bde961c6f2
PAF becomes saf/device (history kept), STATE.md dissolves into saf/state.md with the dated era archived, the substrate SAF moves up from souveraine, and every agreement points at saf/INDEX.md and nowhere else. one map, nothing to remember
74 lines
4.7 KiB
Markdown
74 lines
4.7 KiB
Markdown
# PAF · Android modem bring-up — COMPLETE captured sequence (the working reference)
|
|
|
|
The full modem boot Android does, end to end, extracted from the real captures in
|
|
`android-capture-20260620/` (modem SSR full re-init -> ONLINE, and the cold online capture).
|
|
This is the ENTIRE process — not one diff. Each phase lists what Android does (with file:line)
|
|
and the pmOS gap. Android reaches **IN_SERVICE / LTE / Fido (302/720)** at the end; pmOS stalls
|
|
at phase 1.
|
|
|
|
Source files:
|
|
- `qcril-ssr-fullinit.txt` (66k lines, modem SSR -> full re-init)
|
|
- `qcril-online-capture.txt` (24k lines, cold bring-up to ONLINE)
|
|
- `android-radio-log.txt`, `qcril-ssr-TIMELINE.txt` (digest)
|
|
SIM: ICCID <redacted>, IMSI <redacted>, MCC/MNC 302/370 (Fido).
|
|
|
|
---
|
|
|
|
## PHASE 0 — kernel/firmware secure-load (pre-QMI; NOT in these AP logs)
|
|
The modem PIL loads MBA -> PBL -> MPSS with the TZ memory-assign + XPU unlock. Android passes this.
|
|
pmOS is where the **-22 / XPU violation** lives — see `secure_load_tz_frontier.md`. NOTE: downstream
|
|
(`peripheral-loader.c:334` `pil_assign_mem_to_subsys`) makes the **same** HLOS->subsys_vmid RW
|
|
hyp_assign that mainline `qcom_q6v5_mss.c:463` does — the assign is load-bearing, the skip was wrong.
|
|
|
|
## PHASE 1 — firmware comes up at op-mode 1 = LOW_POWER ← THE DIVERGENCE
|
|
- Android: `qcril_qmi_nas_query_cur_power_state: known modem operating mode 1` then
|
|
`dms_handle_modem_operating_mode: modem's operating mode needs to be changed`
|
|
(`qcril-online-capture.txt:90,96`), and the DMS event report shows `oprt 1 / 0`
|
|
(`qcril-online-capture.txt`, qcril_qmi_nas.cpp:6562).
|
|
- **pmOS: modem comes up at op-mode 3 = OFFLINE** (`tools/modem-online-provisioner/RESULTS.md`).
|
|
OFFLINE->online = **52 DeviceNotReady**; low_power->online would be a legal transition.
|
|
- QMI DMS operating-mode enum: 0=ONLINE 1=LOW_POWER 2=FACTORY 3=OFFLINE 4=RESET 5=SHUTDOWN
|
|
6=PERSISTENT_LOW_POWER.
|
|
- **The real question is NOT "how to force OFFLINE->online" (it can't) — it is "why does our
|
|
modem boot to OFFLINE when Android's boots to LOW_POWER".** OFFLINE is the firmware's
|
|
"something-wrong / not-provisioned" state. Prime suspects: phase-0 secure-load health (degraded
|
|
boot), or EFS/rmtfs provisioning (modem can't read/write its NV -> falls to OFFLINE).
|
|
|
|
## PHASE 2 — UIM / SIM card init (Android: OK)
|
|
- `card_state 3` (present), app `state 5` (READY), app `type 2`=USIM / `type 5`=ISIM
|
|
(`qcril-online-capture.txt:336-337`). SIM ICCID/IMSI read fine.
|
|
- pmOS gap: untested past phase 1 — modem must be online first.
|
|
|
|
## PHASE 3 — PDC: select carrier MBN config (per SIM slot) ← pmOS likely missing
|
|
- Android: `qcril_qmi_pdc_get_selected_mbn_config_by_sim_slot` (`qcril-ssr-fullinit.txt:4308…`)
|
|
and `qcril_qmi_pdc_get_selection_carrier: cnv is valid, cnv=[72]` (`qcril-online-capture.txt:9367`,
|
|
`qcril_qmi_nas: prop_cnv = 72`). cnv 72 = the Fido carrier config.
|
|
- This is the carrier/modem config (MBN) activation. pmOS has no RIL doing it; the planned
|
|
replacement is the PDC self-provisioner `qcril-autoselect.py` (see `build.md`,
|
|
`device-google-blueline`). Without a selected config the modem may stay inert on RF.
|
|
|
|
## PHASE 4 — drive operating mode -> ONLINE
|
|
- Android: NAS decides "needs to be changed" (phase 1) and sets the modem ONLINE; subsequent
|
|
state shows `is_online 1` (`qcril-online-capture.txt`, qcril_qmi_nas.cpp:26131).
|
|
- pmOS: this is exactly the `--dms-set-operating-mode=online` we fire — returns **52** because we
|
|
start from OFFLINE (phase 1), not LOW_POWER.
|
|
|
|
## PHASE 5 — NAS attach / network registration (full QMI choreography)
|
|
- Module/QMI send order (from `qcril-ssr-TIMELINE.txt` section A): Nas, Pdc, Voice, DSD, Auth, WDS,
|
|
Pbm, Sms, Vs — dozens of NasModem sends, all rc=0. This is the post-online network attach.
|
|
|
|
## PHASE 6 — IN_SERVICE (the goal)
|
|
- `combinePsRegistrationStates: mVoiceRegState=0(IN_SERVICE), mDataRegState=0(IN_SERVICE) …
|
|
getRilVoiceRadioTechnology=14(LTE) … mOperatorAlphaLong=Fido` (`qcril-online-capture.txt:24110`).
|
|
- CS domain: VOICE,SMS,VIDEO; PS domain: DATA,MMS; registrationState=HOME; LTE EARFCN 2000, Fido
|
|
302/720 (`qcril-online-capture.txt:24107-24132`). IMS registered (`:24083`).
|
|
|
|
---
|
|
|
|
## What "the whole job" actually is (so it stops getting half-done)
|
|
1. **Phase 0** — fix the secure-load so the modem boots HEALTHY (the -22 / XPU). Not the skip.
|
|
2. **Phase 1** — get the modem to come up at LOW_POWER, not OFFLINE. Likely a consequence of (1)
|
|
and/or EFS/rmtfs provisioning. This is the current wall.
|
|
3. **Phase 3** — replicate Android's PDC MBN carrier-config selection (qcril-autoselect provisioner).
|
|
4. **Phase 4** — only then does `set-operating-mode=online` succeed instead of 52.
|
|
Doing (4) without (1)-(3) is why every "flash and test" returns 52. All four are required.
|