Project Aurora: mainline ARM64 Linux on JZ08AU (MSM8916) LTE modem

Sanitized research log, build/reproducibility docs, DTS, kernel configs, patches, initramfs sources, bootchain migration plans and test logs. B5 direct boot PASS; B6 modem lifecycle in progress. No dumps, NV/EFS, vendor firmware or device identifiers included.
2026-09-30 17:23:18 +03:00 · 2026-09-30 17:23:18 +03:00 · 105bef466a
commit 105bef466a
856 changed files with 332686 additions and 0 deletions
--- a/.gitignore
+++ b/.gitignore
@ -0,0 +1,83 @@
 # --- raw device data: never commit ---
 dumps/
 partitions/*.bin
 backup/
 **/backup/
 *.bin
 *.img
 *.pad1M
 *.pad512K
 *.pad16M
 *.mbn
 *.elf
 *.mdt
 *.b[0-9][0-9]
 *.raw
 *.pcap
 *.dtb
 # NV / EFS / per-device partitions (hash lists nv-*.txt are fine)
 *modemst*
 *fsg*.bin
 *fsc*.bin
 *persist*.bin
 *userdata*
 firmware-fat/
 # SIM / identity material
 *.private*
 *imei*
 *iccid*
 *imsi*
 # --- vendor / proprietary blobs (see docs/BLOBS.md) ---
 firehose/*.bin
 bootchain/**/kernel
 bootchain/**/ramdisk
 bootchain/**/ramdisk-root/
 bootchain/aboot-analysis/
 # --- build trees and outputs (rebuild per docs/BUILD.md) ---
 linux/src/
 linux/out/
 lk2nd-build/src/
 lk2nd-build/out/
 lk2nd-build/inspect/
 linux/artifacts/**/Image*
 linux/artifacts/**/*.cpio.gz
 linux/initramfs*/dl/*
 !linux/initramfs*/dl/APK-SHA256SUMS
 linux/initramfs*/root/*
 !linux/initramfs*/root/bin/
 linux/initramfs*/root/bin/udevadm
 !linux/initramfs*/root/etc/
 linux/initramfs*/root/etc/*
 !linux/initramfs*/root/etc/passwd
 !linux/initramfs*/root/etc/group
 linux/initramfs*/busybox
 linux/initramfs*/gen_init_cpio
 linux/initramfs*/*.cpio.gz
 linux/**/*.so
 linux/**/*.apk
 linux/**/*.pp.dts
 *.tar
 *.tgz
 *.tar.gz
 *.gz
 *.apk
 *.o
 *.a
 # --- transient ---
 __pycache__/
 *.pyc
 *.stderr
 *.swp
 *~
 .DS_Store
 mnt/
 tmp/
 *.tmp
 .env
 *.key
 *.pem
 id_rsa*
 id_ed25519*
--- a/MANIFEST.md
+++ b/MANIFEST.md
@ -0,0 +1,40 @@
 # Aurora eMMC manifest (from full-emmc.bin GPT)
 ```
 full image: 3909091328 bytes, 7634944 sectors, sha256 e81e7a7b727aa65883d30992702def3a23d694e0a32a7c6852eebc415c913c7a
 primary: sig=b'EFI PART' cur=1 bak=7634943 first=34 last=7634910 entries@2 n=28 hdrCRC=OK entCRC=OK
 backup: sig=b'EFI PART' cur=7634943 bak=1 first=34 last=7634910 entries@7634911 n=28 hdrCRC=OK entCRC=OK
 primary entries == backup entries: True; backup hdr at last LBA: True
 ```
 | # | name | start LBA | sectors | bytes | attrs | SHA256 | rl vs rf |
 |---|---|---|---|---|---|---|---|
 | 1 | modem | 131072 | 131072 | 67108864 | 0x1000000000000000 | 04ada779f8ab878b048bd8551bb6633eb2810bf45637557f3053bbf3354680b5 | MATCH |
 | 2 | sbl1 | 262144 | 1024 | 524288 | 0x0000000000000000 | 6a661ec947c1d935316f9d8731b5314e7502bde5825ebbfc3d2860d081b4096d | MATCH |
 | 3 | sbl1bak | 263168 | 1024 | 524288 | 0x0000000000000000 | 6a661ec947c1d935316f9d8731b5314e7502bde5825ebbfc3d2860d081b4096d | MATCH |
 | 4 | aboot | 264192 | 2048 | 1048576 | 0x0000000000000000 | fd1af1679f9dd24de2689dc79faf0d2b043c3e95200234bec36da9ed7df1053a | MATCH |
 | 5 | abootbak | 266240 | 2048 | 1048576 | 0x0000000000000000 | ebcd0c9011ac887cdf208c2413c4447c2a7d88f4ced1f3ea4f826162c8f2f30d | MATCH |
 | 6 | rpm | 268288 | 1024 | 524288 | 0x0000000000000000 | 5a9b857ba6c3af1c848c6e57bbaf9cefcedc3629e5536d27e87b336c67a281fd | MATCH |
 | 7 | rpmbak | 269312 | 1024 | 524288 | 0x0000000000000000 | 5a9b857ba6c3af1c848c6e57bbaf9cefcedc3629e5536d27e87b336c67a281fd | MATCH |
 | 8 | tz | 270336 | 1024 | 524288 | 0x0000000000000000 | 4c8c7875501e0718b2afe6597f7159a510462cb4bd9b0e6f25ab142d256ddfb8 | MATCH |
 | 9 | tzbak | 271360 | 1024 | 524288 | 0x0000000000000000 | c6f7db266a14227ca7e7b0343661089298e4c4320a9522e3e695b5e069e6b4af | MATCH |
 | 10 | hyp | 272384 | 1024 | 524288 | 0x0000000000000000 | 340049c116faaab6db6cd5004ec7eb17c3fecd308df8456ede8b40aa3244c506 | MATCH |
 | 11 | hypbak | 273408 | 1024 | 524288 | 0x0000000000000000 | 428d25ebd86d047f33fa9fd2f22aa2d716e6ecf39735ad61bb34409a323f9082 | MATCH |
 | 12 | pad | 274432 | 2048 | 1048576 | 0x0000000000000000 | e3e1c32da673d1feb4a2f11f05e55f12e7d6829ee9a1b1f4062ce1bc7823d25e | MATCH |
 | 13 | modemst1 | 276480 | 3072 | 1572864 | 0x0000000000000000 | 6f45b08a0b752a0f642842b35d7fcb6849bab2977a76c03672b82df4387b3c05 | MATCH |
 | 14 | modemst2 | 279552 | 3072 | 1572864 | 0x0000000000000000 | 79037242b7f34d373637258c13e0c8dd1a1460bfd44a87234dd83b66cd673917 | MATCH |
 | 15 | misc | 282624 | 2048 | 1048576 | 0x0000000000000000 | 959c2320499fc3be3eaf6d38889cc192dccc0ad6c98f0d90511edfd4cc3ff6e8 | MATCH |
 | 16 | fsc | 284672 | 2 | 1024 | 0x0000000000000000 | 5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef | MATCH |
 | 17 | ssd | 284674 | 16 | 8192 | 0x0000000000000000 | 9f1dcbc35c350d6027f98be0f5c8b43b42ca52b7604459c0c42be3aa88913d47 | MATCH |
 | 18 | splash | 284690 | 20480 | 10485760 | 0x0000000000000000 | e5b844cc57f57094ea4585e235f36c78c1cd222262bb89d53c94dcb4d6b3e55d | MATCH |
 | 19 | DDR | 393216 | 64 | 32768 | 0x1000000000000000 | c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479 | MATCH |
 | 20 | fsg | 393280 | 3072 | 1572864 | 0x1000000000000000 | b0a3b7e46bc420f39120cfa7f2049027cba59383d52c78ad9576049ad40982aa | MATCH |
 | 21 | sec | 396352 | 32 | 16384 | 0x1000000000000000 | 3b1cae78981f065f648ee33b048de38004569dacb2ae4a3093404eb1b5586985 | MATCH |
 | 22 | boot | 396384 | 32768 | 16777216 | 0x1000000000000000 | 1342def7e0f0c245385d4bac2852d361537a520abd8a45708618983cdab43c0a | MATCH |
 | 23 | system | 429152 | 1638400 | 838860800 | 0x1000000000000000 | f09ded23689fbf22e656784917b3b0dfdc13a50393f56385f8e8abe15e72199d | MATCH |
 | 24 | persist | 2067552 | 65536 | 33554432 | 0x1000000000000000 | 9923b45bee1637b289bfc686a3c57ab69289bb56da4d2add063bf4481de0808c | MATCH |
 | 25 | cache | 2133088 | 262144 | 134217728 | 0x1000000000000000 | 6a8ab0bd7c0d1d64160d6063c515b0c1e5f172ca26475d9b6cf9287289a63a2c | MATCH |
 | 26 | recovery | 2395232 | 32768 | 16777216 | 0x1000000000000000 | 0be90bc42efb0eae2e5376fef2c2786d68c614f679f6e214102a92b196b3a43d | MATCH |
 | 27 | userdata | 2428000 | 5206911 | 2665938432 | 0x1000000000000000 | 0678d9809d50a2322c50568e1c406687f5992200d97de5c9987542e7e402bdae | MATCH |
 ALL PARTITIONS VERIFIED: True
--- a/NOTES.md
+++ b/NOTES.md
@ -0,0 +1,964 @@
 # Aurora — отчёт сессии 1 (2026-09-29)
 ## 1. Hardware
 - SoC: MSM8916 (Sahara MSM_ID 0x007050e1), 4×Cortex-A53, Android 32-bit.
 - RAM: 512 MB (MemTotal 403480 kB; LK/QCDT выбирает "MSM 8916 512MB MTP", board-id 8/0x100).
 - eMMC: Hynix **H4G2a**, CID `<EMMC_CID>`, PSN 0x<EMMC_SERIAL>,
  3 909 091 328 B = 7 634 944 секторов (у JZ02: 3 875 536 896 B — другая eMMC).
 - PMIC: PM8916 (linear charger + VM-BMS, MPP4 current sink → lcd-bl, vibrator node enabled).
 - Батарея: присутствует, профиль `palladium_1500mah` (стандартный MTP-профиль, вероятно не откалиброван под реальный АКБ).
 - Идентификаторы: fastboot serialno <EMMC_SERIAL> **= eMMC PSN**, не серийник чипа. Sahara chip serial = **0x<SAHARA_SERIAL>**.
 ## 2. Android / kernel
 - Android 4.4.4 KTU84P, `msm8916_32_512-user … eng.richal.20260709 test-keys`, product/model `MIFI`.
 - Kernel: `Linux 3.10.28 (richal@msa2) gcc 4.7 #1 SMP PREEMPT Tue Apr 14 2026`.
 - cmdline (из boot.img): `console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x3F ehci-hcd.park=3 androidboot.bootdevice=7824900.sdhci`
 - Baseband: PM.1.0.c7-00193-M8916EAAAANVZM-1.
 ## 3. Root / adbd
 - `uid=2000(shell)`, ro.secure=1, ro.debuggable=0, su нет. dmesg (klogctl) и /proc/cmdline недоступны. `adb root` не проверялся (user-build → бесполезно).
 - adb serial = `0` (как на JZ02).
 ## 4. Fastboot
 - Минимальный LK: getvar почти пустой. devinfo (последний сектор aboot): `ANDROID-BOOT!`, is_unlocked=0, is_tampered=0, charger_screen_enabled=1 — **как у JZ02**, bootloader, вероятно, locked. abootbak без devinfo.
 ## 5. EDL
 - `adb reboot edl` → 05c6:9008 — работает.
 ## 6. Sahara
 | | Aurora | JZ02 |
 |---|---|---|
 | Sahara ver | 2 (min 1) | 2 |
 | HWID | 0x007050e100000000 (OEM 0, MODEL 0) | тот же |
 | PK_HASH | cc3153a80293939b90d02d3bf8b23e0292e452fef662c74998421adad42a380f | тот же |
 | Serial | 0x<SAHARA_SERIAL> | 0x<JZ02_SAHARA_SERIAL> |
 PK_HASH = публичный тестовый root Qualcomm ⇒ **secure boot не зафьюжен** (PBL принимает любой тест-подписанный программер).
 Инцидент: мой первый probe (`tools/sahara_probe.py`) отправил SAHARA_EXEC GET_SBL_VERSION — PBL его не поддержал, после
 этого modeswitch не вернул HELLO и PBL завис. Плата была восстановлена пользователем (перезагрузка в Android).
 Хранилище не затронуто. Вывод: только стандартный `edl` flow; не слать неподдерживаемые exec-команды.
 ## 7. Firehose
 - Файл: `firehose/007050e100000000_394a2e47cf830150_fhprg_peek.bin`
 - SHA256: `53f193500c03248f0d671ab57bfe9ca8a42967e97f28403294b4b3f854075aca`
 - Источник: bkerler edl Loaders, `qualcomm/factory/msm8916/` (тот же файл, что на JZ02).
 - ELF32, подписан цепочкой QUALCOMM (тестовые ключи), Sahara принял, `TargetName=MSM8916, MemoryName=eMMC, Version=1`.
 - READ: подтверждено (две независимые вычитки совпали). WRITE: не тестировалось. RESET: на JZ02 ненадёжен — после работы отключать питание вручную.
 - Использованы только команды: `printgpt`, `rl`, `rf`.
 ## 8. GPT
 Primary и backup: CRC header/entries OK, 28 слотов, записи идентичны, backup header на последнем LBA (7634943).
 Таблица совпадает с данными Android (/proc/partitions + by-name). Полная таблица: `MANIFEST.md`.
 Неразмеченное: LBA 34..131071 (до modem), 305170..393215 (между splash и DDR) — входит в full-emmc.bin.
 ## 9. Backup
 - `rl` (все разделы) и `rf` (вся eMMC) — две независимые вычитки, 19:24–19:33 MSK.
 - 27/27 разделов bit-identical между rl и rf, размеры = GPT. Хэши: `partitions/SHA256SUMS`, `dumps/full-emmc.sha256`.
 - Две копии: ноутбук + эта папка (sha256 проверены после копирования).
 ## 10. Bootchain (ELF-разбор, `bootchain/elfinfo.txt`)
 | образ | версия | сравнение с JZ02 |
 |---|---|---|
 | sbl1 = sbl1bak | BOOT.BF.3.0.1-00019 (HAAAANAZA) | раздел целиком **идентичен** |
 | rpm = rpmbak | RPM.BF.2.0.1-00027 | ELF-образ идентичен; раздел отличается только мусором после конца образа |
 | tz / tzbak | TZ.BF.2.2-2.2.0026 | ELF-образ идентичен. В хвосте tz — остатки старого TZ.BF.2.5.C6-00025 (не исполняется) |
 | hyp / hypbak | (hyp из TZ.BF.2.2) | ELF-образ идентичен; хвост hyp — остатки TZ.BF.2.5.C6 hyp |
 | aboot = abootbak (кроме devinfo) | LK, сертификат 2026-07-09 | **ДРУГОЙ** (JZ02: 2025-11-03). Добавлены SPI-панели st7735s/nv3023a, "Config SPI PANEL", charger mode |
 | DDR, sec, splash | — | разделы идентичны JZ02 |
 | modem | MPSS.DPM.1.0.C7-00193, WCNSS CNSS.PR.1.4.2.C4-00084 | те же сборки; образ раздела отличается (содержимое FAT не сравнивалось) |
 Вывод: SBL1/RPM/TZ/HYP де-факто те же, что stock JZ02. Отличается только LK (aboot).
 Не выводить отсюда, что DB410c TZ/qhypstub/lk1st от JZ02 подойдут без проверки — это только аналитический факт.
 ## 11. boot / recovery (`bootchain/boot|recovery/info.txt`)
 - Android boot image v0, page 2048, kernel @0x80008000, ramdisk @0x81000000, tags @0x80000100.
 - Ядро: zImage 32-bit, одно и то же в boot и recovery (sha256 8796a9cd…), без appended DTB.
 - DTB: **QCDT v2** (dt_size 0x46800), 8 записей → 2 уникальных DTB, одинаковые в boot и recovery.
  platform_id 0xce/0xf8/0xf9/0xfa, variant 8 (QRD/MTP), subtype 0 (`dtb_00`, "MSM 8916 MTP") и 0x100 (`dtb_01`, "512MB MTP").
 - ramdisk: boot 534088 B, recovery 1071013 B (не распакованы — следующий шаг).
 ## 12. DT / board (`dt/dtb_01.dts` — активный для 512MB)
 - model "Qualcomm Technologies, Inc. MSM 8916 512MB MTP", compatible `qcom,msm8916-mtp`.
 - **Дисплей**: ST7735S "wx144" 128×128, command mode, RGB565 (bpp 16), 20 fps, cont-splash.
  - интерфейс: SPI через MDSS SPI (`qcom,mdss-spi-display`), BLSP1 **QUP4** `spi@78b8000` (BAM), клиент 16 МГц.
  - reset GPIO **118**, D/C GPIO **116** (disp_rst_n / disp_dc в /sys/kernel/debug/gpio).
  - vdd = **L17 2.85 В**, vddio = **L6 1.8 В**.
  - подсветка: PM8916 **MPP4** current sink (`lcd-bl`, 40 мА, manual). В Android также `lcd-backlight` (mdss).
  - альтернативная панель в DT/LK: NV3023A "jz05" 128×128 SPI (второй вариант поставки).
  - fb0: `mdssfb_d0000`, "spi panel", 128×128, virtual 128×256, 32 bpp, stride 512.
  - тачскрина нет.
 - **Кнопки**: PON power (qpnp_pon), `key_f2` GPIO37 (active-high, KEY_F2), `key_f3` GPIO107 (active-low, KEY_F3). Обе wakeup.
 - **SIM mux** (gpio-leds hack): sim1_switch GPIO22, sim2_switch GPIO23, sim3_switch GPIO1 (default on), sim_hotdet GPIO20 — **те же GPIO, что у JZ02**.
 - LEDs: RGB GPIO-LED как у JZ02 (GPIO6/7/8) в DT **нет**.
 - UART: console `serial@78b0000` (BLSP1 UART2, ttyHSL0, 115200).
 - USB: hsusb-otg @78d9000, usb-bam.
 - WCNSS: `qcom,wcnss_wlan@0a000000`, pronto PIL, 5-wire pinmux (GPIO40-44) — как JZ02.
 - Modem: `qcom,pil-q6v56-mss@4080000`, SMD/SMSM, **bam_dmux@4044000**, rmtfs sharedmem-uio.
 - Thermal: tsens sensor0/1/2/4/5, pm8916_tz, bms, battery; msm-thermal.
 - Audio: msm8x16 codec (headset jack detect), cdc-us-euro GPIO113 (JZ02: 120).
 - Камеры CCI camera@0/@1 "ok" — артефакт MTP-DT, физически камер нет (не проверялось).
 - Полный diff против JZ02 stock dtb_01: `dt/diff-jz02-vs-aurora-dtb01.txt`.
 Android runtime: rmt_storage, qmuxd, netmgrd, rild, wcnss_service, hostapd, dnsmasq, thermal-engine, mpdecision.
 wlan0 = AP 192.168.100.1/24; rmnet* + rev_rmnet* (SMD/BAM-DMUX).
 ## 13. JZ02 vs Aurora
 | | JZ02 | Aurora | класс |
 |---|---|---|---|
 | SoC | MSM8916 | MSM8916 | SAME |
 | RAM | не зафиксировано в заметках | 512MB | UNKNOWN |
 | eMMC | 3 875 536 896 B | 3 909 091 328 B, Hynix H4G2a | DIFFERENT |
 | GPT | 27 разделов | те же имена/порядок, другие размеры/смещения под eMMC | DIFFERENT (не переносить GPT) |
 | SBL1 | BOOT.BF.3.0.1-00019 | идентичен | SAME |
 | RPM | RPM.BF.2.0.1-00027 | ELF идентичен | SAME |
 | TZ | TZ.BF.2.2-2.2.0026 | ELF идентичен | SAME |
 | HYP | stock | ELF идентичен | SAME |
 | ABOOT | LK 2025-11 | LK 2026-07, SPI panel | DIFFERENT |
 | MPSS | MPSS.DPM.1.0.C7-00193 | та же версия, но переподписан 2026-04 и бинарно отличается | DIFFERENT (см. S2.7) |
 | PMIC | PM8916 | PM8916 | SAME |
 | WCNSS | CNSS.PR.1.4.2.C4-00084 | тот же, те же пины | LIKELY SAME |
 | Wi-Fi | WCN36x0 via pronto | то же | LIKELY SAME |
 | USB | hsusb-otg | то же | LIKELY SAME |
 | UART | ttyHSL0 @78b0000 | ttyHSL0 @78b0000, GPIO4/5 (DT), пады найдены | LIKELY SAME (у JZ02 pinctrl не сверялся) |
 | SIM mux | GPIO22/23/1/20 | GPIO22/23/1/20 | SAME (по DT) |
 | display | нет (в DT — generic DSI st7796s) | ST7735S SPI 128×128 | DIFFERENT |
 | buttons | vol_up GPIO107, reset GPIO37 | key_f3 GPIO107, key_f2 GPIO37 (+PON) | LIKELY SAME pins, другие коды |
 | LEDs | RGB GPIO6/7/8 | нет RGB; lcd-bl на MPP4 | DIFFERENT |
 | battery | ? | 1500 mAh, VM-BMS | UNKNOWN для JZ02 |
 | charger | ? | qpnp-linear-charger | UNKNOWN для JZ02 |
 | thermal | tsens | tsens + bms/battery | LIKELY SAME |
 | DT | QCDT v2, 2 DTB | QCDT v2, 2 DTB, ~1080 строк diff | DIFFERENT |
 | kernel | 3.10.28 (sha 56214cdd…) | 3.10.28 (sha 8796a9cd…) | DIFFERENT build |
 ## 14. Риски / блокеры
 - Firehose WRITE не проверен; edl reset ненадёжен (опыт JZ02) → после EDL-сессии нужен ручной power-cycle.
 - modemst1/2, fsg, persist — уникальные NV/RF-калибровки; бэкап есть, но писать туда нельзя.
 - Мусор в хвостах rpm/tz/hyp: при любой будущей записи bootchain сравнивать по ELF-образу, а не по хэшу раздела.
 - UART найден (сессия 2). Stock LK: только getvar/download — RAM-boot невозможен без записи (S2.4).
 - Аварийный вход в EDL без Android (кнопки/test point) не найден — сейчас EDL только через `adb reboot edl` или fastboot/LK.
 - Батарея: при экспериментах с ядром без charger/BMS драйвера возможен глубокий разряд.
 ## 15. Следующий безопасный шаг
 > Устарело после сессии 2: п.2 выполнен — `fastboot boot` в stock LK отсутствует (S2.4); п.3 выполнен (S2.5–S2.7); UART найден (S2.1).
 1. Физически: отключить/подключить питание (плата сейчас в firehose-режиме), убедиться, что Android загрузился.
 2. Проверить `fastboot oem device-info` / `fastboot boot <stock boot.img>` (RAM-boot без записи) — понять, разрешает ли LK `fastboot boot`. Это ключ к тестам mainline без flash.
 3. Распаковать ramdisk boot/recovery, собрать init/rc и firmware-список; снять содержимое FAT `modem` (mtools) и сравнить с JZ02.
 4. Найти UART-пады (GPIO4/5) на плате — до начала порта Linux.
 5. Только после этого: план mainline DTS `msm8916-jz08-aurora` (panel-mipi-dbi/ st7735 над SPI QUP4, gpio-keys, pm8916 charger/bms).
 ---
 # Сессия 2 (2026-09-29, 20:00–) — UART, fastboot policy, ramdisk, modem FAT
 Все операции read-only. В eMMC ничего не записано.
 ## S2.1 UART (подтверждён физически)
 - Пады RX/TX найдены пользователем на плате; вывод stock kernel console читается.
  - Расположение TX pad: **не сообщено** (дописать).
  - Расположение RX pad: **не сообщено** (дописать).
  - GND: **не сообщено**.
  - Уровень логики: **не измерялся** (MSM8916 GPIO bank = 1.8 В — ожидаемо, не подтверждено измерением).
 - Адаптер на 480s: CH340 (1a86:7523) → `/dev/ttyUSB0`, 115200 8N1.
 - Логика: BLSP1 UART2, `serial@78b0000` (`qcom,msm-lsuart-v14`, irq 0x6c), ttyHSL0, cmdline `console=ttyHSL0,115200,n8`.
 - pinctrl из Aurora `dt/dtb_01.dts` (`pinctrl-0 = <0xac>` → `pmx-uartconsole/uart-console`):
  - `qcom,pins = <&tlmm 4>, <&tlmm 5>` → **GPIO4, GPIO5**; `qcom,pin-func = 2`;
  - `drive-strength = 2` (мА), `bias-pull-down`;
  - только состояние `default` (active); **sleep-состояния в DT нет**.
  - TX = GPIO4, RX = GPIO5 — по таблице функций TLMM MSM8916 (blsp_uart2), в самом DT направление не указано.
 - Битые символы: встречаются кластерами там, где kernel printk пересекается с выводом из другого контекста (SBL→LK
  переход, параллельные CPU), не равномерно — нет оснований считать baudrate неверным.
 ## S2.2 Cold-boot UART log (`logs/uart/coldboot-20260929-200018.log/.raw`)
 Контекст: плата была выключена и сидела в **off-mode charging** (Android `charger`). Нажатие питания →
 `charger: [241128] rebooting` → `Restarting system` → полный bootchain. PON reason в ядре:
 `Triggered from Hard Reset and 'cold' boot`, power-off reason `PS_HOLD`. LK: `pm8x41_get_is_cold_boot` (текст повреждён).
 - PBL: вывода нет (ожидаемо).
 - **SBL1**: печатает boot-лог (`Format: Log Type - Time(microsec)`), `batt_voltage=3975`, `sbl1_efs_handle_cookies`,
  загрузка TZ/RPM/APPSBL, `QSEE Execution`, `SBL1, End` ≈ 335 мс.
 - **LK**: `Android Bootloader - UART_DM Initialized!!!`, `welcome to lk`, баннера/версии нет.
  - `[210] Panel power on done`, `[210] Config SPI PANEL.` — LK сам инициализирует ST7735S (splash).
  - DTB: `Using DTB entry 206/00000000/0x00000008/256 for device 206/00010000/0x0001…` → выбран **dtb_01** (512MB MTP).
  - cmdline от LK добавляет: `androidboot.emmc=true androidboot.serialno=<EMMC_SERIAL> androidboot.baseband=msm
    mdss_mdp.panel=1:spi:0:qcom,mdss_spi_st7735s_wx144_128x128_cmd`.
  - `booting linux @ 0x80008000, ramdisk @ 0x82000000 (534088), tags/device tree @ 0x81e00000`.
  - Сообщения `Authenticating boot image` в логе **не видно** (участок 400–500 мс частично повреждён) — не доказано ни то, ни другое.
 - **Kernel**: `[0.000000] Linux version 3.10.28 … Apr 14 2026`, ARMv7 (32-bit), model "MSM 8916 512MB MTP".
  `socinfo: id=206 ver=1.0 hw_plat=8 hw_plat_subtype=0 pmic_model=65547 (PM8916 v2.0)`. Memory 420 MB total.
  mdss_spi_panel_init: st7735s, continuous splash. BMS: soc=38, vbatt≈3.92 В.
 - **Модем** (normal boot): ext4 mount ≈8.3 с → `pil-q6v5-mss: modem: loading` 8.81 с → `pil: MBA boot done` 8.87 →
  `modem: Brought out of reset` 9.56 → `Power/Clock ready interrupt` 9.65 → `Subsystem error monitoring … up`.
  **MPSS стартует успешно**; строки `Failed to locate modem.mdt` в этой загрузке нет.
 - WCNSS: `wcnss_wlan probed`, WLAN FW caps ≈21.6 с.
 - Шум, не относящийся к делу: ov5648 camera probe fail (камеры нет), `gcc-mdss Failed to get pixel source` (SPI-панель без DSI),
  `display reset gpio request failed` (18.15 с, GPIO118 уже занят mdss_spi — предположение).
 ## S2.3 fastboot policy (`logs/fastboot/session-20260929-200145.txt`)
 - `adb reboot bootloader` → UART: `Restarting system with command 'bootloader'` → SBL → LK `pm8x41_get_is_cold_boot: Warm boot`
  → `fastboot: processing commands`. USB 18d1:d00d, serial <EMMC_SERIAL>.
 - `fastboot oem device-info` → `FAILED (remote: 'unknown command')`.
 - `fastboot getvar all` → пусто.
 ## S2.4 fastboot boot stock boot.img — **FAIL**
 - Образ: `partitions/boot.bin`, sha256 `1342def7…3c0a` = manifest (Aurora), ≠ JZ02 (`9cc36657…`).
 - `fastboot boot partitions/boot.bin` → `Sending 'boot.img' (16384 KB) OKAY` → `Booting FAILED (remote: 'unknown command')`.
 - UART LK: `[15510] fastboot: download:01000000` → `[16020] fastboot: boot` → unknown command.
 - Причина (статический анализ `partitions/aboot.bin`): в LK зарегистрированы только **`getvar:` и `download:`**.
  Нет `boot`, `flash:`, `erase:`, `continue`, `reboot`, `reboot-bootloader`, любых `oem`/`flashing`.
  **Точно так же урезан LK JZ02** (проверено тем же способом).
 - Следствия:
  - **FASTBOOT RAM BOOT = NOT AVAILABLE** на stock LK.
  - Из fastboot нельзя выйти программно — только отключение питания.
  - eMMC не изменялась (download пишет только в RAM-буфер LK; команд записи в LK нет вообще).
 - Обход записью в aboot НЕ предпринимался (по правилам сессии).
 ## S2.5 modem.mdt — объяснение
 - `init.target.rc`: `on fs` → `mount vfat …/by-name/modem /firmware ro …`;
  `init.qcom.rc`: `on early-boot` → `write /sys/kernel/boot_adsp/boot 1` (+ pil параметры из persist.sys.*, пустые → "cannot expand").
 - В off-mode charging (`androidboot.mode=charger`) init выполняет `on charger` (монтирует только /system, стартует
  healthd/charger/vm_bms), **`on fs` не выполняется → /firmware не смонтирован**. Ядерный PIL-vote при этом пытается
  загрузить modem → `Failed to locate modem.mdt` / `pil_vote_load_worker: Failed to load modem`.
 - Пример пользователя содержит `charger: Enabling backlight` → это была загрузка в charger mode. Вывод: **сообщение
  нормально для зарядного режима, модем исправен** (в normal boot MPSS поднимается, см. S2.2).
 - Последовательность boot ramdisk JZ02 и Aurora идентична: из всех файлов boot ramdisk отличается только `init.rc`
  (у Aurora добавлены chown/chmod для sysfs LED `*_sec`, `*2`, `*2_sec`); init.target.rc/init.qcom.rc/fstab — одинаковые.
 ## S2.6 Ramdisk inventory (`tools/unpack-ramdisk.sh`, результат `bootchain/{boot,recovery}/ramdisk-root`)
 Воспроизведение: `tools/unpack-ramdisk.sh` (gzip → cpio -id --no-absolute-filenames; списки `ramdisk.list`). Оригиналы не менялись.
 - boot (gzip, 51 запись): init, init.rc, init.environ.rc, init.qcom.rc, init.target.rc, init.qcom.usb.rc, init.usb.rc,
  init.trace.rc, init.qti.carrier.rc, init.*.sh (class_main, mdm, class_core, early_boot, factory, qcom, ssr, syspart_fixup, usb),
  fstab.qcom, ueventd.rc, ueventd.qcom.rc, default.prop, sepolicy/*_contexts, charger, res/ (charger images), sbin/.
  - fstab.qcom: system ro, userdata (encryptable=footer), vold sdcard1 (7864900.sdhci), uicc0/1 на `78b7000.spi` (не используется), usbotg, zram 192 MiB.
  - cache/persist/firmware монтируются вручную в `on fs` (init.target.rc).
  - modem stack: rmt_storage, qmuxd, netmgrd, ril-daemon1/2 (`rild -c 1/2`), wcnss-service, wcnss_filter.
  - charger: `on charger` → healthd-charger, `/charger`, vm_bms; qbcharger по property.
  - default.prop: ro.secure=1, ro.debuggable=0, persist.sys.usb.config=none.
 - recovery (gzip, 73 записи): минимальный AOSP recovery (sbin/recovery, adbd, healthd, ueventd, watchdogd), etc/recovery.fstab
  (system/cache/userdata/boot/recovery/misc). default.prop: ro.secure=1, usb.config=diag,serial_smd,rmnet_bam,adb → **root в recovery нет**.
 - Сам recovery-ramdisk не содержит init.qcom.rc/init.target.rc → модем в recovery не стартует.
 ## S2.7 Modem FAT (раздел `modem`), пофайлово vs JZ02 (`firmware-fat-compare.tsv`, распаковано в `firmware-fat/`)
 Извлечено read-only `7z x partitions/modem.bin`. 53 файла у обеих плат, набор имён одинаковый.
 | группа | результат |
 |---|---|
 | wcnss.mdt, wcnss.b00-b11 | **SAME** |
 | cmnlib.*, keymaste.*, playread.*, widevine.* | **SAME** |
 | modem.b03, b04, b19 | SAME |
 | modem.mdt, b00-b02, b05-b07, b10, b12, b13, b15-b18, b20, b21, b24-b27 | **DIFFERENT** |
 | mba.mbn | **DIFFERENT** |
 - Базовая сборка та же (`M8916EAAAANVZM-1_20150909_103440`, MPSS.DPM.1.0.C7-00193), но Aurora-модем/MBA **переподписаны
  2026-04-30** (cert 260430…Z), JZ02 — 2023-06-28. Отличаются кодовые сегменты (b05, b18, b20, b26…) → бинарно модифицированная прошивка,
  не просто другая подпись. **MPSS между платами НЕ взаимозаменяем** без отдельного анализа.
 ## S2.8 Безопасный путь RAM-boot — статус
 Stock LK (Aurora и JZ02) не умеет `fastboot boot`. Без записи в eMMC загрузить собственное ядро **невозможно**
 (EDL/firehose грузит только программер, не ядро). Любой путь требует **минимум одной записи**, которую пользователь должен одобрить явно.
 Вариант, который предлагаю к обсуждению (НЕ выполнен):
 - **lk2nd в раздел `recovery`** через firehose `program` (первая запись firehose — WRITE ещё не тестировался).
  - recovery — некритичный раздел, есть проверенный бэкап; boot/aboot/bootchain/NV не трогаются, обычная загрузка Android не меняется.
  - Вход: `adb reboot recovery` → stock LK грузит recovery → lk2nd → полноценный fastboot (`fastboot boot` → RAM boot).
  - Откат: EDL `program recovery partitions/recovery.bin` (или LK сам свалится в normal boot/fastboot при невалидном образе).
  - Открытые вопросы до записи: (1) проверяет ли stock LK подпись recovery (строки `Authenticating boot image` в LK есть,
    факт применения не доказан; чип unfused); (2) нужна ли поддержка QCDT/board-id для lk2nd на этой плате;
    (3) firehose WRITE сначала проверить на безопасной цели.
 - Альтернативы хуже: замена aboot (риск bootchain), замена boot (ломает stock Android).
 ## S2.9 Первый минимальный Linux RAM-boot (дизайн, не начат)
 - Цепочка: stock SBL1/TZ/HYP/LK → recovery=lk2nd → `fastboot boot` образа (Image.gz + DTB + initramfs), всё в RAM.
 - Ядро: mainline arm64 ≥ 6.6 (msm8916 поддержан upstream), defconfig + msm8916 фрагмент; **без** rmtfs/modem/wcnss на первом шаге.
 - DTB `msm8916-jz08-aurora.dts` (минимум): `#include "msm8916-pm8916.dtsi"`, memory от lk2nd,
  `&blsp_uart2 { status="okay"; }` (GPIO4/5, console ttyMSM0), `&sdhc_1` можно **disabled** на 1-м шаге (или только чтение),
  `&usb` peripheral (опционально), gpio-keys GPIO37 (active-high) / GPIO107 (active-low), `&pm8916_pwrkey`.
 - initramfs: static busybox, `/init` печатает в ttyMSM0: uname, /proc/cpuinfo, meminfo, interrupts, dmesg, gpio-keys events;
  никаких mount блочных устройств, никакого mkfs, никаких записей.
 - Критерии PASS: kernel стартует, UART, DT выбран (model), RAM ≈ 512 MB (минус reserved), таймер/GIC (interrupts растут),
  gpio-keys реагируют, USB (опц.), eMMC не тронута (sha256 boot/recovery/… до и после через EDL — по желанию).
 - Потом: sdhc_1 ro → rmtfs/modem (Aurora-собственный MPSS!) → wcnss → ST7735S (`panel-mipi-dbi`/`fb_st7735r` на `&blsp_spi4`,
  reset GPIO118, dc GPIO116, L17/L6, backlight PM8916 MPP4) → charger/BMS.
 ---
 # Сессия 3 — read-only preflight для lk2nd-в-recovery (2026-09-29 20:11–)
 UART: `logs/uart/preflight-recovery-20260929-201150.{log,raw}`. В eMMC ничего не записано нами
 (оговорка: stock recovery сам монтирует /cache ext4 rw — штатное поведение заводского recovery).
 ## P1 Эталонный recovery
 `partitions/recovery.bin`: 16 777 216 B = 32768 секторов с LBA 2395232 (= GPT), sha256
 `0be90bc42efb0eae2e5376fef2c2786d68c614f679f6e214102a92b196b3a43d` = MANIFEST = SHA256SUMS = срез full-emmc.bin.
 ## P2 Normal boot после полного обесточивания
 OK: LK → DTB 206/…/0x8/256 (dtb_01) → kernel → modem `Brought out of reset` 9.7 с → `sys.boot_completed=1`, adb есть.
 ## P3 `adb reboot recovery` → stock recovery
 - kernel: `Restarting system with command 'recovery'` → SBL1 → LK `pm8x41_get_is_cold_boot: Warm…`, `pon_reason is 17 cold_boot:0`.
 - LK выбрал тот же DTB (206/00000000/0x8/256) и загрузил **recovery**: `booting linux @ 0x80008000, ramdisk @ 0x82000000 (1071013),
  tags/device tree @ 0x81e00000` (1071013 = размер ramdisk recovery.img; у boot 534088).
 - cmdline recovery = cmdline normal + ` gpt` (LK добавляет в recovery-пути); `androidboot.mode` не передаётся.
 - recovery kernel/init стартуют, /cache монтируется; USB не энумерируется (adbd в stock recovery не поднимается), UI ждёт клавиш —
  **за 5 мин сам не перезагрузился**. Выход — физически (кнопка/обесточивание).
 ## P4 Аутентификация образов — что доказано
 - UART: строк `Authenticating boot image`, `signature`, `Image Invalid`, `Recovery command`, `boot-recovery` **не наблюдалось**
  ни в normal, ни в recovery-пути. НО окно LK ~400–500 мс (где печатается выбор DTB и, возможно, загрузка/проверка образа)
  **систематически повреждено** в обоих логах (потеря байт, не baudrate) → отсутствие строки само по себе не доказательство.
 - Косвенное (сильное): **ни boot, ни recovery не несут подписи** по смещению, где её ищет Qualcomm LK
  (`imagesize_actual` = page + kernel + ramdisk + dt, всё page-aligned):
  - boot @0x6ee800: сплошные высокоэнтропийные остатки (>4 KiB, энтропия ~7.1 бит/байт на всех 256-байтных блоках) — не 256-байтная подпись;
  - recovery @0x771800: остатки старого DTB (строки `primary`, `SPK_RX_BIAS`, `Handset Mic`…) — подписи нет точно.
  - Тем не менее LK загрузил и запустил оба образа.
 - `androidboot.authorized_kernel=true` (LK добавляет при успешной аутентификации, строка есть в aboot) **отсутствует**
  в cmdline normal, recovery и charger загрузок.
 - Вывод: на Aurora stock LK **не требует валидной подписи** ни для boot, ни для recovery (либо проверка не выполняется, либо
  её результат не блокирует загрузку). Devinfo `is_unlocked=0` на это не влияет — locked-устройство грузит неподписанный recovery.
 - Не доказано: выполняется ли вычисление/проверка вообще (нужен неповреждённый UART в окне 400–500 мс или разбор кода).
 ## P5 Возврат в Android и EDL
 - Выход из stock recovery — вручную пользователем (перезагрузка); Android загрузился, `sys.boot_completed=1`, adb OK.
 - `adb reboot edl` → **05c6:9008** за <25 с (20:20:26). Sahara не трогали; выход из EDL — только обесточивание.
 ## P6 Итог preflight
 | пункт | результат |
 |---|---|
 | normal boot | OK |
 | stock recovery (`adb reboot recovery`) | OK (грузится, но зависает в UI без USB; выход — руками) |
 | auth path в UART | NOT OBSERVED (окно LK 400–500 мс повреждено) |
 | signature verification | де-факто не применяется: оба stock-образа без подписи грузятся |
 | EDL | OK |
 Оценка риска lk2nd-в-recovery: НИЗКИЙ для bootchain/NV (пишется только recovery; boot/aboot/NV не трогаются;
 normal boot не зависит от recovery; откат — EDL `program` оригинала, путь в EDL через adb из normal Android подтверждён).
 Остаточные риски: (1) первая firehose WRITE на Aurora; (2) lk2nd может не стартовать/зависнуть — выход только обесточиванием,
 плата после этого грузит normal Android (recovery грузится лишь по команде 'recovery' / misc BCB); (3) если misc получит
 `boot-recovery` (штатно пишет только recovery/Android), LK будет циклически грузить recovery → выход через EDL.
 ---
 # Сессия 4 — подготовка lk2nd для recovery (preflight 4–5). ЗАПИСЬ НЕ ВЫПОЛНЯЛАСЬ.
 Плата в EDL 05c6:9008, в Sahara/Firehose ничего не отправлялось.
 ## Сборка (`lk2nd-build/BUILD.md`)
 lk2nd **23.1** (`e9c8b217…`), цель `lk2nd-msm8916`, QCDT только `msm8916-512mb-mtp.dtb`, `LK2ND_FORCE_FASTBOOT=1`.
 Проверено по исходникам 23.1 (не по памяти):
 - `ABOOT_STANDALONE ?= 1` (lk2nd/project/base.mk) → `read_device_info`/`write_device_info` не вызываются (aboot.c:5515),
  `emmc_recovery_init` (единственный путь записи в misc при старте) пропущен (aboot.c:5662), `check_format_bit` пропущен.
 - В модулях `lk2nd/` нет ни одного `mmc_write`/`partition_write`/`mmc_erase`. Запись в eMMC возможна только по явной fastboot-команде.
 - `LK2ND_FORCE_FASTBOOT=1` → всегда меню fastboot, никакой автозагрузки boot+512k/extlinux.
 - UART: `target/msm8916/init.c:98 uart_dm_init(2, 0, BLSP1_UART1_BASE=0x78B0000)`; `platform/msm8916/gpio.c`: GPIO4 out / GPIO5 in, func 2
  → та же консоль, что stock (serial@78b0000, 115200).
 - Самоперемещение: `arch/arm/crt0.S:110–128` — копирует себя с адреса загрузки (0x80008000) на линк-адрес 0x8F600000.
 ## Образ
 | поле | lk2nd (`recovery-lk2nd-16MiB.img`) | stock recovery | комментарий |
 |---|---|---|---|
 | magic | ANDROID! | ANDROID! | = |
 | page_size | 2048 | 2048 | = |
 | kernel_addr | 0x80008000 | 0x80008000 | = |
 | ramdisk_addr | 0x81000000 | 0x81000000 | = (stock LK всё равно кладёт на 0x82000000 — видно в UART) |
 | tags_addr | 0x80000100 | 0x80000100 | = (LK кладёт DT на 0x81e00000) |
 | second | 0 | 0 | = |
 | kernel_size | 0x44de0 (lk.bin, 282080 B) | 0x624c90 (zImage) | lk2nd = «ядро» для stock LK |
 | ramdisk_size | 1 | 0x1057a5 | lk2nd кладёт 1-байтовый ramdisk-заглушку |
 | dt_size | 0x1000, QCDT v2, 1 запись | 0x46800, QCDT v2, 8 записей | см. ниже |
 | QCDT entry | 0xce / 0x8 / 0x100 / 0x0 | entry1 = 0xce / 0x8 / 0x100 / 0x0 | **идентична записи, которую stock LK выбирает на Aurora** (UART `206/00000000/0x00000008/256`) |
 | DTB | msm-id <206 0>, board-id <8 0x100> | то же | |
 | cmdline | `lk2nd` | console=ttyHSL0… | stock LK дописывает свои androidboot.* как для stock |
 | image_end | 0x47000 (+16 B `SEANDROIDENFORCE`) | 0x771800 | 290832 B ≪ 16 MiB |
 Файл для записи = lk2nd.img + нули до 16 777 216 B (весь раздел детерминирован → побайтная сверка readback).
 Узлы устройств lk2nd в этом DTB не совпадут с cmdline Aurora (`st7735s_wx144_128x128` ≠ `st7735s_128128`) → generic, без чужих GPIO.
 ## Сессия 4b — ЗАПИСЬ lk2nd в recovery (одобрено пользователем: только шаги 0→A→B→C)
 Логи: `logs/lk2nd-write/00-printgpt.log, 01-write.log, 02-readback.log`.
 - 0 printgpt (20:30): Sahara serial 0x<SAHARA_SERIAL> (Aurora), loader 53f19350… принят; `recovery: Offset 0x4918c000 (= LBA 2395232), Length 0x1000000`. OK.
 - A write (20:30:47–20:30:53): `edl w recovery lk2nd/recovery-lk2nd-16MiB.img` → `Wrote … to sector 2395232.` rc=0.
 - B readback: `edl r recovery …/recovery-after-lk2nd-write.bin` → `Dumped sector 2395232 with sector count 32768`. rc=0.
 - C: оба sha256 = `0dfa60a03a742ab2bf9f6e91e3887142cb7a0af2dd37c6373f7942703cd011e1`, размер 16777216, `cmp` без различий → **READBACK_MATCH**.
 - Сообщения Firehose (те же, что при чтении на JZ02/Aurora, безвредные): `Host's payload to target size is too large`,
  `logbuf@0x0801D0A0 fh@0x08019F08`, `Sector size in XML 4096 does not match disk sector size 512`.
 - **Firehose WRITE на Aurora: подтверждён** (один раздел, побайтная сверка).
 - Больше ничего не выполнялось: ни reset, ни reboot, ни misc, ни другие разделы. Плата осталась в EDL (firehose загружен).
 ## Адрес ramdisk 0x82000000 vs 0x81000000 в заголовке
 - Заголовки stock boot и stock recovery: ramdisk 0x81000000, tags 0x80000100. UART stock LK для обоих: ramdisk @0x82000000,
  tags/DT @0x81e00000, kernel @0x80008000 → LK **игнорирует адреса из заголовка** и подставляет свои фиксированные.
 - Это механизм CAF LK `ABOOT_IGNORE_BOOT_HEADER_ADDRS` → `update_ker_tags_rdisk_addr()` (app/aboot/aboot.c:397–406, в lk2nd-исходниках):
  `hdr->ramdisk_addr = ABOOT_FORCE_RAMDISK_ADDR; hdr->tags_addr = ABOOT_FORCE_TAGS_ADDR`. Смещения +0x02000000 / +0x01e00000
  от базы 0x80000000 те же, что у msm8226/msm8974 в project/*.mk. Значения для msm8916 в stock-бинарнике не извлекались
  — вывод по поведению (UART), а не по коду aboot Aurora.
 - Вывод: runtime-переопределение со стороны LK; к lk2nd-образу применяется так же (одинаковый header layout). Не блокер.
 ## Сессия 5 — первый boot-test lk2nd (20:33–20:36) — PASS
 UART: `logs/uart/preflight-recovery-20260929-201150.log` (до 20:33:43: charger-boot + начало normal boot) и
 `logs/uart/lk2nd-boottest-20260929-203353.log` (дальше). Разрыв ~10 с (перезапуск логгера) пришёлся на kernel 0.6–12.9 с normal boot.
 fastboot: `logs/lk2nd-write/boottest-fastboot.txt`.
 - После обесточивания плата сначала поднялась в **charger mode** (20:33:24, `charger` в логе, `Failed to locate modem.mdt` — ожидаемо),
  затем перезапуск в normal Android (20:33:39).
 - Normal Android: PASS — adb OK, `sys.boot_completed=1`, `subsys modem ONLINE`, `wcnss ONLINE`, rmt_storage/qmuxd/netmgrd/ril-daemon/wcnss-service running
  (SIM ABSENT — SIM не вставлена).
 - `adb reboot recovery` (20:34:55): kernel `Restarting system with command 'recovery'` → SBL1 → stock LK
  `pon_reason is 145 cold_boot:0`, DTB `206/00000000/0x00000008/256` (запись из lk2nd QCDT),
  `cmdline: lk2nd androidboot.emmc=true androidboot.serialno=<EMMC_SERIAL> gpt androidboot.baseband=msm mdss_mdp.panel=1:spi:0:qcom,mdss_spi_st7735s_wx144_128x128_cmd`,
  `booting linux @ 0x80008000, ramdisk @ 0x82000000 (1), tags/device tree @ 0x81e00000` → **stock LK принял lk2nd**.
 - lk2nd (через ~0.2 с): `Android Bootloader - UART_DM Initialized!!!`, `welcome to lk`, `MMC card: H4G2a … 3909091328 bytes`,
  `Command line from previous bootloader: lk2nd …`, `Failed to find matching lk2nd device node: -1` (ожидаемо: generic),
  `No continuous splash: MDP GDSC is not enabled` (дисплей не нужен), `Fastboot mode was forced with compile-time…`,
  `USB init`, `udc_start()`, `fastboot: processing commands` (~0.57 с от старта lk2nd).
 - USB: 18d1:d00d, iManufacturer Google, iProduct Android, iSerial <EMMC_SERIAL> (тот же VID:PID, что stock LK fastboot — различать по getvar product).
 - fastboot: `devices` → <EMMC_SERIAL>; `getvar version` → 0.5; `getvar product` → **lk2nd-msm8916**; `getvar all`: lk2nd:version 23.1,
  variant MTP eMMC, unlocked yes, secure no, max-download-size 0x10000000 (256 MiB), hw-revision 10000,
  lk2nd:panel qcom,mdss_spi_st7735s_wx144_128x128_cmd, wifimac <MAC>, полная таблица разделов = GPT.
 - Стабильность: >60 с в fastboot, USB на месте, в UART только `STALL GET_DESCRIPTOR` (хост опрашивает BOS/qualifier — безвредно).
 ### ВАЖНО: lk2nd считает, что живёт в `boot`, а не в `recovery`
 Сборка по умолчанию `LK2ND_PARTITION_BASE ?= boot` (lk2nd/project/lk2nd.mk:16): getvar показывает виртуальный раздел
 `lk2nd` = первые 512 KiB **boot** и `boot` = 0xf80000 (со смещением 512 KiB). Для Aurora это неверно (lk2nd в recovery).
 Последствия при будущих командах записи через lk2nd:
 - `fastboot flash lk2nd …` перезапишет **начало stock boot** (ядро Android) — ЗАПРЕЩЕНО;
 - `fastboot flash boot …` запишет в boot со смещением 512 KiB — ломает stock boot — ЗАПРЕЩЕНО.
 - `fastboot boot`, `getvar`, `download` — не затрагиваются.
 Если когда-нибудь понадобятся записи через lk2nd — сначала пересобрать с `LK2ND_PARTITION_BASE=recovery` (отдельное решение, новая запись recovery).
 ---
 # Сессия 6 — первый Linux RAM boot через lk2nd (2026-09-29 22:00) — FAIL до передачи управления ядру
 Записей в eMMC: нет. lk2nd/recovery не менялись.
 ## Что собрано (всё в `linux/`)
 - Ядро: Linux **7.2.7** stable (`f42acb3678424d1e08f6ed27c0d8ba8a125e14d6`, git.kernel.org stable, тот же коммит, что база JZ02),
  чистый `git archive` (без правок JZ02) → `linux/src`; сборка на локальном диске `/home/q/aurora-kbuild` (virtiofs даёт clock skew).
 - Config: arm64 `defconfig` + `linux/aurora-ramboot1-v2.config` (только ARCH_QCOM, без драйверов чужих SoC, без btrfs/xfs/nfs/netfilter/ftrace,
  MODULES=n) → `artifacts/ramboot1/kernel.config`. Первая сборка (defconfig почти целиком) дала image_size 33.6 MiB — отброшена:
  lk2nd кладёт ARM64-ядро на 0x80000000, DTB на 0x81E00000, ramdisk на 0x82000000 (platform/msm8916 iomap.h ABOOT_FORCE_*),
  т.е. image_size обязан быть < 30 MiB. v2: image_size **22.31 MiB** (конец 0x81650000).
 - DTS `linux/dts/msm8916-jz08-aurora.dts` (+`build-dtb.sh`, out-of-tree cpp+dtc): `#include "msm8916.dtsi"`, model "JZ08AU Aurora (RAM boot 1)",
  serial0=&blsp_uart2 (serial@78b0000, pinctrl blsp_uart2_console_default GPIO4/5), stdout-path serial0:115200n8;
  явно disabled: sdhc_1 (eMMC), sdhc_2, usb, mpss, bam_dmux, bam_dmux_dma, wcnss. Проверено fdtget.
 - initramfs: Debian trixie `busybox-static 1:1.37.0-6+b9 arm64` (deb sha256 c833be48… = Packages index), `gen_init_cpio`
  (/dev/console, /dev/null), `/init` — proc/sys/devtmpfs, диагностика, бесконечный цикл shell. Без блочных устройств/сети/firmware.
 - Образ: Android boot v0, kernel = Image.gz + appended DTB (lk2nd: «Only one appended non-skales DTB, select it»),
  ramdisk = initramfs.cpio.gz, page 2048, cmdline `earlycon console=ttyMSM0,115200n8 ignore_loglevel loglevel=8 rdinit=/init`
  (ttyMSM / msm_serial_dm — из drivers/tty/serial/msm_serial.c).
  `artifacts/ramboot1/aurora-ramboot1.img` 9549824 B, sha256 `470ce4f82864600c5bed7e1791a38e84a802dc2cac7d43d15439f593b9e15347` (все хэши — SHA256SUMS).
 ## Результат (`logs/uart/ramboot1-20260929-215954.log`, `logs/uart/ramboot1-fastboot.txt`)
 - fastboot: `Sending 'boot.img' (9326 KB) OKAY`, `Booting OKAY`.
 - lk2nd: `decompressing kernel image: done` → `qcom,msm-id entry not found` → `Only one appended non-skales DTB, select it` →
  `kaslr-Seed is added` → **`Cannot boot ARM64 with old SCM calling convention`** → `booting linux @ 0x80000000, ramdisk @ 0x82000000 (1016607),
  tags/device tree @ 0x81e00000` → `Jumping to kernel via monitor` → `Failed to jump to kernel` → `ASSERT FAILED at (platform/msm_shared/scm.c:1085)`
  → каскад data abort (alignment fault) внутри lk2nd → ~18 с → сброс SoC → SBL1 → stock LK (Warm) → normal Android (22:00:24), adb/diag 05c6:9091.
 - **Linux не получил управление ни на одну инструкцию** (нет ни earlycon, ни `Booting Linux on physical CPU` от 7.2.7).
 ## Причина (доказано по исходникам lk2nd 23.1)
 - `lk2nd/smp/spin-table/spin-table.c:54`: если `!is_scm_armv8_support()` и ядро ARM64 → «Cannot boot ARM64 with old SCM calling convention».
 - `platform/msm_shared/scm.c` (~1060–1085): переход 32→64 делается SCM-вызовом `SCM_SVC_MILESTONE_32_64`; со старым (ARMv7) SCM TZ
  вызов возвращается → `ASSERT(0)`.
 - Stock TZ Aurora = TZ.BF.2.2-2.2.0026 (ELF идентичен JZ02 stock): только legacy SCM, без ARMv8 SMC/PSCI → **ARM64 невозможен на stock TZ/HYP**.
 - Это не ошибка DTS/ядра/образа/адресов. Аналогично JZ02/UZ801: там ARM64 стал возможен только после замены hyp (qhypstub) и aboot (lk1st)
  [и/или TZ от DB410c] — т.е. записей в bootchain.
 ## Варианты (решение за пользователем)
 A. **ARM32 mainline** (без записей): тот же DTS, ядро `ARCH=arm` (multi_v7 + ARCH_QCOM/msm8916). lk2nd содержит A32 spin-table
   (`spin_code_a32`) именно для SMP на старом TZ. Минусы: 32-bit userspace (Alpine armv7), расхождение с JZ02 (arm64).
 B. **Замена hyp → qhypstub** (+ возможно TZ → DB410c, + aboot → lk1st) через EDL — даёт ARM64 и PSCI, как у JZ02/UZ801.
   Это записи в bootchain (hyp/tz/aboot): высокий риск; откат только через EDL; отдельный preflight.
 ---
 # Сессия 7 — preflight миграции bootchain на ARM64 (2026-09-30). НИЧЕГО НЕ ЗАПИСАНО.
 Документы: `bootchain-migration/PREFLIGHT.md` (анализ, варианты, неопределённости), `bootchain-migration/WRITE-PLAN.md` (S0–S4, команды, откаты),
 артефакты + эталоны отката + SHA256SUMS в `bootchain-migration/`.
 Ключевое: одного qhypstub недостаточно (JZ02 S3); нужна пара DB410c TZ.BF.3.0 + qhypstub + правка GPT (TZ 605312 B > 512 KiB) + lk1st.
 Рекомендовано: вариант D (цепочка JZ02, по одной стадии). БЛОКЕР: аппаратный вход в EDL на Aurora не доказан (кандидат — кнопка KEY_F2 = GPIO37,
 тот же пин, что RESET/EDL у JZ02).
 Новый артефакт: lk1st-aurora (lk2nd 23.1 e9c8b217, `lk1st-msm8916 LK2ND_BUNDLE_DTB=msm8916-512mb-mtp.dtb LK2ND_FORCE_FASTBOOT=1`,
 qtestsign 0eef3b5 -v 3 aboot) → aboot-lk1st-aurora.mbn 327244 B (003c484e…), pad1M e4addbf8….
 Aurora GPT candidate: той же правкой (13 байт, записи tz/tzbak), валидатор OK: primary 6e850a5d…, backup 795952a1….
 ## Сессия 7b — S0: аппаратный вход в EDL (2026-09-29 22:22–22:50). Записей нет, Sahara не трогали.
 - Кнопки (`logs/s0/getevent-keys.txt`): 1 верхняя = KEY_POWER (qpnp_pon/KPDPWR); 2 у USB = KEY_POWER (qpnp_pon); 3 RESET = KEY_F1 (qpnp_pon/**RESIN**).
  gpio-keys (KEY_F2/GPIO37, KEY_F3/GPIO107) — ни одна физическая кнопка (отличие от JZ02, где RESET = GPIO37).
 - Плата без аккумулятора не стартует от USB (со слов пользователя).
 - Попытки «зажат RESET + подача питания»: **3/3 → 05c6:9008** (устр. 114, 115, 116). UART (`logs/uart/s0-edl-attempt2-20260929-224606.*`):
  EDL-загрузка = `SBL1, Start … pm_driver_init (batt_voltage=…) … clock_init, Delta` → тишина → 9008. Ни `Image Load`, ни QSEE, ни LK —
  **в EDL уводит stock SBL1 до загрузки TZ/RPM/HYP/ABOOT**.
 - НО: в попытках 2 и 3 перед EDL-загрузкой была обычная загрузка (SBL1 → LK → ядро 3.10), и EDL наступил только после
  следующего сброса (~10 с). Источник этого сброса не установлен: stock DT настраивает reset только для POWER (pon_1 s1 10.256 с + s2 2 с, warm),
  для RESIN (pon_2) reset не настроен. Попытка 2 — сброс вручную пользователем.
 - Вывод: воспроизводимо 3/3, механизм входа (SBL1) не зависит от tz/hyp/aboot, но не доказано, что без работающего ядра Android
  (т.е. при зависшем aboot/tz) произойдёт тот сброс, после которого SBL1 уходит в EDL. Нужен тест-симуляция без записи.
 ## Сессия 7c — S0 simulation (2026-09-29 22:54 – 00:06) — **S0 FAIL**. Записей нет. UART: `logs/uart/s0-testA-20260929-225444.*`
 - Test A #1 (lk2nd fastboot 22:56:57, RESET ~30 с): в 22:57:31 SBL1 → LK → Android (charger mode). EDL нет. Источник сброса не установлен.
 - Test A #2 (lk2nd fastboot 00:01:29, RESET 60 с непрерывно): **сброса нет**, плата осталась в lk2nd → у RESIN нет аппаратного сброса
  (согласуется со stock DT: reset настроен только для POWER/pon_1).
 - Test C (полное обесточивание, RESET зажат ДО подачи питания, держался ~10 с после): первый SBL1 прошёл полностью
  (Image Load ×3, QSEE, SBL1 End) → stock LK → Linux 3.10. **EDL нет**.
 - Вывод: зажатый RESET при старте SBL1 **не** переводит в EDL. Все 3 успешных входа в 9008 (попытки 1–3) случились только
  после загрузки stock Android и последующего сброса → вероятно, SBL1 уходил в download mode по признаку, выставленному stock-ядром
  (гипотеза, не доказано). Путь зависит от Android → **не является независимым аппаратным recovery path**.
 - Ранее сделанный вывод «SBL1 видит зажатый RESET → EDL» (сессия 7b) — **ОТОЗВАН**.
 - Bootloader writes: NO-GO. Нужен настоящий аппаратный EDL (PBL): кандидат — GPIO37 (KEY_F2 в stock DT, кнопка отсутствует;
  на JZ02 и UFI-001x GPIO37 = EDL-кнопка) → поиск площадки/посадочного места по фото платы, без замыканий наугад.
 ## Сессия 7d — S0 PASS: аппаратный EDL через USB D+ → GND (2026-09-30 00:14–00:16). Записей нет, Sahara не трогали.
 Метод (найден пользователем): аккумулятор подключён → замкнуть USB D+ на GND → подключить USB-C → отпустить → 05c6:9008.
 Выход: обесточивание.
 | # | время | USB | UART |
 |---|---|---|---|
 | 1 | 00:14:05 | 9008 (dev 127) | холодный старт: SBL1, Start → pm_driver_init (batt 4180) → clock_init, Delta → тишина |
 | 2 | 00:15:25 | 9008 (dev 002) | то же |
 | 3 | 00:15:51 | 9008 (dev 006) | то же |
 **3/3.** Без предварительной загрузки Android/LK (единственный SBL1-старт на попытку). Вход выполняет stock **SBL1** (не PBL: SBL1 печатает),
 до загрузки TZ/RPM/HYP/ABOOT (нет Image Load/QSEE). SBL1 в плане миграции не меняется, запись `sbl1` в GPT не меняется →
 путь не зависит от tz/hyp/aboot/Android/ADB. Если PBL не найдёт SBL1 (порча GPT) — PBL уходит в EDL сам (штатное поведение).
 Попытки 1–3 сессии 7b и выводы 7b/7c про RESET — недостоверны (со слов пользователя, часть попыток была загрузкой Android в режим зарядки).
 ---
 # Сессия 8 — S1: aboot ← lk1st-aurora (2026-09-30 00:18–00:22) — **PASS**
 Логи: `logs/bootchain/S1-*`, UART `logs/uart/S1-lk1st-boot-20260930-001922.*`.
 - Pre: вход в EDL через D+→GND; printgpt: Sahara serial 0x<SAHARA_SERIAL>, aboot Offset 0x8100000 (LBA 264192), Length 0x100000; GPT stock (tz 0x80000).
  sha256: lk1st pad1M e4addbf8…6482, orig-aboot fd1af167…053a (= manifest; копии на 480s и локально), firehose 53f19350….
 - Write: `edl w aboot bootchain-migration/aboot-lk1st-aurora.pad1M` → `Wrote … to sector 264192` (00:18:26).
  Readback `edl r aboot` → sha256 e4addbf8…6482, cmp OK → **READBACK_MATCH**. Контроль: abootbak, GPT primary/backup — без изменений.
 - Boot (00:20:25, обычное включение): SBL1 (Image Load ×3, `APPSBL Image Loaded`, QSEE, SBL1 End) → `welcome to lk` →
  `MMC card: H4G2a … 3909091328 bytes` → `Fastboot mode was forced` → USB → `fastboot: processing commands` (~0.55 с).
 - USB 18d1:d00d; fastboot: devices <EMMC_SERIAL>; version 0.5; **product lk1st-msm8916**; lk2nd:version 23.1; variant MTP eMMC; unlocked yes;
  secure no; max-download-size 0x10000000; boot 0x1000000 (без виртуального раздела lk2nd); tz 0x80000, hyp 0x80000 (stock GPT).
  Стабильно (~36 с, ответы на все команды, ошибок в UART нет). Заставки нет (ожидаемо).
 - `fastboot oem reboot-edl` (misc.c: reboot_device(EMERGENCY_DLOAD)) → OKAY → 05c6:9008 за ~1 с. PASS.
 - Аппаратный EDL после S1: D+→GND → SBL1 Start → clock_init → тишина → 9008 (00:22:12). PASS.
 - Rollback: не требуется. Stock Android больше не грузится (ожидаемо).
 # Сессия 9 — S2: GPT (tz 512K→1M, tzbak → gap) (2026-09-30 00:24–00:26) — записи и проверки PASS
 Логи/readback: `logs/bootchain/S2-*`. Pre: serial 0x<SAHARA_SERIAL>; aboot == lk1st (S1); sbl1 == stock; recovery == lk2nd image; gap 305184..306207 == zeros.
 | part | OLD | NEW |
 |---|---|---|
 | tz | 270336..271359 (1024 sect, 524288 B) | 270336..272383 (2048 sect, 1048576 B) |
 | tzbak | 271360..272383 (1024, 524288 B) | 305184..306207 (1024, 524288 B) — в неразмеченном промежутке 305170..393215 |
 | hyp | 272384..273407 (1024, 524288 B) | без изменений |
 - S2-A `ws 305184 orig-tzbak.bin` → readback c6f7db26…b4af == stock tzbak, cmp OK (GPT в этот момент ещё stock — проверено).
 - S2-B `ws 7634911 aurora-new-gpt-backup-33sectors.bin` → readback 795952a1…e18f, cmp OK.
 - S2-C `ws 0 aurora-new-gpt-primary-34sectors.bin` → readback 6e850a5d…b8b6, cmp OK.
 - S2-D: printgpt: tz Offset 0x8400000 Length 0x100000; tzbak Offset 0x9504000 (=LBA 305184) Length 0x80000; hyp 0x8500000/0x80000;
  sbl1/aboot/rpm/boot/recovery/DDR/fsg/splash — прежние. Валидатор по readback: hdr/entry CRC OK (обе копии), primary==backup,
  backup hdr на LBA 7634943, usable 34..7634910, disk GUID тот же, изменены только LBA-поля записей tz и tzbak (GUID/attrs/индексы те же).
  Содержимое области tz (1 MiB) == stock tz + старый tzbak (не менялось).
 - Переходное состояние безопасно: SBL1 грузит TZ по program headers ELF (stock tz уже содержит 19303 B мусора после image_end и грузится;
  JZ02 S2 с тем же TZ/SBL1 → lk1st OK).
 - Откат S2: ws 0 orig-gpt-primary-LBA0-33.bin; ws 7634911 orig-gpt-backup-LBA7634911-7634943.bin; ws 305184 orig-gap-LBA305184-306207.bin; rs+cmp.
 - S2 boot (00:26:58, обычное включение): SBL1 → APPSBL Image Loaded → QSEE → SBL1 End → lk1st → forced fastboot (~0.54 с). **PASS.**
  getvar: product lk1st-msm8916; partition-size tz 0x100000, tzbak 0x80000, hyp 0x80000, aboot 0x100000, sbl1/rpm 0x80000, boot/recovery 0x1000000.
  `fastboot oem reboot-edl` → OKAY → 05c6:9008. Rollback не требуется.
 - Состояние флеша после S2: sbl1/rpm/hyp stock; aboot = lk1st-aurora; GPT new (tz 1 MiB: stock TZ.BF.2.2 + бывший tzbak; tzbak @305184 = stock tzbak);
  recovery = lk2nd 23.1; boot/modem/NV/persist — не тронуты.
 # Сессия 10 — S3: tz ← DB410c TZ.BF.3.0-00714, hyp ← qhypstub (2026-09-30 00:30–00:33) — **PASS**
 Логи: `logs/bootchain/S3-*`, UART `logs/uart/S3-newchain-boot-20260930-003103.*`.
 - Pre: serial 0x<SAHARA_SERIAL>; tz 0x8400000/0x100000, hyp 0x8500000/0x80000; tz-db410c.pad1M 8481892f…5363, hyp-qhypstub.pad512K 1a963047…4555;
  rollback orig-tzarea 0284863b… и orig-hyp 340049c1… == срезы full-emmc.bin.
 - A–C `edl w tz tz-db410c.pad1M` → `Wrote … sector 270336`; `r tz` → 8481892f…5363, cmp OK.
 - D–F `edl w hyp hyp-qhypstub.pad512K` → `Wrote … sector 272384`; `r hyp` → 1a963047…4555, cmp OK. (одна EDL-сессия, без перезагрузки между ними)
 - Контроль: GPT primary/backup == S2, aboot == lk1st, tzbak@305184 == stock.
 - Первый boot (00:31:32, обычное включение): SBL1 → Image Load ×3 (строка `QHEE Image Loaded`) → QSEE Execution → SBL1 End →
  lk1st `welcome to lk` → MMC → forced fastboot → `fastboot: processing commands` (~0.54 с). 0× panic/ASSERT/abort.
  → DB410c TZ PASS, qhypstub PASS (цепочка дошла до aboot; на stock TZ+qhypstub JZ02 висел), lk1st PASS.
 - fastboot: <EMMC_SERIAL>; version 0.5; product lk1st-msm8916; lk2nd 23.1; tz 0x100000, tzbak 0x80000, hyp 0x80000, aboot 0x100000.
  SCM/PSCI lk1st при старте не логирует (проверка — при запуске ядра) → подтвердится на ARM64 RAM boot.
 - EDL после S3: `fastboot oem reboot-edl` → 9008 (PASS); аппаратный D+→GND → SBL1 Start → clock_init → тишина → 9008 (00:33:05, PASS).
 - Rollback: не требуется. Состояние флеша: sbl1/rpm stock; tz = DB410c TZ.BF.3.0 (1 MiB); hyp = qhypstub; aboot = lk1st-aurora;
  GPT new; tzbak@305184 = stock; recovery = lk2nd; boot/modem/NV/persist не тронуты.
 # Сессия 11 — ARM64 RAM boot #2 (A/B, тот же образ) — **LEVEL 5 PASS** (2026-09-30 00:36)
 Логи: `logs/uart/ramboot2-arm64-20260930-003530.{log,raw}`, `logs/uart/ramboot2-dmesg.txt` (198 строк), `logs/uart/ramboot2-fastboot.txt`.
 - Образ без изменений: `linux/ramboot1/aurora-ramboot1.img` sha256 470ce4f82864600c5bed7e1791a38e84a802dc2cac7d43d15439f593b9e15347
  (Linux 7.2.7-aurora-ramboot1 arm64, appended DTB == msm8916-jz08-aurora.dtb, eMMC/SD/USB/MSS/WCNSS/BAM-DMUX disabled, busybox initramfs).
 - Команда: `fastboot boot linux/ramboot1/aurora-ramboot1.img` (lk1st) → Sending OKAY, Booting OKAY.
 - lk1st: decompress OK → «Only one appended non-skales DTB, select it» → `SCM call: 0x84000000 failed with :10000` (пробный вызов, некритично)
  → **`PSCI v1.0 detected, skipping SMP spin table`** → `booting linux @ 0x80000000 …` → `Jumping to kernel via monitor`.
  Ошибки «Cannot boot ARM64 with old SCM calling convention» / ASSERT **больше нет** (A/B: разница только в TZ.BF.3.0 + qhypstub).
 - Kernel: `Booting Linux on physical CPU 0x0000000000 [0x410fd030]`, Linux 7.2.7-aurora-ramboot1, `Machine model: JZ08AU Aurora (RAM boot 1)`,
  earlycon msm_serial_dm0 @0x78b0000; psci: PSCIv1.0 in firmware, SMCCC v1.0, OSI mode; `[Firmware Bug]: failed to set PC mode: -3`
  (известно для DB410c TZ, работает OSI, CPUidle PSCI OSI инициализирован).
  GIC: `Root IRQ handler: gic_handle_irq`; arch_timer cp15 19.20 MHz (virt), clocksource arch_sys_counter; arch_mem_timer IRQ растёт.
  SMP: CPU1–3 booted, 4 CPUs. Memory: 445304K/524288K available (512 MiB, reserved tz-apps/smem/hyp/tz/rmtfs/rfsa по upstream dtsi), MemTotal 482864 kB.
  console ttyMSM0 enabled; initramfs unpacked; `Run /init` → `=== AURORA RAM BOOT ===` → BusyBox v1.37.0 ash, prompt `~ #`.
  Блочных устройств нет кроме loop/nbd (eMMC не проявилась — DT disabled). Предупреждений/ошибок в dmesg больше нет.
 - Диагностика из shell (read-only): uname aarch64; model из /proc и /sys; 4 × Cortex-A53 (0xd03); /sys/class/tty: ttyMSM0 (+ttyS0-3 от 8250, не используются).
 - Записей в eMMC: нет.
 # Сессия 12 — RAM boot USB1: USB peripheral + NCM (2026-09-30 00:44) — **PASS-7**
 Эталон ramboot1 не изменён (470ce4f8…). Новое: `linux/dts/msm8916-jz08-aurora-usb1.dts` (diff: `linux/ramboot-usb1.dts.diff`),
 `linux/aurora-usb1.config` (дельта конфига: `linux/ramboot-usb1.config.diff`, 23 опции + LOCALVERSION, только добавления),
 `linux/initramfs-usb1/` (diff init: `linux/ramboot-usb1.init.diff`), артефакты `linux/artifacts/ramboot-usb1/` (SHA256SUMS).
 Логи: `logs/uart/usb1-20260930-004405.{log,raw}`, `logs/uart/usb1-dmesg.txt` (223 строки), `logs/uart/usb1-fastboot.txt`.
 - DTS: `#include "msm8916-pm8916.dtsi"` (RPM-регуляторы), `&pm8916_usbin` okay, `&usb` dr_mode="peripheral" + extcon=pm8916_usbin,
  `&usb_hs_phy` extcon; PHY supplies L7 1.8 V / L13 3.075 V (= stock HSUSB_1p8/3p3), init-seq upstream == stock. eMMC/SD/MSS/WCNSS/BAM-DMUX disabled.
 - Kernel 7.2.7-aurora-usb1: USB_SUPPORT, USB_GADGET, USB_CHIPIDEA(+UDC, MSM glue), PHY_QCOM_USB_HS, EXTCON_QCOM_SPMI_MISC, USB_CONFIGFS(+NCM); USB host = n; MODULES=n.
  Image image_size 0x1670000 (22.44 MiB, end 0x81670000 < DTB 0x81E00000). Image.gz e09d7e81…, DTB 998dcfd4…, initramfs efd2a3f0… (1017243 B),
  **aurora-usb1.img 7735d3df9c17b142786ac83d8ed382b2308f11d32ca38b51603237cedde89eb7** (9629696 B).
 - Boot: из RAM-shell ramboot1 `reboot -f` → SBL1 → lk1st fastboot → `fastboot boot linux/ramboot-usb1/aurora-usb1.img` (OKAY/OKAY) →
  PSCI v1.0 → Linux 7.2.7-aurora-usb1, model «JZ08AU Aurora (RAM boot USB1)».
 - USB: msm_hsusb 78d9000.usb (ChipIdea) + qcom usb-hs-phy; UDC **ci_hdrc.0**, state `configured`; gadget configfs `aurora`,
  NCM ifname **usb0** (dev <MAC>, host <MAC>), 172.16.42.1/24 static.
 - Host (480s): lsusb **18d1:d001** «Aurora / Aurora RAM Boot / <EMMC_SERIAL>» (dev-only IDs, как JZ02), класс CDC NCM; интерфейс **enp0s20f0u2**
  (driver cdc_ncm), NM-профиль jz02-ncm применился автоматически: 172.16.42.2/24.
 - Ping: host→Aurora 5/5, 0% loss, avg 2.19 ms; Aurora→host 5/5, 0% loss, avg 2.24 ms.
 - Предупреждения: `Fixed dependency cycle(s)` usb↔phy (то же на JZ02, штатно); `msm_hsusb: Failed to create device link (0x180) with supplier remoteproc`
  (fw_devlink к отключённому remoteproc; USB работает); psci «failed to set PC mode: -3» (как раньше). Ошибок нет.
 - eMMC: отсутствует (0 строк mmc/sdhci, /sys/block только loop/nbd). SSH: не делался (в Debian busybox нет dropbear; есть telnetd — не включён).
 - Записей в eMMC: нет.
 # Сессия 13 — RAM boot EMMC1: eMMC READ-ONLY (2026-09-30 00:50) — **PASS-9**
 Эталоны не изменены (ramboot1 470ce4f8…, ramboot-usb1 7735d3df…). Новое: `linux/dts/msm8916-jz08-aurora-emmc1.dts` (diff `linux/ramboot-emmc1.dts.diff`),
 `linux/aurora-emmc1.config` (дельта = НЕТ: MMC/MMC_BLOCK/SDHCI/SDHCI_PLTFM/SDHCI_MSM/EFI_PARTITION уже =y), `linux/initramfs-emmc1/` (diff `linux/ramboot-emmc1.init.diff`),
 `linux/artifacts/ramboot-emmc1/` — ядро **байт-в-байт usb1** (Image.gz e09d7e81…), DTB 23f6464f…, initramfs ff3c202c…, **aurora-emmc1.img 93f61ce7…f8e9f** (9631744 B).
 Логи: `logs/uart/emmc1-20260930-005048.{log,raw}`, `logs/uart/emmc1-fastboot.txt`.
 - DTS: `&sdhc_1` okay (+alias mmc0); из upstream: bus-width 8, non-removable, mmc-ddr-1_8v, sdc1 pinctrl; vmmc=pm8916_l8 2.9 V, vqmmc=pm8916_l5 1.8 V (= stock L8/L5).
  sdhc_2 (SD), MSS, WCNSS, BAM-DMUX — disabled; USB/UART — как usb1.
 - init: RO **первым делом** (до USB): ждёт /dev/mmcblk0 → blockdev --setro на mmcblk0, p1..p27, boot0/1 → getro всем → `EMMC-RO-SUMMARY devices=30 all_ro=YES`
  (t≈1.86 s). Затем USB; отчёт по диску только при RO=OK. Нет mount/fsck/mkfs/trim/swap для mmcblk*.
 - Probe: `mmc0: SDHCI controller on 7824900.mmc using ADMA`; `new HS200 MMC card at address 0001`; `mmcblk0: mmc0:0001 H4G2a 3.64 GiB`;
  p1..p27; mmcblk0boot0/1 4 MiB; mmcblk0rpmb (chardev). **Режим: HS200, 8 bit, 1.8 V, 177.78 MHz** (debugfs ios) — НЕ DDR52: sdhci-msm включил HS200 по caps
  контроллера, хотя в DTS нет mmc-hs200-1_8v (ранее заявленное «DDR52 conservative» — неверно). `Card appears overclocked; req 177770000, actual 177777777 Hz`
  = округление GCC (+7777 Hz). CRC/tuning/timeout/I/O error: нет.
 - Карта: name H4G2a, manfid 0x90, oemid 0x14a, CID <EMMC_CID> (== Android sysfs), serial 0x<EMMC_SERIAL>, 7634944 × 512 = 3909091328 B.
 - GPT глазами Linux == S2 GPT по всем 27 разделам (номер/start/size), все ro=1. tz p8 0x8400000/0x100000; tzbak p9 0x9504000/0x80000; hyp p10 0x8500000/0x80000;
  sbl1 p2 0x8000000/0x80000; aboot p4 0x8100000/0x100000; modem p1 0x4000000/0x4000000; boot p22 0xc18c000/0x1000000; recovery p26 0x4918c000/0x1000000;
  userdata p27 0x4a18c000/0x9ee6fe00.
 - SHA256 через mainline MMC == эталоны Firehose: sbl1 6a661ec9 (stock), rpm 5a9b857b (stock), DDR c3502047 (stock), sec 3b1cae78 (stock),
  aboot e4addbf8 (lk1st S1), hyp 1a963047 (qhypstub S3), tz 8481892f (DB410c S3), tzbak c6f7db26 (stock tzbak S2). 8/8 MATCH.
  (Вывод DDR/sec в первом прогоне потерялся на UART; повтор через файл /tmp — rc=0, совпадение.)
 - USB NCM: без регрессий — 18d1:d001, enp0s20f0u2 (jz02-ncm), ping host→Aurora 5/5 (avg 2.68 ms), Aurora→host 5/5 (avg 2.29 ms).
 - Записи: /sys/block/mmcblk0/stat: writes completed 0, sectors written 0 (reads 45 / 8616 sectors). **ZERO writes.**
 - Предупреждения: overclocked (выше); `l13: voltage operation not allowed` (было и в usb1; PHY vs фиксированный L13); `gcc … sync_state() pending due to 7824900.mmc` (информационное).
 - UART-канал теряет куски вывода при всплесках → для данных писать в /tmp и выводить отдельно (или по NCM).
 ## Сессия 13b — software poweroff из RAM-Linux (2026-09-30 01:00) — **НЕ работает (перезапуск)**
 - Пути в ядре: PSCI SYSTEM_OFF (`pm_power_off = psci_sys_poweroff`, psci-1.0 от DB410c TZ) и `qcom,pshold` (POWER_RESET_MSM, PS_HOLD low);
  результат зависит от PS_HOLD-конфигурации PM8916 (задаётся загрузчиком) и от VBUS (при USB PMIC может снова включиться).
 - Busybox `poweroff` без -f шлёт сигнал PID 1 (у нас PID 1 = shell-скрипт) → использовать только `sync; poweroff -f` (прямой reboot(POWER_OFF)).
 - Тест (USB + аккумулятор подключены): `sync; poweroff -f` → через ~0.4 с `SBL1, Start` → QHEE/APPSBL/QSEE → lk1st fastboot 18d1:d00d; NCM исчез.
  Т.е. SoC сбрасывается и сразу грузится заново. Причина (PS_HOLD=reset vs повторное включение по VBUS) не установлена.
 - lk1st fastboot: команды выключения нет (oem: dtb, log, reboot-edl, hash, screenshot).
 - Безопасное выключение сейчас = ручное обесточивание (USB, затем аккумулятор). Безопасно в любой момент: rootfs в RAM, eMMC RO/не используется,
  в lk1st fastboot записей нет.
 - Возможная будущая проверка (не выполнялась): при отключённом USB подать `sync; poweroff -f` через UART и смотреть, стартует ли SBL1.
 # Сессия 14 — B1 (modem FAT RO) + B2 (rmtfs -r + MPSS) (2026-09-30 01:10–01:16) — **PASS-11**. SIM T2 установлена, не использовалась.
 Эталоны ramboot1/usb1/emmc1 не изменены. Новое: `linux/dts/msm8916-jz08-aurora-modem1.dts` (diff `linux/ramboot-modem1.dts.diff`),
 `linux/aurora-modem1.config` (diff `linux/ramboot-modem1.config.diff`), `linux/initramfs-modem1/` (diff init `linux/ramboot-modem1.init.diff`,
 `root/bin/modem-up`, `root/bin/nv-check`, пакеты Alpine в `dl/` + APK-SHA256SUMS), `linux/artifacts/ramboot-modem1/`
 (Image.gz 95596fb9…, DTB 4269cf0b…, initramfs 010837f4…, **aurora-modem1.img 10745c98…7802**, 10133504 B).
 Логи: `logs/uart/modem1-20260930-011037.*`, `logs/modem1/*` (файлы с платы получены по NCM через `nc -l` → `ncat --recv-only`; UART теряет вывод).
 - Kernel delta vs usb1/emmc1: +REMOTEPROC, REMOTEPROC_CDEV, QCOM_Q6V5_MSS, QCOM_SYSMON (+ select: MDT_LOADER, PIL_INFO, Q6V5_COMMON, RPROC_COMMON, DEV_COREDUMP).
  BAM_DMUX, WWAN, WCNSS_PIL — off. image_size 22.50 MiB.
 - DTS delta vs emmc1: &mpss okay (+pinctrl sim_ctrl: gpio1 high, gpio20/22/23 low — как stock Aurora gpio-leds/Android runtime); &mpss_mem reg 0x86800000/0x4e00000
  (= stock modem_adsp_region 78 MiB; Aurora modem.mdt span 0x86800000..0x8b300000 = stock PIL log); &mba_mem okay (dyn 1 MiB → 0x8e700000).
  wcnss, bam_dmux, bam_dmux_dma, sdhc_2 — disabled.
 - rmtfs: Alpine v3.24 `rmtfs 1.3-r0` (+qrtr-libs 1.2-r1, eudev-libs 3.2.14-r6, musl 1.2.6-r2); APKINDEX C: == JZ02 installed; бинарники == JZ02 (sha256).
  Исходник v1.3 (b30a3eb3): `-r` → storage_read_only: open O_RDONLY → RAM shadow; pwrite → RAM; sync no-op; O_RDWR только без -r. `-P` by-partlabel, `-s` rproc sync.
  Команда: `rmtfs -r -P -s -v` (только через /bin/modem-up, который сперва проверяет getro=1 для modemst1/2/fsc/fsg и ro у /firmware).
  Драйвер q6v5-mss: auto_boot=false → MSS стартует только по rmtfs -s.
 B1: RO всем 30 устройствам (t≈1.9 s) → stat до B1: 0 writes → nv_snapshot before → modem по PARTLABEL = mmcblk0p1 (ro=1) →
  `vfat ro,nosuid,nodev,noexec,relatime,…,shortname=lower,errors=remount-ro` на /firmware → 53 файла, **53/53 == Aurora reference** (firmware-fat-compare.tsv);
  modem.mdt aabbf109…, mba.mbn ac123b42…, modem.b18 d901d526… — Aurora (≠ JZ02). firmware_class.path=/firmware/image. B1_OK=1.
 B2 (`/bin/modem-up` в t=109 s): `powering up 4080000.remoteproc` → `Booting fw image mba.mbn, size 234176` → `MBA booted without debug policy, loading mpss`
  → `remote processor 4080000.remoteproc is now up` (+0.6 s). remoteproc0 **running** и через 77 s; нет fatal/crash/SSR/wdog.
  rmtfs жив; /tmp/rmtfs.log содержит только «registering services» (stdout буферизован при перенаправлении в файл — остальное в буфере);
  косвенно: VmData rmtfs 4656 kB ≈ shadow modemst1+modemst2+fsg+fsc (открываются только по запросу модема); fd: /dev/qcom_rmtfs_mem1 (RAM), сокет QRTR, без mmcblk.
 - NV: modemst1 637a71d1…, modemst2 9bb10190…, fsg b0a3b7e4…, fsc 5f70bf18…, persist ee48a843… — **BEFORE == AFTER**.
 - eMMC: /sys/block/mmcblk0/stat writes_completed 0, sectors_written 0 (reads 1048 / 258860 sectors — хэши + rmtfs shadow).
 - USB NCM: 18d1:d001, ping host→Aurora 5/5 (2.27 ms), Aurora→host 5/5 (2.31 ms).
 - Warnings: `qcom-smsm: mbox_request_channel: can't parse "mboxes"` ×3 (upstream smsm без mboxes, информационно), `remoteproc0: releasing` ×4 (probe deferral),
  fw_devlink/l13/overclock — как раньше.
 - SIM T2: интерфейсов для неё нет (QMI/WWAN/BAM-DMUX не включены, /dev: rpmsg_ctrl0/1, qrtr-tun, qcom_rmtfs_mem1). К SIM и модему никаких запросов не делалось.
 # Сессия 15 — B3: QMI control plane + SIM detect + passive NAS (2026-09-30 01:29–01:36) — **PASS-11**
 Эталоны ramboot1/usb1/emmc1/modem1 не изменены. Новое: `linux/patches/rpmsg_wwan_ctrl-port-race.patch` (из JZ02, sha256 7355d729…),
 `linux/aurora-qmi1.config` (diff `linux/ramboot-qmi1.config.diff`), DTS qmi1 (diff `linux/ramboot-qmi1.dts.diff`: только model),
 `linux/initramfs-qmi1/` (Alpine qmi-utils/libqmi 1.38.0_git20260414-r0 + closure в `dl/` + APK-SHA256SUMS; `src/linebuf.c`; `root/bin/qmi-b3`;
 modem-up diff `linux/ramboot-qmi1.modem-up.diff`), `linux/artifacts/ramboot-qmi1/` (Image.gz faf71c53…, DTB af75e4e3…, initramfs 59e4c52c…,
 **aurora-qmi1.img dae591e1…9652**). Логи: `logs/uart/qmi1-20260930-012917.*`, `logs/qmi1/*` (b3.txt с маскированными ICCID/IMSI).
 - JZ02 race patch: `JZ02V30-UFI-@/openrc/rpmsg_wwan_ctrl-port-race.patch` (7355d729…). Исправляет NULL deref в wwan_port_rx ← rpmsg_wwan_ctrl_callback
  ← rpmsg_wwan_ctrl_probe (JZ02 panic 2026-09-26: порт открыт до возврата wwan_create_port, rpwwan->wwan_port ещё NULL) — присваивает wwan_port в
  rpmsg_wwan_ctrl_start() до rpmsg_create_ept(). Код Aurora 7.2.7 идентичен контексту → **применён** (patch -p1 чисто) в /home/q/aurora-kbuild/src.
  (Примечание: в заметках JZ02 отдельно фигурирует ещё bam-dmux runtime-PM race — не относится к B3, BAM-DMUX выключен.)
 - Kernel delta vs modem1: +WWAN, +RPMSG_WWAN_CTRL (+WWAN_DEBUGFS по умолчанию). BAM_DMUX off, USB qmi_wwan не включался (USB host off).
 - Ошибка по ходу: первый образ qmi1 (cd4c9d98…) — /bin/modem-up без +x (потерян при sed>mv) → «Permission denied», MPSS не стартовал; исправлено (dae591e1…).
 - rmtfs: та же команда `rmtfs -r -P -s -v`, только `LD_PRELOAD=/usr/lib/linebuf.so` (setvbuf(stdout,_IOLBF) — механизм stdbuf; linebuf.so bac4480a…).
  Лог теперь построчно: open /boot/modem_fs1/fs2/fsg/fsc, alloc 917504 => 0x86700000, iovec … read; **write = 0** (даже в RAM-shadow).
 - MPSS: t=39.54 powering up → mba.mbn 234176 → MBA booted → 40.13 is now up → 40.74 wwan0at0, wwan0at1, 40.92 **wwan0qmi0** attached. Паники нет.
  rpmsg: DATA5_CNTL/DATA1/DATA4 → rpmsg_wwan_ctrl; IPCRTR → qcom_smd_qrtr; sys_mon → qcom_sysmon; прочие DATA*/DIAG*/apr* без драйвера.
 - qmicli 1.39.0 (Alpine libqmi 1.38.0_git20260414-r0 == JZ02), `qmicli -p -d /dev/wwan0qmi0`, только get-запросы (`/bin/qmi-b3`):
  DMS operating mode **'shutting-down'** (HW restricted no; как JZ02 S7 до ручного online); revision MPSS.DPM.1.0.c7-00193-M8916EAAAANVZM-1;
  DMS UIM state initialization-completed; UIM card status: slot 1 **present**, USIM app **ready**, personalization ready, **PIN1 disabled** (3/10), PIN2 enabled-not-verified;
  slot 2 no-atr (нет второй SIM); ICCID <REDACTED>; IMSI <REDACTED> (MCC/MNC 250-20 = T2).
  NAS: home-network NotProvisioned; serving system not-registered-searching, CS/PS detached, RAT none; system-info GSM/WCDMA/LTE status none;
  signal-info InformationUnavailable; system selection pref (READ): mode 'lte', LTE bands 1,3,5,7,8,20,40, network selection automatic, ps-only, roaming any.
  → модем не зарегистрирован (радио фактически выключено режимом shutting-down/low-power). Режим НЕ менялся.
 - MPSS после запросов: running (uptime 116 s). qmi-proxy запущен (qmicli -p).
 - NV: modemst1 637a71d1…, modemst2 9bb10190…, fsg b0a3b7e4…, fsc 5f70bf18…, persist ee48a843… — BEFORE == AFTER (и == B2).
 - eMMC stat: writes_completed 0, sectors_written 0. USB NCM: ping 5/5 в обе стороны (~2.2 ms). BAM-DMUX: disabled весь B3.
 # Сессия 16 — B4a: DMS online + пассивное наблюдение (2026-09-30 01:50–01:53) — **PASS, автоматическая регистрация T2 LTE**
 Образ без изменений: ramboot-qmi1 (dae591e1…). Сценарий `linux/b4a/b4a.sh` (a200d960…; копия в `logs/b4a/`), результаты `logs/b4a/*`.
 - Ровно одна SET-команда: `qmicli -p -d /dev/wwan0qmi0 --dms-set-operating-mode=online` (t=1195.00) → «Operating mode set successfully», rc=0;
  GET → Mode 'online', HW restricted 'no'. Больше SET/scan/register/attach/bearer не выполнялось.
 - Шкала (39 циклов по ~3 s, только GET serving-system/system-info/signal-info):
  +0.1 s not-registered-searching, RAT none → **+3.2 s registered, PS attached, CS detached, RAT lte, PLMN 250-20 't2'**, LTE service available
  → стабильно до +118.7 s. Автоматическая регистрация модемом (network selection automatic из NV), userspace её не инициировал.
 - Signal LTE: при регистрации RSSI -59 / RSRQ -19 / RSRP -97 dBm / SNR -4.0 dB; в конце RSSI -65 / RSRQ -9 / RSRP -87 dBm / SNR 16.2 dB.
  cell-location: serving PCI 266 RSRP -90.0 RSRQ -7.5 RSSI -65.4; соседи PCI 491 (intra), 357/123 (inter).
 - RF: LTE, active band **eutran-1 (B1)**, EARFCN 100. Home network (теперь provisioned): MCC 250 MNC 20 'TELE2 RU'. Service domain pref ps-only → CS detached ожидаемо.
 - SIM после: slot1 present, USIM ready, PIN1 disabled. Mode online. MPSS running. Паник/SSR/wdog нет.
 - rmtfs после online: 1 запрос записи — `iovec 1, not forced` / `write 0:1792 0x86700000` (EFS caller 1 = modem_fs2, 1792 сектора) → удержан в RAM-shadow (-r).
 - NV на диске: modemst1/2, fsg, fsc, persist — BEFORE == AFTER. eMMC stat: writes 0, sectors_written 0 (до и после).
 - BAM-DMUX: disabled весь B4a (нет wwan0 netdev, ModemManager не запускался). USB NCM: ping 5/5 в обе стороны (~2.3 ms).
 - Следствие для будущего: с rmtfs -r изменения EFS (запись после регистрации) теряются при перезагрузке — ожидаемо и безопасно.
 # Сессия 17 — B4b1: BAM-DMUX kernel bring-up без bearer (2026-09-30 02:01–02:24) — **PASS-11**
 Эталоны не изменены. Новое: `linux/aurora-bam1.config` (diff `linux/ramboot-bam1.config.diff`: +QCOM_BAM_DMUX), DTS bam1 (diff `linux/ramboot-bam1.dts.diff`:
 &bam_dmux + &bam_dmux_dma okay), initramfs == qmi1 (59e4c52c…), `linux/artifacts/ramboot-bam1/` (Image.gz 9c20a372…, DTB a10056c5…,
 **aurora-bam1.img e24c8e5e…8eca**), сценарий `linux/b4b1/b4b1.sh` (6d54ab6c…). Логи: `logs/uart/bam1-20260930-020119.*`, `logs/b4b1/b4b1/*`.
 - JZ02-материалы (тот же Linux 7.2.7): рабочая схема = DT &bam_dmux/&bam_dmux_dma okay (msm8916-ufi.dtsi), probe на старте, отдельного bam-dmux патча нет.
  Известный риск: трафик через bam-dmux во время остановки MSS → «Failed to resume: -22» (sticky); порядок остановки JZ02 = wwan-quiesce
  (ip addr flush + link down всех wwan*) ДО остановки rmtfs/MSS. Recovery: unbind/bind /sys/bus/platform/drivers/bam-dmux/{unbind,bind}
  (устройство 4080000.remoteproc:bam-dmux) по заметкам НЕНАДЁЖЕН; power/control=on и autosuspend_delay_ms=3600000 — лишь смягчение;
  надёжно — только полное обесточивание. Upstream-фикс «net: wwan: qcom_bam_dmux: fix TX DMA channel use-after-free» (v5, 2026-09-03, Cc stable)
  в 7.2.7 отсутствует (старый bam_dmux_pc_vote(bool)) и по треду не влит → не бэкпортировался.
 - Код 7.2.7: probe ничего не делает, пока модем не поднимет pc-линию; netdev регистрируются по CMD_OPEN от модема; ndo_open/stop = BAM_DMUX_CMD_OPEN/CLOSE
  (мультиплексорный канал, не bearer/WDS) + pm_runtime_get_sync.
 - Порядок: eMMC RO → FAT RO → rmtfs -r → MPSS (39 s) → wwan0at0/at1/qmi0 → BAM-DMUX netdev wwan0..wwan7 (DOWN) → mode shutting-down →
  **одна SET `--dms-set-operating-mode=online`** (как B4a; attempt1 t=95.6) → registered 250-20 't2' LTE PS attached.
 - Попытка 1 сценария упала на моей ошибке (`nets()` затирал глобальный счётчик n → arithmetic error) до up/down; попытка 2 (исправлено) — полный прогон.
 - Runtime PM (device /sys/bus/platform/devices/4080000.remoteproc:bam-dmux, drv bam-dmux, control auto, autosuspend 1000 ms):
  5 мин наблюдения — 10/10 suspended, active_ms 0; QMI каждые 60 s: online / registered / PS attached, MPSS running.
 - UP/DOWN wwan0 (без IP, без WDS): up rc=0 → UP,LOWER_UP; PM suspended→active (active_ms 0→1010→3267); down rc=0 → PM suspended (active_ms 4530),
  через 30 s — suspended. «Failed to resume»: 0. «Channel already open»: 0. Паник нет.
 - QMI после: online, SIM present/USIM ready, registered 250-20 't2', PS attached, RSRP -93 RSRQ -13 RSSI -64 SNR 11.6. MPSS running.
 - rmtfs: 1 write (`write 0:1792 0x86700000`, modem_fs2) → RAM shadow (-r). NV BEFORE == AFTER, eMMC writes 0 / sectors 0. USB NCM 5/5 в обе стороны.
 # Сессия 18 — B4b2 попытка 1: прямой qmicli data path (2026-09-30 02:29) — **STOP на start-network, bearer НЕ поднят**
 Образ ramboot-bam1 без изменений. Сценарий `linux/b4b2/b4b2.sh` (ab5e7844…), результаты `logs/b4b2/b4b2/*`.
 - Precheck OK: online, registered 250-20, PS attached, LTE, SIM ready, wwan0 DOWN, BAM-DMUX suspended.
 - WDA: `qmicli -p -d /dev/wwan0qmi0 --wda-set-data-format="link-layer-protocol=raw-ip"` → «Successfully set data format … Link layer protocol: 'raw-ip'», rc=0;
  но `--wda-get-data-format` (следующий запуск qmicli = новый WDA-клиент) → **'802-3'** → raw-ip НЕ подтверждён.
  **Моя ошибка в сценарии**: проверка grep 'raw-ip' совпала с выводом SET, а не GET → сценарий не остановился после WDA, как требовалось.
 - Bind: `--wds-bind-data-port=a2-mux-rmnet0 --client-no-release-cid` → CID '1', rc=0.
 - Start (единственная попытка): `--client-cid=1 --client-no-release-cid --wds-start-network="apn=internet,ip-type=ipv4"` (auth/user/pass не передавались)
  → нет ответа, «Operation was cancelled» (~40 s timeout), rc=1; `--wds-noop --client-cid=1` → «InvalidClientId». Повторов не было.
 - **Точное повторение JZ02** (PLAN-B S9): WDA set per-client, GET через новый клиент = 802-3; reused CID → timeout, release → InvalidClientId.
  Вывод: многошаговый поток «qmicli через qmi-proxy с --client-cid» на этом стеке неработоспособен (CID/WDA-состояние не переживают процесс qmicli).
  JZ02 данные поднимал только через ModemManager (держит постоянных клиентов в одном процессе).
 - После: WDS packet service 'disconnected'; online; registered; PS attached; SIM ready; wwan0 DOWN без IP; маршруты — только usb0;
  BAM-DMUX suspended; MPSS running; dmesg: 0 Failed to resume/Oops/panic; rmtfs — новых запросов нет; NV BEFORE==AFTER; eMMC writes 0 / sectors 0.
 # Сессия 19 — B4b2 через ModemManager (2026-09-30 02:49–02:57) — bearer CONNECTED, DNS OK, ping по table100 FAIL (не разобрано)
 Образ `linux/artifacts/ramboot-mm1/aurora-mm1.img` 38c960ef… (ядро/DTB = bam1; initramfs + MM 1.25.95_git20260527-r1, libqmi 1.38.0_git, dbus 1.16.2,
 polkit 127, eudev 3.2.14 + **modemmanager-udev** (install_if, сперва пропущен мной → "not candidate")); все пакеты == JZ02 (C: и файлы).
 Сценарии: `initramfs-mm1/root/bin/mm-up`, `b4b2-mm` (9b5df90a…); результаты `logs/b4b2mm/run3/b4b2mm/*`.
 - MM: plugin qcom-soc, primary wwan0qmi0, net wwan0..7, physdev bam-dmux; mm.log: raw-ip / a2-mux-rmnet0 (12 совпадений).
 - `mmcli -m 0 --simple-connect="apn=internet,ip-type=ipv4"` (одна попытка) → connected Bearer/1, rc=0.
  IPv4 26.224.4.252/29, gw 26.224.4.253, DNS 176.59.95.243, 176.59.95.242, MTU 1430, interface wwan0.
 - DNS через оператора (host-routes в main): nslookup ya.ru → 5.255.255.242 / 77.88.55.242 → **данные через wwan0 проходят**.
 - ping -I <LTE IP> 77.88.8.8/1.1.1.1/8.8.8.8 через table 100 → 100% loss (причина не разобрана: вероятно моя policy-routing схема; счётчики bam-dmux = 0, драйвер их не ведёт).
 - Disconnect: successfully disconnected, connected: no, wwan0 down, BAM-DMUX suspended, MPSS running. Failed to resume: 0.
 - NV BEFORE==AFTER, eMMC writes 0 / sectors 0.
 # Сессия 20 — B4b2 retest (SIM T2 с ограничением «только Яндекс»), MM (2026-09-30 05:02–05:05) — **DATA PLANE PASS**; контент блокирует оператор
 Уточнение пользователя: SIM T2 ограничена оператором (только сервисы Яндекса) → 1.1.1.1/8.8.8.8 не критерии; провал ping из сессии 19 не доказывает сбой.
 Образ aurora-mm1.img 38c960ef… без изменений; tcpdump 4.99.6-r1 + libpcap 1.10.7-r0 (Alpine v3.24, sha256 в `logs/b4b2mm2/tcpdump-APK-SHA256SUMS`)
 загружены в RAM (/tmp/td) по NCM. Сценарий `linux/b4b2/b4b2-mm2.sh` (0fd51f71…), результаты `logs/b4b2mm2/b4b2mm2/*` (+ wwan0.pcap).
 - Одна попытка `mmcli -m 0 --simple-connect="apn=internet,ip-type=ipv4"` → connected Bearer/1, rc=0. IPv4 26.221.78.53/30, gw 26.221.78.54,
  DNS 176.59.95.243/176.59.95.242, MTU 1430, iface wwan0.
 - Маршруты: только /32 через wwan0 в main (77.88.8.8, 77.88.8.1, оба DNS T2, 3 адреса ya.ru); default НЕТ; `ip route get 77.88.8.8` → dev wwan0 src LTE-IP;
  `ip route get 172.16.42.2` → dev usb0 (management цел).
 - ping 77.88.8.8: 5 echo request ушли в wwan0, 0 reply (ICMP не пропускается оператором).
 - DNS через T2 DNS: nslookup ya.ru → 77.88.55.242, 5.255.255.242, 77.88.44.242 (+AAAA 2a02:6b8::2:242) — ответы получены по wwan0.
 - HTTP http://ya.ru → TCP SYN/SYN-ACK с 77.88.44.242:80 по wwan0, ответ «HTTP/1.1 302 Found, Location: http://internet-block.t2.ru/?p=LOCKB»
  → оператор перехватывает и отдаёт страницу блокировки (LOCKB). HTTPS https://ya.ru → «Connection reset by peer» (тоже оператор).
 - tcpdump wwan0: всего 42 пакета, TX (src LTE-IP) 26, RX (dst LTE-IP) 14: DNS-ответы, TCP SYN-ACK/данные HTTP. Счётчики netdev bam-dmux = 0 (драйвер не ведёт).
 - BAM-DMUX: active во время трафика (active_ms до ~33 s), после disconnect → suspended. Failed to resume/-110/-22/EAGAIN: 0.
 - Disconnect: `--simple-disconnect` → успешно, connected: no; маршруты/адрес удалены; wwan0 down. После: MM registered, PS attached; QMI registered; MPSS running.
 - rmtfs: новых запросов нет. NV BEFORE==AFTER. eMMC writes 0 / sectors 0. USB NCM работал всё время (результаты получены через него).
 - Вывод: LTE data plane (MM qcom-soc → WDA raw-ip → a2-mux-rmnet0 → WDS → bam-dmux wwan0 → IPv4) работает в обе стороны (UDP+TCP).
  Доступ к контенту даже ya.ru сейчас заблокирован оператором (редирект internet-block.t2.ru ?p=LOCKB) — вопрос SIM/тарифа, не платы.
 # Сессия 21 — Beeline SIM, финальный cellular test (2026-09-30 13:14–13:27) — **STOP: нет регистрации (registration-denied → limited)**
 SIM заменена пользователем на обесточенной плате (T2 → Beeline). Перед заменой плата была в lk1st fastboot (Linux не работал, bearer не было).
 Образ `linux/ramboot-mm1/aurora-mm1.img` 38c960ef… без изменений (sha256 сверен), `fastboot boot` через lk1st (`logs/uart/beeline1-fastboot.txt`).
 UART `logs/uart/beeline1-20260930-131418.*`; сценарии и результаты `logs/beeline1/` (bee-p23.sh 8d3e8cf2…, bee-obs.sh, bee-watch.sh, bee-safe.sh; bee23/, beeobs/, beewatch.txt, prof.txt, beesafe/).
 - Boot: EMMC-RO 30/30, B1_OK=1, NCM usb0 172.16.42.1 (ping OK). modem-up: MPSS up t≈108 s, wwan0qmi0/at0/at1, wwan0..7.
 - P2 (GET): DMS 'shutting-down'; UIM initialization-completed; slot1 present, USIM ready, PIN1 disabled (3/10), personalization ready; slot2 no-atr.
  ICCID <REDACTED>; IMSI <REDACTED> → home 250-99 'Beeline' (SPN 'beeline'). Home network до online: NotProvisioned. NAS not-registered-searching.
 - P3: одна `--dms-set-operating-mode=online` (t=128.39, rc=0 → Mode 'online'). Далее только GET, без scan/register/band/RAT.
  +6 s: Selected 3gpp, RAT lte, searching; +97 s (t=226): **registration-denied** (~20 s); t=247 → снова not-registered-searching и так до t≈626 (конец наблюдения, ~500 s).
  LTE service 'limited' / True status 'limited-regional', Domain camped, PS detached, Forbidden no, Cell access all-calls.
  Camped: PLMN 250-99, **B3 EARFCN 1275**, PCI 390, TAC <CELL> (cell-location TAC <CELL>), GCI <CELL>; RSRP −102…−104, RSRQ −19…−20, SNR −7…−1 dB, RSSI −61.
  Соседи intra PCI 55 (RSRP −100, RSRQ −14.5), 7, 61, 319; inter EARFCN 550 (B1), 3300 (B7). Причина отказа (EMM cause) через QMI GET не получена.
 - LTE attach PDN list '1', профиль 1: APN '' (пусто), ipv4-or-ipv6, auth none — тот же, с которым T2 регистрировалась за 3 s → APN профиля attach не объясняет отказ (не доказано).
 - MM 1.25.95 (qcom-soc): modem найден, state **disabled**, lock sim-pin2 (PIN2, не блокирует), SIM operator 25099 'beeline'. Bearer/connect НЕ выполнялись (Phase 4 не начата — нет регистрации).
 - Безопасность: NV (modemst1/2, fsg, fsc, persist) BEFORE==AFTER (== B2 эталоны); eMMC writes_completed 0 / sectors_written 0;
  rmtfs 2× `write 0:1792` → RAM shadow (-r). BAM-DMUX suspended, wwan0 DOWN, MPSS running, dmesg без Failed to resume/-110/-22/SSR/wdog. NCM OK.
 - Гипотезы (не проверены): SIM Beeline не активирована/заблокирована для данных или LTE; слабая/перегруженная сота B3 (RSRQ −20, SNR<0).
  Проверить SIM в телефоне там же (регистрация, LTE, мобильный интернет) до следующей попытки.
 # Сессия 22 — Beeline, повтор после полного обесточивания (2026-09-30 13:39–14:01) — **CELLULAR PASS (Aurora cellular bring-up закрыт)**
 Контроль: та же SIM в Redmi 9 (crDroid) — LTE 250-99 HOME, rejectCause 0, интернет OK, APN internet.beeline.ru, EARFCN 1275 / PCI 390.
 Образ aurora-mm1.img 38c960ef… без изменений; UART `logs/uart/beeline2-20260930-134119.*`, `logs/uart/beeline2-fastboot.txt`.
 Сценарии/результаты `logs/beeline1/`: bee2-diag.sh (98d89ad3…) → bee2/; bee-data.sh (11156676…) → beedata/; bee-data2.sh (94d47de8…) → beedata2/.
 curl для RAM: Alpine v3.24 curl 8.22.0 + closure (libcurl, libssl3/libcrypto3 3.5.9, nghttp2, c-ares, idn2, psl, unistring, brotli, CA bundle) —
 `linux/beeline/curl/` (APK C: сверены с APKINDEX, SHA256SUMS; cu.tar b5087392…), распакован в /tmp/cu, LD_LIBRARY_PATH (системный libcrypto не заменялся).
 - Регистрация: одна `--dms-set-operating-mode=online` (t=43.95) → +6.7 s **registered, PS attached**, 250-99 'Beeline', LTE B3 EARFCN 1275,
  **PCI 55**, ECI <CELL>, TAC <CELL>; RSRP −103 / RSRQ −17 / SNR −3.0. Ветка reject-диагностики (AT+CEREG/CEER) не понадобилась — AT-команды не отправлялись.
  Сравнение с сессией 21 (denied): тогда serving PCI 390, ECI <CELL>, system-info TAC <CELL> (cell-location TAC <CELL>) — причина отказа не установлена
  (EMM cause не получен); после cold boot модем выбрал другую соту той же несущей и зарегистрировался сразу.
 - MM qcom-soc формирует bearer так: WDA Set Data Format (raw-ip) → Bind Data Port (a2-mux-rmnet0) → Set IP Family → WDS **Start Network с TLV APN/Username/
  Auth/IP family** — профили модема НЕ создаются/не меняются (0× Create/Modify Profile в mm.log). rmtfs — 0 новых запросов записи.
 - Connect (одна попытка на проход): `mmcli -m 0 --simple-connect="apn=internet.beeline.ru,user=beeline,password=beeline,allowed-auth=pap,ip-type=ipv4"` → Bearer/1, rc=0.
  IPv4 10.46.47.17/30, gw 10.46.47.18, DNS 10.10.22.1, 194.186.191.1, MTU 1500, iface wwan0. Внешний IP (CGNAT) <PUBLIC_IP> (1.1.1.1 trace: colo DME).
 - Маршрутизация: ядро без policy routing (`ip rule` → Operation not supported) → только /32 host-routes через wwan0 в main; default нет
  (`ip route get 8.8.4.4` → unreachable); `ip route get 172.16.42.2` → usb0.
 - Проход 1 (beedata): DNS OK (ya.ru, www.google.com через оба DNS Beeline), ping 77.88.8.8 5/5 (avg 49 ms), 1.1.1.1 5/5 (44 ms), HTTP ya.ru 302;
  HTTPS rc=60 «certificate is not yet valid» — **часы RAM-Linux ≈1970** (не сеть: TLS-сертификат получен). Disconnect OK.
 - Часы: `date -u -s @<epoch 480s>` (только системное время ядра, hwclock/RTC не трогали).
 - Проход 2 (beedata2, те же параметры connect): ping 5/5 оба; **HTTPS ya.ru HTTP/2 302** (капча Яндекса), **https://www.google.com/generate_204 → 204**,
  **https://1.1.1.1/cdn-cgi/trace → 200 TLSv1.3**, ssl_verify=0 везде; HTTP ya.ru 302.
  tcpdump wwan0: 152 пакета, TX 79 / RX 71, DNS 16, ICMP 20, tcp443 102, tcp80 12, SYN 4 / SYN-ACK 4, TLS handshake records 6.
  Во время данных модем перешёл на B1 EARFCN 550, PCI 147, ECI <CELL>, TAC <CELL> (RSRP −105, RSRQ −17, SNR −6.4).
 - BAM-DMUX: active во время трафика, после disconnect suspended; Failed to resume/-110/-22/EAGAIN/SSR/wdog: 0. MPSS running.
 - Disconnect: successfully disconnected, connected: no, /32 routes и адрес удалены, resolv.conf очищен, wwan0 DOWN; MM registered/home, QMI registered+PS attached.
 - NV modemst1/2, fsg, fsc, persist BEFORE==AFTER (оба прохода, == эталоны B2); eMMC writes_completed 0 / sectors_written 0. USB NCM ping OK всё время.
 - Итог: SIM detect, online, automatic registration, PS attach, bearer, IPv4, wwan0 TX/RX, DNS, ICMP, HTTP, HTTPS, clean disconnect — **PASS**.
  Замечание на будущее: для TLS в RAM-Linux выставлять время (NTP через wwan0 или date с хоста) до HTTPS.
 # Сессия 23 — B5 (direct boot из eMMC): Phase 0–1 audit (2026-09-30) — **STOP на Phase 1, записей нет**
 Ничего не записано, к плате не обращались (только анализ файлов зеркала).
 - Блокер 1 (доказан): текущий aboot = lk1st-aurora (e4addbf8…, == readback S1 и == sha из Linux S13) собран с `LK2ND_FORCE_FASTBOOT=1`
  (`lk2nd-build/src/build-lk1st-msm8916/config.h`; строка «Fastboot mode was forced with compile-time flag.» в aboot-lk1st-aurora.mbn и в UART S1/S2/S3).
  `app/aboot/aboot.c:5647` безусловно ставит boot_into_fastboot=true → `normal_boot` (lk2nd_boot()/boot_linux_from_mmc()) не выполняется НИКОГДА.
  ⇒ любая запись только в `boot` не меняет поведение power-on: lk1st остаётся в fastboot. B5 без изменения aboot невозможен.
 - Блокер 2 (доказан): golden aurora-mm1.img 38c960ef… = 20 606 976 B (Image.gz-dtb 8 658 738 + initramfs.cpio.gz 11 944 942, page 2048)
  > boot 16 777 216 B (LBA 396384, 32768 сект.). Даже тот же cpio (40 307 200 B) в xz -9e = 8 340 976 B → итог ≈17.0 MB > 16 MiB. zstd -19 хуже.
 - Попутно (для будущего дизайна): без FORCE_FASTBOOT lk1st сначала вызывает lk2nd_scan_devices() — ext2-mount (RO в LK) всех leaf-разделов ≥ LK2ND_BOOT_MIN_SIZE
  (+boot) и поиск extlinux/extlinux.conf, затем boot_linux_from_mmc() из `boot`; при ошибке → «Could not do normal boot» → fastboot.
  Клавиши lk1st msm8916: RESIN (кнопка RESET Aurora) = KEY_VOLUMEDOWN → fastboot; GPIO107 (pull-up, active-low) = KEY_VOLUMEUP → recovery.
 # Сессия 24 — B5a (minimal direct boot proof): A1–A3 + подготовка A4 (2026-09-30 14:20–14:40) — **ЗАПИСЕЙ НЕТ, ждёт GO**
 Артефакты `b5a/` (SHA256SUMS, копия на 480s сверена), логи `logs/b5a/A3/*`, UART `logs/uart/b5a-a3-20260930-142659.*`.
 - A1 сборка: чистые клоны lk2nd 23.1 e9c8b217 (tag 23.1, git clean), тот же toolchain/команда. Контроль воспроизводимости: FORCE=1 → unsigned 58d20d78 (== прошитый),
  qtestsign 0eef3b5 `-v 3 aboot` → 003c484e, pad1M → **e4addbf8 == текущий aboot** (бит-в-бит). Кандидат: та же команда без `LK2ND_FORCE_FASTBOOT=1`
  → unsigned 33c452e4…, signed `aboot-lk1st-aurora-autoboot.mbn` 327196 B 7b3fb5b3…, **pad1M 3b8cd266…0f85**. config.h diff = одна строка `-#define LK2ND_FORCE_FASTBOOT 1`.
  Все .o без debug-info идентичны, кроме app/aboot/aboot.o (aboot_init: в FORCE-сборке lk2nd_boot/normal path выкинуты как мёртвый код; в autoboot — есть).
  Строка «Fastboot mode was forced…» в autoboot-бинарнике отсутствует (0 вхождений).
 - Normal boot flow (исходник, autoboot): multislot нет (нет *_a/_b) → keys (lk2nd device node не матчится: lk1st без LK2ND_COMPATIBLE, cmdline пуст → generic):
  VOL_UP = GPIO107 pull-up active-low → recovery (там lk2nd = fastboot); VOL_DOWN = PM8916 RESIN (кнопка RESET) → fastboot; обе → EDL; KEY_HOME → false.
  reboot mode = PON_SOFT_RB_SPARE (обнуляется при полном обесточивании). ABOOT_STANDALONE: devinfo/misc/BCB/ffbm/format-bit не читаются.
  → lk2nd_boot(): ext2-mount **только чтение** (ext2 fs_api без write; lk2nd bdev без write; bcache dirty не ставится) на leaf-разделах ≥16 MiB + boot, ищет extlinux;
  не найдено → boot_linux_from_mmc(): header ANDROID!, page 2048, imagesize ≤ partition, target_use_signed_kernel && !unlocked → не проверяется (standalone unlocked),
  gzip-распаковка в scratch, update_ker_tags_rdisk_addr (ABOOT_FORCE_* 0x80080000 → лог «0x80000000»/0x82000000/0x81E00000), dt_size=0 → dev_tree_appended → boot_linux.
  Тот же scratch-буфер/распаковка/адреса/appended-DTB, что в cmd_boot (fastboot boot), которым emmc1 PASS (сессия 13). Ошибка → «Could not do normal boot» → fastboot.
 - A2 кандидат boot: `linux/artifacts/ramboot-emmc1/aurora-emmc1.img` 93f61ce7… 9 631 744 B: ANDROID! v0, page 2048, kernel Image.gz+DTB 8 608 417 B
  (gzip → arm64 Image 22 945 800 B, image_size 0x1670000, text_offset 0; appended DTB 65 425 B = 23f6464f…, model «JZ08AU Aurora (RAM boot EMMC1)»), ramdisk gzip 1 017 983 B,
  dt_size 0, cmdline `earlycon console=ttyMSM0,115200n8 ignore_loglevel loglevel=8 rdinit=/init`. `b5a/boot-emmc1-16MiB.img` = образ + нули до 16 777 216 B → **e9579f33…ebff**.
 - A3 (живое чтение Firehose, 14:27–14:35): вход mm1 RAM-Linux → `reboot -f` → lk1st → `fastboot oem reboot-edl` → 9008. Все чтения rc=0, 15/15 == documented:
  boot 1342def7 (stock, == partitions/boot.bin), aboot e4addbf8, GPT p 6e850a5d / b 795952a1 (== S2 кандидаты побайтно), sbl1 6a661ec9, rpm 5a9b857b, tz 8481892f, hyp 1a963047,
  tzbak@305184 c6f7db26, recovery 0dfa60a0, modemst1 637a71d1, modemst2 9bb10190, fsg b0a3b7e4, fsc 5f70bf18, persist ee48a843. printgpt: boot 0xc18c000/0x1000000, aboot 0x8100000/0x100000.
 - Находка (не блокер B5a): warm `reboot -f` из mainline → lk1st иногда висит после `target_init()` до «MMC card» ~15 с → сброс SoC → вторая попытка OK
  (сейчас 14:27:22→14:27:37; ранее сессия 19 02:49:13→02:49:28). 2 из ~6 warm reboot; на cold boot не наблюдалось. Причина не установлена.
 - Подготовлено (НЕ запускалось): `b5a/A4-write.sh` (7cda9d18…; гейты → boot → readback cmp → aboot → readback cmp → сверка остальных с A3), `b5a/A4-rollback.sh` (47de97b1…).
 # Сессия 25 — B5a: запись boot+aboot и 3 cold boot (2026-09-30 14:40–14:59) — **B5a PASS**
 - Pre-GO offline/RO проверка extlinux (`logs/b5a/A4pre/scan-check.{py,out}`): lk2nd 23.1 ищет только `<part>/extlinux/extlinux.conf`; scan list = GPT-разделы ≥16 MiB + boot
  (вложенных MBR-subdevice нет ни в одном, у mmc1 protective MBR не проходит validate). Живые Firehose-дампы modem 04ada779 (==эталон), system f09ded23, cache 817118e4,
  userdata 1e021a0c + A3 persist/recovery + кандидат boot; ext-FS: system/persist/cache/userdata — debugfs (RO) «File not found» для /extlinux и /extlinux/extlinux.conf,
  то же на backup session 1. modem (FAT), boot, recovery — не ext.
 - `b5a/A4-write.sh` (7cda9d18) без изменений, EDL-сессия из A3: гейты OK → boot `Wrote … sector 396384`, readback e9579f33 cmp **BOOT_MATCH** →
  aboot `Wrote … sector 264192`, readback 3b8cd266 cmp **ABOOT_MATCH** → GPT p/b, tzbak, sbl1, rpm, tz, hyp, recovery, modemst1/2, fsg, fsc, persist == A3. Логи `logs/b5a/A4/`.
 - Состояние флеша теперь: aboot = lk1st-aurora-autoboot (3b8cd266…, без FORCE_FASTBOOT); boot = emmc1 + нули (e9579f33…); остальное как после S3/сессии 4b.
 - Cold boot ×3 (полное обесточивание USB+АКБ пользователем, без хоста/fastboot/reboot -f), UART `logs/uart/b5a-cold{1,2,3}-*.log`:
  по одному `SBL1, Start` → SBL1 End → lk1st `welcome to lk` → MMC → таблица block devices (== GPT) → `boot: Trying to boot from the file system` → decompress →
  appended DTB → PSCI v1.0 → `booting linux … ramdisk (1017983)` (~1.0 с от lk) → Linux 7.2.7 «JZ08AU Aurora (RAM boot EMMC1)», 4 CPU, 445132K/524288K, MemTotal 482692 kB,
  eMMC 27 разделов, EMMC-RO-SUMMARY 30/30 all_ro=YES, mmcblk0 writes 0, UDC configured, NCM ping 5/5 (~2.7 ms), shell по UART. 14:52 / 14:54 / 14:57 — **3/3 PASS**.
  Безвредно: `Failed detecting MMC/SDC @ slot2` (lk2nd опрашивает пустой SD-слот); окно UART ~280–820 мс lk повреждено (строка «Loading (boot) image» не читается).
 - Как попасть в fastboot теперь: зажать RESET (RESIN = KEY_VOLUMEDOWN) при включении (по коду; на железе не проверялось). Аварийно: HW EDL D+→GND. Откат: `b5a/A4-rollback.sh`.
 - B5b (extlinux/cache, exact golden mm1) НЕ начат — ждёт отдельного GO.
 # Сессия 26 — B5b (exact golden mm1 через extlinux): B1–B6 аудит + кандидат (2026-09-30 15:00–15:50) — **ЗАПИСЕЙ НЕТ, ждёт GO**
 Артефакты `b5b/` (SHA256SUMS), эмулятор и прогоны `b5b/emu/`. Плата: emmc1 Linux (B5a baseline), к flash только чтение.
 - B1 (исходник lk2nd 23.1): lk2nd_scan_devices() идёт по списку bio в порядке list_add_head → **userdata(p26), recovery(p25), cache(p24), persist, system, boot(p21), modem(p0)**
  (прочие <16 MiB пропускаются; wrp0 не leaf). Для каждого: fs_mount ext2 → lk2nd_try_extlinux("<mp>/extlinux/extlinux.conf"); **ничего не размонтирует**;
  find_mount/mount сравнивают префикс без границы «/» (ERR_ALREADY_MOUNTED) — до cache ничего не монтируется, конфликтов нет.
  ext2-драйвер LK: только rev≤1; ro_compat кроме sparse_super|large_file → mount -3; **incompat не проверяет** (extents/64bit/flex_bg/meta_bg/inline_data прочитает мусором);
  только прямые/IND/DIND/TIND блоки; group desc 32 B; каталоги линейно (dir_entry_2, filetype ок); write API нет.
  Парсер extlinux: ключи (регистр не важен) label, default, kernel|linux, initrd, append, fdt|devicetree, fdtdir, fdtoverlays; без DEFAULT → первый label;
  **FDT обязателен** (appended DTB в этом пути не используется); пути: абсолютный → "<mp>/" + path (// схлопывается), относительный → "<mp>/extlinux/";
  нужны LF и завершающий \n (иначе «Failed to parse»). Загрузка: kernel файл → scratch 0x90000000 (256 MiB) → gzip (трейлер игнорируется) → kernel @DDR+text_offset(0),
  initrd @ROUNDDOWN(0x3200000−size,4K), DTB @initrd−2 MiB (max 2 MiB); kernel_max = tags_offset−kernel_offset. Любая ошибка до boot_linux → return → следующий раздел →
  «Bootable file system not found. Reverting to android boot.» → boot_linux_from_mmc(). Далее общий boot_linux() (как у Android-пути: update_device_tree, ASSERT при сбое DT).
 - B2 golden `linux/artifacts/ramboot-mm1/aurora-mm1.img` 38c960ef…: v0, page 2048, kernel @2048 8 658 738 B 0ff9c802 (= Image.gz-dtb: gzip 8 592 969 B 9c20a372 + appended DTB
  @file 8 595 017, 65 769 B a10056c5), ramdisk @8 660 992 11 944 942 B 250bf8ee, паддинги нулевые. Image 23 015 432 B 4603b02f, image_size 0x1680000, text_offset 0.
  Всё == build-артефактам mm1. Выбор: kernel-файл = **точный payload Image.gz-dtb**, fdt = точный appended DTB, initrd = точный initramfs, append = точный cmdline.
 - B3 cache: LBA 2133088, 262144 сект., 134 217 728 B (0x4118c000). Живой sha **817118e4** (Firehose A4pre + sha256 /dev/mmcblk0p25 на плате — совпали; поток nc префикс OK).
  ext4 (Android make_ext4fs): has_journal ext_attr resize_inode filetype **extent** sparse_super large_file **uninit_bg**, 4K, inode 256, UUID 57f8f4bc-…, 1554/32768 блоков,
  содержимое: /backup (пусто), /recovery/last_log (5836 B, stock recovery сессии 3), /recovery/last_install (0). Ценности нет; ≠ session-1 (6a8ab0bd). **Несовместим с lk2nd**
  (mount -3, extents). Backup: `b5b/backup/cache-current-817118e4.bin` (RO).
 - B4 кандидат `b5b/cache-extlinux-mm1.img` **409bbb11…14ed9**, 134 217 728 B, воспроизводим (`b5b/mkfs-candidate.sh` 045cc857: mke2fs 1.47.2 -t ext2 -O none,filetype,sparse_super,
  4K, inode 128, 64 inodes, 1 group, фикс. UUID/hash_seed/время + debugfs sif времён). Файлы: /extlinux/extlinux.conf e14e9ad6 (173 B), /Image.gz-dtb 0ff9c802,
  /aurora-mm1.dtb a10056c5, /initramfs.cpio.gz 250bf8ee (+lost+found). inode flags 0x0 (block map, IND/DIND). e2fsck -fn rc=0.
 - Эмулятор `b5b/emu/lk2nd-scan-emu`: реальные boot.c/extlinux.c/util.c, lk2nd bdev wrapper/util, lib/bio, lib/partition, lib/fs, lib/fs/ext2, lib/bcache, lib/zlib_inflate
  из дерева 23.1 + шимы (bdev из образов по GPT A3, write→abort). S0 (текущий flash): таблица устройств == UART cold boot, mount rc: userdata/cache/persist/system −3,
  recovery/boot/modem −1 → Android boot (как на плате). S1 (кандидат): «Trying to boot 'mm1'» → boot_linux: kernel 4603b02f @DDR+0, image end +0x1680000,
  DTB a10056c5 @+0x249B000, initrd 250bf8ee @+0x269B000, cmdline точный. F1–F11 (нет conf/kernel/initrd/dtb, мусор, нет fdt, CRLF, нет \n, битый gzip, нули, битый sb) →
  все → «Reverting to android boot» (emmc1).
 - Не эмулируется (остаточный риск): зависание/краш LK на повреждённых метаданных; ASSERT в boot_linux (DT) → panic → EDL; ядро стартовало, но Linux упал — fallback нет.
 - Подготовлено (НЕ запускалось): `b5b/B5b-write.sh` c0ebd361, `b5b/B5b-rollback.sh` 72d3deb1. Вход в EDL — только HW (D+→GND).
 # Сессия 27 — B5b: запись cache + cold boot #1 PASS, cold boot #2 HANG (2026-09-30 15:27–15:42) — **STOP для анализа**
 - GO пользователя: заменить cache целиком. HW EDL (D+→GND) → `b5b/B5b-write.sh` c0ebd361 без изменений: Serial 0x<SAHARA_SERIAL>, cache 0x4118c000/0x8000000, GPT==A3,
  boot e9579f33, aboot 3b8cd266, cache 817118e4 (pre) → `Wrote … sector 2133088` → readback 409bbb11 cmp **CACHE_MATCH** → GPT p/b, tzbak, boot, aboot, sbl1, rpm, tz, hyp,
  recovery, modemst1/2, fsg, fsc, persist == A3; modem, system, userdata == A4pre. Логи `logs/b5b/W/`, `logs/b5b/B5b-write.out`.
 - Cold boot #1 (`logs/uart/b5b-cold1-20260930-153540.log`): 15:36:57 SBL1 → lk1st → `booting linux @ 0x80000000, ramdisk @ 0x8269b000 (11944942), tags/device tree @ 0x8249b000`
  (адреса только extlinux-пути; == эмулятор; golden fastboot: 0x82000000/0x81e00000) → Linux `7.2.7-aurora-bam1 #5 … 04:59:18` (== golden в сессии 22),
  «JZ08AU Aurora (RAM boot BAM1)», 4 CPU (0-3), Memory 353708K/524288K (== golden), /proc/cmdline == APPEND, EMMC-RO 30/30, writes 0, NCM ping 5/5, shell,
  remoteproc offline, MM/rmtfs не запущены (штатно для mm1). **PASS.** Строка «Trying to boot 'mm1'» — в повреждённом окне UART lk 280–950 мс.
  Ещё 3 SBL1-старта (15:37:22, 15:37:37, 15:37:54) — выпадение аккумулятора (со слов пользователя, контакт нестабилен); все 3 тоже прошли extlinux → mm1; в зачёт не идут.
 - Cold boot #2 (`logs/uart/b5b-cold2-20260930-153935.log`): 15:41:10 SBL1 Start … QHEE/Image Loaded ×3, QSEE, **SBL1 End 15:41:11 → тишина** (нет «UART_DM Initialized»/
  «welcome to lk»), USB не энумерируется (>40 с). Зависание ДО lk1st (TZ/qhypstub/ранний lk) — до любого чтения cache. Первый такой случай во всех UART-логах проекта
  (скан всех *.log: SBL1 End без lk — только этот). Причина не установлена (кандидат: нестабильный контакт АКБ). Ничего не писалось, отката не было.
 - Cold boot #2 повтор (АКБ закреплён) 15:43:50: SBL1 → lk1st → extlinux-адреса (0x8269b000/0x8249b000) → mm1: ядро #5 == golden, BAM1, CPU 0-3, 353708K, cmdline == APPEND,
  RO 30/30, writes 0, NCM 5/5, shell, remoteproc offline, MM/rmtfs нет. **PASS.**
 - Cold boot #3 (`logs/uart/b5b-cold3-20260930-154444.log`): 15:45:06 SBL1 Start → pm_device_init (Delta 17202 µs вместо обычных ~11.2–11.8 ms) → boot_config →
  sbl1_ddr_set_params → Pre_DDR_clock_init Delta → **тишина** (зависание внутри stock SBL1 до pm_driver_init/Image Load, т.е. до загрузки TZ/HYP/aboot и до чтения cache).
  15:49:29 новый старт → SBL1 → lk1st → extlinux → mm1: все проверки как в #2 — **PASS**.
 - Итог наблюдений: все 6 загрузок, дошедших до lk1st, прошли extlinux → точный golden mm1. 2 ранних зависания (15:41 после SBL1 End; 15:45 внутри SBL1 DDR-init) —
  оба до кода/данных, изменённых в B5a/B5b; совпадают по времени с нестабильным контактом АКБ. Причина не доказана.
 - 15:49:29 — повторное обесточивание пользователем (подтверждено), не самовосстановление.
 - **B5b = PASS / CLOSED** (решение пользователя 2026-09-30). Baseline flash: aboot 3b8cd266 (lk1st autoboot), boot e9579f33 (emmc1, fallback),
  cache 409bbb11 (ext2 extlinux → exact golden mm1), остальное == A3. Power-on без хоста → mm1.
 - ОТКРЫТО (отдельный вопрос, без GO не исследуется): ранние зависания при включении до lk1st — 15:41 (после SBL1 End) и 15:45 (внутри SBL1 DDR-init,
  pm_device_init 17202 µs vs ~11.3–11.8 ms), на фоне нестабильного контакта АКБ. Также открыт warm reboot -f hang (сессия 24).
 # Session 28 — B6 RAM-only modem lifecycle (2026-09-30 16:09–16:47 on 480s clock) — **B6I NOT REACHED: re-attach alternates PASS/FAIL**. Nothing written to flash.
 Board: golden mm1 via extlinux (B5 baseline), a single Linux boot for the whole session. Scripts live only in board /tmp. Sources in `b6/` (SHA256SUMS), logs in `logs/b6/all/` (b6/c1..c6, aurora-modem.d/lifecycle.log,
 rmtfs.log, mm-*.log with IMSI masked), UART `logs/uart/b6-20260930-160910.log`. System clock set from 480s (`date -u -s @…`, RTC untouched) — for HTTPS only.
 - Reconstructed flow (Aurora 14–22 + JZ02 openrc/stopcycle/wwanfix + rmtfs v1.3 source): RO gates → `rmtfs -r -P -s -v` (with -s rmtfs itself writes "start";
  on SIGTERM it does pwrite "stop" to remoteproc state and only then exits → MSS stops while rmtfs is still alive, rmtfs exits last) → MSS running (0.7 s)
  → wwan0qmi0+wwan0 (0.8 s) +2 s (JZ02 start_post guard) → [NEW gate] UIM card present + USIM ready → qmicli online (one successful SET;
  retries only on DeviceNotReady — the first 2–3 SETs ~3 s after MSS boot get DeviceNotReady(52)) → NAS registered+PS attached → kill qmi-proxy → udevd/dbus/polkitd/MM
  → MM modem detected (38–51 s) → MM state `disabled` is OK (session 22 pass 1: simple-connect enables it) → one simple-connect → IPv4 from bearer, /32 routes only.
  Stop: simple-disconnect → [NEW] `mmcli --disable` (low-power/detach) → delete our /32 routes, flush+down all wwan* → SIGTERM MM (+qmi-proxy) → BAM-DMUX suspended → SIGTERM rmtfs (MSS stop → exit).
 - Findings while debugging: this mmcli has no `--list-bearers` ("error: no actions specified" — also in session 22/JZ02 logs, so the JZ02 wwan-quiesce bearer check was a no-op);
  mmcli colours values even without a tty (`state: ESC[32mconnected`) → strip before grep; udevd rewrites /dev/disk/by-partlabel/* as relative links → use readlink -f.
 - PASS cycles (c1, c3, c5): registration 8–53 s, START OK 75–124 s; DNS (ya.ru, google via Beeline DNS), ping 77.88.8.8 3/3 and 1.1.1.1 3/3, HTTP ya.ru 302, HTTPS google 204 + 1.1.1.1 trace 200;
  STOP 4.0–4.6 s: bearer disconnected, routes/address removed, 0/8 wwan UP, MM/qmi-proxy/rmtfs gone, BAM-DMUX suspended, MSS offline; NCM ping OK.
 - All 6 harness cycles + 5 debug starts (11 MSS boots/stops in one boot): Failed to resume/-110/-22/EAGAIN/crash/fatal/watchdog/Oops = 0; `Channel already open: 0..7` on every MSS boot
  after the first (as on JZ02, harmless); eMMC writes_completed 0 / sectors_written 0; modemst1/2, fsg, fsc, persist == boot == B2 references; 30/30 eMMC devices getro=1.
 - **Blocker:** attach after MSS restart strictly alternates: c1 PASS, c2 FAIL, c3 PASS, c4 FAIL, c5 PASS, c6 FAIL (and the same across the earlier debug starts). FAIL = 250-99 LTE 'limited', PS detached,
  `not-registered-searching` / `registration-denied`, Forbidden no — the session 21 signature. Not fixed by explicit detach (c3→c4) or by 120 s re-attach holdoff (c5→c6).
  Every attach right after a successful session was rejected; every attach right after a rejected one succeeded.
  Hypothesis (not proven): "amnesic EFS" — with rmtfs -r, each rmtfs restart discards the RAM shadow (modem_fs2 write after attach), so every MSS boot presents the stale NAS context from disk
  (GUTI/KSI/NAS COUNT); the MME rejects it while it still holds the newer context, and a reject clears it. EMM reject cause not obtained (QMI GET has none).
 - Board final state: controller OFF, MSS offline, rmtfs/MM not running (udevd/dbus/polkitd left running), wwan all DOWN, USB NCM OK.
--- a/README.md
+++ b/README.md
@ -0,0 +1,87 @@
 # uzbek-plus — Project Aurora: mainline ARM64 Linux на LTE-модеме JZ08AU (MSM8916)
 Плата **JZ08AU-XPA-7J-R3** («Aurora»): Qualcomm MSM8916, 512 MiB RAM, eMMC 3.64 GiB, LTE-модем, Wi-Fi, дисплей.
 Стоковая прошивка — Android 4.4 (ядро 3.10). Здесь — журнал и воспроизводимые материалы перевода платы на
 **mainline Linux 7.2.7 arm64**, который загружается автономно с eMMC и поднимает LTE через ModemManager.
 > **Это не прошивка «скачай и залей».** Всё, что касается записи во flash, делалось на одном конкретном экземпляре,
 > по одной стадии, с backup и readback-сверкой. Перед любой записью сделайте и проверьте **полный backup СВОЕГО устройства**
 > (см. [docs/QUICKSTART.md](docs/QUICKSTART.md)). Никогда не прошивайте NV/EFS-разделы (`modemst1`, `modemst2`, `fsg`, `fsc`, `persist`)
 > с другого устройства — там калибровки RF и идентификаторы конкретного модема.
 ## Статус (2026-09-30)
 | Подсистема | Статус |
 |---|---|
 | ARM64 Linux (7.2.7, PSCI, 4 CPU) | PASS |
 | eMMC (HS200, строго read-only в Linux) | PASS |
 | USB NCM (gadget, 172.16.42.1/24) | PASS |
 | MPSS (modem remoteproc, rmtfs `-r`) | PASS |
 | QMI (rpmsg wwan ctrl) | PASS |
 | BAM-DMUX (wwan0) | PASS |
 | LTE registration | PASS |
 | LTE Internet (DNS/ICMP/HTTP/HTTPS) | PASS |
 | Direct boot с eMMC без хоста (B5) | **PASS / CLOSED** |
 | B6 — автоматический lifecycle модема | **IN PROGRESS** (см. ниже) |
 | Wi-Fi (WCNSS) | TODO |
 | Router stack (NAT/firewall/VPN) | TODO |
 | Дисплей в Linux | TODO |
 | Батарея / зарядка | TODO |
 ## Рабочая цепочка загрузки (baseline B5)
 ```
 Power → stock SBL1 → DB410c TZ (TZ.BF.3.0) → qhypstub → lk1st (aboot, autoboot)
      → cache: ext2 + extlinux/extlinux.conf → golden mm1 (Image.gz + DTB + initramfs) → ARM64 Linux
 Fallback: extlinux не найден / не парсится / не грузится → Android boot image из раздела boot (emmc1 rescue)
 ```
 Текущее содержимое flash на референсной плате (sha256, первые 8 hex):
 | раздел | содержимое | sha256 |
 |---|---|---|
 | sbl1, rpm, DDR, sec | stock (не менялись) | sbl1 `6a661ec9`, rpm `5a9b857b` |
 | GPT | stock + tz 512K→1M, tzbak перенесён в свободный промежуток @LBA 305184 | primary `6e850a5d`, backup `795952a1` |
 | tz | DB410c TZ.BF.3.0-00714, дополнен нулями до 1 MiB | `8481892f` |
 | hyp | qhypstub, до 512 KiB | `1a963047` |
 | aboot | lk1st (lk2nd 23.1) autoboot, подписан qtestsign, до 1 MiB | `3b8cd266` |
 | boot | emmc1 rescue image (+ нули до 16 MiB) | `e9579f33` |
 | cache | ext2 + extlinux + точный golden mm1 | `409bbb11` |
 | recovery | lk2nd 23.1 (fastboot) | `0dfa60a0` |
 | modem, NV/EFS, persist, system, userdata | не менялись (Linux монтирует modem FAT только RO) | — |
 Golden mm1 (Android boot image, для `fastboot boot`): `aurora-mm1.img` sha256 `38c960ef…`, ядро `7.2.7-aurora-bam1 #5`.
 Все хэши целиком: `b5a/SHA256SUMS`, `b5b/SHA256SUMS`, `bootchain-migration/SHA256SUMS`, `linux/*/SHA256SUMS`, [docs/BLOBS.md](docs/BLOBS.md).
 ## B6 — lifecycle модема (IN PROGRESS)
 RAM-only контроллер `b6/aurora-modem start|stop|status` (rmtfs `-r -P -s` → MPSS → QMI → SIM → online → регистрация →
 ModemManager → bearer → только /32-маршруты; стоп: disconnect → detach → wwan down → MM stop → BAM-DMUX idle → MPSS stop → rmtfs последним).
 Полные циклы start→data→stop проходят чисто (0 ошибок BAM-DMUX/remoteproc, 0 записей eMMC, NV не меняются), **но** повторная
 регистрация в сети после перезапуска MPSS в одном boot чередуется PASS/FAIL (`limited` / `registration-denied`).
 Гипотеза (не доказана): с `rmtfs -r` модем при каждом старте теряет EFS-контекст NAS. Подробности — NOTES.md, сессия 28.
 ## Структура репозитория
 | путь | что |
 |---|---|
 | [NOTES.md](NOTES.md) | подробный журнал всех сессий (sanitized) |
 | [docs/QUICKSTART.md](docs/QUICKSTART.md) | порядок действий для второго устройства |
 | [docs/RECOVERY.md](docs/RECOVERY.md) | аппаратный EDL, откаты |
 | [docs/BUILD.md](docs/BUILD.md) | как пересобрать lk1st/lk2nd, ядро, DTB, initramfs, boot image, cache-образ |
 | [docs/BLOBS.md](docs/BLOBS.md) | проприетарные/device-specific файлы, которых **нет** в репозитории: имя, sha256, назначение, где взять свой |
 | `linux/` | DTS, фрагменты и полные kernel config, патч, init/скрипты initramfs, списки пакетов + APK sha256 |
 | `lk2nd-build/`, `b5a/` | запись сборки lk2nd/lk1st, config.h diff, скрипты записи/отката B5a |
 | `b5b/` | генератор ext2/extlinux-образа cache, эмулятор сканирования lk2nd (исходники + результаты) |
 | `bootchain-migration/` | preflight, write plan, редактор/валидатор GPT |
 | `b6/` | контроллер lifecycle модема (RAM-only прототип) и харнесс тестов |
 | `tools/` | утилиты: UART-логгер, Sahara probe, распаковка boot.img, sanitizer публикации |
 | `logs/` | sanitized логи: UART, QMI, ModemManager, EDL, результаты тестов |
 | `android/` | снимок стокового Android (getprop, gpio, input, leds, …), sanitized |
 ## Что намеренно не опубликовано
 Полные дампы eMMC и разделов, NV/EFS (`modemst1/2`, `fsg`, `fsc`), `persist`, `userdata`, файлы прошивки модема,
 стоковые SBL1/RPM/TZ/aboot/boot/recovery/system, Firehose-программер, DB410c TZ, собранные бинарники.
 Идентификаторы (IMEI, IMSI, ICCID, eMMC CID/serial, Sahara serial, MAC, номера сот, cookies) заменены на `<PLACEHOLDER>`.
 Как это сделано — `tools/publish-sanitize.py`; значения идентификаторов в репозиторий не попадают.
--- a/android/build.prop
+++ b/android/build.prop
@ -0,0 +1,279 @@
 # begin build properties
 # autogenerated by buildinfo.sh
 ro.build.id=KTU84P
 ro.build.display.id=KTU84P test-keys
 ro.build.version.incremental=eng.richal.20260709
 ro.build.version.sdk=19
 ro.build.version.codename=REL
 ro.build.version.release=4.4.4
 ro.build.date=2026年 07月 09日 星期四 12:27:08 CST
 ro.build.date.utc=1783571228
 ro.build.type=user
 ro.build.user=richal
 ro.build.host=msa2
 ro.build.tags=test-keys
 ro.product.board=msm8916
 ro.product.cpu.abi=armeabi-v7a
 ro.product.cpu.abi2=armeabi
 ro.product.manufacturer=unknown
 ro.product.locale.language=en
 ro.product.locale.region=US
 ro.wifi.channels=
 ro.board.platform=msm8916
 # ro.build.product is obsolete; use ro.product.device
 ro.build.product=msm8916_32_512
 # Do not try to parse ro.build.description or .fingerprint
 ro.build.description=msm8916_32_512-user 4.4.4 KTU84P eng.richal.20260709 test-keys
 ro.build.fingerprint=qcom/msm8916_32_512/msm8916_32_512:4.4.4/KTU84P/eng.richal.20260709:user/test-keys
 ro.build.characteristics=default
 persist.sys.language=en
 persist.sys.country=US
 persist.sys.timezone=Asia/Shanghai
 ro.product.locale.language=en
 ro.product.locale.region=CN
 ro.product.model=MIFI
 ro.product.brand=MIFI
 ro.product.name=MIFI
 ro.product.device=MIFI
 # end build properties
 #
 # from device/qcom/msm8916_32_512/system.prop
 #
 #
 # system.prop for msm8916
 #
 #rild.libpath=/system/lib/libreference-ril.so
 rild.libpath=/system/vendor/lib/libril-qc-qmi-1.so
 rild.libargs=-d /dev/smd0
 persist.rild.nitz_plmn=
 persist.rild.nitz_long_ons_0=
 persist.rild.nitz_long_ons_1=
 persist.rild.nitz_long_ons_2=
 persist.rild.nitz_long_ons_3=
 persist.rild.nitz_short_ons_0=
 persist.rild.nitz_short_ons_1=
 persist.rild.nitz_short_ons_2=
 persist.rild.nitz_short_ons_3=
 #remove cdma subscription selection menu
 #ril.subscription.types=NV,RUIM
 DEVICE_PROVISIONED=1
 # Start in cdma mode
 #default network mode set to lte
 ro.telephony.default_network=11
 #default cdma mode set to 0 - uim mode
 ro.telephony.default_cdma_sub=0
 #richal add enable modem restart not full android
 persist.sys.ssr.restart_level=modem
 persist.sys.ssr.enable_ramdumps=0
 # richal change dpi for small lcd
 ro.sf.lcd_density=114
 # richal disable screen lock
 ro.lockscreen.disable.default=true
 # richal add prop for sn write
 persist.sys.juzhen.sn=1
 # richal add prop for mifi and ufi device type
 # persist.sys.juzhen.type=ufi
 persist.sys.juzhen.type=mifi
 persist.sys.juzhen.ssid.prefix=4G-MIFI-
 # richal add prop for wifi hotspot initial password
 persist.sys.juzhen.wifi.password=1234567890
 # persist.sys.juzhen.wifi.password=12345678
 persist.sys.juzhen.ssid.pd=1234567890
 # richal add ssid suffix type:1-MAC;2-IMEI;3-SN
 persist.sys.juzhen.ssid.suffix=2
 persist.sys.juzhen.web.pd=admin
 persist.sys.juzhen.sim.pd=UFIadmin88888
 persist.sys.juzhen.soft.version=JZ_MIFI_LCD_COM_20260709
 # richal add prop for web imei update no ssid reopen
 persist.sys.imei.reboot=0
 # richal add prop to disable selinux
 ro.boot.selinux=disable
 debug.sf.hw=1
 debug.egl.hw=1
 debug.composition.type=c2d
 persist.hwc.mdpcomp.enable=true
 debug.mdpcomp.logs=0
 dalvik.vm.heapsize=36m
 dev.pm.dyn_samplingrate=1
 persist.demo.hdmirotationlock=false
 #ro.hdmi.enable=true
 #tunnel.decode=true
 #tunnel.audiovideo.decode=true
 #lpa.decode=false
 #lpa.use-stagefright=true
 #persist.speaker.prot.enable=false
 #
 # system props for the cne module
 #
 persist.cne.feature=4
 #
 # system props for the dpm module
 #
 persist.dpm.feature=0
 #system props for the MM modules
 media.stagefright.enable-player=true
 media.stagefright.enable-http=true
 media.stagefright.enable-aac=true
 media.stagefright.enable-qcp=true
 media.stagefright.enable-fma2dp=true
 media.stagefright.enable-scan=true
 mmp.enable.3g2=true
 media.aac_51_output_enabled=true
 #codecs:(PARSER_)AAC AC3 ASF AVI DTS 3G2 MP2TS QCP FLAC
 mm.enable.qcom_parser=168563
 #
 # system props for the data modules
 #
 ro.use_data_netmgrd=true
 persist.data.netmgrd.qos.enable=true
 #system props for time-services
 persist.timed.enable=true
 #
 # system prop for opengles version
 #
 # 196608 is decimal for 0x30000 to report version 3
 ro.opengles.version=196608
 # System property for cabl
 ro.qualcomm.cabl=0
 #
 # System props for telephony
 # System prop to turn on CdmaLTEPhone always
 telephony.lteOnCdmaDevice=0
 #Simulate sdcard on /data/media
 #
 persist.fuse_sdcard=true
 #
 #snapdragon value add features
 #
 ro.qc.sdk.audio.ssr=false
 ##fluencetype can be "fluence" or "fluencepro" or "none"
 ro.qc.sdk.audio.fluencetype=none
 persist.audio.fluence.voicecall=true
 persist.audio.fluence.voicerec=false
 persist.audio.fluence.speaker=true
 #Set for msm8916
 tunnel.audio.encode = false
 ro.config.low_ram=true
 #Buffer size in kbytes for compress offload playback
 audio.offload.buffer.size.kb=32
 #Enable offload audio video playback by default
 av.offload.enable=true
 #enable voice path for PCM VoIP by default
 use.voice.path.for.pcm.voip=true
 #
 #System property for FM transmitter
 #
 ro.fm.transmitter=false
 #enable dsp gapless mode by default
 audio.offload.gapless.enabled=true
 #Set composition for USB
 persist.sys.usb.config=diag,serial_smd,rmnet_bam,adb
 #Set read only default composition for USB
 ro.sys.usb.default.config=diag,serial_smd,rmnet_bam,adb
 #property to enable user to access Google WFD settings
 persist.debug.wfd.enable=1
 #propery to enable VDS WFD solution
 persist.hwc.enable_vds=1
 #enable low_ram property on low-tier devices
 ro.config.low_ram=true
 #disable atlas service on low-tier devices
 config.disable_atlas=true
 #reduce background apps limit to 16 on low-tier devices
 ro.sys.fw.bg_apps_limit=16
 #property to configure value of tile size and maxtile for swe
 swe.tile.width=128
 swe.tile.height=128
 swe.tile.maxtile=128
 ro.config.pppoe_enable=1
 #
 # ADDITIONAL_BUILD_PROPERTIES
 #
 persist.radio.multisim.config=ssss
 dalvik.vm.heapstartsize=5m
 dalvik.vm.heapgrowthlimit=48m
 dalvik.vm.heapsize=128m
 dalvik.vm.heaptargetutilization=0.75
 dalvik.vm.heapminfree=512k
 dalvik.vm.heapmaxfree=2m
 keyguard.no_require_sim=true
 ro.com.android.dataroaming=true
 ro.com.android.dateformat=MM-dd-yyyy
 ro.config.ringtone=Ring_Synth_04.ogg
 ro.config.notification_sound=pixiedust.ogg
 ro.carrier=unknown
 ro.config.alarm_alert=Alarm_Classic.ogg
 ro.vendor.extension_library=/vendor/lib/libqc-opt.so
 persist.radio.apm_sim_not_pwdn=1
 persist.sys.logkit.ctrlcode=1
 persist.sys.dalvik.vm.lib=libdvm.so
 net.bt.name=Android
 dalvik.vm.stack-trace-file=/data/anr/traces.txt
 persist.gps.qc_nlp_in_use=1
 persist.loc.nlp_name=com.qualcomm.services.location
 ro.gps.agps_provider=1
 ro.pip.gated=0
 persist.radio.calls.on.ims=0
 persist.radio.jbims=0
 persist.radio.csvt.enabled=false
 persist.radio.custom_ecc=1
 persist.radio.rat_on=combine
 persist.radio.mt_sms_ack=20
 #
 # Properties to overwrite (Default)
 #
 # disable "keep SIM alive" in LPM feature
 #persist.radio.apm_sim_not_pwdn=0
 # enable restoring mode_pref when manual select network with rat
 persist.radio.restore_mode_pref=1
 persist.env.c.phone.matchnum=11
 #
 # Properties to overwrite (Default)
 #
 # disable "keep SIM alive" in LPM feature
 #persist.radio.apm_sim_not_pwdn=0
 # enable restoring mode_pref when manual select network with rat
 persist.radio.restore_mode_pref=1
 persist.env.c.phone.matchnum=11
--- a/android/by-name.txt
+++ b/android/by-name.txt
@ -0,0 +1,27 @@
 lrwxrwxrwx root     root              1970-01-01 08:20 DDR -> /dev/block/mmcblk0p19
 lrwxrwxrwx root     root              1970-01-01 08:20 aboot -> /dev/block/mmcblk0p4
 lrwxrwxrwx root     root              1970-01-01 08:20 abootbak -> /dev/block/mmcblk0p5
 lrwxrwxrwx root     root              1970-01-01 08:20 boot -> /dev/block/mmcblk0p22
 lrwxrwxrwx root     root              1970-01-01 08:20 cache -> /dev/block/mmcblk0p25
 lrwxrwxrwx root     root              1970-01-01 08:20 fsc -> /dev/block/mmcblk0p16
 lrwxrwxrwx root     root              1970-01-01 08:20 fsg -> /dev/block/mmcblk0p20
 lrwxrwxrwx root     root              1970-01-01 08:20 hyp -> /dev/block/mmcblk0p10
 lrwxrwxrwx root     root              1970-01-01 08:20 hypbak -> /dev/block/mmcblk0p11
 lrwxrwxrwx root     root              1970-01-01 08:20 misc -> /dev/block/mmcblk0p15
 lrwxrwxrwx root     root              1970-01-01 08:20 modem -> /dev/block/mmcblk0p1
 lrwxrwxrwx root     root              1970-01-01 08:20 modemst1 -> /dev/block/mmcblk0p13
 lrwxrwxrwx root     root              1970-01-01 08:20 modemst2 -> /dev/block/mmcblk0p14
 lrwxrwxrwx root     root              1970-01-01 08:20 pad -> /dev/block/mmcblk0p12
 lrwxrwxrwx root     root              1970-01-01 08:20 persist -> /dev/block/mmcblk0p24
 lrwxrwxrwx root     root              1970-01-01 08:20 recovery -> /dev/block/mmcblk0p26
 lrwxrwxrwx root     root              1970-01-01 08:20 rpm -> /dev/block/mmcblk0p6
 lrwxrwxrwx root     root              1970-01-01 08:20 rpmbak -> /dev/block/mmcblk0p7
 lrwxrwxrwx root     root              1970-01-01 08:20 sbl1 -> /dev/block/mmcblk0p2
 lrwxrwxrwx root     root              1970-01-01 08:20 sbl1bak -> /dev/block/mmcblk0p3
 lrwxrwxrwx root     root              1970-01-01 08:20 sec -> /dev/block/mmcblk0p21
 lrwxrwxrwx root     root              1970-01-01 08:20 splash -> /dev/block/mmcblk0p18
 lrwxrwxrwx root     root              1970-01-01 08:20 ssd -> /dev/block/mmcblk0p17
 lrwxrwxrwx root     root              1970-01-01 08:20 system -> /dev/block/mmcblk0p23
 lrwxrwxrwx root     root              1970-01-01 08:20 tz -> /dev/block/mmcblk0p8
 lrwxrwxrwx root     root              1970-01-01 08:20 tzbak -> /dev/block/mmcblk0p9
 lrwxrwxrwx root     root              1970-01-01 08:20 userdata -> /dev/block/mmcblk0p27
--- a/android/cmdline.txt
+++ b/android/cmdline.txt
@ -0,0 +1 @@
 /system/bin/sh: cat: /proc/cmdline: Permission denied
--- a/android/cpuinfo.txt
+++ b/android/cpuinfo.txt
@ -0,0 +1,44 @@
 processor	: 0
 model name	: ARMv7 Processor rev 0 (v7l)
 BogoMIPS	: 38.40
 Features	: swp half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 evtstrm 
 CPU implementer	: 0x41
 CPU architecture: 7
 CPU variant	: 0x0
 CPU part	: 0xd03
 CPU revision	: 0
 processor	: 1
 model name	: ARMv7 Processor rev 0 (v7l)
 BogoMIPS	: 38.40
 Features	: swp half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 evtstrm 
 CPU implementer	: 0x41
 CPU architecture: 7
 CPU variant	: 0x0
 CPU part	: 0xd03
 CPU revision	: 0
 processor	: 2
 model name	: ARMv7 Processor rev 0 (v7l)
 BogoMIPS	: 38.40
 Features	: swp half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 evtstrm 
 CPU implementer	: 0x41
 CPU architecture: 7
 CPU variant	: 0x0
 CPU part	: 0xd03
 CPU revision	: 0
 processor	: 3
 model name	: ARMv7 Processor rev 0 (v7l)
 BogoMIPS	: 38.40
 Features	: swp half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 evtstrm 
 CPU implementer	: 0x41
 CPU architecture: 7
 CPU variant	: 0x0
 CPU part	: 0xd03
 CPU revision	: 0
 Hardware	: Qualcomm Technologies, Inc MSM8916
 Revision	: 0000
 Serial		: 0000000000000000
 Processor	: ARMv7 Processor rev 0 (v7l)
--- a/android/devices.txt
+++ b/android/devices.txt
@ -0,0 +1,73 @@
 Character devices:
  1 mem
 256 msm_rng
  2 pty
  3 ttyp
  4 /dev/vc/0
  4 tty
  5 /dev/tty
  5 /dev/console
  5 /dev/ptmx
  7 vcs
 10 misc
 13 input
 21 sg
 29 fb
 81 video4linux
 86 ch
 89 i2c
 108 ppp
 116 alsa
 128 ptm
 136 pts
 166 ttyACM
 180 usb
 188 ttyUSB
 189 usb_device
 216 rfcomm
 233 vm_bms
 234 avtimer
 235 jpeg0
 236 ttyGS
 237 ccid_bridge
 238 usbmon
 239 usb_ext_chg
 240 uio
 241 qseecom
 242 kgsl
 243 smdpkt
 244 dia
 245 smd
 246 ttyHSL
 247 subsys
 248 voice_svc
 249 bsg
 250 battery_data
 251 media
 252 rtc
 253 msm_sps
 254 msm_thermal_query
 Block devices:
  1 ramdisk
 259 blkext
  7 loop
  8 sd
 65 sd
 66 sd
 67 sd
 68 sd
 69 sd
 70 sd
 71 sd
 128 sd
 129 sd
 130 sd
 131 sd
 132 sd
 133 sd
 134 sd
 135 sd
 179 mmc
 253 zram
 254 device-mapper
--- a/android/dmesg.txt
+++ b/android/dmesg.txt
@ -0,0 +1 @@
 klogctl: Operation not permitted
--- a/android/dt-live.txt
+++ b/android/dt-live.txt
@ -0,0 +1,4 @@
 /sys/firmware/devicetree/base: No such file or directory
 /proc/device-tree: No such file or directory
 /system/bin/sh: cat: /proc/device-tree/model: No such file or directory
 /system/bin/sh: cat: /proc/device-tree/compatible: No such file or directory
--- a/android/fb.txt
+++ b/android/fb.txt
@ -0,0 +1,14 @@
 mdssfb_d0000
 U:128x128p-0
 128,256
 32
 512
 spi panel
 pu_en=0
 xalign=0
 walign=0
 ystart=0
 halign=0
 min_w=0
 min_h=0
 panel_name=st7735s wx144 128x128 command mode spi panel
--- a/android/fs-ls.txt
+++ b/android/fs-ls.txt
@ -0,0 +1,651 @@
 drwxr-xr-x root     root              1970-01-01 08:20 acct
 drwxrwx--- system   cache             1970-01-02 08:00 cache
 -rwxr-x--- root     root       292844 1970-01-01 08:00 charger
 dr-x------ root     root              1970-01-01 08:20 config
 lrwxrwxrwx root     root              1970-01-01 08:20 d -> /sys/kernel/debug
 drwxrwx--x system   system            1970-01-02 08:00 data
 -rw-r--r-- root     root          207 1970-01-01 08:00 default.prop
 drwxr-xr-x root     root              1970-01-01 08:20 dev
 lrwxrwxrwx root     root              1970-01-01 08:20 etc -> /system/etc
 -rw-r--r-- root     root         9093 1970-01-01 08:00 file_contexts
 dr-xr-x--- system   system            1970-01-01 08:00 firmware
 -rw-r----- root     root         1316 1970-01-01 08:00 fstab.qcom
 -rwxr-x--- root     root       179476 1970-01-01 08:00 init
 -rwxr-x--- root     root         2823 1970-01-01 08:00 init.class_main.sh
 -rwxr-x--- root     root         1171 1970-01-01 08:00 init.environ.rc
 -rwxr-x--- root     root         1730 1970-01-01 08:00 init.mdm.sh
 -rwxr-x--- root     root         7374 1970-01-01 08:00 init.qcom.class_core.sh
 -rwxr-x--- root     root         6920 1970-01-01 08:00 init.qcom.early_boot.sh
 -rwxr-x--- root     root        12466 1970-01-01 08:00 init.qcom.factory.sh
 -rwxr-x--- root     root        26376 1970-01-01 08:00 init.qcom.rc
 -rwxr-x--- root     root         6370 1970-01-01 08:00 init.qcom.sh
 -rwxr-x--- root     root         4561 1970-01-01 08:00 init.qcom.ssr.sh
 -rwxr-x--- root     root         2962 1970-01-01 08:00 init.qcom.syspart_fixup.sh
 -rwxr-x--- root     root        53658 1970-01-01 08:00 init.qcom.usb.rc
 -rwxr-x--- root     root         8256 1970-01-01 08:00 init.qcom.usb.sh
 -rwxr-x--- root     root         2247 1970-01-01 08:00 init.qti.carrier.rc
 -rwxr-x--- root     root        28234 1970-01-01 08:00 init.rc
 -rwxr-x--- root     root         5802 1970-01-01 08:00 init.target.rc
 -rwxr-x--- root     root         1795 1970-01-01 08:00 init.trace.rc
 -rwxr-x--- root     root         3915 1970-01-01 08:00 init.usb.rc
 drwxrwxr-x root     system            1970-01-01 08:20 mnt
 drwxrwx--x system   system            1970-01-01 08:00 persist
 dr-xr-xr-x root     root              1970-01-01 08:00 proc
 -rw-r--r-- root     root         2161 1970-01-01 08:00 property_contexts
 drwxr-xr-x root     root              1970-01-01 08:00 res
 drwx------ root     root              2026-04-14 19:23 root
 drwxr-x--- root     root              1970-01-01 08:00 sbin
 lrwxrwxrwx root     root              1970-01-01 08:20 sdcard -> /storage/emulated/legacy
 -rw-r--r-- root     root          656 1970-01-01 08:00 seapp_contexts
 -rw-r--r-- root     root        75088 1970-01-01 08:00 sepolicy
 d---r-x--- system   sdcard_r          1970-01-01 08:20 storage
 dr-xr-xr-x root     root              1970-01-01 08:20 sys
 drwxr-xr-x root     root              1970-01-01 08:00 system
 lrwxrwxrwx root     root              1970-01-01 08:20 tombstones -> /data/tombstones
 -rw-r--r-- root     root         9740 1970-01-01 08:00 ueventd.qcom.rc
 -rw-r--r-- root     root         4023 1970-01-01 08:00 ueventd.rc
 lrwxrwxrwx root     root              1970-01-01 08:20 vendor -> /system/vendor
 drwxr-xr-x root     root              2026-07-09 12:27 app
 drwxr-xr-x root     shell             2026-04-14 19:33 bin
 -rw-r--r-- root     root         7178 2026-07-09 12:28 build.prop
 drwxr-xr-x root     root              2026-07-09 12:28 etc
 drwxr-xr-x root     root              2026-04-14 19:30 fonts
 drwxr-xr-x root     root              2026-04-14 19:35 framework
 drwxr-xr-x root     root              2026-04-14 19:35 lib
 drwx------ root     root              1970-01-01 08:00 lost+found
 drwxr-xr-x root     root              2026-07-09 12:28 media
 drwxr-xr-x root     root              2026-07-09 12:27 priv-app
 drwxr-xr-x root     root              2026-04-14 19:27 tts
 drwxr-xr-x root     root              2026-04-14 19:27 usr
 drwxr-xr-x root     shell             2026-04-14 19:35 vendor
 drwxr-xr-x root     shell             2026-04-14 19:33 xbin
 -rwxr-xr-x root     shell       26368 2026-04-14 19:33 ATFWD-daemon
 -rwxr-xr-x root     shell        5396 2026-04-14 19:33 PktRspTest
 -rwxr-xr-x root     shell       30096 2026-04-14 19:27 StoreKeybox
 -rwxr-xr-x root     shell      108944 2026-04-14 19:33 adb
 -rwxr-xr-x root     shell        5564 2026-04-14 19:27 adsprpcd
 -rwxr-xr-x root     shell         210 2026-04-14 19:27 am
 -rwxr-xr-x root     shell        9488 2026-04-14 19:33 app_process
 -rwxr-xr-x root     shell       53588 2026-04-14 19:33 applypatch
 -rwxr-xr-x root     shell       17884 2026-04-14 19:33 atrace
 -rwxr-xr-x root     shell       13584 2026-04-14 19:33 audiod
 -rwxr-xr-x root     shell        9504 2026-04-14 19:33 blkid
 -rwxr-xr-x root     shell         199 2026-04-14 19:27 bmgr
 -rwxr-xr-x root     shell       25972 2026-04-14 19:33 bootanimation
 -rwxr-xr-x root     shell       21828 2026-04-14 19:33 brctl
 -rwxr-xr-x root     shell       34376 2026-04-14 19:33 bridgemgrd
 -rwxr-xr-x root     shell        9540 2026-04-14 19:33 btnvtool
 -rwxr-xr-x root     shell         156 2026-04-14 19:27 bu
 -rwxr-xr-x root     shell        5336 2026-04-14 19:33 bugreport
 -rwxr-xr-x root     shell       66784 2026-04-14 19:33 camera_test
 lrwxr-xr-x root     shell             2026-04-14 19:33 cat -> toolbox
 lrwxr-xr-x root     shell             2026-04-14 19:33 chcon -> toolbox
 lrwxr-xr-x root     shell             2026-04-14 19:33 chmod -> toolbox
 lrwxr-xr-x root     shell             2026-04-14 19:33 chown -> toolbox
 -rwxr-xr-x root     shell       21776 2026-04-14 19:33 clatd
 lrwxr-xr-x root     shell             2026-04-14 19:33 clear -> toolbox
 lrwxr-xr-x root     shell             2026-04-14 19:33 cmp -> toolbox
 -rwxr-xr-x root     shell      600084 2026-04-14 19:27 cnd
 -rwxr-xr-x root     shell         207 2026-04-14 19:27 content
 lrwxr-xr-x root     shell             2026-04-14 19:33 cp -> toolbox
 -rwxr-xr-x root     shell        9432 2026-04-14 19:33 cplay
 -rwxr-xr-x root     shell        9804 2026-04-14 19:33 crda
 -rwxr-xr-x root     shell       62744 2026-04-14 19:33 curl
 -rwxr-xr-x root     shell        9432 2026-04-14 19:33 dalvikvm
 lrwxr-xr-x root     shell             2026-04-14 19:33 date -> toolbox
 lrwxr-xr-x root     shell             2026-04-14 19:33 dd -> toolbox
 -rwxr-xr-x root     shell       25816 2026-04-14 19:33 debuggerd
 -rwxr-xr-x root     shell       62736 2026-04-14 19:33 dex2oat
 -rwxr-xr-x root     shell        9384 2026-04-14 19:33 dexopt
 lrwxr-xr-x root     shell             2026-04-14 19:33 df -> toolbox
 -rwxr-xr-x root     shell       66964 2026-04-14 19:33 dhcpcd
 -rwxr-xr-x root     shell        9380 2026-04-14 19:33 diag_callback_client
 -rwxr-xr-x root     shell       13620 2026-04-14 19:33 diag_dci_sample
 -rwxr-xr-x root     shell        5396 2026-04-14 19:33 diag_klog
 -rwxr-xr-x root     shell       18372 2026-04-14 19:33 diag_mdlog
 -rwxr-xr-x root     shell       13820 2026-04-14 19:33 diag_qshrink4_daemon
 -rwxr-xr-x root     shell       17968 2026-04-14 19:33 diag_socket_log
 -rwxr-xr-x root     shell        9752 2026-04-14 19:33 diag_uart_log
 lrwxr-xr-x root     shell             2026-04-14 19:33 dmesg -> toolbox
 -rwxr-xr-x root     shell      105796 2026-04-14 19:33 dnsmasq
 -rwxr-xr-x root     shell        5352 2026-04-14 19:27 dpmd
 -rwxr-xr-x root     shell       50448 2026-04-14 19:33 drmserver
 -rwxr-xr-x root     shell       58776 2026-04-14 19:33 ds_fmc_appd
 -rwxr-xr-x root     shell        9484 2026-04-14 19:33 dsdnsutil
 lrwxr-xr-x root     shell             2026-04-14 19:33 du -> toolbox
 -rwxr-xr-x root     shell       42268 2026-04-14 19:33 dumpstate
 -rwxr-xr-x root     shell        9436 2026-04-14 19:33 dumpsys
 -rwxr-xr-x root     shell       21856 2026-04-14 19:33 dun-server
 -rwxr-xr-x root     shell      122500 2026-04-14 19:33 e2fsck
 -rwxr-xr-x root     shell        5284 2026-04-14 19:33 ebtables
 -rwxr-xr-x root     shell       22184 2026-04-14 19:33 fm_qsoc_patches
 -rwxr-xr-x root     shell       13636 2026-04-14 19:33 fmconfig
 -rwxr-xr-x root     shell        5284 2026-04-14 19:33 fmfactorytest
 -rwxr-xr-x root     shell       13528 2026-04-14 19:33 fmfactorytestserver
 -rwxr-xr-x root     shell       34372 2026-04-14 19:33 fsck_msdos
 -rwxr-xr-x root     shell       58856 2026-04-14 19:33 ftmdaemon
 -rwxr-xr-x root     shell       35236 2026-04-14 19:33 garden_app
 lrwxr-xr-x root     shell             2026-04-14 19:33 getenforce -> toolbox
 lrwxr-xr-x root     shell             2026-04-14 19:33 getevent -> toolbox
 lrwxr-xr-x root     shell             2026-04-14 19:33 getprop -> toolbox
 lrwxr-xr-x root     shell             2026-04-14 19:33 getsebool -> toolbox
 -rwxr-xr-x root     shell       42392 2026-04-14 19:33 gpsone_daemon
 -rwxr-xr-x root     shell        9612 2026-04-14 19:33 gptest
 lrwxr-xr-x root     shell             2026-04-14 19:33 grep -> toolbox
 -rwxr-xr-x root     shell        9436 2026-04-14 19:33 gzip
 -rwxr-xr-x root     shell      129008 2026-04-14 19:33 hci_qcomm_init
 lrwxr-xr-x root     shell             2026-04-14 19:33 hd -> toolbox
 -rwxr-xr-x root     shell      322072 2026-04-14 19:33 hostapd
 -rwxr-xr-x root     shell       26096 2026-04-14 19:33 hostapd_cli
 lrwxr-xr-x root     shell             2026-04-14 19:33 id -> toolbox
 lrwxr-xr-x root     shell             2026-04-14 19:33 ifconfig -> toolbox
 lrwxr-xr-x root     shell             2026-04-14 19:33 iftop -> toolbox
 -rwxr-xr-x root     shell         194 2026-04-14 19:27 ime
 -rwxr-xr-x root     shell         201 2026-04-14 19:27 input
 lrwxr-xr-x root     shell             2026-04-14 19:33 insmod -> toolbox
 -rwxr-xr-x root     shell       30152 2026-04-14 19:33 installd
 lrwxr-xr-x root     shell             2026-04-14 19:33 ioctl -> toolbox
 lrwxr-xr-x root     shell             2026-04-14 19:33 ionice -> toolbox
 -rwxr-xr-x root     shell      165480 2026-04-14 19:33 ip
 -rwxr-xr-x root     shell      191532 2026-04-14 19:33 ip6tables
 -rwxr-xr-x root     shell      196324 2026-04-14 19:33 iptables
 -rwxr-xr-x root     shell        5284 2026-04-14 19:33 irsc_util
 -rwxr-xr-x root     shell      103784 2026-04-14 19:33 isdbtmmtest
 -rwxr-xr-x root     shell      105776 2026-04-14 19:33 keymaster_test
 -rwxr-xr-x root     shell       38268 2026-04-14 19:33 keystore
 lrwxr-xr-x root     shell             2026-04-14 19:33 kill -> toolbox
 -rwxr-xr-x root     shell       63596 2026-04-14 19:33 linker
 lrwxr-xr-x root     shell             2026-04-14 19:33 ln -> toolbox
 lrwxr-xr-x root     shell             2026-04-14 19:33 load_policy -> toolbox
 -rwxr-xr-x root     shell       21780 2026-04-14 19:33 loc_launcher
 -rwxr-xr-x root     shell       30148 2026-04-14 19:27 location-mq
 lrwxr-xr-x root     shell             2026-04-14 19:33 log -> toolbox
 -rwxr-xr-x root     shell       13584 2026-04-14 19:33 logcat
 -rwxr-xr-x root     shell       13604 2026-04-14 19:33 logwrapper
 -rwxr-xr-x root     shell      157420 2026-04-14 19:27 lowi-server
 lrwxr-xr-x root     shell             2026-04-14 19:33 ls -> toolbox
 lrwxr-xr-x root     shell             2026-04-14 19:33 lsmod -> toolbox
 lrwxr-xr-x root     shell             2026-04-14 19:33 lsof -> toolbox
 -rwxr-xr-x root     shell        9496 2026-04-14 19:33 make_ext4fs
 -rwxr-xr-x root     shell       83212 2026-04-14 19:33 mcDriverDaemon
 lrwxr-xr-x root     shell             2026-04-14 19:33 md5 -> toolbox
 -rwxr-xr-x root     shell      255336 2026-04-14 19:33 mdnsd
 -rwxr-xr-x root     shell         210 2026-04-14 19:27 media
 -rwxr-xr-x root     shell       13536 2026-04-14 19:33 mediaserver
 lrwxr-xr-x root     shell             2026-04-14 19:33 mkdir -> toolbox
 -rwxr-xr-x root     shell      157424 2026-04-14 19:33 mksh
 lrwxr-xr-x root     shell             2026-04-14 19:33 mkswap -> toolbox
 -rwxr-xr-x root     shell       95768 2026-04-15 12:28 mm-pp-daemon
 -rwxr-xr-x root     shell       58812 2026-04-15 12:28 mm-qcamera-app
 -rwxr-xr-x root     shell        9436 2026-04-15 12:28 mm-qcamera-daemon
 -rwxr-xr-x root     shell       13532 2026-04-15 12:28 mm-qjpeg-dec-test
 -rwxr-xr-x root     shell       13532 2026-04-15 12:28 mm-qjpeg-enc-test
 -rwxr-xr-x root     shell       17684 2026-04-14 19:33 mm-qomx-idec-test
 -rwxr-xr-x root     shell       21780 2026-04-14 19:33 mm-qomx-ienc-test
 -rwxr-xr-x root     shell       46388 2026-04-15 12:28 mm-vdec-omx-test
 -rwxr-xr-x root     shell       34076 2026-04-15 12:28 mm-venc-omx-test720p
 -rwxr-xr-x root     shell       17572 2026-04-15 12:28 mm-video-driver-test
 -rwxr-xr-x root     shell       13476 2026-04-15 12:28 mm-video-encdrv-test
 -rwxr-xr-x root     shell       38284 2026-04-14 19:33 mmi
 -rwxr-xr-x root     shell         217 2026-04-14 19:27 monkey
 lrwxr-xr-x root     shell             2026-04-14 19:33 mount -> toolbox
 -rwxr-xr-x root     shell       43376 2026-04-14 19:33 mpdecision
 -rwxr-xr-x root     shell       62912 2026-04-15 12:28 msm-vidc-test
 -rwxr-xr-x root     shell       17844 2026-04-14 19:33 mtpd
 lrwxr-xr-x root     shell             2026-04-14 19:33 mv -> toolbox
 -rwxr-xr-x root     shell        5284 2026-04-14 19:33 n_smux
 lrwxr-xr-x root     shell             2026-04-14 19:33 nandread -> toolbox
 -rwxr-xr-x root     shell        5284 2026-04-14 19:33 ndc
 -rwxr-s--- root     inet         5468 2026-04-14 19:33 netcfg
 -rwxr-xr-x root     shell      100032 2026-04-14 19:33 netd
 -rwxr-xr-x root     shell      235884 2026-04-15 12:28 netmgrd
 lrwxr-xr-x root     shell             2026-04-14 19:33 netstat -> toolbox
 lrwxr-xr-x root     shell             2026-04-14 19:33 newfs_msdos -> toolbox
 -rwxr-xr-x root     shell        5284 2026-04-14 19:33 nl_listener
 lrwxr-xr-x root     shell             2026-04-14 19:33 notify -> toolbox
 -rwxr-xr-x root     shell       79204 2026-04-14 19:33 oatdump
 -rwxr-xr-x root     root        26060 2026-04-14 19:33 ping
 -rwxr-xr-x root     shell       30420 2026-04-14 19:33 ping6
 -rwxr-xr-x root     shell         191 2026-04-14 19:27 pm
 -rwxr-xr-x root     shell       17712 2026-04-14 19:33 port-bridge
 -rwxr-xr-x root     shell      141856 2026-04-14 19:33 pppd
 lrwxr-xr-x root     shell             2026-04-14 19:33 printenv -> toolbox
 lrwxr-xr-x root     shell             2026-04-14 19:33 ps -> toolbox
 -rwxr-xr-x root     shell       25980 2026-04-14 19:33 ptt_socket_app
 -rwxr-xr-x root     shell       17800 2026-04-14 19:33 qcom-system-daemon
 -rwxr-xr-x root     shell      166384 2026-04-14 19:33 qmiproxy
 -rwxr-xr-x root     shell       84524 2026-04-15 12:28 qmuxd
 -rwxr-xr-x root     shell        9488 2026-04-14 19:33 qrngd
 -rwxr-xr-x root     shell        5336 2026-04-15 12:28 qrngp
 -rwxr-xr-x root     shell        5340 2026-04-14 19:33 qrngtest
 -rwxr-xr-x root     shell       21980 2026-04-15 12:28 qseecom_sample_client
 -rwxr-xr-x root     shell        9432 2026-04-14 19:33 qseecom_security_test
 -rwxr-xr-x root     shell        9568 2026-04-14 19:33 qseecomd
 -rwxr-xr-x root     shell      162700 2026-04-14 19:33 racoon
 -rwxr-xr-x root     shell       30024 2026-04-14 19:33 radish
 lrwxr-xr-x root     shell             2026-04-14 19:33 readlink -> toolbox
 -rwxr-xr-x root     shell        5284 2026-04-14 19:33 reboot
 -rwxr-xr-x root     shell        9780 2026-04-14 19:33 regdbdump
 lrwxr-xr-x root     shell             2026-04-14 19:33 renice -> toolbox
 -rwxr-xr-x root     shell         188 2026-04-14 19:27 requestsync
 lrwxr-xr-x root     shell             2026-04-14 19:33 restorecon -> toolbox
 -rwxr-xr-x root     shell       18492 2026-04-14 19:33 rfs_access
 -rwxr-xr-x root     shell        9492 2026-04-14 19:33 rild
 lrwxr-xr-x root     shell             2026-04-14 19:33 rm -> toolbox
 lrwxr-xr-x root     shell             2026-04-14 19:33 rmdir -> toolbox
 lrwxr-xr-x root     shell             2026-04-14 19:33 rmmod -> toolbox
 -rwxr-xr-x root     shell       15376 2026-04-15 12:28 rmnetcli
 -rwxr-xr-x root     shell       19336 2026-04-15 12:28 rmt_storage
 lrwxr-xr-x root     shell             2026-04-14 19:33 route -> toolbox
 -rwxr-x--- root     shell        9432 2026-04-14 19:33 run-as
 lrwxr-xr-x root     shell             2026-04-14 19:33 runcon -> toolbox
 -rwxr-xr-x root     shell       17624 2026-04-14 19:33 sapd
 -rwxr-xr-x root     shell        5284 2026-04-14 19:33 schedtest
 lrwxr-xr-x root     shell             2026-04-14 19:33 schedtop -> toolbox
 -rwxr-xr-x root     shell        9384 2026-04-14 19:33 screencap
 -rwxr-xr-x root     shell       17796 2026-04-14 19:33 screenrecord
 -rwxr-xr-x root     shell       38256 2026-04-14 19:33 screenshot
 -rwxr-xr-x root     shell       17624 2026-04-14 19:33 sdcard
 -rwxr-xr-x root     shell        9688 2026-04-14 19:33 sdptool
 lrwxr-xr-x root     shell             2026-04-14 19:33 sendevent -> toolbox
 -rwxr-xr-x root     shell        5336 2026-04-14 19:33 sensorservice
 -rwxr-xr-x root     shell        9436 2026-04-14 19:33 service
 -rwxr-xr-x root     shell        9588 2026-04-14 19:33 servicemanager
 lrwxr-xr-x root     shell             2026-04-14 19:33 setconsole -> toolbox
 lrwxr-xr-x root     shell             2026-04-14 19:33 setenforce -> toolbox
 lrwxr-xr-x root     shell             2026-04-14 19:33 setprop -> toolbox
 lrwxr-xr-x root     shell             2026-04-14 19:33 setsebool -> toolbox
 -rwxr-xr-x root     shell         178 2026-04-14 19:27 settings
 -rwxr-xr-x root     shell        5336 2026-04-14 19:33 setup_fs
 lrwxr-xr-x root     shell             2026-04-14 19:33 sh -> mksh
 lrwxr-xr-x root     shell             2026-04-14 19:33 sleep -> toolbox
 lrwxr-xr-x root     shell             2026-04-14 19:33 smd -> toolbox
 lrwxr-xr-x root     shell             2026-04-14 19:33 start -> toolbox
 lrwxr-xr-x root     shell             2026-04-14 19:33 stop -> toolbox
 -rwxr-xr-x root     shell       17680 2026-04-14 19:33 subsystem_ramdump
 -rwxr-xr-x root     shell        5284 2026-04-14 19:33 surfaceflinger
 -rwxr-xr-x root     shell         192 2026-04-14 19:27 svc
 lrwxr-xr-x root     shell             2026-04-14 19:33 swapoff -> toolbox
 lrwxr-xr-x root     shell             2026-04-14 19:33 swapon -> toolbox
 lrwxr-xr-x root     shell             2026-04-14 19:33 sync -> toolbox
 -rwxr-xr-x root     shell        5340 2026-04-15 12:28 syssn
 -rwxr-xr-x root     shell       67188 2026-04-15 12:28 tc
 -rwxr-xr-x root     shell        9492 2026-04-14 19:33 test_diag
 -rwxr-xr-x root     shell      220960 2026-04-15 12:28 thermal-engine
 -rwxr-xr-x root     shell       17688 2026-04-14 19:33 time_daemon
 -rwxr-xr-x root     shell        5336 2026-04-14 19:33 tinycap
 -rwxr-xr-x root     shell        9380 2026-04-14 19:33 tinymix
 -rwxr-xr-x root     shell        5284 2026-04-14 19:33 tinypcminfo
 -rwxr-xr-x root     shell        9432 2026-04-14 19:33 tinyplay
 -rwxr-xr-x root     shell      139024 2026-04-14 19:33 toolbox
 lrwxr-xr-x root     shell             2026-04-14 19:33 top -> toolbox
 lrwxr-xr-x root     shell             2026-04-14 19:33 touch -> toolbox
 -rwxr-xr-x root     shell        3814 2026-04-14 19:27 uiautomator
 lrwxr-xr-x root     shell             2026-04-14 19:33 umount -> toolbox
 lrwxr-xr-x root     shell             2026-04-14 19:33 uptime -> toolbox
 -rwxr-xr-x root     shell       21876 2026-04-15 12:28 usb_uicc_client
 -rwxr-xr-x root     shell        5284 2026-04-14 19:33 usbhub
 -rwxr-xr-x root     shell        5284 2026-04-14 19:33 usbhub_init
 -rwxr-xr-x root     shell        5284 2026-04-14 19:33 vdc
 -rwxr-xr-x root     shell       13596 2026-04-14 19:27 vm_bms
 lrwxr-xr-x root     shell             2026-04-14 19:33 vmstat -> toolbox
 -rwxr-xr-x root     shell       91780 2026-04-14 19:33 vold
 lrwxr-xr-x root     shell             2026-04-14 19:33 watchprops -> toolbox
 -rwxr-xr-x root     shell       35880 2026-04-14 19:33 wcnss_filter
 -rwxr-xr-x root     shell       13580 2026-04-14 19:33 wcnss_service
 -rwxr-xr-x root     shell        9432 2026-04-14 19:33 wdsdaemon
 lrwxr-xr-x root     shell             2026-04-14 19:33 wipe -> toolbox
 -rwxr-xr-x root     shell         190 2026-04-14 19:27 wm
 -rwxr-xr-x root     shell      899928 2026-04-14 19:33 wpa_supplicant
 -rwxr-xr-x root     shell      439884 2026-04-14 19:27 xtwifi-client
 -rwxr-xr-x root     shell       54736 2026-04-14 19:27 xtwifi-inet-agent
 drwxr-xr-x root     root              2026-04-14 19:27 crda
 -rw-r--r-- root     root         1332 2026-04-14 19:22 crtbegin_so.o
 -rw-r--r-- root     root          617 2026-04-14 19:22 crtend_so.o
 drwxr-xr-x root     root              2026-04-14 19:33 drm
 drwxr-xr-x root     root              2026-04-14 19:33 egl
 drwxr-xr-x root     root              2026-04-14 19:33 hw
 -rw-r--r-- root     root       332528 2026-04-14 19:33 libEGL.so
 -rw-r--r-- root     root         9220 2026-04-14 19:33 libETC1.so
 -rw-r--r-- root     root       185508 2026-04-14 19:33 libFFTEm.so
 -rw-r--r-- root     root       319876 2026-04-14 19:33 libGLES_trace.so
 -rw-r--r-- root     root        21460 2026-04-14 19:33 libGLESv1_CM.so
 -rw-r--r-- root     root        25556 2026-04-14 19:33 libGLESv2.so
 lrw-r--r-- root     root              2026-04-14 19:33 libGLESv3.so -> libGLESv2.so
 -rw-r--r-- root     root      8492932 2026-04-14 19:33 libLLVM.so
 -rw-r--r-- root     root        38092 2026-04-14 19:33 libMcClient.so
 -rw-r--r-- root     root        13420 2026-04-14 19:33 libMcRegistry.so
 -rw-r--r-- root     root        42092 2026-04-15 12:28 libOmxAacEnc.so
 -rw-r--r-- root     root        50284 2026-04-15 12:28 libOmxAmrEnc.so
 -rw-r--r-- root     root        16216 2026-04-14 19:33 libOmxCore.so
 -rw-r--r-- root     root        50284 2026-04-15 12:28 libOmxEvrcEnc.so
 -rw-r--r-- root     root        50284 2026-04-15 12:28 libOmxQcelp13Enc.so
 -rw-r--r-- root     root       214220 2026-04-15 12:28 libOmxVdec.so
 -rw-r--r-- root     root       214220 2026-04-15 12:28 libOmxVdecHevc.so
 -rw-r--r-- root     root       165020 2026-04-15 12:28 libOmxVenc.so
 -rw-r--r-- root     root         9328 2026-04-14 19:33 libOpenMAXAL.so
 -rw-r--r-- root     root         9328 2026-04-14 19:33 libOpenSLES.so
 -rw-r--r-- root     root         9272 2026-04-14 19:33 libQWiFiSoftApCfg.so
 -rw-r--r-- root     root       206664 2026-04-14 19:33 libRS.so
 -rw-r--r-- root     root       108524 2026-04-14 19:33 libRSCpuRef.so
 -rw-r--r-- root     root       148740 2026-04-14 19:33 libRSDriver.so
 -rw-r--r-- root     root        74908 2026-04-14 19:33 libRScpp.so
 -rw-r--r-- root     root         5128 2026-04-14 19:33 libSR_AudioIn.so
 -rw-r--r-- root     root       456108 2026-04-14 19:33 liballjoyn.so
 -rw-r--r-- root     root        58576 2026-04-14 19:33 libandroid.so
 -rw-r--r-- root     root       736420 2026-04-14 19:33 libandroid_runtime.so
 -rw-r--r-- root     root        84708 2026-04-14 19:33 libandroid_servers.so
 -rw-r--r-- root     root       132616 2026-04-14 19:33 libandroidfw.so
 -rw-r--r-- root     root      1017748 2026-04-14 19:33 libart-compiler.so
 -rw-r--r-- root     root      2179204 2026-04-14 19:33 libart.so
 -rw-r--r-- root     root        21508 2026-04-14 19:33 libaudio-resampler.so
 -rw-r--r-- root     root        17884 2026-04-14 19:33 libaudioeffect_jni.so
 -rw-r--r-- root     root       238932 2026-04-14 19:33 libaudioflinger.so
 -rw-r--r-- root     root        13428 2026-04-14 19:33 libaudioparameter.so
 -rw-r--r-- root     root         9220 2026-04-14 19:33 libaudioroute.so
 -rw-r--r-- root     root         9220 2026-04-14 19:33 libaudioutils.so
 -rw-r--r-- root     root         5072 2026-04-14 19:33 libbcc.sha1.so
 -rw-r--r-- root     root       136432 2026-04-14 19:33 libbcc.so
 -rw-r--r-- root     root       210124 2026-04-14 19:33 libbcinfo.so
 -rw-r--r-- root     root       177436 2026-04-14 19:33 libbinder.so
 -rw-r--r-- root     root         9268 2026-04-14 19:33 libbluedroid.so
 -rw-r--r-- root     root        98280 2026-04-14 19:33 libbluetooth_jni.so
 -rw-r--r-- root     root        17508 2026-04-14 19:33 libbson.so
 -rw-r--r-- root     root        29960 2026-04-14 19:33 libbt-hci.so
 -rw-r--r-- root     root         5220 2026-04-14 19:33 libbt-utils.so
 -rw-r--r-- root     root       310584 2026-04-14 19:33 libc.so
 -rw-r--r-- root     root        13420 2026-04-15 12:28 libc2dcolorconvert.so
 -rw-r--r-- root     root       214296 2026-04-14 19:33 libcamera_client.so
 -rw-r--r-- root     root        23332 2026-04-14 19:33 libcamera_metadata.so
 -rw-r--r-- root     root       509268 2026-04-14 19:33 libcameraservice.so
 -rw-r--r-- root     root        26368 2026-04-15 12:28 libchromatix_imx135_liveshot.so
 -rw-r--r-- root     root      1645820 2026-04-14 19:33 libchromium_net.so
 -rw-r--r-- root     root        17796 2026-04-15 12:28 libcimax_spi.so
 -rw-r--r-- root     root       174112 2026-04-14 19:31 libclcore.bc
 -rw-r--r-- root     root       188972 2026-04-14 19:31 libclcore_debug.bc
 -rw-r--r-- root     root       163792 2026-04-14 19:31 libclcore_neon.bc
 -rw-r--r-- root     root         5124 2026-04-14 19:33 libcnefeatureconfig.so
 -rw-r--r-- root     root        58572 2026-04-14 19:33 libcommon_time_client.so
 -rw-r--r-- root     root        21560 2026-04-14 19:33 libcompiler_rt.so
 -rw-r--r-- root     root         5220 2026-04-14 19:33 libconnectivitymanager.so
 -rw-r--r-- root     root        13412 2026-04-14 19:33 libcorkscrew.so
 -rw-r--r-- root     root       953184 2026-04-14 19:33 libcrypto.so
 -rw-r--r-- root     root         5168 2026-04-14 19:33 libctest.so
 -rw-r--r-- root     root       140580 2026-04-14 19:33 libcurl.so
 -rw-r--r-- root     root        38120 2026-04-14 19:33 libcutils.so
 -rw-r--r-- root     root       189776 2026-04-15 12:28 libdashplayer.so
 -rw-r--r-- root     root         5232 2026-04-14 19:33 libdefcontainer_jni.so
 -rw-r--r-- root     root        13368 2026-04-14 19:33 libdiskconfig.so
 -rw-r--r-- root     root         5168 2026-04-14 19:33 libdivxdrmdecrypt.so
 -rw-r--r-- root     root         9224 2026-04-14 19:33 libdl.so
 -rw-r--r-- root     root        91340 2026-04-14 19:33 libdrmframework.so
 -rw-r--r-- root     root        26036 2026-04-14 19:33 libdrmframework_jni.so
 -rw-r--r-- root     root       820664 2026-04-14 19:33 libdvm.so
 -rw-r--r-- root     root         5256 2026-04-14 19:33 libebt_802_3.so
 -rw-r--r-- root     root         9480 2026-04-14 19:33 libebt_among.so
 -rw-r--r-- root     root         9524 2026-04-14 19:33 libebt_arp.so
 -rw-r--r-- root     root         5300 2026-04-14 19:33 libebt_arpreply.so
 -rw-r--r-- root     root         9496 2026-04-14 19:33 libebt_ip.so
 -rw-r--r-- root     root         9364 2026-04-14 19:33 libebt_ip6.so
 -rw-r--r-- root     root         5316 2026-04-14 19:33 libebt_limit.so
 -rw-r--r-- root     root         5428 2026-04-14 19:33 libebt_log.so
 -rw-r--r-- root     root         5364 2026-04-14 19:33 libebt_mark.so
 -rw-r--r-- root     root         5240 2026-04-14 19:33 libebt_mark_m.so
 -rw-r--r-- root     root         5532 2026-04-14 19:33 libebt_nat.so
 -rw-r--r-- root     root         5356 2026-04-14 19:33 libebt_nflog.so
 -rw-r--r-- root     root         5272 2026-04-14 19:33 libebt_pkttype.so
 -rw-r--r-- root     root         5240 2026-04-14 19:33 libebt_redirect.so
 -rw-r--r-- root     root         5252 2026-04-14 19:33 libebt_standard.so
 -rw-r--r-- root     root         9564 2026-04-14 19:33 libebt_stp.so
 -rw-r--r-- root     root         5356 2026-04-14 19:33 libebt_ulog.so
 -rw-r--r-- root     root         5316 2026-04-14 19:33 libebt_vlan.so
 -rw-r--r-- root     root         5168 2026-04-14 19:33 libebtable_broute.so
 -rw-r--r-- root     root         5168 2026-04-14 19:33 libebtable_filter.so
 -rw-r--r-- root     root         5168 2026-04-14 19:33 libebtable_nat.so
 -rw-r--r-- root     root        46888 2026-04-14 19:33 libebtc.so
 -rw-r--r-- root     root         9368 2026-04-14 19:33 libeffects.so
 -rw-r--r-- root     root       173172 2026-04-14 19:33 libexif.so
 -rw-r--r-- root     root        87248 2026-04-14 19:27 libexpat.so
 -rw-r--r-- root     root        28012 2026-04-14 19:33 libext2_blkid.so
 -rw-r--r-- root     root         9320 2026-04-14 19:33 libext2_com_err.so
 -rw-r--r-- root     root        18144 2026-04-14 19:33 libext2_e2p.so
 -rw-r--r-- root     root        13472 2026-04-14 19:33 libext2_profile.so
 -rw-r--r-- root     root         9272 2026-04-14 19:33 libext2_uuid.so
 -rw-r--r-- root     root       108096 2026-04-14 19:33 libext2fs.so
 -rw-r--r-- root     root        42084 2026-04-14 19:33 libext4_utils.so
 -rw-r--r-- root     root         9320 2026-04-14 19:33 libextendedremotedisplay.so
 -rw-r--r-- root     root        17412 2026-04-15 12:28 libexternal.so
 -rw-r--r-- root     root       107676 2026-04-14 19:33 libfilterfw.so
 -rw-r--r-- root     root         5128 2026-04-14 19:33 libfilterpack_imageproc.so
 -rw-r--r-- root     root       332972 2026-04-14 19:33 libft2.so
 -rw-r--r-- root     root        17516 2026-04-14 19:33 libgabi++.so
 -rw-r--r-- root     root        21616 2026-04-14 19:33 libgccdemangle.so
 -rw-r--r-- root     root        23328 2026-04-14 19:33 libgps.utils.so
 -rw-r--r-- root     root       255496 2026-04-14 19:33 libgui.so
 -rw-r--r-- root     root         5232 2026-04-14 19:33 libhardware.so
 -rw-r--r-- root     root        21700 2026-04-14 19:33 libhardware_legacy.so
 -rw-r--r-- root     root       296244 2026-04-14 19:33 libharfbuzz_ng.so
 -rw-r--r-- root     root       218920 2026-04-14 19:33 libhwui.so
 -rw-r--r-- root     root      1275308 2026-04-14 19:33 libicui18n.so
 -rw-r--r-- root     root      1021164 2026-04-14 19:33 libicuuc.so
 -rw-r--r-- root     root         9432 2026-04-14 19:33 libimscamera_jni.so
 -rw-r--r-- root     root        87308 2026-04-14 19:33 libinput.so
 -rw-r--r-- root     root       238748 2026-04-14 19:33 libinputservice.so
 -rw-r--r-- root     root        23768 2026-04-14 19:33 libiprouteutil.so
 -rw-r--r-- root     root       207524 2026-04-14 19:33 libjavacore.so
 -rw-r--r-- root     root        77564 2026-04-14 19:33 libjavacrypto.so
 -rw-r--r-- root     root        38588 2026-04-14 19:33 libjhead.so
 -rw-r--r-- root     root         9336 2026-04-14 19:33 libjhead_jni.so
 -rw-r--r-- root     root       476540 2026-04-14 19:29 libjni_latinime.so
 -rw-r--r-- root     root       218676 2026-04-14 19:29 libjni_mosaic.so
 -rw-r--r-- root     root         9420 2026-04-14 19:33 libjni_pacprocessor.so
 -rw-r--r-- root     root        13412 2026-04-14 19:29 libjni_tinyplanet.so
 -rw-r--r-- root     root         5080 2026-04-14 19:33 libjnigraphics.so
 -rw-r--r-- root     root       218272 2026-04-14 19:33 libjpeg.so
 -rw-r--r-- root     root        38092 2026-04-14 19:33 libkeystore_binder.so
 -rw-r--r-- root     root       102488 2026-04-14 19:33 libloc_api_v02.so
 -rw-r--r-- root     root        36192 2026-04-14 19:33 libloc_core.so
 -rw-r--r-- root     root        17540 2026-04-14 19:33 libloc_ds_api.so
 -rw-r--r-- root     root       101168 2026-04-14 19:33 libloc_eng.so
 -rw-r--r-- root     root        17588 2026-04-14 19:33 libloc_xtra.so
 -rw-r--r-- root     root        13432 2026-04-14 19:33 liblog.so
 -rw-r--r-- root     root         9316 2026-04-14 19:33 liblogwrap.so
 -rw-r--r-- root     root        99532 2026-04-14 19:33 libm.so
 -rw-r--r-- root     root        21604 2026-04-14 19:33 libmdnssd.so
 -rw-r--r-- root     root       570664 2026-04-14 19:33 libmedia.so
 -rw-r--r-- root     root       220972 2026-04-14 19:33 libmedia_jni.so
 -rw-r--r-- root     root        17564 2026-04-14 19:33 libmedialogservice.so
 -rw-r--r-- root     root       455972 2026-04-14 19:33 libmediaplayerservice.so
 -rw-r--r-- root     root        13516 2026-04-15 12:28 libmemalloc.so
 -rw-r--r-- root     root         5220 2026-04-14 19:33 libmemtrack.so
 -rw-r--r-- root     root        24616 2026-04-14 19:33 libminui.so
 -rw-r--r-- root     root        15796 2026-04-14 19:33 libmm-omxcore.so
 -rw-r--r-- root     root        79136 2026-04-15 12:28 libmm-qcamera.so
 -rw-r--r-- root     root        58592 2026-04-15 12:28 libmmcamera_interface.so
 -rw-r--r-- root     root        46180 2026-04-15 12:28 libmmjpeg_interface.so
 -rw-r--r-- root     root        74920 2026-04-14 19:33 libmtp.so
 -rw-r--r-- root     root        17508 2026-04-14 19:33 libnativehelper.so
 -rw-r--r-- root     root        25708 2026-04-14 19:33 libnbaio.so
 -rw-r--r-- root     root        13416 2026-04-14 19:33 libnetlink.so
 -rw-r--r-- root     root        21612 2026-04-14 19:33 libnetutils.so
 -rw-r--r-- root     root         5124 2026-04-14 19:33 libnfc_ndef.so
 -rw-r--r-- root     root        13368 2026-04-14 19:33 libnl_2.so
 -rw-r--r-- root     root         5128 2026-04-15 12:28 libnvrw.so
 -rw-r--r-- root     root        46348 2026-04-15 12:28 liboverlay.so
 -rw-r--r-- root     root      1930728 2026-04-14 19:33 libpac.so
 -rw-r--r-- root     root       129408 2026-04-14 19:33 libpixelflinger.so
 -rw-r--r-- root     root       124072 2026-04-14 19:33 libpng.so
 -rw-r--r-- root     root         9376 2026-04-14 19:33 libportable.so
 -rw-r--r-- root     root         5284 2026-04-14 19:33 libpower.so
 -rw-r--r-- root     root        13464 2026-04-14 19:33 libpowermanager.so
 -rw-r--r-- root     root        13692 2026-04-15 12:28 libqcomfm_jni.so
 -rw-r--r-- root     root         5124 2026-04-15 12:28 libqdMetaData.so
 -rw-r--r-- root     root        25804 2026-04-15 12:28 libqdutils.so
 -rw-r--r-- root     root         9324 2026-04-14 19:33 libqomx_core.so
 -rw-r--r-- root     root        34608 2026-04-14 19:33 libqsap_sdk.so
 -rw-r--r-- root     root        38092 2026-04-15 12:28 libqservice.so
 -rw-r--r-- root     root        29876 2026-04-14 19:33 libreference-ril.so
 -rw-r--r-- root     root        39592 2026-04-14 19:33 libril.so
 -rw-r--r-- root     root         5128 2026-04-14 19:33 librilutils.so
 -rw-r--r-- root     root        10724 2026-04-15 12:28 librmnetctl.so
 -rw-r--r-- root     root        31204 2026-04-14 19:33 librs_jni.so
 -rw-r--r-- root     root       103912 2026-04-14 19:33 librtp_jni.so
 -rw-r--r-- root     root        46388 2026-04-14 19:33 libselinux.so
 -rw-r--r-- root     root        58576 2026-04-14 19:33 libsensorservice.so
 -rw-r--r-- root     root      2009016 2026-04-14 19:33 libskia.so
 -rw-r--r-- root     root        13316 2026-04-14 19:33 libsoftkeymaster.so
 -rw-r--r-- root     root       321340 2026-04-14 19:33 libsonivox.so
 -rw-r--r-- root     root         9500 2026-04-14 19:33 libsoundpool.so
 -rw-r--r-- root     root        17608 2026-04-14 19:33 libsparse.so
 -rw-r--r-- root     root        18964 2026-04-14 19:33 libspeexresampler.so
 -rw-r--r-- root     root       332136 2026-04-14 19:33 libsqlite.so
 -rw-r--r-- root     root        29796 2026-04-14 19:33 libsqlite_jni.so
 -rw-r--r-- root     root       249456 2026-04-14 19:33 libssl.so
 -rw-r--r-- root     root      1072536 2026-04-14 19:33 libstagefright.so
 -rw-r--r-- root     root        50232 2026-04-14 19:33 libstagefright_amrnb_common.so
 -rw-r--r-- root     root        21508 2026-04-14 19:33 libstagefright_avc_common.so
 -rw-r--r-- root     root        50392 2026-04-14 19:33 libstagefright_chromium_http.so
 -rw-r--r-- root     root         5128 2026-04-14 19:33 libstagefright_enc_common.so
 -rw-r--r-- root     root        66768 2026-04-14 19:33 libstagefright_foundation.so
 -rw-r--r-- root     root        91292 2026-04-14 19:33 libstagefright_httplive.so
 -rw-r--r-- root     root       103604 2026-04-14 19:33 libstagefright_omx.so
 -rw-r--r-- root     root       222632 2026-04-14 19:33 libstagefright_soft_aacdec.so
 -rw-r--r-- root     root       275624 2026-04-14 19:33 libstagefright_soft_aacenc.so
 -rw-r--r-- root     root        91308 2026-04-14 19:33 libstagefright_soft_amrdec.so
 -rw-r--r-- root     root        58476 2026-04-14 19:33 libstagefright_soft_amrnbenc.so
 -rw-r--r-- root     root       118376 2026-04-14 19:33 libstagefright_soft_amrwbenc.so
 -rw-r--r-- root     root       170212 2026-04-14 19:33 libstagefright_soft_flacenc.so
 -rw-r--r-- root     root        13372 2026-04-14 19:33 libstagefright_soft_g711dec.so
 -rw-r--r-- root     root        25812 2026-04-14 19:33 libstagefright_soft_gsmdec.so
 -rw-r--r-- root     root       111932 2026-04-14 19:33 libstagefright_soft_h264dec.so
 -rw-r--r-- root     root        91248 2026-04-14 19:33 libstagefright_soft_h264enc.so
 -rw-r--r-- root     root        62576 2026-04-14 19:33 libstagefright_soft_mp3dec.so
 -rw-r--r-- root     root        87152 2026-04-14 19:33 libstagefright_soft_mpeg4dec.so
 -rw-r--r-- root     root       119920 2026-04-14 19:33 libstagefright_soft_mpeg4enc.so
 -rw-r--r-- root     root        13372 2026-04-14 19:33 libstagefright_soft_rawdec.so
 -rw-r--r-- root     root        17468 2026-04-14 19:33 libstagefright_soft_vorbisdec.so
 -rw-r--r-- root     root       197880 2026-04-14 19:33 libstagefright_soft_vpxdec.so
 -rw-r--r-- root     root       234712 2026-04-14 19:33 libstagefright_soft_vpxenc.so
 -rw-r--r-- root     root       156880 2026-04-14 19:33 libstagefright_wfd.so
 -rw-r--r-- root     root         9272 2026-04-14 19:33 libstagefright_yuv.so
 -rw-r--r-- root     root         5228 2026-04-14 19:33 libstagefrighthw.so
 -rw-r--r-- root     root         5228 2026-04-14 19:33 libstdc++.so
 -rw-r--r-- root     root       210252 2026-04-14 19:33 libstlport.so
 -rw-r--r-- root     root       189708 2026-04-14 19:33 libsurfaceflinger.so
 -rw-r--r-- root     root         5176 2026-04-14 19:33 libsurfaceflinger_ddmconnection.so
 -rw-r--r-- root     root         9288 2026-04-14 19:33 libsuspend.so
 -rw-r--r-- root     root         5176 2026-04-14 19:33 libsync.so
 -rw-r--r-- root     root        21612 2026-04-14 19:33 libsysutils.so
 -rw-r--r-- root     root         5228 2026-04-14 19:33 libthread_db.so
 -rw-r--r-- root     root        13580 2026-04-14 19:33 libtinyalsa.so
 -rw-r--r-- root     root         9432 2026-04-14 19:33 libtinycompress.so
 -rw-r--r-- root     root        29976 2026-04-14 19:33 libtinyxml.so
 -rw-r--r-- root     root        29864 2026-04-14 19:33 libtinyxml2.so
 -rw-r--r-- root     root        38092 2026-04-14 19:33 libui.so
 -rw-r--r-- root     root         9272 2026-04-14 19:33 libusbhost.so
 -rw-r--r-- root     root        83164 2026-04-14 19:33 libutils.so
 -rw-r--r-- root     root        34000 2026-04-14 19:33 libvariablespeed.so
 -rw-r--r-- root     root       222364 2026-04-14 19:33 libvideoeditor_core.so
 -rw-r--r-- root     root        88224 2026-04-14 19:33 libvideoeditor_jni.so
 -rw-r--r-- root     root        17508 2026-04-14 19:33 libvideoeditor_osal.so
 -rw-r--r-- root     root        13324 2026-04-14 19:33 libvideoeditor_videofilters.so
 -rw-r--r-- root     root       119992 2026-04-14 19:33 libvideoeditorplayer.so
 -rw-r--r-- root     root         9220 2026-04-15 12:28 libvirtual.so
 -rw-r--r-- root     root       100472 2026-04-14 19:33 libvorbisidec.so
 -rw-r--r-- root     root         9460 2026-04-14 19:33 libvt_jni.so
 -rw-r--r-- root     root       368000 2026-04-14 19:33 libwebrtc_audio_coding.so
 -rw-r--r-- root     root       369944 2026-04-14 19:33 libwebrtc_audio_preprocessing.so
 -rw-r--r-- root     root     21175740 2026-04-14 19:35 libwebviewchromium.so
 -rw-r--r-- root     root         9432 2026-04-14 19:33 libwebviewchromium_plat_support.so
 -rw-r--r-- root     root       165136 2026-04-14 19:33 libwilhelm.so
 -rw-r--r-- root     root        13416 2026-04-14 19:33 libwpa_client.so
 -rw-r--r-- root     root       403368 2026-04-14 19:33 libxml2.so
 -rw-r--r-- root     root        95500 2026-04-14 19:27 libz.so
 drwxr-xr-x root     root              2026-07-09 12:28 modules
 drwxr-xr-x root     root              2026-04-14 19:33 soundfx
 drwxr-xr-x root     root              2026-04-14 19:33 ssl
 -rw-r--r-- root     root         4423 2026-04-14 19:27 MMI_PCBA.cfg
 -rw-r--r-- root     root       226597 2026-07-09 12:28 NOTICE.html.gz
 drwxr-xr-x root     root              2026-04-14 19:27 acdbdata
 -rw-r--r-- root     root          716 2026-04-14 19:27 adbkey.pub
 -rw-r--r-- root     root       590660 2026-07-09 12:28 apns-conf.xml
 -rw-r--r-- root     root       271006 2026-07-09 12:27 apns-conf.xml.bakforspec
 -rw-r--r-- root     root         5491 2026-04-14 19:27 audio_effects.conf
 -rw-r--r-- root     root         5000 2026-04-14 19:27 audio_policy.conf
 drwxr-xr-x root     root              2026-04-14 19:27 bluetooth
 -rw-r--r-- root     root        30438 2026-04-14 19:27 cacert_location.pem
 -rw-r--r-- root     root         3251 2026-04-14 19:27 capability.xml
 -rw-r--r-- root     root         4457 2026-07-09 12:28 cdma_call_conf.xml
 -rw-r--r-- root     root       989184 2026-07-09 12:28 cdrom_install.iso
 -rw-r--r-- root     root          650 2026-04-14 19:27 clatd.conf
 drwxr-xr-x root     root              2026-04-14 19:27 cne
 drwxr-xr-x root     root              2026-04-14 19:27 dhcpcd
 drwxr-xr-x root     root              2026-04-14 19:27 dpm
 -rw-r--r-- root     root         1362 2026-04-14 19:27 ethertypes
 -rw-r--r-- root     root        14420 2026-04-14 19:22 event-log-tags
 -rw-r--r-- root     root         5907 2026-04-14 19:27 fallback_fonts.xml
 drwxr-xr-x root     root              2026-04-14 19:27 firmware
 -rw-r--r-- root     root         1826 2026-04-14 19:27 flp.conf
 -rw-r--r-- root     root         8237 2026-04-14 19:27 ftm_test_config
 -rw-r--r-- root     root         2202 2026-04-14 19:27 gps.conf
 -rw-r--r-- root     root         1918 2026-04-14 19:27 hcidump.sh
 drwxr-xr-x root     root              2026-04-14 19:27 hostapd
 -rw-r--r-- root     root           25 2026-04-14 19:27 hosts
 -rw-r--r-- root     root         3222 2026-04-14 19:27 hsic.control.bt.sh
 -rw-r--r-- root     root         2767 2026-04-14 19:27 init.ath3k.bt.sh
 -rw-r--r-- root     root         1773 2026-04-14 19:27 init.crda.sh
 -rw-r--r-- root     root         4987 2026-04-14 19:27 init.qcom.audio.sh
 -rw-r--r-- root     root         9932 2026-04-14 19:27 init.qcom.bt.sh
 -rw-r--r-- root     root         3651 2026-04-14 19:27 init.qcom.coex.sh
 -rw-r--r-- root     root         1725 2026-04-14 19:27 init.qcom.efs.sync.sh
 -rw-r--r-- root     root         3083 2026-04-14 19:27 init.qcom.fm.sh
 -rw-r--r-- root     root         4023 2026-04-14 19:27 init.qcom.modem_links.sh
 -rw-r--r-- root     root        42322 2026-04-14 19:27 init.qcom.post_boot.sh
 -rw-r--r-- root     root         4891 2026-04-14 19:27 init.qcom.rootagent.sh
 -rw-r--r-- root     root         2767 2026-04-14 19:27 init.qcom.sdio.sh
 -rw-r--r-- root     root         2688 2026-04-14 19:27 init.qcom.uicc.sh
 -rw-r--r-- root     root        19064 2026-04-14 19:27 init.qcom.wifi.sh
 -rw-r--r-- root     root         4308 2026-04-14 19:27 izat.conf
 -rw-r--r-- root     root         2699 2026-04-14 19:27 listen_platform_info.xml
 drwxr-xr-x root     root              2026-04-14 19:27 logmask
 -rw-r--r-- root     root         1578 2026-04-14 19:27 lowi.conf
 -rw-r--r-- root     root         7900 2026-04-14 19:27 media_codecs.xml
 -rw-r--r-- root     root        23988 2026-04-14 19:27 media_profiles.xml
 -rw-r--r-- root     root        24782 2026-04-14 19:27 mixer_paths.xml
 -rw-r--r-- root     root        24819 2026-04-14 19:27 mixer_paths_mtp.xml
 -rw-r--r-- root     root         1308 2026-04-14 19:27 mkshrc
 drwxr-xr-x root     root              2026-04-14 19:27 mmi
 -rw-r--r-- root     root         4732 2026-04-14 19:27 mmi.cfg
 drwxr-xr-x root     root              2026-04-14 19:27 permissions
 drwxr-xr-x root     root              2026-04-14 19:33 ppp
 -rw-r--r-- root     root         3740 2026-04-14 19:27 qca6234-service.sh
 -rw-r--r-- root     root          177 2026-04-14 19:27 qcom.cfg
 -rw-r--r-- root     root         1809 2026-04-14 19:27 qlog-conf.xml
 -rw-r--r-- root     root          422 2026-04-14 19:27 quipc.conf
 -rw-r--r-- root     root       304926 2026-07-09 12:28 recovery-resource.dat
 -rw-r--r-- root     root         1341 2026-04-14 19:27 sap.conf
 -rw-r--r-- root     root          232 2026-04-14 19:27 sec_config
 drwxr-xr-x root     root              2026-04-14 19:30 security
 -rw-r--r-- root     root         1274 2026-07-09 12:28 spn-conf.xml
 -rw-r--r-- root     root         3418 2026-04-14 19:27 system_fonts.xml
 -rw-r--r-- root     root         1723 2026-04-14 19:27 vold.fstab
 -rw-r--r-- root     root        11278 2026-04-14 19:27 wfdconfig.xml
 -rw-r--r-- root     root        10485 2026-04-14 19:27 wfdconfigsink.xml
 -rw-r--r-- root     root         2855 2026-04-14 19:27 whitelist_appops.xml
 drwxr-xr-x root     root              2026-07-09 12:27 wifi
 -rw-r--r-- root     root         1265 2026-04-14 19:27 xtra_root_cert.pem
 -rw-r--r-- root     root         3471 2026-04-14 19:27 xtwifi.conf
 drwxr-xr-x root     shell             2026-04-14 19:22 CTA
 drwxr-xr-x root     shell             2026-04-14 19:22 ChinaMobile
 drwxr-xr-x root     shell             2026-04-14 19:22 ChinaTelecom
 drwxr-xr-x root     shell             2026-04-14 19:22 ChinaUnicom
 drwxr-xr-x root     shell             2026-04-14 19:27 Default
 drwxr-xr-x root     shell             2026-04-14 19:27 bin
 drwxr-xr-x root     shell             2026-04-14 19:27 etc
 drwxr-xr-x root     shell             2026-04-14 19:35 exclude
 drwxr-xr-x root     shell             2026-04-14 19:33 lib
 drwxr-xr-x root     shell             2026-04-14 19:22 modemconfig
 drwxr-xr-x root     shell             2026-04-14 19:22 overlay
 drwxr-xr-x root     shell             2026-07-09 12:28 speccfg
 opendir failed, Permission denied
 /firmware/image: Permission denied
--- a/android/getprop.txt
+++ b/android/getprop.txt
@ -0,0 +1,275 @@
 [DEVICE_PROVISIONED]: [1]
 [audio.offload.buffer.size.kb]: [32]
 [audio.offload.gapless.enabled]: [true]
 [av.offload.enable]: [true]
 [config.disable_atlas]: [true]
 [dalvik.vm.heapgrowthlimit]: [48m]
 [dalvik.vm.heapmaxfree]: [2m]
 [dalvik.vm.heapminfree]: [512k]
 [dalvik.vm.heapsize]: [128m]
 [dalvik.vm.heapstartsize]: [5m]
 [dalvik.vm.heaptargetutilization]: [0.75]
 [dalvik.vm.stack-trace-file]: [/data/anr/traces.txt]
 [debug.composition.type]: [c2d]
 [debug.egl.hw]: [1]
 [debug.force_rtl]: [0]
 [debug.mdpcomp.logs]: [0]
 [debug.sf.hw]: [1]
 [dev.bootcomplete]: [1]
 [dev.pm.dyn_samplingrate]: [1]
 [dolby.audio.sink.info]: [speaker]
 [gsm.current.phone-type]: [1]
 [gsm.network.type]: [Unknown]
 [gsm.operator.alpha]: []
 [gsm.operator.iso-country]: []
 [gsm.operator.isroaming]: [false]
 [gsm.operator.numeric]: []
 [gsm.sim.state]: [ABSENT]
 [gsm.version.baseband]: [PM.1.0.c7-00193-M8916EAAAANVZM-1]
 [gsm.version.ril-impl]: [Qualcomm RIL 1.0]
 [hw.cabl.version]: [1.1.20130401]
 [hw.cabl.yuv]: [0]
 [init.svc.adbd]: [running]
 [init.svc.atfwd]: [running]
 [init.svc.audiod]: [running]
 [init.svc.bootanim]: [stopped]
 [init.svc.carrier_switcher]: [stopped]
 [init.svc.cnd]: [stopped]
 [init.svc.config_bluetooth]: [stopped]
 [init.svc.copy_apps]: [running]
 [init.svc.debuggerd]: [running]
 [init.svc.dpmd]: [stopped]
 [init.svc.drm]: [running]
 [init.svc.fuse_sdcard1]: [running]
 [init.svc.fuse_uicc0]: [running]
 [init.svc.fuse_usbotg]: [running]
 [init.svc.healthd]: [running]
 [init.svc.installd]: [running]
 [init.svc.irsc_util]: [stopped]
 [init.svc.keystore]: [running]
 [init.svc.loc_launcher]: [running]
 [init.svc.media]: [running]
 [init.svc.mpdecision]: [running]
 [init.svc.netd]: [running]
 [init.svc.netmgrd]: [running]
 [init.svc.ppd]: [restarting]
 [init.svc.ptt_socket_app]: [running]
 [init.svc.qcamerasvr]: [running]
 [init.svc.qcom-RIDL]: [stopped]
 [init.svc.qcom-c_core-sh]: [stopped]
 [init.svc.qcom-c_main-sh]: [stopped]
 [init.svc.qcom-post-boot]: [stopped]
 [init.svc.qcom-sh]: [stopped]
 [init.svc.qcom-usb-sh]: [stopped]
 [init.svc.qcomsysd]: [running]
 [init.svc.qmuxd]: [running]
 [init.svc.qrngd]: [running]
 [init.svc.qrngp]: [stopped]
 [init.svc.qseecomd]: [running]
 [init.svc.rfs_access]: [running]
 [init.svc.ril-daemon]: [running]
 [init.svc.rmt_storage]: [running]
 [init.svc.sdcard]: [running]
 [init.svc.servicemanager]: [running]
 [init.svc.surfaceflinger]: [running]
 [init.svc.syssn]: [restarting]
 [init.svc.thermal-engine]: [running]
 [init.svc.time_daemon]: [running]
 [init.svc.ueventd]: [running]
 [init.svc.usb_uicc_daemon]: [stopped]
 [init.svc.usb_uicc_enable]: [stopped]
 [init.svc.vm_bms]: [running]
 [init.svc.vold]: [running]
 [init.svc.wcnss-service]: [running]
 [init.svc.zygote]: [running]
 [keyguard.no_require_sim]: [true]
 [media.aac_51_output_enabled]: [true]
 [media.stagefright.enable-aac]: [true]
 [media.stagefright.enable-fma2dp]: [true]
 [media.stagefright.enable-http]: [true]
 [media.stagefright.enable-player]: [true]
 [media.stagefright.enable-qcp]: [true]
 [media.stagefright.enable-scan]: [true]
 [mm.enable.qcom_parser]: [168563]
 [mmp.enable.3g2]: [true]
 [net.bt.name]: [Android]
 [net.change]: [net.qtaguid_enabled]
 [net.hostname]: [<ANDROID_HOSTNAME>]
 [net.qtaguid_enabled]: [1]
 [net.tcp.buffersize.default]: [4096,87380,110208,4096,16384,110208]
 [net.tcp.buffersize.edge]: [4093,26280,35040,4096,16384,35040]
 [net.tcp.buffersize.evdo]: [4094,87380,262144,4096,16384,262144]
 [net.tcp.buffersize.gprs]: [4092,8760,11680,4096,8760,11680]
 [net.tcp.buffersize.hsdpa]: [4094,87380,1220608,4096,16384,1220608]
 [net.tcp.buffersize.hspa]: [4094,87380,1220608,4096,16384,1220608]
 [net.tcp.buffersize.hspap]: [4094,87380,1220608,4096,16384,1220608]
 [net.tcp.buffersize.hsupa]: [4094,87380,1220608,4096,16384,1220608]
 [net.tcp.buffersize.lte]: [524288,1048576,2097152,262144,524288,1048576]
 [net.tcp.buffersize.umts]: [4094,87380,110208,4096,16384,110208]
 [net.tcp.buffersize.wifi]: [524288,2097152,4194304,262144,524288,1048576]
 [net.tcp.default_init_rwnd]: [60]
 [persist.audio.fluence.speaker]: [true]
 [persist.audio.fluence.voicecall]: [true]
 [persist.audio.fluence.voicerec]: [false]
 [persist.cne.feature]: [4]
 [persist.data.netmgrd.qos.enable]: [true]
 [persist.debug.wfd.enable]: [1]
 [persist.demo.hdmirotationlock]: [false]
 [persist.dpm.feature]: [0]
 [persist.env.c.phone.matchnum]: [11]
 [persist.fuse_sdcard]: [true]
 [persist.gps.qc_nlp_in_use]: [1]
 [persist.hwc.enable_vds]: [1]
 [persist.hwc.mdpcomp.enable]: [true]
 [persist.loc.nlp_name]: [com.qualcomm.services.location]
 [persist.radio.adb_log_on]: [0]
 [persist.radio.apm_sim_not_pwdn]: [1]
 [persist.radio.calls.on.ims]: [0]
 [persist.radio.csvt.enabled]: [false]
 [persist.radio.custom_ecc]: [1]
 [persist.radio.eons.enabled]: [false]
 [persist.radio.jbims]: [0]
 [persist.radio.mt_sms_ack]: [20]
 [persist.radio.multisim.config]: [ssss]
 [persist.radio.rat_on]: [combine]
 [persist.radio.restore_mode_pref]: [1]
 [persist.rild.nitz_long_ons_0]: []
 [persist.rild.nitz_long_ons_1]: []
 [persist.rild.nitz_long_ons_2]: []
 [persist.rild.nitz_long_ons_3]: []
 [persist.rild.nitz_plmn]: []
 [persist.rild.nitz_short_ons_0]: []
 [persist.rild.nitz_short_ons_1]: []
 [persist.rild.nitz_short_ons_2]: []
 [persist.rild.nitz_short_ons_3]: []
 [persist.service.bdroid.bdaddr]: []
 [persist.sys.country]: [US]
 [persist.sys.dalvik.vm.lib]: [libdvm.so]
 [persist.sys.imei.reboot]: [0]
 [persist.sys.juzhen.sim.pd]: [UFIadmin88888]
 [persist.sys.juzhen.sn]: [1]
 [persist.sys.juzhen.sncode]: [<VENDOR_SN>]
 [persist.sys.juzhen.soft.version]: [JZ_MIFI_LCD_COM_20260709]
 [persist.sys.juzhen.ssid.pd]: [1234567890]
 [persist.sys.juzhen.ssid.prefix]: [4G-MIFI-]
 [persist.sys.juzhen.ssid.suffix]: [2]
 [persist.sys.juzhen.type]: [mifi]
 [persist.sys.juzhen.web.pd]: [admin]
 [persist.sys.language]: [en]
 [persist.sys.logkit.ctrlcode]: [1]
 [persist.sys.profiler_ms]: [0]
 [persist.sys.ssr.enable_ramdumps]: [0]
 [persist.sys.ssr.restart_level]: [modem]
 [persist.sys.strict_op_enable]: [false]
 [persist.sys.timezone]: [Asia/Shanghai]
 [persist.sys.usb.config.extra]: [none]
 [persist.sys.usb.config]: [diag,serial_smd,rmnet_bam,adb]
 [persist.sys.whitelist]: [/system/etc/whitelist_appops.xml]
 [persist.timed.enable]: [true]
 [ril.ecclist]: [911,*911,#911,112,000,08,110,999,118,119,120,122]
 [ril.qcril_pre_init_lock_held]: [0]
 [rild.libargs]: [-d /dev/smd0]
 [rild.libpath]: [/system/vendor/lib/libril-qc-qmi-1.so]
 [ro.alarm_boot]: [false]
 [ro.allow.mock.location]: [0]
 [ro.baseband]: [msm]
 [ro.bluetooth.dun]: [true]
 [ro.bluetooth.hfp.ver]: [1.6]
 [ro.bluetooth.sap]: [true]
 [ro.board.platform]: [msm8916]
 [ro.boot.baseband]: [msm]
 [ro.boot.bootdevice]: [7824900.sdhci]
 [ro.boot.console]: [ttyHSL0]
 [ro.boot.emmc]: [true]
 [ro.boot.hardware]: [qcom]
 [ro.boot.selinux]: [disable]
 [ro.boot.serialno]: [<EMMC_SERIAL>]
 [ro.bootloader]: [unknown]
 [ro.bootmode]: [unknown]
 [ro.build.characteristics]: [default]
 [ro.build.date.utc]: [1783571228]
 [ro.build.date]: [2026年 07月 09日 星期四 12:27:08 CST]
 [ro.build.description]: [msm8916_32_512-user 4.4.4 KTU84P eng.richal.20260709 test-keys]
 [ro.build.display.id]: [KTU84P test-keys]
 [ro.build.fingerprint]: [qcom/msm8916_32_512/msm8916_32_512:4.4.4/KTU84P/eng.richal.20260709:user/test-keys]
 [ro.build.host]: [msa2]
 [ro.build.id]: [KTU84P]
 [ro.build.product]: [msm8916_32_512]
 [ro.build.tags]: [test-keys]
 [ro.build.type]: [user]
 [ro.build.user]: [richal]
 [ro.build.version.codename]: [REL]
 [ro.build.version.incremental]: [eng.richal.20260709]
 [ro.build.version.release]: [4.4.4]
 [ro.build.version.sdk]: [19]
 [ro.carrier]: [unknown]
 [ro.com.android.dataroaming]: [true]
 [ro.com.android.dateformat]: [MM-dd-yyyy]
 [ro.config.alarm_alert]: [Alarm_Classic.ogg]
 [ro.config.low_ram]: [true]
 [ro.config.notification_sound]: [pixiedust.ogg]
 [ro.config.pppoe_enable]: [1]
 [ro.config.ringtone]: [Ring_Synth_04.ogg]
 [ro.crypto.state]: [unencrypted]
 [ro.debuggable]: [0]
 [ro.factorytest]: [0]
 [ro.fm.transmitter]: [false]
 [ro.gps.agps_provider]: [1]
 [ro.hardware]: [qcom]
 [ro.lockscreen.disable.default]: [true]
 [ro.opengles.version]: [196608]
 [ro.pip.gated]: [0]
 [ro.product.board]: [msm8916]
 [ro.product.brand]: [MIFI]
 [ro.product.cpu.abi2]: [armeabi]
 [ro.product.cpu.abi]: [armeabi-v7a]
 [ro.product.device]: [MIFI]
 [ro.product.locale.language]: [en]
 [ro.product.locale.region]: [US]
 [ro.product.manufacturer]: [unknown]
 [ro.product.model]: [MIFI]
 [ro.product.name]: [MIFI]
 [ro.qc.sdk.audio.fluencetype]: [none]
 [ro.qc.sdk.audio.ssr]: [false]
 [ro.qualcomm.bluetooth.ftp]: [true]
 [ro.qualcomm.bluetooth.hfp]: [true]
 [ro.qualcomm.bluetooth.hsp]: [true]
 [ro.qualcomm.bluetooth.map]: [true]
 [ro.qualcomm.bluetooth.nap]: [true]
 [ro.qualcomm.bluetooth.opp]: [true]
 [ro.qualcomm.bluetooth.pbap]: [true]
 [ro.qualcomm.bt.hci_transport]: [smd]
 [ro.qualcomm.cabl]: [0]
 [ro.revision]: [0]
 [ro.ril.svdo]: [false]
 [ro.ril.svlte1x]: [false]
 [ro.runtime.firstboot]: [86420292]
 [ro.secure]: [1]
 [ro.serialno]: [<EMMC_SERIAL>]
 [ro.sf.lcd_density]: [114]
 [ro.sys.fw.bg_apps_limit]: [16]
 [ro.sys.usb.default.config]: [diag,serial_smd,rmnet_bam,adb]
 [ro.telephony.call_ring.multiple]: [false]
 [ro.telephony.default_cdma_sub]: [0]
 [ro.telephony.default_network]: [11]
 [ro.use_data_netmgrd]: [true]
 [ro.vendor.extension_library]: [/vendor/lib/libqc-opt.so]
 [ro.wifi.channels]: []
 [service.bootanim.exit]: [1]
 [swe.tile.height]: [128]
 [swe.tile.maxtile]: [128]
 [swe.tile.width]: [128]
 [sys.boot_completed]: [1]
 [sys.sysctl.extra_free_kbytes]: [192]
 [sys.usb.config]: [diag,serial_smd,rmnet_bam,adb]
 [sys.usb.state]: [diag,serial_smd,rmnet_bam,adb]
 [telephony.lteOnCdmaDevice]: [0]
 [tunnel.audio.encode]: [false]
 [usb_uicc.enabled]: [0]
 [usb_uicc.loading]: [1]
 [use.voice.path.for.pcm.voip]: [true]
 [vold.post_fs_data_done]: [1]
 [wifi.interface]: [wlan0]
 [wlan.driver.ath]: [0]
 [wlan.driver.config]: [/data/misc/wifi/WCNSS_qcom_cfg.ini]
 [wlan.driver.status]: [ok]
--- a/android/gpio.txt
+++ b/android/gpio.txt
@ -0,0 +1,31 @@
 GPIOs 581-612, platform/qcom,smp2pgpio-ssr-smp2p-4-out.19, master-kernel:
 GPIOs 613-644, platform/qcom,smp2pgpio-ssr-smp2p-4-in.18, slave-kernel:
 GPIOs 645-676, platform/qcom,smp2pgpio-ssr-smp2p-1-out.13, master-kernel:
 GPIOs 677-708, platform/qcom,smp2pgpio-ssr-smp2p-1-in.12, slave-kernel:
 GPIOs 709-740, platform/qcom,smp2pgpio-smp2p-4-out.16, smp2p:
 GPIOs 741-772, platform/qcom,smp2pgpio-smp2p-4-in.14, smp2p:
 GPIOs 773-804, platform/qcom,smp2pgpio-smp2p-1-out.10, smp2p:
 GPIOs 805-836, platform/qcom,smp2pgpio-smp2p-1-in.8, smp2p:
 GPIOs 837-868, platform/qcom,smp2pgpio-smp2p-7-out.6, smp2p:
 GPIOs 869-900, platform/qcom,smp2pgpio-smp2p-7-in.4, smp2p:
 GPIOs 901-901, spmi/qpnp-pin-de735200, pm8916-mpp:
 GPIOs 902-1023, platform/1000000.pinctrl, msm_tlmm_v4_gpio:
 gpio-903 (sim3_switch_gpio    ) out hi
 gpio-922 (sim_hotdet_gpio     ) out lo
 gpio-924 (sim1_switch_gpio    ) out lo
 gpio-925 (sim2_switch_gpio    ) out lo
 gpio-939 (key_f2              ) in  lo
 gpio-1009 (key_f3              ) in  hi
 gpio-1018 (disp_dc             ) in  hi
 gpio-1020 (disp_rst_n          ) in  hi
--- a/android/init-rc.txt
+++ b/android/init-rc.txt
@ -0,0 +1,302 @@
 -rwxr-x--- root     root         1171 1970-01-01 08:00 init.environ.rc
 -rwxr-x--- root     root        26376 1970-01-01 08:00 init.qcom.rc
 -rwxr-x--- root     root        53658 1970-01-01 08:00 init.qcom.usb.rc
 -rwxr-x--- root     root         2247 1970-01-01 08:00 init.qti.carrier.rc
 -rwxr-x--- root     root        28234 1970-01-01 08:00 init.rc
 -rwxr-x--- root     root         5802 1970-01-01 08:00 init.target.rc
 -rwxr-x--- root     root         1795 1970-01-01 08:00 init.trace.rc
 -rwxr-x--- root     root         3915 1970-01-01 08:00 init.usb.rc
 -rw-r--r-- root     root         9740 1970-01-01 08:00 ueventd.qcom.rc
 -rw-r--r-- root     root         4023 1970-01-01 08:00 ueventd.rc
 /system/bin/sh: cat: /init.environ.rc: Permission denied
 /system/bin/sh: cat: /init.qcom.rc: Permission denied
 /system/bin/sh: cat: /init.qcom.usb.rc: Permission denied
 /system/bin/sh: cat: /init.qti.carrier.rc: Permission denied
 /system/bin/sh: cat: /init.rc: Permission denied
 /system/bin/sh: cat: /init.target.rc: Permission denied
 /system/bin/sh: cat: /init.trace.rc: Permission denied
 /system/bin/sh: cat: /init.usb.rc: Permission denied
 # Copyright (c) 2012-2014, The Linux Foundation. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
 #     * Redistributions of source code must retain the above copyright
 #       notice, this list of conditions and the following disclaimer.
 #     * Redistributions in binary form must reproduce the above copyright
 #       notice, this list of conditions and the following disclaimer in the
 #       documentation and/or other materials provided with the distribution.
 #     * Neither the name of The Linux Foundation nor
 #       the names of its contributors may be used to endorse or promote
 #       products derived from this software without specific prior written
 #       permission.
 #
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
 # NON-INFRINGEMENT ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
 # CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 # EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 # PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
 # OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
 # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
 # OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
 # ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 #
 # the DIAG device node is not world writable/readable.
 /dev/diag                 0660   system     qcom_diag
 /dev/genlock              0666   system     system
 /dev/kgsl                 0666   system     system
 /dev/kgsl-3d0             0666   system     system
 /dev/kgsl-2d0             0666   root       root
 /dev/kgsl-2d1             0666   root       root
 /dev/ion                  0664   system     system
 /dev/rtc0                 0600   system     system
 /dev/smd0                 0660   system     system
 /dev/smd4                 0660   system     system
 /dev/smd_cxm_qmi          0640   radio      radio
 /dev/smd5                 0660   system     system
 /dev/smd6                 0660   system     system
 /dev/smd7                 0660   bluetooth  bluetooth
 /dev/ccid_bridge          0660   system     system
 #permissions for CSVT
 /dev/smd11                0660   radio      radio
 /dev/radio0               0640   system     system
 /dev/rfcomm0              0660   bluetooth  bluetooth
 /dev/ttyUSB0              0660   bluetooth  bluetooth
 /dev/smdcntl0             0640   radio      radio
 /dev/smdcntl1             0640   radio      radio
 /dev/smdcntl2             0640   radio      radio
 /dev/smdcntl3             0640   radio      radio
 /dev/smdcntl4             0640   radio      radio
 /dev/smdcntl5             0640   radio      radio
 /dev/smdcntl6             0640   radio      radio
 /dev/smdcntl7             0640   radio      radio
 /dev/smdcnt_rev0          0640   radio      radio
 /dev/smdcnt_rev1          0640   radio      radio
 /dev/smdcnt_rev2          0640   radio      radio
 /dev/smdcnt_rev3          0640   radio      radio
 /dev/smdcnt_rev4          0640   radio      radio
 /dev/smdcnt_rev5          0640   radio      radio
 /dev/smdcnt_rev6          0640   radio      radio
 /dev/smdcnt_rev7          0640   radio      radio
 /dev/smdcnt_rev8          0640   radio      radio
 /dev/smuxctl32            0640   radio      radio
 /dev/sdioctl0             0640   radio      radio
 /dev/sdioctl1             0640   radio      radio
 /dev/sdioctl2             0640   radio      radio
 /dev/sdioctl3             0640   radio      radio
 /dev/sdioctl4             0640   radio      radio
 /dev/sdioctl5             0640   radio      radio
 /dev/sdioctl6             0640   radio      radio
 /dev/sdioctl7             0640   radio      radio
 /dev/sdioctl8             0640   radio      radio
 /dev/rmnet_mux_ctrl       0640   radio      radio
 /dev/hsicctl0             0640   radio      radio
 /dev/hsicctl1             0640   radio      radio
 /dev/hsicctl2             0640   radio      radio
 /dev/hsicctl3             0640   radio      radio
 /dev/hsicctl4             0640   radio      radio
 /dev/hsicctl5             0640   radio      radio
 /dev/hsicctl6             0640   radio      radio
 /dev/hsicctl7             0640   radio      radio
 /dev/hsicctl8             0640   radio      radio
 /dev/hsicctl9             0640   radio      radio
 /dev/hsicctl10            0640   radio      radio
 /dev/hsicctl11            0640   radio      radio
 /dev/hsicctl12            0640   radio      radio
 /dev/hsicctl13            0640   radio      radio
 /dev/hsicctl14            0640   radio      radio
 /dev/hsicctl15            0640   radio      radio
 /dev/hsicctl16            0640   radio      radio
 /dev/mhi_pipe_14          0640   radio      radio
 /dev/mhi_pipe_16          0640   radio      radio
 /dev/mhi_pipe_32          0640   radio      radio
 /dev/video*               0660   system     camera
 /dev/media*               0660   system     camera
 /dev/v4l-subdev*          0660   system     camera
 /dev/qseecom              0660   system     drmrpc
 /dev/gemini0              0660   system     camera
 /dev/jpeg0                0660   system     camera
 /dev/jpeg1                0660   system     camera
 /dev/jpeg2                0660   system     camera
 /dev/adsprpc-smd          0664   system     system
 /dev/msm_camera/*         0660   system     camera
 /dev/gemini/              0660   system     camera
 /dev/mercury0             0660   system     camera
 /dev/msm_vidc_reg         0660   system     audio
 /dev/msm_vidc_dec         0660   system     audio
 /dev/msm_vidc_dec_sec     0660   system     audio
 /dev/msm_vidc_enc         0660   system     audio
 /dev/msm_rotator          0660   system     system
 /dev/hw_random            0600   root       root
 /dev/adsprpc-smd          0664   system     system
 #permissions for audio
 /dev/audio_slimslave      0660   system     audio
 /dev/msm_qcelp            0660   system     audio
 /dev/msm_evrc             0660   system     audio
 /dev/msm_wma              0660   system     audio
 /dev/msm_wmapro           0660   system     audio
 /dev/msm_amrnb            0660   system     audio
 /dev/msm_amrwb            0660   system     audio
 /dev/msm_amrwbplus        0660   system     audio
 /dev/msm_aac              0660   system     audio
 /dev/msm_multi_aac        0660   system     audio
 /dev/msm_aac_in           0660   system     audio
 /dev/msm_qcelp_in         0660   system     audio
 /dev/msm_evrc_in          0660   system     audio
 /dev/msm_amrnb_in         0640   system     audio
 /dev/msm_a2dp_in          0660   system     audio
 /dev/msm_ac3              0660   system     audio
 /dev/msm_acdb             0660   system     audio
 /dev/msm_cad              0660   system     audio
 /dev/msm_fm               0660   system     audio
 /dev/msm_mvs              0660   system     audio
 /dev/msm_pcm_lp_dec       0660   system     audio
 /dev/msm_preproc_ctl      0660   system     audio
 /dev/msm_rtac             0660   system     audio
 /dev/msm_voicememo        0660   system     audio
 /dev/radio0               0640   fm_radio   fm_radio
 /dev/smd3                 0660   bluetooth  net_bt_stack
 /dev/smd2                 0660   bluetooth  net_bt_stack
 /dev/ttyHSL1              0660   system     system
 /dev/ttyHS1               0660   system     system
 /dev/mdm                  0660   system     radio
 /sys/devices/virtual/smdpkt/smdcntl*       open_timeout   0664 radio radio
 /dev/sdio_tty_ciq_00      0660   system     system
 /dev/tty_sdio_00          0660   system     system
 /dev/ttyGS0               0660   system     system
 /dev/i2c-5                0660   media       media
 /dev/voice_svc            0660   system     audio
 # DVB devices
 /dev/dvb/adapter0/demux*  0440   media       media
 /dev/dvb/adapter0/dvr*    0660   media       media
 /dev/dvb/adapter0/video*  0660   media       media
 # Broadcast devices
 /dev/tsc_mux0             0660   media       media
 /dev/tsc_ci0              0660   media       media
 # sensors
 /sys/devices/i2c-12/12-*  pollrate_ms 0664 system system
 /sys/devices/f9925000.i2c/i2c-0/0-*                 enable         0660    input    system
 /sys/devices/f9925000.i2c/i2c-0/0-*                 poll_delay     0660    input    system
 /sys/devices/soc.0/78b6000.i2c/i2c-0/0-*            enable         0660    input    system
 /sys/devices/soc.0/78b6000.i2c/i2c-0/0-*            poll_delay     0660    input    system
 /sys/devices/virtual/optical_sensors/proximity      ps_adc         0660    input    system
 /sys/devices/virtual/optical_sensors/proximity      ps_poll_delay  0660    input    system
 /sys/devices/virtual/optical_sensors/lightsensor    ls_auto        0660    input    system
 /sys/devices/virtual/optical_sensors/lightsensor    ls_poll_delay  0660    input    system
 /sys/devices/virtual/input/input*                   poll           0660    input    system
 /sys/devices/virtual/input/input*                   pollrate_ms    0660    input    system
 # vm_bms
 /dev/vm_bms               0660   system     system
 /dev/battery_data         0660   system     system
 # wlan
 /dev/wcnss_wlan           0660   system     system
 /dev/wcnss_ctrl           0660   system     system
 #nfc permissions
 /dev/nfc-nci              0660    nfc         nfc
 /dev/assd                 0660    nfc         nfc
 # UIO devices
 /dev/uio0                 0660   system     system
 /dev/uio1                 0660   system     system
 /dev/uio2                 0660   system     system
 # ESOC devices
 /dev/subsys_esoc*         0640   system     radio
 /dev/null                 0666   root       root
 /dev/zero                 0666   root       root
 /dev/full                 0666   root       root
 /dev/ptmx                 0666   root       root
 /dev/tty                  0666   root       root
 /dev/random               0666   root       root
 /dev/urandom              0666   root       root
 /dev/ashmem               0666   root       root
 /dev/binder               0666   root       root
 # Anyone can read the logs, but if they're not in the "logs"
 # group, then they'll only see log entries for their UID.
 /dev/log/*                0666   root       log
 # the msm hw3d client device node is world writable/readable
 /dev/msm_hw3dc            0666   root       root
 # gpu driver for adreno200 is globally accessible
 /dev/kgsl                 0666   root       root
 # kms driver for drm based gpu
 /dev/dri/*                0666   root       graphics
 # these should not be world writable
 /dev/diag                 0660   radio      radio
 /dev/diag_arm9            0660   radio      radio
 /dev/android_adb          0660   adb        adb
 /dev/android_adb_enable   0660   adb        adb
 /dev/ttyMSM0              0600   bluetooth  bluetooth
 /dev/uhid                 0660   system     net_bt_stack
 /dev/uinput               0660   system     net_bt_stack
 /dev/alarm                0664   system     radio
 /dev/tty0                 0660   root       system
 /dev/graphics/*           0660   system     graphics
 /dev/msm_hw3dm            0660   system     graphics
 /dev/input/*              0660   root       input
 /dev/eac                  0660   root       audio
 /dev/cam                  0660   root       camera
 /dev/pmem                 0660   system     graphics
 /dev/pmem_adsp*           0660   system     audio
 /dev/pmem_camera*         0660   system     camera
 /dev/oncrpc/*             0660   root       system
 /dev/adsp/*               0660   system     audio
 /dev/snd/*                0660   system     audio
 /dev/mt9t013              0660   system     system
 /dev/msm_camera/*         0660   system     system
 /dev/akm8976_daemon       0640   compass    system
 /dev/akm8976_aot          0640   compass    system
 /dev/akm8973_daemon       0640   compass    system
 /dev/akm8973_aot          0640   compass    system
 /dev/bma150               0640   compass    system
 /dev/cm3602               0640   compass    system
 /dev/akm8976_pffd         0640   compass    system
 /dev/lightsensor          0640   system     system
 /dev/msm_pcm_out*         0660   system     audio
 /dev/msm_pcm_in*          0660   system     audio
 /dev/msm_pcm_ctl*         0660   system     audio
 /dev/msm_snd*             0660   system     audio
 /dev/msm_mp3*             0660   system     audio
 /dev/audience_a1026*      0660   system     audio
 /dev/tpa2018d1*           0660   system     audio
 /dev/msm_audpre           0660   system     audio
 /dev/msm_audio_ctl        0660   system     audio
 /dev/htc-acoustic         0660   system     audio
 /dev/vdec                 0660   system     audio
 /dev/q6venc               0660   system     audio
 /dev/snd/dsp              0660   system     audio
 /dev/snd/dsp1             0660   system     audio
 /dev/snd/mixer            0660   system     audio
 /dev/smd0                 0640   radio      radio
 /dev/qmi                  0640   radio      radio
 /dev/qmi0                 0640   radio      radio
 /dev/qmi1                 0640   radio      radio
 /dev/qmi2                 0640   radio      radio
 /dev/bus/usb/*            0660   root       usb
 /dev/mtp_usb              0660   root       mtp
 /dev/usb_accessory        0660   root       usb
 /dev/tun                  0660   system     vpn
 # CDMA radio interface MUX
 /dev/ts0710mux*           0640   radio      radio
 /dev/ppp                  0660   radio      vpn
 # sysfs properties
 /sys/devices/virtual/input/input*   enable      0660  root   input
 /sys/devices/virtual/input/input*   poll_delay  0660  root   input
 /sys/devices/virtual/usb_composite/*   enable      0664  root   system
--- a/android/input.txt
+++ b/android/input.txt
@ -0,0 +1,40 @@
 I: Bus=0000 Vendor=0000 Product=0000 Version=0000
 N: Name="qpnp_pon"
 P: Phys=qpnp_pon/input0
 S: Sysfs=/devices/virtual/input/input0
 U: Uniq=
 H: Handlers=kbd event0 
 B: PROP=10
 B: EV=3
 B: KEY=100000 0 8000000 0
 I: Bus=0019 Vendor=0001 Product=0001 Version=0100
 N: Name="gpio-keys"
 P: Phys=gpio-keys/input0
 S: Sysfs=/devices/soc.0/gpio_keys.63/input/input1
 U: Uniq=
 H: Handlers=kbd event1 
 B: PROP=0
 B: EV=3
 B: KEY=30000000 0
 I: Bus=0000 Vendor=0000 Product=0000 Version=0000
 N: Name="msm8x16-snd-card-mtp Button Jack"
 P: Phys=ALSA
 S: Sysfs=/devices/soc.0/sound.62/sound/card0/input2
 U: Uniq=
 H: Handlers=kbd event2 
 B: PROP=0
 B: EV=3
 B: KEY=1e 4 0 0 0 0 0 0 0
 I: Bus=0000 Vendor=0000 Product=0000 Version=0000
 N: Name="msm8x16-snd-card-mtp Headset Jack"
 P: Phys=ALSA
 S: Sysfs=/devices/soc.0/sound.62/sound/card0/input3
 U: Uniq=
 H: Handlers=event3 
 B: PROP=0
 B: EV=21
 B: SW=1c054
--- a/android/interrupts.txt
+++ b/android/interrupts.txt
@ -0,0 +1,81 @@
           CPU0       CPU1       CPU2       CPU3       
 20:       9008       1664       1113       3097       GIC  arch_timer
 35:          0          0          0          0       GIC  apps_wdog_bark
 39:          0          0          0          0       GIC  arch_mem_timer
 47:          3          0          0          0       GIC  cpr
 56:          0          0          0          0       GIC  modem
 57:       1222          0          0          0       GIC  qcom,smd-modem
 58:         10          0          0          0       GIC  qcom,smsm-modem
 59:          5          0          0          0       GIC  smp2p
 61:         11          0          0          0       GIC  sps
 65:        788          0          0          0       GIC  kgsl-3d0
 75:          0          0          0          0       GIC  msm_iommu_global_cfg_irq, msm_iommu_global_cfg_irq
 76:          0          0          0          0       GIC  msm_vidc
 82:          6          0          0          0       GIC  cci
 83:          0          0          0          0       GIC  csid
 84:          0          0          0          0       GIC  csid
 89:          2          0          0          0       GIC
 102:          0          0          0          0       GIC  msm_iommu_nonsecure_irq, msm_iommu_nonsecure_irq, msm_iommu_nonsecure_irq, msm_iommu_nonsecure_irq, msm_iommu_nonsecure_irq, msm_iommu_nonsecure_irq, msm_iommu_nonsecure_irq, msm_iommu_nonsecure_irq, msm_iommu_secure_irq, msm_iommu_secure_irq, msm_iommu_secure_irq, msm_iommu_secure_irq, msm_iommu_secure_irq, msm_iommu_secure_irq, msm_iommu_nonsecure_irq, msm_iommu_nonsecure_irq, msm_iommu_nonsecure_irq, msm_iommu_nonsecure_irq, msm_iommu_nonsecure_irq, msm_iommu_nonsecure_irq
 104:          0          0          0          0       GIC  MDSS
 110:          0          0          0          0       GIC  csiphy
 111:          0          0          0          0       GIC  csiphy
 130:          0          0          0          0       GIC  78b8000.spi
 155:       6066          0          0          0       GIC  mmc0
 166:       4531          0          0          0       GIC  msm_otg, msm_hsusb
 170:          5          0          0          0       GIC  7824900.sdhci
 172:          0          0          0          0       GIC  msm_otg
 174:        109          0          0          0       GIC  qcom,smd-wcnss
 175:          5          0          0          0       GIC  smp2p
 176:          0          0          0          0       GIC  qcom,smsm-wcnss
 177:         20          0          0          0       GIC  wcnss_wlan
 178:        410          0          0          0       GIC  wcnss_wlan
 181:          0          0          0          0       GIC  wcnss
 200:       2141          0          0          0       GIC  qcom,smd-rpm
 203:          0          0          0          0       GIC  601d0.qcom,mpm
 216:          0          0          0          0       GIC  tsens_interrupt
 222:          2          0          0          0       GIC  200f000.qcom,spmi
 239:          0          0          0          0       GIC  sps
 240:          0          0          0          0       GIC  1000000.pinctrl
 270:        151          0          0          0       GIC  sps
 273:          0          0          0          0       GIC  msm_iommu_nonsecure_irq
 274:          0          0          0          0       GIC  msm_iommu_nonsecure_irq
 288:          0          0          0          0  qpnp-int  qpnp_kpdpwr_status
 289:          0          0          0          0  qpnp-int  qpnp_resin_status
 290:          0          0          0          0  qpnp-int  qpnp_rtc_alarm
 292:          0          0          0          0  qpnp-int  pm8916_tz
 294:          1          0          0          0  qpnp-int  qpnp_adc_tm_high_interrupt
 295:          0          0          0          0  qpnp-int  qpnp_adc_tm_low_interrupt
 297:          0          0          0          0  qpnp-int  chg_failed
 298:          0          0          0          0  qpnp-int  fastchg
 299:          0          0          0          0  qpnp-int  vbatdet_lo
 300:          0          0          0          0  qpnp-int  batt_temp
 301:          0          0          0          0  qpnp-int  batt_pres
 302:          0          0          0          0  qpnp-int  usb_overtemp
 304:          0          0          0          0  qpnp-int  usbin_valid
 309:          1          0          0          0  qpnp-int  fifo_update_done
 310:          0          0          0          0  qpnp-int  fsm_state_change
 314:          0          0          0          0  qpnp-int  Elect Insert
 315:          0          0          0          0  qpnp-int  Button Release detect
 316:          0          0          0          0  qpnp-int  Button Press detect
 317:          0          0          0          0  qpnp-int  Elect Remove
 318:          0          0          0          0  qpnp-int  mbhc sw intr
 320:          0          0          0          0  qpnp-int  HPH_R OCP detect
 321:          0          0          0          0  qpnp-int  HPH_L OCP detect
 421:          0          0          0          0  smp2p_gpio  modem
 422:          1          0          0          0  smp2p_gpio  error_ready_interrupt
 423:          1          0          0          0  smp2p_gpio  modem
 424:          0          0          0          0  smp2p_gpio  modem
 453:          0          0          0          0  smp2p_gpio  wcnss
 454:          1          0          0          0  smp2p_gpio  error_ready_interrupt
 455:          1          0          0          0  smp2p_gpio  wcnss
 456:          0          0          0          0  smp2p_gpio  wcnss
 485:          0          0          0          0  msm_tlmm_v4_irq  key_f2
 486:          0          0          0          0  msm_tlmm_v4_irq  key_f3
 IPI0:          0         12          5          6  CPU wakeup interrupts
 IPI1:          0          0          0          0  Timer broadcast interrupts
 IPI2:       6255       7036       5295       4157  Rescheduling interrupts
 IPI3:         35        145        147        139  Function call interrupts
 IPI4:          5         28         17         18  Single function call interrupts
 IPI5:          0          0          0          0  CPU stop interrupts
 IPI6:          0          0          0          0  CPU backtrace
 Err:          0
--- a/android/leds.txt
+++ b/android/leds.txt
@ -0,0 +1,14 @@
 lrwxrwxrwx root     root              1970-01-01 08:20 lcd-backlight -> ../../devices/soc.0/1a00000.qcom,mdss_mdp/qcom,mdss_fb_primary.119/leds/lcd-backlight
 lrwxrwxrwx root     root              1970-01-01 08:20 lcd-bl -> ../../devices/soc.0/leds-qpnp-de736200/leds/lcd-bl
 lrwxrwxrwx root     root              1970-01-01 08:20 mmc0:: -> ../../devices/soc.0/7824900.sdhci/leds/mmc0::
 lrwxrwxrwx root     root              1970-01-01 08:20 sim1_switch_gpio -> ../../devices/soc.0/gpio-leds.64/leds/sim1_switch_gpio
 lrwxrwxrwx root     root              1970-01-01 08:20 sim2_switch_gpio -> ../../devices/soc.0/gpio-leds.64/leds/sim2_switch_gpio
 lrwxrwxrwx root     root              1970-01-01 08:20 sim3_switch_gpio -> ../../devices/soc.0/gpio-leds.64/leds/sim3_switch_gpio
 lrwxrwxrwx root     root              1970-01-01 08:20 sim_hotdet_gpio -> ../../devices/soc.0/gpio-leds.64/leds/sim_hotdet_gpio
 255
 40
 255
 255
 255
 255
 255
--- a/android/meminfo.txt
+++ b/android/meminfo.txt
@ -0,0 +1,33 @@
 MemTotal:         403480 kB
 MemFree:           40424 kB
 Buffers:            6020 kB
 Cached:           190416 kB
 SwapCached:            0 kB
 Active:           101792 kB
 Inactive:         180448 kB
 Active(anon):      85828 kB
 Inactive(anon):      280 kB
 Active(file):      15964 kB
 Inactive(file):   180168 kB
 Unevictable:           0 kB
 Mlocked:               0 kB
 SwapTotal:        196604 kB
 SwapFree:         196604 kB
 Dirty:                28 kB
 Writeback:             0 kB
 AnonPages:         85836 kB
 Mapped:            60004 kB
 Shmem:               324 kB
 Slab:              39684 kB
 SReclaimable:      20772 kB
 SUnreclaim:        18912 kB
 KernelStack:        5128 kB
 PageTables:         4720 kB
 NFS_Unstable:          0 kB
 Bounce:                0 kB
 WritebackTmp:          0 kB
 CommitLimit:      398344 kB
 Committed_AS:    4390652 kB
 VmallocTotal:     499712 kB
 VmallocUsed:       50600 kB
 VmallocChunk:     316948 kB
--- a/android/modules.txt
+++ b/android/modules.txt
@ -0,0 +1 @@
 wlan 3803637 0 - Live 0x00000000 (O)
--- a/android/mounts.txt
+++ b/android/mounts.txt
@ -0,0 +1,22 @@
 rootfs / rootfs ro,relatime 0 0
 tmpfs /dev tmpfs rw,nosuid,relatime,size=193740k,nr_inodes=48435,mode=755 0 0
 devpts /dev/pts devpts rw,relatime,mode=600 0 0
 proc /proc proc rw,relatime 0 0
 sysfs /sys sysfs rw,relatime 0 0
 debugfs /sys/kernel/debug debugfs rw,relatime 0 0
 none /acct cgroup rw,relatime,cpuacct 0 0
 none /sys/fs/cgroup tmpfs rw,relatime,size=193740k,nr_inodes=48435,mode=750,gid=1000 0 0
 tmpfs /mnt/asec tmpfs rw,relatime,size=193740k,nr_inodes=48435,mode=755,gid=1000 0 0
 tmpfs /mnt/obb tmpfs rw,relatime,size=193740k,nr_inodes=48435,mode=755,gid=1000 0 0
 none /dev/cpuctl cgroup rw,relatime,cpu 0 0
 adb /dev/usb-ffs/adb functionfs rw,relatime 0 0
 /dev/block/bootdevice/by-name/system /system ext4 ro,relatime,discard,data=ordered 0 0
 /dev/block/bootdevice/by-name/userdata /data ext4 rw,nosuid,nodev,relatime,discard,noauto_da_alloc,data=ordered 0 0
 /dev/block/bootdevice/by-name/cache /cache ext4 rw,nosuid,nodev,relatime,data=ordered 0 0
 /dev/block/bootdevice/by-name/persist /persist ext4 rw,nosuid,nodev,relatime,data=ordered 0 0
 /dev/block/bootdevice/by-name/modem /firmware vfat ro,relatime,uid=1000,gid=1000,fmask=0337,dmask=0227,codepage=437,iocharset=iso8859-1,shortname=lower,errors=remount-ro 0 0
 /dev/fuse /mnt/shell/emulated fuse rw,nosuid,nodev,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
 /dev/fuse /storage/sdcard1 fuse rw,nosuid,nodev,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
 /dev/fuse /storage/uicc0 fuse rw,nosuid,nodev,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
 /dev/fuse /storage/usbotg fuse rw,nosuid,nodev,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
 /dev/fuse /storage/emulated/legacy fuse rw,nosuid,nodev,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
--- a/android/net.txt
+++ b/android/net.txt
@ -0,0 +1,75 @@
 rev_rmnet7 DOWN                                   0.0.0.0/0   0x00001002 <MAC>
 rev_rmnet5 DOWN                                   0.0.0.0/0   0x00001002 <MAC>
 rev_rmnet6 DOWN                                   0.0.0.0/0   0x00001002 <MAC>
 rev_rmnet4 DOWN                                   0.0.0.0/0   0x00001002 <MAC>
 rev_rmnet2 DOWN                                   0.0.0.0/0   0x00001002 <MAC>
 rev_rmnet3 DOWN                                   0.0.0.0/0   0x00001002 <MAC>
 rev_rmnet8 DOWN                                   0.0.0.0/0   0x00001002 <MAC>
 rev_rmnet1 DOWN                                   0.0.0.0/0   0x00001002 <MAC>
 rev_rmnet0 DOWN                                   0.0.0.0/0   0x00001002 <MAC>
 rmnet1   DOWN                                   0.0.0.0/0   0x00000000 <MAC>
 rmnet0   DOWN                                   0.0.0.0/0   0x00000000 <MAC>
 rmnet7   DOWN                                   0.0.0.0/0   0x00000000 <MAC>
 rmnet5   DOWN                                   0.0.0.0/0   0x00000000 <MAC>
 rmnet6   DOWN                                   0.0.0.0/0   0x00000000 <MAC>
 rmnet4   DOWN                                   0.0.0.0/0   0x00000000 <MAC>
 rmnet2   DOWN                                   0.0.0.0/0   0x00000000 <MAC>
 rmnet3   DOWN                                   0.0.0.0/0   0x00000000 <MAC>
 dummy0   DOWN                                   0.0.0.0/0   0x00000082 <MAC>
 rmnet_usb0 DOWN                                   0.0.0.0/0   0x00001002 <MAC>
 sit0     DOWN                                   0.0.0.0/0   0x00000080 <MAC>
 lo       UP                                   127.0.0.1/8   0x00000049 <MAC>
 wlan0    UP                               192.168.100.1/24  0x00001043 <MAC>
 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
    link/loopback <MAC> brd <MAC>
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
 2: dummy0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN 
    link/ether <MAC> brd <MAC>
 3: rmnet0: <> mtu 2000 qdisc noop state DOWN qlen 1000
    link/[530] 
 4: rmnet1: <> mtu 2000 qdisc noop state DOWN qlen 1000
    link/[530] 
 5: rmnet2: <> mtu 2000 qdisc noop state DOWN qlen 1000
    link/[530] 
 6: rmnet3: <> mtu 2000 qdisc noop state DOWN qlen 1000
    link/[530] 
 7: rmnet4: <> mtu 2000 qdisc noop state DOWN qlen 1000
    link/[530] 
 8: rmnet5: <> mtu 2000 qdisc noop state DOWN qlen 1000
    link/[530] 
 9: rmnet6: <> mtu 2000 qdisc noop state DOWN qlen 1000
    link/[530] 
 10: rmnet7: <> mtu 2000 qdisc noop state DOWN qlen 1000
    link/[530] 
 11: rmnet_usb0: <BROADCAST,MULTICAST> mtu 2000 qdisc noop state DOWN qlen 1000
    link/ether <MAC> brd <MAC>
 12: rev_rmnet0: <BROADCAST,MULTICAST> mtu 2000 qdisc noop state DOWN qlen 1000
    link/ether <MAC> brd <MAC>
 13: rev_rmnet1: <BROADCAST,MULTICAST> mtu 2000 qdisc noop state DOWN qlen 1000
    link/ether <MAC> brd <MAC>
 14: rev_rmnet2: <BROADCAST,MULTICAST> mtu 2000 qdisc noop state DOWN qlen 1000
    link/ether <MAC> brd <MAC>
 15: rev_rmnet3: <BROADCAST,MULTICAST> mtu 2000 qdisc noop state DOWN qlen 1000
    link/ether <MAC> brd <MAC>
 16: rev_rmnet4: <BROADCAST,MULTICAST> mtu 2000 qdisc noop state DOWN qlen 1000
    link/ether <MAC> brd <MAC>
 17: rev_rmnet5: <BROADCAST,MULTICAST> mtu 2000 qdisc noop state DOWN qlen 1000
    link/ether <MAC> brd <MAC>
 18: rev_rmnet6: <BROADCAST,MULTICAST> mtu 2000 qdisc noop state DOWN qlen 1000
    link/ether <MAC> brd <MAC>
 19: rev_rmnet7: <BROADCAST,MULTICAST> mtu 2000 qdisc noop state DOWN qlen 1000
    link/ether <MAC> brd <MAC>
 20: rev_rmnet8: <BROADCAST,MULTICAST> mtu 2000 qdisc noop state DOWN qlen 1000
    link/ether <MAC> brd <MAC>
 21: sit0: <NOARP> mtu 1480 qdisc noop state DOWN 
    link/sit 0.0.0.0 brd 0.0.0.0
 22: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
    link/ether <MAC> brd <MAC>
    inet 192.168.100.1/24 brd 192.168.100.255 scope global wlan0
       valid_lft forever preferred_lft forever
    inet6 fe80::2ee:f2ff:fe87:440/64 scope link 
       valid_lft forever preferred_lft forever
 192.168.100.0/24 dev wlan0  proto kernel  scope link  src 192.168.100.1 
--- a/android/partitions.txt
+++ b/android/partitions.txt
@ -0,0 +1,32 @@
 major minor  #blocks  name
 253        0     196608 zram0
 179        0    3817472 mmcblk0
 179        1      65536 mmcblk0p1
 179        2        512 mmcblk0p2
 179        3        512 mmcblk0p3
 179        4       1024 mmcblk0p4
 179        5       1024 mmcblk0p5
 179        6        512 mmcblk0p6
 179        7        512 mmcblk0p7
 179        8        512 mmcblk0p8
 179        9        512 mmcblk0p9
 179       10        512 mmcblk0p10
 179       11        512 mmcblk0p11
 179       12       1024 mmcblk0p12
 179       13       1536 mmcblk0p13
 179       14       1536 mmcblk0p14
 179       15       1024 mmcblk0p15
 179       16          1 mmcblk0p16
 179       17          8 mmcblk0p17
 179       18      10240 mmcblk0p18
 179       19         32 mmcblk0p19
 179       20       1536 mmcblk0p20
 179       21         16 mmcblk0p21
 179       22      16384 mmcblk0p22
 179       23     819200 mmcblk0p23
 179       24      32768 mmcblk0p24
 179       25     131072 mmcblk0p25
 179       26      16384 mmcblk0p26
 179       27    2603455 mmcblk0p27
 179       32       4096 mmcblk0rpmb
--- a/android/power_supply.txt
+++ b/android/power_supply.txt
@ -0,0 +1,35 @@
 POWER_SUPPLY_NAME=battery
 POWER_SUPPLY_CHARGING_ENABLED=1
 POWER_SUPPLY_STATUS=Charging
 POWER_SUPPLY_CHARGE_TYPE=Fast
 POWER_SUPPLY_HEALTH=Good
 POWER_SUPPLY_PRESENT=1
 POWER_SUPPLY_VOLTAGE_MAX_DESIGN=4200000
 POWER_SUPPLY_VOLTAGE_MIN_DESIGN=4308000
 POWER_SUPPLY_VOLTAGE_NOW=3890842
 POWER_SUPPLY_CAPACITY=24
 POWER_SUPPLY_CURRENT_NOW=-411638
 POWER_SUPPLY_TEMP=214
 POWER_SUPPLY_TEMP_COOL=100
 POWER_SUPPLY_TEMP_WARM=450
 POWER_SUPPLY_SYSTEM_TEMP_LEVEL=0
 POWER_SUPPLY_NAME=bms
 POWER_SUPPLY_CAPACITY=24
 POWER_SUPPLY_STATUS=Charging
 POWER_SUPPLY_RESISTANCE=210
 POWER_SUPPLY_RESISTANCE_CAPACITIVE=50
 POWER_SUPPLY_CURRENT_NOW=-411638
 POWER_SUPPLY_VOLTAGE_OCV=3752694
 POWER_SUPPLY_HI_POWER=0
 POWER_SUPPLY_LOW_POWER=1
 POWER_SUPPLY_BATTERY_TYPE=palladium_1500mah
 POWER_SUPPLY_TEMP=214
 POWER_SUPPLY_NAME=usb
 POWER_SUPPLY_HEALTH=Unknown
 POWER_SUPPLY_PRESENT=1
 POWER_SUPPLY_ONLINE=1
 POWER_SUPPLY_VOLTAGE_MAX=0
 POWER_SUPPLY_CURRENT_MAX=500000
 POWER_SUPPLY_SCOPE=Device
 POWER_SUPPLY_TYPE=USB
 POWER_SUPPLY_VOLTAGE_NOW=-19
--- a/android/ps.txt
+++ b/android/ps.txt
@ -0,0 +1,230 @@
 USER     PID   PPID  VSIZE  RSS     WCHAN    PC         NAME
 root      1     0     704    536   ffffffff 00000000 S /init
 root      2     0     0      0     ffffffff 00000000 S kthreadd
 root      3     2     0      0     ffffffff 00000000 S ksoftirqd/0
 root      4     2     0      0     ffffffff 00000000 S kworker/0:0
 root      5     2     0      0     ffffffff 00000000 S kworker/0:0H
 root      6     2     0      0     ffffffff 00000000 D kworker/u8:0
 root      7     2     0      0     ffffffff 00000000 S migration/0
 root      8     2     0      0     ffffffff 00000000 S rcuc/0
 root      9     2     0      0     ffffffff 00000000 S rcub/0
 root      10    2     0      0     ffffffff 00000000 S rcu_preempt
 root      11    2     0      0     ffffffff 00000000 S rcu_bh
 root      12    2     0      0     ffffffff 00000000 S rcu_sched
 root      13    2     0      0     ffffffff 00000000 S watchdog/0
 root      14    2     0      0     ffffffff 00000000 S watchdog/1
 root      15    2     0      0     ffffffff 00000000 S rcuc/1
 root      16    2     0      0     ffffffff 00000000 S migration/1
 root      17    2     0      0     ffffffff 00000000 S ksoftirqd/1
 root      18    2     0      0     ffffffff 00000000 S kworker/1:0
 root      19    2     0      0     ffffffff 00000000 S kworker/1:0H
 root      20    2     0      0     ffffffff 00000000 S watchdog/2
 root      21    2     0      0     ffffffff 00000000 S rcuc/2
 root      22    2     0      0     ffffffff 00000000 S migration/2
 root      23    2     0      0     ffffffff 00000000 S ksoftirqd/2
 root      24    2     0      0     ffffffff 00000000 S kworker/2:0
 root      25    2     0      0     ffffffff 00000000 S kworker/2:0H
 root      26    2     0      0     ffffffff 00000000 R watchdog/3
 root      27    2     0      0     ffffffff 00000000 R rcuc/3
 root      28    2     0      0     ffffffff 00000000 R migration/3
 root      29    2     0      0     ffffffff 00000000 R ksoftirqd/3
 root      30    2     0      0     ffffffff 00000000 S kworker/3:0
 root      31    2     0      0     ffffffff 00000000 S kworker/3:0H
 root      32    2     0      0     ffffffff 00000000 S khelper
 root      33    2     0      0     ffffffff 00000000 S netns
 root      34    2     0      0     ffffffff 00000000 S kworker/0:1
 root      35    2     0      0     ffffffff 00000000 S kworker/3:1
 root      36    2     0      0     ffffffff 00000000 S kworker/2:1
 root      37    2     0      0     ffffffff 00000000 S kworker/1:1
 root      38    2     0      0     ffffffff 00000000 S kworker/0:1H
 root      39    2     0      0     ffffffff 00000000 S smd_channel_clo
 root      40    2     0      0     ffffffff 00000000 S smsm_cb_wq
 root      41    2     0      0     ffffffff 00000000 S kworker/u8:1
 root      42    2     0      0     ffffffff 00000000 D kworker/u9:0
 root      43    2     0      0     ffffffff 00000000 S rpm-smd
 root      44    2     0      0     ffffffff 00000000 S kworker/u9:1
 root      45    2     0      0     ffffffff 00000000 S irq/47-cpr
 root      46    2     0      0     ffffffff 00000000 S deferwq
 root      47    2     0      0     ffffffff 00000000 S mpm
 root      48    2     0      0     ffffffff 00000000 S kworker/u8:2
 root      49    2     0      0     ffffffff 00000000 S writeback
 root      50    2     0      0     ffffffff 00000000 S bioset
 root      51    2     0      0     ffffffff 00000000 S kblockd
 root      52    2     0      0     ffffffff 00000000 S khubd
 root      53    2     0      0     ffffffff 00000000 S system
 root      54    2     0      0     ffffffff 00000000 S irq/75-msm_iomm
 root      55    2     0      0     ffffffff 00000000 S irq/75-msm_iomm
 root      56    2     0      0     ffffffff 00000000 S irq/273-msm_iom
 root      57    2     0      0     ffffffff 00000000 S irq/274-msm_iom
 root      58    2     0      0     ffffffff 00000000 S irq/102-msm_iom
 root      59    2     0      0     ffffffff 00000000 S irq/102-msm_iom
 root      60    2     0      0     ffffffff 00000000 S irq/102-msm_iom
 root      61    2     0      0     ffffffff 00000000 S irq/102-msm_iom
 root      62    2     0      0     ffffffff 00000000 S irq/102-msm_iom
 root      63    2     0      0     ffffffff 00000000 S irq/102-msm_iom
 root      64    2     0      0     ffffffff 00000000 S irq/102-msm_iom
 root      65    2     0      0     ffffffff 00000000 S irq/102-msm_iom
 root      66    2     0      0     ffffffff 00000000 S irq/102-msm_iom
 root      67    2     0      0     ffffffff 00000000 S irq/102-msm_iom
 root      68    2     0      0     ffffffff 00000000 S irq/102-msm_iom
 root      69    2     0      0     ffffffff 00000000 S irq/102-msm_iom
 root      70    2     0      0     ffffffff 00000000 S irq/102-msm_iom
 root      71    2     0      0     ffffffff 00000000 S irq/102-msm_iom
 root      72    2     0      0     ffffffff 00000000 S irq/102-msm_iom
 root      73    2     0      0     ffffffff 00000000 S irq/102-msm_iom
 root      74    2     0      0     ffffffff 00000000 S irq/102-msm_iom
 root      75    2     0      0     ffffffff 00000000 S irq/102-msm_iom
 root      76    2     0      0     ffffffff 00000000 S irq/102-msm_iom
 root      77    2     0      0     ffffffff 00000000 S irq/102-msm_iom
 root      78    2     0      0     ffffffff 00000000 S devfreq_wq
 root      79    2     0      0     ffffffff 00000000 S cfg80211
 root      80    2     0      0     ffffffff 00000000 S kswapd0
 root      81    2     0      0     ffffffff 00000000 S ksmd
 root      82    2     0      0     ffffffff 00000000 S fsnotify_mark
 root      83    2     0      0     ffffffff 00000000 S crypto
 root      102   2     0      0     ffffffff 00000000 S apr_driver
 root      103   2     0      0     ffffffff 00000000 S pil_vote_wq
 root      104   2     0      0     ffffffff 00000000 S mem_share_svc
 root      105   2     0      0     ffffffff 00000000 S qmi_hndl0000000
 root      106   2     0      0     ffffffff 00000000 S kworker/0:2
 root      107   2     0      0     ffffffff 00000000 S diag_real_time_
 root      108   2     0      0     ffffffff 00000000 S diag_modem_data
 root      109   2     0      0     ffffffff 00000000 S diag_lpass_data
 root      110   2     0      0     ffffffff 00000000 S diag_wcnss_data
 root      111   2     0      0     ffffffff 00000000 S diag_wq
 root      112   2     0      0     ffffffff 00000000 S diag_usb_wq
 root      113   2     0      0     ffffffff 00000000 S diag_cntl_wq
 root      114   2     0      0     ffffffff 00000000 S diag_dci_wq
 root      115   2     0      0     ffffffff 00000000 S kgsl-3d0
 root      116   2     0      0     ffffffff 00000000 S kgsl-events
 root      117   2     0      0     ffffffff 00000000 S kgsl_devfreq_wq
 root      118   2     0      0     ffffffff 00000000 S proximity_als
 root      119   2     0      0     ffffffff 00000000 S spi0
 root      122   2     0      0     ffffffff 00000000 S usbnet
 root      123   2     0      0     ffffffff 00000000 S kworker/0:3
 root      124   2     0      0     ffffffff 00000000 S k_gserial
 root      125   2     0      0     ffffffff 00000000 S uether
 root      126   2     0      0     ffffffff 00000000 S kpsmoused
 root      129   2     0      0     ffffffff 00000000 S msm_cpp_workque
 root      130   2     0      0     ffffffff 00000000 S cfinteractive
 root      131   2     0      0     ffffffff 00000000 S irq/170-7824900
 root      132   2     0      0     ffffffff 00000000 S binder
 root      133   2     0      0     ffffffff 00000000 S usb_bam_wq
 root      134   2     0      0     ffffffff 00000000 S krfcommd
 root      135   2     0      0     ffffffff 00000000 S msm_ipc_router
 root      136   2     0      0     ffffffff 00000000 S kworker/u8:3
 root      137   2     0      0     ffffffff 00000000 S irq/455-wcnss
 root      138   2     0      0     ffffffff 00000000 S irq/423-modem
 root      139   2     0      0     ffffffff 00000000 S msm_vidc_worker
 root      140   2     0      0     ffffffff 00000000 S pm_workerq_venu
 root      141   2     0      0     ffffffff 00000000 S mmcqd/0
 root      142   2     0      0     ffffffff 00000000 S mmcqd/0rpmb
 root      143   2     0      0     ffffffff 00000000 S irq/309-fifo_up
 root      144   2     0      0     ffffffff 00000000 S irq/310-fsm_sta
 root      145   2     0      0     ffffffff 00000000 S kworker/1:2
 root      146   2     0      0     ffffffff 00000000 S irq/298-fastchg
 root      147   2     0      0     ffffffff 00000000 S irq/301-batt_pr
 root      148   2     0      0     ffffffff 00000000 S rq_stats
 root      149   2     0      0     ffffffff 00000000 S bam_dmux_rx
 root      150   2     0      0     ffffffff 00000000 S bam_dmux_tx
 root      151   2     0      0     ffffffff 00000000 S f_mtp
 root      152   2     0      0     ffffffff 00000000 S file-storage
 root      153   2     0      0     ffffffff 00000000 S msm_thermal:hot
 root      154   2     0      0     ffffffff 00000000 S msm_thermal:fre
 root      155   2     0      0     ffffffff 00000000 S msm_thermal:the
 root      156   1     548    240   ffffffff 00000000 S /sbin/ueventd
 root      158   2     0      0     ffffffff 00000000 S jbd2/mmcblk0p23
 root      159   2     0      0     ffffffff 00000000 S ext4-dio-unwrit
 root      163   2     0      0     ffffffff 00000000 S jbd2/mmcblk0p27
 root      164   2     0      0     ffffffff 00000000 S ext4-dio-unwrit
 root      166   2     0      0     ffffffff 00000000 S jbd2/mmcblk0p25
 root      167   2     0      0     ffffffff 00000000 S ext4-dio-unwrit
 root      168   2     0      0     ffffffff 00000000 S jbd2/mmcblk0p24
 root      169   2     0      0     ffffffff 00000000 S ext4-dio-unwrit
 root      193   2     0      0     ffffffff 00000000 S IPCRTR
 root      194   2     0      0     ffffffff 00000000 S kworker/u8:4
 root      195   2     0      0     ffffffff 00000000 S modem_IPCRTR
 root      196   2     0      0     ffffffff 00000000 S irq/318-mbhc sw
 root      197   2     0      0     ffffffff 00000000 S irq/316-Button 
 root      198   2     0      0     ffffffff 00000000 S irq/315-Button 
 root      199   2     0      0     ffffffff 00000000 S irq/314-Elect I
 root      200   2     0      0     ffffffff 00000000 S irq/317-Elect R
 root      201   2     0      0     ffffffff 00000000 S irq/321-HPH_L O
 root      202   2     0      0     ffffffff 00000000 S irq/320-HPH_R O
 root      203   1     1436   148   ffffffff 00000000 S /sbin/healthd
 system    204   1     1352   624   ffffffff 00000000 S /system/bin/servicemanager
 root      205   1     4752   1188  ffffffff 00000000 S /system/bin/vold
 system    207   1     2492   816   ffffffff 00000000 S /system/bin/rfs_access
 system    210   1     2484   824   ffffffff 00000000 S /system/bin/qseecomd
 root      211   1     11204  1636  ffffffff 00000000 S /system/bin/netd
 root      212   1     1336   680   ffffffff 00000000 S /system/bin/debuggerd
 radio     213   1     29364  7236  ffffffff 00000000 S /system/bin/rild
 system    214   1     38556  10484 ffffffff 00000000 S /system/bin/surfaceflinger
 root      215   1     317240 41356 ffffffff 00000000 S zygote
 drm       216   1     11028  3604  ffffffff 00000000 S /system/bin/drmserver
 media     218   1     30412  9080  ffffffff 00000000 S /system/bin/mediaserver
 install   219   1     1292   700   ffffffff 00000000 S /system/bin/installd
 keystore  220   1     3660   1344  ffffffff 00000000 S /system/bin/keystore
 root      221   1     5276   1416  ffffffff 00000000 S /system/bin/qcom-system-daemon
 system    224   1     3568   1052  ffffffff 00000000 S /system/bin/ptt_socket_app
 system    226   1     1224   640   ffffffff 00000000 S /system/bin/qrngd
 root      227   1     33872  1512  ffffffff 00000000 S /system/bin/thermal-engine
 root      229   2     0      0     ffffffff 00000000 S kworker/3:1H
 radio     247   1     12376  1320  ffffffff 00000000 S /system/bin/qmuxd
 radio     254   1     9696   1796  ffffffff 00000000 S /system/bin/netmgrd
 gps       257   1     1400   764   ffffffff 00000000 S /system/bin/loc_launcher
 system    259   1     6232   1508  ffffffff 00000000 S /system/bin/ATFWD-daemon
 media_rw  260   1     2776   728   ffffffff 00000000 S /system/bin/sdcard
 media_rw  261   1     3808   696   ffffffff 00000000 S /system/bin/sdcard
 media_rw  263   1     3808   696   ffffffff 00000000 S /system/bin/sdcard
 root      264   2     0      0     ffffffff 00000000 S kworker/1:1H
 media_rw  265   1     3808   696   ffffffff 00000000 S /system/bin/sdcard
 camera    266   1     17612  4848  ffffffff 00000000 S /system/bin/mm-qcamera-daemon
 system    267   1     7928   1260  ffffffff 00000000 S /system/bin/time_daemon
 system    268   1     8052   2580  ffffffff 00000000 S /system/bin/audiod
 system    272   1     4012   1328  ffffffff 00000000 S /system/bin/wcnss_service
 root      273   2     0      0     ffffffff 00000000 S kworker/2:1H
 root      274   1     1404   776   ffffffff 00000000 S /system/bin/sh
 nobody    284   1     6432   824   ffffffff 00000000 S /system/bin/rmt_storage
 shell     295   1     4592   232   ffffffff 00000000 S /sbin/adbd
 root      299   2     0      0     ffffffff 00000000 S k_gsmd
 root      300   2     0      0     ffffffff 00000000 S k_gbam
 root      301   2     0      0     ffffffff 00000000 S gsmd_ctrl
 system    304   1     1360   740   ffffffff 00000000 S /system/bin/vm_bms
 gps       305   257   948    464   ffffffff 00000000 S /system/bin/location-mq
 gps       306   257   5404   696   ffffffff 00000000 S /system/bin/lowi-server
 gps       307   257   14888  1296  ffffffff 00000000 S /system/bin/xtwifi-inet-agent
 gps       308   257   12760  2116  ffffffff 00000000 S /system/bin/xtwifi-client
 gps       310   257   1400   304   ffffffff 00000000 S /system/bin/loc_launcher
 system    355   210   6716   708   ffffffff 00000000 S /system/bin/qseecomd
 root      367   2     0      0     ffffffff 00000000 S kworker/u8:5
 root      411   2     0      0     ffffffff 00000000 S kworker/u8:6
 root      450   2     0      0     ffffffff 00000000 D mdss_fb0
 root      639   2     0      0     ffffffff 00000000 S IPCRTR
 root      654   2     0      0     ffffffff 00000000 S wcnss_IPCRTR
 system    871   215   407004 38404 ffffffff 00000000 S system_server
 u0_a5     935   215   345044 30680 ffffffff 00000000 S com.android.systemui
 u0_a1     992   215   330048 23144 ffffffff 00000000 S android.process.acore
 u0_a10    1012  215   368076 42460 ffffffff 00000000 S com.youdo.server
 u0_a15    1038  215   335028 24372 ffffffff 00000000 S com.android.inputmethod.latin
 radio     1057  215   345352 25816 ffffffff 00000000 S com.android.phone
 system    1070  215   337852 19040 ffffffff 00000000 S com.qualcomm.services.location
 system    1095  215   330552 18348 ffffffff 00000000 S com.qualcomm.location.XT
 radio     1169  215   327164 17708 ffffffff 00000000 S com.qualcomm.qcrilmsgtunnel
 u0_a6     1203  215   327132 22256 ffffffff 00000000 S android.process.media
 system    1219  215   328792 19880 ffffffff 00000000 S com.android.settings
 system    1232  215   326360 18136 ffffffff 00000000 S com.qualcomm.telephony
 root      1251  2     0      0     ffffffff 00000000 S VosWDThread
 root      1253  2     0      0     ffffffff 00000000 S VosMCThread
 root      1254  2     0      0     ffffffff 00000000 S VosTXThread
 root      1255  2     0      0     ffffffff 00000000 S VosRXThread
 root      1274  1     7544   824   ffffffff 00000000 S /system/bin/mpdecision
 root      1289  2     0      0     ffffffff 00000000 S wlan_logging_th
 wifi      1294  211   2732   1292  ffffffff 00000000 S /system/bin/hostapd
 radio     1303  211   0      0     ffffffff 00000000 Z radish
 nobody    1306  211   1332   756   ffffffff 00000000 S /system/bin/dnsmasq
 u0_a3     1334  215   328500 19252 ffffffff 00000000 S com.android.dialer
 u0_a7     1381  215   325060 17276 ffffffff 00000000 S com.android.onetimeinitializer
 system    1395  215   325100 17112 ffffffff 00000000 S com.qualcomm.display
 radio     1444  215   326316 18220 ffffffff 00000000 S com.qualcomm.qti.modemtestmode
 shell     1522  295   1540   720   00000000 b6f694ac R ps
--- a/android/regs.txt
+++ b/android/regs.txt
@ -0,0 +1 @@
 /system/bin/sh: cat: /d/regulator/*/name: No such file or directory
--- a/android/sysclass-ls.txt
+++ b/android/sysclass-ls.txt
--- a/android/thermal.txt
+++ b/android/thermal.txt
@ -0,0 +1,8 @@
 tsens_tz_sensor0
 tsens_tz_sensor1
 tsens_tz_sensor2
 tsens_tz_sensor4
 tsens_tz_sensor5
 pm8916_tz
 bms
 battery
--- a/android/version.txt
+++ b/android/version.txt
@ -0,0 +1 @@
 Linux version 3.10.28 (richal@msa2) (gcc version 4.7 (GCC) ) #1 SMP PREEMPT Tue Apr 14 19:25:03 CST 2026
--- a/b5a/A4-rollback.sh
+++ b/b5a/A4-rollback.sh
@ -0,0 +1,11 @@
 #!/bin/bash
 # B5a rollback — restore pre-B5a state (aboot first, then boot). Needs 9008 (HW EDL: battery on, D+->GND, plug USB, release).
 cd ~/doc/modem/jz08-aurora || exit 1
 L=firehose/007050e100000000_394a2e47cf830150_fhprg_peek.bin ; O=logs/b5a/rollback ; mkdir -p $O
 E(){ edl --loader=$L "$@"; }
 E printgpt > $O/00-printgpt.log 2>&1
 E w aboot bootchain-migration/aboot-lk1st-aurora.pad1M > $O/aboot-w.log 2>&1       # e4addbf8… (forced-fastboot lk1st)
 E r aboot $O/aboot-rb.bin > /dev/null 2>&1 ; cmp bootchain-migration/aboot-lk1st-aurora.pad1M $O/aboot-rb.bin && echo ABOOT_RESTORED
 E w boot partitions/boot.bin > $O/boot-w.log 2>&1                                  # 1342def7… (stock Android boot)
 E r boot $O/boot-rb.bin > /dev/null 2>&1 ; cmp partitions/boot.bin $O/boot-rb.bin && echo BOOT_RESTORED
 sha256sum $O/*.bin
--- a/b5a/A4-write.sh
+++ b/b5a/A4-write.sh
@ -0,0 +1,53 @@
 #!/bin/bash
 # B5a A4 — the ONLY writes: boot, then aboot. Run on 480s ONLY after explicit GO.
 # Stops at the first failed gate. Never runs `edl reset`. Board must be in 05c6:9008.
 cd ~/doc/modem/jz08-aurora || exit 1
 L=firehose/007050e100000000_394a2e47cf830150_fhprg_peek.bin
 O=logs/b5a/A4 ; A3=logs/b5a/A3 ; mkdir -p $O
 BOOT_NEW=b5a/boot-emmc1-16MiB.img              ; BOOT_NEW_SHA=e9579f33c7304cd47f487f2b61cd9226dc04fd3a63775d62b4b95fc15bd3ebff
 ABOOT_NEW=b5a/aboot-lk1st-aurora-autoboot.pad1M ; ABOOT_NEW_SHA=3b8cd2667837fc7083cb28991d849f9b408a07fa743bfd05eafee7b053760f85
 BOOT_OLD_SHA=1342def7e0f0c245385d4bac2852d361537a520abd8a45708618983cdab43c0a
 ABOOT_OLD_SHA=e4addbf80eb86f6ad8b112e5a3115c7b721bbd2cca8cc109d135aeceb6194482
 die(){ echo "STOP: $*"; exit 1; }
 sha(){ sha256sum "$1" | cut -d' ' -f1; }
 E(){ edl --loader=$L "$@"; }
 echo "== G0 inputs"
 [ "$(sha $L)" = 53f193500c03248f0d671ab57bfe9ca8a42967e97f28403294b4b3f854075aca ] || die loader
 [ "$(sha $BOOT_NEW)" = $BOOT_NEW_SHA ] || die boot-candidate-sha
 [ "$(sha $ABOOT_NEW)" = $ABOOT_NEW_SHA ] || die aboot-candidate-sha
 [ $(stat -c %s $BOOT_NEW) = 16777216 ] && [ $(stat -c %s $ABOOT_NEW) = 1048576 ] || die sizes
 lsusb | grep -q 05c6:9008 || die "no 9008"
 echo "== G1 identity + geometry"
 E printgpt > $O/00-printgpt.log 2>&1 || die printgpt
 grep -aq "Serial: *0x<SAHARA_SERIAL>" $O/00-printgpt.log || grep -aq "Mode detected: firehose" $O/00-printgpt.log || die serial
 grep -a "^boot:" $O/00-printgpt.log | grep -q "Offset 0x000000000c18c000, Length 0x0000000001000000" || die boot-geometry
 grep -a "^aboot:" $O/00-printgpt.log | grep -q "Offset 0x0000000008100000, Length 0x0000000000100000" || die aboot-geometry
 E rs 0 34 $O/pre-gptp.bin >/dev/null 2>&1 ; cmp $O/pre-gptp.bin $A3/gpt-primary-34.bin || die gpt-primary-changed
 E r boot  $O/pre-boot.bin  >/dev/null 2>&1 ; [ "$(sha $O/pre-boot.bin)"  = $BOOT_OLD_SHA ]  || die boot-not-stock
 E r aboot $O/pre-aboot.bin >/dev/null 2>&1 ; [ "$(sha $O/pre-aboot.bin)" = $ABOOT_OLD_SHA ] || die aboot-not-e4addbf8
 echo "== W1 boot := emmc1 (LBA 396384, 32768 sectors)"
 E w boot $BOOT_NEW > $O/10-boot-write.log 2>&1 ; echo "rc=$?"; grep -a "Wrote" $O/10-boot-write.log
 E r boot $O/11-boot-readback.bin > $O/11-boot-readback.log 2>&1 || die boot-readback-rc
 sha256sum $BOOT_NEW $O/11-boot-readback.bin
 cmp $BOOT_NEW $O/11-boot-readback.bin || die "BOOT READBACK MISMATCH — do NOT write aboot, do NOT reboot"
 echo BOOT_MATCH
 echo "== W2 aboot := lk1st autoboot (LBA 264192, 2048 sectors)"
 E w aboot $ABOOT_NEW > $O/20-aboot-write.log 2>&1 ; echo "rc=$?"; grep -a "Wrote" $O/20-aboot-write.log
 E r aboot $O/21-aboot-readback.bin > $O/21-aboot-readback.log 2>&1 || die aboot-readback-rc
 sha256sum $ABOOT_NEW $O/21-aboot-readback.bin
 cmp $ABOOT_NEW $O/21-aboot-readback.bin || die "ABOOT READBACK MISMATCH — do NOT reboot; roll back aboot"
 echo ABOOT_MATCH
 echo "== V post-write: everything else == A3"
 E rs 0 34        $O/post-gptp.bin  >/dev/null 2>&1; cmp $O/post-gptp.bin  $A3/gpt-primary-34.bin || die gptp
 E rs 7634911 33  $O/post-gptb.bin  >/dev/null 2>&1; cmp $O/post-gptb.bin  $A3/gpt-backup-33.bin  || die gptb
 E rs 305184 1024 $O/post-tzbak.bin >/dev/null 2>&1; cmp $O/post-tzbak.bin $A3/tzbak-305184.bin   || die tzbak
 for p in sbl1 rpm tz hyp recovery modemst1 modemst2 fsg fsc persist; do
  E r $p $O/post-$p.bin >/dev/null 2>&1; cmp $O/post-$p.bin $A3/$p.bin || die "$p changed"; echo "$p == A3"
 done
 (cd $O && sha256sum *.bin > SHA256SUMS)
 echo "B5A_WRITES_VERIFIED — power off fully (USB, then battery) before first autonomous boot"
--- a/b5a/SHA256SUMS
+++ b/b5a/SHA256SUMS
@ -0,0 +1,4 @@
 7b3fb5b36b933b40e2cd099495419cfe954bf018bcd5c6d4337337620168ae67  aboot-lk1st-aurora-autoboot.mbn
 33c452e4b0629b3f46a38091679700af4a3ddec64d3e494ac7ec8ba56a348b5b  lk1st-aurora-autoboot-unsigned.mbn
 3b8cd2667837fc7083cb28991d849f9b408a07fa743bfd05eafee7b053760f85  aboot-lk1st-aurora-autoboot.pad1M
 e9579f33c7304cd47f487f2b61cd9226dc04fd3a63775d62b4b95fc15bd3ebff  boot-emmc1-16MiB.img
--- a/b5a/build-autoboot.log
+++ b/b5a/build-autoboot.log
@ -0,0 +1,227 @@
 make[1]: Entering directory '/tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce'
 NOTE: Display support is disabled without display/panel selection
 including app/aboot dev/fbcon dev/gcdb/display dev/keys dev/pmic/pm8x41 dev/vib lib/debug lib/heap lib/libc lib/libfdt lib/ptable lk2nd lk2nd/boot lk2nd/device lk2nd/fastboot lk2nd/fastboot/debug lk2nd/hw/gpio lk2nd/hw/i2c lk2nd/ramoops lk2nd/rng-seed lk2nd/serialno lk2nd/smp lk2nd/smp/spin-table lk2nd/version
 including lib/bio lib/fs lib/zlib_inflate lk2nd/hw/bdev lk2nd/hw/regulator
 including lib/fs/ext2 lib/partition
 including lib/bcache
 generating build-lk1st-msm8916/config.h
 compiling lk2nd/device/dts/msm8916/msm8916-512mb-mtp.dts
 generating build-lk1st-msm8916/system-onesegment.ld
 generating build-lk1st-msm8916/lk2nd/version/tag.c for lk2nd 23.1
 compiling arch/arm/crt0.S
 compiling target/msm8916/init.c
 compiling target/msm8916/meminfo.c
 compiling target/msm8916/target_display.c
 compiling target/msm8916/oem_panel.c
 compiling platform/msm8916/platform.c
 compiling platform/msm8916/acpuclock.c
 compiling platform/msm8916/msm8916-clock.c
 compiling platform/msm8916/gpio.c
 compiling platform/msm_shared/debug.c
 compiling platform/msm_shared/smem.c
 compiling platform/msm_shared/smem_ptable.c
 compiling platform/msm_shared/partition_parser.c
 compiling platform/msm_shared/ab_partition_parser.c
 compiling platform/msm_shared/hsusb.c
 compiling platform/msm_shared/boot_stats.c
 compiling platform/msm_shared/qgic_common.c
 compiling platform/msm_shared/crc32.c
 compiling platform/msm_shared/sdhci.c
 compiling platform/msm_shared/sdhci_msm.c
 compiling platform/msm_shared/mmc_sdhci.c
 compiling platform/msm_shared/mmc_wrapper.c
 compiling platform/msm_shared/rpm-ipc.c
 compiling platform/msm_shared/qgic.c
 compiling platform/msm_shared/qtimer.c
 compiling platform/msm_shared/qtimer_mmap.c
 compiling platform/msm_shared/interrupts.c
 compiling platform/msm_shared/clock.c
 compiling platform/msm_shared/clock_pll.c
 compiling platform/msm_shared/clock_lib2.c
 compiling platform/msm_shared/uart_dm.c
 compiling platform/msm_shared/board.c
 compiling platform/msm_shared/spmi.c
 compiling platform/msm_shared/bam.c
 compiling platform/msm_shared/scm.c
 compiling platform/msm_shared/dload_util.c
 compiling platform/msm_shared/gpio.c
 compiling platform/msm_shared/dev_tree.c
 compiling platform/msm_shared/mdp5.c
 compiling platform/msm_shared/display.c
 compiling platform/msm_shared/mipi_dsi.c
 compiling platform/msm_shared/mipi_dsi_phy.c
 compiling platform/msm_shared/mipi_dsi_autopll.c
 compiling platform/msm_shared/shutdown_detect.c
 compiling platform/msm_shared/certificate.c
 compiling platform/msm_shared/crypto_hash.c
 compiling platform/msm_shared/crypto5_eng.c
 compiling platform/msm_shared/crypto5_wrapper.c
 compiling platform/msm_shared/i2c_qup.c
 compiling platform/msm_shared/mipi_dsi_i2c.c
 compiling platform/msm_shared/regulator.c
 compiling platform/msm_shared/reboot.c
 compiling arch/arm/arch.c
 compiling arch/arm/asm.S
 compiling arch/arm/cache.c
 compiling arch/arm/cache-ops.S
 compiling arch/arm/ops.S
 compiling arch/arm/exceptions.S
 compiling arch/arm/faults.c
 compiling arch/arm/thread.c
 compiling arch/arm/dcc.S
 compiling arch/arm/mmu.c
 compiling platform/debug.c
 compiling platform/init.c
 compiling target/init.c
 compiling target/target_display.c
 compiling kernel/debug.c
 compiling kernel/dpc.c
 compiling kernel/event.c
 compiling kernel/main.c
 compiling kernel/mutex.c
 compiling kernel/thread.c
 compiling kernel/timer.c
 compiling dev/dev.c
 compiling app/app.c
 compiling app/aboot/aboot.c
 compiling app/aboot/fastboot.c
 compiling dev/fbcon/fbcon.c
 compiling dev/gcdb/display/gcdb_display.c
 compiling dev/gcdb/display/gcdb_display_param.c
 compiling dev/gcdb/display/panel_display.c
 compiling dev/gcdb/display/gcdb_autopll.c
 compiling dev/keys/keys.c
 compiling dev/pmic/pm8x41/pm8x41.c
 compiling dev/pmic/pm8x41/pm8x41_adc.c
 compiling dev/pmic/pm8x41/pm8x41_wled.c
 compiling dev/pmic/pm8x41/pm8x41_vib.c
 compiling dev/pmic/pm8x41/pm_pwm.c
 compiling dev/vib/vibrator.c
 compiling lib/debug/debug.c
 compiling lib/heap/heap.c
 compiling lib/libc/atoi.c
 compiling lib/libc/bsearch.c
 compiling lib/libc/ctype.c
 compiling lib/libc/errno.c
 compiling lib/libc/gcd_lcm.c
 compiling lib/libc/itoa.c
 compiling lib/libc/printf.c
 compiling lib/libc/malloc.c
 compiling lib/libc/rand.c
 compiling lib/libc/stdio.c
 compiling lib/libc/eabi.c
 compiling lib/libc/string/arch/arm/memcpy.S
 compiling lib/libc/string/arch/arm/memset.S
 compiling lib/libc/string/memchr.c
 compiling lib/libc/string/memcmp.c
 compiling lib/libc/string/memscpy.c
 compiling lib/libc/string/strcasecmp.c
 compiling lib/libc/string/strcat.c
 compiling lib/libc/string/strchr.c
 compiling lib/libc/string/strcmp.c
 compiling lib/libc/string/strcoll.c
 compiling lib/libc/string/strcpy.c
 compiling lib/libc/string/strdup.c
 compiling lib/libc/string/strerror.c
 compiling lib/libc/string/strlcat.c
 compiling lib/libc/string/strlcpy.c
 compiling lib/libc/string/strlen.c
 compiling lib/libc/string/strncat.c
 compiling lib/libc/string/strncpy.c
 compiling lib/libc/string/strncmp.c
 compiling lib/libc/string/strnicmp.c
 compiling lib/libc/string/strnlen.c
 compiling lib/libc/string/strpbrk.c
 compiling lib/libc/string/strrchr.c
 compiling lib/libc/string/strrev.c
 compiling lib/libc/string/strspn.c
 compiling lib/libc/string/strstr.c
 compiling lib/libc/string/strtok.c
 compiling lib/libc/string/strxfrm.c
 compiling lib/libfdt/fdt.c
 compiling lib/libfdt/fdt_ro.c
 compiling lib/libfdt/fdt_wip.c
 compiling lib/libfdt/fdt_sw.c
 compiling lib/libfdt/fdt_rw.c
 compiling lib/libfdt/fdt_strerror.c
 compiling lib/libfdt/fdt_empty_tree.c
 compiling lib/libfdt/fdt_addresses.c
 compiling lib/libfdt/fdt_overlay.c
 compiling lib/libfdt/fdt_check.c
 compiling lib/ptable/ptable.c
 compiling lk2nd/init.c
 compiling lk2nd/util/cmdline.c
 compiling lk2nd/util/lkfdt.c
 compiling lk2nd/util/mmu.c
 compiling lk2nd/boot/boot.c
 compiling lk2nd/boot/extlinux.c
 compiling lk2nd/boot/util.c
 compiling lk2nd/device/device.c
 compiling lk2nd/device/panel.c
 compiling lk2nd/device/keys.c
 compiling lk2nd/device/leds.c
 compiling lk2nd/device/regulator-fixed.c
 compiling lk2nd/device/regulator-ldo.c
 compiling lk2nd/device/sdhc.c
 compiling lk2nd/device/smb1360/smb1360.c
 compiling lk2nd/device/smb1360/gpl/battery-idol347.c
 compiling lk2nd/device/smb1360/gpl/battery-wt88047.c
 compiling lk2nd/device/smb1360/gpl/battery-qcom.c
 compiling lk2nd/fastboot/fetch.c
 compiling lk2nd/fastboot/hash.c
 compiling lk2nd/fastboot/misc.c
 compiling lk2nd/fastboot/dtb.c
 compiling lk2nd/fastboot/debug/cpuid.c
 compiling lk2nd/fastboot/debug/register.c
 compiling lk2nd/fastboot/debug/regulator.c
 compiling lk2nd/hw/gpio/gpio.c
 compiling lk2nd/hw/gpio/tlmm.c
 compiling lk2nd/hw/gpio/pm8x41.c
 compiling lk2nd/hw/i2c/dt.c
 compiling lk2nd/hw/i2c/gpio_i2c.c
 compiling lk2nd/ramoops/ramoops.c
 compiling lk2nd/rng-seed/rng-seed.c
 compiling lk2nd/serialno/mac.c
 compiling lk2nd/serialno/serialno.c
 compiling lk2nd/smp/clock-msm8916.c
 compiling lk2nd/smp/cpu-boot.c
 compiling lk2nd/smp/cortex-a.c
 compiling lk2nd/smp/spin-table/spin-table.c
 compiling lk2nd/version/version.c
 compiling build-lk1st-msm8916/lk2nd/version/tag.c
 compiling lib/bio/bio.c
 compiling lib/bio/debug.c
 compiling lib/bio/mem.c
 compiling lib/bio/subdev.c
 compiling lib/fs/fs.c
 compiling lib/fs/debug.c
 compiling lib/zlib_inflate/zutil.c
 compiling lib/zlib_inflate/adler32.c
 compiling lib/zlib_inflate/inftrees.c
 compiling lib/zlib_inflate/inflate.c
 compiling lib/zlib_inflate/inffast.c
 compiling lib/zlib_inflate/uncompr.c
 compiling lib/zlib_inflate/decompress.c
 compiling lk2nd/hw/bdev/bdev.c
 compiling lk2nd/hw/bdev/util.c
 compiling lk2nd/hw/bdev/wrapper.c
 compiling lk2nd/hw/bdev/mmc_sdhci.c
 compiling lk2nd/hw/regulator/gpl/qcom_spmi-regulator.c
 compiling lib/fs/ext2/ext2.c
 compiling lib/fs/ext2/dir.c
 compiling lib/fs/ext2/io.c
 compiling lib/fs/ext2/file.c
 compiling lib/partition/partition.c
 compiling lib/bcache/bcache.c
 linking build-lk1st-msm8916/lk
 generating image: build-lk1st-msm8916/lk.bin
 generating listing: build-lk1st-msm8916/lk.lst
 generating listing: build-lk1st-msm8916/lk.debug.lst
 generating symbols: build-lk1st-msm8916/lk.sym
   text	   data	    bss	    dec	    hex	filename
 202300	  59340	 224720	 486360	  76bd8	build-lk1st-msm8916/lk
 arm-none-eabi-objcopy -O binary build-lk1st-msm8916/lk build-lk1st-msm8916/lk.bin
 generating size map: build-lk1st-msm8916/lk.size
 generating stripped elf: build-lk1st-msm8916/lk_s.elf
 cp -f ./build-lk1st-msm8916/lk_s.elf ./build-lk1st-msm8916/emmc_appsboot.mbn
 make[1]: Leaving directory '/tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce'
--- a/b5a/build-repro-force.log
+++ b/b5a/build-repro-force.log
@ -0,0 +1,227 @@
 make[1]: Entering directory '/tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/force'
 NOTE: Display support is disabled without display/panel selection
 including app/aboot dev/fbcon dev/gcdb/display dev/keys dev/pmic/pm8x41 dev/vib lib/debug lib/heap lib/libc lib/libfdt lib/ptable lk2nd lk2nd/boot lk2nd/device lk2nd/fastboot lk2nd/fastboot/debug lk2nd/hw/gpio lk2nd/hw/i2c lk2nd/ramoops lk2nd/rng-seed lk2nd/serialno lk2nd/smp lk2nd/smp/spin-table lk2nd/version
 including lib/bio lib/fs lib/zlib_inflate lk2nd/hw/bdev lk2nd/hw/regulator
 including lib/fs/ext2 lib/partition
 including lib/bcache
 generating build-lk1st-msm8916/config.h
 compiling lk2nd/device/dts/msm8916/msm8916-512mb-mtp.dts
 generating build-lk1st-msm8916/system-onesegment.ld
 generating build-lk1st-msm8916/lk2nd/version/tag.c for lk2nd 23.1
 compiling arch/arm/crt0.S
 compiling target/msm8916/init.c
 compiling target/msm8916/meminfo.c
 compiling target/msm8916/target_display.c
 compiling target/msm8916/oem_panel.c
 compiling platform/msm8916/platform.c
 compiling platform/msm8916/acpuclock.c
 compiling platform/msm8916/msm8916-clock.c
 compiling platform/msm8916/gpio.c
 compiling platform/msm_shared/debug.c
 compiling platform/msm_shared/smem.c
 compiling platform/msm_shared/smem_ptable.c
 compiling platform/msm_shared/partition_parser.c
 compiling platform/msm_shared/ab_partition_parser.c
 compiling platform/msm_shared/hsusb.c
 compiling platform/msm_shared/boot_stats.c
 compiling platform/msm_shared/qgic_common.c
 compiling platform/msm_shared/crc32.c
 compiling platform/msm_shared/sdhci.c
 compiling platform/msm_shared/sdhci_msm.c
 compiling platform/msm_shared/mmc_sdhci.c
 compiling platform/msm_shared/mmc_wrapper.c
 compiling platform/msm_shared/rpm-ipc.c
 compiling platform/msm_shared/qgic.c
 compiling platform/msm_shared/qtimer.c
 compiling platform/msm_shared/qtimer_mmap.c
 compiling platform/msm_shared/interrupts.c
 compiling platform/msm_shared/clock.c
 compiling platform/msm_shared/clock_pll.c
 compiling platform/msm_shared/clock_lib2.c
 compiling platform/msm_shared/uart_dm.c
 compiling platform/msm_shared/board.c
 compiling platform/msm_shared/spmi.c
 compiling platform/msm_shared/bam.c
 compiling platform/msm_shared/scm.c
 compiling platform/msm_shared/dload_util.c
 compiling platform/msm_shared/gpio.c
 compiling platform/msm_shared/dev_tree.c
 compiling platform/msm_shared/mdp5.c
 compiling platform/msm_shared/display.c
 compiling platform/msm_shared/mipi_dsi.c
 compiling platform/msm_shared/mipi_dsi_phy.c
 compiling platform/msm_shared/mipi_dsi_autopll.c
 compiling platform/msm_shared/shutdown_detect.c
 compiling platform/msm_shared/certificate.c
 compiling platform/msm_shared/crypto_hash.c
 compiling platform/msm_shared/crypto5_eng.c
 compiling platform/msm_shared/crypto5_wrapper.c
 compiling platform/msm_shared/i2c_qup.c
 compiling platform/msm_shared/mipi_dsi_i2c.c
 compiling platform/msm_shared/regulator.c
 compiling platform/msm_shared/reboot.c
 compiling arch/arm/arch.c
 compiling arch/arm/asm.S
 compiling arch/arm/cache.c
 compiling arch/arm/cache-ops.S
 compiling arch/arm/ops.S
 compiling arch/arm/exceptions.S
 compiling arch/arm/faults.c
 compiling arch/arm/thread.c
 compiling arch/arm/dcc.S
 compiling arch/arm/mmu.c
 compiling platform/debug.c
 compiling platform/init.c
 compiling target/init.c
 compiling target/target_display.c
 compiling kernel/debug.c
 compiling kernel/dpc.c
 compiling kernel/event.c
 compiling kernel/main.c
 compiling kernel/mutex.c
 compiling kernel/thread.c
 compiling kernel/timer.c
 compiling dev/dev.c
 compiling app/app.c
 compiling app/aboot/aboot.c
 compiling app/aboot/fastboot.c
 compiling dev/fbcon/fbcon.c
 compiling dev/gcdb/display/gcdb_display.c
 compiling dev/gcdb/display/gcdb_display_param.c
 compiling dev/gcdb/display/panel_display.c
 compiling dev/gcdb/display/gcdb_autopll.c
 compiling dev/keys/keys.c
 compiling dev/pmic/pm8x41/pm8x41.c
 compiling dev/pmic/pm8x41/pm8x41_adc.c
 compiling dev/pmic/pm8x41/pm8x41_wled.c
 compiling dev/pmic/pm8x41/pm8x41_vib.c
 compiling dev/pmic/pm8x41/pm_pwm.c
 compiling dev/vib/vibrator.c
 compiling lib/debug/debug.c
 compiling lib/heap/heap.c
 compiling lib/libc/atoi.c
 compiling lib/libc/bsearch.c
 compiling lib/libc/ctype.c
 compiling lib/libc/errno.c
 compiling lib/libc/gcd_lcm.c
 compiling lib/libc/itoa.c
 compiling lib/libc/printf.c
 compiling lib/libc/malloc.c
 compiling lib/libc/rand.c
 compiling lib/libc/stdio.c
 compiling lib/libc/eabi.c
 compiling lib/libc/string/arch/arm/memcpy.S
 compiling lib/libc/string/arch/arm/memset.S
 compiling lib/libc/string/memchr.c
 compiling lib/libc/string/memcmp.c
 compiling lib/libc/string/memscpy.c
 compiling lib/libc/string/strcasecmp.c
 compiling lib/libc/string/strcat.c
 compiling lib/libc/string/strchr.c
 compiling lib/libc/string/strcmp.c
 compiling lib/libc/string/strcoll.c
 compiling lib/libc/string/strcpy.c
 compiling lib/libc/string/strdup.c
 compiling lib/libc/string/strerror.c
 compiling lib/libc/string/strlcat.c
 compiling lib/libc/string/strlcpy.c
 compiling lib/libc/string/strlen.c
 compiling lib/libc/string/strncat.c
 compiling lib/libc/string/strncpy.c
 compiling lib/libc/string/strncmp.c
 compiling lib/libc/string/strnicmp.c
 compiling lib/libc/string/strnlen.c
 compiling lib/libc/string/strpbrk.c
 compiling lib/libc/string/strrchr.c
 compiling lib/libc/string/strspn.c
 compiling lib/libc/string/strrev.c
 compiling lib/libc/string/strstr.c
 compiling lib/libc/string/strtok.c
 compiling lib/libc/string/strxfrm.c
 compiling lib/libfdt/fdt.c
 compiling lib/libfdt/fdt_ro.c
 compiling lib/libfdt/fdt_wip.c
 compiling lib/libfdt/fdt_sw.c
 compiling lib/libfdt/fdt_rw.c
 compiling lib/libfdt/fdt_strerror.c
 compiling lib/libfdt/fdt_empty_tree.c
 compiling lib/libfdt/fdt_addresses.c
 compiling lib/libfdt/fdt_overlay.c
 compiling lib/libfdt/fdt_check.c
 compiling lib/ptable/ptable.c
 compiling lk2nd/init.c
 compiling lk2nd/util/cmdline.c
 compiling lk2nd/util/lkfdt.c
 compiling lk2nd/util/mmu.c
 compiling lk2nd/boot/boot.c
 compiling lk2nd/boot/extlinux.c
 compiling lk2nd/boot/util.c
 compiling lk2nd/device/device.c
 compiling lk2nd/device/panel.c
 compiling lk2nd/device/keys.c
 compiling lk2nd/device/leds.c
 compiling lk2nd/device/regulator-fixed.c
 compiling lk2nd/device/regulator-ldo.c
 compiling lk2nd/device/sdhc.c
 compiling lk2nd/device/smb1360/smb1360.c
 compiling lk2nd/device/smb1360/gpl/battery-idol347.c
 compiling lk2nd/device/smb1360/gpl/battery-wt88047.c
 compiling lk2nd/device/smb1360/gpl/battery-qcom.c
 compiling lk2nd/fastboot/fetch.c
 compiling lk2nd/fastboot/hash.c
 compiling lk2nd/fastboot/misc.c
 compiling lk2nd/fastboot/dtb.c
 compiling lk2nd/fastboot/debug/cpuid.c
 compiling lk2nd/fastboot/debug/register.c
 compiling lk2nd/fastboot/debug/regulator.c
 compiling lk2nd/hw/gpio/gpio.c
 compiling lk2nd/hw/gpio/tlmm.c
 compiling lk2nd/hw/gpio/pm8x41.c
 compiling lk2nd/hw/i2c/dt.c
 compiling lk2nd/hw/i2c/gpio_i2c.c
 compiling lk2nd/ramoops/ramoops.c
 compiling lk2nd/rng-seed/rng-seed.c
 compiling lk2nd/serialno/mac.c
 compiling lk2nd/serialno/serialno.c
 compiling lk2nd/smp/clock-msm8916.c
 compiling lk2nd/smp/cpu-boot.c
 compiling lk2nd/smp/cortex-a.c
 compiling lk2nd/smp/spin-table/spin-table.c
 compiling lk2nd/version/version.c
 compiling build-lk1st-msm8916/lk2nd/version/tag.c
 compiling lib/bio/bio.c
 compiling lib/bio/debug.c
 compiling lib/bio/mem.c
 compiling lib/bio/subdev.c
 compiling lib/fs/fs.c
 compiling lib/fs/debug.c
 compiling lib/zlib_inflate/zutil.c
 compiling lib/zlib_inflate/adler32.c
 compiling lib/zlib_inflate/inftrees.c
 compiling lib/zlib_inflate/inflate.c
 compiling lib/zlib_inflate/inffast.c
 compiling lib/zlib_inflate/uncompr.c
 compiling lib/zlib_inflate/decompress.c
 compiling lk2nd/hw/bdev/bdev.c
 compiling lk2nd/hw/bdev/util.c
 compiling lk2nd/hw/bdev/wrapper.c
 compiling lk2nd/hw/bdev/mmc_sdhci.c
 compiling lk2nd/hw/regulator/gpl/qcom_spmi-regulator.c
 compiling lib/fs/ext2/ext2.c
 compiling lib/fs/ext2/dir.c
 compiling lib/fs/ext2/io.c
 compiling lib/fs/ext2/file.c
 compiling lib/partition/partition.c
 compiling lib/bcache/bcache.c
 linking build-lk1st-msm8916/lk
 generating image: build-lk1st-msm8916/lk.bin
 generating listing: build-lk1st-msm8916/lk.lst
 generating listing: build-lk1st-msm8916/lk.debug.lst
 generating symbols: build-lk1st-msm8916/lk.sym
   text	   data	    bss	    dec	    hex	filename
 202308	  59388	 224720	 486416	  76c10	build-lk1st-msm8916/lk
 arm-none-eabi-objcopy -O binary build-lk1st-msm8916/lk build-lk1st-msm8916/lk.bin
 generating size map: build-lk1st-msm8916/lk.size
 generating stripped elf: build-lk1st-msm8916/lk_s.elf
 cp -f ./build-lk1st-msm8916/lk_s.elf ./build-lk1st-msm8916/emmc_appsboot.mbn
 make[1]: Leaving directory '/tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/force'
--- a/b5a/config-autoboot.h
+++ b/b5a/config-autoboot.h
@ -0,0 +1,97 @@
 #ifndef __CONFIG_H
 #define __CONFIG_H
 #define BOARD lk1st-msm8916
 #define LK 1
 #define USE_LE_SYSTEMD 0
 #define MOUNT_EMMC_LE 0
 #define TARGET_USE_SYSTEM_AS_ROOT_IMAGE 0
 #define ENABLE_KASLRSEED_SUPPORT 1
 #define WITH_DEBUG_LOG_BUF 1
 #define WITH_DEBUG_UART 1
 #define ENABLE_FBCON_LOGGING 1
 #define DEVICE_TREE 1
 #define CRYPTO_BAM 1
 #define SPMI_CORE_V2 1
 #define BAM_V170 1
 #define ABOOT_IGNORE_BOOT_HEADER_ADDRS 1
 #define LONG_PRESS_POWER_ON 1
 #define MMC_SDHCI_SUPPORT 1
 #define _EMMC_BOOT 1
 #define PON_VIB_SUPPORT 1
 #define PLATFORM_USE_SCM_DLOAD 1
 #define USE_PON_REBOOT_REG 1
 #define WITH_DEBUG_LOG_BUF 1
 #define LK_LOG_BUF_SIZE 32768
 #define GENERATE_CMDLINE_ONLY_FOR_ANDROID 1
 #define DISABLE_SPLASH_PARTITION 1
 #define FASTBOOT_HELP 1
 #define DISPLAY_TYPE_MIPI 1
 #define DISPLAY_TYPE_DSI6G 1
 #define MEMSIZE 0x00100000
 #define MEMBASE 0x8F600000
 #define BASE_ADDR 0x80000000
 #define SCRATCH_ADDR 0x90000000
 #define ARM_CPU_CORE_A7
 #define PERIPH_BLK_BLSP 1
 #define WITH_CPU_EARLY_INIT 0
 #define WITH_CPU_WARM_BOOT 0
 #define MMC_SLOT 1
 #define PANIC_REBOOT_MODE EMERGENCY_DLOAD
 #define DISPLAY_TYPE_MDSS 1
 #define DTBO_DISABLED 1
 #define ARM_CPU_CORTEX_A8 1
 #define ARM_WITH_CP15 1
 #define ARM_WITH_MMU 1
 #define ARM_ISA_ARMV7 1
 #define ARM_WITH_VFP 1
 #define ARM_WITH_NEON 1
 #define ARM_WITH_THUMB 1
 #define ARM_WITH_THUMB2 1
 #define ARM_WITH_CACHE 1
 #define ARM_WITH_L2 1
 #define ASSERT_ON_TAMPER 1
 #define ABOOT_STANDALONE 1
 #define GPL 1
 #define LK2ND_BOOT_MEM_SIZE 0x03200000
 #define LK2ND_BUNDLE_DTB "./build-lk1st-msm8916/lk2nd/device/dts/msm8916/msm8916-512mb-mtp.dtb"
 #define CPU_BOOT_CORTEX_A 1
 #define PROJECT_LK1ST_MSM8916 1
 #define TARGET_MSM8916 1
 #define PLATFORM_MSM8916 1
 #define ARCH_ARM 1
 #define WITH_APP_ABOOT 1
 #define WITH_DEV_FBCON 1
 #define WITH_DEV_GCDB_DISPLAY 1
 #define WITH_DEV_KEYS 1
 #define WITH_DEV_PMIC_PM8X41 1
 #define WITH_DEV_VIB 1
 #define WITH_LIB_BCACHE 1
 #define WITH_LIB_BIO 1
 #define WITH_LIB_DEBUG 1
 #define WITH_LIB_FS 1
 #define WITH_LIB_FS_EXT2 1
 #define WITH_LIB_HEAP 1
 #define WITH_LIB_LIBC 1
 #define WITH_LIB_LIBFDT 1
 #define WITH_LIB_PARTITION 1
 #define WITH_LIB_PTABLE 1
 #define WITH_LIB_ZLIB_INFLATE 1
 #define WITH_LK2ND 1
 #define WITH_LK2ND_BOOT 1
 #define WITH_LK2ND_DEVICE 1
 #define WITH_LK2ND_FASTBOOT 1
 #define WITH_LK2ND_FASTBOOT_DEBUG 1
 #define WITH_LK2ND_HW_BDEV 1
 #define WITH_LK2ND_HW_GPIO 1
 #define WITH_LK2ND_HW_I2C 1
 #define WITH_LK2ND_HW_REGULATOR 1
 #define WITH_LK2ND_RAMOOPS 1
 #define WITH_LK2ND_RNG_SEED 1
 #define WITH_LK2ND_SERIALNO 1
 #define WITH_LK2ND_SMP 1
 #define WITH_LK2ND_SMP_SPIN_TABLE 1
 #define WITH_LK2ND_VERSION 1
 #define MEMRWOFF .
 #define DEBUG 1
 #define _EMMC_BOOT 1
 #endif
--- a/b5a/config-force-repro.h
+++ b/b5a/config-force-repro.h
@ -0,0 +1,98 @@
 #ifndef __CONFIG_H
 #define __CONFIG_H
 #define BOARD lk1st-msm8916
 #define LK 1
 #define USE_LE_SYSTEMD 0
 #define MOUNT_EMMC_LE 0
 #define TARGET_USE_SYSTEM_AS_ROOT_IMAGE 0
 #define ENABLE_KASLRSEED_SUPPORT 1
 #define WITH_DEBUG_LOG_BUF 1
 #define WITH_DEBUG_UART 1
 #define ENABLE_FBCON_LOGGING 1
 #define DEVICE_TREE 1
 #define CRYPTO_BAM 1
 #define SPMI_CORE_V2 1
 #define BAM_V170 1
 #define ABOOT_IGNORE_BOOT_HEADER_ADDRS 1
 #define LONG_PRESS_POWER_ON 1
 #define MMC_SDHCI_SUPPORT 1
 #define _EMMC_BOOT 1
 #define PON_VIB_SUPPORT 1
 #define PLATFORM_USE_SCM_DLOAD 1
 #define USE_PON_REBOOT_REG 1
 #define WITH_DEBUG_LOG_BUF 1
 #define LK_LOG_BUF_SIZE 32768
 #define LK2ND_FORCE_FASTBOOT 1
 #define GENERATE_CMDLINE_ONLY_FOR_ANDROID 1
 #define DISABLE_SPLASH_PARTITION 1
 #define FASTBOOT_HELP 1
 #define DISPLAY_TYPE_MIPI 1
 #define DISPLAY_TYPE_DSI6G 1
 #define MEMSIZE 0x00100000
 #define MEMBASE 0x8F600000
 #define BASE_ADDR 0x80000000
 #define SCRATCH_ADDR 0x90000000
 #define ARM_CPU_CORE_A7
 #define PERIPH_BLK_BLSP 1
 #define WITH_CPU_EARLY_INIT 0
 #define WITH_CPU_WARM_BOOT 0
 #define MMC_SLOT 1
 #define PANIC_REBOOT_MODE EMERGENCY_DLOAD
 #define DISPLAY_TYPE_MDSS 1
 #define DTBO_DISABLED 1
 #define ARM_CPU_CORTEX_A8 1
 #define ARM_WITH_CP15 1
 #define ARM_WITH_MMU 1
 #define ARM_ISA_ARMV7 1
 #define ARM_WITH_VFP 1
 #define ARM_WITH_NEON 1
 #define ARM_WITH_THUMB 1
 #define ARM_WITH_THUMB2 1
 #define ARM_WITH_CACHE 1
 #define ARM_WITH_L2 1
 #define ASSERT_ON_TAMPER 1
 #define ABOOT_STANDALONE 1
 #define GPL 1
 #define LK2ND_BOOT_MEM_SIZE 0x03200000
 #define LK2ND_BUNDLE_DTB "./build-lk1st-msm8916/lk2nd/device/dts/msm8916/msm8916-512mb-mtp.dtb"
 #define CPU_BOOT_CORTEX_A 1
 #define PROJECT_LK1ST_MSM8916 1
 #define TARGET_MSM8916 1
 #define PLATFORM_MSM8916 1
 #define ARCH_ARM 1
 #define WITH_APP_ABOOT 1
 #define WITH_DEV_FBCON 1
 #define WITH_DEV_GCDB_DISPLAY 1
 #define WITH_DEV_KEYS 1
 #define WITH_DEV_PMIC_PM8X41 1
 #define WITH_DEV_VIB 1
 #define WITH_LIB_BCACHE 1
 #define WITH_LIB_BIO 1
 #define WITH_LIB_DEBUG 1
 #define WITH_LIB_FS 1
 #define WITH_LIB_FS_EXT2 1
 #define WITH_LIB_HEAP 1
 #define WITH_LIB_LIBC 1
 #define WITH_LIB_LIBFDT 1
 #define WITH_LIB_PARTITION 1
 #define WITH_LIB_PTABLE 1
 #define WITH_LIB_ZLIB_INFLATE 1
 #define WITH_LK2ND 1
 #define WITH_LK2ND_BOOT 1
 #define WITH_LK2ND_DEVICE 1
 #define WITH_LK2ND_FASTBOOT 1
 #define WITH_LK2ND_FASTBOOT_DEBUG 1
 #define WITH_LK2ND_HW_BDEV 1
 #define WITH_LK2ND_HW_GPIO 1
 #define WITH_LK2ND_HW_I2C 1
 #define WITH_LK2ND_HW_REGULATOR 1
 #define WITH_LK2ND_RAMOOPS 1
 #define WITH_LK2ND_RNG_SEED 1
 #define WITH_LK2ND_SERIALNO 1
 #define WITH_LK2ND_SMP 1
 #define WITH_LK2ND_SMP_SPIN_TABLE 1
 #define WITH_LK2ND_VERSION 1
 #define MEMRWOFF .
 #define DEBUG 1
 #define _EMMC_BOOT 1
 #endif
--- a/b5a/config.diff
+++ b/b5a/config.diff
@ -0,0 +1,10 @@
 --- config-force-repro.h	2026-09-30 17:25:56.607262520 +0600
 +++ config-autoboot.h	2026-09-30 17:25:56.599262481 +0600
@@ -22,7 +22,6 @@
 #define USE_PON_REBOOT_REG 1
 #define WITH_DEBUG_LOG_BUF 1
 #define LK_LOG_BUF_SIZE 32768
 -#define LK2ND_FORCE_FASTBOOT 1
 #define GENERATE_CMDLINE_ONLY_FOR_ANDROID 1
 #define DISABLE_SPLASH_PARTITION 1
 #define FASTBOOT_HELP 1
--- a/b5b/B5b-rollback.sh
+++ b/b5b/B5b-rollback.sh
@ -0,0 +1,9 @@
 #!/bin/bash
 # B5b rollback — restore pre-B5b cache (Android ext4, 817118e4). Needs 9008 via HW EDL. After this, power-on boots emmc1 from boot again.
 cd ~/doc/modem/jz08-aurora || exit 1
 L=firehose/007050e100000000_394a2e47cf830150_fhprg_peek.bin ; O=logs/b5b/rollback ; mkdir -p $O
 B=b5b/backup/cache-current-817118e4.bin
 edl --loader=$L printgpt > $O/00-printgpt.log 2>&1
 edl --loader=$L w cache $B > $O/cache-w.log 2>&1
 edl --loader=$L r cache $O/cache-rb.bin > /dev/null 2>&1 ; cmp $B $O/cache-rb.bin && echo CACHE_RESTORED
 sha256sum $B $O/cache-rb.bin
--- a/b5b/B5b-write.sh
+++ b/b5b/B5b-write.sh
@ -0,0 +1,46 @@
 #!/bin/bash
 # B5b — the ONLY write: cache := minimal ext2 with exact golden mm1 components. Run on 480s ONLY after explicit GO.
 # Entry: HW EDL (battery on, D+->GND, plug USB, release). Never `edl reset`. Stops at first failed gate.
 cd ~/doc/modem/jz08-aurora || exit 1
 L=firehose/007050e100000000_394a2e47cf830150_fhprg_peek.bin
 O=logs/b5b/W ; A3=logs/b5a/A3 ; P=logs/b5a/A4pre ; mkdir -p $O
 NEW=b5b/cache-extlinux-mm1.img            ; NEW_SHA=409bbb11c34d95c867c5cc1a33a686a7ecd5fcb4d43b5c592f334cd402114ed9
 OLD_SHA=817118e44545268014c76cfe4775866be7b9939699d214e009e27413dc5d8c9e
 BOOT_SHA=e9579f33c7304cd47f487f2b61cd9226dc04fd3a63775d62b4b95fc15bd3ebff
 ABOOT_SHA=3b8cd2667837fc7083cb28991d849f9b408a07fa743bfd05eafee7b053760f85
 die(){ echo "STOP: $*"; exit 1; }
 sha(){ sha256sum "$1" | cut -d" " -f1; }
 E(){ edl --loader=$L "$@"; }
 echo "== G0 inputs"
 [ "$(sha $L)" = 53f193500c03248f0d671ab57bfe9ca8a42967e97f28403294b4b3f854075aca ] || die loader
 [ "$(sha $NEW)" = $NEW_SHA ] && [ $(stat -c %s $NEW) = 134217728 ] || die candidate
 [ "$(sha b5b/backup/cache-current-817118e4.bin)" = $OLD_SHA ] || die backup
 lsusb | grep -q 05c6:9008 || die "no 9008"
 echo "== G1 identity + geometry + baseline"
 E printgpt > $O/00-printgpt.log 2>&1 || die printgpt
 grep -aq "Serial: *0x<SAHARA_SERIAL>" $O/00-printgpt.log || grep -aq "Mode detected: firehose" $O/00-printgpt.log || die serial
 grep -a "^cache:" $O/00-printgpt.log | grep -q "Offset 0x000000004118c000, Length 0x0000000008000000" || die cache-geometry
 E rs 0 34 $O/pre-gptp.bin >/dev/null 2>&1; cmp $O/pre-gptp.bin $A3/gpt-primary-34.bin || die gpt-changed
 E r boot  $O/pre-boot.bin  >/dev/null 2>&1; [ "$(sha $O/pre-boot.bin)"  = $BOOT_SHA ]  || die boot-not-emmc1
 E r aboot $O/pre-aboot.bin >/dev/null 2>&1; [ "$(sha $O/pre-aboot.bin)" = $ABOOT_SHA ] || die aboot-not-autoboot
 E r cache $O/pre-cache.bin >/dev/null 2>&1; [ "$(sha $O/pre-cache.bin)" = $OLD_SHA ]  || die cache-not-backup
 echo "== W cache := candidate (LBA 2133088, 262144 sectors)"
 E w cache $NEW > $O/10-cache-write.log 2>&1; echo "rc=$?"; grep -a "Wrote" $O/10-cache-write.log
 E r cache $O/11-cache-readback.bin > $O/11-cache-readback.log 2>&1 || die readback-rc
 sha256sum $NEW $O/11-cache-readback.bin
 cmp $NEW $O/11-cache-readback.bin || die "CACHE READBACK MISMATCH — do NOT reboot; run B5b-rollback.sh"
 echo CACHE_MATCH
 echo "== V everything else unchanged"
 E rs 0 34        $O/post-gptp.bin  >/dev/null 2>&1; cmp $O/post-gptp.bin  $A3/gpt-primary-34.bin || die gptp
 E rs 7634911 33  $O/post-gptb.bin  >/dev/null 2>&1; cmp $O/post-gptb.bin  $A3/gpt-backup-33.bin  || die gptb
 E rs 305184 1024 $O/post-tzbak.bin >/dev/null 2>&1; cmp $O/post-tzbak.bin $A3/tzbak-305184.bin   || die tzbak
 E r boot  $O/post-boot.bin  >/dev/null 2>&1; [ "$(sha $O/post-boot.bin)"  = $BOOT_SHA ]  || die boot
 E r aboot $O/post-aboot.bin >/dev/null 2>&1; [ "$(sha $O/post-aboot.bin)" = $ABOOT_SHA ] || die aboot
 for p in sbl1 rpm tz hyp recovery modemst1 modemst2 fsg fsc persist; do
  E r $p $O/post-$p.bin >/dev/null 2>&1; cmp $O/post-$p.bin $A3/$p.bin || die "$p changed"; echo "$p == A3"
 done
 for p in modem system userdata; do
  E r $p $O/post-$p.bin >/dev/null 2>&1; cmp $O/post-$p.bin $P/$p.bin || die "$p changed"; echo "$p == A4pre"; rm -f $O/post-$p.bin
 done
 (cd $O && sha256sum *.bin > SHA256SUMS)
 echo "B5B_WRITE_VERIFIED — power off fully (USB, then battery) before first boot"
--- a/b5b/SHA256SUMS
+++ b/b5b/SHA256SUMS
@ -0,0 +1,12 @@
 409bbb11c34d95c867c5cc1a33a686a7ecd5fcb4d43b5c592f334cd402114ed9  cache-extlinux-mm1.img
 e14e9ad60e4914bd122368d43dd632959b984716de1c601743ef86f9683628b1  extlinux.conf
 045cc857a5e27313188aaedcba80d93df4a0db1d450f2c7074169273374fafee  mkfs-candidate.sh
 c0ebd361d2bd09a54d7cd1f88316de3a8551814fcb369a0817ea6c9980e9c34f  B5b-write.sh
 72d3deb1e6e77d5b0caa45688acab640de1b628f622c7408d2df32821f6ef88e  B5b-rollback.sh
 817118e44545268014c76cfe4775866be7b9939699d214e009e27413dc5d8c9e  backup/cache-current-817118e4.bin
 9c20a372aedf94dfec5b758320a3ab7dac0a806258441efab60219678985079d  components/Image.gz
 0ff9c802346697a029aea28e6f571fa669c8907c8c73430c2c2639e388ad82a3  components/Image.gz-dtb
 a10056c50a6cc89dd14c3a418fc1de4ed4b21986f4661ad959184fc0e6ab2c7b  components/aurora-mm1.dtb
 cc54d780cca61927b0b98d638f5ef304a0b65d688f4b2ae40f990a8e7a5d68e3  components/cmdline.txt
 250bf8eea58cb64cba0b8f18a14e5b0d1a8aec3e99bb1009826e4d1126d0bd81  components/initramfs.cpio.gz
 d4be800b8658968f381a4b33fc2d42c95bafe50b8ab159b2d8e7982717b85ed7  emu/lk2nd-scan-emu
--- a/b5b/components/cmdline.txt
+++ b/b5b/components/cmdline.txt
@ -0,0 +1 @@
 earlycon console=ttyMSM0,115200n8 ignore_loglevel loglevel=8 rdinit=/init
--- a/b5b/emu/F1-no-conf.out
+++ b/b5b/emu/F1-no-conf.out
@ -0,0 +1,42 @@
 [lk] Registering wrapper bio devices...
 [lk] block devices:
 [lk]  | dev        | label           | size       | Leaf |
 [lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
 [lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
 [lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
 [lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
 [lk]  | wrp0p22    | system          |    800 MiB | Yes  |
 [lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
 [lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
 [lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
 [lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
 [lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
 [lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
 [lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
 [lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
 [lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
 [lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
 [lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
 [lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
 [lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
 [lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
 [lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
 [lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
 [lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
 [lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
 [lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
 [lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
 [lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
 [lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
 [lk]  | wrp0       |                 |   3728 MiB |      |
 [lk] boot: Trying to boot from the file system...
 [lk] boot: Bootable file system not found. Reverting to android boot.
 HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
 HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
 HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=0
 HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
 HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
 HARNESS: total bytes read 45568
--- a/b5b/emu/F10-zeroed-cache.out
+++ b/b5b/emu/F10-zeroed-cache.out
@ -0,0 +1,42 @@
 [lk] Registering wrapper bio devices...
 [lk] block devices:
 [lk]  | dev        | label           | size       | Leaf |
 [lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
 [lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
 [lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
 [lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
 [lk]  | wrp0p22    | system          |    800 MiB | Yes  |
 [lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
 [lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
 [lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
 [lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
 [lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
 [lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
 [lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
 [lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
 [lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
 [lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
 [lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
 [lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
 [lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
 [lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
 [lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
 [lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
 [lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
 [lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
 [lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
 [lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
 [lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
 [lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
 [lk]  | wrp0       |                 |   3728 MiB |      |
 [lk] boot: Trying to boot from the file system...
 [lk] boot: Bootable file system not found. Reverting to android boot.
 HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
 HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
 HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=-1
 HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
 HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
 HARNESS: total bytes read 28160
--- a/b5b/emu/F11-bad-superblock.out
+++ b/b5b/emu/F11-bad-superblock.out
@ -0,0 +1,42 @@
 [lk] Registering wrapper bio devices...
 [lk] block devices:
 [lk]  | dev        | label           | size       | Leaf |
 [lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
 [lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
 [lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
 [lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
 [lk]  | wrp0p22    | system          |    800 MiB | Yes  |
 [lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
 [lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
 [lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
 [lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
 [lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
 [lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
 [lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
 [lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
 [lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
 [lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
 [lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
 [lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
 [lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
 [lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
 [lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
 [lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
 [lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
 [lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
 [lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
 [lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
 [lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
 [lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
 [lk]  | wrp0       |                 |   3728 MiB |      |
 [lk] boot: Trying to boot from the file system...
 [lk] boot: Bootable file system not found. Reverting to android boot.
 HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
 HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
 HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=-1
 HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
 HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
 HARNESS: total bytes read 28160
--- a/b5b/emu/F2-no-kernel.out
+++ b/b5b/emu/F2-no-kernel.out
@ -0,0 +1,44 @@
 [lk] Registering wrapper bio devices...
 [lk] block devices:
 [lk]  | dev        | label           | size       | Leaf |
 [lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
 [lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
 [lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
 [lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
 [lk]  | wrp0p22    | system          |    800 MiB | Yes  |
 [lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
 [lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
 [lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
 [lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
 [lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
 [lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
 [lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
 [lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
 [lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
 [lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
 [lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
 [lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
 [lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
 [lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
 [lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
 [lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
 [lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
 [lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
 [lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
 [lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
 [lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
 [lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
 [lk]  | wrp0       |                 |   3728 MiB |      |
 [lk] boot: Trying to boot from the file system...
 [lk] Kernel /wrp0p24//Image.gz-dtb does not exist
 [lk] Failed to parse extlinux.conf
 [lk] boot: Bootable file system not found. Reverting to android boot.
 HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
 HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
 HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=0
 HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
 HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
 HARNESS: total bytes read 53760
--- a/b5b/emu/F3-no-initrd.out
+++ b/b5b/emu/F3-no-initrd.out
@ -0,0 +1,44 @@
 [lk] Registering wrapper bio devices...
 [lk] block devices:
 [lk]  | dev        | label           | size       | Leaf |
 [lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
 [lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
 [lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
 [lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
 [lk]  | wrp0p22    | system          |    800 MiB | Yes  |
 [lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
 [lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
 [lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
 [lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
 [lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
 [lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
 [lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
 [lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
 [lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
 [lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
 [lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
 [lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
 [lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
 [lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
 [lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
 [lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
 [lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
 [lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
 [lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
 [lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
 [lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
 [lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
 [lk]  | wrp0       |                 |   3728 MiB |      |
 [lk] boot: Trying to boot from the file system...
 [lk] Initramfs /wrp0p24//initramfs.cpio.gz does not exist
 [lk] Failed to parse extlinux.conf
 [lk] boot: Bootable file system not found. Reverting to android boot.
 HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
 HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
 HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=0
 HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
 HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
 HARNESS: total bytes read 57856
--- a/b5b/emu/F4-no-dtb.out
+++ b/b5b/emu/F4-no-dtb.out
@ -0,0 +1,44 @@
 [lk] Registering wrapper bio devices...
 [lk] block devices:
 [lk]  | dev        | label           | size       | Leaf |
 [lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
 [lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
 [lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
 [lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
 [lk]  | wrp0p22    | system          |    800 MiB | Yes  |
 [lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
 [lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
 [lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
 [lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
 [lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
 [lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
 [lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
 [lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
 [lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
 [lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
 [lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
 [lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
 [lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
 [lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
 [lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
 [lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
 [lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
 [lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
 [lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
 [lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
 [lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
 [lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
 [lk]  | wrp0       |                 |   3728 MiB |      |
 [lk] boot: Trying to boot from the file system...
 [lk] FDT /wrp0p24//aurora-mm1.dtb does not exist
 [lk] Failed to parse extlinux.conf
 [lk] boot: Bootable file system not found. Reverting to android boot.
 HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
 HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
 HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=0
 HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
 HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
 HARNESS: total bytes read 57856
--- a/b5b/emu/F5-garbage-conf.out
+++ b/b5b/emu/F5-garbage-conf.out
@ -0,0 +1,44 @@
 [lk] Registering wrapper bio devices...
 [lk] block devices:
 [lk]  | dev        | label           | size       | Leaf |
 [lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
 [lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
 [lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
 [lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
 [lk]  | wrp0p22    | system          |    800 MiB | Yes  |
 [lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
 [lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
 [lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
 [lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
 [lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
 [lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
 [lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
 [lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
 [lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
 [lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
 [lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
 [lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
 [lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
 [lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
 [lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
 [lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
 [lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
 [lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
 [lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
 [lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
 [lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
 [lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
 [lk]  | wrp0       |                 |   3728 MiB |      |
 [lk] boot: Trying to boot from the file system...
 [lk] No labels in the extlinux.conf
 [lk] Failed to parse extlinux.conf
 [lk] boot: Bootable file system not found. Reverting to android boot.
 HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
 HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
 HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=0
 HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
 HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
 HARNESS: total bytes read 49664
--- a/b5b/emu/F6-no-fdt-line.out
+++ b/b5b/emu/F6-no-fdt-line.out
@ -0,0 +1,44 @@
 [lk] Registering wrapper bio devices...
 [lk] block devices:
 [lk]  | dev        | label           | size       | Leaf |
 [lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
 [lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
 [lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
 [lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
 [lk]  | wrp0p22    | system          |    800 MiB | Yes  |
 [lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
 [lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
 [lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
 [lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
 [lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
 [lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
 [lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
 [lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
 [lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
 [lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
 [lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
 [lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
 [lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
 [lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
 [lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
 [lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
 [lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
 [lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
 [lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
 [lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
 [lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
 [lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
 [lk]  | wrp0       |                 |   3728 MiB |      |
 [lk] boot: Trying to boot from the file system...
 [lk] Neither fdt nor fdtdir is specified
 [lk] Failed to parse extlinux.conf
 [lk] boot: Bootable file system not found. Reverting to android boot.
 HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
 HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
 HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=0
 HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
 HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
 HARNESS: total bytes read 49664
--- a/b5b/emu/F7-crlf-conf.out
+++ b/b5b/emu/F7-crlf-conf.out
@ -0,0 +1,44 @@
 [lk] Registering wrapper bio devices...
 [lk] block devices:
 [lk]  | dev        | label           | size       | Leaf |
 [lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
 [lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
 [lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
 [lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
 [lk]  | wrp0p22    | system          |    800 MiB | Yes  |
 [lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
 [lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
 [lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
 [lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
 [lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
 [lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
 [lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
 [lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
 [lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
 [lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
 [lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
 [lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
 [lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
 [lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
 [lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
 [lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
 [lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
 [lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
 [lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
 [lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
 [lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
 [lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
 [lk]  | wrp0       |                 |   3728 MiB |      |
 [lk] boot: Trying to boot from the file system...
 [lk] Kernel /wrp0p24//Image.gz-dtb
 does not exist
 [lk] Failed to parse extlinux.conf
 [lk] boot: Bootable file system not found. Reverting to android boot.
 HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
 HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
 HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=0
 HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
 HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
 HARNESS: total bytes read 53760
--- a/b5b/emu/F8-no-final-newline.out
+++ b/b5b/emu/F8-no-final-newline.out
@ -0,0 +1,44 @@
 [lk] Registering wrapper bio devices...
 [lk] block devices:
 [lk]  | dev        | label           | size       | Leaf |
 [lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
 [lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
 [lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
 [lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
 [lk]  | wrp0p22    | system          |    800 MiB | Yes  |
 [lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
 [lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
 [lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
 [lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
 [lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
 [lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
 [lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
 [lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
 [lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
 [lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
 [lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
 [lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
 [lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
 [lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
 [lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
 [lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
 [lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
 [lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
 [lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
 [lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
 [lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
 [lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
 [lk]  | wrp0       |                 |   3728 MiB |      |
 [lk] boot: Trying to boot from the file system...
 [lk] Failed to parse the extlinux.conf
 [lk] Failed to parse extlinux.conf
 [lk] boot: Bootable file system not found. Reverting to android boot.
 HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
 HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
 HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=0
 HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
 HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
 HARNESS: total bytes read 49664
--- a/b5b/emu/F9-corrupt-gzip-kernel.out
+++ b/b5b/emu/F9-corrupt-gzip-kernel.out
@ -0,0 +1,46 @@
 [lk] Registering wrapper bio devices...
 [lk] block devices:
 [lk]  | dev        | label           | size       | Leaf |
 [lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
 [lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
 [lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
 [lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
 [lk]  | wrp0p22    | system          |    800 MiB | Yes  |
 [lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
 [lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
 [lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
 [lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
 [lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
 [lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
 [lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
 [lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
 [lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
 [lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
 [lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
 [lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
 [lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
 [lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
 [lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
 [lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
 [lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
 [lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
 [lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
 [lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
 [lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
 [lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
 [lk]  | wrp0       |                 |   3728 MiB |      |
 [lk] boot: Trying to boot from the file system...
 [lk] Trying to boot 'mm1'
 [lk] Decompressing the kernel...
 [lk] uncompression error 
 [lk] Failed to decompress the kernel: -1
 [lk] boot: Bootable file system not found. Reverting to android boot.
 HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
 HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
 HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=0
 HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
 HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
 HARNESS: total bytes read 8081920
--- a/b5b/emu/S0-current.out
+++ b/b5b/emu/S0-current.out
@ -0,0 +1,42 @@
 [lk] Registering wrapper bio devices...
 [lk] block devices:
 [lk]  | dev        | label           | size       | Leaf |
 [lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
 [lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
 [lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
 [lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
 [lk]  | wrp0p22    | system          |    800 MiB | Yes  |
 [lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
 [lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
 [lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
 [lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
 [lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
 [lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
 [lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
 [lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
 [lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
 [lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
 [lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
 [lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
 [lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
 [lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
 [lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
 [lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
 [lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
 [lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
 [lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
 [lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
 [lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
 [lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
 [lk]  | wrp0       |                 |   3728 MiB |      |
 [lk] boot: Trying to boot from the file system...
 [lk] boot: Bootable file system not found. Reverting to android boot.
 HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
 HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
 HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
 HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
 HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
 HARNESS: total bytes read 28160
--- a/b5b/emu/S1-candidate.out
+++ b/b5b/emu/S1-candidate.out
@ -0,0 +1,40 @@
 [lk] Registering wrapper bio devices...
 [lk] block devices:
 [lk]  | dev        | label           | size       | Leaf |
 [lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
 [lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
 [lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
 [lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
 [lk]  | wrp0p22    | system          |    800 MiB | Yes  |
 [lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
 [lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
 [lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
 [lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
 [lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
 [lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
 [lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
 [lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
 [lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
 [lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
 [lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
 [lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
 [lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
 [lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
 [lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
 [lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
 [lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
 [lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
 [lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
 [lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
 [lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
 [lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
 [lk]  | wrp0       |                 |   3728 MiB |      |
 [lk] boot: Trying to boot from the file system...
 [lk] Trying to boot 'mm1'
 [lk] Decompressing the kernel...
 HARNESS: boot_linux reached: kernel @DDR+0x0 tags @DDR+0x249b000 ramdisk @DDR+0x269b000 (11944942) boot_type 0
 HARNESS: kernel magic 0x644d5241 image_size 0x1680000 end @DDR+0x1680000
 HARNESS: cmdline 'earlycon console=ttyMSM0,115200n8 ignore_loglevel loglevel=8 rdinit=/init'
 HARNESS: kernel   sha256 4603b02f8ae36dcf14582a00198715e7cf64fb18bfc5c3212ef464e9ecd20032 (23015432 bytes)
 HARNESS: dtb      sha256 a10056c50a6cc89dd14c3a418fc1de4ed4b21986f4661ad959184fc0e6ab2c7b (65769 bytes)
 HARNESS: ramdisk  sha256 250bf8eea58cb64cba0b8f18a14e5b0d1a8aec3e99bb1009826e4d1126d0bd81 (11944942 bytes)
--- a/b5b/emu/map-S0-current.txt
+++ b/b5b/emu/map-S0-current.txt
@ -0,0 +1,28 @@
 0 34 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/gpt-primary-34.bin
 131072 131072 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/modem.bin
 262144 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/sbl1.bin
 263168 1024 /home/q/doc/modem/jz08-aurora/partitions/sbl1bak.bin
 264192 2048 /home/q/doc/modem/jz08-aurora/b5a/aboot-lk1st-aurora-autoboot.pad1M
 266240 2048 /home/q/doc/modem/jz08-aurora/partitions/abootbak.bin
 268288 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/rpm.bin
 269312 1024 /home/q/doc/modem/jz08-aurora/partitions/rpmbak.bin
 270336 2048 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tz.bin
 305184 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tzbak-305184.bin
 272384 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/hyp.bin
 273408 1024 /home/q/doc/modem/jz08-aurora/partitions/hypbak.bin
 274432 2048 /home/q/doc/modem/jz08-aurora/partitions/pad.bin
 276480 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst1.bin
 279552 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst2.bin
 282624 2048 /home/q/doc/modem/jz08-aurora/partitions/misc.bin
 284672 2 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsc.bin
 284674 16 /home/q/doc/modem/jz08-aurora/partitions/ssd.bin
 284690 20480 /home/q/doc/modem/jz08-aurora/partitions/splash.bin
 393216 64 /home/q/doc/modem/jz08-aurora/partitions/DDR.bin
 393280 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsg.bin
 396352 32 /home/q/doc/modem/jz08-aurora/partitions/sec.bin
 396384 32768 /home/q/doc/modem/jz08-aurora/b5a/boot-emmc1-16MiB.img
 429152 1638400 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/system.bin
 2067552 65536 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/persist.bin
 2133088 262144 /home/q/doc/modem/jz08-aurora/b5b/backup/cache-current-817118e4.bin
 2395232 32768 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/recovery.bin
 2428000 5206911 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/userdata.bin
--- a/b5b/emu/map-S1-candidate.txt
+++ b/b5b/emu/map-S1-candidate.txt
@ -0,0 +1,28 @@
 0 34 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/gpt-primary-34.bin
 131072 131072 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/modem.bin
 262144 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/sbl1.bin
 263168 1024 /home/q/doc/modem/jz08-aurora/partitions/sbl1bak.bin
 264192 2048 /home/q/doc/modem/jz08-aurora/b5a/aboot-lk1st-aurora-autoboot.pad1M
 266240 2048 /home/q/doc/modem/jz08-aurora/partitions/abootbak.bin
 268288 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/rpm.bin
 269312 1024 /home/q/doc/modem/jz08-aurora/partitions/rpmbak.bin
 270336 2048 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tz.bin
 305184 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tzbak-305184.bin
 272384 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/hyp.bin
 273408 1024 /home/q/doc/modem/jz08-aurora/partitions/hypbak.bin
 274432 2048 /home/q/doc/modem/jz08-aurora/partitions/pad.bin
 276480 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst1.bin
 279552 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst2.bin
 282624 2048 /home/q/doc/modem/jz08-aurora/partitions/misc.bin
 284672 2 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsc.bin
 284674 16 /home/q/doc/modem/jz08-aurora/partitions/ssd.bin
 284690 20480 /home/q/doc/modem/jz08-aurora/partitions/splash.bin
 393216 64 /home/q/doc/modem/jz08-aurora/partitions/DDR.bin
 393280 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsg.bin
 396352 32 /home/q/doc/modem/jz08-aurora/partitions/sec.bin
 396384 32768 /home/q/doc/modem/jz08-aurora/b5a/boot-emmc1-16MiB.img
 429152 1638400 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/system.bin
 2067552 65536 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/persist.bin
 2133088 262144 /home/q/doc/modem/jz08-aurora/b5b/cache-extlinux-mm1.img
 2395232 32768 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/recovery.bin
 2428000 5206911 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/userdata.bin
--- a/b5b/emu/mkmap.py
+++ b/b5b/emu/mkmap.py
@ -0,0 +1,16 @@
 import struct,sys
 R="/home/q/doc/modem/jz08-aurora/"
 src={"modem":"logs/b5a/A4pre/modem.bin","sbl1":"logs/b5a/A3/sbl1.bin","sbl1bak":"partitions/sbl1bak.bin","aboot":"b5a/aboot-lk1st-aurora-autoboot.pad1M",
 "abootbak":"partitions/abootbak.bin","rpm":"logs/b5a/A3/rpm.bin","rpmbak":"partitions/rpmbak.bin","tz":"logs/b5a/A3/tz.bin","tzbak":"logs/b5a/A3/tzbak-305184.bin",
 "hyp":"logs/b5a/A3/hyp.bin","hypbak":"partitions/hypbak.bin","pad":"partitions/pad.bin","modemst1":"logs/b5a/A3/modemst1.bin","modemst2":"logs/b5a/A3/modemst2.bin",
 "misc":"partitions/misc.bin","fsc":"logs/b5a/A3/fsc.bin","ssd":"partitions/ssd.bin","splash":"partitions/splash.bin","DDR":"partitions/DDR.bin","fsg":"logs/b5a/A3/fsg.bin",
 "sec":"partitions/sec.bin","boot":"b5a/boot-emmc1-16MiB.img","system":"logs/b5a/A4pre/system.bin","persist":"logs/b5a/A3/persist.bin",
 "cache":sys.argv[1],"recovery":"logs/b5a/A3/recovery.bin","userdata":"logs/b5a/A4pre/userdata.bin"}
 g=open(R+"logs/b5a/A3/gpt-primary-34.bin","rb").read()
 print(0,34,R+"logs/b5a/A3/gpt-primary-34.bin")
 for i in range(128):
    e=g[1024+128*i:1024+128*(i+1)]
    if e[:16]==bytes(16): continue
    f,l=struct.unpack("<QQ",e[32:48]); n=e[56:128].decode("utf-16le").rstrip("\0")
    p=src[n]; p=p if p.startswith("/") else R+p
    print(f,l-f+1,p)
--- a/b5b/emu/mkvariants.sh
+++ b/b5b/emu/mkvariants.sh
@ -0,0 +1,18 @@
 #!/bin/bash
 # Offline fault-injection copies of the candidate (in /tmp). Candidate itself untouched.
 set -e
 C=/home/q/doc/modem/jz08-aurora/b5b/cache-extlinux-mm1.img; D=/tmp/b5b-var; rm -rf $D; mkdir -p $D
 v(){ cp $C $D/$1.img; chmod u+w $D/$1.img; }
 v F1-no-conf;      debugfs -w -R "rm /extlinux/extlinux.conf" $D/F1-no-conf.img
 v F2-no-kernel;    debugfs -w -R "rm /Image.gz-dtb" $D/F2-no-kernel.img
 v F3-no-initrd;    debugfs -w -R "rm /initramfs.cpio.gz" $D/F3-no-initrd.img
 v F4-no-dtb;       debugfs -w -R "rm /aurora-mm1.dtb" $D/F4-no-dtb.img
 put(){ debugfs -w -R "rm $2" $D/$1.img; debugfs -w -R "write $3 $2" $D/$1.img; }
 printf "this is not an extlinux config\n" > $D/bad.conf;                         v F5-garbage-conf; put F5-garbage-conf /extlinux/extlinux.conf $D/bad.conf
 printf "default mm1\nlabel mm1\n\tlinux /Image.gz-dtb\n\tinitrd /initramfs.cpio.gz\n" > $D/nofdt.conf; v F6-no-fdt-line; put F6-no-fdt-line /extlinux/extlinux.conf $D/nofdt.conf
 sed "s/\$/\r/" ../extlinux.conf > $D/crlf.conf;                                  v F7-crlf-conf; put F7-crlf-conf /extlinux/extlinux.conf $D/crlf.conf
 printf "default mm1\nlabel mm1\n\tlinux /Image.gz-dtb\n\tfdt /aurora-mm1.dtb\n\tinitrd /initramfs.cpio.gz\n\tappend x" > $D/nonl.conf; v F8-no-final-newline; put F8-no-final-newline /extlinux/extlinux.conf $D/nonl.conf
 { printf "\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\x03"; head -c 8000000 /dev/zero | tr "\0" "\377"; } > $D/badk;  v F9-corrupt-gzip-kernel; put F9-corrupt-gzip-kernel /Image.gz-dtb $D/badk
 head -c 134217728 /dev/zero > $D/F10-zeroed-cache.img
 cp $C $D/F11-bad-superblock.img; chmod u+w $D/F11-bad-superblock.img; printf "\x00\x00" | dd of=$D/F11-bad-superblock.img bs=1 seek=1080 conv=notrunc status=none
 ls $D/*.img
--- a/b5b/emu/shim.c
+++ b/b5b/emu/shim.c
@ -0,0 +1,120 @@
 /* Host shim for running exact lk2nd 23.1 boot scan / extlinux / ext2 code against eMMC image files. */
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <stdarg.h>
 #include <stdint.h>
 #include <fcntl.h>
 #include <unistd.h>
 #include <openssl/sha.h>
 #include "shim/partition_parser.h"
 int _dprintf(const char *fmt, ...) { va_list ap; va_start(ap, fmt); printf("[lk] "); int r = vprintf(fmt, ap); va_end(ap); return r; }
 void platform_halt(void) { printf("HARNESS: platform_halt (panic)\n"); exit(3); }
 void _panic(void *caller, const char *fmt, ...) { va_list ap; va_start(ap, fmt); printf("HARNESS: PANIC "); vprintf(fmt, ap); va_end(ap); exit(3); }
 /* ---- virtual disk: LBA ranges -> files ---- */
 struct seg { uint64_t lba, n; const char *file; int fd; };
 static struct seg segs[64]; static int nsegs;
 static uint64_t disk_sectors = 7634944;
 static struct partition_entry ents[128]; static unsigned nents;
 uint64_t reads_bytes;
 static void load_map(const char *mapfile) {
 	FILE *f = fopen(mapfile, "r"); char path[512]; unsigned long long lba, n;
 	if (!f) { perror(mapfile); exit(2); }
 	while (fscanf(f, "%llu %llu %511s", &lba, &n, path) == 3) {
 		segs[nsegs].lba = lba; segs[nsegs].n = n; segs[nsegs].file = strdup(path);
 		segs[nsegs].fd = open(path, O_RDONLY); if (segs[nsegs].fd < 0) { perror(path); exit(2); }
 		off_t sz = lseek(segs[nsegs].fd, 0, SEEK_END);
 		if ((uint64_t)sz < n * 512) { fprintf(stderr, "short file %s\n", path); exit(2); }
 		nsegs++;
 	}
 	fclose(f);
 }
 static void load_gpt(const char *gptfile) {
 	unsigned char g[17408]; int fd = open(gptfile, O_RDONLY); if (fd < 0 || read(fd, g, sizeof g) != sizeof g) { perror(gptfile); exit(2); }
 	close(fd);
 	for (int i = 0; i < 128; i++) {
 		unsigned char *e = g + 1024 + 128 * i; int z = 1; for (int k = 0; k < 16; k++) if (e[k]) z = 0; if (z) continue;
 		memcpy(&ents[nents].first_lba, e + 32, 8); memcpy(&ents[nents].last_lba, e + 40, 8);
 		ents[nents].size = ents[nents].last_lba - ents[nents].first_lba + 1;
 		for (int k = 0; k < 36; k++) ents[nents].name[k] = e[56 + 2 * k];
 		nents++;
 	}
 }
 struct partition_entry *partition_get_partition_entries(void) { return ents; }
 unsigned partition_get_partition_count(void) { return nents; }
 uint32_t mmc_get_device_blocksize(void) { return 512; }
 uint64_t mmc_get_device_capacity(void) { return disk_sectors * 512; }
 uint32_t mmc_read(uint64_t addr, uint32_t *out, uint32_t len) {
 	uint8_t *o = (uint8_t *)out; reads_bytes += len;
 	while (len) {
 		uint64_t lba = addr / 512; struct seg *s = NULL;
 		for (int i = 0; i < nsegs; i++) if (lba >= segs[i].lba && lba < segs[i].lba + segs[i].n) s = &segs[i];
 		if (!s) { fprintf(stderr, "HARNESS: read of unmapped LBA %llu\n", (unsigned long long)lba); exit(4); }
 		uint64_t end = (s->lba + s->n) * 512, chunk = end - addr; if (chunk > len) chunk = len;
 		if (pread(s->fd, o, chunk, addr - s->lba * 512) != (ssize_t)chunk) { perror("pread"); exit(4); }
 		o += chunk; addr += chunk; len -= chunk;
 	}
 	return 0;
 }
 /* writes must never happen */
 uint32_t mmc_write(uint64_t a, uint32_t l, void *b) { (void)a;(void)l;(void)b; fprintf(stderr, "HARNESS: WRITE ATTEMPT\n"); abort(); }
 /* ---- target / platform ---- */
 uint8_t *fake_ddr; static uint8_t *scratch;
 void *target_get_scratch_address(void) { return scratch; }
 unsigned target_get_max_flash_size(void) { return 256u * 1024 * 1024; }
 unsigned board_machtype(void) { return 0; }
 void arch_clean_invalidate_cache_range(uintptr_t a, size_t l) { (void)a; (void)l; }
 const char *const *lk2nd_device_get_dtb_hints(void) { return NULL; }
 int fdt_open_into(const void *f, void *b, int s) { (void)f;(void)b;(void)s; return -1; }
 int fdt_overlay_apply(void *f, void *o) { (void)f;(void)o; return -1; }
 int fdt_pack(void *f) { (void)f; return -1; }
 static void hx(const char *what, const void *p, size_t n) {
 	unsigned char h[32]; SHA256(p, n, h); printf("HARNESS: %-8s sha256 ", what); for (int i = 0; i < 32; i++) printf("%02x", h[i]); printf(" (%zu bytes)\n", n);
 }
 void boot_linux(void *kernel, unsigned *tags, const char *cmdline, unsigned machtype, void *ramdisk, unsigned ramdisk_size, int boot_type) {
 	(void)machtype;
 	uint32_t *k = kernel; uint64_t image_size; memcpy(&image_size, (uint8_t *)kernel + 16, 8);
 	uint32_t dtsz = __builtin_bswap32(tags[1]);
 	printf("HARNESS: boot_linux reached: kernel @DDR+0x%lx tags @DDR+0x%lx ramdisk @DDR+0x%lx (%u) boot_type %d\n",
 	       (long)((uint8_t *)kernel - fake_ddr), (long)((uint8_t *)tags - fake_ddr), (long)((uint8_t *)ramdisk - fake_ddr), ramdisk_size, boot_type);
 	printf("HARNESS: kernel magic 0x%08x image_size 0x%llx end @DDR+0x%llx\n", k[14], (unsigned long long)image_size,
 	       (unsigned long long)((uint8_t *)kernel - fake_ddr) + image_size);
 	printf("HARNESS: cmdline '%s'\n", cmdline);
 	extern unsigned harness_kernel_len; hx("kernel", kernel, harness_kernel_len);
 	hx("dtb", tags, dtsz); hx("ramdisk", ramdisk, ramdisk_size);
 	exit(0);
 }
 unsigned harness_kernel_len = 23015432;
 void lk2nd_boot(void);
 void bio_init(void);
 void fs_init(void);
 void ext2_init(void);
 int main(int argc, char **argv) {
 	if (argc < 3) { fprintf(stderr, "usage: %s map gpt [kernel_len]\n", argv[0]); return 2; }
 	if (argc > 3) harness_kernel_len = strtoul(argv[3], 0, 0);
 	setvbuf(stdout, NULL, _IONBF, 0);
 	fake_ddr = calloc(1, 0x3200000); scratch = calloc(1, 256u * 1024 * 1024);
 	load_map(argv[1]); load_gpt(argv[2]);
 	bio_init(); fs_init();
 	lk2nd_boot();
 	printf("HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)\n");
 	{ /* diagnostics: mount result per scan candidate, same criteria as lk2nd_scan_devices */
 	  extern struct bdev_struct *bio_get_bdevs(void); extern int fs_mount(const char*,const char*,const char*); extern int fs_unmount(const char*);
 	  struct hl { struct hl *prev, *next; };
 	  struct hb { struct hl node; volatile int ref; char *name; long long size; size_t block_size; uint32_t block_count; char *label; _Bool is_leaf; };
 	  struct hl *head = (struct hl *)bio_get_bdevs();
 	  for (struct hl *n = head->next; n != head; n = n->next) { struct hb *b = (struct hb *)n; char mp[32];
 	    if (!b->is_leaf) continue;
 	    if (b->size < 16*1024*1024 && !(b->label && !strncmp(b->label, "boot", 4))) continue;
 	    snprintf(mp, sizeof mp, "/diag-%s", b->name); int r = fs_mount(mp, "ext2", b->name);
 	    printf("HARNESS: scan-candidate %-8s (%s) ext2 mount rc=%d\n", b->name, b->label ? b->label : "", r); if (r == 0) fs_unmount(mp); } }
 	printf("HARNESS: total bytes read %llu\n", (unsigned long long)reads_bytes);
 	return 1;
 }
 int atomic_add(volatile int *p, int v) { int o = *p; *p = o + v; return o; }
--- a/b5b/emu/shim/arch.h
+++ b/b5b/emu/shim/arch.h
@ -0,0 +1 @@
 #pragma once
--- a/b5b/emu/shim/arch/defines.h
+++ b/b5b/emu/shim/arch/defines.h
@ -0,0 +1,3 @@
 #pragma once
 #define PAGE_SIZE 4096
 #define CACHE_LINE 64
--- a/b5b/emu/shim/decompress.h
+++ b/b5b/emu/shim/decompress.h
@ -0,0 +1,3 @@
 #pragma once
 int decompress(unsigned char *in_buf, unsigned int in_len, unsigned char *out_buf, unsigned int out_buf_len, unsigned int *pos, unsigned int *out_len);
 int is_gzip_package(unsigned char *buf, unsigned int len);
--- a/b5b/emu/shim/harness_pre.h
+++ b/b5b/emu/shim/harness_pre.h
@ -0,0 +1,5 @@
 #pragma once
 #include <sys/types.h>
 enum boot_type { BOOT_TYPE_HARNESS_DUMMY = 0 };
 void arch_clean_invalidate_cache_range(addr_t start, size_t len);
 int atomic_add(volatile int *ptr, int val);
--- a/b5b/emu/shim/kernel/mutex.h
+++ b/b5b/emu/shim/kernel/mutex.h
@ -0,0 +1,5 @@
 #pragma once
 typedef struct { int x; } mutex_t;
 static inline void mutex_init(mutex_t *m) { (void)m; }
 static inline int mutex_acquire(mutex_t *m) { (void)m; return 0; }
 static inline int mutex_release(mutex_t *m) { (void)m; return 0; }
--- a/b5b/emu/shim/libfdt.h
+++ b/b5b/emu/shim/libfdt.h
@ -0,0 +1,4 @@
 #pragma once
 int fdt_open_into(const void *fdt, void *buf, int bufsize);
 int fdt_overlay_apply(void *fdt, void *fdto);
 int fdt_pack(void *fdt);
--- a/b5b/emu/shim/lk2nd/boot.h
+++ b/b5b/emu/shim/lk2nd/boot.h
@ -0,0 +1,2 @@
 #pragma once
 void lk2nd_boot(void);
--- a/b5b/emu/shim/lk2nd/device.h
+++ b/b5b/emu/shim/lk2nd/device.h
@ -0,0 +1,2 @@
 #pragma once
 const char *const *lk2nd_device_get_dtb_hints(void);
--- a/b5b/emu/shim/lk2nd/hw/bdev.h
+++ b/b5b/emu/shim/lk2nd/hw/bdev.h
@ -0,0 +1,2 @@
 #pragma once
 void lk2nd_bdev_init(void);
--- a/b5b/emu/shim/lk2nd/init.h
+++ b/b5b/emu/shim/lk2nd/init.h
@ -0,0 +1,2 @@
 #pragma once
 #define LK2ND_INIT(f)
--- a/b5b/emu/shim/partition_parser.h
+++ b/b5b/emu/shim/partition_parser.h
@ -0,0 +1,11 @@
 #pragma once
 #define MAX_GPT_NAME_SIZE 72
 struct partition_entry {
 	unsigned long long first_lba, last_lba, size;
 	unsigned char name[MAX_GPT_NAME_SIZE];
 };
 struct partition_entry *partition_get_partition_entries(void);
 unsigned partition_get_partition_count(void);
 uint32_t mmc_get_device_blocksize(void);
 uint64_t mmc_get_device_capacity(void);
 uint32_t mmc_read(uint64_t data_addr, uint32_t *out, uint32_t data_len);
--- a/b5b/emu/shim/platform.h
+++ b/b5b/emu/shim/platform.h
@ -0,0 +1 @@
 #pragma once
--- a/b5b/emu/shim/platform/debug.h
+++ b/b5b/emu/shim/platform/debug.h
@ -0,0 +1,4 @@
 #pragma once
 #include <stdarg.h>
 int _dprintf(const char *fmt, ...);
 void platform_halt(void);
--- a/b5b/emu/shim/platform/iomap.h
+++ b/b5b/emu/shim/platform/iomap.h
@ -0,0 +1,4 @@
 #pragma once
 #include <stdint.h>
 extern uint8_t *fake_ddr;
 #define DDR_START ((uintptr_t)fake_ddr)
--- a/b5b/emu/shim/printf.h
+++ b/b5b/emu/shim/printf.h
@ -0,0 +1,7 @@
 #pragma once
 #include <stdarg.h>
 #include <stddef.h>
 int printf(const char *fmt, ...);
 int sprintf(char *str, const char *fmt, ...);
 int snprintf(char *str, size_t len, const char *fmt, ...);
 int vsnprintf(char *str, size_t len, const char *fmt, va_list ap);
--- a/b5b/emu/shim/smem.h
+++ b/b5b/emu/shim/smem.h
@ -0,0 +1 @@
 #pragma once
--- a/b5b/emu/shim/target.h
+++ b/b5b/emu/shim/target.h
@ -0,0 +1,4 @@
 #pragma once
 void *target_get_scratch_address(void);
 unsigned target_get_max_flash_size(void);
 unsigned board_machtype(void);
--- a/b5b/emu/srclist
+++ b/b5b/emu/srclist
@ -0,0 +1 @@
 /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lk2nd/boot/boot.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lk2nd/boot/extlinux.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lk2nd/boot/util.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lk2nd/hw/bdev/bdev.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lk2nd/hw/bdev/wrapper.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lk2nd/hw/bdev/util.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/bio/bio.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/bio/subdev.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/partition/partition.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/fs/fs.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/fs/ext2/ext2.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/fs/ext2/dir.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/fs/ext2/file.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/fs/ext2/io.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/bcache/bcache.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/zlib_inflate/decompress.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/zlib_inflate/inflate.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/zlib_inflate/inffast.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/zlib_inflate/inftrees.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/zlib_inflate/zutil.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/zlib_inflate/crc32.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/zlib_inflate/adler32.c
--- a/b5b/extlinux.conf
+++ b/b5b/extlinux.conf
@ -0,0 +1,6 @@
 default mm1
 label mm1
 	linux /Image.gz-dtb
 	fdt /aurora-mm1.dtb
 	initrd /initramfs.cpio.gz
 	append earlycon console=ttyMSM0,115200n8 ignore_loglevel loglevel=8 rdinit=/init
--- a/b5b/mkfs-candidate.sh
+++ b/b5b/mkfs-candidate.sh
@ -0,0 +1,20 @@
 #!/bin/bash
 # B5b candidate: minimal ext2 image, exactly cache-sized (134217728 B), deterministic. Offline only.
 set -e
 cd ~/doc/modem/jz08-aurora/b5b
 OUT=${1:-cache-extlinux-mm1.img}
 ST=$(mktemp -d)
 mkdir -p $ST/extlinux
 cp components/Image.gz-dtb components/aurora-mm1.dtb components/initramfs.cpio.gz $ST/
 printf "default mm1\nlabel mm1\n\tlinux /Image.gz-dtb\n\tfdt /aurora-mm1.dtb\n\tinitrd /initramfs.cpio.gz\n\tappend %s\n" "$(cat components/cmdline.txt)" > $ST/extlinux/extlinux.conf
 cp $ST/extlinux/extlinux.conf extlinux.conf
 chmod 0644 $ST/*.* $ST/extlinux/extlinux.conf; chmod 0755 $ST $ST/extlinux
 find $ST -exec touch -h -d @1790000000 {} +
 rm -f $OUT; truncate -s 134217728 $OUT
 E2FSPROGS_FAKE_TIME=1790000000 /sbin/mke2fs -F -q -t ext2 -O none,filetype,sparse_super \
  -b 4096 -I 128 -N 64 -m 0 -L aurora-mm1 -U 4a5a3038-b5b0-4000-8000-00000000b5b0 \
  -E root_owner=0:0,hash_seed=4a5a3038-b5b0-4000-8000-00000000b5b1 -d $ST $OUT 32768
 rm -rf $ST
 for f in / /lost+found /extlinux /extlinux/extlinux.conf /Image.gz-dtb /aurora-mm1.dtb /initramfs.cpio.gz; do for t in atime ctime mtime; do echo "sif $f $t @1790000000"; done; done > /tmp/b5b-sif.$$
 /sbin/debugfs -w -f /tmp/b5b-sif.$$ $OUT >/dev/null 2>&1; rm -f /tmp/b5b-sif.$$
 stat -c "%n %s" $OUT; sha256sum $OUT
--- a/b6/SHA256SUMS
+++ b/b6/SHA256SUMS
@ -0,0 +1,8 @@
 df26d58a38eac85ecb5516ba03d183ebb43a1d35ecbf14d4e1849276bcab56ef  aurora-modem
 7e3521b0e6e71d4b5527845298f04d9d812ccf3bc4070b5ec6e93cb5e08bdaf6  aurora-modem.conf
 3a31c16cdcdd86b52f0097b8eefd16de9b44f83b307ed60d16f743e3f5c0f436  aurora-modem-datatest
 a235b7b6b2041e51a3b9b9ebdc8200ba1bc434194e9b9c242205ae53e11b2373  b6-run.sh
 5c7a610a48f1773710214f5f800a385d2d6806172614ed0ca2c6391ba72638a7  aurora-modem-start
 aad437c22a37b2b7491c0628288c5dc34908d14b0ac7cca07863d394df04b5e7  aurora-modem-stop
 60e5868ee407e0e800c1c41bef3f3900292f104ad25a485ef8f9558f4eaf2338  aurora-modem-status
 2ddb249630f7420cd1325bba704d015978710ed466fe3305138c54813cfb43a5  ro-check.sh
--- a/b6/aurora-modem
+++ b/b6/aurora-modem
@ -0,0 +1,293 @@
 #!/bin/sh
 # B6 RAM-only modem lifecycle controller for Aurora (golden mm1). Lives in /tmp only.
 #   aurora-modem start | stop | status | addroute <ipv4>
 # Reconstructs the proven flow (NOTES sessions 14-22 Aurora, JZ02 stopcycle/wwanfix/openrc):
 #   start: RO gates -> rmtfs -r -P -s -v (rmtfs -s starts MSS) -> MSS running -> wwan0qmi0+wwan0 (+2 s, JZ02 port-race guard)
 #          -> qmicli -p DMS online (one SET, only if not online) -> NAS registered + PS attached -> kill qmi-proxy
 #          -> udevd/dbus/polkitd/ModemManager -> MM modem registered -> ONE simple-connect -> bearer IPv4 on wwanN
 #          + /32 host routes only (no default route, usb0 untouched).
 #   stop:  simple-disconnect -> MM disable (radio low-power = detach) -> del our /32 routes, flush+down all wwan* -> stop MM (+qmi-proxy) -> BAM-DMUX suspended
 #          -> SIGTERM rmtfs: rmtfs writes "stop" to remoteproc state (MSS stops while rmtfs still serves) -> rmtfs exits LAST.
 # Never writes eMMC/NV: rmtfs -r keeps EFS writes in RAM; the script refuses to run unless the NV partitions are getro=1.
 # Exit: 0 ok, 1 failure/timeout (start rolls back with a full stop unless MODEM_KEEP_ON_FAIL=1), 2 usage/config error.
 CONF=${MODEM_CONF:-/tmp/aurora-modem.conf}
 D=/tmp/aurora-modem.d; mkdir -p $D
 LOG=$D/lifecycle.log; STATE=$D/state; ROUTES=$D/routes; BEARER=$D/bearer
 RPNAME=4080000.remoteproc
 BAM=/sys/bus/platform/devices/4080000.remoteproc:bam-dmux
 Q="qmicli -p -d /dev/wwan0qmi0"
 # --- timeouts (s); override in $CONF
 T_RMTFS=5 T_MSS=60 T_QMI_DEV=30 T_QMI=45 T_SIM=60 T_ONLINE=30 T_REG=180 T_MM_DETECT=150 T_MM_REG=60 T_CONNECT=150
 MODEM_REATTACH_HOLDOFF=120	# s between radio stop and next MSS start (B6: re-attach <=61 s after stop was rejected 3/3 by Beeline)
 T_DISCONNECT=60 T_DISABLE=30 T_MM_EXIT=30 T_BAM_IDLE=15 T_MSS_STOP=30 T_RMTFS_EXIT=15
 MODEM_APN= MODEM_USER= MODEM_PASSWORD= MODEM_AUTH= MODEM_IP_TYPE=ipv4 MODEM_TEST_ROUTES= KEEP=${MODEM_KEEP_ON_FAIL:-0}
 [ -f "$CONF" ] && . "$CONF"
 MODEM_KEEP_ON_FAIL=${MODEM_KEEP_ON_FAIL:-$KEEP}
 mmc() { mmcli "$@" 2>/dev/null | tr -d '\033' | sed 's/\[[0-9;]*m//g'; }	# mmcli colours values even without a tty
 now() { cut -d' ' -f1 /proc/uptime; }
 log() { m="[$(now)] $*"; echo "$m" >> $LOG; echo "$m"; echo "<5>[aurora-modem] $*" > /dev/kmsg 2>/dev/null; }
 setstate() { o=$(cat $STATE 2>/dev/null); echo "$1" > $STATE; log "STATE ${o:-OFF} -> $1"; }
 die() { log "FAIL: $*"; exit 1; }
 # wait_for TIMEOUT INTERVAL cmd... : poll a real condition, no blind sleeps
 wait_for() { _to=$1; _iv=$2; shift 2; _t0=$(now)
 	while :; do "$@" && return 0
 		[ "$(awk -v a="$(now)" -v b="$_t0" -v t="$_to" 'BEGIN{print (a-b>=t)}')" = 1 ] && return 1
 		sleep $_iv; done; }
 since() { awk -v a="$(now)" -v b="$1" 'BEGIN{printf "%.1f", a-b}'; }
 rp() { for r in /sys/class/remoteproc/remoteproc*; do [ "$(cat $r/name 2>/dev/null)" = $RPNAME ] && echo $r && return; done; }
 mss_state() { r=$(rp); [ -n "$r" ] && cat $r/state || echo none; }
 mss_is() { [ "$(mss_state)" = "$1" ]; }
 rmtfs_pid() { pidof rmtfs; }
 mm_pid() { pidof ModemManager; }
 bam_pm() { cat $BAM/power/runtime_status 2>/dev/null || echo none; }
 bam_suspended() { [ "$(bam_pm)" = suspended ]; }
 qmi_dev() { [ -e /dev/wwan0qmi0 ] && [ -e /sys/class/net/wwan0 ]; }
 link_up() { [ $(( $(cat /sys/class/net/$1/flags) & 1 )) -ne 0 ]; }
 mm_idx() { mmc -L | grep -oE "Modem/[0-9]+" | head -1 | cut -d/ -f2; }
 mm_has_modem() { [ -n "$(mm_idx)" ]; }
 mm_state() { mmc -m "$(mm_idx)" | awk -F': ' '/\| +state: /{gsub(/ /,"",$2); print $2; exit}'; }
 # MM initialized: proven session 22 pass 1 connected from 'disabled' (Simple.Connect enables the modem itself)
 mm_usable() { case "$(mm_state)" in disabled|enabling|enabled|searching|registered|connected|connecting) return 0;; esac; return 1; }
 qmi_ok() { timeout 20 $Q --dms-get-operating-mode > $D/qmi-mode.txt 2>&1 && grep -q "Mode:" $D/qmi-mode.txt; }
 qmi_reg() { timeout 20 $Q --nas-get-serving-system > $D/qmi-ss.txt 2>&1
 	grep -q "Registration state: 'registered'" $D/qmi-ss.txt && grep -q "PS: 'attached'" $D/qmi-ss.txt; }
 sim_ready() { timeout 20 $Q --uim-get-card-status > $D/qmi-uim.txt 2>&1
 	grep -q "Card state: 'present'" $D/qmi-uim.txt && grep -q "Application state: 'ready'" $D/qmi-uim.txt; }
 set_online() { timeout 20 $Q --dms-set-operating-mode=online > $D/qmi-set.txt 2>&1; r=$?; cat $D/qmi-set.txt >> $LOG
 	[ $r = 0 ] && return 0; grep -q "DeviceNotReady" $D/qmi-set.txt || { echo hard > $D/qmi-set.err; return 0; }; return 1; }
 # this mmcli has no --list-bearers ("no actions specified"); use 'Bearer | paths:' of mmcli -m, not the initial (attach) bearer
 bearers() { mmc -m "$(mm_idx)" | grep -v "initial bearer" | grep -oE "Bearer/[0-9]+" | cut -d/ -f2; }
 any_bearer_connected() { for b in $(bearers); do mmc -b $b | grep -q "connected: yes" && return 0; done; return 1; }
 bearer_field() { awk -F': ' -v k="$1" '$1 ~ " "k"$" {gsub(/ /,"",$2); print $2; exit}' $BEARER.txt; }
 check_safety() {
 	for p in modemst1 modemst2 fsc fsg persist; do
 		d=/dev/disk/by-partlabel/$p; [ -e $d ] || return 1
 		[ "$(blockdev --getro $(readlink -f $d))" = 1 ] || { log "SAFETY: $p not RO"; return 1; }
 	done
 	[ "$(blockdev --getro /dev/mmcblk0)" = 1 ] || { log "SAFETY: mmcblk0 not RO"; return 1; }
 	grep -q " /firmware .* ro," /proc/mounts || { log "SAFETY: /firmware not mounted ro"; return 1; }
 	[ "$(cat /sys/module/firmware_class/parameters/path)" = /firmware/image ] || { log "SAFETY: firmware path"; return 1; }
 	return 0
 }
 connect_args() {
 	for v in "$MODEM_APN" "$MODEM_USER" "$MODEM_PASSWORD" "$MODEM_AUTH" "$MODEM_IP_TYPE"; do
 		case "$v" in *[,\"\'=]*) echo "BAD"; return;; esac; done
 	a="apn=$MODEM_APN"
 	[ -n "$MODEM_USER" ] && a="$a,user=$MODEM_USER"
 	[ -n "$MODEM_PASSWORD" ] && a="$a,password=$MODEM_PASSWORD"
 	[ -n "$MODEM_AUTH" ] && a="$a,allowed-auth=$MODEM_AUTH"
 	echo "$a,ip-type=$MODEM_IP_TYPE"
 }
 addroute() { # /32 via the bearer interface, recorded so stop removes exactly what we added
 	ip=$1; . $D/ipcfg 2>/dev/null || { echo "no bearer ipcfg"; return 1; }
 	grep -qx "$ip" $ROUTES 2>/dev/null && return 0
 	ip route add $ip/32 dev $IF src $A && echo $ip >> $ROUTES
 }
 diag() { # snapshot before rollback
 	{ echo "### diag $(now) state=$(cat $STATE 2>/dev/null) mss=$(mss_state) rmtfs=$(rmtfs_pid) mm=$(mm_pid) bam=$(bam_pm)"
 	  [ -n "$(mm_pid)" ] && { mmc -L; mmc -m "$(mm_idx)"; }
 	  cat $D/qmi-mode.txt $D/qmi-ss.txt 2>/dev/null; dmesg | tail -40; } > $D/diag-$(now).txt 2>&1
 }
 fail_start() { log "FAIL in $(cat $STATE 2>/dev/null): $*"; diag
 	if [ "$MODEM_KEEP_ON_FAIL" = 1 ]; then log "MODEM_KEEP_ON_FAIL=1: leaving stack as is"
 	else log "rollback: full stop"; do_stop; fi
 	exit 1; }
 do_start() {
 	T0=$(now); log "=== START (conf $CONF, apn '${MODEM_APN}', ip-type $MODEM_IP_TYPE)"
 	[ -n "$MODEM_APN" ] || { log "config: MODEM_APN empty - refusing (no APN guessing)"; exit 2; }
 	CA=$(connect_args); [ "$CA" = BAD ] && { log "config: forbidden character in APN/user/password/auth"; exit 2; }
 	check_safety || { log "FAIL: safety gate (RO) - nothing started"; exit 1; }
 	[ -n "$(rp)" ] || { log "FAIL: remoteproc $RPNAME not found"; exit 1; }
 	# OFF -> RMTFS_READY -> MPSS_BOOTING -> MPSS_RUNNING
 	if [ -n "$(rmtfs_pid)" ] && mss_is running; then log "rmtfs $(rmtfs_pid) + MSS running already - reuse"
 	elif [ -n "$(rmtfs_pid)" ] || ! mss_is offline; then
 		log "FAIL: inconsistent (rmtfs='$(rmtfs_pid)' MSS=$(mss_state)); run stop first"; exit 1
 	else
 		if [ -f $D/last-radio-stop ]; then
 			w=$(awk -v a="$(now)" -v b="$(cat $D/last-radio-stop)" -v h="$MODEM_REATTACH_HOLDOFF" 'BEGIN{d=h-(a-b); printf "%d", (d>0)?d+1:0}')
 			[ "$w" -gt 0 ] && { log "re-attach holdoff: last radio stop $(since $(cat $D/last-radio-stop))s ago, waiting ${w}s (MODEM_REATTACH_HOLDOFF=$MODEM_REATTACH_HOLDOFF)"; sleep $w; }
 		fi
 		: > $ROUTES; rm -f $D/ipcfg
 		LD_PRELOAD=/usr/lib/linebuf.so rmtfs -r -P -s -v >> $D/rmtfs.log 2>&1 &
 		echo $! > $D/rmtfs.pid
 		wait_for $T_RMTFS 0.2 sh -c "kill -0 $(cat $D/rmtfs.pid) 2>/dev/null && grep -q 'registering services' $D/rmtfs.log" \
 			|| fail_start "rmtfs did not start (pid $(cat $D/rmtfs.pid))"
 		setstate RMTFS_READY
 		setstate MPSS_BOOTING
 		t=$(now); wait_for $T_MSS 0.2 mss_is running || fail_start "MSS not running after ${T_MSS}s (state $(mss_state))"
 		log "MSS running after $(since $t)s"
 	fi
 	setstate MPSS_RUNNING
 	# -> QMI_READY
 	t=$(now); wait_for $T_QMI_DEV 0.2 qmi_dev || fail_start "wwan0qmi0/wwan0 missing after ${T_QMI_DEV}s"
 	log "wwan0qmi0 + wwan0 present after $(since $t)s; +2 s (JZ02 rpmsg_wwan_ctrl port-race guard, proven start_post)"
 	sleep 2
 	[ "$(bam_pm)" = error ] && fail_start "BAM-DMUX runtime_status=error"
 	# -> RADIO_ONLINE -> REGISTERED  (Aurora-proven: qmicli online + NAS poll before ModemManager)
 	if [ -n "$(mm_pid)" ]; then
 		log "ModemManager already running - skip qmicli, use MM state"
 		setstate QMI_READY
 	else
 		t=$(now); wait_for $T_QMI 1 qmi_ok || fail_start "QMI DMS not answering after ${T_QMI}s"
 		setstate QMI_READY; log "DMS $(grep -o "Mode: '[^']*'" $D/qmi-mode.txt) after $(since $t)s"
 		t=$(now); wait_for $T_SIM 1 sim_ready || fail_start "SIM/USIM not ready after ${T_SIM}s ($(grep -E "Card state|Application state" $D/qmi-uim.txt | head -2 | tr -s ' \t\n' ' '))"
 		setstate SIM_READY; log "UIM card present, USIM app ready after $(since $t)s"
 		if ! grep -q "Mode: 'online'" $D/qmi-mode.txt; then
 			log "SET: $Q --dms-set-operating-mode=online (retried only on DeviceNotReady, <= ${T_ONLINE}s)"
 			rm -f $D/qmi-set.err; t=$(now); wait_for $T_ONLINE 1 set_online || fail_start "SET online: DeviceNotReady for ${T_ONLINE}s"
 			[ -f $D/qmi-set.err ] && fail_start "SET online failed: $(grep -i error $D/qmi-set.txt | head -1)"
 			qmi_ok && grep -q "Mode: 'online'" $D/qmi-mode.txt || fail_start "mode not online after SET"
 			log "DMS online after $(since $t)s"
 		fi
 		setstate RADIO_ONLINE
 		t=$(now); wait_for $T_REG 2 qmi_reg || fail_start "not registered+PS attached after ${T_REG}s ($(grep -E "Registration state" $D/qmi-ss.txt | tr -s ' \t'))"
 		log "registered: $(grep -oE "(MCC|MNC|Description): '[^']*'" $D/qmi-ss.txt | tr '\n' ' ')after $(since $t)s"
 		setstate REGISTERED
 		killall qmi-proxy 2>/dev/null; wait_for 5 0.2 sh -c '! pidof qmi-proxy >/dev/null'
 	fi
 	# -> MM_READY  (mm-up order: udevd, trigger, settle, dbus, polkitd, ModemManager)
 	pidof udevd >/dev/null || { udevd --daemon; udevadm trigger --action=add; udevadm settle --timeout=15; log "udevd started"; }
 	if ! pidof dbus-daemon >/dev/null; then
 		mkdir -p /run/dbus /var/lib/dbus /var/lib/polkit; rm -f /run/dbus/pid; dbus-uuidgen --ensure
 		dbus-daemon --system --fork || fail_start "dbus-daemon"; log "dbus started"; fi
 	pidof polkitd >/dev/null || { /usr/lib/polkit-1/polkitd --no-debug >> $D/polkitd.log 2>&1 & log "polkitd started"; }
 	if [ -z "$(mm_pid)" ]; then
 		N=$(ls $D/mm-*.log 2>/dev/null | wc -l)
 		ModemManager --debug > $D/mm-$N.log 2>&1 &
 		echo $! > $D/mm.pid; log "ModemManager started pid $! (log mm-$N.log)"
 	fi
 	t=$(now); wait_for $T_MM_DETECT 2 mm_has_modem || fail_start "MM: no modem after ${T_MM_DETECT}s"
 	log "MM modem $(mm_idx) detected after $(since $t)s"
 	mmc -m "$(mm_idx)" > $D/mm-modem.txt
 	grep -q "plugin: qcom-soc" $D/mm-modem.txt || fail_start "MM plugin is not qcom-soc"
 	grep -q "primary port: wwan0qmi0" $D/mm-modem.txt || fail_start "MM primary port is not wwan0qmi0"
 	setstate MM_READY
 	t=$(now); wait_for $T_MM_REG 2 mm_usable || fail_start "MM state '$(mm_state)' not usable after ${T_MM_REG}s"
 	log "MM state $(mm_state) after $(since $t)s"
 	# -> BEARER_CONNECTED  (exactly one simple-connect)
 	if any_bearer_connected; then log "bearer already connected - reuse"
 	else
 		log "mmcli -m $(mm_idx) --simple-connect=\"$(echo "$CA" | sed 's/password=[^,]*/password=***/')\""
 		timeout $T_CONNECT mmcli -m "$(mm_idx)" --simple-connect="$CA" >> $LOG 2>&1 || fail_start "simple-connect failed/timeout"
 	fi
 	BR=; for b in $(bearers); do mmc -b $b | grep -q "connected: yes" && BR=$b; done
 	[ -n "$BR" ] || fail_start "no connected bearer after simple-connect"
 	mmc -m "$(mm_idx)" > $D/mm-modem.txt
 	grep -qE "registration: (home|roaming)" $D/mm-modem.txt || fail_start "MM registration not home/roaming after connect"
 	log "MM state $(mm_state), $(grep -oE "registration: [a-z]+" $D/mm-modem.txt)"
 	mmc -b $BR > $BEARER.txt
 	IF=$(bearer_field interface); A=$(bearer_field address); PF=$(bearer_field prefix); GW=$(bearer_field gateway)
 	DNS=$(bearer_field dns); MTU=$(bearer_field mtu)
 	echo "$IF" | grep -qE '^wwan[0-7]$' && [ -n "$A" ] && [ -n "$PF" ] || fail_start "bearer $BR bad ipv4 config IF=$IF A=$A PF=$PF"
 	printf 'BR=%s\nIF=%s\nA=%s\nPF=%s\nGW=%s\nDNS=%s\nMTU=%s\n' "$BR" "$IF" "$A" "$PF" "$GW" "$DNS" "$MTU" > $D/ipcfg
 	log "bearer $BR: $IF $A/$PF gw $GW dns $DNS mtu $MTU"
 	ip addr flush dev $IF; ip addr add $A/$PF dev $IF || fail_start "ip addr add"
 	[ -n "$MTU" ] && ip link set $IF mtu $MTU
 	ip link set $IF up || fail_start "ip link set $IF up (bam-dmux runtime PM?)"
 	link_up $IF || fail_start "$IF not UP"
 	for h in $(echo "$DNS" | tr ',' ' ') $MODEM_TEST_ROUTES; do addroute $h || fail_start "route $h"; done
 	ip route get 172.16.42.2 2>&1 | grep -q "dev usb0" || fail_start "management route no longer via usb0"
 	ip route | grep -q "^default" && log "WARNING: a default route exists (not created by us)"
 	setstate BEARER_CONNECTED
 	log "=== START OK in $(since $T0)s ($IF $A/$PF, routes: $(tr '\n' ' ' < $ROUTES))"
 }
 do_stop() {
 	T0=$(now); log "=== STOP (from $(cat $STATE 2>/dev/null || echo OFF): mss=$(mss_state) rmtfs=$(rmtfs_pid) mm=$(mm_pid) bam=$(bam_pm))"
 	rc=0
 	# 1. disconnect bearer(s)
 	if [ -n "$(mm_pid)" ] && mm_has_modem; then
 		timeout $T_DISCONNECT mmcli -m "$(mm_idx)" --simple-disconnect >> $LOG 2>&1; log "simple-disconnect rc=$? (bearers: $(bearers | tr '\n' ' '))"
 		wait_for 15 1 sh -c "! sh $0 _anyconn" && log "no bearer connected" || { log "WARNING: bearer still connected"; rc=1; }
 		# 1b. radio off / network detach before MSS goes away (B6 addition: abrupt MSS stop while EPS-attached
 		#     was followed by attach rejection 'limited' on quick restart). MM disable = DMS low-power.
 		timeout $T_DISABLE mmcli -m "$(mm_idx)" --disable >> $LOG 2>&1; r=$?
 		wait_for 10 0.5 sh -c "[ \"\$(sh $0 _mmstate)\" = disabled ]" && log "MM disable rc=$r -> state disabled (radio low-power, detached)" \
 			|| { log "WARNING: MM disable rc=$r state '$(mm_state)'"; rc=1; }
 	elif [ -e /dev/wwan0qmi0 ] && mss_is running; then
 		timeout 20 $Q --dms-set-operating-mode=low-power >> $LOG 2>&1; log "qmicli low-power rc=$? (MM not running)"
 	fi
 	# 2. our /32 routes, 3. flush + DOWN every wwan*
 	for h in $(cat $ROUTES 2>/dev/null); do ip route del $h/32 2>/dev/null; done; : > $ROUTES
 	for d in /sys/class/net/wwan*; do [ -e "$d" ] || continue; w=${d##*/}
 		ip addr flush dev $w 2>/dev/null; ip link set $w down 2>/dev/null
 		link_up $w && { log "ERROR: $w still UP"; rc=1; }; done
 	rm -f $D/ipcfg
 	ip route | grep -q " dev wwan" && { log "ERROR: routes via wwan remain: $(ip route | grep ' dev wwan' | tr '\n' ';')"; rc=1; }
 	log "wwan links down, addresses/routes removed"
 	[ -n "$(cat $STATE 2>/dev/null)" ] && setstate WWAN_DOWN
 	# 4. stop ModemManager (+ its qmi-proxy)
 	if [ -n "$(mm_pid)" ]; then
 		kill -TERM $(mm_pid); wait_for $T_MM_EXIT 0.5 sh -c '! pidof ModemManager >/dev/null' \
 			|| { log "MM did not exit in ${T_MM_EXIT}s - SIGKILL"; kill -KILL $(mm_pid) 2>/dev/null; rc=1; }
 		log "ModemManager stopped"
 	fi
 	pidof qmi-proxy >/dev/null && { killall qmi-proxy; wait_for 5 0.2 sh -c '! pidof qmi-proxy >/dev/null'; log "qmi-proxy stopped"; }
 	setstate MM_STOPPED
 	# 5. BAM-DMUX idle
 	if [ -e $BAM ] && ! mss_is offline; then
 		t=$(now); if wait_for $T_BAM_IDLE 0.5 bam_suspended; then log "BAM-DMUX suspended after $(since $t)s"
 		else log "ERROR: BAM-DMUX '$(bam_pm)' not suspended after ${T_BAM_IDLE}s - NOT stopping MSS"; exit 1; fi
 	fi
 	# 6. MSS stop via rmtfs -s (SIGTERM -> pwrite "stop" to remoteproc state -> exit), 7. rmtfs exits last
 	P=$(rmtfs_pid)
 	mss_is running && now > $D/last-radio-stop
 	if [ -n "$P" ]; then
 		t=$(now); kill -TERM $P; log "SIGTERM rmtfs $P (rmtfs stops MSS, then exits)"
 		wait_for $T_MSS_STOP 0.2 mss_is offline && log "MSS offline after $(since $t)s (rmtfs alive: $(kill -0 $P 2>/dev/null && echo yes || echo no))" \
 			|| { log "ERROR: MSS '$(mss_state)' after ${T_MSS_STOP}s"; rc=1; }
 		setstate MPSS_STOPPED
 		wait_for $T_RMTFS_EXIT 0.2 sh -c "! kill -0 $P 2>/dev/null" && log "rmtfs exited after $(since $t)s" \
 			|| { log "rmtfs still alive - second SIGTERM"; kill -TERM $P; wait_for 5 0.2 sh -c "! kill -0 $P 2>/dev/null" || { kill -KILL $P; rc=1; }; }
 	elif ! mss_is offline && [ -n "$(rp)" ]; then
 		log "MSS $(mss_state) without rmtfs - echo stop > state"; echo stop > $(rp)/state
 		wait_for $T_MSS_STOP 0.2 mss_is offline || rc=1
 	fi
 	mss_is offline || mss_is none || { log "ERROR: MSS state $(mss_state)"; rc=1; }
 	setstate OFF
 	log "=== STOP done rc=$rc in $(since $T0)s (mss=$(mss_state) rmtfs='$(rmtfs_pid)' mm='$(mm_pid)' bam=$(bam_pm))"
 	return $rc
 }
 do_status() {
 	r=$(rp)
 	echo "controller: $(cat $STATE 2>/dev/null || echo OFF)"
 	echo "remoteproc: $RPNAME $(mss_state) ($r) fw=$(cat $r/firmware 2>/dev/null)"
 	echo "rmtfs:      pid='$(rmtfs_pid)' writes_logged=$(grep -c 'write ' $D/rmtfs.log 2>/dev/null)"
 	echo "qmi dev:    $(ls /dev/wwan0qmi0 2>/dev/null || echo absent)  qmi-proxy='$(pidof qmi-proxy)'"
 	echo "daemons:    udevd='$(pidof udevd)' dbus='$(pidof dbus-daemon)' polkitd='$(pidof polkitd)' ModemManager='$(mm_pid)'"
 	if [ -n "$(mm_pid)" ] && mm_has_modem; then
 		mmc -m "$(mm_idx)" | grep -E "\| +(state|power state|registration|operator name|access tech|signal quality|plugin|primary port): " \
 			| sed -E 's/^[^|]*\| */  mm /'
 		for b in $(bearers); do echo "  bearer $b: $(mmc -b $b | grep -E 'connected:|interface:|address:' | tr -s ' |' ' ' | tr '\n' ';')"; done
 	else echo "  mm: n/a"; fi
 	for d in /sys/class/net/wwan*; do [ -e "$d" ] || continue; w=${d##*/}
 		link_up $w && echo "wwan:       $w UP $(ip -4 addr show $w | awk '/inet /{print $2}')"; done
 	echo "wwan up:    $(n=0; for d in /sys/class/net/wwan*; do [ -e $d ] && link_up ${d##*/} && n=$((n+1)); done; echo $n) of $(ls -d /sys/class/net/wwan* 2>/dev/null | wc -l)"
 	echo "routes:     $(ip route | grep ' dev wwan' | tr '\n' ';')"
 	echo "bam-dmux:   $(bam_pm) active_ms=$(cat $BAM/power/runtime_active_time 2>/dev/null) suspended_ms=$(cat $BAM/power/runtime_suspended_time 2>/dev/null) control=$(cat $BAM/power/control 2>/dev/null)"
 	echo "usb0:       $(ip -4 addr show usb0 | awk '/inet /{print $2}') route-to-host: $(ip route get 172.16.42.2 2>&1 | head -1)"
 	echo "emmc:       $(awk '{print "writes_completed="$5" sectors_written="$7}' /sys/block/mmcblk0/stat)"
 	echo "dmesg-errs: $(dmesg | grep -cE 'Failed to resume|Resource temporarily|crash detected|fatal error|[Ww]atchdog|Oops|Kernel panic|Unable to handle')"
 }
 case "$1" in
 	start) do_start;;
 	stop) do_stop; exit $?;;
 	status) do_status;;
 	addroute) [ -n "$2" ] || exit 2; addroute "$2";;
 	_anyconn) any_bearer_connected;;
 	_mmstate) mm_state;;
 	*) echo "usage: $0 start|stop|status|addroute <ipv4>"; exit 2;;
 esac
--- a/b6/aurora-modem-datatest
+++ b/b6/aurora-modem-datatest
@ -0,0 +1,28 @@
 #!/bin/sh
 # B6 data-path test through the bearer set up by aurora-modem start. Output dir $1. Uses only /32 routes (aurora-modem addroute).
 O=${1:-/tmp/b6/dt}; mkdir -p $O; . /tmp/aurora-modem.d/ipcfg || { echo "DT: no ipcfg"; exit 1; }
 CU="env LD_LIBRARY_PATH=/tmp/cu/usr/lib /tmp/cu/usr/bin/curl --cacert /tmp/cu/etc/ssl/certs/ca-certificates.crt --interface $IF -4 --connect-timeout 10 -sS"
 W='code=%{http_code} remote=%{remote_ip}:%{remote_port} local=%{local_ip} ssl_verify=%{ssl_verify_result} t_total=%{time_total}\n'
 D1=${DNS%%,*}
 { for n in ya.ru www.google.com; do echo "### nslookup $n $D1"; timeout 20 nslookup $n $D1 2>&1; done; } > $O/dns.txt
 ips() { awk -v n="$1" '/^### nslookup/{c=($3==n)} c && /^Address[^:]*: *[0-9.]+$/{print $NF}' $O/dns.txt | grep -v "^$D1$" | sort -u | head -2; }
 YA=$(ips ya.ru); GO=$(ips www.google.com); YA1=$(echo $YA | cut -d' ' -f1); GO1=$(echo $GO | cut -d' ' -f1)
 for y in $YA $GO; do sh /tmp/aurora-modem addroute $y; done
 { echo "ya.ru=$YA google=$GO"; for h in 77.88.8.8 $YA1 172.16.42.2 8.8.4.4; do echo "--- route get $h: $(ip route get $h 2>&1 | head -1)"; done; } > $O/routes.txt
 { for h in 77.88.8.8 1.1.1.1; do echo "### ping $h"; ping -c 3 -W 3 $h 2>&1; done; } > $O/ping.txt
 Y=$(date -u +%Y)
 { echo "### http://ya.ru/"; timeout 40 $CU --resolve ya.ru:80:$YA1 -o /dev/null -w "$W" http://ya.ru/ 2>&1; echo "rc=$?"
  if [ "$Y" -ge 2026 ]; then
    echo "### https://www.google.com/generate_204"; timeout 40 $CU --resolve www.google.com:443:$GO1 -o /dev/null -w "$W" https://www.google.com/generate_204 2>&1; echo "rc=$?"
    echo "### https://1.1.1.1/cdn-cgi/trace"; timeout 40 $CU -o /dev/null -w "$W" https://1.1.1.1/cdn-cgi/trace 2>&1; echo "rc=$?"
  else echo "### HTTPS skipped: clock year $Y (not a cellular failure)"; fi; } > $O/http.txt
 DNSOK=$([ -n "$YA1" ] && [ -n "$GO1" ] && echo 1 || echo 0)
 PING=$(grep -oE "[0-9]+ packets received" $O/ping.txt | cut -d' ' -f1 | tr '\n' '+'); PING=${PING%+}
 PINGOK=$(grep -qE "[1-9][0-9]* packets received" $O/ping.txt && echo 1 || echo 0)
 HTTP=$(grep -A1 "^### http://" $O/http.txt | grep -oE "code=[0-9]+" | head -1)
 HTTPS=$(grep -oE "code=[0-9]+" $O/http.txt | tail -n +2 | tr '\n' ' ')
 HTTPOK=$(echo "$HTTP" | grep -qE "code=[1-5][0-9][0-9]" && echo 1 || echo 0)
 if [ "$Y" -ge 2026 ]; then echo "$HTTPS" | grep -q "code=204" && echo "$HTTPS" | grep -q "code=200" && HTTPSOK=1 || HTTPSOK=0; else HTTPSOK=skip; fi
 V=FAIL; [ $DNSOK$PINGOK$HTTPOK = 111 ] && [ "$HTTPSOK" != 0 ] && V=PASS
 echo "DATATEST $V dns=$DNSOK(ya=$YA1 go=$GO1) ping=$PING http=$HTTP https=[$HTTPS]($HTTPSOK) if=$IF addr=$A" | tee $O/verdict.txt
 [ $V = PASS ]
--- a/b6/aurora-modem-start
+++ b/b6/aurora-modem-start
@ -0,0 +1,2 @@
 #!/bin/sh
 exec sh /tmp/aurora-modem start "$@"
--- a/b6/aurora-modem-status
+++ b/b6/aurora-modem-status
@ -0,0 +1,2 @@
 #!/bin/sh
 exec sh /tmp/aurora-modem status "$@"
--- a/b6/aurora-modem-stop
+++ b/b6/aurora-modem-stop
@ -0,0 +1,2 @@
 #!/bin/sh
 exec sh /tmp/aurora-modem stop "$@"
--- a/b6/aurora-modem.conf
+++ b/b6/aurora-modem.conf
@ -0,0 +1,10 @@
 # B6 operator config (sourced by /tmp/aurora-modem). Lifecycle logic is operator-independent;
 # only this file names an operator. No APN auto-selection: empty MODEM_APN => start refuses (exit 2).
 # Proven Beeline (session 22). For T2 use: MODEM_APN=internet and empty USER/PASSWORD/AUTH.
 MODEM_APN=internet.beeline.ru
 MODEM_USER=beeline
 MODEM_PASSWORD=beeline
 MODEM_AUTH=pap
 MODEM_IP_TYPE=ipv4
 # /32 host routes via the bearer interface (in addition to the bearer DNS servers). No default route.
 MODEM_TEST_ROUTES="77.88.8.8 1.1.1.1"
--- a/b6/b6-run.sh
+++ b/b6/b6-run.sh
@ -0,0 +1,46 @@
 #!/bin/sh
 # B6I harness: N x (aurora-modem start -> datatest -> aurora-modem stop) in one boot, checks after each cycle. RAM only.
 N=${1:-1}; C0=${2:-1}; O=/tmp/b6; mkdir -p $O; M="sh /tmp/aurora-modem"
 mask() { sed -E 's/([0-9]{6,})([0-9]{4})/******\2/g'; }
 mk() { echo "<5>[b6] $*" > /dev/kmsg; echo "[$(cut -d' ' -f1 /proc/uptime)] $*" | tee -a $O/run.log; }
 nv() { for want in modemst1 modemst2 fsg fsc persist; do for p in /sys/class/block/mmcblk0p*; do
 	[ "$(sed -n 's/^PARTNAME=//p' $p/uevent)" = "$want" ] && echo "$want $(basename $p) $(sha256sum /dev/$(basename $p) | cut -d' ' -f1)"; done; done; }
 ERR='Failed to resume|-110|Resource temporarily|EAGAIN|crash detected|fatal error|[Ww]atchdog|Oops|Kernel panic|Unable to handle|BUG:'
 REF="modemst1:637a71d1 modemst2:9bb10190 fsg:b0a3b7e4 fsc:5f70bf18 persist:ee48a843"
 [ -f $O/nv-boot.txt ] || cp /tmp/nv-before.txt $O/nv-boot.txt
 for c in $(seq $C0 $((C0+N-1))); do
 	X=$O/c$c; mkdir -p $X; dmesg | wc -l > $X/dmesg-off; wc -l < /tmp/aurora-modem.d/lifecycle.log > $X/log-off 2>/dev/null || echo 0 > $X/log-off
 	mk "CYCLE $c begin: $(awk '{print "w="$5" s="$7}' /sys/block/mmcblk0/stat) mss=$(cat /sys/class/remoteproc/remoteproc0/state)"
 	$M start > $X/start.out 2>&1; SR=$?; mk "CYCLE $c start rc=$SR"
 	$M status 2>&1 | mask > $X/status-up.txt
 	if [ $SR = 0 ]; then sh /tmp/aurora-modem-datatest $X/dt > $X/dt.out 2>&1; DR=$?; else DR=9; fi; mk "CYCLE $c $(cat $X/dt/verdict.txt 2>/dev/null || echo DATATEST not-run) rc=$DR"
 	[ $SR = 0 ] && { $M stop > $X/stop.out 2>&1; PR=$?; } || PR=$(grep -q "STOP done rc=0" $X/start.out && echo 0 || echo 1)
 	mk "CYCLE $c stop rc=$PR"; sleep 2
 	$M status 2>&1 | mask > $X/status-down.txt
 	nv > $X/nv.txt; cat /sys/block/mmcblk0/stat > $X/stat.txt
 	dmesg | tail -n +$(( $(cat $X/dmesg-off) + 1 )) > $X/dmesg-delta.txt
 	grep -E "$ERR" $X/dmesg-delta.txt > $X/dmesg-errs.txt
 	B=/sys/bus/platform/devices/4080000.remoteproc:bam-dmux
 	F=""
 	[ $SR = 0 ] || F="$F start"; [ $DR = 0 ] || F="$F data"; [ $PR = 0 ] || F="$F stop"
 	[ "$(cat /sys/class/remoteproc/remoteproc0/state)" = offline ] || F="$F mss"
 	[ -z "$(pidof rmtfs)" ] || F="$F rmtfs"; [ -z "$(pidof ModemManager)" ] || F="$F mm"; [ -z "$(pidof qmi-proxy)" ] || F="$F qmi-proxy"
 	for d in /sys/class/net/wwan*; do [ -e $d ] || continue; w=${d##*/}
 		[ $(( $(cat $d/flags) & 1 )) -ne 0 ] && F="$F $w-up"; ip -4 addr show $w | grep -q "inet " && F="$F $w-addr"; done
 	ip route | grep -q " dev wwan" && F="$F routes"; ip route | grep -q "^default" && F="$F default-route"
 	[ "$(cat $B/power/runtime_status)" = suspended ] || F="$F bam-$(cat $B/power/runtime_status)"
 	[ -s $X/dmesg-errs.txt ] && F="$F dmesg-errs"
 	for r in $REF; do grep -q "^${r%%:*} .* ${r#*:}" $X/nv.txt || F="$F nv-${r%%:*}"; done
 	grep -v '^stat' $O/nv-boot.txt | awk '{print $1,$3}' > $X/nv-a; awk '{print $1,$3}' $X/nv.txt > $X/nv-b; cmp -s $X/nv-a $X/nv-b || F="$F nv-vs-boot"
 	awk '{exit !($5==0 && $7==0)}' $X/stat.txt || F="$F emmc-writes"
 	ping -c 2 -W 2 172.16.42.2 > $X/usb-ping.txt 2>&1 || F="$F usb-ncm"
 	CHO=$(grep -c "Channel already open" $X/dmesg-delta.txt)
 	tail -n +$(( $(cat $X/log-off) + 1 )) /tmp/aurora-modem.d/lifecycle.log | mask > $X/lifecycle.log
 	[ -z "$F" ] && V=PASS || V="FAIL:$F"
 	mk "CYCLE $c RESULT $V (bam=$(cat $B/power/runtime_status) emmc=$(awk '{print $5"/"$7}' $X/stat.txt) chan-already-open=$CHO dmesg-errs=$(wc -l < $X/dmesg-errs.txt))"
 	[ -z "$F" ] || { mk "STOPPING after failed cycle $c"; break; }
 	sleep 5
 done
 for f in /tmp/aurora-modem.d/mm-*.log; do [ -f $f ] && mask < $f > $O/$(basename $f); done
 cp /tmp/aurora-modem.d/rmtfs.log /tmp/aurora-modem.d/lifecycle.log $O/ 2>/dev/null; mask < /tmp/aurora-modem.d/lifecycle.log > $O/lifecycle.log
 tar -C /tmp -cf /tmp/b6.tar b6; mk "B6-RUN-END"
--- a/b6/ro-check.sh
+++ b/b6/ro-check.sh
@ -0,0 +1,4 @@
 #!/bin/sh
 n=0; bad=0; for d in /dev/mmcblk0 /dev/mmcblk0p* /dev/mmcblk0boot*; do [ -b "$d" ] || continue; n=$((n+1)); [ "$(blockdev --getro $d)" = 1 ] || { bad=$((bad+1)); echo "NOT-RO $d"; }; done
 echo "RO-CHECK devices=$n not_ro=$bad"; for p in modemst1 modemst2 fsc fsg persist; do f=$(readlink -f /dev/disk/by-partlabel/$p); echo "$p $f getro=$(blockdev --getro $f)"; done
 awk '{print "emmc writes_completed="$5" sectors_written="$7}' /sys/block/mmcblk0/stat
--- a/bootchain-migration/PREFLIGHT.md
+++ b/bootchain-migration/PREFLIGHT.md
@ -0,0 +1,68 @@
 # Aurora bootchain migration preflight (ARM64) — 2026-09-30. NOTHING WRITTEN.
 ## 1. Why ARM64 fails today (proven)
 lk2nd 23.1 `spin-table.c:54`: `!is_scm_armv8_support()` && ARM64 kernel → "Cannot boot ARM64 with old SCM calling convention";
 `scm.c` ~1060–1085: 32→64 switch = SCM `SCM_SVC_MILESTONE_32_64`; legacy-SCM TZ returns → `ASSERT(0)`.
 Stock TZ = TZ.BF.2.2-2.2.0026 (ELF32, legacy SCM, no PSCI), ELF-identical to JZ02 stock.
 ## 2. Component requirements (evidence: JZ02 PLAN-B runs on IDENTICAL stock sbl1/rpm/tz/hyp ELF + qhypstub README)
 | component | verdict | evidence |
 |---|---|---|
 | TZ → DB410c TZ.BF.3.0-00714 (ELF64, armv8 SCM + PSCI) | **REQUIRED** | JZ02 S3: qhypstub with stock TZ.BF.2.2 → silence after SBL1. S4′: TZ.BF.3.0 + qhypstub → lk1st → PSCI v1.0 → arm64 Linux |
 | HYP → qhypstub | **REQUIRED (with TZ.BF.3.0)** | stock hyp is ELF32; JZ02 only proven pair = TZ64 + qhypstub. qhypstub also brings RPM out of reset. Alone: insufficient (JZ02 S3) |
 | GPT delta (tz 512K→1M, tzbak moved to empty gap) | **REQUIRED** | DB410c TZ = 605312 B > tz 524288 B, last segment ends at EOF (cannot truncate) |
 | ABOOT → lk1st | **REQUIRED for a proven chain** / stock aboot = UNKNOWN | Only proven combo is lk1st. Stock Aurora LK (32-bit, legacy-SCM era) under TZ.BF.3.0+qhypstub never tested on any board; qhypstub README says aarch32 LK in EL1 is supported in principle |
 | lk2nd in recovery | OPTIONAL (keep untouched) | with lk1st in aboot, lk1st itself gives `fastboot boot`; recovery stays as is |
 | SBL1 / RPM / DDR / sec / cdt | keep stock (NOT required) | JZ02 runs stock sbl1 BOOT.BF.3.0.1 + stock rpm RPM.BF.2.0.1 with TZ.BF.3.0; Aurora sbl1/DDR/sec byte-identical, rpm ELF identical |
 ## 3. JZ02 (working ARM64) vs Aurora (stock)
 | component | JZ02 working | Aurora stock | same? | role | replace? | risk |
 |---|---|---|---|---|---|---|
 | SBL1 | stock 6a661ec9… BOOT.BF.3.0.1-00019 | 6a661ec9… | SAME (bytes) | DDR init, loads TZ/RPM/HYP/ABOOT | no | — |
 | RPM | stock 53b591bb… | ELF identical (slack differs) | SAME (ELF) | power/clocks | no | — |
 | DDR | stock | c3502047… = JZ02 | SAME (bytes) | DDR params for SBL1 | no | — |
 | TZ | DB410c TZ.BF.3.0-00714 (8481892f… padded 1M) | TZ.BF.2.2-2.2.0026 | DIFFERENT | secure monitor, SCM/PSCI | yes | high (runs before aboot) |
 | HYP | qhypstub (1a963047… padded 512K) | stock ELF32 (TZ.BF.2.2 hyp) | DIFFERENT | EL2, RPM release | yes | high |
 | ABOOT | lk1st JZ02 build (JZ02 node, -dirty) | stock LK 2026-07 (SPI panel, charger) | DIFFERENT | bootloader/fastboot | yes (Aurora lk1st) | medium (loses Android) |
 | GPT | tz 270336..272383, tzbak 305184..306207 | stock | DIFFERENT (2 entries) | layout | yes | high (table write) |
 | QCDT/DT | lk1st: appended kernel DTB | stock LK: QCDT dtb_01 | — | kernel DT | n/a (mainline DTB appended) | — |
 Aurora region layout (tz/tzbak/hyp LBAs, splash end 305169, gap 305170..393215 all-zero, DDR 393216) == JZ02 → same GPT delta applies.
 Memory map: upstream msm8916.dtsi reserves tz@86500000 (DB410c TZ) — proven on JZ02. DDR init owner = stock SBL1 (unchanged). PMIC PM8916 same; RPM unchanged.
 Board-id: lk1st does not use QCDT; kernel DTB appended ("Only one appended non-skales DTB").
 Display: stock LK powers + draws ST7735S splash (`Config SPI PANEL`); lk1st has no SPI-panel driver → **no boot splash** (expected change, not a fault).
 ## 4. Options
 | | writes | ARM64 handoff | normal boot after | recovery/lk2nd | EDL | rollback | main brick risk |
 |---|---|---|---|---|---|---|---|
 | A hyp=qhypstub only | hyp | **NO** (JZ02 S3 hang) | hangs after SBL1 | unreachable | HW only | ws hyp | proven failure → rejected |
 | B tz=DB410c, hyp=qhypstub, aboot=stock | GPT, tz, hyp | plausible via lk2nd in recovery (armv8 SCM + PSCI) | UNKNOWN (stock LK + Android 3.10 on TZ64 never tested; qseecom/keymaster TZ apps built for TZ.BF.2.x) | lk2nd path kept (if stock LK runs) | adb only if Android boots, else HW | ws GPT/tz/hyp | stock LK hang → only HW EDL |
 | C tz=DB410c, hyp=qhypstub, aboot=lk1st | GPT, tz, hyp, aboot | **YES** (JZ02 S4′/S5, identical inputs) | lk1st forced fastboot (Android gone) | untouched, not needed | lk1st `fastboot oem reboot-edl` (proven JZ02) + HW | ws each stage | lower: every stage proven on JZ02 |
 | D staged C (JZ02 order) | same as C, one change per stage | YES at end | per stage | untouched | per stage | per stage | minimal: stage-by-stage verification |
 **Recommended: D (= C executed in JZ02's proven order).** Not hyp alone. Not B (unproven, and only saves Android which the target system does not need).
 ## 5. HW EDL without ADB — OPEN BLOCKER (must be proven before S1)
 Currently proven on Aurora: only `adb reboot edl`. After S1 Android is gone; lk1st `oem reboot-edl` only works if lk1st boots.
 Evidence for a button path (NOT yet proven on Aurora):
 - JZ02: stock DT `key_reset` = GPIO37; user entered 9008 with the RESET button (PLAN-B "HW EDL proof", twice, also with lk1st in aboot).
 - upstream lk2nd `msm8916-512mb-mtp.dts`: GPIO37 is labelled "The EDL button" on UFI-001B/C sticks.
 - Aurora stock DT: `key_f2` = **GPIO37** (active-high, same pin).
 Test (non-destructive, no write): identify which physical button is KEY_F2 (`adb shell getevent -l`, press buttons),
 full power-off (USB + battery), hold that button, apply power/USB → expect `lsusb` 05c6:9008; exit = power-off.
 If this does not yield 9008: STOP — no bootloader writes without a hardware recovery path. Do NOT short test pads blindly.
 ## 6. Recovery path
 recovery (lk2nd 23.1) stays untouched. With lk1st in aboot, development path becomes: power-on → lk1st fastboot → `fastboot boot`.
 lk1st PANIC_REBOOT_MODE=EMERGENCY_DLOAD (panic → EDL).
 ## 7. UART
 lk1st = same lk2nd 23.1 target code: `uart_dm_init(2,0,0x78B0000)`, GPIO4/5 → UART stays on BLSP1 UART2 115200 (proven for lk2nd on Aurora, lk1st on JZ02).
 SBL1 prints its log on the same UART (seen). qhypstub/TZ print nothing (JZ02: SBL1 → silence → lk1st).
 ## 8. Uncertainties
 1. HW EDL button on Aurora — unproven (blocker).
 2. DB410c TZ provenance: from OpenStick base.zip (JZ02); Linaro release server no longer serves files → cannot re-verify upstream origin online.
   Mitigation: byte-identical to image running on JZ02 hardware; signed with Qualcomm test chain = Aurora PK_HASH root.
 3. lk1st-aurora is a new build (never run): same source/tag as the lk2nd running on Aurora, same config pattern as JZ02 lk1st (bundle 512mb-mtp dtb, force fastboot), no device node → generic.
 4. Battery/charging: stock LK off-mode charging + charger decisions disappear with lk1st; PM8916 charging behaviour under lk1st/mainline untested. Keep USB power connected.
 5. Aurora MPSS is a different build than JZ02 (re-signed 2026-04-30) — irrelevant for boot, relevant later for modem under TZ.BF.3.0.
 6. Android + stock recovery will no longer boot after S1 (expected); full stock restore = rollback all stages.
--- a/bootchain-migration/SHA256SUMS
+++ b/bootchain-migration/SHA256SUMS
@ -0,0 +1,19 @@
 003c484e5a2880819f45c2bd74543796d28758925c9c58c26b5bcbdcf42a6696  aboot-lk1st-aurora.mbn
 58d20d78b9eb5b9c5a6b41977c1646519456e695d0ede503e7afa98597cb6ed1  lk1st-aurora-unsigned.mbn
 e4addbf80eb86f6ad8b112e5a3115c7b721bbd2cca8cc109d135aeceb6194482  aboot-lk1st-aurora.pad1M
 ebcd0c9011ac887cdf208c2413c4447c2a7d88f4ced1f3ea4f826162c8f2f30d  orig-abootbak.bin
 fd1af1679f9dd24de2689dc79faf0d2b043c3e95200234bec36da9ed7df1053a  orig-aboot.bin
 428d25ebd86d047f33fa9fd2f22aa2d716e6ecf39735ad61bb34409a323f9082  orig-hypbak.bin
 340049c116faaab6db6cd5004ec7eb17c3fecd308df8456ede8b40aa3244c506  orig-hyp.bin
 c6f7db266a14227ca7e7b0343661089298e4c4320a9522e3e695b5e069e6b4af  orig-tzbak.bin
 4c8c7875501e0718b2afe6597f7159a510462cb4bd9b0e6f25ab142d256ddfb8  orig-tz.bin
 795952a1a5965ca2118afcb0add9cd1d358a09ec9a43ca4208cfad40c99de18f  aurora-new-gpt-backup-33sectors.bin
 6e850a5dfe5400da346962a54e41491cb0e4c5ac3543dd4799c8bc0ee5c3b8b6  aurora-new-gpt-primary-34sectors.bin
 8481892fe56fc810e4322b7e6838bf071695e4fc1380c16b21973d7fab325363  tz-db410c.pad1M
 2daaedaafeee5697b6d85aa329cc6af9bc7e661677e4594d75efb54e4b53fea1  tz-db410c-TZ.BF.3.0-00714.mbn
 c6414843b635a2b3e7ec58bc5a6c6c7c7aef7f5a31898dc5923c2085c9de1a2d  hyp-qhypstub.mbn
 1a963047a4302569da2ddbda726b65c57f5181c0e290ca983dcd2fc529f74555  hyp-qhypstub.pad512K
 0284863bf665a4fd945bb95796a2f40385bb9eeadbcc7c0e16cf830ddb1056b4  orig-tzarea-LBA270336-272383.bin
 07854d2fef297a06ba81685e660c332de36d5d18d546927d30daad6d7fda1541  orig-gap-LBA305184-306207.bin
 1dbb7727613108fbfb9a7caefbc8c120a6674d2ce95423385ff7f968e54568c6  orig-gpt-backup-LBA7634911-7634943.bin
 9b01428eb659eb95cc1f59c8b5c012278b82676774997f036d601057b7a8a8b5  orig-gpt-primary-LBA0-33.bin
--- a/bootchain-migration/WRITE-PLAN.md
+++ b/bootchain-migration/WRITE-PLAN.md
@ -0,0 +1,38 @@
 # Aurora ARM64 bootchain — staged write plan (NOT EXECUTED; each stage needs explicit user approval)
 Run on 480s:  cd ~/doc/modem/jz08-aurora ; M=bootchain-migration ; O=logs/bootchain ; mkdir -p $O
 L=firehose/007050e100000000_394a2e47cf830150_fhprg_peek.bin   (sha256 53f19350…5aca)
 Every edl call: --loader=$L . NEVER `edl reset`. After each stage: physical power-cycle + full UART log.
 Entry to EDL: S1 from Android `adb reboot edl`; later stages: lk1st `fastboot oem reboot-edl` or the HW button (S0).
 ## S0 — prerequisite, NO WRITE: prove hardware EDL entry (button on GPIO37 / KEY_F2). If it fails: STOP.
 ## S1 — aboot ← lk1st-aurora  (stock tz/hyp/GPT kept; proven order on JZ02)
 edl --loader=$L printgpt                                   # aboot must be 264192 / 0x100000
 edl --loader=$L w aboot $M/aboot-lk1st-aurora.pad1M          # e4addbf8…6482
 edl --loader=$L r aboot $O/S1-aboot-readback.bin
 sha256sum $M/aboot-lk1st-aurora.pad1M $O/S1-aboot-readback.bin ; cmp $M/aboot-lk1st-aurora.pad1M $O/S1-aboot-readback.bin && echo S1_MATCH
 expect after power-cycle: SBL1 → lk1st "welcome to lk" → forced fastboot 18d1:d00d, getvar product lk1st-msm8916; test `fastboot oem reboot-edl` → 9008.
 ROLLBACK S1: edl w aboot $M/orig-aboot.bin ; edl r aboot $O/S1-rb.bin ; cmp $M/orig-aboot.bin $O/S1-rb.bin   # fd1af167…053a
 ## S2 — GPT delta + copy stock tzbak to its new place (tz content unchanged)
 edl --loader=$L ws 0       $M/aurora-new-gpt-primary-34sectors.bin    # 6e850a5d…b8b6
 edl --loader=$L ws 7634911 $M/aurora-new-gpt-backup-33sectors.bin     # 795952a1…e18f
 edl --loader=$L ws 305184  $M/orig-tzbak.bin                          # c6f7db26…b4af
 edl --loader=$L rs 0 34 $O/S2-gptp.bin ; edl --loader=$L rs 7634911 33 $O/S2-gptb.bin ; edl --loader=$L rs 305184 1024 $O/S2-tzbak.bin
 edl --loader=$L rs 270336 2048 $O/S2-tzarea.bin                        # must still equal orig-tzarea (unchanged bytes)
 cmp $M/aurora-new-gpt-primary-34sectors.bin $O/S2-gptp.bin ; cmp $M/aurora-new-gpt-backup-33sectors.bin $O/S2-gptb.bin
 cmp $M/orig-tzbak.bin $O/S2-tzbak.bin ; cmp $M/orig-tzarea-LBA270336-272383.bin $O/S2-tzarea.bin && echo S2_MATCH
 expect: identical boot to S1 (stock tz still first 512K of enlarged tz); getvar partition-size:tz 0x100000.
 ROLLBACK S2: ws 0 $M/orig-gpt-primary-LBA0-33.bin ; ws 7634911 $M/orig-gpt-backup-LBA7634911-7634943.bin ; ws 305184 $M/orig-gap-LBA305184-306207.bin ; rs + cmp each
 ## S3 — tz + hyp as a PAIR (never hyp alone: JZ02 S3 proved hang)
 edl --loader=$L ws 270336 $M/tz-db410c.pad1M               # 8481892f…5363 (1 MiB, whole enlarged tz)
 edl --loader=$L ws 272384 $M/hyp-qhypstub.pad512K          # 1a963047…4555
 edl --loader=$L rs 270336 2048 $O/S3-tz.bin ; edl --loader=$L rs 272384 1024 $O/S3-hyp.bin
 cmp $M/tz-db410c.pad1M $O/S3-tz.bin ; cmp $M/hyp-qhypstub.pad512K $O/S3-hyp.bin && echo S3_MATCH
 expect: SBL1 → lk1st fastboot; lk1st detects PSCI.
 ROLLBACK S3: ws 270336 $M/orig-tzarea-LBA270336-272383.bin ; ws 272384 $M/orig-hyp.bin ; rs + cmp
 ## S4 — RAM only: fastboot boot linux/ramboot1/aurora-ramboot1.img (470ce4f8…) via lk1st
 ## FULL STOCK RESTORE (any state): S3 rollback → S2 rollback → S1 rollback (then Android + adb reboot edl return).
--- a/bootchain-migration/gptedit-aurora.py
+++ b/bootchain-migration/gptedit-aurora.py
@ -0,0 +1,27 @@
 import struct, zlib, uuid
 P = open("../gpt/gpt-primary-34sectors.bin", "rb").read()      # LBA 0..33
 B = open("../gpt/gpt-backup-33sectors.bin", "rb").read()      # entries (32 sectors) + header (last LBA)
 def entries_of(buf, off, n, esz): return bytearray(buf[off: off + n*esz])
 hdrP = bytearray(P[512:1024]); ent_lba, n, esz = struct.unpack("<QII", hdrP[72:88])
 ents = entries_of(P, ent_lba*512, n, esz)
 assert bytes(ents) == B[:n*esz], "primary/backup entry arrays differ"
 def name(i): return ents[i*esz+56:i*esz+128].decode("utf-16le").rstrip("\0")
 idx = {name(i): i for i in range(n) if ents[i*esz:i*esz+16] != b"\0"*16}
 def setlba(i, first, last): ents[i*esz+32:i*esz+48] = struct.pack("<QQ", first, last)
 def getlba(i): return struct.unpack("<QQ", ents[i*esz+32:i*esz+48])
 tz, tzb = idx["tz"], idx["tzbak"]
 assert getlba(tz) == (270336, 271359) and getlba(tzb) == (271360, 272383)
 setlba(tz, 270336, 272383)
 setlba(tzb, 305184, 306207)
 ecrc = zlib.crc32(bytes(ents)) & 0xffffffff
 def fix(h):
    h = bytearray(h); h[88:92] = struct.pack("<I", ecrc); h[16:20] = b"\0"*4
    hs = struct.unpack("<I", h[12:16])[0]; h[16:20] = struct.pack("<I", zlib.crc32(bytes(h[:hs])) & 0xffffffff); return h
 newP = bytearray(P); newP[512:1024] = fix(hdrP); newP[ent_lba*512: ent_lba*512+n*esz] = ents
 hdrB = B[32*512:33*512]; newB = bytearray(B); newB[:n*esz] = ents; newB[32*512:33*512] = fix(hdrB)
 open("aurora-new-gpt-primary-34sectors.bin", "wb").write(newP); open("aurora-new-gpt-backup-33sectors.bin", "wb").write(newB)
 # diff report
 for i in range(n):
    a = P[ent_lba*512+i*esz: ent_lba*512+(i+1)*esz]; b = bytes(ents[i*esz:(i+1)*esz])
    if a != b: print("changed entry %2d %-8s %s -> %s" % (i, name(i), struct.unpack("<QQ", a[32:48]), struct.unpack("<QQ", b[32:48])))
 nd = sum(1 for x, y in zip(P, newP) if x != y); print("primary bytes changed:", nd, " backup bytes changed:", sum(1 for x, y in zip(B, newB) if x != y))
--- a/bootchain-migration/gptvalidate-aurora.py
+++ b/bootchain-migration/gptvalidate-aurora.py
@ -0,0 +1,44 @@
 # Independent GPT validator (does not share code with gptedit.py)
 import struct, zlib, sys
 DISK_SECTORS = 7634944
 def check(prim_path, back_path):
    P = open(prim_path, "rb").read(); B = open(back_path, "rb").read()
    ok = True
    def fail(m):
        nonlocal ok; ok = False; print("  FAIL:", m)
    def hdr(buf, label, expect_my, expect_alt):
        h = buf
        sig, rev, hsz, hcrc, _, my, alt, fu, lu = struct.unpack("<8sIII4sQQQQ", h[:56])
        guid = h[56:72]; ent_lba, n, esz, ecrc = struct.unpack("<QIII", h[72:92])
        calc = zlib.crc32(h[:16] + b"\0\0\0\0" + h[20:hsz]) & 0xffffffff
        if sig != b"EFI PART": fail(label + " signature")
        if calc != hcrc: fail("%s header CRC stored %08x calc %08x" % (label, hcrc, calc))
        if my != expect_my: fail("%s my_lba %d != %d" % (label, my, expect_my))
        if alt != expect_alt: fail("%s alternate_lba %d != %d" % (label, alt, expect_alt))
        return dict(fu=fu, lu=lu, guid=guid, ent_lba=ent_lba, n=n, esz=esz, ecrc=ecrc)
    hp = hdr(P[512:1024], "primary", 1, DISK_SECTORS - 1)
    hb = hdr(B[32*512:33*512], "backup", DISK_SECTORS - 1, 1)
    ep = P[hp["ent_lba"]*512: hp["ent_lba"]*512 + hp["n"]*hp["esz"]]
    if hb["ent_lba"] != DISK_SECTORS - 33: fail("backup entries LBA %d" % hb["ent_lba"])
    eb = B[:hb["n"]*hb["esz"]]
    for lab, e, h in (("primary", ep, hp), ("backup", eb, hb)):
        c = zlib.crc32(e) & 0xffffffff
        if c != h["ecrc"]: fail("%s entries CRC stored %08x calc %08x" % (lab, h["ecrc"], c))
    if ep != eb: fail("primary and backup entry arrays differ")
    for k in ("fu", "lu", "guid", "n", "esz"):
        if hp[k] != hb[k]: fail("header field %s differs" % k)
    parts = []
    for i in range(hp["n"]):
        e = ep[i*128:(i+1)*128]
        if e[:16] == b"\0"*16: continue
        s, l = struct.unpack("<QQ", e[32:48]); nm = e[56:128].decode("utf-16le").rstrip("\0")
        if not (hp["fu"] <= s <= l <= hp["lu"]): fail("%s outside usable range" % nm)
        parts.append((s, l, nm))
    parts.sort()
    for a, b in zip(parts, parts[1:]):
        if b[0] <= a[1]: fail("overlap %s / %s" % (a[2], b[2]))
    if P[0x1fe:0x200] != b"\x55\xaa" or P[0x1c2] != 0xee: fail("protective MBR")
    print("  %s: %d partitions, usable %d..%d -> %s" % (prim_path, len(parts), hp["fu"], hp["lu"], "OK" if ok else "INVALID"))
    return ok
 for p, b in (("../gpt/gpt-primary-34sectors.bin", "../gpt/gpt-backup-33sectors.bin"), ("aurora-new-gpt-primary-34sectors.bin", "aurora-new-gpt-backup-33sectors.bin")):
    check(p, b)
--- a/bootchain/boot/info.txt
+++ b/bootchain/boot/info.txt
@ -0,0 +1,23 @@
 kernel_size=0x624c90 kernel_addr=0x80008000
 ramdisk_size=0x82648 ramdisk_addr=0x81000000
 second_size=0x0 tags_addr=0x80000100 page_size=2048
 dt_size=0x46800
 name=b''
 cmdline=console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x3F ehci-hcd.park=3 androidboot.bootdevice=7824900.sdhci
 id=0ab51698aa1b85b20d5dde57d8c221f42a468b1d000000000000000000000000
 extra_cmdline_first_bytes=0000000000000000000000000000000000000000000000000000000000000000 (nonzero=False)
 image_end=0x6ee800 of 0x1000000
 tail_after_image_nonzero=537767
 kernel: 6442128 bytes sha256 8796a9cd21ef23a2219acecfa7539fbc7ce167612c265119b31e3b731655c6b7
 ramdisk: 534088 bytes sha256 f79c1e141d998f758ac72e47c0854ca4a774e1f35a6e86a791a3ebb641c95311
 dt.img: 288768 bytes sha256 6ba72582f4c3b2e5711143c8b502b46e3eaf707e22852e9a8075c4d5e59992fd
 no FDT magic in kernel (no appended DTB)
 QCDT version=2 entries=8
  entry0: fields=['0xce', '0x8', '0x0', '0x0'] off=0x800 size=0x23000 -> dtb_00.dtb
  entry1: fields=['0xce', '0x8', '0x100', '0x0'] off=0x23800 size=0x23000 -> dtb_01.dtb
  entry2: fields=['0xf8', '0x8', '0x0', '0x0'] off=0x800 size=0x23000 -> dtb_00.dtb
  entry3: fields=['0xf8', '0x8', '0x100', '0x0'] off=0x23800 size=0x23000 -> dtb_01.dtb
  entry4: fields=['0xf9', '0x8', '0x0', '0x0'] off=0x800 size=0x23000 -> dtb_00.dtb
  entry5: fields=['0xf9', '0x8', '0x100', '0x0'] off=0x23800 size=0x23000 -> dtb_01.dtb
  entry6: fields=['0xfa', '0x8', '0x0', '0x0'] off=0x800 size=0x23000 -> dtb_00.dtb
  entry7: fields=['0xfa', '0x8', '0x100', '0x0'] off=0x23800 size=0x23000 -> dtb_01.dtb
--- a/bootchain/boot/ramdisk.list
+++ b/bootchain/boot/ramdisk.list
@ -0,0 +1,51 @@
 -rwxr-x---   1 root     root       292844 Jan  1  1970 charger
 drwxrwx--x   1 root     root            0 Jan  1  1970 data
 -rw-r--r--   1 root     root          207 Jan  1  1970 default.prop
 drwxr-xr-x   1 root     root            0 Jan  1  1970 dev
 -rw-r--r--   1 root     root         9093 Jan  1  1970 file_contexts
 -rw-r-----   1 root     root         1316 Jan  1  1970 fstab.qcom
 -rwxr-x---   1 root     root       179476 Jan  1  1970 init
 -rwxr-x---   1 root     root         2823 Jan  1  1970 init.class_main.sh
 -rwxr-x---   1 root     root         1171 Jan  1  1970 init.environ.rc
 -rwxr-x---   1 root     root         1730 Jan  1  1970 init.mdm.sh
 -rwxr-x---   1 root     root         7374 Jan  1  1970 init.qcom.class_core.sh
 -rwxr-x---   1 root     root         6920 Jan  1  1970 init.qcom.early_boot.sh
 -rwxr-x---   1 root     root        12466 Jan  1  1970 init.qcom.factory.sh
 -rwxr-x---   1 root     root        26376 Jan  1  1970 init.qcom.rc
 -rwxr-x---   1 root     root         6370 Jan  1  1970 init.qcom.sh
 -rwxr-x---   1 root     root         4561 Jan  1  1970 init.qcom.ssr.sh
 -rwxr-x---   1 root     root         2962 Jan  1  1970 init.qcom.syspart_fixup.sh
 -rwxr-x---   1 root     root        53658 Jan  1  1970 init.qcom.usb.rc
 -rwxr-x---   1 root     root         8256 Jan  1  1970 init.qcom.usb.sh
 -rwxr-x---   1 root     root         2247 Jan  1  1970 init.qti.carrier.rc
 -rwxr-x---   1 root     root        28234 Jan  1  1970 init.rc
 -rwxr-x---   1 root     root         5802 Jan  1  1970 init.target.rc
 -rwxr-x---   1 root     root         1795 Jan  1  1970 init.trace.rc
 -rwxr-x---   1 root     root         3915 Jan  1  1970 init.usb.rc
 drwxr-xr-x   1 root     root            0 Jan  1  1970 proc
 -rw-r--r--   1 root     root         2161 Jan  1  1970 property_contexts
 drwxr-xr-x   1 root     root            0 Jan  1  1970 res
 drwxr-xr-x   1 root     root            0 Jan  1  1970 res/images
 drwxr-xr-x   1 root     root            0 Jan  1  1970 res/images/charger
 -rw-r--r--   1 root     root         1295 Jan  1  1970 res/images/charger/battery_0.png
 -rw-r--r--   1 root     root         1290 Jan  1  1970 res/images/charger/battery_1.png
 -rw-r--r--   1 root     root         1289 Jan  1  1970 res/images/charger/battery_2.png
 -rw-r--r--   1 root     root         1291 Jan  1  1970 res/images/charger/battery_3.png
 -rw-r--r--   1 root     root         1288 Jan  1  1970 res/images/charger/battery_4.png
 -rw-r--r--   1 root     root         1267 Jan  1  1970 res/images/charger/battery_5.png
 -rw-r--r--   1 root     root         2475 Jan  1  1970 res/images/charger/battery_charge.png
 -rw-r--r--   1 root     root         1805 Jan  1  1970 res/images/charger/battery_fail.png
 drwxr-xr-x   1 root     root            0 Jan  1  1970 res/images/mmi
 -rw-r--r--   1 root     root         3962 Jan  1  1970 res/images/mmi/fail.png
 -rw-r--r--   1 root     root         3767 Jan  1  1970 res/images/mmi/pass.png
 drwxr-x---   1 root     root            0 Jan  1  1970 sbin
 -rwxr-x---   1 root     root       161956 Jan  1  1970 sbin/adbd
 -rwxr-x---   1 root     root       120656 Jan  1  1970 sbin/healthd
 lrwxr-x---   1 root     root            7 Jan  1  1970 sbin/ueventd -> ../init
 lrwxr-x---   1 root     root            7 Jan  1  1970 sbin/watchdogd -> ../init
 -rw-r--r--   1 root     root          656 Jan  1  1970 seapp_contexts
 -rw-r--r--   1 root     root        75088 Jan  1  1970 sepolicy
 drwxr-xr-x   1 root     root            0 Jan  1  1970 sys
 drwxr-xr-x   1 root     root            0 Jan  1  1970 system
 -rw-r--r--   1 root     root         9740 Jan  1  1970 ueventd.qcom.rc
 -rw-r--r--   1 root     root         4023 Jan  1  1970 ueventd.rc
--- a/bootchain/boot/ramdisk.type
+++ b/bootchain/boot/ramdisk.type
@ -0,0 +1 @@
 gzip compressed data, from Unix, original size modulo 2^32 1060352
--- a/bootchain/elfinfo.txt
+++ b/bootchain/elfinfo.txt
@ -0,0 +1,39 @@
 sbl1.bin: ELF32 entry=0x8006560 phnum=8 image_end=0x3dc24 part=0x80000 img_sha256=dfb1ce5582f2694e tail_nonblank=0
   segs=0x0+0x134(f0x7000000) 0x86782000+0x1a28(f0x2200000) 0x220000+0x2abc(f0x5) 0x223000+0x928(f0x6) 0x8005000+0x33f90(f0x80000005) 0x803b000+0x0(f0x6) 0x8041000+0x38b0(f0x6) 0x86700000+0x0(f0x6)
   ver=[('QC_IMAGE_VERSION_STRING=BOOT.BF.3.0.1-00019', '0x32e64')]
 rpm.bin: ELF32 entry=0x9 phnum=4 image_end=0x24734 part=0x80000 img_sha256=d7b6517870a5d9e6 tail_nonblank=883
   segs=0x0+0xb4(f0x7000000) 0x296000+0x19a8(f0x2200000) 0x200000+0x1c094(f0x80000005) 0x290000+0x56a0(f0x6)
   ver=[('QC_IMAGE_VERSION_STRING=RPM.BF.2.0.1-00027', '0x1f0d4')]
 rpmbak.bin: ELF32 entry=0x9 phnum=4 image_end=0x24734 part=0x80000 img_sha256=d7b6517870a5d9e6 tail_nonblank=883
   segs=0x0+0xb4(f0x7000000) 0x296000+0x19a8(f0x2200000) 0x200000+0x1c094(f0x80000005) 0x290000+0x56a0(f0x6)
   ver=[('QC_IMAGE_VERSION_STRING=RPM.BF.2.0.1-00027', '0x1f0d4')]
 tz.bin: ELF32 entry=0x86500000 phnum=10 image_end=0x649ac part=0x80000 img_sha256=d992d0c25180ec61 tail_nonblank=19303
   segs=0x0+0x174(f0x7000000) 0x86570000+0x1a68(f0x2200000) 0x86500000+0x352b8(f0x80000005) 0x86536000+0x5b98(f0x4) 0x8653c000+0xb604(f0x6) 0x8654dc00+0x4800(f0x6) 0x86567000+0xba8(f0x6) 0x86568000+0x3000(f0x6) 0x8656b000+0x1000(f0x6) 0x8656c000+0x4000(f0x6)
   ver=[('QC_IMAGE_VERSION_STRING=TZ.BF.2.2-2.2.0026', '0x4c53c'), ('QC_IMAGE_VERSION_STRING=TZ.BF.2.5.C6-00025', '0x65624')]
 tzbak.bin: ELF32 entry=0x86500000 phnum=10 image_end=0x649ac part=0x80000 img_sha256=d992d0c25180ec61 tail_nonblank=102960
   segs=0x0+0x174(f0x7000000) 0x86570000+0x1a68(f0x2200000) 0x86500000+0x352b8(f0x80000005) 0x86536000+0x5b98(f0x4) 0x8653c000+0xb604(f0x6) 0x8654dc00+0x4800(f0x6) 0x86567000+0xba8(f0x6) 0x86568000+0x3000(f0x6) 0x8656b000+0x1000(f0x6) 0x8656c000+0x4000(f0x6)
   ver=[('QC_IMAGE_VERSION_STRING=TZ.BF.2.2-2.2.0026', '0x4c53c')]
 hyp.bin: ELF32 entry=0x86400000 phnum=4 image_end=0x4fd8 part=0x80000 img_sha256=13c3227c9cd9958e tail_nonblank=120320
   segs=0x0+0xb4(f0x7000000) 0x86500000+0x19a8(f0x2200000) 0x86400000+0x1fd8(f0x80000007) 0x86410800+0x0(f0x6)
   ver=[('QC_IMAGE_VERSION_STRING=TZ.BF.2.5.C6-00025', '0x25624')]
 hypbak.bin: ELF32 entry=0x86400000 phnum=4 image_end=0x4fd8 part=0x80000 img_sha256=13c3227c9cd9958e tail_nonblank=0
   segs=0x0+0xb4(f0x7000000) 0x86500000+0x19a8(f0x2200000) 0x86400000+0x1fd8(f0x80000007) 0x86410800+0x0(f0x6)
   ver=[]
 aboot.bin: ELF32 entry=0x8f600000 phnum=4 image_end=0x5b0c8 part=0x100000 img_sha256=aae4b59024e3b114 tail_nonblank=49015
   segs=0x0+0xb4(f0x7000000) 0x8f648000+0x19a8(f0x2200000) 0x8f647dac+0x10(f0x4) 0x8f600000+0x530c8(f0x7)
   ver=[]
 abootbak.bin: ELF32 entry=0x8f600000 phnum=4 image_end=0x5b0c8 part=0x100000 img_sha256=aae4b59024e3b114 tail_nonblank=49001
   segs=0x0+0xb4(f0x7000000) 0x8f648000+0x19a8(f0x2200000) 0x8f647dac+0x10(f0x4) 0x8f600000+0x530c8(f0x7)
   ver=[]
 /home/q/doc/modem/JZ02V30-UFI-@/backup/parts/rpm.bin: ELF32 entry=0x9 phnum=4 image_end=0x24734 part=0x80000 img_sha256=d7b6517870a5d9e6 tail_nonblank=0
   segs=0x0+0xb4(f0x7000000) 0x296000+0x19a8(f0x2200000) 0x200000+0x1c094(f0x80000005) 0x290000+0x56a0(f0x6)
   ver=[('QC_IMAGE_VERSION_STRING=RPM.BF.2.0.1-00027', '0x1f0d4')]
 /home/q/doc/modem/JZ02V30-UFI-@/backup/parts/tz.bin: ELF32 entry=0x86500000 phnum=10 image_end=0x649ac part=0x80000 img_sha256=d992d0c25180ec61 tail_nonblank=0
   segs=0x0+0x174(f0x7000000) 0x86570000+0x1a68(f0x2200000) 0x86500000+0x352b8(f0x80000005) 0x86536000+0x5b98(f0x4) 0x8653c000+0xb604(f0x6) 0x8654dc00+0x4800(f0x6) 0x86567000+0xba8(f0x6) 0x86568000+0x3000(f0x6) 0x8656b000+0x1000(f0x6) 0x8656c000+0x4000(f0x6)
   ver=[('QC_IMAGE_VERSION_STRING=TZ.BF.2.2-2.2.0026', '0x4c53c')]
 /home/q/doc/modem/JZ02V30-UFI-@/backup/parts/hyp.bin: ELF32 entry=0x86400000 phnum=4 image_end=0x4fd8 part=0x80000 img_sha256=13c3227c9cd9958e tail_nonblank=0
   segs=0x0+0xb4(f0x7000000) 0x86500000+0x19a8(f0x2200000) 0x86400000+0x1fd8(f0x80000007) 0x86410800+0x0(f0x6)
   ver=[]
 /home/q/doc/modem/JZ02V30-UFI-@/backup/parts/aboot.bin: ELF32 entry=0x8f600000 phnum=4 image_end=0x5cf5c part=0x100000 img_sha256=e57e88588f77e683 tail_nonblank=14
   segs=0x0+0xb4(f0x7000000) 0x8f649000+0x19a8(f0x2200000) 0x8f648314+0x10(f0x4) 0x8f600000+0x54f5c(f0x7)
   ver=[]
--- a/bootchain/recovery/info.txt
+++ b/bootchain/recovery/info.txt
@ -0,0 +1,23 @@
 kernel_size=0x624c90 kernel_addr=0x80008000
 ramdisk_size=0x1057a5 ramdisk_addr=0x81000000
 second_size=0x0 tags_addr=0x80000100 page_size=2048
 dt_size=0x46800
 name=b''
 cmdline=console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x3F ehci-hcd.park=3 androidboot.bootdevice=7824900.sdhci
 id=bdf6015bb7d2b99457ac0411a63b30b4ca0eacfb000000000000000000000000
 extra_cmdline_first_bytes=0000000000000000000000000000000000000000000000000000000000000000 (nonzero=False)
 image_end=0x771800 of 0x1000000
 tail_after_image_nonzero=8558292
 kernel: 6442128 bytes sha256 8796a9cd21ef23a2219acecfa7539fbc7ce167612c265119b31e3b731655c6b7
 ramdisk: 1071013 bytes sha256 69fd1ba2719ab007b3431f0f483c0c69466e31c2008041032216335566a7a267
 dt.img: 288768 bytes sha256 6ba72582f4c3b2e5711143c8b502b46e3eaf707e22852e9a8075c4d5e59992fd
 no FDT magic in kernel (no appended DTB)
 QCDT version=2 entries=8
  entry0: fields=['0xce', '0x8', '0x0', '0x0'] off=0x800 size=0x23000 -> dtb_00.dtb
  entry1: fields=['0xce', '0x8', '0x100', '0x0'] off=0x23800 size=0x23000 -> dtb_01.dtb
  entry2: fields=['0xf8', '0x8', '0x0', '0x0'] off=0x800 size=0x23000 -> dtb_00.dtb
  entry3: fields=['0xf8', '0x8', '0x100', '0x0'] off=0x23800 size=0x23000 -> dtb_01.dtb
  entry4: fields=['0xf9', '0x8', '0x0', '0x0'] off=0x800 size=0x23000 -> dtb_00.dtb
  entry5: fields=['0xf9', '0x8', '0x100', '0x0'] off=0x23800 size=0x23000 -> dtb_01.dtb
  entry6: fields=['0xfa', '0x8', '0x0', '0x0'] off=0x800 size=0x23000 -> dtb_00.dtb
  entry7: fields=['0xfa', '0x8', '0x100', '0x0'] off=0x23800 size=0x23000 -> dtb_01.dtb
--- a/bootchain/recovery/ramdisk.list
+++ b/bootchain/recovery/ramdisk.list
@ -0,0 +1,73 @@
 -rwxr-x---   1 root     root       292844 Jan  1  1970 charger
 drwxrwx--x   1 root     root            0 Jan  1  1970 data
 -rw-r--r--   1 root     root         7133 Jan  1  1970 default.prop
 drwxr-xr-x   1 root     root            0 Jan  1  1970 dev
 drwxr-xr-x   1 root     root            0 Jan  1  1970 etc
 -rw-r--r--   1 root     root         2605 Jan  1  1970 etc/recovery.fstab
 -rw-r--r--   1 root     root         9093 Jan  1  1970 file_contexts
 -rw-r-----   1 root     root         1316 Jan  1  1970 fstab.qcom
 -rwxr-x---   1 root     root       179476 Jan  1  1970 init
 -rwxr-x---   1 root     root         2823 Jan  1  1970 init.class_main.sh
 -rwxr-x---   1 root     root         1730 Jan  1  1970 init.mdm.sh
 -rwxr-x---   1 root     root         7374 Jan  1  1970 init.qcom.class_core.sh
 -rwxr-x---   1 root     root         6920 Jan  1  1970 init.qcom.early_boot.sh
 -rwxr-x---   1 root     root        12466 Jan  1  1970 init.qcom.factory.sh
 -rwxr-x---   1 root     root         6370 Jan  1  1970 init.qcom.sh
 -rwxr-x---   1 root     root         4561 Jan  1  1970 init.qcom.ssr.sh
 -rwxr-x---   1 root     root         2962 Jan  1  1970 init.qcom.syspart_fixup.sh
 -rwxr-x---   1 root     root         8256 Jan  1  1970 init.qcom.usb.sh
 -rwxr-x---   1 root     root         1740 Jan  1  1970 init.rc
 drwxr-xr-x   1 root     root            0 Jan  1  1970 proc
 -rw-r--r--   1 root     root         2161 Jan  1  1970 property_contexts
 drwxr-xr-x   1 root     root            0 Jan  1  1970 res
 drwxr-xr-x   1 root     root            0 Jan  1  1970 res/images
 drwxr-xr-x   1 root     root            0 Jan  1  1970 res/images/charger
 -rw-r--r--   1 root     root         1295 Jan  1  1970 res/images/charger/battery_0.png
 -rw-r--r--   1 root     root         1290 Jan  1  1970 res/images/charger/battery_1.png
 -rw-r--r--   1 root     root         1289 Jan  1  1970 res/images/charger/battery_2.png
 -rw-r--r--   1 root     root         1291 Jan  1  1970 res/images/charger/battery_3.png
 -rw-r--r--   1 root     root         1288 Jan  1  1970 res/images/charger/battery_4.png
 -rw-r--r--   1 root     root         1267 Jan  1  1970 res/images/charger/battery_5.png
 -rw-r--r--   1 root     root         2475 Jan  1  1970 res/images/charger/battery_charge.png
 -rw-r--r--   1 root     root         1805 Jan  1  1970 res/images/charger/battery_fail.png
 -rw-r--r--   1 root     root        31491 Jan  1  1970 res/images/erasing_text.png
 -rw-r--r--   1 root     root        17504 Jan  1  1970 res/images/error_text.png
 -rw-r--r--   1 root     root        24437 Jan  1  1970 res/images/font.png
 -rw-r--r--   1 root     root        19306 Jan  1  1970 res/images/icon_error.png
 -rw-r--r--   1 root     root         3402 Jan  1  1970 res/images/icon_installing.png
 -rw-r--r--   1 root     root        10095 Jan  1  1970 res/images/icon_installing_overlay01.png
 -rw-r--r--   1 root     root         9990 Jan  1  1970 res/images/icon_installing_overlay02.png
 -rw-r--r--   1 root     root         9782 Jan  1  1970 res/images/icon_installing_overlay03.png
 -rw-r--r--   1 root     root         9817 Jan  1  1970 res/images/icon_installing_overlay04.png
 -rw-r--r--   1 root     root         9863 Jan  1  1970 res/images/icon_installing_overlay05.png
 -rw-r--r--   1 root     root         9944 Jan  1  1970 res/images/icon_installing_overlay06.png
 -rw-r--r--   1 root     root        10062 Jan  1  1970 res/images/icon_installing_overlay07.png
 -rw-r--r--   1 root     root          673 Jan  1  1970 res/images/indeterminate01.png
 -rw-r--r--   1 root     root          687 Jan  1  1970 res/images/indeterminate02.png
 -rw-r--r--   1 root     root          661 Jan  1  1970 res/images/indeterminate03.png
 -rw-r--r--   1 root     root          665 Jan  1  1970 res/images/indeterminate04.png
 -rw-r--r--   1 root     root          683 Jan  1  1970 res/images/indeterminate05.png
 -rw-r--r--   1 root     root          676 Jan  1  1970 res/images/indeterminate06.png
 -rw-r--r--   1 root     root        66592 Jan  1  1970 res/images/installing_text.png
 drwxr-xr-x   1 root     root            0 Jan  1  1970 res/images/mmi
 -rw-r--r--   1 root     root         3962 Jan  1  1970 res/images/mmi/fail.png
 -rw-r--r--   1 root     root         3767 Jan  1  1970 res/images/mmi/pass.png
 -rw-r--r--   1 root     root        40632 Jan  1  1970 res/images/no_command_text.png
 -rw-r--r--   1 root     root          118 Jan  1  1970 res/images/progress_empty.png
 -rw-r--r--   1 root     root          404 Jan  1  1970 res/images/progress_fill.png
 -rw-r--r--   1 root     root          322 Jan  1  1970 res/images/stage_empty.png
 -rw-r--r--   1 root     root          258 Jan  1  1970 res/images/stage_fill.png
 -rw-r--r--   1 root     root         1387 Jan  1  1970 res/keys
 drwxr-x---   1 root     root            0 Jan  1  1970 sbin
 -rwxr-x---   1 root     root       161956 Jan  1  1970 sbin/adbd
 -rwxr-x---   1 root     root       120656 Jan  1  1970 sbin/healthd
 -rwxr-x---   1 root     root       436816 Jan  1  1970 sbin/recovery
 lrwxr-x---   1 root     root            7 Jan  1  1970 sbin/ueventd -> ../init
 lrwxr-x---   1 root     root            7 Jan  1  1970 sbin/watchdogd -> ../init
 -rw-r--r--   1 root     root          656 Jan  1  1970 seapp_contexts
 -rw-r--r--   1 root     root        75088 Jan  1  1970 sepolicy
 drwxr-xr-x   1 root     root            0 Jan  1  1970 sys
 drwxr-xr-x   1 root     root            0 Jan  1  1970 system
 drwxr-xr-x   1 root     root            0 Jan  1  1970 tmp
 -rw-r--r--   1 root     root         9740 Jan  1  1970 ueventd.qcom.rc
 -rw-r--r--   1 root     root         4023 Jan  1  1970 ueventd.rc
--- a/Show more
+++ b/Show more
		`@ -0,0 +1 @@`
							`/system/bin/sh: cat: /proc/cmdline: Permission denied`
		`@ -0,0 +1 @@`
							`/system/bin/sh: cat: /d/regulator/*/name: No such file or directory`
		`@ -0,0 +1 @@`
							`Linux version 3.10.28 (richal@msa2) (gcc version 4.7 (GCC) ) #1 SMP PREEMPT Tue Apr 14 19:25:03 CST 2026`
		`@ -0,0 +1 @@`
							`earlycon console=ttyMSM0,115200n8 ignore_loglevel loglevel=8 rdinit=/init`
		`@ -0,0 +1,2 @@`
							`#pragma once`
							`const char const lk2nd_device_get_dtb_hints(void);`
		`@ -0,0 +1 @@`
							/tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lk2nd/boot/boot.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lk2nd/boot/extlinux.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lk2nd/boot/util.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lk2nd/hw/bdev/bdev.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lk2nd/hw/bdev/wrapper.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lk2nd/hw/bdev/util.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/bio/bio.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/bio/subdev.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/partition/partition.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/fs/fs.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/fs/ext2/ext2.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/fs/ext2/dir.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/fs/ext2/file.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/fs/ext2/io.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/bcache/bcache.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/zlib_inflate/decompress.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/zlib_inflate/inflate.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/zlib_inflate/inffast.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/zlib_inflate/inftrees.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/zlib_inflate/zutil.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/zlib_inflate/crc32.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/zlib_inflate/adler32.c
		`@ -0,0 +1,2 @@`
							`#!/bin/sh`
							`exec sh /tmp/aurora-modem start "$@"`
		`@ -0,0 +1,2 @@`
							`#!/bin/sh`
							`exec sh /tmp/aurora-modem status "$@"`
		`@ -0,0 +1,2 @@`
							`#!/bin/sh`
							`exec sh /tmp/aurora-modem stop "$@"`
		`@ -0,0 +1 @@`
							`gzip compressed data, from Unix, original size modulo 2^32 1060352`