netdev - Re: GPL compliance issue with liquidio/lio_23xx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:   Fri, 7 Sep 2018 15:58:36 -0700
From:   Felix Manlunas <felix.manlunas@...ium.com>
To:     Ben Hutchings <ben@...adent.org.uk>
Cc:     Florian Weimer <fweimer@...hat.com>, linux-firmware@...nel.org,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        Derek Chickles <derek.chickles@...iumnetworks.com>,
        Satanand Burla <satananda.burla@...iumnetworks.com>,
        Felix Manlunas <felix.manlunas@...iumnetworks.com>,
        Raghu Vatsavayi <raghu.vatsavayi@...iumnetworks.com>,
        Manish Awasthi <manish.awasthi@...ium.com>,
        Manojkumar.Panicker@...ium.com
Subject: Re: GPL compliance issue with liquidio/lio_23xx_vsw.bin firmware

On Wed, Aug 29, 2018 at 09:26:35PM +0100, Ben Hutchings wrote:
> Date: Wed, 29 Aug 2018 21:26:35 +0100
> From: Ben Hutchings <ben@...adent.org.uk>
> To: Felix Manlunas <felix.manlunas@...ium.com>, Florian Weimer
>  <fweimer@...hat.com>
> CC: linux-firmware@...nel.org, "netdev@...r.kernel.org"
>  <netdev@...r.kernel.org>, Derek Chickles
>  <derek.chickles@...iumnetworks.com>, Satanand Burla
>  <satananda.burla@...iumnetworks.com>, Felix Manlunas
>  <felix.manlunas@...iumnetworks.com>, Raghu Vatsavayi
>  <raghu.vatsavayi@...iumnetworks.com>, Manish Awasthi
>  <manish.awasthi@...ium.com>, Manojkumar.Panicker@...ium.com
> Subject: Re: GPL compliance issue with liquidio/lio_23xx_vsw.bin firmware
> User-Agent: Evolution 3.29.92-1 
> 
> On Mon, 2018-08-27 at 17:04 -0700, Felix Manlunas wrote:
> > On Mon, Aug 27, 2018 at 05:01:10PM +0200, Florian Weimer wrote:
> > > liquidio/lio_23xx_vsw.bin contains a compiled MIPS Linux kernel:
> > > 
> > > $ tail --bytes=+1313 liquidio/lio_23xx_vsw.bin > elf
> > > $ readelf -aW elf
> > > […]
> > >   [ 6] __ksymtab         PROGBITS        ffffffff80e495f8 64a5f8 00d130
> > > 00   A  0   0  8
> > >   [ 7] __ksymtab_gpl     PROGBITS        ffffffff80e56728 657728 008400
> > > 00   A  0   0  8
> > >   [ 8] __ksymtab_strings PROGBITS        ffffffff80e5eb28 65fb28 018868
> > > 00   A  0   0  1
> > > […]
> > > Symbol table '.symtab' contains 1349 entries:
> > >    Num:    Value          Size Type    Bind   Vis      Ndx Name
> > >      0: 0000000000000000     0 NOTYPE  LOCAL  DEFAULT  UND
> > >      1: 0000000000000000     0 FILE    LOCAL  DEFAULT  ABS
> > > arch/mips/kernel/head.o
> > >      2: 0000000000000000     0 FILE    LOCAL  DEFAULT  ABS init/main.c
> > >      3: 0000000000000000     0 FILE    LOCAL  DEFAULT  ABS
> > > include/linux/types.h
> > > […]
> > > 
> > > Yet there is no corresponding source provided, and LICENCE.cavium lacks
> > > the required notices.
> > > 
> > > Thanks,
> > > Florian
> > 
> > Cavium apologizes for the oversight.  Cavium has been advertising the
> > appropriate license terms including the existence of GPL in the firmware
> > in our outbox releases. We will update the license terms in LICENCE.cavium
> > in our upstream contribution in collaboration with our legal team.
> 
> Everything added to linux-firmware.git needs to be safe for Linux
> distributions to redistribute.  (There are some ancient firmware images
> with unclear licensing, but we don't want to add any more.)
> 
> My understanding is that GPL v2 requires that commercial distributors
> either provide the complete and corresponding source alongside the
> binaries, or include a written offer to provide it later.  They
> *cannot* simply point to your offer to do this (only non-commercial
> distributors can do that).  So the source needs to be published too.
> 
> Adding the complete Linux kernel source code to linux-firmware.git
> doesn't seem like a sensible step, so maybe this particular firmware
> needs to live elsewhere.
> 
> Ben.

Apologies for the delay. We're committed to provide sources for the GPL
components of LiquidIO firmware.

After Cavium's recent merger with Marvell, we are revisiting our Licensing
and expect to share the updated license soon. Since keeping Linux kernel
source code in linux-firmware.git doesn't make sense to us too, we're also
working internally on identifying the appropriate mechanism to share those
sources when requested.  That said, it is our opinion that for all
practical purposes (for example, distribution of driver + firmware) the
firmware binary for LiquidIO adapters should continue to reside in the
linux-firmware.git as long as all the prerequisites for sharing the
firmware are met.  In the case of liquidio_23xx_vsw.bin, this would mean an
additional license type in the LICENCE.cavium file for this firmware
including a reference to the accompanying sources for the Linux kernel
bundled in the firmware.

As we understand, there is no precedent in the linux-firmware.git for
device firmware that include a Linux kernel so we also request comments
from community on the best ways to support the LiquidIO firmware and
similar firmwares that may appear in future.

Cavium LiquidIO Team