bde961c6f2
PAF becomes saf/device (history kept), STATE.md dissolves into saf/state.md with the dated era archived, the substrate SAF moves up from souveraine, and every agreement points at saf/INDEX.md and nowhere else. one map, nothing to remember
51 lines
4.1 KiB
Markdown
51 lines
4.1 KiB
Markdown
# PAF — Pixel 3 (blueline) pmOS Architecture Framework
|
||
|
||
The single living spine for this port. Replaces the accreting handoffs/findings: instead of
|
||
appending a new dated doc each session, **update the relevant layer in place.** The spine:
|
||
|
||
- **[modem.md](modem.md)** — the modem bring-up stack as layers, status per layer, the
|
||
eliminated-leads ledger (don't re-chase these), and the one live frontier.
|
||
- **[platform.md](platform.md)** — device hardware map, boot/storage architecture, how to
|
||
reach the phone, recovery procedures, and the hard hardware lessons.
|
||
- **[build.md](build.md)** — how the kernel + device package are actually built with
|
||
pmbootstrap, the two-package split, and the build-system gotchas that have each cost a session.
|
||
- **[slpi.md](slpi.md)** — SLPI sensor island bring-up and the `sar.cc:27` crash-loop fix.
|
||
- **[secure_load_tz_frontier.md](secure_load_tz_frontier.md)** — 🔴 SUPERSEDED: secure-load is
|
||
resolved (modem loads clean via DELTA-1). Historical −22/fastrpc_mem record; the live frontier is
|
||
the firmware OFFLINE/52 park — see `modem.md` + `diag_capture.md`.
|
||
- **[README.md](README.md)** — this index.
|
||
|
||
Deeper/dated capture docs (`modem_*`, `qcril_*`, `pmos_fix_plan.md`, `diag_capture.md`, …) sit
|
||
alongside as evidence; the spine above is what you read first. Sibling docs kept outside the PAF
|
||
on purpose: `../README.md` (the generic port guide) and `../SIDE-TASKS.md` (parked non-modem work).
|
||
|
||
## Status at a glance (2026-07-01)
|
||
|
||
| Layer | State |
|
||
|---|---|
|
||
| Firmware load (MBA→MPSS) | 🟢 healthy — loads clean, **no −22 on the modem path** (DELTA-1 `c2923cb49`) |
|
||
| Power (rpmhpd cx/mx/mss → mss.lvl) | 🟢 healthy, proven equivalent to Android |
|
||
| QMI / QRTR transport | 🟢 healthy |
|
||
| rmtfs / tqftpserv | 🟢 healthy (rmtfs in `-P -s` rw partition mode) |
|
||
| pd-mapper | 🟢 fixed live (2026-06-29 late). `CONFIG_QCOM_PD_MAPPER=m` is in the flashed kernel and `qcom_pd_mapper` loads. This restored WLAN PD advertisement and `ath10k_snoc` probe; `wlan0` exists. |
|
||
| SIM / UIM provisioning | 🟢 healthy (usim ready, Primary-GW slot1/app1) |
|
||
| PDC MCFG autoselect | 🟡 works (configs go Active) — **NOT the gate** (modem parks OFFLINE regardless) |
|
||
| SLPI sensor island (`sar.cc:27`) | 🟠 real firmware crash, still unfixed — **but now cleanly bounded and PROVEN independent of the modem 52 wall** (2026-07-01, three live boots: crashed continuously / running / cleanly parked all gave byte-identical `DeviceNotReady`). Ordering + crash-recovery both fixed (see `slpi.md`); the sensor island itself is out of scope for modem bring-up now. |
|
||
| **RF arm (`Set Operating Mode=online`)** | **🔴 BLOCKED — offline/mode 0/52. THE frontier; proven kernel- and SLPI-independent.** `dms-ui-ready.py` (DMS 0x0064, the one load-bearing QCRIL pre-online step never replayed) built 2026-07-01, untested on hardware — next pmOS boot is the test. |
|
||
| Data / voice (IPA, MM, calls) | gated behind RF arm |
|
||
|
||
**One-line state:** the modem MSS loads clean, enumerates fully (IMEI/SIM/firmware all read
|
||
reliably), and the phone is stable on 7.1.1 with WiFi working. The 52 wall is the modem's
|
||
firmware-internal RF-init decision (pmOS parks op-mode 3 OFFLINE vs Android's op-mode 1
|
||
LOW_POWER) — now **proven independent of SLPI** with hard repeated evidence, closing out the prior
|
||
"make SLPI healthy first" ranked move as a dead end for this specific blocker. The live frontier is
|
||
`dms-ui-ready.py`: the one QCRIL pre-online QMI step (disassembly-confirmed load-bearing) that pmOS
|
||
has built but never fired on real hardware yet.
|
||
|
||
**Build/packaging milestone (2026-06-22):** all fixes unified into one **7.1.1** kernel tree as
|
||
commits (not scattered patches), built via pmbootstrap; the PDC self-provisioner
|
||
(`qcril-autoselect`) moved out of hand-deployed `tools/` glue and **into the
|
||
`device-google-blueline` package**, auto-enabled via the systemd preset and ordered
|
||
`After=rmtfs` / `Before=ModemManager`. One piece still hand-built: the openimsd **libqmi fork**
|
||
(PDC Set Feature) is not yet its own aport — see [build.md](build.md). This is "how the PAF
|
||
ought to look": kernel fixes in-tree, provisioner in the device package, nothing scp'd by hand.
|