feat!: install the qcom-next kernel package from QLI APT

.github/workflows/build-on-pr.yml

@@ -31,10 +31,6 @@ jobs:
     with:
       suite: ${{ matrix.suite }}
       variant: ${{ matrix.variant }}
-      # QLI targets qcom-next; consume the debs published to EFS by the
-      # "qcom-next linux build" workflow rather than a kernel from an
-      # APT repository
-      kernelpackages: efs/qcom-next
   schema-check:
     uses: ./.github/workflows/lava-schema-check.yml
     permissions:

.github/workflows/build-on-push.yml

@@ -18,10 +18,6 @@ jobs:
       contents: read
     with:
       suite: ${{ matrix.suite }}
-      # QLI targets qcom-next; consume the debs published to EFS by the
-      # "qcom-next linux build" workflow rather than a kernel from an
-      # APT repository
-      kernelpackages: efs/qcom-next
   schema-check:
     uses: ./.github/workflows/lava-schema-check.yml
     permissions:

.github/workflows/build.yml

@@ -1,28 +1,22 @@
 # Builds & Tests QLI Debian images:
-#  - qcom-next kernel
+#  - qcom-next kernel (from QLI APT repo)
 #  - Qualcomm overlay repos and packages
 #
 # This workflow tracks the state of QLI Debian on supported boards.
 
 name: Build
 
-# runs once the daily qcom-next kernel build is done, so that the images are
-# built from the debs it has just published to EFS; this also runs when that
-# build fails, in which case EFS still holds the previous kernel debs and the
-# images are worth building and testing anyway.
-#
-# workflow_run is required to chain onto that build: it is the only trigger
-# that fires when another workflow completes. The triggering workflow only
-# runs from schedule or workflow_dispatch on main of this repository, so its
-# event payload is never attacker-controlled, the jobs below are additionally
-# guarded on the repository and ref. Nothing here checks out or executes
-# code from the triggering run, so the usual workflow_run privilege-escalation
-# route does not apply.
-on: # zizmor: ignore[dangerous-triggers]
-  workflow_run:
-    workflows: ["qcom-next linux build"]
-    types:
-      - completed
+on:
+  # run daily at 0:30am. these are the images QLI ships, so they go first of
+  # the scheduled builds and get an empty LAVA queue; the rest of the day's
+  # builds are staggered behind them (arduino 6:30am, vanilla Debian 10:30am)
+  # so that they don't all submit LAVA jobs at once.
+  #
+  # the images this workflow produces are shared with the test teams and are
+  # expected by 8:00am IST (2:30am UTC); building from 0:30am leaves two hours
+  # of headroom, see issue #566.
+  schedule:
+    - cron: '30 0 * * *'
   # allow manual runs
   workflow_dispatch:
 
@@ -49,10 +43,6 @@ jobs:
     with:
       suite: ${{ matrix.suite }}
       variant: ${{ matrix.variant }}
-      # QLI targets qcom-next; consume the debs published to EFS by the
-      # "qcom-next linux build" workflow rather than a kernel from an
-      # APT repository
-      kernelpackages: efs/qcom-next
 
   test:
     # don't run from forks of the main repository or from other branches;

.github/workflows/debos.yml

@@ -17,7 +17,7 @@ on:
           repositories (e.g. linux-image-arm64) or name of a EFS kernel
           package directory (e.g. efs/mainline)
         type: string
-        default: linux-image-arm64
+        default: linux-image-qcom-next
       debos_extra_args:
         description: Extra arguments to pass to debos (e.g. -t dtb:qcom/some.dtb)
         type: string
@@ -156,21 +156,6 @@ jobs:
               apt-ftparchive release . >Release
           )
 
-      - name: Copy unstripped vmlinux from EFS
-        run: |
-          set -ux
-          # the kernel workflow publishes the unstripped vmlinux next to the
-          # debs; pick it up so it gets published with the image artifacts.
-          case "$KERNEL_PACKAGES" in
-            efs/*)
-              efs_kernel_dir="/efs/${KERNEL_PACKAGES#efs/}"
-              # kernel builds predating the vmlinux artifact have none
-              if [ -f "${efs_kernel_dir}/vmlinux" ]; then
-                  cp -av "${efs_kernel_dir}/vmlinux" .
-              fi
-            ;;
-          esac
-
       - name: Build rootfs with debos
         run: |
           set -ux
@@ -200,6 +185,28 @@ jobs:
               --print-recipe \
               debos-recipes/qualcomm-linux-debian-rootfs.yaml
 
+      - name: Extract unstripped vmlinux from the kernel debug package
+        run: |
+          set -ux
+          case "$KERNEL_PACKAGES" in
+            # kernels built from EFS are installed from the packages copied to
+            # the local APT repo above, so extract vmlinux from the -dbg
+            # package sitting next to them; the image installs the
+            # highest-version kernel found there
+            efs/*)
+              kernel_deb="$(find local-apt-repo/kernel -type f -name 'linux-image-[0-9]*.deb' -not -name '*-dbg_*'|sort -V|tail -n1)"
+              ci/vmlinux/extract-vmlinux.sh --optional "$kernel_deb" vmlinux
+              ;;
+            # kernels installed from an APT repository (e.g.
+            # linux-image-qcom-next from the Qualcomm Linux repository) only
+            # ship vmlinux in a -dbg package, which has to be downloaded first
+            *)
+              debos \
+                  --print-recipe \
+                  ci/vmlinux/download-vmlinux.yaml
+              ;;
+          esac
+
       - name: Build UFS and SD card images with debos
         run: |
           set -ux
@@ -229,8 +236,8 @@ jobs:
           gzip -c disk-sdcard.img >"${dir}/${PREFIX}-disk-sdcard.img.gz"
           cp -av dtbs.tar.gz "${dir}/${PREFIX}-dtbs.tar.gz"
           # publish the unstripped vmlinux of the kernel installed in the image
-          # to facilitate debugging oops/panic backtraces; absent when the kernel
-          # comes from APT rather than from an EFS kernel build.
+          # to facilitate debugging oops/panic backtraces; absent when neither
+          # the EFS kernel build nor a kernel debug package provided one.
           if [ -f vmlinux ]; then
               gzip -c vmlinux >"${dir}/${PREFIX}-vmlinux.gz"
           fi

.github/workflows/linux-qcom-next.yml

@@ -1,19 +1,18 @@
+# DEPRECATED: the QLI Debian images install the linux-image-qcom-next package
+# from the QLI APT repository, maintained in its own packaging repository at
+# https://github.com/qualcomm-linux/pkg-linux-qcom
+
+# Nothing consumes the packages this workflow publishes anymore. It survives as
+# a reference build, to compare the kernel built straight from the qcom-next
+# tree against the package from the QLI APT repository.
+
 name: qcom-next linux build
 
 on:
-  # run daily at 0:30am. qcom-next is what QLI ships, so it goes first of the
-  # scheduled builds and gets an empty LAVA queue; the rest of the day's builds
-  # are staggered behind it (arduino 6:30am, linux-next 8:30am, vanilla Debian
-  # images 10:30am) so that they don't all submit LAVA jobs at once. The "Build"
-  # workflow chains onto this one, so its LAVA jobs land later still, around
-  # 3:30am.
-  #
-  # the images the "Build" workflow produces are shared with the test teams and
-  # are expected by 8:00am IST (2:30am UTC); building from 0:30am leaves an hour
-  # of headroom, see issue #566.
-  schedule:
-    - cron: '30 0 * * *'
-  # allow manual runs
+  # no schedule: this build is no longer used, so it only runs when started
+  # by hand
+  #schedule:
+  #  - cron: '30 4 * * *'
   workflow_dispatch:
 
 # grant nothing by default; every job below declares the scopes it needs
@@ -36,10 +35,10 @@ jobs:
       pull-requests: write
     with:
       kernel_name: qcom-next
-      build_linux_deb_extra_args: '--qcom-next --ref qcom-next-7.2-rc7-20260821 prune.config qcom.config'
-      # stop after publishing the debs to EFS; the "Build" workflow
-      # picks them up and builds and tests the images on every suite
-      skip_image_build: true
+      build_linux_deb_extra_args: '--qcom-next prune.config qcom.config'
+      # reference build: we want the debs and the LAVA results to compare
+      # against, but its failures must not gate qcom-deb-images work
+      lava_report_test_results_externally: false
       # https://github.com/qualcomm-linux/qcom-deb-images/issues/537
       lava_boards_exclude: '["monaco-arduino-monza", "qrb2210-arduino-imola"]'
     secrets:

.github/workflows/linux.yml

@@ -154,13 +154,6 @@ jobs:
           # stage artifacts in a directory
           mkdir -v artifacts
           cp -av `dcmd *.changes` artifacts
-          # also publish the unstripped vmlinux to help debug crashes: it
-          # carries the kernel symbol table so oops/panic backtraces can be
-          # symbolize. This matches the vmlinux artifact meta-qcom's Yocto CI
-          # publishes and is required by teams analyzing kernel crashes.
-          if [ -f linux/vmlinux ]; then
-            cp -av linux/vmlinux artifacts/
-          fi
 
       - name: Upload results to EFS
         run: |

README.md

@@ -20,14 +20,12 @@ tuned!
 
 ## CI Status
 
-| Variant | Kernel build | Image build & boot test |
-| ------- | --- | --- |
-| Qualcomm Linux | [![qcom-next kernel][qcom-next-badge]][qcom-next] | [![images][images-badge]][images] |
-| Debian | *uses kernel from Debian Archive* | [![Debian images][debian-images-badge]][debian-images] |
-| Reference upstream kernels | [![linux-next][linux-next-badge]][linux-next] [![mainline][mainline-badge]][mainline] | *covered by the kernel build* [^1] |
-| Project-specific builds | [![arduino][arduino-badge]][arduino] | *covered by the kernel build* [^1] |
-
-[^1]: these builds compile the kernel, build an image and boot test the image in a single workflow, so the Kernel build reports all three.
+| Variant | Image build & test status |
+| ------- | --- |
+| Qualcomm Linux | [![QLI images][images-badge]][images] |
+| Debian | [![Debian images][debian-images-badge]][debian-images] |
+| Reference upstream kernels | [![linux-next images][linux-next-badge]][linux-next] [![mainline images][mainline-badge]][mainline] |
+| Project-specific builds | [![Arduino images][arduino-badge]][arduino] |
 
 
 ## Requirements
@@ -65,12 +63,12 @@ scripts/build-u-boot-rb1.sh
 
 ### (optional) Build custom kernel
 
-By default the image recipes will install the kernel provided by Debian.
+By default the image recipes install `linux-image-qcom-next`, the Qualcomm
+Linux kernel package; see the [Kernel](#kernel) section for details.
 
-Build a custom kernel if you want to run `qcom-next`, the kernel which the CI
-images use and recommended for maximum hardware compatibility, `mainline` or
-`linux-next`. See the [Kernel](#kernel) section for the build-dependencies and
-the build instructions, then come back here.
+Build a custom kernel if you want to run your own `qcom-next` tree, `mainline`
+or `linux-next` instead. See the [Kernel](#kernel) section for the
+build-dependencies and the build instructions, then come back here.
 
 ### Build the image
 
@@ -146,11 +144,9 @@ A few options are provided in the debos recipes; for the root filesystem recipe:
 - `overlays`: a `,`-separated list of rootfs overlays to add from
   `debos-recipes/overlays/`. See the *Supported overlays* section below.
 - `kernelpackages`: a `,`-separated list of kernel packages to install from
-  apt; defaults to `linux-image-arm64`. Set it to `none` when you are installing
-  a local kernel package. See the [Kernel](#kernel) section below for
-  more information.
-- `kernelpackage`: **deprecated**, superseded by `kernelpackages`; still
-  accepted as a single package name for backwards compatibility.
+  apt; defaults to `linux-image-qcom-next`. Set it to `linux-image-arm64` to
+  install the kernel from Debian, or to `none` when you are installing a local
+  kernel package. See the [Kernel](#kernel) section below for more information.
 - `qliaptrepo`: configure the Qualcomm Linux APT repository in the root
   filesystem; defaults to `true`. Set it to `false` to leave the image with no
   Qualcomm Linux APT sources.
@@ -268,14 +264,25 @@ password to a safe one.
 
 ## Kernel
 
-When building an image locally, by default the recipe will install the latest
-kernel from Debian.
+The default kernel, installed by the recipes and by every CI-built image, is
+the `linux-image-qcom-next` package from the Qualcomm Linux APT repository. It
+is the default because it carries additional hardware support for Qualcomm
+devices, on top of what the kernel in the Debian archive provides.
+
+The package is built from `qcom-next`, the Qualcomm Linux integration branch of
+the [Qualcomm Linux kernel tree](https://github.com/qualcomm-linux/kernel), by
+[its own packaging repository](https://github.com/qualcomm-linux/pkg-linux-qcom).
+That repository is maintained separately from this one and decides which
+revision of the tree it packages and publishes, so the version of
+`linux-image-qcom-next` an image installs does not necessarily correspond to
+the newest `qcom-next-*` tag; run `apt policy linux-image-qcom-next` in an
+image to see which version it has.
 
-All of the CI-built images instead install
-[`qcom-next`](https://github.com/qualcomm-linux/kernel/tree/qcom-next), the
-Qualcomm Linux integration branch, which carries additional platform support.
+To install the kernel from the Debian archive instead, see
+[Build a vanilla Debian image](#build-a-vanilla-debian-image) below.
 
-Build it yourself to get the same kernel the CI images use.
+You can also build a kernel yourself, for instance to test a local change or to
+compare `qcom-next` against `mainline` or `linux-next`.
 
 Building a Linux kernel deb requires the following build-dependencies:
 ```bash
@@ -289,8 +296,8 @@ enable arm64 as a foreign architecture first by running
 Then build `qcom-next` with the recommended config fragments:
 
 ```bash
-# CI pins an exact version with `--ref`; without one this builds the qcom-next
-# branch tip.
+# this builds the latest qcom-next-* tag; pass --ref to build a specific tag
+# or the qcom-next branch tip instead
 scripts/build-linux-deb.py --qcom-next prune.config qcom.config kernel-configs/*.config
 ```
 
@@ -313,15 +320,26 @@ the root filesystem:
 EXTRA_DEBOS_OPTS="-t localdebs:local-debs/ -t kernelpackages:none" make rootfs.tar
 ```
 
-Prebuilt Qualcomm kernel packages are also available from the overlay apt
-repository, as an alternative to building one:
+## Build a vanilla Debian image
+
+The images built by default are Debian plus the Qualcomm Linux additions:
+additional Qualcomm-provided packages and the `linux-image-qcom-next` kernel
+package from the Qualcomm Linux APT repository, which the image keeps
+configured so that it can be upgraded from later on.
+
+To build an image without the Qualcomm-provided packages or the Qualcomm Linux
+APT repository configured and the kernel from the Debian archive, run:
 
 ```bash
-# the trailing plus sign is doubled because apt reads a single one in a package
-# name as a request to install the package
-EXTRA_DEBOS_OPTS="-t kernelpackages:linux-image-<version>-qcom1++" make rootfs.tar
+EXTRA_DEBOS_OPTS="-t kernelpackages:linux-image-arm64 -t qliaptrepo:false" make rootfs.tar
 ```
 
+The result is a plain Debian root filesystem: every package in it comes from
+the Debian archive and the image has no Qualcomm Linux APT sources so it will
+never pull a Qualcomm Linux package on upgrade. Expect reduced hardware support
+compared to the default image, as the Debian kernel does not carry the
+Qualcomm platform patches which `linux-image-qcom-next` does.
+
 ## Development
 
 Want to join in the development? Changes welcome! See [CONTRIBUTING.md file](CONTRIBUTING.md) for step by step instructions.
@@ -376,15 +394,13 @@ This project is licensed under the [BSD-3-clause License](https://spdx.org/licen
 <!-- link targets for the CI status badges at the top of this file; each
      workflow needs two: the shields.io image and the Actions page it links to -->
 
-[qcom-next]: https://github.com/qualcomm-linux/qcom-deb-images/actions/workflows/linux-qcom-next.yml
-[qcom-next-badge]: https://img.shields.io/github/actions/workflow/status/qualcomm-linux/qcom-deb-images/linux-qcom-next.yml?label=qcom-next
 [images]: https://github.com/qualcomm-linux/qcom-deb-images/actions/workflows/build.yml
-[images-badge]: https://img.shields.io/github/actions/workflow/status/qualcomm-linux/qcom-deb-images/build.yml?label=images
+[images-badge]: https://img.shields.io/github/actions/workflow/status/qualcomm-linux/qcom-deb-images/build.yml?label=QLI%20images
 [debian-images]: https://github.com/qualcomm-linux/qcom-deb-images/actions/workflows/build-debian.yml
 [debian-images-badge]: https://img.shields.io/github/actions/workflow/status/qualcomm-linux/qcom-deb-images/build-debian.yml?label=Debian%20images
 [linux-next]: https://github.com/qualcomm-linux/qcom-deb-images/actions/workflows/linux-next.yml
-[linux-next-badge]: https://img.shields.io/github/actions/workflow/status/qualcomm-linux/qcom-deb-images/linux-next.yml?label=linux-next
+[linux-next-badge]: https://img.shields.io/github/actions/workflow/status/qualcomm-linux/qcom-deb-images/linux-next.yml?label=linux-next%20images
 [mainline]: https://github.com/qualcomm-linux/qcom-deb-images/actions/workflows/linux-mainline.yml
-[mainline-badge]: https://img.shields.io/github/actions/workflow/status/qualcomm-linux/qcom-deb-images/linux-mainline.yml?label=mainline
+[mainline-badge]: https://img.shields.io/github/actions/workflow/status/qualcomm-linux/qcom-deb-images/linux-mainline.yml?label=mainline%20images
 [arduino]: https://github.com/qualcomm-linux/qcom-deb-images/actions/workflows/linux-arduino.yml
-[arduino-badge]: https://img.shields.io/github/actions/workflow/status/qualcomm-linux/qcom-deb-images/linux-arduino.yml?label=arduino
+[arduino-badge]: https://img.shields.io/github/actions/workflow/status/qualcomm-linux/qcom-deb-images/linux-arduino.yml?label=Arduino%20images