Fimeg/SouveraineOS
Watch
1
0
Fork
You've already forked SouveraineOS
 0
Code Releases Activity
SouveraineOS/saf/device/evidence/android_modem_bringup_capture.md
Fimeg bde961c6f2 saf: one spine — device, state, and work under the index 
PAF becomes saf/device (history kept), STATE.md dissolves
into saf/state.md with the dated era archived, the substrate
SAF moves up from souveraine, and every agreement points at
saf/INDEX.md and nowhere else. one map, nothing to remember
2026-08-18 09:47:30 -04:00

4.7 KiB
Raw Blame History

PAF · Android modem bring-up — COMPLETE captured sequence (the working reference)

The full modem boot Android does, end to end, extracted from the real captures in android-capture-20260620/ (modem SSR full re-init -> ONLINE, and the cold online capture). This is the ENTIRE process — not one diff. Each phase lists what Android does (with file:line) and the pmOS gap. Android reaches IN_SERVICE / LTE / Fido (302/720) at the end; pmOS stalls at phase 1.

Source files:

  • qcril-ssr-fullinit.txt (66k lines, modem SSR -> full re-init)
  • qcril-online-capture.txt (24k lines, cold bring-up to ONLINE)
  • android-radio-log.txt, qcril-ssr-TIMELINE.txt (digest) SIM: ICCID , IMSI , MCC/MNC 302/370 (Fido).

PHASE 0 — kernel/firmware secure-load (pre-QMI; NOT in these AP logs)

The modem PIL loads MBA -> PBL -> MPSS with the TZ memory-assign + XPU unlock. Android passes this. pmOS is where the -22 / XPU violation lives — see secure_load_tz_frontier.md. NOTE: downstream (peripheral-loader.c:334 pil_assign_mem_to_subsys) makes the same HLOS->subsys_vmid RW hyp_assign that mainline qcom_q6v5_mss.c:463 does — the assign is load-bearing, the skip was wrong.

PHASE 1 — firmware comes up at op-mode 1 = LOW_POWER ← THE DIVERGENCE

  • Android: qcril_qmi_nas_query_cur_power_state: known modem operating mode 1 then dms_handle_modem_operating_mode: modem's operating mode needs to be changed (qcril-online-capture.txt:90,96), and the DMS event report shows oprt 1 / 0 (qcril-online-capture.txt, qcril_qmi_nas.cpp:6562).
  • pmOS: modem comes up at op-mode 3 = OFFLINE (tools/modem-online-provisioner/RESULTS.md). OFFLINE->online = 52 DeviceNotReady; low_power->online would be a legal transition.
  • QMI DMS operating-mode enum: 0=ONLINE 1=LOW_POWER 2=FACTORY 3=OFFLINE 4=RESET 5=SHUTDOWN 6=PERSISTENT_LOW_POWER.
  • The real question is NOT "how to force OFFLINE->online" (it can't) — it is "why does our modem boot to OFFLINE when Android's boots to LOW_POWER". OFFLINE is the firmware's "something-wrong / not-provisioned" state. Prime suspects: phase-0 secure-load health (degraded boot), or EFS/rmtfs provisioning (modem can't read/write its NV -> falls to OFFLINE).

PHASE 2 — UIM / SIM card init (Android: OK)

  • card_state 3 (present), app state 5 (READY), app type 2=USIM / type 5=ISIM (qcril-online-capture.txt:336-337). SIM ICCID/IMSI read fine.
  • pmOS gap: untested past phase 1 — modem must be online first.

PHASE 3 — PDC: select carrier MBN config (per SIM slot) ← pmOS likely missing

  • Android: qcril_qmi_pdc_get_selected_mbn_config_by_sim_slot (qcril-ssr-fullinit.txt:4308…) and qcril_qmi_pdc_get_selection_carrier: cnv is valid, cnv=[72] (qcril-online-capture.txt:9367, qcril_qmi_nas: prop_cnv = 72). cnv 72 = the Fido carrier config.
  • This is the carrier/modem config (MBN) activation. pmOS has no RIL doing it; the planned replacement is the PDC self-provisioner qcril-autoselect.py (see build.md, device-google-blueline). Without a selected config the modem may stay inert on RF.

PHASE 4 — drive operating mode -> ONLINE

  • Android: NAS decides "needs to be changed" (phase 1) and sets the modem ONLINE; subsequent state shows is_online 1 (qcril-online-capture.txt, qcril_qmi_nas.cpp:26131).
  • pmOS: this is exactly the --dms-set-operating-mode=online we fire — returns 52 because we start from OFFLINE (phase 1), not LOW_POWER.

PHASE 5 — NAS attach / network registration (full QMI choreography)

  • Module/QMI send order (from qcril-ssr-TIMELINE.txt section A): Nas, Pdc, Voice, DSD, Auth, WDS, Pbm, Sms, Vs — dozens of NasModem sends, all rc=0. This is the post-online network attach.

PHASE 6 — IN_SERVICE (the goal)

  • combinePsRegistrationStates: mVoiceRegState=0(IN_SERVICE), mDataRegState=0(IN_SERVICE) … getRilVoiceRadioTechnology=14(LTE) … mOperatorAlphaLong=Fido (qcril-online-capture.txt:24110).
  • CS domain: VOICE,SMS,VIDEO; PS domain: DATA,MMS; registrationState=HOME; LTE EARFCN 2000, Fido 302/720 (qcril-online-capture.txt:24107-24132). IMS registered (:24083).

What "the whole job" actually is (so it stops getting half-done)

  1. Phase 0 — fix the secure-load so the modem boots HEALTHY (the -22 / XPU). Not the skip.
  2. Phase 1 — get the modem to come up at LOW_POWER, not OFFLINE. Likely a consequence of (1) and/or EFS/rmtfs provisioning. This is the current wall.
  3. Phase 3 — replicate Android's PDC MBN carrier-config selection (qcril-autoselect provisioner).
  4. Phase 4 — only then does set-operating-mode=online succeed instead of 52. Doing (4) without (1)-(3) is why every "flash and test" returns 52. All four are required.