The Linux kernel already has cryptographic support for signature verification on data. This is used to digitally sign kernel modules at build time, and verify integrity and provenance at load time. Likewise the 802.11 subsystem on the Linux kernel had historically in parallel prior to Linux's own kernel signing facility implemented and integrated support to verify file integrity and provenance for use on the Linux regulatory database. The 802.11 subsystem's components that provide this facility are CRDA and wireless-regdb. CRDA and wireless-regdb technically are split up as two separate trees for development, wireless-regdb helps provide the 802.11 regulatory database while CRDA exists as a udev helper to feed to the Linux kernel a regulatory domain when needed. By using a regulatory database in userspace the Linux kernel is able to get updates for regulatory rules without requiring a rebuild. Linux distributions need the digitally signed regulatory.bin file from wireless-regdb tree and the CRDA binary from the CRDA tree. Linux distributions often combine both into one package, some distributions separate the two. The regulatory database is digitally signed by the wireless-regdb maintainer, and distributions that have have compiled in support for digital signature support on CRDA verify the integrity of the file before feeding a regulatory domain to the Linux kernel. Since the kernel module signing facility was merged upstream on Linux we could replace both CRDA and wireless-regdb distribution mechanism by adding cryptographic file signature verification support on Linux on the firmware_class module which provides the APIs to load firmware, and having the regulatory.bin file merged and updated through the linux-firmware tree.

Adding cryptographic signature verification support on the firmware APIs on Linux is the first step to replace CRDA and wireless-regdb's own signature functionality. The second step is to extend the firmware APIs to enable subsystems to customize cryptographic requirements.

Code:

https://git.kernel.org/cgit/linux/kernel/git/mcgrof/linux.git/log/?h=fw-signing-v3-20150518