We've been running an IRC meeting every other week for quite a while
now (when they weren't cancelled). After talking it over with the
team, we're going to discontinue these for the time being. They've
mostly turned into status reports with little in the way of
As a replacement, I'll send out a status report to this list every
month or so with a wrap up and on-going items. If you have questions,
please just send them to the list!
For those of you that did attend the IRC meetings, many thanks for
your participation. If we really have the need for a high bandwidth
meeting, we'll schedule as needed.
It's base on the kernel patches of Fedora 20.
This patch set add the support to MODSIGN mechanism for revoke kernel
module by hash or public key. As MokListRT, EFI bootloader(e.g. shim)
should maintain the MokListXRT container the format the same with dbx.
The patches will check the hash of kernel module before load it.
I doesn't add the module hash blacklist support to dbx because
UEFI BIOS of Intel DQ57TM, my development board, doesn't allow set hash
of non-efi file to dbx.
+ Use the digest generated by mod_make_digest() to avoid computing the hash twice.
+ Also check the hash of whole module file is not in the module hash blacklist.
+ Change the statements of information log.
+ The hash type need the same with CONFIG_MODULE_SIG_HASH.
+ Handle the return value of func()
+ Move the logic of parsing EFI signature database to parse_efi_signature_db() for
collecting certificates and hashes.
+ Still parsing hashes when signature parsing fail on MOKx.
Lee, Chun-Yi (2):
MODSIGN: check hash of kernel module in blacklist
MODSIGN: load hash blacklist of modules from MOKx
crypto/asymmetric_keys/efi_parser.c | 80 +++++++++++++++++++----------
include/linux/efi.h | 16 ++++++
kernel/modsign_uefi.c | 97 ++++++++++++++++++++++++++++++++++-
kernel/module-internal.h | 13 +++++
kernel/module_signing.c | 86 ++++++++++++++++++++++++++++++-
5 files changed, 261 insertions(+), 31 deletions(-)
As you probably know in my spare time I'm working on Linux Allwinner SoC support.
We (the linux-sunxi community) are currently making good progress on getting
Allwinner SoCs supported in the upstream kernel. It looks like the majority
of it will land in 3.14 and 3.15. As such I believe the time has come to
start supporting Allwinner SoCs with the official Fedora kernels ootb for
I've written a Feature page for this, which you can find here:
This will likely require carrying some kernel patches for 1-2 kernel releases,
until all the necessary bits for headless operation have landed upstream.
As always I'm willing to put my time were my work is, and I'll maintain these
patches for as long as necessary. To give you an idea of where things are
going, here is a break down of the tree I'm currently using for testing
and development, see:
This branch contains 3.13-rc5
+ the following, which should all go upstream for 3.14:
Emilio's "[PATCH v3 00/13] clk: sunxi: add PLL5 and PLL6 support" series
+ the following which is not quite ready for 3.14 yet, but people
are working hard to get it ready so hopefully we will see some of
it in 3.14, and the rest should make 3.15:
Emilio's sunxi-clk branch: patches not part of the above set
David's and mine sunxi-mmc work
Chen's gmac work
Oliver's ahci work
Arokux' ehci work
mripard's "ARM: sunxi: Add A31 High Speed Timer Support" series
wens' "v2 of A20 external output clock support patch series"
hansg's resistive touchscreen controller driver (rtp) including temp sensor support
Of the above list, we should at a minimum carry the mmc, gmac (gigabit nic) and
ahci patches if those don't get upstream in time. USB support would also be very nice,
but is not a must have. The last 3 patch-sets we don't need.