Question to recent Qualcomm CVEs

[Kalle Valo]

Kalle Valo <kvalo at kernel.org> writes:

> + ath11k, jeff
>
> Sven Eckelmann <sven at narfation.org> writes:
>
>> On Monday, 26 February 2024 15:50:44 CET Felix Fietkau wrote:
>> [...]
>>>> The Qualcomm bulletin[1] says "Patches are being actively
>>> > shared with OEMs".
>>> > 
>>> > Were these bugfixes made available for OpenWRT? Is there an established
>>> > procedure for such cases, where closed-source firmware gets bugfixes?
>> [...]
>>> > [1]
>>> > https://docs.qualcomm.com/product/publicresources/securitybulletin/
>> december-2023-bulletin.html
>>> 
>>> The fixes were not shared with OpenWrt. Qualcomm does not care about 
>>> OpenWrt support for their platforms.
>>
>> I've asked (using their qualcomm-cdmatech-support portal) for an official 
>> release of their WiFi firmware with all gathered bugfixes via 
>> linux-firmware.git. I got statements that the ath10k firmware is no longer 
>> supported + ath11k firmware is not developed further. But for some of them it 
>> is possible to request a release of the firmwares via Kalle's repositories. 
>> But also that Kalle's repositories are now replaced. Which seems to be 
>> confirmed by Kalle's statement [1] regarding the firmware-N.bin files on 
>> ath12k at lists.infradead.org .
>>
>> The new positions for firmware files were not revealed but I found a couple of 
>> places [2,3,4,5] in my search.
>
> Yeah, the ath1?k-firmware.git repos are being moved to
> git.codelinaro.org and we will send an announcement once everything is
> ready.
>
>> And to the request to get the latest versions released via linux-firmware.git 
>> (or maybe even only in Kalle's repositories), I got (some weeks ago) the 
>> answer "Let me check with our team.".
>>
>> It is rather hard to make statements about Qualcomm  - simply because it is 
>> not just a single person and I have no idea about the internal structures. But 
>> it doesn't seem to be the highest priority (for the "internal team"?) to make 
>> fixes available for everyone. I still hope that it is just delayed due to some 
>> unfortunate circumstances. But this is just the current state.
>
> Thanks for letting me know, I was not aware any of this. Me and Jeff
> will investigate and get back to you.

In case not everyone noticed but Jeff has now uploaded updates to
2.5.0.1 branch:

https://git.codelinaro.org/clo/ath-firmware/ath11k-firmware/-/commit/97e0d33fe3e0f708459a682b167014906719337d

https://git.codelinaro.org/clo/ath-firmware/ath11k-firmware/-/commit/04dd351414737ac14b3e381d3695b59f4de67eaa

https://git.codelinaro.org/clo/ath-firmware/ath11k-firmware/-/commit/2dda8ce67f65af54f86fb2f49316174841fa95f7

It's quite strange that they updated 2.5.0.1 branch first but my
understanding that there should be updates for the newer 2.7.0.1 branch
as well (2.7.0.1 branch is also in linux-firmware).

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches