1-rc1.Signed-off-by: Thomas Zimmermann List of files: /linux/security/integrity/ima/Kconfig

370c3883195566ee3e7d79e0146c3d735a406573 - Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux

Tue, 14 Apr 2026 02:31:39 +0200

Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linuxPull crypto library updates from Eric Biggers: - Migrate more hash algorithms from the traditional crypto subsystem to lib/crypto/ Like the algorithms migrated earlier (e.g. SHA-*), this simplifies the implementations, improves performance, enables further simplifications in calling code, and solves various other issues: - AES CBC-based MACs (AES-CMAC, AES-XCBC-MAC, and AES-CBC-MAC) - Support these algorithms in lib/crypto/ using the AES library and the existing arm64 assembly code - Reimplement the traditional crypto API's "cmac(aes)", "xcbc(aes)", and "cbcmac(aes)" on top of the library - Convert mac80211 to use the AES-CMAC library. Note: several other subsystems can use it too and will be converted later - Drop the broken, nonstandard, and likely unused support for "xcbc(aes)" with key lengths other than 128 bits - Enable optimizations by default - GHASH - Migrate the standalone GHASH code into lib/crypto/ - Integrate the GHASH code more closely with the very similar POLYVAL code, and improve the generic GHASH implementation to resist cache-timing attacks and use much less memory - Reimplement the AES-GCM library and the "gcm" crypto_aead template on top of the GHASH library. Remove "ghash" from the crypto_shash API, as it's no longer needed - Enable optimizations by default - SM3 - Migrate the kernel's existing SM3 code into lib/crypto/, and reimplement the traditional crypto API's "sm3" on top of it - I don't recommend using SM3, but this cleanup is worthwhile to organize the code the same way as other algorithms - Testing improvements: - Add a KUnit test suite for each of the new library APIs - Migrate the existing ChaCha20Poly1305 test to KUnit - Make the KUnit all_tests.config enable all crypto library tests - Move the test kconfig options to the Runtime Testing menu - Other updates to arch-optimized crypto code: - Optimize SHA-256 for Zhaoxin CPUs using the Padlock Hash Engine - Remove some MD5 implementations that are no longer worth keeping - Drop big endian and voluntary preemption support from the arm64 code, as those configurations are no longer supported on arm64 - Make jitterentropy and samples/tsm-mr use the crypto library APIs* tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: (66 commits) lib/crypto: arm64: Assume a little-endian kernel arm64: fpsimd: Remove obsolete cond_yield macro lib/crypto: arm64/sha3: Remove obsolete chunking logic lib/crypto: arm64/sha512: Remove obsolete chunking logic lib/crypto: arm64/sha256: Remove obsolete chunking logic lib/crypto: arm64/sha1: Remove obsolete chunking logic lib/crypto: arm64/poly1305: Remove obsolete chunking logic lib/crypto: arm64/gf128hash: Remove obsolete chunking logic lib/crypto: arm64/chacha: Remove obsolete chunking logic lib/crypto: arm64/aes: Remove obsolete chunking logic lib/crypto: Include instead of lib/crypto: aesgcm: Don't disable IRQs during AES block encryption lib/crypto: aescfb: Don't disable IRQs during AES block encryption lib/crypto: tests: Migrate ChaCha20Poly1305 self-test to KUnit lib/crypto: sparc: Drop optimized MD5 code lib/crypto: mips: Drop optimized MD5 code lib: Move crypto library tests to Runtime Testing menu crypto: sm3 - Remove 'struct sm3_state' crypto: sm3 - Remove the original "sm3_block_generic()" crypto: sm3 - Remove sm3_base.h ... List of files: /linux/security/integrity/ima/Kconfig

6dc7fce91041ec8d2f5e6fd589ee2962898d9f44 - crypto: sm3 - Rename CRYPTO_SM3_GENERIC to CRYPTO_SM3

Sat, 21 Mar 2026 05:09:26 +0100

crypto: sm3 - Rename CRYPTO_SM3_GENERIC to CRYPTO_SM3The kconfig options for generic crypto API modules have traditionally*not* had a "_GENERIC" suffix. Also, the "_GENERIC" suffix will makeeven less sense once the architecture-optimized SM3 code is moved intolib/crypto/ and the "sm3" crypto_shash is reimplemented on top of that.Thus, rename CRYPTO_SM3_GENERIC to CRYPTO_SM3.Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260321040935.410034-4-ebiggers@kernel.orgSigned-off-by: Eric Biggers List of files: /linux/security/integrity/ima/Kconfig

f088104d837a991c65e51fa30bb4196169b3244d - Merge drm/drm-next into drm-intel-gt-next

Tue, 16 Sep 2025 12:53:20 +0200

Merge drm/drm-next into drm-intel-gt-nextBackmerge in order to get the commit: 048832a3f400 ("drm/i915: Refactor shmem_pwrite() to use kiocb and write_iter")To drm-intel-gt-next as there are followup fixes to be applied.Signed-off-by: Joonas Lahtinen List of files: /linux/security/integrity/ima/Kconfig

ab93e0dd72c37d378dd936f031ffb83ff2bd87ce - Merge branch 'next' into for-linus

Wed, 06 Aug 2025 19:08:54 +0200

Merge branch 'next' into for-linusPrepare input updates for 6.17 merge window. List of files: /linux/security/integrity/ima/Kconfig

a7bee4e7f78089c101be2ad51f4b5ec64782053e - Merge tag 'ib-mfd-gpio-input-pwm-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd into next

Mon, 04 Aug 2025 08:28:48 +0200

Merge tag 'ib-mfd-gpio-input-pwm-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd into nextMerge an immutable branch between MFD, GPIO, Input and PWM to resolveconflicts for the merge window pull request. List of files: /linux/security/integrity/ima/Kconfig

74f1af95820fc2ee580a775a3a17c416db30b38c - Merge remote-tracking branch 'drm/drm-next' into msm-next

Sun, 29 Jun 2025 04:54:49 +0200

Merge remote-tracking branch 'drm/drm-next' into msm-nextBack-merge drm-next to (indirectly) get arm-smmu updates for makingstall-on-fault more reliable.Signed-off-by: Rob Clark List of files: /linux/security/integrity/ima/Kconfig

c598d5eb9fb331ba17bc9ad67ae9a2231ca5aca5 - Merge drm/drm-next into drm-misc-next

Wed, 11 Jun 2025 09:01:34 +0200

Merge drm/drm-next into drm-misc-nextBackmerging to forward to v6.16-rc1Signed-off-by: Thomas Zimmermann List of files: /linux/security/integrity/ima/Kconfig

86e2d052c2320bf12571a5d96b16c2745e1cfc5e - Merge drm/drm-next into drm-xe-next

Mon, 09 Jun 2025 18:26:55 +0200

Merge drm/drm-next into drm-xe-nextBackmerging to bring in 6.16Signed-off-by: Thomas Hellström List of files: /linux/security/integrity/ima/Kconfig