That may keep the phone working but that doesn't provide security updates. Only Qualcomm can provide security updates for the binary blobs, so if Qualcomm won't sell security updates past 3 years than no OEM can guarantee a secure phone for more than 3 years. Sure, they can update other components but I would be very upset if 3.5 years into my 5 year supported phone a CPU vulnerability was discovered that let apps get root.

So while in practice this is rare it means that longer updates can't be offered as a product feature, and if it can't be offered as a product feature than how does it help sell phones.

I'll tell you right now that if any somewhat reputable manufacturer promised 5 year support on an otherwise reasonable phone I would buy it (and 5 isn't even that much). I would even pay a bit more for it. The amount of environmental waste that is basically working phones that just need a couple of software patches is disgusting.

> I'll tell you right now that if any somewhat reputable manufacturer promised 5 year support on an otherwise reasonable phone I would buy it

I think that's exactly what Fairphone does. Sure they are not as big as Samsung, but they seem to be true to their word (I'm a happy FP3 customer, but to be honest I have much reasonable expectations for my phone than many :) )

This was one of the big reasons my newest phone is an iPhone, not an Android phone. I am tired of buying new hardware every 2-3 years just to have a secure device.

I worked on the Linux Kernel team at Qualcomm for about five years, left in 2016. Our director was very much in favor of upstreaming but the product release schedules were so aggressive everyone was scrambling just to hit customer deadlines. It was incredibly difficult to get upper management on board with spending an additional 20% time getting drivers upstreamed, despite our team making the case for it ad nauseam.

Hopefully they recognize the value of "upstream first" more now. I think it is getting better...

My understanding is that a number of Android vendors operate by just taking a version of the Linux kernel and making any changes they need. By the time the phone is released and anyone cares, it's an old version of the Linux kernel, and the changes weren't written in a way that it's easy to incorporate them in the first place. The idea of incorporating a large chunk of changes all at once at the end is nobody's idea of a good time.

I get that they have no responsibility vis a vis the GPL to upstream their changes, and I have no doubt that this is a cheaper way for them to run their business.

The SoC manufacturer provides to the OEM exactly one kernel version that works on that chip.

The OEM has to use that version. Oftentimes the SoC manufacturer will deliberately make it an old version because they know that the next android release will require a newer kernel version, therefore forcing the OEM to update to a new and more profitable SoC rather than continuing to sell an old model.

Isn't that a blatant GPL Violation?

Also; has any work been done on decompiling that kernel and trying to match up the symbols with existing source code?

The full source code of that kernel version is provided, including all KM drivers.