On Thu 12 Jul 13:03 PDT 2018, Mimi Zohar wrote: > On Wed, 2018-07-11 at 08:24 +0200, Ard Biesheuvel wrote: > > On 10 July 2018 at 21:19, Bjorn Andersson <bjorn.andersson@xxxxxxxxxx> wrote: > > > > Tbh the only case I can think of where there would be a "race condition" > > > here is if we have a device that is polling the last byte of a > > > predefined firmware memory area for the firmware loader to read some > > > specific data into it. In cases where the firmware request is followed > > > by some explicit signalling to the device (or a power on sequence) I'm > > > unable to see the issue discussed here. > > > > > > > I agree. But the latter part is platform specific, and so it requires > > some degree of trust in the driver author on the part of the IMA > > routines that request_firmware() is called at an appropriate time. > > Exactly. Qualcomm could be using the pre-allocated buffer > appropriately, but that doesn't guarantee how it will be used in the > future. > Agreed. But a device that starts operate on the firmware memory before it's fully loaded (and verified) will likely hit other nasty issues. Using a traditional request_firmware() and memcpy() or simply mapping the buffer into the remote piecemeal would have the same issue. So I think that regardless of using IMA, if you don't have the ability to control your device's view of the entire firmware buffer atomically you must write your device drivers accordingly. Regards, Bjorn
