bde961c6f2
PAF becomes saf/device (history kept), STATE.md dissolves into saf/state.md with the dated era archived, the substrate SAF moves up from souveraine, and every agreement points at saf/INDEX.md and nowhere else. one map, nothing to remember
4.1 KiB
PAF — Pixel 3 (blueline) pmOS Architecture Framework
The single living spine for this port. Replaces the accreting handoffs/findings: instead of appending a new dated doc each session, update the relevant layer in place. The spine:
- modem.md — the modem bring-up stack as layers, status per layer, the eliminated-leads ledger (don't re-chase these), and the one live frontier.
- platform.md — device hardware map, boot/storage architecture, how to reach the phone, recovery procedures, and the hard hardware lessons.
- build.md — how the kernel + device package are actually built with pmbootstrap, the two-package split, and the build-system gotchas that have each cost a session.
- slpi.md — SLPI sensor island bring-up and the
sar.cc:27crash-loop fix. - secure_load_tz_frontier.md — 🔴 SUPERSEDED: secure-load is
resolved (modem loads clean via DELTA-1). Historical −22/fastrpc_mem record; the live frontier is
the firmware OFFLINE/52 park — see
modem.md+diag_capture.md. - README.md — this index.
Deeper/dated capture docs (modem_*, qcril_*, pmos_fix_plan.md, diag_capture.md, …) sit
alongside as evidence; the spine above is what you read first. Sibling docs kept outside the PAF
on purpose: ../README.md (the generic port guide) and ../SIDE-TASKS.md (parked non-modem work).
Status at a glance (2026-07-01)
| Layer | State |
|---|---|
| Firmware load (MBA→MPSS) | 🟢 healthy — loads clean, no −22 on the modem path (DELTA-1 c2923cb49) |
| Power (rpmhpd cx/mx/mss → mss.lvl) | 🟢 healthy, proven equivalent to Android |
| QMI / QRTR transport | 🟢 healthy |
| rmtfs / tqftpserv | 🟢 healthy (rmtfs in -P -s rw partition mode) |
| pd-mapper | 🟢 fixed live (2026-06-29 late). CONFIG_QCOM_PD_MAPPER=m is in the flashed kernel and qcom_pd_mapper loads. This restored WLAN PD advertisement and ath10k_snoc probe; wlan0 exists. |
| SIM / UIM provisioning | 🟢 healthy (usim ready, Primary-GW slot1/app1) |
| PDC MCFG autoselect | 🟡 works (configs go Active) — NOT the gate (modem parks OFFLINE regardless) |
SLPI sensor island (sar.cc:27) |
🟠 real firmware crash, still unfixed — but now cleanly bounded and PROVEN independent of the modem 52 wall (2026-07-01, three live boots: crashed continuously / running / cleanly parked all gave byte-identical DeviceNotReady). Ordering + crash-recovery both fixed (see slpi.md); the sensor island itself is out of scope for modem bring-up now. |
RF arm (Set Operating Mode=online) |
🔴 BLOCKED — offline/mode 0/52. THE frontier; proven kernel- and SLPI-independent. dms-ui-ready.py (DMS 0x0064, the one load-bearing QCRIL pre-online step never replayed) built 2026-07-01, untested on hardware — next pmOS boot is the test. |
| Data / voice (IPA, MM, calls) | gated behind RF arm |
One-line state: the modem MSS loads clean, enumerates fully (IMEI/SIM/firmware all read
reliably), and the phone is stable on 7.1.1 with WiFi working. The 52 wall is the modem's
firmware-internal RF-init decision (pmOS parks op-mode 3 OFFLINE vs Android's op-mode 1
LOW_POWER) — now proven independent of SLPI with hard repeated evidence, closing out the prior
"make SLPI healthy first" ranked move as a dead end for this specific blocker. The live frontier is
dms-ui-ready.py: the one QCRIL pre-online QMI step (disassembly-confirmed load-bearing) that pmOS
has built but never fired on real hardware yet.
Build/packaging milestone (2026-06-22): all fixes unified into one 7.1.1 kernel tree as
commits (not scattered patches), built via pmbootstrap; the PDC self-provisioner
(qcril-autoselect) moved out of hand-deployed tools/ glue and into the
device-google-blueline package, auto-enabled via the systemd preset and ordered
After=rmtfs / Before=ModemManager. One piece still hand-built: the openimsd libqmi fork
(PDC Set Feature) is not yet its own aport — see build.md. This is "how the PAF
ought to look": kernel fixes in-tree, provisioner in the device package, nothing scp'd by hand.