Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: Re: [PATCH 1/2] wifi: rtw89: don't request partial firmware if
 SECURITY_LOADPIN_ENFORCE
From:   Kalle Valo <kvalo@kernel.org>
In-Reply-To: <20221202060521.501512-2-pkshih@realtek.com>
References: <20221202060521.501512-2-pkshih@realtek.com>
To:     Ping-Ke Shih <pkshih@realtek.com>
Cc:     <kevin_yang@realtek.com>, <linux-wireless@vger.kernel.org>
User-Agent: pwcli/0.1.1-git (https://github.com/kvalo/pwcli/) Python/3.7.3
Message-ID: <167051085972.9839.9335859470213768636.kvalo@kernel.org>
Date:   Thu,  8 Dec 2022 14:47:41 +0000 (UTC)
Precedence: bulk

Ping-Ke Shih <pkshih@realtek.com> wrote:

> From: Zong-Zhe Yang <kevin_yang@realtek.com>
> 
> Kernel logs on platform enabling SECURITY_LOADPIN_ENFORCE
> ------
> ```
> LoadPin: firmware old-api-denied obj=<unknown> pid=810 cmdline="modprobe -q -- rtw89_8852ce"
> rtw89_8852ce 0000:01:00.0: loading /lib/firmware/rtw89/rtw8852c_fw.bin failed with error -1
> rtw89_8852ce 0000:01:00.0: Direct firmware load for rtw89/rtw8852c_fw.bin failed with error -1
> rtw89_8852ce 0000:01:00.0: failed to early request firmware: -1
> ```
> 
> Trace
> ------
> ```
> request_partial_firmware_into_buf()
> > _request_firmware()
> >> fw_get_filesystem_firmware()
> >>> kernel_read_file_from_path_initns()
> >>>> kernel_read_file()
> >>>>> security_kernel_read_file()
> // It will iterate enabled LSMs' hooks for kernel_read_file.
> // With loadpin, it hooks loadpin_read_file.
> ```
> 
> If SECURITY_LOADPIN_ENFORCE is enabled, doing kernel_read_file() on partial
> files will be denied and return -EPERM (-1). Then, the outer API based on it,
> e.g. request_partial_firmware_into_buf(), will get the error.
> 
> In the case, we cannot get the firmware stuffs right, even though there might
> be no error other than a permission issue on reading a partial file. So we have
> to request full firmware if SECURITY_LOADPIN_ENFORCE is enabled. It makes us
> still have a chance to do early firmware work on this kind of platforms.
> 
> Signed-off-by: Zong-Zhe Yang <kevin_yang@realtek.com>
> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>

2 patches applied to wireless-next.git, thanks.

3ddfe3bdd3cf wifi: rtw89: don't request partial firmware if SECURITY_LOADPIN_ENFORCE
13eb07e0be1b wifi: rtw89: request full firmware only once if it's early requested

-- 
https://patchwork.kernel.org/project/linux-wireless/patch/20221202060521.501512-2-pkshih@realtek.com/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches