bde961c6f2
PAF becomes saf/device (history kept), STATE.md dissolves into saf/state.md with the dated era archived, the substrate SAF moves up from souveraine, and every agreement points at saf/INDEX.md and nowhere else. one map, nothing to remember
108 lines
5 KiB
Markdown
108 lines
5 KiB
Markdown
# First-Provision Capture — force QCRIL to run the real MBN load sequence
|
|
|
|
**Why:** Every Android capture we have (`android-live-20260619/`) was an *already-provisioned*
|
|
device, so QCRIL took the verify-only fast path (`is_modem_mbn_updated: prev_ver == cur_ver` →
|
|
skip). We have **never recorded** the actual load→select→activate sequence, nor whether
|
|
`pdc_enable_auto_selection` / `qcril_qmi_pdc_enable_modem_update` is a required precondition.
|
|
This runbook forces a first-provision and captures it. See `PAF/modem.md` frontier #4.
|
|
|
|
**Run from the host with the phone on Android slot B, rooted (`adb root`).** All commands are
|
|
host-side `adb`; device shell is Android (toybox), not pmOS ash.
|
|
|
|
---
|
|
|
|
## 0. Preconditions + backup (reversible-safety)
|
|
|
|
```sh
|
|
adb root && adb wait-for-device
|
|
adb shell getprop ro.product.device # expect: blueline
|
|
adb shell getprop gsm.version.baseband # expect: g845-00194-...
|
|
|
|
# Back up QCRIL's writable provisioning cache + the trigger props, so we can prove
|
|
# what changed and restore if needed.
|
|
adb shell 'tar -czf /data/local/tmp/modem_config.bak.tgz -C /data/vendor modem_config 2>/dev/null'
|
|
adb pull /data/local/tmp/modem_config.bak.tgz ./fp-capture/
|
|
adb shell 'getprop | grep -E "vendor.radio.(cnv|hw_mbn|sw_mbn|mbn)" ' | tee ./fp-capture/props.before.txt
|
|
```
|
|
|
|
> Note: we deliberately do **NOT** touch the modem's EFS (`modemst1/2`, `fsg`, `fsc`). Those hold
|
|
> the modem's own persisted config + calibration; wiping them is destructive and not needed. We
|
|
> only clear QCRIL's *userspace* cache + the version prop — that is the documented trigger for the
|
|
> `prev_ver != cur_ver` reload branch.
|
|
|
|
## 1. Enlarge the radio log ring so early-boot lines survive until we dump
|
|
|
|
```sh
|
|
adb shell setprop persist.vendor.radio.smlog_switch 1 # verbose radio logging (best-effort)
|
|
adb logcat -b radio -G 64M # 64 MB radio buffer
|
|
adb logcat -b system -G 16M
|
|
```
|
|
|
|
## 2. Force the first-provision trigger, then reboot
|
|
|
|
```sh
|
|
# Clear QCRIL's writable provisioning state (rebuilt automatically on next provision).
|
|
adb shell 'rm -rf /data/vendor/modem_config/*'
|
|
|
|
# Blank the cached version string QCRIL compares against (this is the prev_ver in
|
|
# is_modem_mbn_updated). Empty prev_ver => mismatch => QCRIL must re-evaluate the load path.
|
|
adb shell 'setprop persist.vendor.radio.cnv.ver_info ""'
|
|
adb shell 'setprop persist.vendor.radio.hw_mbn_loaded ""'
|
|
adb shell 'setprop persist.vendor.radio.sw_mbn_loaded ""'
|
|
|
|
adb shell sync
|
|
adb reboot
|
|
```
|
|
|
|
## 3. Capture from as early as possible after boot
|
|
|
|
```sh
|
|
adb wait-for-device
|
|
adb root && adb wait-for-device
|
|
# Dump the whole radio ring immediately — the 64M buffer should still hold the early
|
|
# provision window (~10-40s into boot).
|
|
adb logcat -b radio -d > ./fp-capture/radio-firstprov.txt
|
|
adb logcat -b system -d > ./fp-capture/system-firstprov.txt
|
|
adb shell 'getprop | grep -E "vendor.radio.(cnv|hw_mbn|sw_mbn|mbn)"' | tee ./fp-capture/props.after.txt
|
|
```
|
|
|
|
If the early window was missed (buffer wrapped), repeat from §2 but instead of a plain dump, run
|
|
a **streaming** capture across the reboot: `adb logcat -b radio > radio-firstprov.txt &` then
|
|
`adb reboot`; logcat auto-reconnects on `wait-for-device` with `adb logcat ... -T 1`.
|
|
|
|
## 4. Analyze — the three questions
|
|
|
|
```sh
|
|
cd ./fp-capture
|
|
# (Q1) Did QCRIL actually run the load path this time (vs skip again)?
|
|
grep -niE 'load_config|select_config|activate_config|REQUEST_MBN|start_mbn_update|is_ssr_or_bootup' radio-firstprov.txt | head -40
|
|
|
|
# (Q2) THE unknown: is pdc_enable_auto_selection / enable_modem_update called, and when
|
|
# relative to load? This settles gap-analysis item #8 / open question #2.
|
|
grep -niE 'enable_auto_select|auto.?select|enable_modem_update|disable_modem_update|set_feature_version' radio-firstprov.txt
|
|
|
|
# (Q3) The decision point — what did prev_ver/cur_ver read this time?
|
|
grep -niE 'is_modem_mbn_updated|prev_ver_info|cur_ver_info' radio-firstprov.txt
|
|
```
|
|
|
|
## 5. Interpreting the outcome (both results are informative)
|
|
|
|
- **QCRIL runs load→select→activate** → we finally have the real sequence + ordering + timing, and
|
|
Q2 tells us if `enable_auto_selection` is a required precondition. Feeds path A (`qcril-prov.py`).
|
|
- **QCRIL still skips** (queries modem, finds the active config already present in modem EFS, just
|
|
rewrites the prop) → strong confirmation of **frontier #4 path B**: the modem self-persists in
|
|
`modemst` and userspace never re-loads in normal operation. That makes the pmOS fix
|
|
"provision-once + ensure `modemst` persistence," not a per-boot loader.
|
|
|
|
## 6. Restore (only if anything misbehaves)
|
|
|
|
QCRIL repopulates `/data/vendor/modem_config/` and the props automatically on the provision pass,
|
|
so normally no restore is needed. If you want the exact prior cache back:
|
|
|
|
```sh
|
|
adb push ./fp-capture/modem_config.bak.tgz /data/local/tmp/
|
|
adb shell 'cd /data/vendor && rm -rf modem_config && tar -xzf /data/local/tmp/modem_config.bak.tgz'
|
|
adb reboot
|
|
```
|
|
|
|
EFS baseline (untouched by this procedure) remains at `efs-postandroid/{modemst1,modemst2,fsg,fsc}.img`.
|