I care about those blobs because they represent a massive amount of attack surface that, as you admit, no one has time to reimplement and/or audit.
At least Google reviews the code they write, but it is obvious they don't review blobs either given vendor quality.
Conversation
Google and other vendors are given the source code for these components and get to build them from source. The reason these things don't get attention is because they are specific to a hardware generation and no one cares to invest much time in something that becomes obsolete.
1
1
It doesn't particularly matter whether this code is open or closed source. Either way, people are not working on it much. Most effort goes into the device independent code. AOSP doesn't have blobs. Devices have blobs, whether or not you run AOSP using those or something else.
2
Qualcomm has invested effort into the open source driver stack but it's never ready in time for it to be what vendors choose to ship. Look at linaro.org/blog/dragonboa as an example. This is the same SoC as the Pixel 3. It has open drivers for mainline kernels. It comes too late.
1
That is the first credible evidence I have seen that there are people at Qualcomm that care about these classes of problems.
This is going to end with someone trying to get VC funding to pay for an actually open driver hardware target isn't it...
1
Qualcomm cares about selling hardware. They've been trying to get a mainline kernel driver stack up and going for years. It's incredibly difficult to land everything upstream. The upstream kernel doesn't accept kernel drivers only used with closed source userspace libs, etc.
1
1
There aren't kernel drivers to build userspace support because the userspace support hasn't been written for non-existent kernel drivers. It all has to be cleaned up, overhauled, ported over to upstream frameworks which are often totally inadequate and have to be improved, etc.
1
1
The open source driver stack for Snapdragon exists and is usable. However, it doesn't match the performance/functionality for devices it supports and it's ready a year or two after the hardware is launched rather than way before that which is what would have to happen...
1
1
So, since it's not what gets shipped, it obviously doesn't get the same resources applied to it. Over time, it's getting better and getting more resources applied but it's unclear if there will EVER be a point that devices can ship with upstream kernel unless they use an old SoC.
2
I would happily use a crippled 5 year old SoC if it was going to continue to be sustainably manufactured.
I would even settle for wifi-only if I could have my 4 apps, open drivers, and decent secure boot.
2
That's essentially what you're able to get with a development board like 96boards.org/product/rb3-pl with AOSP support. Same SoC as the Pixel 3, but in the smartphone world this is already a past generation SoC and it'll be at Pixel 5 / 6 before the open driver stack could be ready.
If all the past efforts / partnerships hadn't been blown up by greed, GrapheneOS would likely already be using custom hardware based on a Qualcomm reference design. Could build with the actual vendor SDK / sources in our official builds and publish output in a usable format.
1
1
It was all massively set back. Still dealing with all of that stuff far more than focusing on the actual project. Pixels are the best currently available option and will probably remain as such, until we can get reference hardware produced for us and start customizing that.
2
1
Show replies
I spoke to someone on the Android team close to hardware sourcing. He didn't indicate any optimism that we will see open driver targets from major vendors any time soon.
Instead he expressed concern over increasing Chinese backdoor sophistication. Fair.
Still, we can dream.
1
Qualcomm is making it available but it's pretty much impossible for it to happen for a current / next generation SoC unless mainline support isn't part of it but rather just code dumping everything and having the eventual mainline support as something distinct from it.
1
1
Show replies