SouveraineOS/saf/device/evidence/first_provision_capture.md

First-Provision Capture — force QCRIL to run the real MBN load sequence

Why: Every Android capture we have (android-live-20260619/) was an already-provisioned device, so QCRIL took the verify-only fast path (is_modem_mbn_updated: prev_ver == cur_ver → skip). We have never recorded the actual load→select→activate sequence, nor whether pdc_enable_auto_selection / qcril_qmi_pdc_enable_modem_update is a required precondition. This runbook forces a first-provision and captures it. See PAF/modem.md frontier #4.

Run from the host with the phone on Android slot B, rooted (adb root). All commands are host-side adb; device shell is Android (toybox), not pmOS ash.

---

0. Preconditions + backup (reversible-safety)

adb root && adb wait-for-device
adb shell getprop ro.product.device          # expect: blueline
adb shell getprop gsm.version.baseband        # expect: g845-00194-...

# Back up QCRIL's writable provisioning cache + the trigger props, so we can prove
# what changed and restore if needed.
adb shell 'tar -czf /data/local/tmp/modem_config.bak.tgz -C /data/vendor modem_config 2>/dev/null'
adb pull /data/local/tmp/modem_config.bak.tgz ./fp-capture/
adb shell 'getprop | grep -E "vendor.radio.(cnv|hw_mbn|sw_mbn|mbn)" ' | tee ./fp-capture/props.before.txt

Note: we deliberately do NOT touch the modem's EFS (modemst1/2, fsg, fsc). Those hold the modem's own persisted config + calibration; wiping them is destructive and not needed. We only clear QCRIL's userspace cache + the version prop — that is the documented trigger for the prev_ver != cur_ver reload branch.

1. Enlarge the radio log ring so early-boot lines survive until we dump

adb shell setprop persist.vendor.radio.smlog_switch 1   # verbose radio logging (best-effort)
adb logcat -b radio -G 64M                               # 64 MB radio buffer
adb logcat -b system -G 16M

2. Force the first-provision trigger, then reboot

# Clear QCRIL's writable provisioning state (rebuilt automatically on next provision).
adb shell 'rm -rf /data/vendor/modem_config/*'

# Blank the cached version string QCRIL compares against (this is the prev_ver in
# is_modem_mbn_updated). Empty prev_ver => mismatch => QCRIL must re-evaluate the load path.
adb shell 'setprop persist.vendor.radio.cnv.ver_info ""'
adb shell 'setprop persist.vendor.radio.hw_mbn_loaded ""'
adb shell 'setprop persist.vendor.radio.sw_mbn_loaded ""'

adb shell sync
adb reboot

3. Capture from as early as possible after boot

adb wait-for-device
adb root && adb wait-for-device
# Dump the whole radio ring immediately — the 64M buffer should still hold the early
# provision window (~10-40s into boot).
adb logcat -b radio -d > ./fp-capture/radio-firstprov.txt
adb logcat -b system -d > ./fp-capture/system-firstprov.txt
adb shell 'getprop | grep -E "vendor.radio.(cnv|hw_mbn|sw_mbn|mbn)"' | tee ./fp-capture/props.after.txt

If the early window was missed (buffer wrapped), repeat from §2 but instead of a plain dump, run a streaming capture across the reboot: adb logcat -b radio > radio-firstprov.txt & then adb reboot; logcat auto-reconnects on wait-for-device with adb logcat ... -T 1.

4. Analyze — the three questions

cd ./fp-capture
# (Q1) Did QCRIL actually run the load path this time (vs skip again)?
grep -niE 'load_config|select_config|activate_config|REQUEST_MBN|start_mbn_update|is_ssr_or_bootup' radio-firstprov.txt | head -40

# (Q2) THE unknown: is pdc_enable_auto_selection / enable_modem_update called, and when
#      relative to load? This settles gap-analysis item #8 / open question #2.
grep -niE 'enable_auto_select|auto.?select|enable_modem_update|disable_modem_update|set_feature_version' radio-firstprov.txt

# (Q3) The decision point — what did prev_ver/cur_ver read this time?
grep -niE 'is_modem_mbn_updated|prev_ver_info|cur_ver_info' radio-firstprov.txt

5. Interpreting the outcome (both results are informative)

• QCRIL runs load→select→activate → we finally have the real sequence + ordering + timing, and Q2 tells us if enable_auto_selection is a required precondition. Feeds path A (qcril-prov.py).
• QCRIL still skips (queries modem, finds the active config already present in modem EFS, just rewrites the prop) → strong confirmation of frontier #4 path B: the modem self-persists in modemst and userspace never re-loads in normal operation. That makes the pmOS fix "provision-once + ensure modemst persistence," not a per-boot loader.

6. Restore (only if anything misbehaves)

QCRIL repopulates /data/vendor/modem_config/ and the props automatically on the provision pass, so normally no restore is needed. If you want the exact prior cache back:

adb push ./fp-capture/modem_config.bak.tgz /data/local/tmp/
adb shell 'cd /data/vendor && rm -rf modem_config && tar -xzf /data/local/tmp/modem_config.bak.tgz'
adb reboot

EFS baseline (untouched by this procedure) remains at efs-postandroid/{modemst1,modemst2,fsg,fsc}.img.