The reason why most android phones don't get upgrades (or only one) to newer android versions has absolutely nothing to do with qualcomm lack of care regarding their cpu's security.
This is partially why Treble is being worked on, to just completely disconnect the actual Linux-based HAL from "the OS", thus trying to negate a lot of the oblate stupidity from vendors like Qualcomm and have a shim in-between your actual phone, and Android itself, in hopes to fix stuff.
We seriously need more phone SoC vendors.
First, of all there are legal obligations known as contracts. If Google was serious about Nexus 5 support from OEMs, it would have had contract in place that would assure the necessary support regardless of what OEMs would decide.
Secondly, Treble is yet another solution that will die, because Google, again, decided to leave to OEMs the task of delivering Treble updates, without any kind of legal obligation.
Additionally Android devices that get upgraded to Oreo aren't obliged to be fully Treble compliant, only the ones released with Oreo.
So, many new devices planned to be released in 2018, are based on Android 7.0.
That kind if snark is unnecessary and degrades the conversation.
> If Google was serious about Nexus 5 support from OEMs, it would have had contract in place that would assure the necessary support regardless of what OEMs would decide.
I'm not sure who you are referring to with "OEM" here, but Google took on the responsibility of maintaining the OS images for the Nexus devices, not the companies they contracted to build them.
May be, but apparently discussions about Android's and OEMs usually leads to hand waving regarding the legal options available to Google, if they really cared about enforcing updates.
> I'm not sure who you are referring to with "OEM" here, but Google took on the responsibility of maintaining the OS images for the Nexus devices, not the companies they contracted to build them.
Like the customers they have abandoned after TI cut down support on their chipsets?
Had Google taken the legal requirements to enforce TI to maintain support or face monetary sanctions for the three years it was supposed to take place, this would not have happened as it did.
It always circles down to how much Google cares.
On the other hand - yes, hammerhead is stuck on Linux kernel 3.4, which is no longer maintained, and current best effort to forward-port to mainline kernel [2] is far from complete.
Among other things this means that there is no workaround for Meltdown on this hardware, which it is likely vulnerable to. [3]
[1] https://download.lineageos.org/hammerhead
[2] https://wiki.postmarketos.org/wiki/Google_Nexus_5_(lg-hammer...
[3] "11 stage integer pipeline with 3-way decode and 4-way out-of-order speculative issue superscalar execution" - from https://en.wikipedia.org/wiki/Krait_(CPU)
Qualcomm on the other hand has taken the "fuck security" approach and failed to clean up their code and get it mainlined for nearly all of their common SoCs. Hence why Android phones are often trapped on old versions of Android when launched or shortly thereafter, long term security through the device lifecycle is a bad joke when Qualcomm and most other ARM vendors are involved.