Question to recent Qualcomm CVEs

[Sven Eckelmann]

On Monday, 26 February 2024 15:50:44 CET Felix Fietkau wrote:
[...]
>> The Qualcomm bulletin[1] says "Patches are being actively
> > shared with OEMs".
> > 
> > Were these bugfixes made available for OpenWRT? Is there an established
> > procedure for such cases, where closed-source firmware gets bugfixes?
[...]
> > [1]
> > https://docs.qualcomm.com/product/publicresources/securitybulletin/
december-2023-bulletin.html
> 
> The fixes were not shared with OpenWrt. Qualcomm does not care about 
> OpenWrt support for their platforms.

I've asked (using their qualcomm-cdmatech-support portal) for an official 
release of their WiFi firmware with all gathered bugfixes via 
linux-firmware.git. I got statements that the ath10k firmware is no longer 
supported + ath11k firmware is not developed further. But for some of them it 
is possible to request a release of the firmwares via Kalle's repositories. 
But also that Kalle's repositories are now replaced. Which seems to be 
confirmed by Kalle's statement [1] regarding the firmware-N.bin files on 
ath12k at lists.infradead.org .

The new positions for firmware files were not revealed but I found a couple of 
places [2,3,4,5] in my search.

And to the request to get the latest versions released via linux-firmware.git 
(or maybe even only in Kalle's repositories), I got (some weeks ago) the 
answer "Let me check with our team.".

It is rather hard to make statements about Qualcomm  - simply because it is 
not just a single person and I have no idea about the internal structures. But 
it doesn't seem to be the highest priority (for the "internal team"?) to make 
fixes available for everyone. I still hope that it is just delayed due to some 
unfortunate circumstances. But this is just the current state.

Kind regards,
	Sven

[1] https://lore.kernel.org/r/87bk8inesm.fsf@kernel.org
[2] https://git.codelinaro.org/clo/ath-firmware/ath10k-firmware
[3] https://git.codelinaro.org/clo/ath-firmware/ath11k-firmware
[4] https://git.codelinaro.org/clo/ath-firmware/ath12k-firmware
[5] https://github.com/quic/upstream-wifi-fw
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: This is a digitally signed message part.
URL: <http://lists.openwrt.org/pipermail/openwrt-devel/attachments/20240226/d8518d49/attachment.sig>