Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Reply-To: chi-hsien.lin@cypress.com
Subject: Re: Updating cypress/brcm firmware in linux-firmware for
 CVE-2019-15126
To:     Hans de Goede <hdegoede@redhat.com>,
        Christopher Rumpf <Christopher.Rumpf@cypress.com>,
        Chung-Hsien Hsu <cnhu@cypress.com>
Cc:     linux-firmware@kernel.org,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
References: <93dba8d2-6e46-9157-d292-4d93feb8ec1a@redhat.com>
 <c2f75e84-6c8d-f4f0-bcc6-5fb2b662de33@redhat.com>
From:   Chi-Hsien Lin <chi-hsien.lin@cypress.com>
Message-ID: <3cf961a6-56c8-81fb-3bf9-fc36e2601d2c@cypress.com>
Date:   Thu, 5 Mar 2020 11:50:58 +0800
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101
 Thunderbird/52.9.1
In-Reply-To: <c2f75e84-6c8d-f4f0-bcc6-5fb2b662de33@redhat.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
Received: from [10.9.112.143] (61.222.14.99) by BYAPR07CA0032.namprd07.prod.outlook.com (2603:10b6:a02:bc::45) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2772.18 via Frontend Transport; Thu, 5 Mar 2020 03:51:08 +0000
X-Originating-IP: [61.222.14.99]
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-HT: Tenant
X-MS-Office365-Filtering-Correlation-Id: fa41a757-845b-4fba-fd16-08d7c0b870ff
X-MS-TrafficTypeDiagnostic: BYAPR06MB3912:|BYAPR06MB3912:
X-MS-Exchange-Transport-Forked: True
X-Microsoft-Antispam-PRVS: <BYAPR06MB39122222F68CA432BBB73D35BBE20@BYAPR06MB3912.namprd06.prod.outlook.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:10000;
X-Forefront-PRVS: 03333C607F
X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(136003)(366004)(39860400002)(346002)(396003)(376002)(189003)(199004)(81166006)(6666004)(8676002)(81156014)(4326008)(16576012)(6486002)(31696002)(52116002)(316002)(26005)(186003)(31686004)(5660300002)(16526019)(86362001)(36756003)(66476007)(3450700001)(478600001)(2906002)(4001150100001)(66556008)(53546011)(956004)(966005)(110136005)(6636002)(66946007)(2616005)(8936002);DIR:OUT;SFP:1102;SCL:1;SRVR:BYAPR06MB3912;H:BYAPR06MB4901.namprd06.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;MX:1;A:1;
Received-SPF: None (protection.outlook.com: cypress.com does not designate
 permitted sender hosts)
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: 06ZziBZbf7QAatdZORahHPk8cDPIB6Z4KOvnw0yLp1zdSP6teq1Z9TWT784CPsnrkGBEJe9uAaC3ERnJck27zV3e4It637pymvGKwnWTC59541k/gcIVyMA0bgUD/lXOiXhSpLNwE9LHT+deoyr8d0/naHCSrXGzv32RBOftjdx0SfMf+Yir6AJUZ9BSO2z/NExm/DZHB3rdJCUQrbqGDDKaCxXu1djFTQk231OOOpJyf0OG0nju+kov0axBwtzUl/ayr03x2NQDA9NdYJUnFl3bRRbk97sO3Ok0RgLAEi4wnLjP2BPkT9U/MCvw8wNFAnp8iN4UVh0I5IHNeGltxkMrKmYKkZqqxT76ZnjpGxlMdjIiHrdQpwsEjn3kYyOW0D+Jq/ZMXphAAiJfRh6U5jv47u1PdvdFmq/cOHA6GNAWELkt3hyky7y4hrzvVKnctBLn8bc6uILNvTIjnDJCZvZu07Ks6RzA9WL8CYp8vDA36X42sW+vszwPhjdJTNR+2CzNGbsbqOni/pWw/sjYeg==
X-MS-Exchange-AntiSpam-MessageData: neVk+4Cdwc7s8fxmZHd2OYcz10WjWvvtu8wvMRNUUFNQE9efUmFKtdXvwVdJ2T/d4nZtxJkeghAMTJFSsdyc612n1unlSGOZ5si/wgx8O2u5SVzWgg3E8hG5F5nQGK3PN8vT3H9SG2y6j30ACfmKqg==
X-OriginatorOrg: cypress.com
X-MS-Exchange-CrossTenant-Network-Message-Id: fa41a757-845b-4fba-fd16-08d7c0b870ff
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Mar 2020 03:51:10.2092
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 011addfc-2c09-450d-8938-e0bbc2dd2376
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 1H8ggI5j5zdcRkA4xc7Q/+ykXWHjjpD5F8ubEHG3AvkSqMED5U4l8i2fYee0RGu7CSVLOaa8e2RZqgG92n/EpQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR06MB3912
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

(+Chris)

On 03/04/2020 7:45, Hans de Goede wrote:
> Hi,
> 
> On 2/26/20 11:16 PM, Hans de Goede wrote:
>> Hello Cypress people,
>>
>> Can we please get updated firmware for
>> brcm/brcmfmac4356-pcie.bin and brcm/brcmfmac4356-sdio.bin
>> fixing CVE-2019-15126 as well as for any other affected
>> models (the 4356 is explicitly named in the CVE description) ?
>>
>> The current Cypress firmware files in linux-firmware are
>> quite old, e.g. for brcm/brcmfmac4356-pcie.bin linux-firmware has:
>> version 7.35.180.176 dated 2017-10-23, way before the CVE
>>
>> Where as https://community.cypress.com/docs/DOC-19000 /
>> cypress-fmac-v4.14.77-2020_0115.zip has:
>> version 7.35.180.197 which presumably contains a fix (no changelog)
> 
> Ping?
> 
> The very old age of the firmware files in linux-firmware is really
> UNACCEPTABLE and very irresponsible from a security POV. Please
> fix this very soon.
> 
> If you do not reply to this email I see no choice but to switch
> the firmwares in linux-firmware over to the ones from the SDK which
> you do regularly update, e.g. those from:
> https://community.cypress.com/docs/DOC-19000
> 
> Yes those are under an older, slightly different version of the Cypress
> license, which is less then ideal, but that license is still acceptable
> for linux-firmware (*) and since you are not providing any updates to
> the special builds you have been doing for linux-firmware you are
> really leaving us no option other then switching to the SDK version
> of the firmwares.

Hans,

As we discussed previously, those files are not suitable for 
linux-firmware for the reason of regulatory (blobs are only for Cypress 
reference boards and could violate regulatory on other boards); also 
clm_blob download is not supported in kernels prior to 4.15 so those 
files won't work with older kernels.

Chris owns the Cypress firmware upstream strategy and will explain our 
going-forward strategy to you.


Regards,
Chi-hsien Lin


> 
> Regards,
> 
> Hans
> 
> *) We have distributed files under the old version of the license before
> 
> .
>