Project Aurora: mainline ARM64 Linux on JZ08AU (MSM8916) LTE modem

Sanitized research log, build/reproducibility docs, DTS, kernel configs, patches, initramfs sources, bootchain migration plans and test logs. B5 direct boot PASS; B6 modem lifecycle in progress. No dumps, NV/EFS, vendor firmware or device identifiers included.
2026-09-30 17:23:18 +03:00 · 2026-09-30 17:23:18 +03:00 · 105bef466a
commit 105bef466a
856 changed files with 332686 additions and 0 deletions
--- a/.gitignore
+++ b/.gitignore
@ -0,0 +1,83 @@
+# --- raw device data: never commit ---
+dumps/
+partitions/*.bin
+backup/
+**/backup/
+*.bin
+*.img
+*.pad1M
+*.pad512K
+*.pad16M
+*.mbn
+*.elf
+*.mdt
+*.b[0-9][0-9]
+*.raw
+*.pcap
+*.dtb
+# NV / EFS / per-device partitions (hash lists nv-*.txt are fine)
+*modemst*
+*fsg*.bin
+*fsc*.bin
+*persist*.bin
+*userdata*
+firmware-fat/
+# SIM / identity material
+*.private*
+*imei*
+*iccid*
+*imsi*
+
+# --- vendor / proprietary blobs (see docs/BLOBS.md) ---
+firehose/*.bin
+bootchain/**/kernel
+bootchain/**/ramdisk
+bootchain/**/ramdisk-root/
+bootchain/aboot-analysis/
+
+# --- build trees and outputs (rebuild per docs/BUILD.md) ---
+linux/src/
+linux/out/
+lk2nd-build/src/
+lk2nd-build/out/
+lk2nd-build/inspect/
+linux/artifacts/**/Image*
+linux/artifacts/**/*.cpio.gz
+linux/initramfs*/dl/*
+!linux/initramfs*/dl/APK-SHA256SUMS
+linux/initramfs*/root/*
+!linux/initramfs*/root/bin/
+linux/initramfs*/root/bin/udevadm
+!linux/initramfs*/root/etc/
+linux/initramfs*/root/etc/*
+!linux/initramfs*/root/etc/passwd
+!linux/initramfs*/root/etc/group
+linux/initramfs*/busybox
+linux/initramfs*/gen_init_cpio
+linux/initramfs*/*.cpio.gz
+linux/**/*.so
+linux/**/*.apk
+linux/**/*.pp.dts
+*.tar
+*.tgz
+*.tar.gz
+*.gz
+*.apk
+*.o
+*.a
+
+# --- transient ---
+__pycache__/
+*.pyc
+*.stderr
+*.swp
+*~
+.DS_Store
+mnt/
+tmp/
+*.tmp
+.env
+*.key
+*.pem
+id_rsa*
+id_ed25519*
--- a/MANIFEST.md
+++ b/MANIFEST.md
@ -0,0 +1,40 @@
+# Aurora eMMC manifest (from full-emmc.bin GPT)
+
+```
+full image: 3909091328 bytes, 7634944 sectors, sha256 e81e7a7b727aa65883d30992702def3a23d694e0a32a7c6852eebc415c913c7a
+primary: sig=b'EFI PART' cur=1 bak=7634943 first=34 last=7634910 entries@2 n=28 hdrCRC=OK entCRC=OK
+backup: sig=b'EFI PART' cur=7634943 bak=1 first=34 last=7634910 entries@7634911 n=28 hdrCRC=OK entCRC=OK
+primary entries == backup entries: True; backup hdr at last LBA: True
+```
+
+| # | name | start LBA | sectors | bytes | attrs | SHA256 | rl vs rf |
+|---|---|---|---|---|---|---|---|
+| 1 | modem | 131072 | 131072 | 67108864 | 0x1000000000000000 | 04ada779f8ab878b048bd8551bb6633eb2810bf45637557f3053bbf3354680b5 | MATCH |
+| 2 | sbl1 | 262144 | 1024 | 524288 | 0x0000000000000000 | 6a661ec947c1d935316f9d8731b5314e7502bde5825ebbfc3d2860d081b4096d | MATCH |
+| 3 | sbl1bak | 263168 | 1024 | 524288 | 0x0000000000000000 | 6a661ec947c1d935316f9d8731b5314e7502bde5825ebbfc3d2860d081b4096d | MATCH |
+| 4 | aboot | 264192 | 2048 | 1048576 | 0x0000000000000000 | fd1af1679f9dd24de2689dc79faf0d2b043c3e95200234bec36da9ed7df1053a | MATCH |
+| 5 | abootbak | 266240 | 2048 | 1048576 | 0x0000000000000000 | ebcd0c9011ac887cdf208c2413c4447c2a7d88f4ced1f3ea4f826162c8f2f30d | MATCH |
+| 6 | rpm | 268288 | 1024 | 524288 | 0x0000000000000000 | 5a9b857ba6c3af1c848c6e57bbaf9cefcedc3629e5536d27e87b336c67a281fd | MATCH |
+| 7 | rpmbak | 269312 | 1024 | 524288 | 0x0000000000000000 | 5a9b857ba6c3af1c848c6e57bbaf9cefcedc3629e5536d27e87b336c67a281fd | MATCH |
+| 8 | tz | 270336 | 1024 | 524288 | 0x0000000000000000 | 4c8c7875501e0718b2afe6597f7159a510462cb4bd9b0e6f25ab142d256ddfb8 | MATCH |
+| 9 | tzbak | 271360 | 1024 | 524288 | 0x0000000000000000 | c6f7db266a14227ca7e7b0343661089298e4c4320a9522e3e695b5e069e6b4af | MATCH |
+| 10 | hyp | 272384 | 1024 | 524288 | 0x0000000000000000 | 340049c116faaab6db6cd5004ec7eb17c3fecd308df8456ede8b40aa3244c506 | MATCH |
+| 11 | hypbak | 273408 | 1024 | 524288 | 0x0000000000000000 | 428d25ebd86d047f33fa9fd2f22aa2d716e6ecf39735ad61bb34409a323f9082 | MATCH |
+| 12 | pad | 274432 | 2048 | 1048576 | 0x0000000000000000 | e3e1c32da673d1feb4a2f11f05e55f12e7d6829ee9a1b1f4062ce1bc7823d25e | MATCH |
+| 13 | modemst1 | 276480 | 3072 | 1572864 | 0x0000000000000000 | 6f45b08a0b752a0f642842b35d7fcb6849bab2977a76c03672b82df4387b3c05 | MATCH |
+| 14 | modemst2 | 279552 | 3072 | 1572864 | 0x0000000000000000 | 79037242b7f34d373637258c13e0c8dd1a1460bfd44a87234dd83b66cd673917 | MATCH |
+| 15 | misc | 282624 | 2048 | 1048576 | 0x0000000000000000 | 959c2320499fc3be3eaf6d38889cc192dccc0ad6c98f0d90511edfd4cc3ff6e8 | MATCH |
+| 16 | fsc | 284672 | 2 | 1024 | 0x0000000000000000 | 5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef | MATCH |
+| 17 | ssd | 284674 | 16 | 8192 | 0x0000000000000000 | 9f1dcbc35c350d6027f98be0f5c8b43b42ca52b7604459c0c42be3aa88913d47 | MATCH |
+| 18 | splash | 284690 | 20480 | 10485760 | 0x0000000000000000 | e5b844cc57f57094ea4585e235f36c78c1cd222262bb89d53c94dcb4d6b3e55d | MATCH |
+| 19 | DDR | 393216 | 64 | 32768 | 0x1000000000000000 | c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479 | MATCH |
+| 20 | fsg | 393280 | 3072 | 1572864 | 0x1000000000000000 | b0a3b7e46bc420f39120cfa7f2049027cba59383d52c78ad9576049ad40982aa | MATCH |
+| 21 | sec | 396352 | 32 | 16384 | 0x1000000000000000 | 3b1cae78981f065f648ee33b048de38004569dacb2ae4a3093404eb1b5586985 | MATCH |
+| 22 | boot | 396384 | 32768 | 16777216 | 0x1000000000000000 | 1342def7e0f0c245385d4bac2852d361537a520abd8a45708618983cdab43c0a | MATCH |
+| 23 | system | 429152 | 1638400 | 838860800 | 0x1000000000000000 | f09ded23689fbf22e656784917b3b0dfdc13a50393f56385f8e8abe15e72199d | MATCH |
+| 24 | persist | 2067552 | 65536 | 33554432 | 0x1000000000000000 | 9923b45bee1637b289bfc686a3c57ab69289bb56da4d2add063bf4481de0808c | MATCH |
+| 25 | cache | 2133088 | 262144 | 134217728 | 0x1000000000000000 | 6a8ab0bd7c0d1d64160d6063c515b0c1e5f172ca26475d9b6cf9287289a63a2c | MATCH |
+| 26 | recovery | 2395232 | 32768 | 16777216 | 0x1000000000000000 | 0be90bc42efb0eae2e5376fef2c2786d68c614f679f6e214102a92b196b3a43d | MATCH |
+| 27 | userdata | 2428000 | 5206911 | 2665938432 | 0x1000000000000000 | 0678d9809d50a2322c50568e1c406687f5992200d97de5c9987542e7e402bdae | MATCH |
+
+ALL PARTITIONS VERIFIED: True
--- a/NOTES.md
+++ b/NOTES.md
@ -0,0 +1,964 @@
+# Aurora — отчёт сессии 1 (2026-09-29)
+
+## 1. Hardware
+- SoC: MSM8916 (Sahara MSM_ID 0x007050e1), 4×Cortex-A53, Android 32-bit.
+- RAM: 512 MB (MemTotal 403480 kB; LK/QCDT выбирает "MSM 8916 512MB MTP", board-id 8/0x100).
+- eMMC: Hynix **H4G2a**, CID `<EMMC_CID>`, PSN 0x<EMMC_SERIAL>,
+  3 909 091 328 B = 7 634 944 секторов (у JZ02: 3 875 536 896 B — другая eMMC).
+- PMIC: PM8916 (linear charger + VM-BMS, MPP4 current sink → lcd-bl, vibrator node enabled).
+- Батарея: присутствует, профиль `palladium_1500mah` (стандартный MTP-профиль, вероятно не откалиброван под реальный АКБ).
+- Идентификаторы: fastboot serialno <EMMC_SERIAL> **= eMMC PSN**, не серийник чипа. Sahara chip serial = **0x<SAHARA_SERIAL>**.
+
+## 2. Android / kernel
+- Android 4.4.4 KTU84P, `msm8916_32_512-user … eng.richal.20260709 test-keys`, product/model `MIFI`.
+- Kernel: `Linux 3.10.28 (richal@msa2) gcc 4.7 #1 SMP PREEMPT Tue Apr 14 2026`.
+- cmdline (из boot.img): `console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x3F ehci-hcd.park=3 androidboot.bootdevice=7824900.sdhci`
+- Baseband: PM.1.0.c7-00193-M8916EAAAANVZM-1.
+
+## 3. Root / adbd
+- `uid=2000(shell)`, ro.secure=1, ro.debuggable=0, su нет. dmesg (klogctl) и /proc/cmdline недоступны. `adb root` не проверялся (user-build → бесполезно).
+- adb serial = `0` (как на JZ02).
+
+## 4. Fastboot
+- Минимальный LK: getvar почти пустой. devinfo (последний сектор aboot): `ANDROID-BOOT!`, is_unlocked=0, is_tampered=0, charger_screen_enabled=1 — **как у JZ02**, bootloader, вероятно, locked. abootbak без devinfo.
+
+## 5. EDL
+- `adb reboot edl` → 05c6:9008 — работает.
+
+## 6. Sahara
+| | Aurora | JZ02 |
+|---|---|---|
+| Sahara ver | 2 (min 1) | 2 |
+| HWID | 0x007050e100000000 (OEM 0, MODEL 0) | тот же |
+| PK_HASH | cc3153a80293939b90d02d3bf8b23e0292e452fef662c74998421adad42a380f | тот же |
+| Serial | 0x<SAHARA_SERIAL> | 0x<JZ02_SAHARA_SERIAL> |
+
+PK_HASH = публичный тестовый root Qualcomm ⇒ **secure boot не зафьюжен** (PBL принимает любой тест-подписанный программер).
+
+Инцидент: мой первый probe (`tools/sahara_probe.py`) отправил SAHARA_EXEC GET_SBL_VERSION — PBL его не поддержал, после
+этого modeswitch не вернул HELLO и PBL завис. Плата была восстановлена пользователем (перезагрузка в Android).
+Хранилище не затронуто. Вывод: только стандартный `edl` flow; не слать неподдерживаемые exec-команды.
+
+## 7. Firehose
+- Файл: `firehose/007050e100000000_394a2e47cf830150_fhprg_peek.bin`
+- SHA256: `53f193500c03248f0d671ab57bfe9ca8a42967e97f28403294b4b3f854075aca`
+- Источник: bkerler edl Loaders, `qualcomm/factory/msm8916/` (тот же файл, что на JZ02).
+- ELF32, подписан цепочкой QUALCOMM (тестовые ключи), Sahara принял, `TargetName=MSM8916, MemoryName=eMMC, Version=1`.
+- READ: подтверждено (две независимые вычитки совпали). WRITE: не тестировалось. RESET: на JZ02 ненадёжен — после работы отключать питание вручную.
+- Использованы только команды: `printgpt`, `rl`, `rf`.
+
+## 8. GPT
+Primary и backup: CRC header/entries OK, 28 слотов, записи идентичны, backup header на последнем LBA (7634943).
+Таблица совпадает с данными Android (/proc/partitions + by-name). Полная таблица: `MANIFEST.md`.
+Неразмеченное: LBA 34..131071 (до modem), 305170..393215 (между splash и DDR) — входит в full-emmc.bin.
+
+## 9. Backup
+- `rl` (все разделы) и `rf` (вся eMMC) — две независимые вычитки, 19:24–19:33 MSK.
+- 27/27 разделов bit-identical между rl и rf, размеры = GPT. Хэши: `partitions/SHA256SUMS`, `dumps/full-emmc.sha256`.
+- Две копии: ноутбук + эта папка (sha256 проверены после копирования).
+
+## 10. Bootchain (ELF-разбор, `bootchain/elfinfo.txt`)
+| образ | версия | сравнение с JZ02 |
+|---|---|---|
+| sbl1 = sbl1bak | BOOT.BF.3.0.1-00019 (HAAAANAZA) | раздел целиком **идентичен** |
+| rpm = rpmbak | RPM.BF.2.0.1-00027 | ELF-образ идентичен; раздел отличается только мусором после конца образа |
+| tz / tzbak | TZ.BF.2.2-2.2.0026 | ELF-образ идентичен. В хвосте tz — остатки старого TZ.BF.2.5.C6-00025 (не исполняется) |
+| hyp / hypbak | (hyp из TZ.BF.2.2) | ELF-образ идентичен; хвост hyp — остатки TZ.BF.2.5.C6 hyp |
+| aboot = abootbak (кроме devinfo) | LK, сертификат 2026-07-09 | **ДРУГОЙ** (JZ02: 2025-11-03). Добавлены SPI-панели st7735s/nv3023a, "Config SPI PANEL", charger mode |
+| DDR, sec, splash | — | разделы идентичны JZ02 |
+| modem | MPSS.DPM.1.0.C7-00193, WCNSS CNSS.PR.1.4.2.C4-00084 | те же сборки; образ раздела отличается (содержимое FAT не сравнивалось) |
+
+Вывод: SBL1/RPM/TZ/HYP де-факто те же, что stock JZ02. Отличается только LK (aboot).
+Не выводить отсюда, что DB410c TZ/qhypstub/lk1st от JZ02 подойдут без проверки — это только аналитический факт.
+
+## 11. boot / recovery (`bootchain/boot|recovery/info.txt`)
+- Android boot image v0, page 2048, kernel @0x80008000, ramdisk @0x81000000, tags @0x80000100.
+- Ядро: zImage 32-bit, одно и то же в boot и recovery (sha256 8796a9cd…), без appended DTB.
+- DTB: **QCDT v2** (dt_size 0x46800), 8 записей → 2 уникальных DTB, одинаковые в boot и recovery.
+  platform_id 0xce/0xf8/0xf9/0xfa, variant 8 (QRD/MTP), subtype 0 (`dtb_00`, "MSM 8916 MTP") и 0x100 (`dtb_01`, "512MB MTP").
+- ramdisk: boot 534088 B, recovery 1071013 B (не распакованы — следующий шаг).
+
+## 12. DT / board (`dt/dtb_01.dts` — активный для 512MB)
+- model "Qualcomm Technologies, Inc. MSM 8916 512MB MTP", compatible `qcom,msm8916-mtp`.
+- **Дисплей**: ST7735S "wx144" 128×128, command mode, RGB565 (bpp 16), 20 fps, cont-splash.
+  - интерфейс: SPI через MDSS SPI (`qcom,mdss-spi-display`), BLSP1 **QUP4** `spi@78b8000` (BAM), клиент 16 МГц.
+  - reset GPIO **118**, D/C GPIO **116** (disp_rst_n / disp_dc в /sys/kernel/debug/gpio).
+  - vdd = **L17 2.85 В**, vddio = **L6 1.8 В**.
+  - подсветка: PM8916 **MPP4** current sink (`lcd-bl`, 40 мА, manual). В Android также `lcd-backlight` (mdss).
+  - альтернативная панель в DT/LK: NV3023A "jz05" 128×128 SPI (второй вариант поставки).
+  - fb0: `mdssfb_d0000`, "spi panel", 128×128, virtual 128×256, 32 bpp, stride 512.
+  - тачскрина нет.
+- **Кнопки**: PON power (qpnp_pon), `key_f2` GPIO37 (active-high, KEY_F2), `key_f3` GPIO107 (active-low, KEY_F3). Обе wakeup.
+- **SIM mux** (gpio-leds hack): sim1_switch GPIO22, sim2_switch GPIO23, sim3_switch GPIO1 (default on), sim_hotdet GPIO20 — **те же GPIO, что у JZ02**.
+- LEDs: RGB GPIO-LED как у JZ02 (GPIO6/7/8) в DT **нет**.
+- UART: console `serial@78b0000` (BLSP1 UART2, ttyHSL0, 115200).
+- USB: hsusb-otg @78d9000, usb-bam.
+- WCNSS: `qcom,wcnss_wlan@0a000000`, pronto PIL, 5-wire pinmux (GPIO40-44) — как JZ02.
+- Modem: `qcom,pil-q6v56-mss@4080000`, SMD/SMSM, **bam_dmux@4044000**, rmtfs sharedmem-uio.
+- Thermal: tsens sensor0/1/2/4/5, pm8916_tz, bms, battery; msm-thermal.
+- Audio: msm8x16 codec (headset jack detect), cdc-us-euro GPIO113 (JZ02: 120).
+- Камеры CCI camera@0/@1 "ok" — артефакт MTP-DT, физически камер нет (не проверялось).
+- Полный diff против JZ02 stock dtb_01: `dt/diff-jz02-vs-aurora-dtb01.txt`.
+
+Android runtime: rmt_storage, qmuxd, netmgrd, rild, wcnss_service, hostapd, dnsmasq, thermal-engine, mpdecision.
+wlan0 = AP 192.168.100.1/24; rmnet* + rev_rmnet* (SMD/BAM-DMUX).
+
+## 13. JZ02 vs Aurora
+| | JZ02 | Aurora | класс |
+|---|---|---|---|
+| SoC | MSM8916 | MSM8916 | SAME |
+| RAM | не зафиксировано в заметках | 512MB | UNKNOWN |
+| eMMC | 3 875 536 896 B | 3 909 091 328 B, Hynix H4G2a | DIFFERENT |
+| GPT | 27 разделов | те же имена/порядок, другие размеры/смещения под eMMC | DIFFERENT (не переносить GPT) |
+| SBL1 | BOOT.BF.3.0.1-00019 | идентичен | SAME |
+| RPM | RPM.BF.2.0.1-00027 | ELF идентичен | SAME |
+| TZ | TZ.BF.2.2-2.2.0026 | ELF идентичен | SAME |
+| HYP | stock | ELF идентичен | SAME |
+| ABOOT | LK 2025-11 | LK 2026-07, SPI panel | DIFFERENT |
+| MPSS | MPSS.DPM.1.0.C7-00193 | та же версия, но переподписан 2026-04 и бинарно отличается | DIFFERENT (см. S2.7) |
+| PMIC | PM8916 | PM8916 | SAME |
+| WCNSS | CNSS.PR.1.4.2.C4-00084 | тот же, те же пины | LIKELY SAME |
+| Wi-Fi | WCN36x0 via pronto | то же | LIKELY SAME |
+| USB | hsusb-otg | то же | LIKELY SAME |
+| UART | ttyHSL0 @78b0000 | ttyHSL0 @78b0000, GPIO4/5 (DT), пады найдены | LIKELY SAME (у JZ02 pinctrl не сверялся) |
+| SIM mux | GPIO22/23/1/20 | GPIO22/23/1/20 | SAME (по DT) |
+| display | нет (в DT — generic DSI st7796s) | ST7735S SPI 128×128 | DIFFERENT |
+| buttons | vol_up GPIO107, reset GPIO37 | key_f3 GPIO107, key_f2 GPIO37 (+PON) | LIKELY SAME pins, другие коды |
+| LEDs | RGB GPIO6/7/8 | нет RGB; lcd-bl на MPP4 | DIFFERENT |
+| battery | ? | 1500 mAh, VM-BMS | UNKNOWN для JZ02 |
+| charger | ? | qpnp-linear-charger | UNKNOWN для JZ02 |
+| thermal | tsens | tsens + bms/battery | LIKELY SAME |
+| DT | QCDT v2, 2 DTB | QCDT v2, 2 DTB, ~1080 строк diff | DIFFERENT |
+| kernel | 3.10.28 (sha 56214cdd…) | 3.10.28 (sha 8796a9cd…) | DIFFERENT build |
+
+## 14. Риски / блокеры
+- Firehose WRITE не проверен; edl reset ненадёжен (опыт JZ02) → после EDL-сессии нужен ручной power-cycle.
+- modemst1/2, fsg, persist — уникальные NV/RF-калибровки; бэкап есть, но писать туда нельзя.
+- Мусор в хвостах rpm/tz/hyp: при любой будущей записи bootchain сравнивать по ELF-образу, а не по хэшу раздела.
+- UART найден (сессия 2). Stock LK: только getvar/download — RAM-boot невозможен без записи (S2.4).
+- Аварийный вход в EDL без Android (кнопки/test point) не найден — сейчас EDL только через `adb reboot edl` или fastboot/LK.
+- Батарея: при экспериментах с ядром без charger/BMS драйвера возможен глубокий разряд.
+
+## 15. Следующий безопасный шаг
+> Устарело после сессии 2: п.2 выполнен — `fastboot boot` в stock LK отсутствует (S2.4); п.3 выполнен (S2.5–S2.7); UART найден (S2.1).
+
+1. Физически: отключить/подключить питание (плата сейчас в firehose-режиме), убедиться, что Android загрузился.
+2. Проверить `fastboot oem device-info` / `fastboot boot <stock boot.img>` (RAM-boot без записи) — понять, разрешает ли LK `fastboot boot`. Это ключ к тестам mainline без flash.
+3. Распаковать ramdisk boot/recovery, собрать init/rc и firmware-список; снять содержимое FAT `modem` (mtools) и сравнить с JZ02.
+4. Найти UART-пады (GPIO4/5) на плате — до начала порта Linux.
+5. Только после этого: план mainline DTS `msm8916-jz08-aurora` (panel-mipi-dbi/ st7735 над SPI QUP4, gpio-keys, pm8916 charger/bms).
+
+---
+
+# Сессия 2 (2026-09-29, 20:00–) — UART, fastboot policy, ramdisk, modem FAT
+
+Все операции read-only. В eMMC ничего не записано.
+
+## S2.1 UART (подтверждён физически)
+- Пады RX/TX найдены пользователем на плате; вывод stock kernel console читается.
+  - Расположение TX pad: **не сообщено** (дописать).
+  - Расположение RX pad: **не сообщено** (дописать).
+  - GND: **не сообщено**.
+  - Уровень логики: **не измерялся** (MSM8916 GPIO bank = 1.8 В — ожидаемо, не подтверждено измерением).
+- Адаптер на 480s: CH340 (1a86:7523) → `/dev/ttyUSB0`, 115200 8N1.
+- Логика: BLSP1 UART2, `serial@78b0000` (`qcom,msm-lsuart-v14`, irq 0x6c), ttyHSL0, cmdline `console=ttyHSL0,115200,n8`.
+- pinctrl из Aurora `dt/dtb_01.dts` (`pinctrl-0 = <0xac>` → `pmx-uartconsole/uart-console`):
+  - `qcom,pins = <&tlmm 4>, <&tlmm 5>` → **GPIO4, GPIO5**; `qcom,pin-func = 2`;
+  - `drive-strength = 2` (мА), `bias-pull-down`;
+  - только состояние `default` (active); **sleep-состояния в DT нет**.
+  - TX = GPIO4, RX = GPIO5 — по таблице функций TLMM MSM8916 (blsp_uart2), в самом DT направление не указано.
+- Битые символы: встречаются кластерами там, где kernel printk пересекается с выводом из другого контекста (SBL→LK
+  переход, параллельные CPU), не равномерно — нет оснований считать baudrate неверным.
+
+## S2.2 Cold-boot UART log (`logs/uart/coldboot-20260929-200018.log/.raw`)
+Контекст: плата была выключена и сидела в **off-mode charging** (Android `charger`). Нажатие питания →
+`charger: [241128] rebooting` → `Restarting system` → полный bootchain. PON reason в ядре:
+`Triggered from Hard Reset and 'cold' boot`, power-off reason `PS_HOLD`. LK: `pm8x41_get_is_cold_boot` (текст повреждён).
+- PBL: вывода нет (ожидаемо).
+- **SBL1**: печатает boot-лог (`Format: Log Type - Time(microsec)`), `batt_voltage=3975`, `sbl1_efs_handle_cookies`,
+  загрузка TZ/RPM/APPSBL, `QSEE Execution`, `SBL1, End` ≈ 335 мс.
+- **LK**: `Android Bootloader - UART_DM Initialized!!!`, `welcome to lk`, баннера/версии нет.
+  - `[210] Panel power on done`, `[210] Config SPI PANEL.` — LK сам инициализирует ST7735S (splash).
+  - DTB: `Using DTB entry 206/00000000/0x00000008/256 for device 206/00010000/0x0001…` → выбран **dtb_01** (512MB MTP).
+  - cmdline от LK добавляет: `androidboot.emmc=true androidboot.serialno=<EMMC_SERIAL> androidboot.baseband=msm
+    mdss_mdp.panel=1:spi:0:qcom,mdss_spi_st7735s_wx144_128x128_cmd`.
+  - `booting linux @ 0x80008000, ramdisk @ 0x82000000 (534088), tags/device tree @ 0x81e00000`.
+  - Сообщения `Authenticating boot image` в логе **не видно** (участок 400–500 мс частично повреждён) — не доказано ни то, ни другое.
+- **Kernel**: `[0.000000] Linux version 3.10.28 … Apr 14 2026`, ARMv7 (32-bit), model "MSM 8916 512MB MTP".
+  `socinfo: id=206 ver=1.0 hw_plat=8 hw_plat_subtype=0 pmic_model=65547 (PM8916 v2.0)`. Memory 420 MB total.
+  mdss_spi_panel_init: st7735s, continuous splash. BMS: soc=38, vbatt≈3.92 В.
+- **Модем** (normal boot): ext4 mount ≈8.3 с → `pil-q6v5-mss: modem: loading` 8.81 с → `pil: MBA boot done` 8.87 →
+  `modem: Brought out of reset` 9.56 → `Power/Clock ready interrupt` 9.65 → `Subsystem error monitoring … up`.
+  **MPSS стартует успешно**; строки `Failed to locate modem.mdt` в этой загрузке нет.
+- WCNSS: `wcnss_wlan probed`, WLAN FW caps ≈21.6 с.
+- Шум, не относящийся к делу: ov5648 camera probe fail (камеры нет), `gcc-mdss Failed to get pixel source` (SPI-панель без DSI),
+  `display reset gpio request failed` (18.15 с, GPIO118 уже занят mdss_spi — предположение).
+
+## S2.3 fastboot policy (`logs/fastboot/session-20260929-200145.txt`)
+- `adb reboot bootloader` → UART: `Restarting system with command 'bootloader'` → SBL → LK `pm8x41_get_is_cold_boot: Warm boot`
+  → `fastboot: processing commands`. USB 18d1:d00d, serial <EMMC_SERIAL>.
+- `fastboot oem device-info` → `FAILED (remote: 'unknown command')`.
+- `fastboot getvar all` → пусто.
+
+## S2.4 fastboot boot stock boot.img — **FAIL**
+- Образ: `partitions/boot.bin`, sha256 `1342def7…3c0a` = manifest (Aurora), ≠ JZ02 (`9cc36657…`).
+- `fastboot boot partitions/boot.bin` → `Sending 'boot.img' (16384 KB) OKAY` → `Booting FAILED (remote: 'unknown command')`.
+- UART LK: `[15510] fastboot: download:01000000` → `[16020] fastboot: boot` → unknown command.
+- Причина (статический анализ `partitions/aboot.bin`): в LK зарегистрированы только **`getvar:` и `download:`**.
+  Нет `boot`, `flash:`, `erase:`, `continue`, `reboot`, `reboot-bootloader`, любых `oem`/`flashing`.
+  **Точно так же урезан LK JZ02** (проверено тем же способом).
+- Следствия:
+  - **FASTBOOT RAM BOOT = NOT AVAILABLE** на stock LK.
+  - Из fastboot нельзя выйти программно — только отключение питания.
+  - eMMC не изменялась (download пишет только в RAM-буфер LK; команд записи в LK нет вообще).
+- Обход записью в aboot НЕ предпринимался (по правилам сессии).
+
+## S2.5 modem.mdt — объяснение
+- `init.target.rc`: `on fs` → `mount vfat …/by-name/modem /firmware ro …`;
+  `init.qcom.rc`: `on early-boot` → `write /sys/kernel/boot_adsp/boot 1` (+ pil параметры из persist.sys.*, пустые → "cannot expand").
+- В off-mode charging (`androidboot.mode=charger`) init выполняет `on charger` (монтирует только /system, стартует
+  healthd/charger/vm_bms), **`on fs` не выполняется → /firmware не смонтирован**. Ядерный PIL-vote при этом пытается
+  загрузить modem → `Failed to locate modem.mdt` / `pil_vote_load_worker: Failed to load modem`.
+- Пример пользователя содержит `charger: Enabling backlight` → это была загрузка в charger mode. Вывод: **сообщение
+  нормально для зарядного режима, модем исправен** (в normal boot MPSS поднимается, см. S2.2).
+- Последовательность boot ramdisk JZ02 и Aurora идентична: из всех файлов boot ramdisk отличается только `init.rc`
+  (у Aurora добавлены chown/chmod для sysfs LED `*_sec`, `*2`, `*2_sec`); init.target.rc/init.qcom.rc/fstab — одинаковые.
+
+## S2.6 Ramdisk inventory (`tools/unpack-ramdisk.sh`, результат `bootchain/{boot,recovery}/ramdisk-root`)
+Воспроизведение: `tools/unpack-ramdisk.sh` (gzip → cpio -id --no-absolute-filenames; списки `ramdisk.list`). Оригиналы не менялись.
+- boot (gzip, 51 запись): init, init.rc, init.environ.rc, init.qcom.rc, init.target.rc, init.qcom.usb.rc, init.usb.rc,
+  init.trace.rc, init.qti.carrier.rc, init.*.sh (class_main, mdm, class_core, early_boot, factory, qcom, ssr, syspart_fixup, usb),
+  fstab.qcom, ueventd.rc, ueventd.qcom.rc, default.prop, sepolicy/*_contexts, charger, res/ (charger images), sbin/.
+  - fstab.qcom: system ro, userdata (encryptable=footer), vold sdcard1 (7864900.sdhci), uicc0/1 на `78b7000.spi` (не используется), usbotg, zram 192 MiB.
+  - cache/persist/firmware монтируются вручную в `on fs` (init.target.rc).
+  - modem stack: rmt_storage, qmuxd, netmgrd, ril-daemon1/2 (`rild -c 1/2`), wcnss-service, wcnss_filter.
+  - charger: `on charger` → healthd-charger, `/charger`, vm_bms; qbcharger по property.
+  - default.prop: ro.secure=1, ro.debuggable=0, persist.sys.usb.config=none.
+- recovery (gzip, 73 записи): минимальный AOSP recovery (sbin/recovery, adbd, healthd, ueventd, watchdogd), etc/recovery.fstab
+  (system/cache/userdata/boot/recovery/misc). default.prop: ro.secure=1, usb.config=diag,serial_smd,rmnet_bam,adb → **root в recovery нет**.
+- Сам recovery-ramdisk не содержит init.qcom.rc/init.target.rc → модем в recovery не стартует.
+
+## S2.7 Modem FAT (раздел `modem`), пофайлово vs JZ02 (`firmware-fat-compare.tsv`, распаковано в `firmware-fat/`)
+Извлечено read-only `7z x partitions/modem.bin`. 53 файла у обеих плат, набор имён одинаковый.
+| группа | результат |
+|---|---|
+| wcnss.mdt, wcnss.b00-b11 | **SAME** |
+| cmnlib.*, keymaste.*, playread.*, widevine.* | **SAME** |
+| modem.b03, b04, b19 | SAME |
+| modem.mdt, b00-b02, b05-b07, b10, b12, b13, b15-b18, b20, b21, b24-b27 | **DIFFERENT** |
+| mba.mbn | **DIFFERENT** |
+- Базовая сборка та же (`M8916EAAAANVZM-1_20150909_103440`, MPSS.DPM.1.0.C7-00193), но Aurora-модем/MBA **переподписаны
+  2026-04-30** (cert 260430…Z), JZ02 — 2023-06-28. Отличаются кодовые сегменты (b05, b18, b20, b26…) → бинарно модифицированная прошивка,
+  не просто другая подпись. **MPSS между платами НЕ взаимозаменяем** без отдельного анализа.
+
+## S2.8 Безопасный путь RAM-boot — статус
+Stock LK (Aurora и JZ02) не умеет `fastboot boot`. Без записи в eMMC загрузить собственное ядро **невозможно**
+(EDL/firehose грузит только программер, не ядро). Любой путь требует **минимум одной записи**, которую пользователь должен одобрить явно.
+
+Вариант, который предлагаю к обсуждению (НЕ выполнен):
+- **lk2nd в раздел `recovery`** через firehose `program` (первая запись firehose — WRITE ещё не тестировался).
+  - recovery — некритичный раздел, есть проверенный бэкап; boot/aboot/bootchain/NV не трогаются, обычная загрузка Android не меняется.
+  - Вход: `adb reboot recovery` → stock LK грузит recovery → lk2nd → полноценный fastboot (`fastboot boot` → RAM boot).
+  - Откат: EDL `program recovery partitions/recovery.bin` (или LK сам свалится в normal boot/fastboot при невалидном образе).
+  - Открытые вопросы до записи: (1) проверяет ли stock LK подпись recovery (строки `Authenticating boot image` в LK есть,
+    факт применения не доказан; чип unfused); (2) нужна ли поддержка QCDT/board-id для lk2nd на этой плате;
+    (3) firehose WRITE сначала проверить на безопасной цели.
+- Альтернативы хуже: замена aboot (риск bootchain), замена boot (ломает stock Android).
+
+## S2.9 Первый минимальный Linux RAM-boot (дизайн, не начат)
+- Цепочка: stock SBL1/TZ/HYP/LK → recovery=lk2nd → `fastboot boot` образа (Image.gz + DTB + initramfs), всё в RAM.
+- Ядро: mainline arm64 ≥ 6.6 (msm8916 поддержан upstream), defconfig + msm8916 фрагмент; **без** rmtfs/modem/wcnss на первом шаге.
+- DTB `msm8916-jz08-aurora.dts` (минимум): `#include "msm8916-pm8916.dtsi"`, memory от lk2nd,
+  `&blsp_uart2 { status="okay"; }` (GPIO4/5, console ttyMSM0), `&sdhc_1` можно **disabled** на 1-м шаге (или только чтение),
+  `&usb` peripheral (опционально), gpio-keys GPIO37 (active-high) / GPIO107 (active-low), `&pm8916_pwrkey`.
+- initramfs: static busybox, `/init` печатает в ttyMSM0: uname, /proc/cpuinfo, meminfo, interrupts, dmesg, gpio-keys events;
+  никаких mount блочных устройств, никакого mkfs, никаких записей.
+- Критерии PASS: kernel стартует, UART, DT выбран (model), RAM ≈ 512 MB (минус reserved), таймер/GIC (interrupts растут),
+  gpio-keys реагируют, USB (опц.), eMMC не тронута (sha256 boot/recovery/… до и после через EDL — по желанию).
+- Потом: sdhc_1 ro → rmtfs/modem (Aurora-собственный MPSS!) → wcnss → ST7735S (`panel-mipi-dbi`/`fb_st7735r` на `&blsp_spi4`,
+  reset GPIO118, dc GPIO116, L17/L6, backlight PM8916 MPP4) → charger/BMS.
+
+---
+
+# Сессия 3 — read-only preflight для lk2nd-в-recovery (2026-09-29 20:11–)
+UART: `logs/uart/preflight-recovery-20260929-201150.{log,raw}`. В eMMC ничего не записано нами
+(оговорка: stock recovery сам монтирует /cache ext4 rw — штатное поведение заводского recovery).
+
+## P1 Эталонный recovery
+`partitions/recovery.bin`: 16 777 216 B = 32768 секторов с LBA 2395232 (= GPT), sha256
+`0be90bc42efb0eae2e5376fef2c2786d68c614f679f6e214102a92b196b3a43d` = MANIFEST = SHA256SUMS = срез full-emmc.bin.
+
+## P2 Normal boot после полного обесточивания
+OK: LK → DTB 206/…/0x8/256 (dtb_01) → kernel → modem `Brought out of reset` 9.7 с → `sys.boot_completed=1`, adb есть.
+
+## P3 `adb reboot recovery` → stock recovery
+- kernel: `Restarting system with command 'recovery'` → SBL1 → LK `pm8x41_get_is_cold_boot: Warm…`, `pon_reason is 17 cold_boot:0`.
+- LK выбрал тот же DTB (206/00000000/0x8/256) и загрузил **recovery**: `booting linux @ 0x80008000, ramdisk @ 0x82000000 (1071013),
+  tags/device tree @ 0x81e00000` (1071013 = размер ramdisk recovery.img; у boot 534088).
+- cmdline recovery = cmdline normal + ` gpt` (LK добавляет в recovery-пути); `androidboot.mode` не передаётся.
+- recovery kernel/init стартуют, /cache монтируется; USB не энумерируется (adbd в stock recovery не поднимается), UI ждёт клавиш —
+  **за 5 мин сам не перезагрузился**. Выход — физически (кнопка/обесточивание).
+
+## P4 Аутентификация образов — что доказано
+- UART: строк `Authenticating boot image`, `signature`, `Image Invalid`, `Recovery command`, `boot-recovery` **не наблюдалось**
+  ни в normal, ни в recovery-пути. НО окно LK ~400–500 мс (где печатается выбор DTB и, возможно, загрузка/проверка образа)
+  **систематически повреждено** в обоих логах (потеря байт, не baudrate) → отсутствие строки само по себе не доказательство.
+- Косвенное (сильное): **ни boot, ни recovery не несут подписи** по смещению, где её ищет Qualcomm LK
+  (`imagesize_actual` = page + kernel + ramdisk + dt, всё page-aligned):
+  - boot @0x6ee800: сплошные высокоэнтропийные остатки (>4 KiB, энтропия ~7.1 бит/байт на всех 256-байтных блоках) — не 256-байтная подпись;
+  - recovery @0x771800: остатки старого DTB (строки `primary`, `SPK_RX_BIAS`, `Handset Mic`…) — подписи нет точно.
+  - Тем не менее LK загрузил и запустил оба образа.
+- `androidboot.authorized_kernel=true` (LK добавляет при успешной аутентификации, строка есть в aboot) **отсутствует**
+  в cmdline normal, recovery и charger загрузок.
+- Вывод: на Aurora stock LK **не требует валидной подписи** ни для boot, ни для recovery (либо проверка не выполняется, либо
+  её результат не блокирует загрузку). Devinfo `is_unlocked=0` на это не влияет — locked-устройство грузит неподписанный recovery.
+- Не доказано: выполняется ли вычисление/проверка вообще (нужен неповреждённый UART в окне 400–500 мс или разбор кода).
+
+## P5 Возврат в Android и EDL
+- Выход из stock recovery — вручную пользователем (перезагрузка); Android загрузился, `sys.boot_completed=1`, adb OK.
+- `adb reboot edl` → **05c6:9008** за <25 с (20:20:26). Sahara не трогали; выход из EDL — только обесточивание.
+
+## P6 Итог preflight
+| пункт | результат |
+|---|---|
+| normal boot | OK |
+| stock recovery (`adb reboot recovery`) | OK (грузится, но зависает в UI без USB; выход — руками) |
+| auth path в UART | NOT OBSERVED (окно LK 400–500 мс повреждено) |
+| signature verification | де-факто не применяется: оба stock-образа без подписи грузятся |
+| EDL | OK |
+
+Оценка риска lk2nd-в-recovery: НИЗКИЙ для bootchain/NV (пишется только recovery; boot/aboot/NV не трогаются;
+normal boot не зависит от recovery; откат — EDL `program` оригинала, путь в EDL через adb из normal Android подтверждён).
+Остаточные риски: (1) первая firehose WRITE на Aurora; (2) lk2nd может не стартовать/зависнуть — выход только обесточиванием,
+плата после этого грузит normal Android (recovery грузится лишь по команде 'recovery' / misc BCB); (3) если misc получит
+`boot-recovery` (штатно пишет только recovery/Android), LK будет циклически грузить recovery → выход через EDL.
+
+---
+
+# Сессия 4 — подготовка lk2nd для recovery (preflight 4–5). ЗАПИСЬ НЕ ВЫПОЛНЯЛАСЬ.
+Плата в EDL 05c6:9008, в Sahara/Firehose ничего не отправлялось.
+
+## Сборка (`lk2nd-build/BUILD.md`)
+lk2nd **23.1** (`e9c8b217…`), цель `lk2nd-msm8916`, QCDT только `msm8916-512mb-mtp.dtb`, `LK2ND_FORCE_FASTBOOT=1`.
+
+Проверено по исходникам 23.1 (не по памяти):
+- `ABOOT_STANDALONE ?= 1` (lk2nd/project/base.mk) → `read_device_info`/`write_device_info` не вызываются (aboot.c:5515),
+  `emmc_recovery_init` (единственный путь записи в misc при старте) пропущен (aboot.c:5662), `check_format_bit` пропущен.
+- В модулях `lk2nd/` нет ни одного `mmc_write`/`partition_write`/`mmc_erase`. Запись в eMMC возможна только по явной fastboot-команде.
+- `LK2ND_FORCE_FASTBOOT=1` → всегда меню fastboot, никакой автозагрузки boot+512k/extlinux.
+- UART: `target/msm8916/init.c:98 uart_dm_init(2, 0, BLSP1_UART1_BASE=0x78B0000)`; `platform/msm8916/gpio.c`: GPIO4 out / GPIO5 in, func 2
+  → та же консоль, что stock (serial@78b0000, 115200).
+- Самоперемещение: `arch/arm/crt0.S:110–128` — копирует себя с адреса загрузки (0x80008000) на линк-адрес 0x8F600000.
+
+## Образ
+| поле | lk2nd (`recovery-lk2nd-16MiB.img`) | stock recovery | комментарий |
+|---|---|---|---|
+| magic | ANDROID! | ANDROID! | = |
+| page_size | 2048 | 2048 | = |
+| kernel_addr | 0x80008000 | 0x80008000 | = |
+| ramdisk_addr | 0x81000000 | 0x81000000 | = (stock LK всё равно кладёт на 0x82000000 — видно в UART) |
+| tags_addr | 0x80000100 | 0x80000100 | = (LK кладёт DT на 0x81e00000) |
+| second | 0 | 0 | = |
+| kernel_size | 0x44de0 (lk.bin, 282080 B) | 0x624c90 (zImage) | lk2nd = «ядро» для stock LK |
+| ramdisk_size | 1 | 0x1057a5 | lk2nd кладёт 1-байтовый ramdisk-заглушку |
+| dt_size | 0x1000, QCDT v2, 1 запись | 0x46800, QCDT v2, 8 записей | см. ниже |
+| QCDT entry | 0xce / 0x8 / 0x100 / 0x0 | entry1 = 0xce / 0x8 / 0x100 / 0x0 | **идентична записи, которую stock LK выбирает на Aurora** (UART `206/00000000/0x00000008/256`) |
+| DTB | msm-id <206 0>, board-id <8 0x100> | то же | |
+| cmdline | `lk2nd` | console=ttyHSL0… | stock LK дописывает свои androidboot.* как для stock |
+| image_end | 0x47000 (+16 B `SEANDROIDENFORCE`) | 0x771800 | 290832 B ≪ 16 MiB |
+Файл для записи = lk2nd.img + нули до 16 777 216 B (весь раздел детерминирован → побайтная сверка readback).
+Узлы устройств lk2nd в этом DTB не совпадут с cmdline Aurora (`st7735s_wx144_128x128` ≠ `st7735s_128128`) → generic, без чужих GPIO.
+
+## Сессия 4b — ЗАПИСЬ lk2nd в recovery (одобрено пользователем: только шаги 0→A→B→C)
+Логи: `logs/lk2nd-write/00-printgpt.log, 01-write.log, 02-readback.log`.
+- 0 printgpt (20:30): Sahara serial 0x<SAHARA_SERIAL> (Aurora), loader 53f19350… принят; `recovery: Offset 0x4918c000 (= LBA 2395232), Length 0x1000000`. OK.
+- A write (20:30:47–20:30:53): `edl w recovery lk2nd/recovery-lk2nd-16MiB.img` → `Wrote … to sector 2395232.` rc=0.
+- B readback: `edl r recovery …/recovery-after-lk2nd-write.bin` → `Dumped sector 2395232 with sector count 32768`. rc=0.
+- C: оба sha256 = `0dfa60a03a742ab2bf9f6e91e3887142cb7a0af2dd37c6373f7942703cd011e1`, размер 16777216, `cmp` без различий → **READBACK_MATCH**.
+- Сообщения Firehose (те же, что при чтении на JZ02/Aurora, безвредные): `Host's payload to target size is too large`,
+  `logbuf@0x0801D0A0 fh@0x08019F08`, `Sector size in XML 4096 does not match disk sector size 512`.
+- **Firehose WRITE на Aurora: подтверждён** (один раздел, побайтная сверка).
+- Больше ничего не выполнялось: ни reset, ни reboot, ни misc, ни другие разделы. Плата осталась в EDL (firehose загружен).
+
+## Адрес ramdisk 0x82000000 vs 0x81000000 в заголовке
+- Заголовки stock boot и stock recovery: ramdisk 0x81000000, tags 0x80000100. UART stock LK для обоих: ramdisk @0x82000000,
+  tags/DT @0x81e00000, kernel @0x80008000 → LK **игнорирует адреса из заголовка** и подставляет свои фиксированные.
+- Это механизм CAF LK `ABOOT_IGNORE_BOOT_HEADER_ADDRS` → `update_ker_tags_rdisk_addr()` (app/aboot/aboot.c:397–406, в lk2nd-исходниках):
+  `hdr->ramdisk_addr = ABOOT_FORCE_RAMDISK_ADDR; hdr->tags_addr = ABOOT_FORCE_TAGS_ADDR`. Смещения +0x02000000 / +0x01e00000
+  от базы 0x80000000 те же, что у msm8226/msm8974 в project/*.mk. Значения для msm8916 в stock-бинарнике не извлекались
+  — вывод по поведению (UART), а не по коду aboot Aurora.
+- Вывод: runtime-переопределение со стороны LK; к lk2nd-образу применяется так же (одинаковый header layout). Не блокер.
+
+## Сессия 5 — первый boot-test lk2nd (20:33–20:36) — PASS
+UART: `logs/uart/preflight-recovery-20260929-201150.log` (до 20:33:43: charger-boot + начало normal boot) и
+`logs/uart/lk2nd-boottest-20260929-203353.log` (дальше). Разрыв ~10 с (перезапуск логгера) пришёлся на kernel 0.6–12.9 с normal boot.
+fastboot: `logs/lk2nd-write/boottest-fastboot.txt`.
+
+- После обесточивания плата сначала поднялась в **charger mode** (20:33:24, `charger` в логе, `Failed to locate modem.mdt` — ожидаемо),
+  затем перезапуск в normal Android (20:33:39).
+- Normal Android: PASS — adb OK, `sys.boot_completed=1`, `subsys modem ONLINE`, `wcnss ONLINE`, rmt_storage/qmuxd/netmgrd/ril-daemon/wcnss-service running
+  (SIM ABSENT — SIM не вставлена).
+- `adb reboot recovery` (20:34:55): kernel `Restarting system with command 'recovery'` → SBL1 → stock LK
+  `pon_reason is 145 cold_boot:0`, DTB `206/00000000/0x00000008/256` (запись из lk2nd QCDT),
+  `cmdline: lk2nd androidboot.emmc=true androidboot.serialno=<EMMC_SERIAL> gpt androidboot.baseband=msm mdss_mdp.panel=1:spi:0:qcom,mdss_spi_st7735s_wx144_128x128_cmd`,
+  `booting linux @ 0x80008000, ramdisk @ 0x82000000 (1), tags/device tree @ 0x81e00000` → **stock LK принял lk2nd**.
+- lk2nd (через ~0.2 с): `Android Bootloader - UART_DM Initialized!!!`, `welcome to lk`, `MMC card: H4G2a … 3909091328 bytes`,
+  `Command line from previous bootloader: lk2nd …`, `Failed to find matching lk2nd device node: -1` (ожидаемо: generic),
+  `No continuous splash: MDP GDSC is not enabled` (дисплей не нужен), `Fastboot mode was forced with compile-time…`,
+  `USB init`, `udc_start()`, `fastboot: processing commands` (~0.57 с от старта lk2nd).
+- USB: 18d1:d00d, iManufacturer Google, iProduct Android, iSerial <EMMC_SERIAL> (тот же VID:PID, что stock LK fastboot — различать по getvar product).
+- fastboot: `devices` → <EMMC_SERIAL>; `getvar version` → 0.5; `getvar product` → **lk2nd-msm8916**; `getvar all`: lk2nd:version 23.1,
+  variant MTP eMMC, unlocked yes, secure no, max-download-size 0x10000000 (256 MiB), hw-revision 10000,
+  lk2nd:panel qcom,mdss_spi_st7735s_wx144_128x128_cmd, wifimac <MAC>, полная таблица разделов = GPT.
+- Стабильность: >60 с в fastboot, USB на месте, в UART только `STALL GET_DESCRIPTOR` (хост опрашивает BOS/qualifier — безвредно).
+
+### ВАЖНО: lk2nd считает, что живёт в `boot`, а не в `recovery`
+Сборка по умолчанию `LK2ND_PARTITION_BASE ?= boot` (lk2nd/project/lk2nd.mk:16): getvar показывает виртуальный раздел
+`lk2nd` = первые 512 KiB **boot** и `boot` = 0xf80000 (со смещением 512 KiB). Для Aurora это неверно (lk2nd в recovery).
+Последствия при будущих командах записи через lk2nd:
+- `fastboot flash lk2nd …` перезапишет **начало stock boot** (ядро Android) — ЗАПРЕЩЕНО;
+- `fastboot flash boot …` запишет в boot со смещением 512 KiB — ломает stock boot — ЗАПРЕЩЕНО.
+- `fastboot boot`, `getvar`, `download` — не затрагиваются.
+Если когда-нибудь понадобятся записи через lk2nd — сначала пересобрать с `LK2ND_PARTITION_BASE=recovery` (отдельное решение, новая запись recovery).
+
+---
+
+# Сессия 6 — первый Linux RAM boot через lk2nd (2026-09-29 22:00) — FAIL до передачи управления ядру
+Записей в eMMC: нет. lk2nd/recovery не менялись.
+
+## Что собрано (всё в `linux/`)
+- Ядро: Linux **7.2.7** stable (`f42acb3678424d1e08f6ed27c0d8ba8a125e14d6`, git.kernel.org stable, тот же коммит, что база JZ02),
+  чистый `git archive` (без правок JZ02) → `linux/src`; сборка на локальном диске `/home/q/aurora-kbuild` (virtiofs даёт clock skew).
+- Config: arm64 `defconfig` + `linux/aurora-ramboot1-v2.config` (только ARCH_QCOM, без драйверов чужих SoC, без btrfs/xfs/nfs/netfilter/ftrace,
+  MODULES=n) → `artifacts/ramboot1/kernel.config`. Первая сборка (defconfig почти целиком) дала image_size 33.6 MiB — отброшена:
+  lk2nd кладёт ARM64-ядро на 0x80000000, DTB на 0x81E00000, ramdisk на 0x82000000 (platform/msm8916 iomap.h ABOOT_FORCE_*),
+  т.е. image_size обязан быть < 30 MiB. v2: image_size **22.31 MiB** (конец 0x81650000).
+- DTS `linux/dts/msm8916-jz08-aurora.dts` (+`build-dtb.sh`, out-of-tree cpp+dtc): `#include "msm8916.dtsi"`, model "JZ08AU Aurora (RAM boot 1)",
+  serial0=&blsp_uart2 (serial@78b0000, pinctrl blsp_uart2_console_default GPIO4/5), stdout-path serial0:115200n8;
+  явно disabled: sdhc_1 (eMMC), sdhc_2, usb, mpss, bam_dmux, bam_dmux_dma, wcnss. Проверено fdtget.
+- initramfs: Debian trixie `busybox-static 1:1.37.0-6+b9 arm64` (deb sha256 c833be48… = Packages index), `gen_init_cpio`
+  (/dev/console, /dev/null), `/init` — proc/sys/devtmpfs, диагностика, бесконечный цикл shell. Без блочных устройств/сети/firmware.
+- Образ: Android boot v0, kernel = Image.gz + appended DTB (lk2nd: «Only one appended non-skales DTB, select it»),
+  ramdisk = initramfs.cpio.gz, page 2048, cmdline `earlycon console=ttyMSM0,115200n8 ignore_loglevel loglevel=8 rdinit=/init`
+  (ttyMSM / msm_serial_dm — из drivers/tty/serial/msm_serial.c).
+  `artifacts/ramboot1/aurora-ramboot1.img` 9549824 B, sha256 `470ce4f82864600c5bed7e1791a38e84a802dc2cac7d43d15439f593b9e15347` (все хэши — SHA256SUMS).
+
+## Результат (`logs/uart/ramboot1-20260929-215954.log`, `logs/uart/ramboot1-fastboot.txt`)
+- fastboot: `Sending 'boot.img' (9326 KB) OKAY`, `Booting OKAY`.
+- lk2nd: `decompressing kernel image: done` → `qcom,msm-id entry not found` → `Only one appended non-skales DTB, select it` →
+  `kaslr-Seed is added` → **`Cannot boot ARM64 with old SCM calling convention`** → `booting linux @ 0x80000000, ramdisk @ 0x82000000 (1016607),
+  tags/device tree @ 0x81e00000` → `Jumping to kernel via monitor` → `Failed to jump to kernel` → `ASSERT FAILED at (platform/msm_shared/scm.c:1085)`
+  → каскад data abort (alignment fault) внутри lk2nd → ~18 с → сброс SoC → SBL1 → stock LK (Warm) → normal Android (22:00:24), adb/diag 05c6:9091.
+- **Linux не получил управление ни на одну инструкцию** (нет ни earlycon, ни `Booting Linux on physical CPU` от 7.2.7).
+
+## Причина (доказано по исходникам lk2nd 23.1)
+- `lk2nd/smp/spin-table/spin-table.c:54`: если `!is_scm_armv8_support()` и ядро ARM64 → «Cannot boot ARM64 with old SCM calling convention».
+- `platform/msm_shared/scm.c` (~1060–1085): переход 32→64 делается SCM-вызовом `SCM_SVC_MILESTONE_32_64`; со старым (ARMv7) SCM TZ
+  вызов возвращается → `ASSERT(0)`.
+- Stock TZ Aurora = TZ.BF.2.2-2.2.0026 (ELF идентичен JZ02 stock): только legacy SCM, без ARMv8 SMC/PSCI → **ARM64 невозможен на stock TZ/HYP**.
+- Это не ошибка DTS/ядра/образа/адресов. Аналогично JZ02/UZ801: там ARM64 стал возможен только после замены hyp (qhypstub) и aboot (lk1st)
+  [и/или TZ от DB410c] — т.е. записей в bootchain.
+
+## Варианты (решение за пользователем)
+A. **ARM32 mainline** (без записей): тот же DTS, ядро `ARCH=arm` (multi_v7 + ARCH_QCOM/msm8916). lk2nd содержит A32 spin-table
+   (`spin_code_a32`) именно для SMP на старом TZ. Минусы: 32-bit userspace (Alpine armv7), расхождение с JZ02 (arm64).
+B. **Замена hyp → qhypstub** (+ возможно TZ → DB410c, + aboot → lk1st) через EDL — даёт ARM64 и PSCI, как у JZ02/UZ801.
+   Это записи в bootchain (hyp/tz/aboot): высокий риск; откат только через EDL; отдельный preflight.
+
+---
+
+# Сессия 7 — preflight миграции bootchain на ARM64 (2026-09-30). НИЧЕГО НЕ ЗАПИСАНО.
+Документы: `bootchain-migration/PREFLIGHT.md` (анализ, варианты, неопределённости), `bootchain-migration/WRITE-PLAN.md` (S0–S4, команды, откаты),
+артефакты + эталоны отката + SHA256SUMS в `bootchain-migration/`.
+Ключевое: одного qhypstub недостаточно (JZ02 S3); нужна пара DB410c TZ.BF.3.0 + qhypstub + правка GPT (TZ 605312 B > 512 KiB) + lk1st.
+Рекомендовано: вариант D (цепочка JZ02, по одной стадии). БЛОКЕР: аппаратный вход в EDL на Aurora не доказан (кандидат — кнопка KEY_F2 = GPIO37,
+тот же пин, что RESET/EDL у JZ02).
+Новый артефакт: lk1st-aurora (lk2nd 23.1 e9c8b217, `lk1st-msm8916 LK2ND_BUNDLE_DTB=msm8916-512mb-mtp.dtb LK2ND_FORCE_FASTBOOT=1`,
+qtestsign 0eef3b5 -v 3 aboot) → aboot-lk1st-aurora.mbn 327244 B (003c484e…), pad1M e4addbf8….
+Aurora GPT candidate: той же правкой (13 байт, записи tz/tzbak), валидатор OK: primary 6e850a5d…, backup 795952a1….
+
+## Сессия 7b — S0: аппаратный вход в EDL (2026-09-29 22:22–22:50). Записей нет, Sahara не трогали.
+- Кнопки (`logs/s0/getevent-keys.txt`): 1 верхняя = KEY_POWER (qpnp_pon/KPDPWR); 2 у USB = KEY_POWER (qpnp_pon); 3 RESET = KEY_F1 (qpnp_pon/**RESIN**).
+  gpio-keys (KEY_F2/GPIO37, KEY_F3/GPIO107) — ни одна физическая кнопка (отличие от JZ02, где RESET = GPIO37).
+- Плата без аккумулятора не стартует от USB (со слов пользователя).
+- Попытки «зажат RESET + подача питания»: **3/3 → 05c6:9008** (устр. 114, 115, 116). UART (`logs/uart/s0-edl-attempt2-20260929-224606.*`):
+  EDL-загрузка = `SBL1, Start … pm_driver_init (batt_voltage=…) … clock_init, Delta` → тишина → 9008. Ни `Image Load`, ни QSEE, ни LK —
+  **в EDL уводит stock SBL1 до загрузки TZ/RPM/HYP/ABOOT**.
+- НО: в попытках 2 и 3 перед EDL-загрузкой была обычная загрузка (SBL1 → LK → ядро 3.10), и EDL наступил только после
+  следующего сброса (~10 с). Источник этого сброса не установлен: stock DT настраивает reset только для POWER (pon_1 s1 10.256 с + s2 2 с, warm),
+  для RESIN (pon_2) reset не настроен. Попытка 2 — сброс вручную пользователем.
+- Вывод: воспроизводимо 3/3, механизм входа (SBL1) не зависит от tz/hyp/aboot, но не доказано, что без работающего ядра Android
+  (т.е. при зависшем aboot/tz) произойдёт тот сброс, после которого SBL1 уходит в EDL. Нужен тест-симуляция без записи.
+## Сессия 7c — S0 simulation (2026-09-29 22:54 – 00:06) — **S0 FAIL**. Записей нет. UART: `logs/uart/s0-testA-20260929-225444.*`
+- Test A #1 (lk2nd fastboot 22:56:57, RESET ~30 с): в 22:57:31 SBL1 → LK → Android (charger mode). EDL нет. Источник сброса не установлен.
+- Test A #2 (lk2nd fastboot 00:01:29, RESET 60 с непрерывно): **сброса нет**, плата осталась в lk2nd → у RESIN нет аппаратного сброса
+  (согласуется со stock DT: reset настроен только для POWER/pon_1).
+- Test C (полное обесточивание, RESET зажат ДО подачи питания, держался ~10 с после): первый SBL1 прошёл полностью
+  (Image Load ×3, QSEE, SBL1 End) → stock LK → Linux 3.10. **EDL нет**.
+- Вывод: зажатый RESET при старте SBL1 **не** переводит в EDL. Все 3 успешных входа в 9008 (попытки 1–3) случились только
+  после загрузки stock Android и последующего сброса → вероятно, SBL1 уходил в download mode по признаку, выставленному stock-ядром
+  (гипотеза, не доказано). Путь зависит от Android → **не является независимым аппаратным recovery path**.
+- Ранее сделанный вывод «SBL1 видит зажатый RESET → EDL» (сессия 7b) — **ОТОЗВАН**.
+- Bootloader writes: NO-GO. Нужен настоящий аппаратный EDL (PBL): кандидат — GPIO37 (KEY_F2 в stock DT, кнопка отсутствует;
+  на JZ02 и UFI-001x GPIO37 = EDL-кнопка) → поиск площадки/посадочного места по фото платы, без замыканий наугад.
+## Сессия 7d — S0 PASS: аппаратный EDL через USB D+ → GND (2026-09-30 00:14–00:16). Записей нет, Sahara не трогали.
+Метод (найден пользователем): аккумулятор подключён → замкнуть USB D+ на GND → подключить USB-C → отпустить → 05c6:9008.
+Выход: обесточивание.
+| # | время | USB | UART |
+|---|---|---|---|
+| 1 | 00:14:05 | 9008 (dev 127) | холодный старт: SBL1, Start → pm_driver_init (batt 4180) → clock_init, Delta → тишина |
+| 2 | 00:15:25 | 9008 (dev 002) | то же |
+| 3 | 00:15:51 | 9008 (dev 006) | то же |
+**3/3.** Без предварительной загрузки Android/LK (единственный SBL1-старт на попытку). Вход выполняет stock **SBL1** (не PBL: SBL1 печатает),
+до загрузки TZ/RPM/HYP/ABOOT (нет Image Load/QSEE). SBL1 в плане миграции не меняется, запись `sbl1` в GPT не меняется →
+путь не зависит от tz/hyp/aboot/Android/ADB. Если PBL не найдёт SBL1 (порча GPT) — PBL уходит в EDL сам (штатное поведение).
+Попытки 1–3 сессии 7b и выводы 7b/7c про RESET — недостоверны (со слов пользователя, часть попыток была загрузкой Android в режим зарядки).
+
+---
+
+# Сессия 8 — S1: aboot ← lk1st-aurora (2026-09-30 00:18–00:22) — **PASS**
+Логи: `logs/bootchain/S1-*`, UART `logs/uart/S1-lk1st-boot-20260930-001922.*`.
+- Pre: вход в EDL через D+→GND; printgpt: Sahara serial 0x<SAHARA_SERIAL>, aboot Offset 0x8100000 (LBA 264192), Length 0x100000; GPT stock (tz 0x80000).
+  sha256: lk1st pad1M e4addbf8…6482, orig-aboot fd1af167…053a (= manifest; копии на 480s и локально), firehose 53f19350….
+- Write: `edl w aboot bootchain-migration/aboot-lk1st-aurora.pad1M` → `Wrote … to sector 264192` (00:18:26).
+  Readback `edl r aboot` → sha256 e4addbf8…6482, cmp OK → **READBACK_MATCH**. Контроль: abootbak, GPT primary/backup — без изменений.
+- Boot (00:20:25, обычное включение): SBL1 (Image Load ×3, `APPSBL Image Loaded`, QSEE, SBL1 End) → `welcome to lk` →
+  `MMC card: H4G2a … 3909091328 bytes` → `Fastboot mode was forced` → USB → `fastboot: processing commands` (~0.55 с).
+- USB 18d1:d00d; fastboot: devices <EMMC_SERIAL>; version 0.5; **product lk1st-msm8916**; lk2nd:version 23.1; variant MTP eMMC; unlocked yes;
+  secure no; max-download-size 0x10000000; boot 0x1000000 (без виртуального раздела lk2nd); tz 0x80000, hyp 0x80000 (stock GPT).
+  Стабильно (~36 с, ответы на все команды, ошибок в UART нет). Заставки нет (ожидаемо).
+- `fastboot oem reboot-edl` (misc.c: reboot_device(EMERGENCY_DLOAD)) → OKAY → 05c6:9008 за ~1 с. PASS.
+- Аппаратный EDL после S1: D+→GND → SBL1 Start → clock_init → тишина → 9008 (00:22:12). PASS.
+- Rollback: не требуется. Stock Android больше не грузится (ожидаемо).
+
+# Сессия 9 — S2: GPT (tz 512K→1M, tzbak → gap) (2026-09-30 00:24–00:26) — записи и проверки PASS
+Логи/readback: `logs/bootchain/S2-*`. Pre: serial 0x<SAHARA_SERIAL>; aboot == lk1st (S1); sbl1 == stock; recovery == lk2nd image; gap 305184..306207 == zeros.
+| part | OLD | NEW |
+|---|---|---|
+| tz | 270336..271359 (1024 sect, 524288 B) | 270336..272383 (2048 sect, 1048576 B) |
+| tzbak | 271360..272383 (1024, 524288 B) | 305184..306207 (1024, 524288 B) — в неразмеченном промежутке 305170..393215 |
+| hyp | 272384..273407 (1024, 524288 B) | без изменений |
+- S2-A `ws 305184 orig-tzbak.bin` → readback c6f7db26…b4af == stock tzbak, cmp OK (GPT в этот момент ещё stock — проверено).
+- S2-B `ws 7634911 aurora-new-gpt-backup-33sectors.bin` → readback 795952a1…e18f, cmp OK.
+- S2-C `ws 0 aurora-new-gpt-primary-34sectors.bin` → readback 6e850a5d…b8b6, cmp OK.
+- S2-D: printgpt: tz Offset 0x8400000 Length 0x100000; tzbak Offset 0x9504000 (=LBA 305184) Length 0x80000; hyp 0x8500000/0x80000;
+  sbl1/aboot/rpm/boot/recovery/DDR/fsg/splash — прежние. Валидатор по readback: hdr/entry CRC OK (обе копии), primary==backup,
+  backup hdr на LBA 7634943, usable 34..7634910, disk GUID тот же, изменены только LBA-поля записей tz и tzbak (GUID/attrs/индексы те же).
+  Содержимое области tz (1 MiB) == stock tz + старый tzbak (не менялось).
+- Переходное состояние безопасно: SBL1 грузит TZ по program headers ELF (stock tz уже содержит 19303 B мусора после image_end и грузится;
+  JZ02 S2 с тем же TZ/SBL1 → lk1st OK).
+- Откат S2: ws 0 orig-gpt-primary-LBA0-33.bin; ws 7634911 orig-gpt-backup-LBA7634911-7634943.bin; ws 305184 orig-gap-LBA305184-306207.bin; rs+cmp.
+- S2 boot (00:26:58, обычное включение): SBL1 → APPSBL Image Loaded → QSEE → SBL1 End → lk1st → forced fastboot (~0.54 с). **PASS.**
+  getvar: product lk1st-msm8916; partition-size tz 0x100000, tzbak 0x80000, hyp 0x80000, aboot 0x100000, sbl1/rpm 0x80000, boot/recovery 0x1000000.
+  `fastboot oem reboot-edl` → OKAY → 05c6:9008. Rollback не требуется.
+- Состояние флеша после S2: sbl1/rpm/hyp stock; aboot = lk1st-aurora; GPT new (tz 1 MiB: stock TZ.BF.2.2 + бывший tzbak; tzbak @305184 = stock tzbak);
+  recovery = lk2nd 23.1; boot/modem/NV/persist — не тронуты.
+
+# Сессия 10 — S3: tz ← DB410c TZ.BF.3.0-00714, hyp ← qhypstub (2026-09-30 00:30–00:33) — **PASS**
+Логи: `logs/bootchain/S3-*`, UART `logs/uart/S3-newchain-boot-20260930-003103.*`.
+- Pre: serial 0x<SAHARA_SERIAL>; tz 0x8400000/0x100000, hyp 0x8500000/0x80000; tz-db410c.pad1M 8481892f…5363, hyp-qhypstub.pad512K 1a963047…4555;
+  rollback orig-tzarea 0284863b… и orig-hyp 340049c1… == срезы full-emmc.bin.
+- A–C `edl w tz tz-db410c.pad1M` → `Wrote … sector 270336`; `r tz` → 8481892f…5363, cmp OK.
+- D–F `edl w hyp hyp-qhypstub.pad512K` → `Wrote … sector 272384`; `r hyp` → 1a963047…4555, cmp OK. (одна EDL-сессия, без перезагрузки между ними)
+- Контроль: GPT primary/backup == S2, aboot == lk1st, tzbak@305184 == stock.
+- Первый boot (00:31:32, обычное включение): SBL1 → Image Load ×3 (строка `QHEE Image Loaded`) → QSEE Execution → SBL1 End →
+  lk1st `welcome to lk` → MMC → forced fastboot → `fastboot: processing commands` (~0.54 с). 0× panic/ASSERT/abort.
+  → DB410c TZ PASS, qhypstub PASS (цепочка дошла до aboot; на stock TZ+qhypstub JZ02 висел), lk1st PASS.
+- fastboot: <EMMC_SERIAL>; version 0.5; product lk1st-msm8916; lk2nd 23.1; tz 0x100000, tzbak 0x80000, hyp 0x80000, aboot 0x100000.
+  SCM/PSCI lk1st при старте не логирует (проверка — при запуске ядра) → подтвердится на ARM64 RAM boot.
+- EDL после S3: `fastboot oem reboot-edl` → 9008 (PASS); аппаратный D+→GND → SBL1 Start → clock_init → тишина → 9008 (00:33:05, PASS).
+- Rollback: не требуется. Состояние флеша: sbl1/rpm stock; tz = DB410c TZ.BF.3.0 (1 MiB); hyp = qhypstub; aboot = lk1st-aurora;
+  GPT new; tzbak@305184 = stock; recovery = lk2nd; boot/modem/NV/persist не тронуты.
+
+# Сессия 11 — ARM64 RAM boot #2 (A/B, тот же образ) — **LEVEL 5 PASS** (2026-09-30 00:36)
+Логи: `logs/uart/ramboot2-arm64-20260930-003530.{log,raw}`, `logs/uart/ramboot2-dmesg.txt` (198 строк), `logs/uart/ramboot2-fastboot.txt`.
+- Образ без изменений: `linux/ramboot1/aurora-ramboot1.img` sha256 470ce4f82864600c5bed7e1791a38e84a802dc2cac7d43d15439f593b9e15347
+  (Linux 7.2.7-aurora-ramboot1 arm64, appended DTB == msm8916-jz08-aurora.dtb, eMMC/SD/USB/MSS/WCNSS/BAM-DMUX disabled, busybox initramfs).
+- Команда: `fastboot boot linux/ramboot1/aurora-ramboot1.img` (lk1st) → Sending OKAY, Booting OKAY.
+- lk1st: decompress OK → «Only one appended non-skales DTB, select it» → `SCM call: 0x84000000 failed with :10000` (пробный вызов, некритично)
+  → **`PSCI v1.0 detected, skipping SMP spin table`** → `booting linux @ 0x80000000 …` → `Jumping to kernel via monitor`.
+  Ошибки «Cannot boot ARM64 with old SCM calling convention» / ASSERT **больше нет** (A/B: разница только в TZ.BF.3.0 + qhypstub).
+- Kernel: `Booting Linux on physical CPU 0x0000000000 [0x410fd030]`, Linux 7.2.7-aurora-ramboot1, `Machine model: JZ08AU Aurora (RAM boot 1)`,
+  earlycon msm_serial_dm0 @0x78b0000; psci: PSCIv1.0 in firmware, SMCCC v1.0, OSI mode; `[Firmware Bug]: failed to set PC mode: -3`
+  (известно для DB410c TZ, работает OSI, CPUidle PSCI OSI инициализирован).
+  GIC: `Root IRQ handler: gic_handle_irq`; arch_timer cp15 19.20 MHz (virt), clocksource arch_sys_counter; arch_mem_timer IRQ растёт.
+  SMP: CPU1–3 booted, 4 CPUs. Memory: 445304K/524288K available (512 MiB, reserved tz-apps/smem/hyp/tz/rmtfs/rfsa по upstream dtsi), MemTotal 482864 kB.
+  console ttyMSM0 enabled; initramfs unpacked; `Run /init` → `=== AURORA RAM BOOT ===` → BusyBox v1.37.0 ash, prompt `~ #`.
+  Блочных устройств нет кроме loop/nbd (eMMC не проявилась — DT disabled). Предупреждений/ошибок в dmesg больше нет.
+- Диагностика из shell (read-only): uname aarch64; model из /proc и /sys; 4 × Cortex-A53 (0xd03); /sys/class/tty: ttyMSM0 (+ttyS0-3 от 8250, не используются).
+- Записей в eMMC: нет.
+
+# Сессия 12 — RAM boot USB1: USB peripheral + NCM (2026-09-30 00:44) — **PASS-7**
+Эталон ramboot1 не изменён (470ce4f8…). Новое: `linux/dts/msm8916-jz08-aurora-usb1.dts` (diff: `linux/ramboot-usb1.dts.diff`),
+`linux/aurora-usb1.config` (дельта конфига: `linux/ramboot-usb1.config.diff`, 23 опции + LOCALVERSION, только добавления),
+`linux/initramfs-usb1/` (diff init: `linux/ramboot-usb1.init.diff`), артефакты `linux/artifacts/ramboot-usb1/` (SHA256SUMS).
+Логи: `logs/uart/usb1-20260930-004405.{log,raw}`, `logs/uart/usb1-dmesg.txt` (223 строки), `logs/uart/usb1-fastboot.txt`.
+- DTS: `#include "msm8916-pm8916.dtsi"` (RPM-регуляторы), `&pm8916_usbin` okay, `&usb` dr_mode="peripheral" + extcon=pm8916_usbin,
+  `&usb_hs_phy` extcon; PHY supplies L7 1.8 V / L13 3.075 V (= stock HSUSB_1p8/3p3), init-seq upstream == stock. eMMC/SD/MSS/WCNSS/BAM-DMUX disabled.
+- Kernel 7.2.7-aurora-usb1: USB_SUPPORT, USB_GADGET, USB_CHIPIDEA(+UDC, MSM glue), PHY_QCOM_USB_HS, EXTCON_QCOM_SPMI_MISC, USB_CONFIGFS(+NCM); USB host = n; MODULES=n.
+  Image image_size 0x1670000 (22.44 MiB, end 0x81670000 < DTB 0x81E00000). Image.gz e09d7e81…, DTB 998dcfd4…, initramfs efd2a3f0… (1017243 B),
+  **aurora-usb1.img 7735d3df9c17b142786ac83d8ed382b2308f11d32ca38b51603237cedde89eb7** (9629696 B).
+- Boot: из RAM-shell ramboot1 `reboot -f` → SBL1 → lk1st fastboot → `fastboot boot linux/ramboot-usb1/aurora-usb1.img` (OKAY/OKAY) →
+  PSCI v1.0 → Linux 7.2.7-aurora-usb1, model «JZ08AU Aurora (RAM boot USB1)».
+- USB: msm_hsusb 78d9000.usb (ChipIdea) + qcom usb-hs-phy; UDC **ci_hdrc.0**, state `configured`; gadget configfs `aurora`,
+  NCM ifname **usb0** (dev <MAC>, host <MAC>), 172.16.42.1/24 static.
+- Host (480s): lsusb **18d1:d001** «Aurora / Aurora RAM Boot / <EMMC_SERIAL>» (dev-only IDs, как JZ02), класс CDC NCM; интерфейс **enp0s20f0u2**
+  (driver cdc_ncm), NM-профиль jz02-ncm применился автоматически: 172.16.42.2/24.
+- Ping: host→Aurora 5/5, 0% loss, avg 2.19 ms; Aurora→host 5/5, 0% loss, avg 2.24 ms.
+- Предупреждения: `Fixed dependency cycle(s)` usb↔phy (то же на JZ02, штатно); `msm_hsusb: Failed to create device link (0x180) with supplier remoteproc`
+  (fw_devlink к отключённому remoteproc; USB работает); psci «failed to set PC mode: -3» (как раньше). Ошибок нет.
+- eMMC: отсутствует (0 строк mmc/sdhci, /sys/block только loop/nbd). SSH: не делался (в Debian busybox нет dropbear; есть telnetd — не включён).
+- Записей в eMMC: нет.
+
+# Сессия 13 — RAM boot EMMC1: eMMC READ-ONLY (2026-09-30 00:50) — **PASS-9**
+Эталоны не изменены (ramboot1 470ce4f8…, ramboot-usb1 7735d3df…). Новое: `linux/dts/msm8916-jz08-aurora-emmc1.dts` (diff `linux/ramboot-emmc1.dts.diff`),
+`linux/aurora-emmc1.config` (дельта = НЕТ: MMC/MMC_BLOCK/SDHCI/SDHCI_PLTFM/SDHCI_MSM/EFI_PARTITION уже =y), `linux/initramfs-emmc1/` (diff `linux/ramboot-emmc1.init.diff`),
+`linux/artifacts/ramboot-emmc1/` — ядро **байт-в-байт usb1** (Image.gz e09d7e81…), DTB 23f6464f…, initramfs ff3c202c…, **aurora-emmc1.img 93f61ce7…f8e9f** (9631744 B).
+Логи: `logs/uart/emmc1-20260930-005048.{log,raw}`, `logs/uart/emmc1-fastboot.txt`.
+- DTS: `&sdhc_1` okay (+alias mmc0); из upstream: bus-width 8, non-removable, mmc-ddr-1_8v, sdc1 pinctrl; vmmc=pm8916_l8 2.9 V, vqmmc=pm8916_l5 1.8 V (= stock L8/L5).
+  sdhc_2 (SD), MSS, WCNSS, BAM-DMUX — disabled; USB/UART — как usb1.
+- init: RO **первым делом** (до USB): ждёт /dev/mmcblk0 → blockdev --setro на mmcblk0, p1..p27, boot0/1 → getro всем → `EMMC-RO-SUMMARY devices=30 all_ro=YES`
+  (t≈1.86 s). Затем USB; отчёт по диску только при RO=OK. Нет mount/fsck/mkfs/trim/swap для mmcblk*.
+- Probe: `mmc0: SDHCI controller on 7824900.mmc using ADMA`; `new HS200 MMC card at address 0001`; `mmcblk0: mmc0:0001 H4G2a 3.64 GiB`;
+  p1..p27; mmcblk0boot0/1 4 MiB; mmcblk0rpmb (chardev). **Режим: HS200, 8 bit, 1.8 V, 177.78 MHz** (debugfs ios) — НЕ DDR52: sdhci-msm включил HS200 по caps
+  контроллера, хотя в DTS нет mmc-hs200-1_8v (ранее заявленное «DDR52 conservative» — неверно). `Card appears overclocked; req 177770000, actual 177777777 Hz`
+  = округление GCC (+7777 Hz). CRC/tuning/timeout/I/O error: нет.
+- Карта: name H4G2a, manfid 0x90, oemid 0x14a, CID <EMMC_CID> (== Android sysfs), serial 0x<EMMC_SERIAL>, 7634944 × 512 = 3909091328 B.
+- GPT глазами Linux == S2 GPT по всем 27 разделам (номер/start/size), все ro=1. tz p8 0x8400000/0x100000; tzbak p9 0x9504000/0x80000; hyp p10 0x8500000/0x80000;
+  sbl1 p2 0x8000000/0x80000; aboot p4 0x8100000/0x100000; modem p1 0x4000000/0x4000000; boot p22 0xc18c000/0x1000000; recovery p26 0x4918c000/0x1000000;
+  userdata p27 0x4a18c000/0x9ee6fe00.
+- SHA256 через mainline MMC == эталоны Firehose: sbl1 6a661ec9 (stock), rpm 5a9b857b (stock), DDR c3502047 (stock), sec 3b1cae78 (stock),
+  aboot e4addbf8 (lk1st S1), hyp 1a963047 (qhypstub S3), tz 8481892f (DB410c S3), tzbak c6f7db26 (stock tzbak S2). 8/8 MATCH.
+  (Вывод DDR/sec в первом прогоне потерялся на UART; повтор через файл /tmp — rc=0, совпадение.)
+- USB NCM: без регрессий — 18d1:d001, enp0s20f0u2 (jz02-ncm), ping host→Aurora 5/5 (avg 2.68 ms), Aurora→host 5/5 (avg 2.29 ms).
+- Записи: /sys/block/mmcblk0/stat: writes completed 0, sectors written 0 (reads 45 / 8616 sectors). **ZERO writes.**
+- Предупреждения: overclocked (выше); `l13: voltage operation not allowed` (было и в usb1; PHY vs фиксированный L13); `gcc … sync_state() pending due to 7824900.mmc` (информационное).
+- UART-канал теряет куски вывода при всплесках → для данных писать в /tmp и выводить отдельно (или по NCM).
+
+## Сессия 13b — software poweroff из RAM-Linux (2026-09-30 01:00) — **НЕ работает (перезапуск)**
+- Пути в ядре: PSCI SYSTEM_OFF (`pm_power_off = psci_sys_poweroff`, psci-1.0 от DB410c TZ) и `qcom,pshold` (POWER_RESET_MSM, PS_HOLD low);
+  результат зависит от PS_HOLD-конфигурации PM8916 (задаётся загрузчиком) и от VBUS (при USB PMIC может снова включиться).
+- Busybox `poweroff` без -f шлёт сигнал PID 1 (у нас PID 1 = shell-скрипт) → использовать только `sync; poweroff -f` (прямой reboot(POWER_OFF)).
+- Тест (USB + аккумулятор подключены): `sync; poweroff -f` → через ~0.4 с `SBL1, Start` → QHEE/APPSBL/QSEE → lk1st fastboot 18d1:d00d; NCM исчез.
+  Т.е. SoC сбрасывается и сразу грузится заново. Причина (PS_HOLD=reset vs повторное включение по VBUS) не установлена.
+- lk1st fastboot: команды выключения нет (oem: dtb, log, reboot-edl, hash, screenshot).
+- Безопасное выключение сейчас = ручное обесточивание (USB, затем аккумулятор). Безопасно в любой момент: rootfs в RAM, eMMC RO/не используется,
+  в lk1st fastboot записей нет.
+- Возможная будущая проверка (не выполнялась): при отключённом USB подать `sync; poweroff -f` через UART и смотреть, стартует ли SBL1.
+
+# Сессия 14 — B1 (modem FAT RO) + B2 (rmtfs -r + MPSS) (2026-09-30 01:10–01:16) — **PASS-11**. SIM T2 установлена, не использовалась.
+Эталоны ramboot1/usb1/emmc1 не изменены. Новое: `linux/dts/msm8916-jz08-aurora-modem1.dts` (diff `linux/ramboot-modem1.dts.diff`),
+`linux/aurora-modem1.config` (diff `linux/ramboot-modem1.config.diff`), `linux/initramfs-modem1/` (diff init `linux/ramboot-modem1.init.diff`,
+`root/bin/modem-up`, `root/bin/nv-check`, пакеты Alpine в `dl/` + APK-SHA256SUMS), `linux/artifacts/ramboot-modem1/`
+(Image.gz 95596fb9…, DTB 4269cf0b…, initramfs 010837f4…, **aurora-modem1.img 10745c98…7802**, 10133504 B).
+Логи: `logs/uart/modem1-20260930-011037.*`, `logs/modem1/*` (файлы с платы получены по NCM через `nc -l` → `ncat --recv-only`; UART теряет вывод).
+- Kernel delta vs usb1/emmc1: +REMOTEPROC, REMOTEPROC_CDEV, QCOM_Q6V5_MSS, QCOM_SYSMON (+ select: MDT_LOADER, PIL_INFO, Q6V5_COMMON, RPROC_COMMON, DEV_COREDUMP).
+  BAM_DMUX, WWAN, WCNSS_PIL — off. image_size 22.50 MiB.
+- DTS delta vs emmc1: &mpss okay (+pinctrl sim_ctrl: gpio1 high, gpio20/22/23 low — как stock Aurora gpio-leds/Android runtime); &mpss_mem reg 0x86800000/0x4e00000
+  (= stock modem_adsp_region 78 MiB; Aurora modem.mdt span 0x86800000..0x8b300000 = stock PIL log); &mba_mem okay (dyn 1 MiB → 0x8e700000).
+  wcnss, bam_dmux, bam_dmux_dma, sdhc_2 — disabled.
+- rmtfs: Alpine v3.24 `rmtfs 1.3-r0` (+qrtr-libs 1.2-r1, eudev-libs 3.2.14-r6, musl 1.2.6-r2); APKINDEX C: == JZ02 installed; бинарники == JZ02 (sha256).
+  Исходник v1.3 (b30a3eb3): `-r` → storage_read_only: open O_RDONLY → RAM shadow; pwrite → RAM; sync no-op; O_RDWR только без -r. `-P` by-partlabel, `-s` rproc sync.
+  Команда: `rmtfs -r -P -s -v` (только через /bin/modem-up, который сперва проверяет getro=1 для modemst1/2/fsc/fsg и ro у /firmware).
+  Драйвер q6v5-mss: auto_boot=false → MSS стартует только по rmtfs -s.
+B1: RO всем 30 устройствам (t≈1.9 s) → stat до B1: 0 writes → nv_snapshot before → modem по PARTLABEL = mmcblk0p1 (ro=1) →
+  `vfat ro,nosuid,nodev,noexec,relatime,…,shortname=lower,errors=remount-ro` на /firmware → 53 файла, **53/53 == Aurora reference** (firmware-fat-compare.tsv);
+  modem.mdt aabbf109…, mba.mbn ac123b42…, modem.b18 d901d526… — Aurora (≠ JZ02). firmware_class.path=/firmware/image. B1_OK=1.
+B2 (`/bin/modem-up` в t=109 s): `powering up 4080000.remoteproc` → `Booting fw image mba.mbn, size 234176` → `MBA booted without debug policy, loading mpss`
+  → `remote processor 4080000.remoteproc is now up` (+0.6 s). remoteproc0 **running** и через 77 s; нет fatal/crash/SSR/wdog.
+  rmtfs жив; /tmp/rmtfs.log содержит только «registering services» (stdout буферизован при перенаправлении в файл — остальное в буфере);
+  косвенно: VmData rmtfs 4656 kB ≈ shadow modemst1+modemst2+fsg+fsc (открываются только по запросу модема); fd: /dev/qcom_rmtfs_mem1 (RAM), сокет QRTR, без mmcblk.
+- NV: modemst1 637a71d1…, modemst2 9bb10190…, fsg b0a3b7e4…, fsc 5f70bf18…, persist ee48a843… — **BEFORE == AFTER**.
+- eMMC: /sys/block/mmcblk0/stat writes_completed 0, sectors_written 0 (reads 1048 / 258860 sectors — хэши + rmtfs shadow).
+- USB NCM: 18d1:d001, ping host→Aurora 5/5 (2.27 ms), Aurora→host 5/5 (2.31 ms).
+- Warnings: `qcom-smsm: mbox_request_channel: can't parse "mboxes"` ×3 (upstream smsm без mboxes, информационно), `remoteproc0: releasing` ×4 (probe deferral),
+  fw_devlink/l13/overclock — как раньше.
+- SIM T2: интерфейсов для неё нет (QMI/WWAN/BAM-DMUX не включены, /dev: rpmsg_ctrl0/1, qrtr-tun, qcom_rmtfs_mem1). К SIM и модему никаких запросов не делалось.
+
+# Сессия 15 — B3: QMI control plane + SIM detect + passive NAS (2026-09-30 01:29–01:36) — **PASS-11**
+Эталоны ramboot1/usb1/emmc1/modem1 не изменены. Новое: `linux/patches/rpmsg_wwan_ctrl-port-race.patch` (из JZ02, sha256 7355d729…),
+`linux/aurora-qmi1.config` (diff `linux/ramboot-qmi1.config.diff`), DTS qmi1 (diff `linux/ramboot-qmi1.dts.diff`: только model),
+`linux/initramfs-qmi1/` (Alpine qmi-utils/libqmi 1.38.0_git20260414-r0 + closure в `dl/` + APK-SHA256SUMS; `src/linebuf.c`; `root/bin/qmi-b3`;
+modem-up diff `linux/ramboot-qmi1.modem-up.diff`), `linux/artifacts/ramboot-qmi1/` (Image.gz faf71c53…, DTB af75e4e3…, initramfs 59e4c52c…,
+**aurora-qmi1.img dae591e1…9652**). Логи: `logs/uart/qmi1-20260930-012917.*`, `logs/qmi1/*` (b3.txt с маскированными ICCID/IMSI).
+- JZ02 race patch: `JZ02V30-UFI-@/openrc/rpmsg_wwan_ctrl-port-race.patch` (7355d729…). Исправляет NULL deref в wwan_port_rx ← rpmsg_wwan_ctrl_callback
+  ← rpmsg_wwan_ctrl_probe (JZ02 panic 2026-09-26: порт открыт до возврата wwan_create_port, rpwwan->wwan_port ещё NULL) — присваивает wwan_port в
+  rpmsg_wwan_ctrl_start() до rpmsg_create_ept(). Код Aurora 7.2.7 идентичен контексту → **применён** (patch -p1 чисто) в /home/q/aurora-kbuild/src.
+  (Примечание: в заметках JZ02 отдельно фигурирует ещё bam-dmux runtime-PM race — не относится к B3, BAM-DMUX выключен.)
+- Kernel delta vs modem1: +WWAN, +RPMSG_WWAN_CTRL (+WWAN_DEBUGFS по умолчанию). BAM_DMUX off, USB qmi_wwan не включался (USB host off).
+- Ошибка по ходу: первый образ qmi1 (cd4c9d98…) — /bin/modem-up без +x (потерян при sed>mv) → «Permission denied», MPSS не стартовал; исправлено (dae591e1…).
+- rmtfs: та же команда `rmtfs -r -P -s -v`, только `LD_PRELOAD=/usr/lib/linebuf.so` (setvbuf(stdout,_IOLBF) — механизм stdbuf; linebuf.so bac4480a…).
+  Лог теперь построчно: open /boot/modem_fs1/fs2/fsg/fsc, alloc 917504 => 0x86700000, iovec … read; **write = 0** (даже в RAM-shadow).
+- MPSS: t=39.54 powering up → mba.mbn 234176 → MBA booted → 40.13 is now up → 40.74 wwan0at0, wwan0at1, 40.92 **wwan0qmi0** attached. Паники нет.
+  rpmsg: DATA5_CNTL/DATA1/DATA4 → rpmsg_wwan_ctrl; IPCRTR → qcom_smd_qrtr; sys_mon → qcom_sysmon; прочие DATA*/DIAG*/apr* без драйвера.
+- qmicli 1.39.0 (Alpine libqmi 1.38.0_git20260414-r0 == JZ02), `qmicli -p -d /dev/wwan0qmi0`, только get-запросы (`/bin/qmi-b3`):
+  DMS operating mode **'shutting-down'** (HW restricted no; как JZ02 S7 до ручного online); revision MPSS.DPM.1.0.c7-00193-M8916EAAAANVZM-1;
+  DMS UIM state initialization-completed; UIM card status: slot 1 **present**, USIM app **ready**, personalization ready, **PIN1 disabled** (3/10), PIN2 enabled-not-verified;
+  slot 2 no-atr (нет второй SIM); ICCID <REDACTED>; IMSI <REDACTED> (MCC/MNC 250-20 = T2).
+  NAS: home-network NotProvisioned; serving system not-registered-searching, CS/PS detached, RAT none; system-info GSM/WCDMA/LTE status none;
+  signal-info InformationUnavailable; system selection pref (READ): mode 'lte', LTE bands 1,3,5,7,8,20,40, network selection automatic, ps-only, roaming any.
+  → модем не зарегистрирован (радио фактически выключено режимом shutting-down/low-power). Режим НЕ менялся.
+- MPSS после запросов: running (uptime 116 s). qmi-proxy запущен (qmicli -p).
+- NV: modemst1 637a71d1…, modemst2 9bb10190…, fsg b0a3b7e4…, fsc 5f70bf18…, persist ee48a843… — BEFORE == AFTER (и == B2).
+- eMMC stat: writes_completed 0, sectors_written 0. USB NCM: ping 5/5 в обе стороны (~2.2 ms). BAM-DMUX: disabled весь B3.
+
+# Сессия 16 — B4a: DMS online + пассивное наблюдение (2026-09-30 01:50–01:53) — **PASS, автоматическая регистрация T2 LTE**
+Образ без изменений: ramboot-qmi1 (dae591e1…). Сценарий `linux/b4a/b4a.sh` (a200d960…; копия в `logs/b4a/`), результаты `logs/b4a/*`.
+- Ровно одна SET-команда: `qmicli -p -d /dev/wwan0qmi0 --dms-set-operating-mode=online` (t=1195.00) → «Operating mode set successfully», rc=0;
+  GET → Mode 'online', HW restricted 'no'. Больше SET/scan/register/attach/bearer не выполнялось.
+- Шкала (39 циклов по ~3 s, только GET serving-system/system-info/signal-info):
+  +0.1 s not-registered-searching, RAT none → **+3.2 s registered, PS attached, CS detached, RAT lte, PLMN 250-20 't2'**, LTE service available
+  → стабильно до +118.7 s. Автоматическая регистрация модемом (network selection automatic из NV), userspace её не инициировал.
+- Signal LTE: при регистрации RSSI -59 / RSRQ -19 / RSRP -97 dBm / SNR -4.0 dB; в конце RSSI -65 / RSRQ -9 / RSRP -87 dBm / SNR 16.2 dB.
+  cell-location: serving PCI 266 RSRP -90.0 RSRQ -7.5 RSSI -65.4; соседи PCI 491 (intra), 357/123 (inter).
+- RF: LTE, active band **eutran-1 (B1)**, EARFCN 100. Home network (теперь provisioned): MCC 250 MNC 20 'TELE2 RU'. Service domain pref ps-only → CS detached ожидаемо.
+- SIM после: slot1 present, USIM ready, PIN1 disabled. Mode online. MPSS running. Паник/SSR/wdog нет.
+- rmtfs после online: 1 запрос записи — `iovec 1, not forced` / `write 0:1792 0x86700000` (EFS caller 1 = modem_fs2, 1792 сектора) → удержан в RAM-shadow (-r).
+- NV на диске: modemst1/2, fsg, fsc, persist — BEFORE == AFTER. eMMC stat: writes 0, sectors_written 0 (до и после).
+- BAM-DMUX: disabled весь B4a (нет wwan0 netdev, ModemManager не запускался). USB NCM: ping 5/5 в обе стороны (~2.3 ms).
+- Следствие для будущего: с rmtfs -r изменения EFS (запись после регистрации) теряются при перезагрузке — ожидаемо и безопасно.
+
+# Сессия 17 — B4b1: BAM-DMUX kernel bring-up без bearer (2026-09-30 02:01–02:24) — **PASS-11**
+Эталоны не изменены. Новое: `linux/aurora-bam1.config` (diff `linux/ramboot-bam1.config.diff`: +QCOM_BAM_DMUX), DTS bam1 (diff `linux/ramboot-bam1.dts.diff`:
+&bam_dmux + &bam_dmux_dma okay), initramfs == qmi1 (59e4c52c…), `linux/artifacts/ramboot-bam1/` (Image.gz 9c20a372…, DTB a10056c5…,
+**aurora-bam1.img e24c8e5e…8eca**), сценарий `linux/b4b1/b4b1.sh` (6d54ab6c…). Логи: `logs/uart/bam1-20260930-020119.*`, `logs/b4b1/b4b1/*`.
+- JZ02-материалы (тот же Linux 7.2.7): рабочая схема = DT &bam_dmux/&bam_dmux_dma okay (msm8916-ufi.dtsi), probe на старте, отдельного bam-dmux патча нет.
+  Известный риск: трафик через bam-dmux во время остановки MSS → «Failed to resume: -22» (sticky); порядок остановки JZ02 = wwan-quiesce
+  (ip addr flush + link down всех wwan*) ДО остановки rmtfs/MSS. Recovery: unbind/bind /sys/bus/platform/drivers/bam-dmux/{unbind,bind}
+  (устройство 4080000.remoteproc:bam-dmux) по заметкам НЕНАДЁЖЕН; power/control=on и autosuspend_delay_ms=3600000 — лишь смягчение;
+  надёжно — только полное обесточивание. Upstream-фикс «net: wwan: qcom_bam_dmux: fix TX DMA channel use-after-free» (v5, 2026-09-03, Cc stable)
+  в 7.2.7 отсутствует (старый bam_dmux_pc_vote(bool)) и по треду не влит → не бэкпортировался.
+- Код 7.2.7: probe ничего не делает, пока модем не поднимет pc-линию; netdev регистрируются по CMD_OPEN от модема; ndo_open/stop = BAM_DMUX_CMD_OPEN/CLOSE
+  (мультиплексорный канал, не bearer/WDS) + pm_runtime_get_sync.
+- Порядок: eMMC RO → FAT RO → rmtfs -r → MPSS (39 s) → wwan0at0/at1/qmi0 → BAM-DMUX netdev wwan0..wwan7 (DOWN) → mode shutting-down →
+  **одна SET `--dms-set-operating-mode=online`** (как B4a; attempt1 t=95.6) → registered 250-20 't2' LTE PS attached.
+- Попытка 1 сценария упала на моей ошибке (`nets()` затирал глобальный счётчик n → arithmetic error) до up/down; попытка 2 (исправлено) — полный прогон.
+- Runtime PM (device /sys/bus/platform/devices/4080000.remoteproc:bam-dmux, drv bam-dmux, control auto, autosuspend 1000 ms):
+  5 мин наблюдения — 10/10 suspended, active_ms 0; QMI каждые 60 s: online / registered / PS attached, MPSS running.
+- UP/DOWN wwan0 (без IP, без WDS): up rc=0 → UP,LOWER_UP; PM suspended→active (active_ms 0→1010→3267); down rc=0 → PM suspended (active_ms 4530),
+  через 30 s — suspended. «Failed to resume»: 0. «Channel already open»: 0. Паник нет.
+- QMI после: online, SIM present/USIM ready, registered 250-20 't2', PS attached, RSRP -93 RSRQ -13 RSSI -64 SNR 11.6. MPSS running.
+- rmtfs: 1 write (`write 0:1792 0x86700000`, modem_fs2) → RAM shadow (-r). NV BEFORE == AFTER, eMMC writes 0 / sectors 0. USB NCM 5/5 в обе стороны.
+
+# Сессия 18 — B4b2 попытка 1: прямой qmicli data path (2026-09-30 02:29) — **STOP на start-network, bearer НЕ поднят**
+Образ ramboot-bam1 без изменений. Сценарий `linux/b4b2/b4b2.sh` (ab5e7844…), результаты `logs/b4b2/b4b2/*`.
+- Precheck OK: online, registered 250-20, PS attached, LTE, SIM ready, wwan0 DOWN, BAM-DMUX suspended.
+- WDA: `qmicli -p -d /dev/wwan0qmi0 --wda-set-data-format="link-layer-protocol=raw-ip"` → «Successfully set data format … Link layer protocol: 'raw-ip'», rc=0;
+  но `--wda-get-data-format` (следующий запуск qmicli = новый WDA-клиент) → **'802-3'** → raw-ip НЕ подтверждён.
+  **Моя ошибка в сценарии**: проверка grep 'raw-ip' совпала с выводом SET, а не GET → сценарий не остановился после WDA, как требовалось.
+- Bind: `--wds-bind-data-port=a2-mux-rmnet0 --client-no-release-cid` → CID '1', rc=0.
+- Start (единственная попытка): `--client-cid=1 --client-no-release-cid --wds-start-network="apn=internet,ip-type=ipv4"` (auth/user/pass не передавались)
+  → нет ответа, «Operation was cancelled» (~40 s timeout), rc=1; `--wds-noop --client-cid=1` → «InvalidClientId». Повторов не было.
+- **Точное повторение JZ02** (PLAN-B S9): WDA set per-client, GET через новый клиент = 802-3; reused CID → timeout, release → InvalidClientId.
+  Вывод: многошаговый поток «qmicli через qmi-proxy с --client-cid» на этом стеке неработоспособен (CID/WDA-состояние не переживают процесс qmicli).
+  JZ02 данные поднимал только через ModemManager (держит постоянных клиентов в одном процессе).
+- После: WDS packet service 'disconnected'; online; registered; PS attached; SIM ready; wwan0 DOWN без IP; маршруты — только usb0;
+  BAM-DMUX suspended; MPSS running; dmesg: 0 Failed to resume/Oops/panic; rmtfs — новых запросов нет; NV BEFORE==AFTER; eMMC writes 0 / sectors 0.
+
+# Сессия 19 — B4b2 через ModemManager (2026-09-30 02:49–02:57) — bearer CONNECTED, DNS OK, ping по table100 FAIL (не разобрано)
+Образ `linux/artifacts/ramboot-mm1/aurora-mm1.img` 38c960ef… (ядро/DTB = bam1; initramfs + MM 1.25.95_git20260527-r1, libqmi 1.38.0_git, dbus 1.16.2,
+polkit 127, eudev 3.2.14 + **modemmanager-udev** (install_if, сперва пропущен мной → "not candidate")); все пакеты == JZ02 (C: и файлы).
+Сценарии: `initramfs-mm1/root/bin/mm-up`, `b4b2-mm` (9b5df90a…); результаты `logs/b4b2mm/run3/b4b2mm/*`.
+- MM: plugin qcom-soc, primary wwan0qmi0, net wwan0..7, physdev bam-dmux; mm.log: raw-ip / a2-mux-rmnet0 (12 совпадений).
+- `mmcli -m 0 --simple-connect="apn=internet,ip-type=ipv4"` (одна попытка) → connected Bearer/1, rc=0.
+  IPv4 26.224.4.252/29, gw 26.224.4.253, DNS 176.59.95.243, 176.59.95.242, MTU 1430, interface wwan0.
+- DNS через оператора (host-routes в main): nslookup ya.ru → 5.255.255.242 / 77.88.55.242 → **данные через wwan0 проходят**.
+- ping -I <LTE IP> 77.88.8.8/1.1.1.1/8.8.8.8 через table 100 → 100% loss (причина не разобрана: вероятно моя policy-routing схема; счётчики bam-dmux = 0, драйвер их не ведёт).
+- Disconnect: successfully disconnected, connected: no, wwan0 down, BAM-DMUX suspended, MPSS running. Failed to resume: 0.
+- NV BEFORE==AFTER, eMMC writes 0 / sectors 0.
+
+# Сессия 20 — B4b2 retest (SIM T2 с ограничением «только Яндекс»), MM (2026-09-30 05:02–05:05) — **DATA PLANE PASS**; контент блокирует оператор
+Уточнение пользователя: SIM T2 ограничена оператором (только сервисы Яндекса) → 1.1.1.1/8.8.8.8 не критерии; провал ping из сессии 19 не доказывает сбой.
+Образ aurora-mm1.img 38c960ef… без изменений; tcpdump 4.99.6-r1 + libpcap 1.10.7-r0 (Alpine v3.24, sha256 в `logs/b4b2mm2/tcpdump-APK-SHA256SUMS`)
+загружены в RAM (/tmp/td) по NCM. Сценарий `linux/b4b2/b4b2-mm2.sh` (0fd51f71…), результаты `logs/b4b2mm2/b4b2mm2/*` (+ wwan0.pcap).
+- Одна попытка `mmcli -m 0 --simple-connect="apn=internet,ip-type=ipv4"` → connected Bearer/1, rc=0. IPv4 26.221.78.53/30, gw 26.221.78.54,
+  DNS 176.59.95.243/176.59.95.242, MTU 1430, iface wwan0.
+- Маршруты: только /32 через wwan0 в main (77.88.8.8, 77.88.8.1, оба DNS T2, 3 адреса ya.ru); default НЕТ; `ip route get 77.88.8.8` → dev wwan0 src LTE-IP;
+  `ip route get 172.16.42.2` → dev usb0 (management цел).
+- ping 77.88.8.8: 5 echo request ушли в wwan0, 0 reply (ICMP не пропускается оператором).
+- DNS через T2 DNS: nslookup ya.ru → 77.88.55.242, 5.255.255.242, 77.88.44.242 (+AAAA 2a02:6b8::2:242) — ответы получены по wwan0.
+- HTTP http://ya.ru → TCP SYN/SYN-ACK с 77.88.44.242:80 по wwan0, ответ «HTTP/1.1 302 Found, Location: http://internet-block.t2.ru/?p=LOCKB»
+  → оператор перехватывает и отдаёт страницу блокировки (LOCKB). HTTPS https://ya.ru → «Connection reset by peer» (тоже оператор).
+- tcpdump wwan0: всего 42 пакета, TX (src LTE-IP) 26, RX (dst LTE-IP) 14: DNS-ответы, TCP SYN-ACK/данные HTTP. Счётчики netdev bam-dmux = 0 (драйвер не ведёт).
+- BAM-DMUX: active во время трафика (active_ms до ~33 s), после disconnect → suspended. Failed to resume/-110/-22/EAGAIN: 0.
+- Disconnect: `--simple-disconnect` → успешно, connected: no; маршруты/адрес удалены; wwan0 down. После: MM registered, PS attached; QMI registered; MPSS running.
+- rmtfs: новых запросов нет. NV BEFORE==AFTER. eMMC writes 0 / sectors 0. USB NCM работал всё время (результаты получены через него).
+- Вывод: LTE data plane (MM qcom-soc → WDA raw-ip → a2-mux-rmnet0 → WDS → bam-dmux wwan0 → IPv4) работает в обе стороны (UDP+TCP).
+  Доступ к контенту даже ya.ru сейчас заблокирован оператором (редирект internet-block.t2.ru ?p=LOCKB) — вопрос SIM/тарифа, не платы.
+
+# Сессия 21 — Beeline SIM, финальный cellular test (2026-09-30 13:14–13:27) — **STOP: нет регистрации (registration-denied → limited)**
+SIM заменена пользователем на обесточенной плате (T2 → Beeline). Перед заменой плата была в lk1st fastboot (Linux не работал, bearer не было).
+Образ `linux/ramboot-mm1/aurora-mm1.img` 38c960ef… без изменений (sha256 сверен), `fastboot boot` через lk1st (`logs/uart/beeline1-fastboot.txt`).
+UART `logs/uart/beeline1-20260930-131418.*`; сценарии и результаты `logs/beeline1/` (bee-p23.sh 8d3e8cf2…, bee-obs.sh, bee-watch.sh, bee-safe.sh; bee23/, beeobs/, beewatch.txt, prof.txt, beesafe/).
+- Boot: EMMC-RO 30/30, B1_OK=1, NCM usb0 172.16.42.1 (ping OK). modem-up: MPSS up t≈108 s, wwan0qmi0/at0/at1, wwan0..7.
+- P2 (GET): DMS 'shutting-down'; UIM initialization-completed; slot1 present, USIM ready, PIN1 disabled (3/10), personalization ready; slot2 no-atr.
+  ICCID <REDACTED>; IMSI <REDACTED> → home 250-99 'Beeline' (SPN 'beeline'). Home network до online: NotProvisioned. NAS not-registered-searching.
+- P3: одна `--dms-set-operating-mode=online` (t=128.39, rc=0 → Mode 'online'). Далее только GET, без scan/register/band/RAT.
+  +6 s: Selected 3gpp, RAT lte, searching; +97 s (t=226): **registration-denied** (~20 s); t=247 → снова not-registered-searching и так до t≈626 (конец наблюдения, ~500 s).
+  LTE service 'limited' / True status 'limited-regional', Domain camped, PS detached, Forbidden no, Cell access all-calls.
+  Camped: PLMN 250-99, **B3 EARFCN 1275**, PCI 390, TAC <CELL> (cell-location TAC <CELL>), GCI <CELL>; RSRP −102…−104, RSRQ −19…−20, SNR −7…−1 dB, RSSI −61.
+  Соседи intra PCI 55 (RSRP −100, RSRQ −14.5), 7, 61, 319; inter EARFCN 550 (B1), 3300 (B7). Причина отказа (EMM cause) через QMI GET не получена.
+- LTE attach PDN list '1', профиль 1: APN '' (пусто), ipv4-or-ipv6, auth none — тот же, с которым T2 регистрировалась за 3 s → APN профиля attach не объясняет отказ (не доказано).
+- MM 1.25.95 (qcom-soc): modem найден, state **disabled**, lock sim-pin2 (PIN2, не блокирует), SIM operator 25099 'beeline'. Bearer/connect НЕ выполнялись (Phase 4 не начата — нет регистрации).
+- Безопасность: NV (modemst1/2, fsg, fsc, persist) BEFORE==AFTER (== B2 эталоны); eMMC writes_completed 0 / sectors_written 0;
+  rmtfs 2× `write 0:1792` → RAM shadow (-r). BAM-DMUX suspended, wwan0 DOWN, MPSS running, dmesg без Failed to resume/-110/-22/SSR/wdog. NCM OK.
+- Гипотезы (не проверены): SIM Beeline не активирована/заблокирована для данных или LTE; слабая/перегруженная сота B3 (RSRQ −20, SNR<0).
+  Проверить SIM в телефоне там же (регистрация, LTE, мобильный интернет) до следующей попытки.
+
+# Сессия 22 — Beeline, повтор после полного обесточивания (2026-09-30 13:39–14:01) — **CELLULAR PASS (Aurora cellular bring-up закрыт)**
+Контроль: та же SIM в Redmi 9 (crDroid) — LTE 250-99 HOME, rejectCause 0, интернет OK, APN internet.beeline.ru, EARFCN 1275 / PCI 390.
+Образ aurora-mm1.img 38c960ef… без изменений; UART `logs/uart/beeline2-20260930-134119.*`, `logs/uart/beeline2-fastboot.txt`.
+Сценарии/результаты `logs/beeline1/`: bee2-diag.sh (98d89ad3…) → bee2/; bee-data.sh (11156676…) → beedata/; bee-data2.sh (94d47de8…) → beedata2/.
+curl для RAM: Alpine v3.24 curl 8.22.0 + closure (libcurl, libssl3/libcrypto3 3.5.9, nghttp2, c-ares, idn2, psl, unistring, brotli, CA bundle) —
+`linux/beeline/curl/` (APK C: сверены с APKINDEX, SHA256SUMS; cu.tar b5087392…), распакован в /tmp/cu, LD_LIBRARY_PATH (системный libcrypto не заменялся).
+- Регистрация: одна `--dms-set-operating-mode=online` (t=43.95) → +6.7 s **registered, PS attached**, 250-99 'Beeline', LTE B3 EARFCN 1275,
+  **PCI 55**, ECI <CELL>, TAC <CELL>; RSRP −103 / RSRQ −17 / SNR −3.0. Ветка reject-диагностики (AT+CEREG/CEER) не понадобилась — AT-команды не отправлялись.
+  Сравнение с сессией 21 (denied): тогда serving PCI 390, ECI <CELL>, system-info TAC <CELL> (cell-location TAC <CELL>) — причина отказа не установлена
+  (EMM cause не получен); после cold boot модем выбрал другую соту той же несущей и зарегистрировался сразу.
+- MM qcom-soc формирует bearer так: WDA Set Data Format (raw-ip) → Bind Data Port (a2-mux-rmnet0) → Set IP Family → WDS **Start Network с TLV APN/Username/
+  Auth/IP family** — профили модема НЕ создаются/не меняются (0× Create/Modify Profile в mm.log). rmtfs — 0 новых запросов записи.
+- Connect (одна попытка на проход): `mmcli -m 0 --simple-connect="apn=internet.beeline.ru,user=beeline,password=beeline,allowed-auth=pap,ip-type=ipv4"` → Bearer/1, rc=0.
+  IPv4 10.46.47.17/30, gw 10.46.47.18, DNS 10.10.22.1, 194.186.191.1, MTU 1500, iface wwan0. Внешний IP (CGNAT) <PUBLIC_IP> (1.1.1.1 trace: colo DME).
+- Маршрутизация: ядро без policy routing (`ip rule` → Operation not supported) → только /32 host-routes через wwan0 в main; default нет
+  (`ip route get 8.8.4.4` → unreachable); `ip route get 172.16.42.2` → usb0.
+- Проход 1 (beedata): DNS OK (ya.ru, www.google.com через оба DNS Beeline), ping 77.88.8.8 5/5 (avg 49 ms), 1.1.1.1 5/5 (44 ms), HTTP ya.ru 302;
+  HTTPS rc=60 «certificate is not yet valid» — **часы RAM-Linux ≈1970** (не сеть: TLS-сертификат получен). Disconnect OK.
+- Часы: `date -u -s @<epoch 480s>` (только системное время ядра, hwclock/RTC не трогали).
+- Проход 2 (beedata2, те же параметры connect): ping 5/5 оба; **HTTPS ya.ru HTTP/2 302** (капча Яндекса), **https://www.google.com/generate_204 → 204**,
+  **https://1.1.1.1/cdn-cgi/trace → 200 TLSv1.3**, ssl_verify=0 везде; HTTP ya.ru 302.
+  tcpdump wwan0: 152 пакета, TX 79 / RX 71, DNS 16, ICMP 20, tcp443 102, tcp80 12, SYN 4 / SYN-ACK 4, TLS handshake records 6.
+  Во время данных модем перешёл на B1 EARFCN 550, PCI 147, ECI <CELL>, TAC <CELL> (RSRP −105, RSRQ −17, SNR −6.4).
+- BAM-DMUX: active во время трафика, после disconnect suspended; Failed to resume/-110/-22/EAGAIN/SSR/wdog: 0. MPSS running.
+- Disconnect: successfully disconnected, connected: no, /32 routes и адрес удалены, resolv.conf очищен, wwan0 DOWN; MM registered/home, QMI registered+PS attached.
+- NV modemst1/2, fsg, fsc, persist BEFORE==AFTER (оба прохода, == эталоны B2); eMMC writes_completed 0 / sectors_written 0. USB NCM ping OK всё время.
+- Итог: SIM detect, online, automatic registration, PS attach, bearer, IPv4, wwan0 TX/RX, DNS, ICMP, HTTP, HTTPS, clean disconnect — **PASS**.
+  Замечание на будущее: для TLS в RAM-Linux выставлять время (NTP через wwan0 или date с хоста) до HTTPS.
+
+# Сессия 23 — B5 (direct boot из eMMC): Phase 0–1 audit (2026-09-30) — **STOP на Phase 1, записей нет**
+Ничего не записано, к плате не обращались (только анализ файлов зеркала).
+- Блокер 1 (доказан): текущий aboot = lk1st-aurora (e4addbf8…, == readback S1 и == sha из Linux S13) собран с `LK2ND_FORCE_FASTBOOT=1`
+  (`lk2nd-build/src/build-lk1st-msm8916/config.h`; строка «Fastboot mode was forced with compile-time flag.» в aboot-lk1st-aurora.mbn и в UART S1/S2/S3).
+  `app/aboot/aboot.c:5647` безусловно ставит boot_into_fastboot=true → `normal_boot` (lk2nd_boot()/boot_linux_from_mmc()) не выполняется НИКОГДА.
+  ⇒ любая запись только в `boot` не меняет поведение power-on: lk1st остаётся в fastboot. B5 без изменения aboot невозможен.
+- Блокер 2 (доказан): golden aurora-mm1.img 38c960ef… = 20 606 976 B (Image.gz-dtb 8 658 738 + initramfs.cpio.gz 11 944 942, page 2048)
+  > boot 16 777 216 B (LBA 396384, 32768 сект.). Даже тот же cpio (40 307 200 B) в xz -9e = 8 340 976 B → итог ≈17.0 MB > 16 MiB. zstd -19 хуже.
+- Попутно (для будущего дизайна): без FORCE_FASTBOOT lk1st сначала вызывает lk2nd_scan_devices() — ext2-mount (RO в LK) всех leaf-разделов ≥ LK2ND_BOOT_MIN_SIZE
+  (+boot) и поиск extlinux/extlinux.conf, затем boot_linux_from_mmc() из `boot`; при ошибке → «Could not do normal boot» → fastboot.
+  Клавиши lk1st msm8916: RESIN (кнопка RESET Aurora) = KEY_VOLUMEDOWN → fastboot; GPIO107 (pull-up, active-low) = KEY_VOLUMEUP → recovery.
+
+# Сессия 24 — B5a (minimal direct boot proof): A1–A3 + подготовка A4 (2026-09-30 14:20–14:40) — **ЗАПИСЕЙ НЕТ, ждёт GO**
+Артефакты `b5a/` (SHA256SUMS, копия на 480s сверена), логи `logs/b5a/A3/*`, UART `logs/uart/b5a-a3-20260930-142659.*`.
+- A1 сборка: чистые клоны lk2nd 23.1 e9c8b217 (tag 23.1, git clean), тот же toolchain/команда. Контроль воспроизводимости: FORCE=1 → unsigned 58d20d78 (== прошитый),
+  qtestsign 0eef3b5 `-v 3 aboot` → 003c484e, pad1M → **e4addbf8 == текущий aboot** (бит-в-бит). Кандидат: та же команда без `LK2ND_FORCE_FASTBOOT=1`
+  → unsigned 33c452e4…, signed `aboot-lk1st-aurora-autoboot.mbn` 327196 B 7b3fb5b3…, **pad1M 3b8cd266…0f85**. config.h diff = одна строка `-#define LK2ND_FORCE_FASTBOOT 1`.
+  Все .o без debug-info идентичны, кроме app/aboot/aboot.o (aboot_init: в FORCE-сборке lk2nd_boot/normal path выкинуты как мёртвый код; в autoboot — есть).
+  Строка «Fastboot mode was forced…» в autoboot-бинарнике отсутствует (0 вхождений).
+- Normal boot flow (исходник, autoboot): multislot нет (нет *_a/_b) → keys (lk2nd device node не матчится: lk1st без LK2ND_COMPATIBLE, cmdline пуст → generic):
+  VOL_UP = GPIO107 pull-up active-low → recovery (там lk2nd = fastboot); VOL_DOWN = PM8916 RESIN (кнопка RESET) → fastboot; обе → EDL; KEY_HOME → false.
+  reboot mode = PON_SOFT_RB_SPARE (обнуляется при полном обесточивании). ABOOT_STANDALONE: devinfo/misc/BCB/ffbm/format-bit не читаются.
+  → lk2nd_boot(): ext2-mount **только чтение** (ext2 fs_api без write; lk2nd bdev без write; bcache dirty не ставится) на leaf-разделах ≥16 MiB + boot, ищет extlinux;
+  не найдено → boot_linux_from_mmc(): header ANDROID!, page 2048, imagesize ≤ partition, target_use_signed_kernel && !unlocked → не проверяется (standalone unlocked),
+  gzip-распаковка в scratch, update_ker_tags_rdisk_addr (ABOOT_FORCE_* 0x80080000 → лог «0x80000000»/0x82000000/0x81E00000), dt_size=0 → dev_tree_appended → boot_linux.
+  Тот же scratch-буфер/распаковка/адреса/appended-DTB, что в cmd_boot (fastboot boot), которым emmc1 PASS (сессия 13). Ошибка → «Could not do normal boot» → fastboot.
+- A2 кандидат boot: `linux/artifacts/ramboot-emmc1/aurora-emmc1.img` 93f61ce7… 9 631 744 B: ANDROID! v0, page 2048, kernel Image.gz+DTB 8 608 417 B
+  (gzip → arm64 Image 22 945 800 B, image_size 0x1670000, text_offset 0; appended DTB 65 425 B = 23f6464f…, model «JZ08AU Aurora (RAM boot EMMC1)»), ramdisk gzip 1 017 983 B,
+  dt_size 0, cmdline `earlycon console=ttyMSM0,115200n8 ignore_loglevel loglevel=8 rdinit=/init`. `b5a/boot-emmc1-16MiB.img` = образ + нули до 16 777 216 B → **e9579f33…ebff**.
+- A3 (живое чтение Firehose, 14:27–14:35): вход mm1 RAM-Linux → `reboot -f` → lk1st → `fastboot oem reboot-edl` → 9008. Все чтения rc=0, 15/15 == documented:
+  boot 1342def7 (stock, == partitions/boot.bin), aboot e4addbf8, GPT p 6e850a5d / b 795952a1 (== S2 кандидаты побайтно), sbl1 6a661ec9, rpm 5a9b857b, tz 8481892f, hyp 1a963047,
+  tzbak@305184 c6f7db26, recovery 0dfa60a0, modemst1 637a71d1, modemst2 9bb10190, fsg b0a3b7e4, fsc 5f70bf18, persist ee48a843. printgpt: boot 0xc18c000/0x1000000, aboot 0x8100000/0x100000.
+- Находка (не блокер B5a): warm `reboot -f` из mainline → lk1st иногда висит после `target_init()` до «MMC card» ~15 с → сброс SoC → вторая попытка OK
+  (сейчас 14:27:22→14:27:37; ранее сессия 19 02:49:13→02:49:28). 2 из ~6 warm reboot; на cold boot не наблюдалось. Причина не установлена.
+- Подготовлено (НЕ запускалось): `b5a/A4-write.sh` (7cda9d18…; гейты → boot → readback cmp → aboot → readback cmp → сверка остальных с A3), `b5a/A4-rollback.sh` (47de97b1…).
+
+# Сессия 25 — B5a: запись boot+aboot и 3 cold boot (2026-09-30 14:40–14:59) — **B5a PASS**
+- Pre-GO offline/RO проверка extlinux (`logs/b5a/A4pre/scan-check.{py,out}`): lk2nd 23.1 ищет только `<part>/extlinux/extlinux.conf`; scan list = GPT-разделы ≥16 MiB + boot
+  (вложенных MBR-subdevice нет ни в одном, у mmc1 protective MBR не проходит validate). Живые Firehose-дампы modem 04ada779 (==эталон), system f09ded23, cache 817118e4,
+  userdata 1e021a0c + A3 persist/recovery + кандидат boot; ext-FS: system/persist/cache/userdata — debugfs (RO) «File not found» для /extlinux и /extlinux/extlinux.conf,
+  то же на backup session 1. modem (FAT), boot, recovery — не ext.
+- `b5a/A4-write.sh` (7cda9d18) без изменений, EDL-сессия из A3: гейты OK → boot `Wrote … sector 396384`, readback e9579f33 cmp **BOOT_MATCH** →
+  aboot `Wrote … sector 264192`, readback 3b8cd266 cmp **ABOOT_MATCH** → GPT p/b, tzbak, sbl1, rpm, tz, hyp, recovery, modemst1/2, fsg, fsc, persist == A3. Логи `logs/b5a/A4/`.
+- Состояние флеша теперь: aboot = lk1st-aurora-autoboot (3b8cd266…, без FORCE_FASTBOOT); boot = emmc1 + нули (e9579f33…); остальное как после S3/сессии 4b.
+- Cold boot ×3 (полное обесточивание USB+АКБ пользователем, без хоста/fastboot/reboot -f), UART `logs/uart/b5a-cold{1,2,3}-*.log`:
+  по одному `SBL1, Start` → SBL1 End → lk1st `welcome to lk` → MMC → таблица block devices (== GPT) → `boot: Trying to boot from the file system` → decompress →
+  appended DTB → PSCI v1.0 → `booting linux … ramdisk (1017983)` (~1.0 с от lk) → Linux 7.2.7 «JZ08AU Aurora (RAM boot EMMC1)», 4 CPU, 445132K/524288K, MemTotal 482692 kB,
+  eMMC 27 разделов, EMMC-RO-SUMMARY 30/30 all_ro=YES, mmcblk0 writes 0, UDC configured, NCM ping 5/5 (~2.7 ms), shell по UART. 14:52 / 14:54 / 14:57 — **3/3 PASS**.
+  Безвредно: `Failed detecting MMC/SDC @ slot2` (lk2nd опрашивает пустой SD-слот); окно UART ~280–820 мс lk повреждено (строка «Loading (boot) image» не читается).
+- Как попасть в fastboot теперь: зажать RESET (RESIN = KEY_VOLUMEDOWN) при включении (по коду; на железе не проверялось). Аварийно: HW EDL D+→GND. Откат: `b5a/A4-rollback.sh`.
+- B5b (extlinux/cache, exact golden mm1) НЕ начат — ждёт отдельного GO.
+
+# Сессия 26 — B5b (exact golden mm1 через extlinux): B1–B6 аудит + кандидат (2026-09-30 15:00–15:50) — **ЗАПИСЕЙ НЕТ, ждёт GO**
+Артефакты `b5b/` (SHA256SUMS), эмулятор и прогоны `b5b/emu/`. Плата: emmc1 Linux (B5a baseline), к flash только чтение.
+- B1 (исходник lk2nd 23.1): lk2nd_scan_devices() идёт по списку bio в порядке list_add_head → **userdata(p26), recovery(p25), cache(p24), persist, system, boot(p21), modem(p0)**
+  (прочие <16 MiB пропускаются; wrp0 не leaf). Для каждого: fs_mount ext2 → lk2nd_try_extlinux("<mp>/extlinux/extlinux.conf"); **ничего не размонтирует**;
+  find_mount/mount сравнивают префикс без границы «/» (ERR_ALREADY_MOUNTED) — до cache ничего не монтируется, конфликтов нет.
+  ext2-драйвер LK: только rev≤1; ro_compat кроме sparse_super|large_file → mount -3; **incompat не проверяет** (extents/64bit/flex_bg/meta_bg/inline_data прочитает мусором);
+  только прямые/IND/DIND/TIND блоки; group desc 32 B; каталоги линейно (dir_entry_2, filetype ок); write API нет.
+  Парсер extlinux: ключи (регистр не важен) label, default, kernel|linux, initrd, append, fdt|devicetree, fdtdir, fdtoverlays; без DEFAULT → первый label;
+  **FDT обязателен** (appended DTB в этом пути не используется); пути: абсолютный → "<mp>/" + path (// схлопывается), относительный → "<mp>/extlinux/";
+  нужны LF и завершающий \n (иначе «Failed to parse»). Загрузка: kernel файл → scratch 0x90000000 (256 MiB) → gzip (трейлер игнорируется) → kernel @DDR+text_offset(0),
+  initrd @ROUNDDOWN(0x3200000−size,4K), DTB @initrd−2 MiB (max 2 MiB); kernel_max = tags_offset−kernel_offset. Любая ошибка до boot_linux → return → следующий раздел →
+  «Bootable file system not found. Reverting to android boot.» → boot_linux_from_mmc(). Далее общий boot_linux() (как у Android-пути: update_device_tree, ASSERT при сбое DT).
+- B2 golden `linux/artifacts/ramboot-mm1/aurora-mm1.img` 38c960ef…: v0, page 2048, kernel @2048 8 658 738 B 0ff9c802 (= Image.gz-dtb: gzip 8 592 969 B 9c20a372 + appended DTB
+  @file 8 595 017, 65 769 B a10056c5), ramdisk @8 660 992 11 944 942 B 250bf8ee, паддинги нулевые. Image 23 015 432 B 4603b02f, image_size 0x1680000, text_offset 0.
+  Всё == build-артефактам mm1. Выбор: kernel-файл = **точный payload Image.gz-dtb**, fdt = точный appended DTB, initrd = точный initramfs, append = точный cmdline.
+- B3 cache: LBA 2133088, 262144 сект., 134 217 728 B (0x4118c000). Живой sha **817118e4** (Firehose A4pre + sha256 /dev/mmcblk0p25 на плате — совпали; поток nc префикс OK).
+  ext4 (Android make_ext4fs): has_journal ext_attr resize_inode filetype **extent** sparse_super large_file **uninit_bg**, 4K, inode 256, UUID 57f8f4bc-…, 1554/32768 блоков,
+  содержимое: /backup (пусто), /recovery/last_log (5836 B, stock recovery сессии 3), /recovery/last_install (0). Ценности нет; ≠ session-1 (6a8ab0bd). **Несовместим с lk2nd**
+  (mount -3, extents). Backup: `b5b/backup/cache-current-817118e4.bin` (RO).
+- B4 кандидат `b5b/cache-extlinux-mm1.img` **409bbb11…14ed9**, 134 217 728 B, воспроизводим (`b5b/mkfs-candidate.sh` 045cc857: mke2fs 1.47.2 -t ext2 -O none,filetype,sparse_super,
+  4K, inode 128, 64 inodes, 1 group, фикс. UUID/hash_seed/время + debugfs sif времён). Файлы: /extlinux/extlinux.conf e14e9ad6 (173 B), /Image.gz-dtb 0ff9c802,
+  /aurora-mm1.dtb a10056c5, /initramfs.cpio.gz 250bf8ee (+lost+found). inode flags 0x0 (block map, IND/DIND). e2fsck -fn rc=0.
+- Эмулятор `b5b/emu/lk2nd-scan-emu`: реальные boot.c/extlinux.c/util.c, lk2nd bdev wrapper/util, lib/bio, lib/partition, lib/fs, lib/fs/ext2, lib/bcache, lib/zlib_inflate
+  из дерева 23.1 + шимы (bdev из образов по GPT A3, write→abort). S0 (текущий flash): таблица устройств == UART cold boot, mount rc: userdata/cache/persist/system −3,
+  recovery/boot/modem −1 → Android boot (как на плате). S1 (кандидат): «Trying to boot 'mm1'» → boot_linux: kernel 4603b02f @DDR+0, image end +0x1680000,
+  DTB a10056c5 @+0x249B000, initrd 250bf8ee @+0x269B000, cmdline точный. F1–F11 (нет conf/kernel/initrd/dtb, мусор, нет fdt, CRLF, нет \n, битый gzip, нули, битый sb) →
+  все → «Reverting to android boot» (emmc1).
+- Не эмулируется (остаточный риск): зависание/краш LK на повреждённых метаданных; ASSERT в boot_linux (DT) → panic → EDL; ядро стартовало, но Linux упал — fallback нет.
+- Подготовлено (НЕ запускалось): `b5b/B5b-write.sh` c0ebd361, `b5b/B5b-rollback.sh` 72d3deb1. Вход в EDL — только HW (D+→GND).
+
+# Сессия 27 — B5b: запись cache + cold boot #1 PASS, cold boot #2 HANG (2026-09-30 15:27–15:42) — **STOP для анализа**
+- GO пользователя: заменить cache целиком. HW EDL (D+→GND) → `b5b/B5b-write.sh` c0ebd361 без изменений: Serial 0x<SAHARA_SERIAL>, cache 0x4118c000/0x8000000, GPT==A3,
+  boot e9579f33, aboot 3b8cd266, cache 817118e4 (pre) → `Wrote … sector 2133088` → readback 409bbb11 cmp **CACHE_MATCH** → GPT p/b, tzbak, boot, aboot, sbl1, rpm, tz, hyp,
+  recovery, modemst1/2, fsg, fsc, persist == A3; modem, system, userdata == A4pre. Логи `logs/b5b/W/`, `logs/b5b/B5b-write.out`.
+- Cold boot #1 (`logs/uart/b5b-cold1-20260930-153540.log`): 15:36:57 SBL1 → lk1st → `booting linux @ 0x80000000, ramdisk @ 0x8269b000 (11944942), tags/device tree @ 0x8249b000`
+  (адреса только extlinux-пути; == эмулятор; golden fastboot: 0x82000000/0x81e00000) → Linux `7.2.7-aurora-bam1 #5 … 04:59:18` (== golden в сессии 22),
+  «JZ08AU Aurora (RAM boot BAM1)», 4 CPU (0-3), Memory 353708K/524288K (== golden), /proc/cmdline == APPEND, EMMC-RO 30/30, writes 0, NCM ping 5/5, shell,
+  remoteproc offline, MM/rmtfs не запущены (штатно для mm1). **PASS.** Строка «Trying to boot 'mm1'» — в повреждённом окне UART lk 280–950 мс.
+  Ещё 3 SBL1-старта (15:37:22, 15:37:37, 15:37:54) — выпадение аккумулятора (со слов пользователя, контакт нестабилен); все 3 тоже прошли extlinux → mm1; в зачёт не идут.
+- Cold boot #2 (`logs/uart/b5b-cold2-20260930-153935.log`): 15:41:10 SBL1 Start … QHEE/Image Loaded ×3, QSEE, **SBL1 End 15:41:11 → тишина** (нет «UART_DM Initialized»/
+  «welcome to lk»), USB не энумерируется (>40 с). Зависание ДО lk1st (TZ/qhypstub/ранний lk) — до любого чтения cache. Первый такой случай во всех UART-логах проекта
+  (скан всех *.log: SBL1 End без lk — только этот). Причина не установлена (кандидат: нестабильный контакт АКБ). Ничего не писалось, отката не было.
+- Cold boot #2 повтор (АКБ закреплён) 15:43:50: SBL1 → lk1st → extlinux-адреса (0x8269b000/0x8249b000) → mm1: ядро #5 == golden, BAM1, CPU 0-3, 353708K, cmdline == APPEND,
+  RO 30/30, writes 0, NCM 5/5, shell, remoteproc offline, MM/rmtfs нет. **PASS.**
+- Cold boot #3 (`logs/uart/b5b-cold3-20260930-154444.log`): 15:45:06 SBL1 Start → pm_device_init (Delta 17202 µs вместо обычных ~11.2–11.8 ms) → boot_config →
+  sbl1_ddr_set_params → Pre_DDR_clock_init Delta → **тишина** (зависание внутри stock SBL1 до pm_driver_init/Image Load, т.е. до загрузки TZ/HYP/aboot и до чтения cache).
+  15:49:29 новый старт → SBL1 → lk1st → extlinux → mm1: все проверки как в #2 — **PASS**.
+- Итог наблюдений: все 6 загрузок, дошедших до lk1st, прошли extlinux → точный golden mm1. 2 ранних зависания (15:41 после SBL1 End; 15:45 внутри SBL1 DDR-init) —
+  оба до кода/данных, изменённых в B5a/B5b; совпадают по времени с нестабильным контактом АКБ. Причина не доказана.
+- 15:49:29 — повторное обесточивание пользователем (подтверждено), не самовосстановление.
+- **B5b = PASS / CLOSED** (решение пользователя 2026-09-30). Baseline flash: aboot 3b8cd266 (lk1st autoboot), boot e9579f33 (emmc1, fallback),
+  cache 409bbb11 (ext2 extlinux → exact golden mm1), остальное == A3. Power-on без хоста → mm1.
+- ОТКРЫТО (отдельный вопрос, без GO не исследуется): ранние зависания при включении до lk1st — 15:41 (после SBL1 End) и 15:45 (внутри SBL1 DDR-init,
+  pm_device_init 17202 µs vs ~11.3–11.8 ms), на фоне нестабильного контакта АКБ. Также открыт warm reboot -f hang (сессия 24).
+
+# Session 28 — B6 RAM-only modem lifecycle (2026-09-30 16:09–16:47 on 480s clock) — **B6I NOT REACHED: re-attach alternates PASS/FAIL**. Nothing written to flash.
+Board: golden mm1 via extlinux (B5 baseline), a single Linux boot for the whole session. Scripts live only in board /tmp. Sources in `b6/` (SHA256SUMS), logs in `logs/b6/all/` (b6/c1..c6, aurora-modem.d/lifecycle.log,
+rmtfs.log, mm-*.log with IMSI masked), UART `logs/uart/b6-20260930-160910.log`. System clock set from 480s (`date -u -s @…`, RTC untouched) — for HTTPS only.
+- Reconstructed flow (Aurora 14–22 + JZ02 openrc/stopcycle/wwanfix + rmtfs v1.3 source): RO gates → `rmtfs -r -P -s -v` (with -s rmtfs itself writes "start";
+  on SIGTERM it does pwrite "stop" to remoteproc state and only then exits → MSS stops while rmtfs is still alive, rmtfs exits last) → MSS running (0.7 s)
+  → wwan0qmi0+wwan0 (0.8 s) +2 s (JZ02 start_post guard) → [NEW gate] UIM card present + USIM ready → qmicli online (one successful SET;
+  retries only on DeviceNotReady — the first 2–3 SETs ~3 s after MSS boot get DeviceNotReady(52)) → NAS registered+PS attached → kill qmi-proxy → udevd/dbus/polkitd/MM
+  → MM modem detected (38–51 s) → MM state `disabled` is OK (session 22 pass 1: simple-connect enables it) → one simple-connect → IPv4 from bearer, /32 routes only.
+  Stop: simple-disconnect → [NEW] `mmcli --disable` (low-power/detach) → delete our /32 routes, flush+down all wwan* → SIGTERM MM (+qmi-proxy) → BAM-DMUX suspended → SIGTERM rmtfs (MSS stop → exit).
+- Findings while debugging: this mmcli has no `--list-bearers` ("error: no actions specified" — also in session 22/JZ02 logs, so the JZ02 wwan-quiesce bearer check was a no-op);
+  mmcli colours values even without a tty (`state: ESC[32mconnected`) → strip before grep; udevd rewrites /dev/disk/by-partlabel/* as relative links → use readlink -f.
+- PASS cycles (c1, c3, c5): registration 8–53 s, START OK 75–124 s; DNS (ya.ru, google via Beeline DNS), ping 77.88.8.8 3/3 and 1.1.1.1 3/3, HTTP ya.ru 302, HTTPS google 204 + 1.1.1.1 trace 200;
+  STOP 4.0–4.6 s: bearer disconnected, routes/address removed, 0/8 wwan UP, MM/qmi-proxy/rmtfs gone, BAM-DMUX suspended, MSS offline; NCM ping OK.
+- All 6 harness cycles + 5 debug starts (11 MSS boots/stops in one boot): Failed to resume/-110/-22/EAGAIN/crash/fatal/watchdog/Oops = 0; `Channel already open: 0..7` on every MSS boot
+  after the first (as on JZ02, harmless); eMMC writes_completed 0 / sectors_written 0; modemst1/2, fsg, fsc, persist == boot == B2 references; 30/30 eMMC devices getro=1.
+- **Blocker:** attach after MSS restart strictly alternates: c1 PASS, c2 FAIL, c3 PASS, c4 FAIL, c5 PASS, c6 FAIL (and the same across the earlier debug starts). FAIL = 250-99 LTE 'limited', PS detached,
+  `not-registered-searching` / `registration-denied`, Forbidden no — the session 21 signature. Not fixed by explicit detach (c3→c4) or by 120 s re-attach holdoff (c5→c6).
+  Every attach right after a successful session was rejected; every attach right after a rejected one succeeded.
+  Hypothesis (not proven): "amnesic EFS" — with rmtfs -r, each rmtfs restart discards the RAM shadow (modem_fs2 write after attach), so every MSS boot presents the stale NAS context from disk
+  (GUTI/KSI/NAS COUNT); the MME rejects it while it still holds the newer context, and a reject clears it. EMM reject cause not obtained (QMI GET has none).
+- Board final state: controller OFF, MSS offline, rmtfs/MM not running (udevd/dbus/polkitd left running), wwan all DOWN, USB NCM OK.
--- a/README.md
+++ b/README.md
@ -0,0 +1,87 @@
+# uzbek-plus — Project Aurora: mainline ARM64 Linux на LTE-модеме JZ08AU (MSM8916)
+
+Плата **JZ08AU-XPA-7J-R3** («Aurora»): Qualcomm MSM8916, 512 MiB RAM, eMMC 3.64 GiB, LTE-модем, Wi-Fi, дисплей.
+Стоковая прошивка — Android 4.4 (ядро 3.10). Здесь — журнал и воспроизводимые материалы перевода платы на
+**mainline Linux 7.2.7 arm64**, который загружается автономно с eMMC и поднимает LTE через ModemManager.
+
+> **Это не прошивка «скачай и залей».** Всё, что касается записи во flash, делалось на одном конкретном экземпляре,
+> по одной стадии, с backup и readback-сверкой. Перед любой записью сделайте и проверьте **полный backup СВОЕГО устройства**
+> (см. [docs/QUICKSTART.md](docs/QUICKSTART.md)). Никогда не прошивайте NV/EFS-разделы (`modemst1`, `modemst2`, `fsg`, `fsc`, `persist`)
+> с другого устройства — там калибровки RF и идентификаторы конкретного модема.
+
+## Статус (2026-09-30)
+
+| Подсистема | Статус |
+|---|---|
+| ARM64 Linux (7.2.7, PSCI, 4 CPU) | PASS |
+| eMMC (HS200, строго read-only в Linux) | PASS |
+| USB NCM (gadget, 172.16.42.1/24) | PASS |
+| MPSS (modem remoteproc, rmtfs `-r`) | PASS |
+| QMI (rpmsg wwan ctrl) | PASS |
+| BAM-DMUX (wwan0) | PASS |
+| LTE registration | PASS |
+| LTE Internet (DNS/ICMP/HTTP/HTTPS) | PASS |
+| Direct boot с eMMC без хоста (B5) | **PASS / CLOSED** |
+| B6 — автоматический lifecycle модема | **IN PROGRESS** (см. ниже) |
+| Wi-Fi (WCNSS) | TODO |
+| Router stack (NAT/firewall/VPN) | TODO |
+| Дисплей в Linux | TODO |
+| Батарея / зарядка | TODO |
+
+## Рабочая цепочка загрузки (baseline B5)
+
+```
+Power → stock SBL1 → DB410c TZ (TZ.BF.3.0) → qhypstub → lk1st (aboot, autoboot)
+      → cache: ext2 + extlinux/extlinux.conf → golden mm1 (Image.gz + DTB + initramfs) → ARM64 Linux
+Fallback: extlinux не найден / не парсится / не грузится → Android boot image из раздела boot (emmc1 rescue)
+```
+
+Текущее содержимое flash на референсной плате (sha256, первые 8 hex):
+
+| раздел | содержимое | sha256 |
+|---|---|---|
+| sbl1, rpm, DDR, sec | stock (не менялись) | sbl1 `6a661ec9`, rpm `5a9b857b` |
+| GPT | stock + tz 512K→1M, tzbak перенесён в свободный промежуток @LBA 305184 | primary `6e850a5d`, backup `795952a1` |
+| tz | DB410c TZ.BF.3.0-00714, дополнен нулями до 1 MiB | `8481892f` |
+| hyp | qhypstub, до 512 KiB | `1a963047` |
+| aboot | lk1st (lk2nd 23.1) autoboot, подписан qtestsign, до 1 MiB | `3b8cd266` |
+| boot | emmc1 rescue image (+ нули до 16 MiB) | `e9579f33` |
+| cache | ext2 + extlinux + точный golden mm1 | `409bbb11` |
+| recovery | lk2nd 23.1 (fastboot) | `0dfa60a0` |
+| modem, NV/EFS, persist, system, userdata | не менялись (Linux монтирует modem FAT только RO) | — |
+
+Golden mm1 (Android boot image, для `fastboot boot`): `aurora-mm1.img` sha256 `38c960ef…`, ядро `7.2.7-aurora-bam1 #5`.
+Все хэши целиком: `b5a/SHA256SUMS`, `b5b/SHA256SUMS`, `bootchain-migration/SHA256SUMS`, `linux/*/SHA256SUMS`, [docs/BLOBS.md](docs/BLOBS.md).
+
+## B6 — lifecycle модема (IN PROGRESS)
+
+RAM-only контроллер `b6/aurora-modem start|stop|status` (rmtfs `-r -P -s` → MPSS → QMI → SIM → online → регистрация →
+ModemManager → bearer → только /32-маршруты; стоп: disconnect → detach → wwan down → MM stop → BAM-DMUX idle → MPSS stop → rmtfs последним).
+Полные циклы start→data→stop проходят чисто (0 ошибок BAM-DMUX/remoteproc, 0 записей eMMC, NV не меняются), **но** повторная
+регистрация в сети после перезапуска MPSS в одном boot чередуется PASS/FAIL (`limited` / `registration-denied`).
+Гипотеза (не доказана): с `rmtfs -r` модем при каждом старте теряет EFS-контекст NAS. Подробности — NOTES.md, сессия 28.
+
+## Структура репозитория
+
+| путь | что |
+|---|---|
+| [NOTES.md](NOTES.md) | подробный журнал всех сессий (sanitized) |
+| [docs/QUICKSTART.md](docs/QUICKSTART.md) | порядок действий для второго устройства |
+| [docs/RECOVERY.md](docs/RECOVERY.md) | аппаратный EDL, откаты |
+| [docs/BUILD.md](docs/BUILD.md) | как пересобрать lk1st/lk2nd, ядро, DTB, initramfs, boot image, cache-образ |
+| [docs/BLOBS.md](docs/BLOBS.md) | проприетарные/device-specific файлы, которых **нет** в репозитории: имя, sha256, назначение, где взять свой |
+| `linux/` | DTS, фрагменты и полные kernel config, патч, init/скрипты initramfs, списки пакетов + APK sha256 |
+| `lk2nd-build/`, `b5a/` | запись сборки lk2nd/lk1st, config.h diff, скрипты записи/отката B5a |
+| `b5b/` | генератор ext2/extlinux-образа cache, эмулятор сканирования lk2nd (исходники + результаты) |
+| `bootchain-migration/` | preflight, write plan, редактор/валидатор GPT |
+| `b6/` | контроллер lifecycle модема (RAM-only прототип) и харнесс тестов |
+| `tools/` | утилиты: UART-логгер, Sahara probe, распаковка boot.img, sanitizer публикации |
+| `logs/` | sanitized логи: UART, QMI, ModemManager, EDL, результаты тестов |
+| `android/` | снимок стокового Android (getprop, gpio, input, leds, …), sanitized |
+
+## Что намеренно не опубликовано
+
+Полные дампы eMMC и разделов, NV/EFS (`modemst1/2`, `fsg`, `fsc`), `persist`, `userdata`, файлы прошивки модема,
+стоковые SBL1/RPM/TZ/aboot/boot/recovery/system, Firehose-программер, DB410c TZ, собранные бинарники.
+Идентификаторы (IMEI, IMSI, ICCID, eMMC CID/serial, Sahara serial, MAC, номера сот, cookies) заменены на `<PLACEHOLDER>`.
+Как это сделано — `tools/publish-sanitize.py`; значения идентификаторов в репозиторий не попадают.
--- a/android/build.prop
+++ b/android/build.prop
@ -0,0 +1,279 @@
+# begin build properties
+# autogenerated by buildinfo.sh
+ro.build.id=KTU84P
+ro.build.display.id=KTU84P test-keys
+ro.build.version.incremental=eng.richal.20260709
+ro.build.version.sdk=19
+ro.build.version.codename=REL
+ro.build.version.release=4.4.4
+ro.build.date=2026年 07月 09日 星期四 12:27:08 CST
+ro.build.date.utc=1783571228
+ro.build.type=user
+ro.build.user=richal
+ro.build.host=msa2
+ro.build.tags=test-keys
+ro.product.board=msm8916
+ro.product.cpu.abi=armeabi-v7a
+ro.product.cpu.abi2=armeabi
+ro.product.manufacturer=unknown
+ro.product.locale.language=en
+ro.product.locale.region=US
+ro.wifi.channels=
+ro.board.platform=msm8916
+# ro.build.product is obsolete; use ro.product.device
+ro.build.product=msm8916_32_512
+# Do not try to parse ro.build.description or .fingerprint
+ro.build.description=msm8916_32_512-user 4.4.4 KTU84P eng.richal.20260709 test-keys
+ro.build.fingerprint=qcom/msm8916_32_512/msm8916_32_512:4.4.4/KTU84P/eng.richal.20260709:user/test-keys
+ro.build.characteristics=default
+persist.sys.language=en
+persist.sys.country=US
+persist.sys.timezone=Asia/Shanghai
+ro.product.locale.language=en
+ro.product.locale.region=CN
+ro.product.model=MIFI
+ro.product.brand=MIFI
+ro.product.name=MIFI
+ro.product.device=MIFI
+# end build properties
+#
+# from device/qcom/msm8916_32_512/system.prop
+#
+#
+# system.prop for msm8916
+#
+
+#rild.libpath=/system/lib/libreference-ril.so
+rild.libpath=/system/vendor/lib/libril-qc-qmi-1.so
+rild.libargs=-d /dev/smd0
+persist.rild.nitz_plmn=
+persist.rild.nitz_long_ons_0=
+persist.rild.nitz_long_ons_1=
+persist.rild.nitz_long_ons_2=
+persist.rild.nitz_long_ons_3=
+persist.rild.nitz_short_ons_0=
+persist.rild.nitz_short_ons_1=
+persist.rild.nitz_short_ons_2=
+persist.rild.nitz_short_ons_3=
+
+#remove cdma subscription selection menu
+#ril.subscription.types=NV,RUIM
+
+DEVICE_PROVISIONED=1
+
+# Start in cdma mode
+#default network mode set to lte
+ro.telephony.default_network=11
+
+#default cdma mode set to 0 - uim mode
+ro.telephony.default_cdma_sub=0
+
+#richal add enable modem restart not full android
+persist.sys.ssr.restart_level=modem
+persist.sys.ssr.enable_ramdumps=0
+
+# richal change dpi for small lcd
+ro.sf.lcd_density=114
+
+# richal disable screen lock
+ro.lockscreen.disable.default=true
+
+# richal add prop for sn write
+persist.sys.juzhen.sn=1
+
+# richal add prop for mifi and ufi device type
+# persist.sys.juzhen.type=ufi
+persist.sys.juzhen.type=mifi
+persist.sys.juzhen.ssid.prefix=4G-MIFI-
+
+# richal add prop for wifi hotspot initial password
+persist.sys.juzhen.wifi.password=1234567890
+# persist.sys.juzhen.wifi.password=12345678
+persist.sys.juzhen.ssid.pd=1234567890
+# richal add ssid suffix type:1-MAC;2-IMEI;3-SN
+persist.sys.juzhen.ssid.suffix=2
+persist.sys.juzhen.web.pd=admin
+persist.sys.juzhen.sim.pd=UFIadmin88888
+persist.sys.juzhen.soft.version=JZ_MIFI_LCD_COM_20260709
+
+# richal add prop for web imei update no ssid reopen
+persist.sys.imei.reboot=0
+
+# richal add prop to disable selinux
+ro.boot.selinux=disable
+
+debug.sf.hw=1
+debug.egl.hw=1
+debug.composition.type=c2d
+persist.hwc.mdpcomp.enable=true
+debug.mdpcomp.logs=0
+dalvik.vm.heapsize=36m
+dev.pm.dyn_samplingrate=1
+persist.demo.hdmirotationlock=false
+
+#ro.hdmi.enable=true
+#tunnel.decode=true
+#tunnel.audiovideo.decode=true
+#lpa.decode=false
+#lpa.use-stagefright=true
+#persist.speaker.prot.enable=false
+
+#
+# system props for the cne module
+#
+persist.cne.feature=4
+
+#
+# system props for the dpm module
+#
+persist.dpm.feature=0
+
+#system props for the MM modules
+media.stagefright.enable-player=true
+media.stagefright.enable-http=true
+media.stagefright.enable-aac=true
+media.stagefright.enable-qcp=true
+media.stagefright.enable-fma2dp=true
+media.stagefright.enable-scan=true
+mmp.enable.3g2=true
+media.aac_51_output_enabled=true
+#codecs:(PARSER_)AAC AC3 ASF AVI DTS 3G2 MP2TS QCP FLAC
+mm.enable.qcom_parser=168563
+
+#
+# system props for the data modules
+#
+ro.use_data_netmgrd=true
+persist.data.netmgrd.qos.enable=true
+
+#system props for time-services
+persist.timed.enable=true
+
+#
+# system prop for opengles version
+#
+# 196608 is decimal for 0x30000 to report version 3
+ro.opengles.version=196608
+
+# System property for cabl
+ro.qualcomm.cabl=0
+
+#
+# System props for telephony
+# System prop to turn on CdmaLTEPhone always
+telephony.lteOnCdmaDevice=0
+
+#Simulate sdcard on /data/media
+#
+persist.fuse_sdcard=true
+
+#
+#snapdragon value add features
+#
+ro.qc.sdk.audio.ssr=false
+##fluencetype can be "fluence" or "fluencepro" or "none"
+ro.qc.sdk.audio.fluencetype=none
+persist.audio.fluence.voicecall=true
+persist.audio.fluence.voicerec=false
+persist.audio.fluence.speaker=true
+#Set for msm8916
+tunnel.audio.encode = false
+ro.config.low_ram=true
+#Buffer size in kbytes for compress offload playback
+audio.offload.buffer.size.kb=32
+#Enable offload audio video playback by default
+av.offload.enable=true
+#enable voice path for PCM VoIP by default
+use.voice.path.for.pcm.voip=true
+#
+#System property for FM transmitter
+#
+ro.fm.transmitter=false
+#enable dsp gapless mode by default
+audio.offload.gapless.enabled=true
+
+#Set composition for USB
+persist.sys.usb.config=diag,serial_smd,rmnet_bam,adb
+
+#Set read only default composition for USB
+ro.sys.usb.default.config=diag,serial_smd,rmnet_bam,adb
+
+#property to enable user to access Google WFD settings
+persist.debug.wfd.enable=1
+#propery to enable VDS WFD solution
+persist.hwc.enable_vds=1
+
+#enable low_ram property on low-tier devices
+ro.config.low_ram=true
+
+#disable atlas service on low-tier devices
+config.disable_atlas=true
+
+#reduce background apps limit to 16 on low-tier devices
+ro.sys.fw.bg_apps_limit=16
+
+#property to configure value of tile size and maxtile for swe
+swe.tile.width=128
+swe.tile.height=128
+swe.tile.maxtile=128
+ro.config.pppoe_enable=1
+
+#
+# ADDITIONAL_BUILD_PROPERTIES
+#
+persist.radio.multisim.config=ssss
+dalvik.vm.heapstartsize=5m
+dalvik.vm.heapgrowthlimit=48m
+dalvik.vm.heapsize=128m
+dalvik.vm.heaptargetutilization=0.75
+dalvik.vm.heapminfree=512k
+dalvik.vm.heapmaxfree=2m
+keyguard.no_require_sim=true
+ro.com.android.dataroaming=true
+ro.com.android.dateformat=MM-dd-yyyy
+ro.config.ringtone=Ring_Synth_04.ogg
+ro.config.notification_sound=pixiedust.ogg
+ro.carrier=unknown
+ro.config.alarm_alert=Alarm_Classic.ogg
+ro.vendor.extension_library=/vendor/lib/libqc-opt.so
+persist.radio.apm_sim_not_pwdn=1
+persist.sys.logkit.ctrlcode=1
+persist.sys.dalvik.vm.lib=libdvm.so
+net.bt.name=Android
+dalvik.vm.stack-trace-file=/data/anr/traces.txt
+persist.gps.qc_nlp_in_use=1
+persist.loc.nlp_name=com.qualcomm.services.location
+ro.gps.agps_provider=1
+ro.pip.gated=0
+persist.radio.calls.on.ims=0
+persist.radio.jbims=0
+persist.radio.csvt.enabled=false
+persist.radio.custom_ecc=1
+persist.radio.rat_on=combine
+persist.radio.mt_sms_ack=20
+
+
+#
+# Properties to overwrite (Default)
+#
+
+# disable "keep SIM alive" in LPM feature
+#persist.radio.apm_sim_not_pwdn=0
+
+# enable restoring mode_pref when manual select network with rat
+persist.radio.restore_mode_pref=1
+
+persist.env.c.phone.matchnum=11
+
+
+#
+# Properties to overwrite (Default)
+#
+
+# disable "keep SIM alive" in LPM feature
+#persist.radio.apm_sim_not_pwdn=0
+
+# enable restoring mode_pref when manual select network with rat
+persist.radio.restore_mode_pref=1
+
+persist.env.c.phone.matchnum=11
--- a/android/by-name.txt
+++ b/android/by-name.txt
@ -0,0 +1,27 @@
+lrwxrwxrwx root     root              1970-01-01 08:20 DDR -> /dev/block/mmcblk0p19
+lrwxrwxrwx root     root              1970-01-01 08:20 aboot -> /dev/block/mmcblk0p4
+lrwxrwxrwx root     root              1970-01-01 08:20 abootbak -> /dev/block/mmcblk0p5
+lrwxrwxrwx root     root              1970-01-01 08:20 boot -> /dev/block/mmcblk0p22
+lrwxrwxrwx root     root              1970-01-01 08:20 cache -> /dev/block/mmcblk0p25
+lrwxrwxrwx root     root              1970-01-01 08:20 fsc -> /dev/block/mmcblk0p16
+lrwxrwxrwx root     root              1970-01-01 08:20 fsg -> /dev/block/mmcblk0p20
+lrwxrwxrwx root     root              1970-01-01 08:20 hyp -> /dev/block/mmcblk0p10
+lrwxrwxrwx root     root              1970-01-01 08:20 hypbak -> /dev/block/mmcblk0p11
+lrwxrwxrwx root     root              1970-01-01 08:20 misc -> /dev/block/mmcblk0p15
+lrwxrwxrwx root     root              1970-01-01 08:20 modem -> /dev/block/mmcblk0p1
+lrwxrwxrwx root     root              1970-01-01 08:20 modemst1 -> /dev/block/mmcblk0p13
+lrwxrwxrwx root     root              1970-01-01 08:20 modemst2 -> /dev/block/mmcblk0p14
+lrwxrwxrwx root     root              1970-01-01 08:20 pad -> /dev/block/mmcblk0p12
+lrwxrwxrwx root     root              1970-01-01 08:20 persist -> /dev/block/mmcblk0p24
+lrwxrwxrwx root     root              1970-01-01 08:20 recovery -> /dev/block/mmcblk0p26
+lrwxrwxrwx root     root              1970-01-01 08:20 rpm -> /dev/block/mmcblk0p6
+lrwxrwxrwx root     root              1970-01-01 08:20 rpmbak -> /dev/block/mmcblk0p7
+lrwxrwxrwx root     root              1970-01-01 08:20 sbl1 -> /dev/block/mmcblk0p2
+lrwxrwxrwx root     root              1970-01-01 08:20 sbl1bak -> /dev/block/mmcblk0p3
+lrwxrwxrwx root     root              1970-01-01 08:20 sec -> /dev/block/mmcblk0p21
+lrwxrwxrwx root     root              1970-01-01 08:20 splash -> /dev/block/mmcblk0p18
+lrwxrwxrwx root     root              1970-01-01 08:20 ssd -> /dev/block/mmcblk0p17
+lrwxrwxrwx root     root              1970-01-01 08:20 system -> /dev/block/mmcblk0p23
+lrwxrwxrwx root     root              1970-01-01 08:20 tz -> /dev/block/mmcblk0p8
+lrwxrwxrwx root     root              1970-01-01 08:20 tzbak -> /dev/block/mmcblk0p9
+lrwxrwxrwx root     root              1970-01-01 08:20 userdata -> /dev/block/mmcblk0p27
--- a/android/cmdline.txt
+++ b/android/cmdline.txt
@ -0,0 +1 @@
+/system/bin/sh: cat: /proc/cmdline: Permission denied
--- a/android/cpuinfo.txt
+++ b/android/cpuinfo.txt
@ -0,0 +1,44 @@
+processor	: 0
+model name	: ARMv7 Processor rev 0 (v7l)
+BogoMIPS	: 38.40
+Features	: swp half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 evtstrm 
+CPU implementer	: 0x41
+CPU architecture: 7
+CPU variant	: 0x0
+CPU part	: 0xd03
+CPU revision	: 0
+
+processor	: 1
+model name	: ARMv7 Processor rev 0 (v7l)
+BogoMIPS	: 38.40
+Features	: swp half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 evtstrm 
+CPU implementer	: 0x41
+CPU architecture: 7
+CPU variant	: 0x0
+CPU part	: 0xd03
+CPU revision	: 0
+
+processor	: 2
+model name	: ARMv7 Processor rev 0 (v7l)
+BogoMIPS	: 38.40
+Features	: swp half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 evtstrm 
+CPU implementer	: 0x41
+CPU architecture: 7
+CPU variant	: 0x0
+CPU part	: 0xd03
+CPU revision	: 0
+
+processor	: 3
+model name	: ARMv7 Processor rev 0 (v7l)
+BogoMIPS	: 38.40
+Features	: swp half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 evtstrm 
+CPU implementer	: 0x41
+CPU architecture: 7
+CPU variant	: 0x0
+CPU part	: 0xd03
+CPU revision	: 0
+
+Hardware	: Qualcomm Technologies, Inc MSM8916
+Revision	: 0000
+Serial		: 0000000000000000
+Processor	: ARMv7 Processor rev 0 (v7l)
--- a/android/devices.txt
+++ b/android/devices.txt
@ -0,0 +1,73 @@
+Character devices:
+  1 mem
+256 msm_rng
+  2 pty
+  3 ttyp
+  4 /dev/vc/0
+  4 tty
+  5 /dev/tty
+  5 /dev/console
+  5 /dev/ptmx
+  7 vcs
+ 10 misc
+ 13 input
+ 21 sg
+ 29 fb
+ 81 video4linux
+ 86 ch
+ 89 i2c
+108 ppp
+116 alsa
+128 ptm
+136 pts
+166 ttyACM
+180 usb
+188 ttyUSB
+189 usb_device
+216 rfcomm
+233 vm_bms
+234 avtimer
+235 jpeg0
+236 ttyGS
+237 ccid_bridge
+238 usbmon
+239 usb_ext_chg
+240 uio
+241 qseecom
+242 kgsl
+243 smdpkt
+244 dia
+245 smd
+246 ttyHSL
+247 subsys
+248 voice_svc
+249 bsg
+250 battery_data
+251 media
+252 rtc
+253 msm_sps
+254 msm_thermal_query
+
+Block devices:
+  1 ramdisk
+259 blkext
+  7 loop
+  8 sd
+ 65 sd
+ 66 sd
+ 67 sd
+ 68 sd
+ 69 sd
+ 70 sd
+ 71 sd
+128 sd
+129 sd
+130 sd
+131 sd
+132 sd
+133 sd
+134 sd
+135 sd
+179 mmc
+253 zram
+254 device-mapper
--- a/android/dmesg.txt
+++ b/android/dmesg.txt
@ -0,0 +1 @@
+klogctl: Operation not permitted
--- a/android/dt-live.txt
+++ b/android/dt-live.txt
@ -0,0 +1,4 @@
+/sys/firmware/devicetree/base: No such file or directory
+/proc/device-tree: No such file or directory
+/system/bin/sh: cat: /proc/device-tree/model: No such file or directory
+/system/bin/sh: cat: /proc/device-tree/compatible: No such file or directory
--- a/android/fb.txt
+++ b/android/fb.txt
@ -0,0 +1,14 @@
+mdssfb_d0000
+U:128x128p-0
+128,256
+32
+512
+spi panel
+pu_en=0
+xalign=0
+walign=0
+ystart=0
+halign=0
+min_w=0
+min_h=0
+panel_name=st7735s wx144 128x128 command mode spi panel
--- a/android/fs-ls.txt
+++ b/android/fs-ls.txt
@ -0,0 +1,651 @@
+drwxr-xr-x root     root              1970-01-01 08:20 acct
+drwxrwx--- system   cache             1970-01-02 08:00 cache
+-rwxr-x--- root     root       292844 1970-01-01 08:00 charger
+dr-x------ root     root              1970-01-01 08:20 config
+lrwxrwxrwx root     root              1970-01-01 08:20 d -> /sys/kernel/debug
+drwxrwx--x system   system            1970-01-02 08:00 data
+-rw-r--r-- root     root          207 1970-01-01 08:00 default.prop
+drwxr-xr-x root     root              1970-01-01 08:20 dev
+lrwxrwxrwx root     root              1970-01-01 08:20 etc -> /system/etc
+-rw-r--r-- root     root         9093 1970-01-01 08:00 file_contexts
+dr-xr-x--- system   system            1970-01-01 08:00 firmware
+-rw-r----- root     root         1316 1970-01-01 08:00 fstab.qcom
+-rwxr-x--- root     root       179476 1970-01-01 08:00 init
+-rwxr-x--- root     root         2823 1970-01-01 08:00 init.class_main.sh
+-rwxr-x--- root     root         1171 1970-01-01 08:00 init.environ.rc
+-rwxr-x--- root     root         1730 1970-01-01 08:00 init.mdm.sh
+-rwxr-x--- root     root         7374 1970-01-01 08:00 init.qcom.class_core.sh
+-rwxr-x--- root     root         6920 1970-01-01 08:00 init.qcom.early_boot.sh
+-rwxr-x--- root     root        12466 1970-01-01 08:00 init.qcom.factory.sh
+-rwxr-x--- root     root        26376 1970-01-01 08:00 init.qcom.rc
+-rwxr-x--- root     root         6370 1970-01-01 08:00 init.qcom.sh
+-rwxr-x--- root     root         4561 1970-01-01 08:00 init.qcom.ssr.sh
+-rwxr-x--- root     root         2962 1970-01-01 08:00 init.qcom.syspart_fixup.sh
+-rwxr-x--- root     root        53658 1970-01-01 08:00 init.qcom.usb.rc
+-rwxr-x--- root     root         8256 1970-01-01 08:00 init.qcom.usb.sh
+-rwxr-x--- root     root         2247 1970-01-01 08:00 init.qti.carrier.rc
+-rwxr-x--- root     root        28234 1970-01-01 08:00 init.rc
+-rwxr-x--- root     root         5802 1970-01-01 08:00 init.target.rc
+-rwxr-x--- root     root         1795 1970-01-01 08:00 init.trace.rc
+-rwxr-x--- root     root         3915 1970-01-01 08:00 init.usb.rc
+drwxrwxr-x root     system            1970-01-01 08:20 mnt
+drwxrwx--x system   system            1970-01-01 08:00 persist
+dr-xr-xr-x root     root              1970-01-01 08:00 proc
+-rw-r--r-- root     root         2161 1970-01-01 08:00 property_contexts
+drwxr-xr-x root     root              1970-01-01 08:00 res
+drwx------ root     root              2026-04-14 19:23 root
+drwxr-x--- root     root              1970-01-01 08:00 sbin
+lrwxrwxrwx root     root              1970-01-01 08:20 sdcard -> /storage/emulated/legacy
+-rw-r--r-- root     root          656 1970-01-01 08:00 seapp_contexts
+-rw-r--r-- root     root        75088 1970-01-01 08:00 sepolicy
+d---r-x--- system   sdcard_r          1970-01-01 08:20 storage
+dr-xr-xr-x root     root              1970-01-01 08:20 sys
+drwxr-xr-x root     root              1970-01-01 08:00 system
+lrwxrwxrwx root     root              1970-01-01 08:20 tombstones -> /data/tombstones
+-rw-r--r-- root     root         9740 1970-01-01 08:00 ueventd.qcom.rc
+-rw-r--r-- root     root         4023 1970-01-01 08:00 ueventd.rc
+lrwxrwxrwx root     root              1970-01-01 08:20 vendor -> /system/vendor
+drwxr-xr-x root     root              2026-07-09 12:27 app
+drwxr-xr-x root     shell             2026-04-14 19:33 bin
+-rw-r--r-- root     root         7178 2026-07-09 12:28 build.prop
+drwxr-xr-x root     root              2026-07-09 12:28 etc
+drwxr-xr-x root     root              2026-04-14 19:30 fonts
+drwxr-xr-x root     root              2026-04-14 19:35 framework
+drwxr-xr-x root     root              2026-04-14 19:35 lib
+drwx------ root     root              1970-01-01 08:00 lost+found
+drwxr-xr-x root     root              2026-07-09 12:28 media
+drwxr-xr-x root     root              2026-07-09 12:27 priv-app
+drwxr-xr-x root     root              2026-04-14 19:27 tts
+drwxr-xr-x root     root              2026-04-14 19:27 usr
+drwxr-xr-x root     shell             2026-04-14 19:35 vendor
+drwxr-xr-x root     shell             2026-04-14 19:33 xbin
+-rwxr-xr-x root     shell       26368 2026-04-14 19:33 ATFWD-daemon
+-rwxr-xr-x root     shell        5396 2026-04-14 19:33 PktRspTest
+-rwxr-xr-x root     shell       30096 2026-04-14 19:27 StoreKeybox
+-rwxr-xr-x root     shell      108944 2026-04-14 19:33 adb
+-rwxr-xr-x root     shell        5564 2026-04-14 19:27 adsprpcd
+-rwxr-xr-x root     shell         210 2026-04-14 19:27 am
+-rwxr-xr-x root     shell        9488 2026-04-14 19:33 app_process
+-rwxr-xr-x root     shell       53588 2026-04-14 19:33 applypatch
+-rwxr-xr-x root     shell       17884 2026-04-14 19:33 atrace
+-rwxr-xr-x root     shell       13584 2026-04-14 19:33 audiod
+-rwxr-xr-x root     shell        9504 2026-04-14 19:33 blkid
+-rwxr-xr-x root     shell         199 2026-04-14 19:27 bmgr
+-rwxr-xr-x root     shell       25972 2026-04-14 19:33 bootanimation
+-rwxr-xr-x root     shell       21828 2026-04-14 19:33 brctl
+-rwxr-xr-x root     shell       34376 2026-04-14 19:33 bridgemgrd
+-rwxr-xr-x root     shell        9540 2026-04-14 19:33 btnvtool
+-rwxr-xr-x root     shell         156 2026-04-14 19:27 bu
+-rwxr-xr-x root     shell        5336 2026-04-14 19:33 bugreport
+-rwxr-xr-x root     shell       66784 2026-04-14 19:33 camera_test
+lrwxr-xr-x root     shell             2026-04-14 19:33 cat -> toolbox
+lrwxr-xr-x root     shell             2026-04-14 19:33 chcon -> toolbox
+lrwxr-xr-x root     shell             2026-04-14 19:33 chmod -> toolbox
+lrwxr-xr-x root     shell             2026-04-14 19:33 chown -> toolbox
+-rwxr-xr-x root     shell       21776 2026-04-14 19:33 clatd
+lrwxr-xr-x root     shell             2026-04-14 19:33 clear -> toolbox
+lrwxr-xr-x root     shell             2026-04-14 19:33 cmp -> toolbox
+-rwxr-xr-x root     shell      600084 2026-04-14 19:27 cnd
+-rwxr-xr-x root     shell         207 2026-04-14 19:27 content
+lrwxr-xr-x root     shell             2026-04-14 19:33 cp -> toolbox
+-rwxr-xr-x root     shell        9432 2026-04-14 19:33 cplay
+-rwxr-xr-x root     shell        9804 2026-04-14 19:33 crda
+-rwxr-xr-x root     shell       62744 2026-04-14 19:33 curl
+-rwxr-xr-x root     shell        9432 2026-04-14 19:33 dalvikvm
+lrwxr-xr-x root     shell             2026-04-14 19:33 date -> toolbox
+lrwxr-xr-x root     shell             2026-04-14 19:33 dd -> toolbox
+-rwxr-xr-x root     shell       25816 2026-04-14 19:33 debuggerd
+-rwxr-xr-x root     shell       62736 2026-04-14 19:33 dex2oat
+-rwxr-xr-x root     shell        9384 2026-04-14 19:33 dexopt
+lrwxr-xr-x root     shell             2026-04-14 19:33 df -> toolbox
+-rwxr-xr-x root     shell       66964 2026-04-14 19:33 dhcpcd
+-rwxr-xr-x root     shell        9380 2026-04-14 19:33 diag_callback_client
+-rwxr-xr-x root     shell       13620 2026-04-14 19:33 diag_dci_sample
+-rwxr-xr-x root     shell        5396 2026-04-14 19:33 diag_klog
+-rwxr-xr-x root     shell       18372 2026-04-14 19:33 diag_mdlog
+-rwxr-xr-x root     shell       13820 2026-04-14 19:33 diag_qshrink4_daemon
+-rwxr-xr-x root     shell       17968 2026-04-14 19:33 diag_socket_log
+-rwxr-xr-x root     shell        9752 2026-04-14 19:33 diag_uart_log
+lrwxr-xr-x root     shell             2026-04-14 19:33 dmesg -> toolbox
+-rwxr-xr-x root     shell      105796 2026-04-14 19:33 dnsmasq
+-rwxr-xr-x root     shell        5352 2026-04-14 19:27 dpmd
+-rwxr-xr-x root     shell       50448 2026-04-14 19:33 drmserver
+-rwxr-xr-x root     shell       58776 2026-04-14 19:33 ds_fmc_appd
+-rwxr-xr-x root     shell        9484 2026-04-14 19:33 dsdnsutil
+lrwxr-xr-x root     shell             2026-04-14 19:33 du -> toolbox
+-rwxr-xr-x root     shell       42268 2026-04-14 19:33 dumpstate
+-rwxr-xr-x root     shell        9436 2026-04-14 19:33 dumpsys
+-rwxr-xr-x root     shell       21856 2026-04-14 19:33 dun-server
+-rwxr-xr-x root     shell      122500 2026-04-14 19:33 e2fsck
+-rwxr-xr-x root     shell        5284 2026-04-14 19:33 ebtables
+-rwxr-xr-x root     shell       22184 2026-04-14 19:33 fm_qsoc_patches
+-rwxr-xr-x root     shell       13636 2026-04-14 19:33 fmconfig
+-rwxr-xr-x root     shell        5284 2026-04-14 19:33 fmfactorytest
+-rwxr-xr-x root     shell       13528 2026-04-14 19:33 fmfactorytestserver
+-rwxr-xr-x root     shell       34372 2026-04-14 19:33 fsck_msdos
+-rwxr-xr-x root     shell       58856 2026-04-14 19:33 ftmdaemon
+-rwxr-xr-x root     shell       35236 2026-04-14 19:33 garden_app
+lrwxr-xr-x root     shell             2026-04-14 19:33 getenforce -> toolbox
+lrwxr-xr-x root     shell             2026-04-14 19:33 getevent -> toolbox
+lrwxr-xr-x root     shell             2026-04-14 19:33 getprop -> toolbox
+lrwxr-xr-x root     shell             2026-04-14 19:33 getsebool -> toolbox
+-rwxr-xr-x root     shell       42392 2026-04-14 19:33 gpsone_daemon
+-rwxr-xr-x root     shell        9612 2026-04-14 19:33 gptest
+lrwxr-xr-x root     shell             2026-04-14 19:33 grep -> toolbox
+-rwxr-xr-x root     shell        9436 2026-04-14 19:33 gzip
+-rwxr-xr-x root     shell      129008 2026-04-14 19:33 hci_qcomm_init
+lrwxr-xr-x root     shell             2026-04-14 19:33 hd -> toolbox
+-rwxr-xr-x root     shell      322072 2026-04-14 19:33 hostapd
+-rwxr-xr-x root     shell       26096 2026-04-14 19:33 hostapd_cli
+lrwxr-xr-x root     shell             2026-04-14 19:33 id -> toolbox
+lrwxr-xr-x root     shell             2026-04-14 19:33 ifconfig -> toolbox
+lrwxr-xr-x root     shell             2026-04-14 19:33 iftop -> toolbox
+-rwxr-xr-x root     shell         194 2026-04-14 19:27 ime
+-rwxr-xr-x root     shell         201 2026-04-14 19:27 input
+lrwxr-xr-x root     shell             2026-04-14 19:33 insmod -> toolbox
+-rwxr-xr-x root     shell       30152 2026-04-14 19:33 installd
+lrwxr-xr-x root     shell             2026-04-14 19:33 ioctl -> toolbox
+lrwxr-xr-x root     shell             2026-04-14 19:33 ionice -> toolbox
+-rwxr-xr-x root     shell      165480 2026-04-14 19:33 ip
+-rwxr-xr-x root     shell      191532 2026-04-14 19:33 ip6tables
+-rwxr-xr-x root     shell      196324 2026-04-14 19:33 iptables
+-rwxr-xr-x root     shell        5284 2026-04-14 19:33 irsc_util
+-rwxr-xr-x root     shell      103784 2026-04-14 19:33 isdbtmmtest
+-rwxr-xr-x root     shell      105776 2026-04-14 19:33 keymaster_test
+-rwxr-xr-x root     shell       38268 2026-04-14 19:33 keystore
+lrwxr-xr-x root     shell             2026-04-14 19:33 kill -> toolbox
+-rwxr-xr-x root     shell       63596 2026-04-14 19:33 linker
+lrwxr-xr-x root     shell             2026-04-14 19:33 ln -> toolbox
+lrwxr-xr-x root     shell             2026-04-14 19:33 load_policy -> toolbox
+-rwxr-xr-x root     shell       21780 2026-04-14 19:33 loc_launcher
+-rwxr-xr-x root     shell       30148 2026-04-14 19:27 location-mq
+lrwxr-xr-x root     shell             2026-04-14 19:33 log -> toolbox
+-rwxr-xr-x root     shell       13584 2026-04-14 19:33 logcat
+-rwxr-xr-x root     shell       13604 2026-04-14 19:33 logwrapper
+-rwxr-xr-x root     shell      157420 2026-04-14 19:27 lowi-server
+lrwxr-xr-x root     shell             2026-04-14 19:33 ls -> toolbox
+lrwxr-xr-x root     shell             2026-04-14 19:33 lsmod -> toolbox
+lrwxr-xr-x root     shell             2026-04-14 19:33 lsof -> toolbox
+-rwxr-xr-x root     shell        9496 2026-04-14 19:33 make_ext4fs
+-rwxr-xr-x root     shell       83212 2026-04-14 19:33 mcDriverDaemon
+lrwxr-xr-x root     shell             2026-04-14 19:33 md5 -> toolbox
+-rwxr-xr-x root     shell      255336 2026-04-14 19:33 mdnsd
+-rwxr-xr-x root     shell         210 2026-04-14 19:27 media
+-rwxr-xr-x root     shell       13536 2026-04-14 19:33 mediaserver
+lrwxr-xr-x root     shell             2026-04-14 19:33 mkdir -> toolbox
+-rwxr-xr-x root     shell      157424 2026-04-14 19:33 mksh
+lrwxr-xr-x root     shell             2026-04-14 19:33 mkswap -> toolbox
+-rwxr-xr-x root     shell       95768 2026-04-15 12:28 mm-pp-daemon
+-rwxr-xr-x root     shell       58812 2026-04-15 12:28 mm-qcamera-app
+-rwxr-xr-x root     shell        9436 2026-04-15 12:28 mm-qcamera-daemon
+-rwxr-xr-x root     shell       13532 2026-04-15 12:28 mm-qjpeg-dec-test
+-rwxr-xr-x root     shell       13532 2026-04-15 12:28 mm-qjpeg-enc-test
+-rwxr-xr-x root     shell       17684 2026-04-14 19:33 mm-qomx-idec-test
+-rwxr-xr-x root     shell       21780 2026-04-14 19:33 mm-qomx-ienc-test
+-rwxr-xr-x root     shell       46388 2026-04-15 12:28 mm-vdec-omx-test
+-rwxr-xr-x root     shell       34076 2026-04-15 12:28 mm-venc-omx-test720p
+-rwxr-xr-x root     shell       17572 2026-04-15 12:28 mm-video-driver-test
+-rwxr-xr-x root     shell       13476 2026-04-15 12:28 mm-video-encdrv-test
+-rwxr-xr-x root     shell       38284 2026-04-14 19:33 mmi
+-rwxr-xr-x root     shell         217 2026-04-14 19:27 monkey
+lrwxr-xr-x root     shell             2026-04-14 19:33 mount -> toolbox
+-rwxr-xr-x root     shell       43376 2026-04-14 19:33 mpdecision
+-rwxr-xr-x root     shell       62912 2026-04-15 12:28 msm-vidc-test
+-rwxr-xr-x root     shell       17844 2026-04-14 19:33 mtpd
+lrwxr-xr-x root     shell             2026-04-14 19:33 mv -> toolbox
+-rwxr-xr-x root     shell        5284 2026-04-14 19:33 n_smux
+lrwxr-xr-x root     shell             2026-04-14 19:33 nandread -> toolbox
+-rwxr-xr-x root     shell        5284 2026-04-14 19:33 ndc
+-rwxr-s--- root     inet         5468 2026-04-14 19:33 netcfg
+-rwxr-xr-x root     shell      100032 2026-04-14 19:33 netd
+-rwxr-xr-x root     shell      235884 2026-04-15 12:28 netmgrd
+lrwxr-xr-x root     shell             2026-04-14 19:33 netstat -> toolbox
+lrwxr-xr-x root     shell             2026-04-14 19:33 newfs_msdos -> toolbox
+-rwxr-xr-x root     shell        5284 2026-04-14 19:33 nl_listener
+lrwxr-xr-x root     shell             2026-04-14 19:33 notify -> toolbox
+-rwxr-xr-x root     shell       79204 2026-04-14 19:33 oatdump
+-rwxr-xr-x root     root        26060 2026-04-14 19:33 ping
+-rwxr-xr-x root     shell       30420 2026-04-14 19:33 ping6
+-rwxr-xr-x root     shell         191 2026-04-14 19:27 pm
+-rwxr-xr-x root     shell       17712 2026-04-14 19:33 port-bridge
+-rwxr-xr-x root     shell      141856 2026-04-14 19:33 pppd
+lrwxr-xr-x root     shell             2026-04-14 19:33 printenv -> toolbox
+lrwxr-xr-x root     shell             2026-04-14 19:33 ps -> toolbox
+-rwxr-xr-x root     shell       25980 2026-04-14 19:33 ptt_socket_app
+-rwxr-xr-x root     shell       17800 2026-04-14 19:33 qcom-system-daemon
+-rwxr-xr-x root     shell      166384 2026-04-14 19:33 qmiproxy
+-rwxr-xr-x root     shell       84524 2026-04-15 12:28 qmuxd
+-rwxr-xr-x root     shell        9488 2026-04-14 19:33 qrngd
+-rwxr-xr-x root     shell        5336 2026-04-15 12:28 qrngp
+-rwxr-xr-x root     shell        5340 2026-04-14 19:33 qrngtest
+-rwxr-xr-x root     shell       21980 2026-04-15 12:28 qseecom_sample_client
+-rwxr-xr-x root     shell        9432 2026-04-14 19:33 qseecom_security_test
+-rwxr-xr-x root     shell        9568 2026-04-14 19:33 qseecomd
+-rwxr-xr-x root     shell      162700 2026-04-14 19:33 racoon
+-rwxr-xr-x root     shell       30024 2026-04-14 19:33 radish
+lrwxr-xr-x root     shell             2026-04-14 19:33 readlink -> toolbox
+-rwxr-xr-x root     shell        5284 2026-04-14 19:33 reboot
+-rwxr-xr-x root     shell        9780 2026-04-14 19:33 regdbdump
+lrwxr-xr-x root     shell             2026-04-14 19:33 renice -> toolbox
+-rwxr-xr-x root     shell         188 2026-04-14 19:27 requestsync
+lrwxr-xr-x root     shell             2026-04-14 19:33 restorecon -> toolbox
+-rwxr-xr-x root     shell       18492 2026-04-14 19:33 rfs_access
+-rwxr-xr-x root     shell        9492 2026-04-14 19:33 rild
+lrwxr-xr-x root     shell             2026-04-14 19:33 rm -> toolbox
+lrwxr-xr-x root     shell             2026-04-14 19:33 rmdir -> toolbox
+lrwxr-xr-x root     shell             2026-04-14 19:33 rmmod -> toolbox
+-rwxr-xr-x root     shell       15376 2026-04-15 12:28 rmnetcli
+-rwxr-xr-x root     shell       19336 2026-04-15 12:28 rmt_storage
+lrwxr-xr-x root     shell             2026-04-14 19:33 route -> toolbox
+-rwxr-x--- root     shell        9432 2026-04-14 19:33 run-as
+lrwxr-xr-x root     shell             2026-04-14 19:33 runcon -> toolbox
+-rwxr-xr-x root     shell       17624 2026-04-14 19:33 sapd
+-rwxr-xr-x root     shell        5284 2026-04-14 19:33 schedtest
+lrwxr-xr-x root     shell             2026-04-14 19:33 schedtop -> toolbox
+-rwxr-xr-x root     shell        9384 2026-04-14 19:33 screencap
+-rwxr-xr-x root     shell       17796 2026-04-14 19:33 screenrecord
+-rwxr-xr-x root     shell       38256 2026-04-14 19:33 screenshot
+-rwxr-xr-x root     shell       17624 2026-04-14 19:33 sdcard
+-rwxr-xr-x root     shell        9688 2026-04-14 19:33 sdptool
+lrwxr-xr-x root     shell             2026-04-14 19:33 sendevent -> toolbox
+-rwxr-xr-x root     shell        5336 2026-04-14 19:33 sensorservice
+-rwxr-xr-x root     shell        9436 2026-04-14 19:33 service
+-rwxr-xr-x root     shell        9588 2026-04-14 19:33 servicemanager
+lrwxr-xr-x root     shell             2026-04-14 19:33 setconsole -> toolbox
+lrwxr-xr-x root     shell             2026-04-14 19:33 setenforce -> toolbox
+lrwxr-xr-x root     shell             2026-04-14 19:33 setprop -> toolbox
+lrwxr-xr-x root     shell             2026-04-14 19:33 setsebool -> toolbox
+-rwxr-xr-x root     shell         178 2026-04-14 19:27 settings
+-rwxr-xr-x root     shell        5336 2026-04-14 19:33 setup_fs
+lrwxr-xr-x root     shell             2026-04-14 19:33 sh -> mksh
+lrwxr-xr-x root     shell             2026-04-14 19:33 sleep -> toolbox
+lrwxr-xr-x root     shell             2026-04-14 19:33 smd -> toolbox
+lrwxr-xr-x root     shell             2026-04-14 19:33 start -> toolbox
+lrwxr-xr-x root     shell             2026-04-14 19:33 stop -> toolbox
+-rwxr-xr-x root     shell       17680 2026-04-14 19:33 subsystem_ramdump
+-rwxr-xr-x root     shell        5284 2026-04-14 19:33 surfaceflinger
+-rwxr-xr-x root     shell         192 2026-04-14 19:27 svc
+lrwxr-xr-x root     shell             2026-04-14 19:33 swapoff -> toolbox
+lrwxr-xr-x root     shell             2026-04-14 19:33 swapon -> toolbox
+lrwxr-xr-x root     shell             2026-04-14 19:33 sync -> toolbox
+-rwxr-xr-x root     shell        5340 2026-04-15 12:28 syssn
+-rwxr-xr-x root     shell       67188 2026-04-15 12:28 tc
+-rwxr-xr-x root     shell        9492 2026-04-14 19:33 test_diag
+-rwxr-xr-x root     shell      220960 2026-04-15 12:28 thermal-engine
+-rwxr-xr-x root     shell       17688 2026-04-14 19:33 time_daemon
+-rwxr-xr-x root     shell        5336 2026-04-14 19:33 tinycap
+-rwxr-xr-x root     shell        9380 2026-04-14 19:33 tinymix
+-rwxr-xr-x root     shell        5284 2026-04-14 19:33 tinypcminfo
+-rwxr-xr-x root     shell        9432 2026-04-14 19:33 tinyplay
+-rwxr-xr-x root     shell      139024 2026-04-14 19:33 toolbox
+lrwxr-xr-x root     shell             2026-04-14 19:33 top -> toolbox
+lrwxr-xr-x root     shell             2026-04-14 19:33 touch -> toolbox
+-rwxr-xr-x root     shell        3814 2026-04-14 19:27 uiautomator
+lrwxr-xr-x root     shell             2026-04-14 19:33 umount -> toolbox
+lrwxr-xr-x root     shell             2026-04-14 19:33 uptime -> toolbox
+-rwxr-xr-x root     shell       21876 2026-04-15 12:28 usb_uicc_client
+-rwxr-xr-x root     shell        5284 2026-04-14 19:33 usbhub
+-rwxr-xr-x root     shell        5284 2026-04-14 19:33 usbhub_init
+-rwxr-xr-x root     shell        5284 2026-04-14 19:33 vdc
+-rwxr-xr-x root     shell       13596 2026-04-14 19:27 vm_bms
+lrwxr-xr-x root     shell             2026-04-14 19:33 vmstat -> toolbox
+-rwxr-xr-x root     shell       91780 2026-04-14 19:33 vold
+lrwxr-xr-x root     shell             2026-04-14 19:33 watchprops -> toolbox
+-rwxr-xr-x root     shell       35880 2026-04-14 19:33 wcnss_filter
+-rwxr-xr-x root     shell       13580 2026-04-14 19:33 wcnss_service
+-rwxr-xr-x root     shell        9432 2026-04-14 19:33 wdsdaemon
+lrwxr-xr-x root     shell             2026-04-14 19:33 wipe -> toolbox
+-rwxr-xr-x root     shell         190 2026-04-14 19:27 wm
+-rwxr-xr-x root     shell      899928 2026-04-14 19:33 wpa_supplicant
+-rwxr-xr-x root     shell      439884 2026-04-14 19:27 xtwifi-client
+-rwxr-xr-x root     shell       54736 2026-04-14 19:27 xtwifi-inet-agent
+drwxr-xr-x root     root              2026-04-14 19:27 crda
+-rw-r--r-- root     root         1332 2026-04-14 19:22 crtbegin_so.o
+-rw-r--r-- root     root          617 2026-04-14 19:22 crtend_so.o
+drwxr-xr-x root     root              2026-04-14 19:33 drm
+drwxr-xr-x root     root              2026-04-14 19:33 egl
+drwxr-xr-x root     root              2026-04-14 19:33 hw
+-rw-r--r-- root     root       332528 2026-04-14 19:33 libEGL.so
+-rw-r--r-- root     root         9220 2026-04-14 19:33 libETC1.so
+-rw-r--r-- root     root       185508 2026-04-14 19:33 libFFTEm.so
+-rw-r--r-- root     root       319876 2026-04-14 19:33 libGLES_trace.so
+-rw-r--r-- root     root        21460 2026-04-14 19:33 libGLESv1_CM.so
+-rw-r--r-- root     root        25556 2026-04-14 19:33 libGLESv2.so
+lrw-r--r-- root     root              2026-04-14 19:33 libGLESv3.so -> libGLESv2.so
+-rw-r--r-- root     root      8492932 2026-04-14 19:33 libLLVM.so
+-rw-r--r-- root     root        38092 2026-04-14 19:33 libMcClient.so
+-rw-r--r-- root     root        13420 2026-04-14 19:33 libMcRegistry.so
+-rw-r--r-- root     root        42092 2026-04-15 12:28 libOmxAacEnc.so
+-rw-r--r-- root     root        50284 2026-04-15 12:28 libOmxAmrEnc.so
+-rw-r--r-- root     root        16216 2026-04-14 19:33 libOmxCore.so
+-rw-r--r-- root     root        50284 2026-04-15 12:28 libOmxEvrcEnc.so
+-rw-r--r-- root     root        50284 2026-04-15 12:28 libOmxQcelp13Enc.so
+-rw-r--r-- root     root       214220 2026-04-15 12:28 libOmxVdec.so
+-rw-r--r-- root     root       214220 2026-04-15 12:28 libOmxVdecHevc.so
+-rw-r--r-- root     root       165020 2026-04-15 12:28 libOmxVenc.so
+-rw-r--r-- root     root         9328 2026-04-14 19:33 libOpenMAXAL.so
+-rw-r--r-- root     root         9328 2026-04-14 19:33 libOpenSLES.so
+-rw-r--r-- root     root         9272 2026-04-14 19:33 libQWiFiSoftApCfg.so
+-rw-r--r-- root     root       206664 2026-04-14 19:33 libRS.so
+-rw-r--r-- root     root       108524 2026-04-14 19:33 libRSCpuRef.so
+-rw-r--r-- root     root       148740 2026-04-14 19:33 libRSDriver.so
+-rw-r--r-- root     root        74908 2026-04-14 19:33 libRScpp.so
+-rw-r--r-- root     root         5128 2026-04-14 19:33 libSR_AudioIn.so
+-rw-r--r-- root     root       456108 2026-04-14 19:33 liballjoyn.so
+-rw-r--r-- root     root        58576 2026-04-14 19:33 libandroid.so
+-rw-r--r-- root     root       736420 2026-04-14 19:33 libandroid_runtime.so
+-rw-r--r-- root     root        84708 2026-04-14 19:33 libandroid_servers.so
+-rw-r--r-- root     root       132616 2026-04-14 19:33 libandroidfw.so
+-rw-r--r-- root     root      1017748 2026-04-14 19:33 libart-compiler.so
+-rw-r--r-- root     root      2179204 2026-04-14 19:33 libart.so
+-rw-r--r-- root     root        21508 2026-04-14 19:33 libaudio-resampler.so
+-rw-r--r-- root     root        17884 2026-04-14 19:33 libaudioeffect_jni.so
+-rw-r--r-- root     root       238932 2026-04-14 19:33 libaudioflinger.so
+-rw-r--r-- root     root        13428 2026-04-14 19:33 libaudioparameter.so
+-rw-r--r-- root     root         9220 2026-04-14 19:33 libaudioroute.so
+-rw-r--r-- root     root         9220 2026-04-14 19:33 libaudioutils.so
+-rw-r--r-- root     root         5072 2026-04-14 19:33 libbcc.sha1.so
+-rw-r--r-- root     root       136432 2026-04-14 19:33 libbcc.so
+-rw-r--r-- root     root       210124 2026-04-14 19:33 libbcinfo.so
+-rw-r--r-- root     root       177436 2026-04-14 19:33 libbinder.so
+-rw-r--r-- root     root         9268 2026-04-14 19:33 libbluedroid.so
+-rw-r--r-- root     root        98280 2026-04-14 19:33 libbluetooth_jni.so
+-rw-r--r-- root     root        17508 2026-04-14 19:33 libbson.so
+-rw-r--r-- root     root        29960 2026-04-14 19:33 libbt-hci.so
+-rw-r--r-- root     root         5220 2026-04-14 19:33 libbt-utils.so
+-rw-r--r-- root     root       310584 2026-04-14 19:33 libc.so
+-rw-r--r-- root     root        13420 2026-04-15 12:28 libc2dcolorconvert.so
+-rw-r--r-- root     root       214296 2026-04-14 19:33 libcamera_client.so
+-rw-r--r-- root     root        23332 2026-04-14 19:33 libcamera_metadata.so
+-rw-r--r-- root     root       509268 2026-04-14 19:33 libcameraservice.so
+-rw-r--r-- root     root        26368 2026-04-15 12:28 libchromatix_imx135_liveshot.so
+-rw-r--r-- root     root      1645820 2026-04-14 19:33 libchromium_net.so
+-rw-r--r-- root     root        17796 2026-04-15 12:28 libcimax_spi.so
+-rw-r--r-- root     root       174112 2026-04-14 19:31 libclcore.bc
+-rw-r--r-- root     root       188972 2026-04-14 19:31 libclcore_debug.bc
+-rw-r--r-- root     root       163792 2026-04-14 19:31 libclcore_neon.bc
+-rw-r--r-- root     root         5124 2026-04-14 19:33 libcnefeatureconfig.so
+-rw-r--r-- root     root        58572 2026-04-14 19:33 libcommon_time_client.so
+-rw-r--r-- root     root        21560 2026-04-14 19:33 libcompiler_rt.so
+-rw-r--r-- root     root         5220 2026-04-14 19:33 libconnectivitymanager.so
+-rw-r--r-- root     root        13412 2026-04-14 19:33 libcorkscrew.so
+-rw-r--r-- root     root       953184 2026-04-14 19:33 libcrypto.so
+-rw-r--r-- root     root         5168 2026-04-14 19:33 libctest.so
+-rw-r--r-- root     root       140580 2026-04-14 19:33 libcurl.so
+-rw-r--r-- root     root        38120 2026-04-14 19:33 libcutils.so
+-rw-r--r-- root     root       189776 2026-04-15 12:28 libdashplayer.so
+-rw-r--r-- root     root         5232 2026-04-14 19:33 libdefcontainer_jni.so
+-rw-r--r-- root     root        13368 2026-04-14 19:33 libdiskconfig.so
+-rw-r--r-- root     root         5168 2026-04-14 19:33 libdivxdrmdecrypt.so
+-rw-r--r-- root     root         9224 2026-04-14 19:33 libdl.so
+-rw-r--r-- root     root        91340 2026-04-14 19:33 libdrmframework.so
+-rw-r--r-- root     root        26036 2026-04-14 19:33 libdrmframework_jni.so
+-rw-r--r-- root     root       820664 2026-04-14 19:33 libdvm.so
+-rw-r--r-- root     root         5256 2026-04-14 19:33 libebt_802_3.so
+-rw-r--r-- root     root         9480 2026-04-14 19:33 libebt_among.so
+-rw-r--r-- root     root         9524 2026-04-14 19:33 libebt_arp.so
+-rw-r--r-- root     root         5300 2026-04-14 19:33 libebt_arpreply.so
+-rw-r--r-- root     root         9496 2026-04-14 19:33 libebt_ip.so
+-rw-r--r-- root     root         9364 2026-04-14 19:33 libebt_ip6.so
+-rw-r--r-- root     root         5316 2026-04-14 19:33 libebt_limit.so
+-rw-r--r-- root     root         5428 2026-04-14 19:33 libebt_log.so
+-rw-r--r-- root     root         5364 2026-04-14 19:33 libebt_mark.so
+-rw-r--r-- root     root         5240 2026-04-14 19:33 libebt_mark_m.so
+-rw-r--r-- root     root         5532 2026-04-14 19:33 libebt_nat.so
+-rw-r--r-- root     root         5356 2026-04-14 19:33 libebt_nflog.so
+-rw-r--r-- root     root         5272 2026-04-14 19:33 libebt_pkttype.so
+-rw-r--r-- root     root         5240 2026-04-14 19:33 libebt_redirect.so
+-rw-r--r-- root     root         5252 2026-04-14 19:33 libebt_standard.so
+-rw-r--r-- root     root         9564 2026-04-14 19:33 libebt_stp.so
+-rw-r--r-- root     root         5356 2026-04-14 19:33 libebt_ulog.so
+-rw-r--r-- root     root         5316 2026-04-14 19:33 libebt_vlan.so
+-rw-r--r-- root     root         5168 2026-04-14 19:33 libebtable_broute.so
+-rw-r--r-- root     root         5168 2026-04-14 19:33 libebtable_filter.so
+-rw-r--r-- root     root         5168 2026-04-14 19:33 libebtable_nat.so
+-rw-r--r-- root     root        46888 2026-04-14 19:33 libebtc.so
+-rw-r--r-- root     root         9368 2026-04-14 19:33 libeffects.so
+-rw-r--r-- root     root       173172 2026-04-14 19:33 libexif.so
+-rw-r--r-- root     root        87248 2026-04-14 19:27 libexpat.so
+-rw-r--r-- root     root        28012 2026-04-14 19:33 libext2_blkid.so
+-rw-r--r-- root     root         9320 2026-04-14 19:33 libext2_com_err.so
+-rw-r--r-- root     root        18144 2026-04-14 19:33 libext2_e2p.so
+-rw-r--r-- root     root        13472 2026-04-14 19:33 libext2_profile.so
+-rw-r--r-- root     root         9272 2026-04-14 19:33 libext2_uuid.so
+-rw-r--r-- root     root       108096 2026-04-14 19:33 libext2fs.so
+-rw-r--r-- root     root        42084 2026-04-14 19:33 libext4_utils.so
+-rw-r--r-- root     root         9320 2026-04-14 19:33 libextendedremotedisplay.so
+-rw-r--r-- root     root        17412 2026-04-15 12:28 libexternal.so
+-rw-r--r-- root     root       107676 2026-04-14 19:33 libfilterfw.so
+-rw-r--r-- root     root         5128 2026-04-14 19:33 libfilterpack_imageproc.so
+-rw-r--r-- root     root       332972 2026-04-14 19:33 libft2.so
+-rw-r--r-- root     root        17516 2026-04-14 19:33 libgabi++.so
+-rw-r--r-- root     root        21616 2026-04-14 19:33 libgccdemangle.so
+-rw-r--r-- root     root        23328 2026-04-14 19:33 libgps.utils.so
+-rw-r--r-- root     root       255496 2026-04-14 19:33 libgui.so
+-rw-r--r-- root     root         5232 2026-04-14 19:33 libhardware.so
+-rw-r--r-- root     root        21700 2026-04-14 19:33 libhardware_legacy.so
+-rw-r--r-- root     root       296244 2026-04-14 19:33 libharfbuzz_ng.so
+-rw-r--r-- root     root       218920 2026-04-14 19:33 libhwui.so
+-rw-r--r-- root     root      1275308 2026-04-14 19:33 libicui18n.so
+-rw-r--r-- root     root      1021164 2026-04-14 19:33 libicuuc.so
+-rw-r--r-- root     root         9432 2026-04-14 19:33 libimscamera_jni.so
+-rw-r--r-- root     root        87308 2026-04-14 19:33 libinput.so
+-rw-r--r-- root     root       238748 2026-04-14 19:33 libinputservice.so
+-rw-r--r-- root     root        23768 2026-04-14 19:33 libiprouteutil.so
+-rw-r--r-- root     root       207524 2026-04-14 19:33 libjavacore.so
+-rw-r--r-- root     root        77564 2026-04-14 19:33 libjavacrypto.so
+-rw-r--r-- root     root        38588 2026-04-14 19:33 libjhead.so
+-rw-r--r-- root     root         9336 2026-04-14 19:33 libjhead_jni.so
+-rw-r--r-- root     root       476540 2026-04-14 19:29 libjni_latinime.so
+-rw-r--r-- root     root       218676 2026-04-14 19:29 libjni_mosaic.so
+-rw-r--r-- root     root         9420 2026-04-14 19:33 libjni_pacprocessor.so
+-rw-r--r-- root     root        13412 2026-04-14 19:29 libjni_tinyplanet.so
+-rw-r--r-- root     root         5080 2026-04-14 19:33 libjnigraphics.so
+-rw-r--r-- root     root       218272 2026-04-14 19:33 libjpeg.so
+-rw-r--r-- root     root        38092 2026-04-14 19:33 libkeystore_binder.so
+-rw-r--r-- root     root       102488 2026-04-14 19:33 libloc_api_v02.so
+-rw-r--r-- root     root        36192 2026-04-14 19:33 libloc_core.so
+-rw-r--r-- root     root        17540 2026-04-14 19:33 libloc_ds_api.so
+-rw-r--r-- root     root       101168 2026-04-14 19:33 libloc_eng.so
+-rw-r--r-- root     root        17588 2026-04-14 19:33 libloc_xtra.so
+-rw-r--r-- root     root        13432 2026-04-14 19:33 liblog.so
+-rw-r--r-- root     root         9316 2026-04-14 19:33 liblogwrap.so
+-rw-r--r-- root     root        99532 2026-04-14 19:33 libm.so
+-rw-r--r-- root     root        21604 2026-04-14 19:33 libmdnssd.so
+-rw-r--r-- root     root       570664 2026-04-14 19:33 libmedia.so
+-rw-r--r-- root     root       220972 2026-04-14 19:33 libmedia_jni.so
+-rw-r--r-- root     root        17564 2026-04-14 19:33 libmedialogservice.so
+-rw-r--r-- root     root       455972 2026-04-14 19:33 libmediaplayerservice.so
+-rw-r--r-- root     root        13516 2026-04-15 12:28 libmemalloc.so
+-rw-r--r-- root     root         5220 2026-04-14 19:33 libmemtrack.so
+-rw-r--r-- root     root        24616 2026-04-14 19:33 libminui.so
+-rw-r--r-- root     root        15796 2026-04-14 19:33 libmm-omxcore.so
+-rw-r--r-- root     root        79136 2026-04-15 12:28 libmm-qcamera.so
+-rw-r--r-- root     root        58592 2026-04-15 12:28 libmmcamera_interface.so
+-rw-r--r-- root     root        46180 2026-04-15 12:28 libmmjpeg_interface.so
+-rw-r--r-- root     root        74920 2026-04-14 19:33 libmtp.so
+-rw-r--r-- root     root        17508 2026-04-14 19:33 libnativehelper.so
+-rw-r--r-- root     root        25708 2026-04-14 19:33 libnbaio.so
+-rw-r--r-- root     root        13416 2026-04-14 19:33 libnetlink.so
+-rw-r--r-- root     root        21612 2026-04-14 19:33 libnetutils.so
+-rw-r--r-- root     root         5124 2026-04-14 19:33 libnfc_ndef.so
+-rw-r--r-- root     root        13368 2026-04-14 19:33 libnl_2.so
+-rw-r--r-- root     root         5128 2026-04-15 12:28 libnvrw.so
+-rw-r--r-- root     root        46348 2026-04-15 12:28 liboverlay.so
+-rw-r--r-- root     root      1930728 2026-04-14 19:33 libpac.so
+-rw-r--r-- root     root       129408 2026-04-14 19:33 libpixelflinger.so
+-rw-r--r-- root     root       124072 2026-04-14 19:33 libpng.so
+-rw-r--r-- root     root         9376 2026-04-14 19:33 libportable.so
+-rw-r--r-- root     root         5284 2026-04-14 19:33 libpower.so
+-rw-r--r-- root     root        13464 2026-04-14 19:33 libpowermanager.so
+-rw-r--r-- root     root        13692 2026-04-15 12:28 libqcomfm_jni.so
+-rw-r--r-- root     root         5124 2026-04-15 12:28 libqdMetaData.so
+-rw-r--r-- root     root        25804 2026-04-15 12:28 libqdutils.so
+-rw-r--r-- root     root         9324 2026-04-14 19:33 libqomx_core.so
+-rw-r--r-- root     root        34608 2026-04-14 19:33 libqsap_sdk.so
+-rw-r--r-- root     root        38092 2026-04-15 12:28 libqservice.so
+-rw-r--r-- root     root        29876 2026-04-14 19:33 libreference-ril.so
+-rw-r--r-- root     root        39592 2026-04-14 19:33 libril.so
+-rw-r--r-- root     root         5128 2026-04-14 19:33 librilutils.so
+-rw-r--r-- root     root        10724 2026-04-15 12:28 librmnetctl.so
+-rw-r--r-- root     root        31204 2026-04-14 19:33 librs_jni.so
+-rw-r--r-- root     root       103912 2026-04-14 19:33 librtp_jni.so
+-rw-r--r-- root     root        46388 2026-04-14 19:33 libselinux.so
+-rw-r--r-- root     root        58576 2026-04-14 19:33 libsensorservice.so
+-rw-r--r-- root     root      2009016 2026-04-14 19:33 libskia.so
+-rw-r--r-- root     root        13316 2026-04-14 19:33 libsoftkeymaster.so
+-rw-r--r-- root     root       321340 2026-04-14 19:33 libsonivox.so
+-rw-r--r-- root     root         9500 2026-04-14 19:33 libsoundpool.so
+-rw-r--r-- root     root        17608 2026-04-14 19:33 libsparse.so
+-rw-r--r-- root     root        18964 2026-04-14 19:33 libspeexresampler.so
+-rw-r--r-- root     root       332136 2026-04-14 19:33 libsqlite.so
+-rw-r--r-- root     root        29796 2026-04-14 19:33 libsqlite_jni.so
+-rw-r--r-- root     root       249456 2026-04-14 19:33 libssl.so
+-rw-r--r-- root     root      1072536 2026-04-14 19:33 libstagefright.so
+-rw-r--r-- root     root        50232 2026-04-14 19:33 libstagefright_amrnb_common.so
+-rw-r--r-- root     root        21508 2026-04-14 19:33 libstagefright_avc_common.so
+-rw-r--r-- root     root        50392 2026-04-14 19:33 libstagefright_chromium_http.so
+-rw-r--r-- root     root         5128 2026-04-14 19:33 libstagefright_enc_common.so
+-rw-r--r-- root     root        66768 2026-04-14 19:33 libstagefright_foundation.so
+-rw-r--r-- root     root        91292 2026-04-14 19:33 libstagefright_httplive.so
+-rw-r--r-- root     root       103604 2026-04-14 19:33 libstagefright_omx.so
+-rw-r--r-- root     root       222632 2026-04-14 19:33 libstagefright_soft_aacdec.so
+-rw-r--r-- root     root       275624 2026-04-14 19:33 libstagefright_soft_aacenc.so
+-rw-r--r-- root     root        91308 2026-04-14 19:33 libstagefright_soft_amrdec.so
+-rw-r--r-- root     root        58476 2026-04-14 19:33 libstagefright_soft_amrnbenc.so
+-rw-r--r-- root     root       118376 2026-04-14 19:33 libstagefright_soft_amrwbenc.so
+-rw-r--r-- root     root       170212 2026-04-14 19:33 libstagefright_soft_flacenc.so
+-rw-r--r-- root     root        13372 2026-04-14 19:33 libstagefright_soft_g711dec.so
+-rw-r--r-- root     root        25812 2026-04-14 19:33 libstagefright_soft_gsmdec.so
+-rw-r--r-- root     root       111932 2026-04-14 19:33 libstagefright_soft_h264dec.so
+-rw-r--r-- root     root        91248 2026-04-14 19:33 libstagefright_soft_h264enc.so
+-rw-r--r-- root     root        62576 2026-04-14 19:33 libstagefright_soft_mp3dec.so
+-rw-r--r-- root     root        87152 2026-04-14 19:33 libstagefright_soft_mpeg4dec.so
+-rw-r--r-- root     root       119920 2026-04-14 19:33 libstagefright_soft_mpeg4enc.so
+-rw-r--r-- root     root        13372 2026-04-14 19:33 libstagefright_soft_rawdec.so
+-rw-r--r-- root     root        17468 2026-04-14 19:33 libstagefright_soft_vorbisdec.so
+-rw-r--r-- root     root       197880 2026-04-14 19:33 libstagefright_soft_vpxdec.so
+-rw-r--r-- root     root       234712 2026-04-14 19:33 libstagefright_soft_vpxenc.so
+-rw-r--r-- root     root       156880 2026-04-14 19:33 libstagefright_wfd.so
+-rw-r--r-- root     root         9272 2026-04-14 19:33 libstagefright_yuv.so
+-rw-r--r-- root     root         5228 2026-04-14 19:33 libstagefrighthw.so
+-rw-r--r-- root     root         5228 2026-04-14 19:33 libstdc++.so
+-rw-r--r-- root     root       210252 2026-04-14 19:33 libstlport.so
+-rw-r--r-- root     root       189708 2026-04-14 19:33 libsurfaceflinger.so
+-rw-r--r-- root     root         5176 2026-04-14 19:33 libsurfaceflinger_ddmconnection.so
+-rw-r--r-- root     root         9288 2026-04-14 19:33 libsuspend.so
+-rw-r--r-- root     root         5176 2026-04-14 19:33 libsync.so
+-rw-r--r-- root     root        21612 2026-04-14 19:33 libsysutils.so
+-rw-r--r-- root     root         5228 2026-04-14 19:33 libthread_db.so
+-rw-r--r-- root     root        13580 2026-04-14 19:33 libtinyalsa.so
+-rw-r--r-- root     root         9432 2026-04-14 19:33 libtinycompress.so
+-rw-r--r-- root     root        29976 2026-04-14 19:33 libtinyxml.so
+-rw-r--r-- root     root        29864 2026-04-14 19:33 libtinyxml2.so
+-rw-r--r-- root     root        38092 2026-04-14 19:33 libui.so
+-rw-r--r-- root     root         9272 2026-04-14 19:33 libusbhost.so
+-rw-r--r-- root     root        83164 2026-04-14 19:33 libutils.so
+-rw-r--r-- root     root        34000 2026-04-14 19:33 libvariablespeed.so
+-rw-r--r-- root     root       222364 2026-04-14 19:33 libvideoeditor_core.so
+-rw-r--r-- root     root        88224 2026-04-14 19:33 libvideoeditor_jni.so
+-rw-r--r-- root     root        17508 2026-04-14 19:33 libvideoeditor_osal.so
+-rw-r--r-- root     root        13324 2026-04-14 19:33 libvideoeditor_videofilters.so
+-rw-r--r-- root     root       119992 2026-04-14 19:33 libvideoeditorplayer.so
+-rw-r--r-- root     root         9220 2026-04-15 12:28 libvirtual.so
+-rw-r--r-- root     root       100472 2026-04-14 19:33 libvorbisidec.so
+-rw-r--r-- root     root         9460 2026-04-14 19:33 libvt_jni.so
+-rw-r--r-- root     root       368000 2026-04-14 19:33 libwebrtc_audio_coding.so
+-rw-r--r-- root     root       369944 2026-04-14 19:33 libwebrtc_audio_preprocessing.so
+-rw-r--r-- root     root     21175740 2026-04-14 19:35 libwebviewchromium.so
+-rw-r--r-- root     root         9432 2026-04-14 19:33 libwebviewchromium_plat_support.so
+-rw-r--r-- root     root       165136 2026-04-14 19:33 libwilhelm.so
+-rw-r--r-- root     root        13416 2026-04-14 19:33 libwpa_client.so
+-rw-r--r-- root     root       403368 2026-04-14 19:33 libxml2.so
+-rw-r--r-- root     root        95500 2026-04-14 19:27 libz.so
+drwxr-xr-x root     root              2026-07-09 12:28 modules
+drwxr-xr-x root     root              2026-04-14 19:33 soundfx
+drwxr-xr-x root     root              2026-04-14 19:33 ssl
+-rw-r--r-- root     root         4423 2026-04-14 19:27 MMI_PCBA.cfg
+-rw-r--r-- root     root       226597 2026-07-09 12:28 NOTICE.html.gz
+drwxr-xr-x root     root              2026-04-14 19:27 acdbdata
+-rw-r--r-- root     root          716 2026-04-14 19:27 adbkey.pub
+-rw-r--r-- root     root       590660 2026-07-09 12:28 apns-conf.xml
+-rw-r--r-- root     root       271006 2026-07-09 12:27 apns-conf.xml.bakforspec
+-rw-r--r-- root     root         5491 2026-04-14 19:27 audio_effects.conf
+-rw-r--r-- root     root         5000 2026-04-14 19:27 audio_policy.conf
+drwxr-xr-x root     root              2026-04-14 19:27 bluetooth
+-rw-r--r-- root     root        30438 2026-04-14 19:27 cacert_location.pem
+-rw-r--r-- root     root         3251 2026-04-14 19:27 capability.xml
+-rw-r--r-- root     root         4457 2026-07-09 12:28 cdma_call_conf.xml
+-rw-r--r-- root     root       989184 2026-07-09 12:28 cdrom_install.iso
+-rw-r--r-- root     root          650 2026-04-14 19:27 clatd.conf
+drwxr-xr-x root     root              2026-04-14 19:27 cne
+drwxr-xr-x root     root              2026-04-14 19:27 dhcpcd
+drwxr-xr-x root     root              2026-04-14 19:27 dpm
+-rw-r--r-- root     root         1362 2026-04-14 19:27 ethertypes
+-rw-r--r-- root     root        14420 2026-04-14 19:22 event-log-tags
+-rw-r--r-- root     root         5907 2026-04-14 19:27 fallback_fonts.xml
+drwxr-xr-x root     root              2026-04-14 19:27 firmware
+-rw-r--r-- root     root         1826 2026-04-14 19:27 flp.conf
+-rw-r--r-- root     root         8237 2026-04-14 19:27 ftm_test_config
+-rw-r--r-- root     root         2202 2026-04-14 19:27 gps.conf
+-rw-r--r-- root     root         1918 2026-04-14 19:27 hcidump.sh
+drwxr-xr-x root     root              2026-04-14 19:27 hostapd
+-rw-r--r-- root     root           25 2026-04-14 19:27 hosts
+-rw-r--r-- root     root         3222 2026-04-14 19:27 hsic.control.bt.sh
+-rw-r--r-- root     root         2767 2026-04-14 19:27 init.ath3k.bt.sh
+-rw-r--r-- root     root         1773 2026-04-14 19:27 init.crda.sh
+-rw-r--r-- root     root         4987 2026-04-14 19:27 init.qcom.audio.sh
+-rw-r--r-- root     root         9932 2026-04-14 19:27 init.qcom.bt.sh
+-rw-r--r-- root     root         3651 2026-04-14 19:27 init.qcom.coex.sh
+-rw-r--r-- root     root         1725 2026-04-14 19:27 init.qcom.efs.sync.sh
+-rw-r--r-- root     root         3083 2026-04-14 19:27 init.qcom.fm.sh
+-rw-r--r-- root     root         4023 2026-04-14 19:27 init.qcom.modem_links.sh
+-rw-r--r-- root     root        42322 2026-04-14 19:27 init.qcom.post_boot.sh
+-rw-r--r-- root     root         4891 2026-04-14 19:27 init.qcom.rootagent.sh
+-rw-r--r-- root     root         2767 2026-04-14 19:27 init.qcom.sdio.sh
+-rw-r--r-- root     root         2688 2026-04-14 19:27 init.qcom.uicc.sh
+-rw-r--r-- root     root        19064 2026-04-14 19:27 init.qcom.wifi.sh
+-rw-r--r-- root     root         4308 2026-04-14 19:27 izat.conf
+-rw-r--r-- root     root         2699 2026-04-14 19:27 listen_platform_info.xml
+drwxr-xr-x root     root              2026-04-14 19:27 logmask
+-rw-r--r-- root     root         1578 2026-04-14 19:27 lowi.conf
+-rw-r--r-- root     root         7900 2026-04-14 19:27 media_codecs.xml
+-rw-r--r-- root     root        23988 2026-04-14 19:27 media_profiles.xml
+-rw-r--r-- root     root        24782 2026-04-14 19:27 mixer_paths.xml
+-rw-r--r-- root     root        24819 2026-04-14 19:27 mixer_paths_mtp.xml
+-rw-r--r-- root     root         1308 2026-04-14 19:27 mkshrc
+drwxr-xr-x root     root              2026-04-14 19:27 mmi
+-rw-r--r-- root     root         4732 2026-04-14 19:27 mmi.cfg
+drwxr-xr-x root     root              2026-04-14 19:27 permissions
+drwxr-xr-x root     root              2026-04-14 19:33 ppp
+-rw-r--r-- root     root         3740 2026-04-14 19:27 qca6234-service.sh
+-rw-r--r-- root     root          177 2026-04-14 19:27 qcom.cfg
+-rw-r--r-- root     root         1809 2026-04-14 19:27 qlog-conf.xml
+-rw-r--r-- root     root          422 2026-04-14 19:27 quipc.conf
+-rw-r--r-- root     root       304926 2026-07-09 12:28 recovery-resource.dat
+-rw-r--r-- root     root         1341 2026-04-14 19:27 sap.conf
+-rw-r--r-- root     root          232 2026-04-14 19:27 sec_config
+drwxr-xr-x root     root              2026-04-14 19:30 security
+-rw-r--r-- root     root         1274 2026-07-09 12:28 spn-conf.xml
+-rw-r--r-- root     root         3418 2026-04-14 19:27 system_fonts.xml
+-rw-r--r-- root     root         1723 2026-04-14 19:27 vold.fstab
+-rw-r--r-- root     root        11278 2026-04-14 19:27 wfdconfig.xml
+-rw-r--r-- root     root        10485 2026-04-14 19:27 wfdconfigsink.xml
+-rw-r--r-- root     root         2855 2026-04-14 19:27 whitelist_appops.xml
+drwxr-xr-x root     root              2026-07-09 12:27 wifi
+-rw-r--r-- root     root         1265 2026-04-14 19:27 xtra_root_cert.pem
+-rw-r--r-- root     root         3471 2026-04-14 19:27 xtwifi.conf
+drwxr-xr-x root     shell             2026-04-14 19:22 CTA
+drwxr-xr-x root     shell             2026-04-14 19:22 ChinaMobile
+drwxr-xr-x root     shell             2026-04-14 19:22 ChinaTelecom
+drwxr-xr-x root     shell             2026-04-14 19:22 ChinaUnicom
+drwxr-xr-x root     shell             2026-04-14 19:27 Default
+drwxr-xr-x root     shell             2026-04-14 19:27 bin
+drwxr-xr-x root     shell             2026-04-14 19:27 etc
+drwxr-xr-x root     shell             2026-04-14 19:35 exclude
+drwxr-xr-x root     shell             2026-04-14 19:33 lib
+drwxr-xr-x root     shell             2026-04-14 19:22 modemconfig
+drwxr-xr-x root     shell             2026-04-14 19:22 overlay
+drwxr-xr-x root     shell             2026-07-09 12:28 speccfg
+opendir failed, Permission denied
+/firmware/image: Permission denied
--- a/android/getprop.txt
+++ b/android/getprop.txt
@ -0,0 +1,275 @@
+[DEVICE_PROVISIONED]: [1]
+[audio.offload.buffer.size.kb]: [32]
+[audio.offload.gapless.enabled]: [true]
+[av.offload.enable]: [true]
+[config.disable_atlas]: [true]
+[dalvik.vm.heapgrowthlimit]: [48m]
+[dalvik.vm.heapmaxfree]: [2m]
+[dalvik.vm.heapminfree]: [512k]
+[dalvik.vm.heapsize]: [128m]
+[dalvik.vm.heapstartsize]: [5m]
+[dalvik.vm.heaptargetutilization]: [0.75]
+[dalvik.vm.stack-trace-file]: [/data/anr/traces.txt]
+[debug.composition.type]: [c2d]
+[debug.egl.hw]: [1]
+[debug.force_rtl]: [0]
+[debug.mdpcomp.logs]: [0]
+[debug.sf.hw]: [1]
+[dev.bootcomplete]: [1]
+[dev.pm.dyn_samplingrate]: [1]
+[dolby.audio.sink.info]: [speaker]
+[gsm.current.phone-type]: [1]
+[gsm.network.type]: [Unknown]
+[gsm.operator.alpha]: []
+[gsm.operator.iso-country]: []
+[gsm.operator.isroaming]: [false]
+[gsm.operator.numeric]: []
+[gsm.sim.state]: [ABSENT]
+[gsm.version.baseband]: [PM.1.0.c7-00193-M8916EAAAANVZM-1]
+[gsm.version.ril-impl]: [Qualcomm RIL 1.0]
+[hw.cabl.version]: [1.1.20130401]
+[hw.cabl.yuv]: [0]
+[init.svc.adbd]: [running]
+[init.svc.atfwd]: [running]
+[init.svc.audiod]: [running]
+[init.svc.bootanim]: [stopped]
+[init.svc.carrier_switcher]: [stopped]
+[init.svc.cnd]: [stopped]
+[init.svc.config_bluetooth]: [stopped]
+[init.svc.copy_apps]: [running]
+[init.svc.debuggerd]: [running]
+[init.svc.dpmd]: [stopped]
+[init.svc.drm]: [running]
+[init.svc.fuse_sdcard1]: [running]
+[init.svc.fuse_uicc0]: [running]
+[init.svc.fuse_usbotg]: [running]
+[init.svc.healthd]: [running]
+[init.svc.installd]: [running]
+[init.svc.irsc_util]: [stopped]
+[init.svc.keystore]: [running]
+[init.svc.loc_launcher]: [running]
+[init.svc.media]: [running]
+[init.svc.mpdecision]: [running]
+[init.svc.netd]: [running]
+[init.svc.netmgrd]: [running]
+[init.svc.ppd]: [restarting]
+[init.svc.ptt_socket_app]: [running]
+[init.svc.qcamerasvr]: [running]
+[init.svc.qcom-RIDL]: [stopped]
+[init.svc.qcom-c_core-sh]: [stopped]
+[init.svc.qcom-c_main-sh]: [stopped]
+[init.svc.qcom-post-boot]: [stopped]
+[init.svc.qcom-sh]: [stopped]
+[init.svc.qcom-usb-sh]: [stopped]
+[init.svc.qcomsysd]: [running]
+[init.svc.qmuxd]: [running]
+[init.svc.qrngd]: [running]
+[init.svc.qrngp]: [stopped]
+[init.svc.qseecomd]: [running]
+[init.svc.rfs_access]: [running]
+[init.svc.ril-daemon]: [running]
+[init.svc.rmt_storage]: [running]
+[init.svc.sdcard]: [running]
+[init.svc.servicemanager]: [running]
+[init.svc.surfaceflinger]: [running]
+[init.svc.syssn]: [restarting]
+[init.svc.thermal-engine]: [running]
+[init.svc.time_daemon]: [running]
+[init.svc.ueventd]: [running]
+[init.svc.usb_uicc_daemon]: [stopped]
+[init.svc.usb_uicc_enable]: [stopped]
+[init.svc.vm_bms]: [running]
+[init.svc.vold]: [running]
+[init.svc.wcnss-service]: [running]
+[init.svc.zygote]: [running]
+[keyguard.no_require_sim]: [true]
+[media.aac_51_output_enabled]: [true]
+[media.stagefright.enable-aac]: [true]
+[media.stagefright.enable-fma2dp]: [true]
+[media.stagefright.enable-http]: [true]
+[media.stagefright.enable-player]: [true]
+[media.stagefright.enable-qcp]: [true]
+[media.stagefright.enable-scan]: [true]
+[mm.enable.qcom_parser]: [168563]
+[mmp.enable.3g2]: [true]
+[net.bt.name]: [Android]
+[net.change]: [net.qtaguid_enabled]
+[net.hostname]: [<ANDROID_HOSTNAME>]
+[net.qtaguid_enabled]: [1]
+[net.tcp.buffersize.default]: [4096,87380,110208,4096,16384,110208]
+[net.tcp.buffersize.edge]: [4093,26280,35040,4096,16384,35040]
+[net.tcp.buffersize.evdo]: [4094,87380,262144,4096,16384,262144]
+[net.tcp.buffersize.gprs]: [4092,8760,11680,4096,8760,11680]
+[net.tcp.buffersize.hsdpa]: [4094,87380,1220608,4096,16384,1220608]
+[net.tcp.buffersize.hspa]: [4094,87380,1220608,4096,16384,1220608]
+[net.tcp.buffersize.hspap]: [4094,87380,1220608,4096,16384,1220608]
+[net.tcp.buffersize.hsupa]: [4094,87380,1220608,4096,16384,1220608]
+[net.tcp.buffersize.lte]: [524288,1048576,2097152,262144,524288,1048576]
+[net.tcp.buffersize.umts]: [4094,87380,110208,4096,16384,110208]
+[net.tcp.buffersize.wifi]: [524288,2097152,4194304,262144,524288,1048576]
+[net.tcp.default_init_rwnd]: [60]
+[persist.audio.fluence.speaker]: [true]
+[persist.audio.fluence.voicecall]: [true]
+[persist.audio.fluence.voicerec]: [false]
+[persist.cne.feature]: [4]
+[persist.data.netmgrd.qos.enable]: [true]
+[persist.debug.wfd.enable]: [1]
+[persist.demo.hdmirotationlock]: [false]
+[persist.dpm.feature]: [0]
+[persist.env.c.phone.matchnum]: [11]
+[persist.fuse_sdcard]: [true]
+[persist.gps.qc_nlp_in_use]: [1]
+[persist.hwc.enable_vds]: [1]
+[persist.hwc.mdpcomp.enable]: [true]
+[persist.loc.nlp_name]: [com.qualcomm.services.location]
+[persist.radio.adb_log_on]: [0]
+[persist.radio.apm_sim_not_pwdn]: [1]
+[persist.radio.calls.on.ims]: [0]
+[persist.radio.csvt.enabled]: [false]
+[persist.radio.custom_ecc]: [1]
+[persist.radio.eons.enabled]: [false]
+[persist.radio.jbims]: [0]
+[persist.radio.mt_sms_ack]: [20]
+[persist.radio.multisim.config]: [ssss]
+[persist.radio.rat_on]: [combine]
+[persist.radio.restore_mode_pref]: [1]
+[persist.rild.nitz_long_ons_0]: []
+[persist.rild.nitz_long_ons_1]: []
+[persist.rild.nitz_long_ons_2]: []
+[persist.rild.nitz_long_ons_3]: []
+[persist.rild.nitz_plmn]: []
+[persist.rild.nitz_short_ons_0]: []
+[persist.rild.nitz_short_ons_1]: []
+[persist.rild.nitz_short_ons_2]: []
+[persist.rild.nitz_short_ons_3]: []
+[persist.service.bdroid.bdaddr]: []
+[persist.sys.country]: [US]
+[persist.sys.dalvik.vm.lib]: [libdvm.so]
+[persist.sys.imei.reboot]: [0]
+[persist.sys.juzhen.sim.pd]: [UFIadmin88888]
+[persist.sys.juzhen.sn]: [1]
+[persist.sys.juzhen.sncode]: [<VENDOR_SN>]
+[persist.sys.juzhen.soft.version]: [JZ_MIFI_LCD_COM_20260709]
+[persist.sys.juzhen.ssid.pd]: [1234567890]
+[persist.sys.juzhen.ssid.prefix]: [4G-MIFI-]
+[persist.sys.juzhen.ssid.suffix]: [2]
+[persist.sys.juzhen.type]: [mifi]
+[persist.sys.juzhen.web.pd]: [admin]
+[persist.sys.language]: [en]
+[persist.sys.logkit.ctrlcode]: [1]
+[persist.sys.profiler_ms]: [0]
+[persist.sys.ssr.enable_ramdumps]: [0]
+[persist.sys.ssr.restart_level]: [modem]
+[persist.sys.strict_op_enable]: [false]
+[persist.sys.timezone]: [Asia/Shanghai]
+[persist.sys.usb.config.extra]: [none]
+[persist.sys.usb.config]: [diag,serial_smd,rmnet_bam,adb]
+[persist.sys.whitelist]: [/system/etc/whitelist_appops.xml]
+[persist.timed.enable]: [true]
+[ril.ecclist]: [911,*911,#911,112,000,08,110,999,118,119,120,122]
+[ril.qcril_pre_init_lock_held]: [0]
+[rild.libargs]: [-d /dev/smd0]
+[rild.libpath]: [/system/vendor/lib/libril-qc-qmi-1.so]
+[ro.alarm_boot]: [false]
+[ro.allow.mock.location]: [0]
+[ro.baseband]: [msm]
+[ro.bluetooth.dun]: [true]
+[ro.bluetooth.hfp.ver]: [1.6]
+[ro.bluetooth.sap]: [true]
+[ro.board.platform]: [msm8916]
+[ro.boot.baseband]: [msm]
+[ro.boot.bootdevice]: [7824900.sdhci]
+[ro.boot.console]: [ttyHSL0]
+[ro.boot.emmc]: [true]
+[ro.boot.hardware]: [qcom]
+[ro.boot.selinux]: [disable]
+[ro.boot.serialno]: [<EMMC_SERIAL>]
+[ro.bootloader]: [unknown]
+[ro.bootmode]: [unknown]
+[ro.build.characteristics]: [default]
+[ro.build.date.utc]: [1783571228]
+[ro.build.date]: [2026年 07月 09日 星期四 12:27:08 CST]
+[ro.build.description]: [msm8916_32_512-user 4.4.4 KTU84P eng.richal.20260709 test-keys]
+[ro.build.display.id]: [KTU84P test-keys]
+[ro.build.fingerprint]: [qcom/msm8916_32_512/msm8916_32_512:4.4.4/KTU84P/eng.richal.20260709:user/test-keys]
+[ro.build.host]: [msa2]
+[ro.build.id]: [KTU84P]
+[ro.build.product]: [msm8916_32_512]
+[ro.build.tags]: [test-keys]
+[ro.build.type]: [user]
+[ro.build.user]: [richal]
+[ro.build.version.codename]: [REL]
+[ro.build.version.incremental]: [eng.richal.20260709]
+[ro.build.version.release]: [4.4.4]
+[ro.build.version.sdk]: [19]
+[ro.carrier]: [unknown]
+[ro.com.android.dataroaming]: [true]
+[ro.com.android.dateformat]: [MM-dd-yyyy]
+[ro.config.alarm_alert]: [Alarm_Classic.ogg]
+[ro.config.low_ram]: [true]
+[ro.config.notification_sound]: [pixiedust.ogg]
+[ro.config.pppoe_enable]: [1]
+[ro.config.ringtone]: [Ring_Synth_04.ogg]
+[ro.crypto.state]: [unencrypted]
+[ro.debuggable]: [0]
+[ro.factorytest]: [0]
+[ro.fm.transmitter]: [false]
+[ro.gps.agps_provider]: [1]
+[ro.hardware]: [qcom]
+[ro.lockscreen.disable.default]: [true]
+[ro.opengles.version]: [196608]
+[ro.pip.gated]: [0]
+[ro.product.board]: [msm8916]
+[ro.product.brand]: [MIFI]
+[ro.product.cpu.abi2]: [armeabi]
+[ro.product.cpu.abi]: [armeabi-v7a]
+[ro.product.device]: [MIFI]
+[ro.product.locale.language]: [en]
+[ro.product.locale.region]: [US]
+[ro.product.manufacturer]: [unknown]
+[ro.product.model]: [MIFI]
+[ro.product.name]: [MIFI]
+[ro.qc.sdk.audio.fluencetype]: [none]
+[ro.qc.sdk.audio.ssr]: [false]
+[ro.qualcomm.bluetooth.ftp]: [true]
+[ro.qualcomm.bluetooth.hfp]: [true]
+[ro.qualcomm.bluetooth.hsp]: [true]
+[ro.qualcomm.bluetooth.map]: [true]
+[ro.qualcomm.bluetooth.nap]: [true]
+[ro.qualcomm.bluetooth.opp]: [true]
+[ro.qualcomm.bluetooth.pbap]: [true]
+[ro.qualcomm.bt.hci_transport]: [smd]
+[ro.qualcomm.cabl]: [0]
+[ro.revision]: [0]
+[ro.ril.svdo]: [false]
+[ro.ril.svlte1x]: [false]
+[ro.runtime.firstboot]: [86420292]
+[ro.secure]: [1]
+[ro.serialno]: [<EMMC_SERIAL>]
+[ro.sf.lcd_density]: [114]
+[ro.sys.fw.bg_apps_limit]: [16]
+[ro.sys.usb.default.config]: [diag,serial_smd,rmnet_bam,adb]
+[ro.telephony.call_ring.multiple]: [false]
+[ro.telephony.default_cdma_sub]: [0]
+[ro.telephony.default_network]: [11]
+[ro.use_data_netmgrd]: [true]
+[ro.vendor.extension_library]: [/vendor/lib/libqc-opt.so]
+[ro.wifi.channels]: []
+[service.bootanim.exit]: [1]
+[swe.tile.height]: [128]
+[swe.tile.maxtile]: [128]
+[swe.tile.width]: [128]
+[sys.boot_completed]: [1]
+[sys.sysctl.extra_free_kbytes]: [192]
+[sys.usb.config]: [diag,serial_smd,rmnet_bam,adb]
+[sys.usb.state]: [diag,serial_smd,rmnet_bam,adb]
+[telephony.lteOnCdmaDevice]: [0]
+[tunnel.audio.encode]: [false]
+[usb_uicc.enabled]: [0]
+[usb_uicc.loading]: [1]
+[use.voice.path.for.pcm.voip]: [true]
+[vold.post_fs_data_done]: [1]
+[wifi.interface]: [wlan0]
+[wlan.driver.ath]: [0]
+[wlan.driver.config]: [/data/misc/wifi/WCNSS_qcom_cfg.ini]
+[wlan.driver.status]: [ok]
--- a/android/gpio.txt
+++ b/android/gpio.txt
@ -0,0 +1,31 @@
+GPIOs 581-612, platform/qcom,smp2pgpio-ssr-smp2p-4-out.19, master-kernel:
+
+GPIOs 613-644, platform/qcom,smp2pgpio-ssr-smp2p-4-in.18, slave-kernel:
+
+GPIOs 645-676, platform/qcom,smp2pgpio-ssr-smp2p-1-out.13, master-kernel:
+
+GPIOs 677-708, platform/qcom,smp2pgpio-ssr-smp2p-1-in.12, slave-kernel:
+
+GPIOs 709-740, platform/qcom,smp2pgpio-smp2p-4-out.16, smp2p:
+
+GPIOs 741-772, platform/qcom,smp2pgpio-smp2p-4-in.14, smp2p:
+
+GPIOs 773-804, platform/qcom,smp2pgpio-smp2p-1-out.10, smp2p:
+
+GPIOs 805-836, platform/qcom,smp2pgpio-smp2p-1-in.8, smp2p:
+
+GPIOs 837-868, platform/qcom,smp2pgpio-smp2p-7-out.6, smp2p:
+
+GPIOs 869-900, platform/qcom,smp2pgpio-smp2p-7-in.4, smp2p:
+
+GPIOs 901-901, spmi/qpnp-pin-de735200, pm8916-mpp:
+
+GPIOs 902-1023, platform/1000000.pinctrl, msm_tlmm_v4_gpio:
+ gpio-903 (sim3_switch_gpio    ) out hi
+ gpio-922 (sim_hotdet_gpio     ) out lo
+ gpio-924 (sim1_switch_gpio    ) out lo
+ gpio-925 (sim2_switch_gpio    ) out lo
+ gpio-939 (key_f2              ) in  lo
+ gpio-1009 (key_f3              ) in  hi
+ gpio-1018 (disp_dc             ) in  hi
+ gpio-1020 (disp_rst_n          ) in  hi
--- a/android/init-rc.txt
+++ b/android/init-rc.txt
@ -0,0 +1,302 @@
+-rwxr-x--- root     root         1171 1970-01-01 08:00 init.environ.rc
+-rwxr-x--- root     root        26376 1970-01-01 08:00 init.qcom.rc
+-rwxr-x--- root     root        53658 1970-01-01 08:00 init.qcom.usb.rc
+-rwxr-x--- root     root         2247 1970-01-01 08:00 init.qti.carrier.rc
+-rwxr-x--- root     root        28234 1970-01-01 08:00 init.rc
+-rwxr-x--- root     root         5802 1970-01-01 08:00 init.target.rc
+-rwxr-x--- root     root         1795 1970-01-01 08:00 init.trace.rc
+-rwxr-x--- root     root         3915 1970-01-01 08:00 init.usb.rc
+-rw-r--r-- root     root         9740 1970-01-01 08:00 ueventd.qcom.rc
+-rw-r--r-- root     root         4023 1970-01-01 08:00 ueventd.rc
+/system/bin/sh: cat: /init.environ.rc: Permission denied
+/system/bin/sh: cat: /init.qcom.rc: Permission denied
+/system/bin/sh: cat: /init.qcom.usb.rc: Permission denied
+/system/bin/sh: cat: /init.qti.carrier.rc: Permission denied
+/system/bin/sh: cat: /init.rc: Permission denied
+/system/bin/sh: cat: /init.target.rc: Permission denied
+/system/bin/sh: cat: /init.trace.rc: Permission denied
+/system/bin/sh: cat: /init.usb.rc: Permission denied
+# Copyright (c) 2012-2014, The Linux Foundation. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+#     * Redistributions of source code must retain the above copyright
+#       notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above copyright
+#       notice, this list of conditions and the following disclaimer in the
+#       documentation and/or other materials provided with the distribution.
+#     * Neither the name of The Linux Foundation nor
+#       the names of its contributors may be used to endorse or promote
+#       products derived from this software without specific prior written
+#       permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+# NON-INFRINGEMENT ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+# EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
+# OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+
+# the DIAG device node is not world writable/readable.
+/dev/diag                 0660   system     qcom_diag
+
+/dev/genlock              0666   system     system
+/dev/kgsl                 0666   system     system
+/dev/kgsl-3d0             0666   system     system
+/dev/kgsl-2d0             0666   root       root
+/dev/kgsl-2d1             0666   root       root
+/dev/ion                  0664   system     system
+/dev/rtc0                 0600   system     system
+/dev/smd0                 0660   system     system
+/dev/smd4                 0660   system     system
+/dev/smd_cxm_qmi          0640   radio      radio
+/dev/smd5                 0660   system     system
+/dev/smd6                 0660   system     system
+/dev/smd7                 0660   bluetooth  bluetooth
+/dev/ccid_bridge          0660   system     system
+
+#permissions for CSVT
+/dev/smd11                0660   radio      radio
+
+/dev/radio0               0640   system     system
+/dev/rfcomm0              0660   bluetooth  bluetooth
+/dev/ttyUSB0              0660   bluetooth  bluetooth
+/dev/smdcntl0             0640   radio      radio
+/dev/smdcntl1             0640   radio      radio
+/dev/smdcntl2             0640   radio      radio
+/dev/smdcntl3             0640   radio      radio
+/dev/smdcntl4             0640   radio      radio
+/dev/smdcntl5             0640   radio      radio
+/dev/smdcntl6             0640   radio      radio
+/dev/smdcntl7             0640   radio      radio
+/dev/smdcnt_rev0          0640   radio      radio
+/dev/smdcnt_rev1          0640   radio      radio
+/dev/smdcnt_rev2          0640   radio      radio
+/dev/smdcnt_rev3          0640   radio      radio
+/dev/smdcnt_rev4          0640   radio      radio
+/dev/smdcnt_rev5          0640   radio      radio
+/dev/smdcnt_rev6          0640   radio      radio
+/dev/smdcnt_rev7          0640   radio      radio
+/dev/smdcnt_rev8          0640   radio      radio
+/dev/smuxctl32            0640   radio      radio
+/dev/sdioctl0             0640   radio      radio
+/dev/sdioctl1             0640   radio      radio
+/dev/sdioctl2             0640   radio      radio
+/dev/sdioctl3             0640   radio      radio
+/dev/sdioctl4             0640   radio      radio
+/dev/sdioctl5             0640   radio      radio
+/dev/sdioctl6             0640   radio      radio
+/dev/sdioctl7             0640   radio      radio
+/dev/sdioctl8             0640   radio      radio
+/dev/rmnet_mux_ctrl       0640   radio      radio
+/dev/hsicctl0             0640   radio      radio
+/dev/hsicctl1             0640   radio      radio
+/dev/hsicctl2             0640   radio      radio
+/dev/hsicctl3             0640   radio      radio
+/dev/hsicctl4             0640   radio      radio
+/dev/hsicctl5             0640   radio      radio
+/dev/hsicctl6             0640   radio      radio
+/dev/hsicctl7             0640   radio      radio
+/dev/hsicctl8             0640   radio      radio
+/dev/hsicctl9             0640   radio      radio
+/dev/hsicctl10            0640   radio      radio
+/dev/hsicctl11            0640   radio      radio
+/dev/hsicctl12            0640   radio      radio
+/dev/hsicctl13            0640   radio      radio
+/dev/hsicctl14            0640   radio      radio
+/dev/hsicctl15            0640   radio      radio
+/dev/hsicctl16            0640   radio      radio
+/dev/mhi_pipe_14          0640   radio      radio
+/dev/mhi_pipe_16          0640   radio      radio
+/dev/mhi_pipe_32          0640   radio      radio
+/dev/video*               0660   system     camera
+/dev/media*               0660   system     camera
+/dev/v4l-subdev*          0660   system     camera
+/dev/qseecom              0660   system     drmrpc
+/dev/gemini0              0660   system     camera
+/dev/jpeg0                0660   system     camera
+/dev/jpeg1                0660   system     camera
+/dev/jpeg2                0660   system     camera
+/dev/adsprpc-smd          0664   system     system
+/dev/msm_camera/*         0660   system     camera
+/dev/gemini/              0660   system     camera
+/dev/mercury0             0660   system     camera
+/dev/msm_vidc_reg         0660   system     audio
+/dev/msm_vidc_dec         0660   system     audio
+/dev/msm_vidc_dec_sec     0660   system     audio
+/dev/msm_vidc_enc         0660   system     audio
+/dev/msm_rotator          0660   system     system
+/dev/hw_random            0600   root       root
+/dev/adsprpc-smd          0664   system     system
+
+#permissions for audio
+/dev/audio_slimslave      0660   system     audio
+/dev/msm_qcelp            0660   system     audio
+/dev/msm_evrc             0660   system     audio
+/dev/msm_wma              0660   system     audio
+/dev/msm_wmapro           0660   system     audio
+/dev/msm_amrnb            0660   system     audio
+/dev/msm_amrwb            0660   system     audio
+/dev/msm_amrwbplus        0660   system     audio
+/dev/msm_aac              0660   system     audio
+/dev/msm_multi_aac        0660   system     audio
+/dev/msm_aac_in           0660   system     audio
+/dev/msm_qcelp_in         0660   system     audio
+/dev/msm_evrc_in          0660   system     audio
+/dev/msm_amrnb_in         0640   system     audio
+/dev/msm_a2dp_in          0660   system     audio
+/dev/msm_ac3              0660   system     audio
+/dev/msm_acdb             0660   system     audio
+/dev/msm_cad              0660   system     audio
+/dev/msm_fm               0660   system     audio
+/dev/msm_mvs              0660   system     audio
+/dev/msm_pcm_lp_dec       0660   system     audio
+/dev/msm_preproc_ctl      0660   system     audio
+/dev/msm_rtac             0660   system     audio
+/dev/msm_voicememo        0660   system     audio
+/dev/radio0               0640   fm_radio   fm_radio
+/dev/smd3                 0660   bluetooth  net_bt_stack
+/dev/smd2                 0660   bluetooth  net_bt_stack
+/dev/ttyHSL1              0660   system     system
+/dev/ttyHS1               0660   system     system
+/dev/mdm                  0660   system     radio
+/sys/devices/virtual/smdpkt/smdcntl*       open_timeout   0664 radio radio
+/dev/sdio_tty_ciq_00      0660   system     system
+/dev/tty_sdio_00          0660   system     system
+/dev/ttyGS0               0660   system     system
+/dev/i2c-5                0660   media       media
+/dev/voice_svc            0660   system     audio
+
+# DVB devices
+/dev/dvb/adapter0/demux*  0440   media       media
+/dev/dvb/adapter0/dvr*    0660   media       media
+/dev/dvb/adapter0/video*  0660   media       media
+
+# Broadcast devices
+/dev/tsc_mux0             0660   media       media
+/dev/tsc_ci0              0660   media       media
+
+# sensors
+/sys/devices/i2c-12/12-*  pollrate_ms 0664 system system
+/sys/devices/f9925000.i2c/i2c-0/0-*                 enable         0660    input    system
+/sys/devices/f9925000.i2c/i2c-0/0-*                 poll_delay     0660    input    system
+/sys/devices/soc.0/78b6000.i2c/i2c-0/0-*            enable         0660    input    system
+/sys/devices/soc.0/78b6000.i2c/i2c-0/0-*            poll_delay     0660    input    system
+/sys/devices/virtual/optical_sensors/proximity      ps_adc         0660    input    system
+/sys/devices/virtual/optical_sensors/proximity      ps_poll_delay  0660    input    system
+/sys/devices/virtual/optical_sensors/lightsensor    ls_auto        0660    input    system
+/sys/devices/virtual/optical_sensors/lightsensor    ls_poll_delay  0660    input    system
+/sys/devices/virtual/input/input*                   poll           0660    input    system
+/sys/devices/virtual/input/input*                   pollrate_ms    0660    input    system
+
+# vm_bms
+/dev/vm_bms               0660   system     system
+/dev/battery_data         0660   system     system
+
+# wlan
+/dev/wcnss_wlan           0660   system     system
+/dev/wcnss_ctrl           0660   system     system
+#nfc permissions
+/dev/nfc-nci              0660    nfc         nfc
+/dev/assd                 0660    nfc         nfc
+
+# UIO devices
+/dev/uio0                 0660   system     system
+/dev/uio1                 0660   system     system
+/dev/uio2                 0660   system     system
+
+# ESOC devices
+/dev/subsys_esoc*         0640   system     radio
+/dev/null                 0666   root       root
+/dev/zero                 0666   root       root
+/dev/full                 0666   root       root
+/dev/ptmx                 0666   root       root
+/dev/tty                  0666   root       root
+/dev/random               0666   root       root
+/dev/urandom              0666   root       root
+/dev/ashmem               0666   root       root
+/dev/binder               0666   root       root
+
+# Anyone can read the logs, but if they're not in the "logs"
+# group, then they'll only see log entries for their UID.
+/dev/log/*                0666   root       log
+
+# the msm hw3d client device node is world writable/readable
+/dev/msm_hw3dc            0666   root       root
+
+# gpu driver for adreno200 is globally accessible
+/dev/kgsl                 0666   root       root
+
+# kms driver for drm based gpu
+/dev/dri/*                0666   root       graphics
+
+# these should not be world writable
+/dev/diag                 0660   radio      radio
+/dev/diag_arm9            0660   radio      radio
+/dev/android_adb          0660   adb        adb
+/dev/android_adb_enable   0660   adb        adb
+/dev/ttyMSM0              0600   bluetooth  bluetooth
+/dev/uhid                 0660   system     net_bt_stack
+/dev/uinput               0660   system     net_bt_stack
+/dev/alarm                0664   system     radio
+/dev/tty0                 0660   root       system
+/dev/graphics/*           0660   system     graphics
+/dev/msm_hw3dm            0660   system     graphics
+/dev/input/*              0660   root       input
+/dev/eac                  0660   root       audio
+/dev/cam                  0660   root       camera
+/dev/pmem                 0660   system     graphics
+/dev/pmem_adsp*           0660   system     audio
+/dev/pmem_camera*         0660   system     camera
+/dev/oncrpc/*             0660   root       system
+/dev/adsp/*               0660   system     audio
+/dev/snd/*                0660   system     audio
+/dev/mt9t013              0660   system     system
+/dev/msm_camera/*         0660   system     system
+/dev/akm8976_daemon       0640   compass    system
+/dev/akm8976_aot          0640   compass    system
+/dev/akm8973_daemon       0640   compass    system
+/dev/akm8973_aot          0640   compass    system
+/dev/bma150               0640   compass    system
+/dev/cm3602               0640   compass    system
+/dev/akm8976_pffd         0640   compass    system
+/dev/lightsensor          0640   system     system
+/dev/msm_pcm_out*         0660   system     audio
+/dev/msm_pcm_in*          0660   system     audio
+/dev/msm_pcm_ctl*         0660   system     audio
+/dev/msm_snd*             0660   system     audio
+/dev/msm_mp3*             0660   system     audio
+/dev/audience_a1026*      0660   system     audio
+/dev/tpa2018d1*           0660   system     audio
+/dev/msm_audpre           0660   system     audio
+/dev/msm_audio_ctl        0660   system     audio
+/dev/htc-acoustic         0660   system     audio
+/dev/vdec                 0660   system     audio
+/dev/q6venc               0660   system     audio
+/dev/snd/dsp              0660   system     audio
+/dev/snd/dsp1             0660   system     audio
+/dev/snd/mixer            0660   system     audio
+/dev/smd0                 0640   radio      radio
+/dev/qmi                  0640   radio      radio
+/dev/qmi0                 0640   radio      radio
+/dev/qmi1                 0640   radio      radio
+/dev/qmi2                 0640   radio      radio
+/dev/bus/usb/*            0660   root       usb
+/dev/mtp_usb              0660   root       mtp
+/dev/usb_accessory        0660   root       usb
+/dev/tun                  0660   system     vpn
+
+# CDMA radio interface MUX
+/dev/ts0710mux*           0640   radio      radio
+/dev/ppp                  0660   radio      vpn
+
+# sysfs properties
+/sys/devices/virtual/input/input*   enable      0660  root   input
+/sys/devices/virtual/input/input*   poll_delay  0660  root   input
+/sys/devices/virtual/usb_composite/*   enable      0664  root   system
--- a/android/input.txt
+++ b/android/input.txt
@ -0,0 +1,40 @@
+I: Bus=0000 Vendor=0000 Product=0000 Version=0000
+N: Name="qpnp_pon"
+P: Phys=qpnp_pon/input0
+S: Sysfs=/devices/virtual/input/input0
+U: Uniq=
+H: Handlers=kbd event0 
+B: PROP=10
+B: EV=3
+B: KEY=100000 0 8000000 0
+
+I: Bus=0019 Vendor=0001 Product=0001 Version=0100
+N: Name="gpio-keys"
+P: Phys=gpio-keys/input0
+S: Sysfs=/devices/soc.0/gpio_keys.63/input/input1
+U: Uniq=
+H: Handlers=kbd event1 
+B: PROP=0
+B: EV=3
+B: KEY=30000000 0
+
+I: Bus=0000 Vendor=0000 Product=0000 Version=0000
+N: Name="msm8x16-snd-card-mtp Button Jack"
+P: Phys=ALSA
+S: Sysfs=/devices/soc.0/sound.62/sound/card0/input2
+U: Uniq=
+H: Handlers=kbd event2 
+B: PROP=0
+B: EV=3
+B: KEY=1e 4 0 0 0 0 0 0 0
+
+I: Bus=0000 Vendor=0000 Product=0000 Version=0000
+N: Name="msm8x16-snd-card-mtp Headset Jack"
+P: Phys=ALSA
+S: Sysfs=/devices/soc.0/sound.62/sound/card0/input3
+U: Uniq=
+H: Handlers=event3 
+B: PROP=0
+B: EV=21
+B: SW=1c054
+
--- a/android/interrupts.txt
+++ b/android/interrupts.txt
@ -0,0 +1,81 @@
+           CPU0       CPU1       CPU2       CPU3       
+ 20:       9008       1664       1113       3097       GIC  arch_timer
+ 35:          0          0          0          0       GIC  apps_wdog_bark
+ 39:          0          0          0          0       GIC  arch_mem_timer
+ 47:          3          0          0          0       GIC  cpr
+ 56:          0          0          0          0       GIC  modem
+ 57:       1222          0          0          0       GIC  qcom,smd-modem
+ 58:         10          0          0          0       GIC  qcom,smsm-modem
+ 59:          5          0          0          0       GIC  smp2p
+ 61:         11          0          0          0       GIC  sps
+ 65:        788          0          0          0       GIC  kgsl-3d0
+ 75:          0          0          0          0       GIC  msm_iommu_global_cfg_irq, msm_iommu_global_cfg_irq
+ 76:          0          0          0          0       GIC  msm_vidc
+ 82:          6          0          0          0       GIC  cci
+ 83:          0          0          0          0       GIC  csid
+ 84:          0          0          0          0       GIC  csid
+ 89:          2          0          0          0       GIC
+102:          0          0          0          0       GIC  msm_iommu_nonsecure_irq, msm_iommu_nonsecure_irq, msm_iommu_nonsecure_irq, msm_iommu_nonsecure_irq, msm_iommu_nonsecure_irq, msm_iommu_nonsecure_irq, msm_iommu_nonsecure_irq, msm_iommu_nonsecure_irq, msm_iommu_secure_irq, msm_iommu_secure_irq, msm_iommu_secure_irq, msm_iommu_secure_irq, msm_iommu_secure_irq, msm_iommu_secure_irq, msm_iommu_nonsecure_irq, msm_iommu_nonsecure_irq, msm_iommu_nonsecure_irq, msm_iommu_nonsecure_irq, msm_iommu_nonsecure_irq, msm_iommu_nonsecure_irq
+104:          0          0          0          0       GIC  MDSS
+110:          0          0          0          0       GIC  csiphy
+111:          0          0          0          0       GIC  csiphy
+130:          0          0          0          0       GIC  78b8000.spi
+155:       6066          0          0          0       GIC  mmc0
+166:       4531          0          0          0       GIC  msm_otg, msm_hsusb
+170:          5          0          0          0       GIC  7824900.sdhci
+172:          0          0          0          0       GIC  msm_otg
+174:        109          0          0          0       GIC  qcom,smd-wcnss
+175:          5          0          0          0       GIC  smp2p
+176:          0          0          0          0       GIC  qcom,smsm-wcnss
+177:         20          0          0          0       GIC  wcnss_wlan
+178:        410          0          0          0       GIC  wcnss_wlan
+181:          0          0          0          0       GIC  wcnss
+200:       2141          0          0          0       GIC  qcom,smd-rpm
+203:          0          0          0          0       GIC  601d0.qcom,mpm
+216:          0          0          0          0       GIC  tsens_interrupt
+222:          2          0          0          0       GIC  200f000.qcom,spmi
+239:          0          0          0          0       GIC  sps
+240:          0          0          0          0       GIC  1000000.pinctrl
+270:        151          0          0          0       GIC  sps
+273:          0          0          0          0       GIC  msm_iommu_nonsecure_irq
+274:          0          0          0          0       GIC  msm_iommu_nonsecure_irq
+288:          0          0          0          0  qpnp-int  qpnp_kpdpwr_status
+289:          0          0          0          0  qpnp-int  qpnp_resin_status
+290:          0          0          0          0  qpnp-int  qpnp_rtc_alarm
+292:          0          0          0          0  qpnp-int  pm8916_tz
+294:          1          0          0          0  qpnp-int  qpnp_adc_tm_high_interrupt
+295:          0          0          0          0  qpnp-int  qpnp_adc_tm_low_interrupt
+297:          0          0          0          0  qpnp-int  chg_failed
+298:          0          0          0          0  qpnp-int  fastchg
+299:          0          0          0          0  qpnp-int  vbatdet_lo
+300:          0          0          0          0  qpnp-int  batt_temp
+301:          0          0          0          0  qpnp-int  batt_pres
+302:          0          0          0          0  qpnp-int  usb_overtemp
+304:          0          0          0          0  qpnp-int  usbin_valid
+309:          1          0          0          0  qpnp-int  fifo_update_done
+310:          0          0          0          0  qpnp-int  fsm_state_change
+314:          0          0          0          0  qpnp-int  Elect Insert
+315:          0          0          0          0  qpnp-int  Button Release detect
+316:          0          0          0          0  qpnp-int  Button Press detect
+317:          0          0          0          0  qpnp-int  Elect Remove
+318:          0          0          0          0  qpnp-int  mbhc sw intr
+320:          0          0          0          0  qpnp-int  HPH_R OCP detect
+321:          0          0          0          0  qpnp-int  HPH_L OCP detect
+421:          0          0          0          0  smp2p_gpio  modem
+422:          1          0          0          0  smp2p_gpio  error_ready_interrupt
+423:          1          0          0          0  smp2p_gpio  modem
+424:          0          0          0          0  smp2p_gpio  modem
+453:          0          0          0          0  smp2p_gpio  wcnss
+454:          1          0          0          0  smp2p_gpio  error_ready_interrupt
+455:          1          0          0          0  smp2p_gpio  wcnss
+456:          0          0          0          0  smp2p_gpio  wcnss
+485:          0          0          0          0  msm_tlmm_v4_irq  key_f2
+486:          0          0          0          0  msm_tlmm_v4_irq  key_f3
+IPI0:          0         12          5          6  CPU wakeup interrupts
+IPI1:          0          0          0          0  Timer broadcast interrupts
+IPI2:       6255       7036       5295       4157  Rescheduling interrupts
+IPI3:         35        145        147        139  Function call interrupts
+IPI4:          5         28         17         18  Single function call interrupts
+IPI5:          0          0          0          0  CPU stop interrupts
+IPI6:          0          0          0          0  CPU backtrace
+Err:          0
--- a/android/leds.txt
+++ b/android/leds.txt
@ -0,0 +1,14 @@
+lrwxrwxrwx root     root              1970-01-01 08:20 lcd-backlight -> ../../devices/soc.0/1a00000.qcom,mdss_mdp/qcom,mdss_fb_primary.119/leds/lcd-backlight
+lrwxrwxrwx root     root              1970-01-01 08:20 lcd-bl -> ../../devices/soc.0/leds-qpnp-de736200/leds/lcd-bl
+lrwxrwxrwx root     root              1970-01-01 08:20 mmc0:: -> ../../devices/soc.0/7824900.sdhci/leds/mmc0::
+lrwxrwxrwx root     root              1970-01-01 08:20 sim1_switch_gpio -> ../../devices/soc.0/gpio-leds.64/leds/sim1_switch_gpio
+lrwxrwxrwx root     root              1970-01-01 08:20 sim2_switch_gpio -> ../../devices/soc.0/gpio-leds.64/leds/sim2_switch_gpio
+lrwxrwxrwx root     root              1970-01-01 08:20 sim3_switch_gpio -> ../../devices/soc.0/gpio-leds.64/leds/sim3_switch_gpio
+lrwxrwxrwx root     root              1970-01-01 08:20 sim_hotdet_gpio -> ../../devices/soc.0/gpio-leds.64/leds/sim_hotdet_gpio
+255
+40
+255
+255
+255
+255
+255
--- a/android/meminfo.txt
+++ b/android/meminfo.txt
@ -0,0 +1,33 @@
+MemTotal:         403480 kB
+MemFree:           40424 kB
+Buffers:            6020 kB
+Cached:           190416 kB
+SwapCached:            0 kB
+Active:           101792 kB
+Inactive:         180448 kB
+Active(anon):      85828 kB
+Inactive(anon):      280 kB
+Active(file):      15964 kB
+Inactive(file):   180168 kB
+Unevictable:           0 kB
+Mlocked:               0 kB
+SwapTotal:        196604 kB
+SwapFree:         196604 kB
+Dirty:                28 kB
+Writeback:             0 kB
+AnonPages:         85836 kB
+Mapped:            60004 kB
+Shmem:               324 kB
+Slab:              39684 kB
+SReclaimable:      20772 kB
+SUnreclaim:        18912 kB
+KernelStack:        5128 kB
+PageTables:         4720 kB
+NFS_Unstable:          0 kB
+Bounce:                0 kB
+WritebackTmp:          0 kB
+CommitLimit:      398344 kB
+Committed_AS:    4390652 kB
+VmallocTotal:     499712 kB
+VmallocUsed:       50600 kB
+VmallocChunk:     316948 kB
--- a/android/modules.txt
+++ b/android/modules.txt
@ -0,0 +1 @@
+wlan 3803637 0 - Live 0x00000000 (O)
--- a/android/mounts.txt
+++ b/android/mounts.txt
@ -0,0 +1,22 @@
+rootfs / rootfs ro,relatime 0 0
+tmpfs /dev tmpfs rw,nosuid,relatime,size=193740k,nr_inodes=48435,mode=755 0 0
+devpts /dev/pts devpts rw,relatime,mode=600 0 0
+proc /proc proc rw,relatime 0 0
+sysfs /sys sysfs rw,relatime 0 0
+debugfs /sys/kernel/debug debugfs rw,relatime 0 0
+none /acct cgroup rw,relatime,cpuacct 0 0
+none /sys/fs/cgroup tmpfs rw,relatime,size=193740k,nr_inodes=48435,mode=750,gid=1000 0 0
+tmpfs /mnt/asec tmpfs rw,relatime,size=193740k,nr_inodes=48435,mode=755,gid=1000 0 0
+tmpfs /mnt/obb tmpfs rw,relatime,size=193740k,nr_inodes=48435,mode=755,gid=1000 0 0
+none /dev/cpuctl cgroup rw,relatime,cpu 0 0
+adb /dev/usb-ffs/adb functionfs rw,relatime 0 0
+/dev/block/bootdevice/by-name/system /system ext4 ro,relatime,discard,data=ordered 0 0
+/dev/block/bootdevice/by-name/userdata /data ext4 rw,nosuid,nodev,relatime,discard,noauto_da_alloc,data=ordered 0 0
+/dev/block/bootdevice/by-name/cache /cache ext4 rw,nosuid,nodev,relatime,data=ordered 0 0
+/dev/block/bootdevice/by-name/persist /persist ext4 rw,nosuid,nodev,relatime,data=ordered 0 0
+/dev/block/bootdevice/by-name/modem /firmware vfat ro,relatime,uid=1000,gid=1000,fmask=0337,dmask=0227,codepage=437,iocharset=iso8859-1,shortname=lower,errors=remount-ro 0 0
+/dev/fuse /mnt/shell/emulated fuse rw,nosuid,nodev,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
+/dev/fuse /storage/sdcard1 fuse rw,nosuid,nodev,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
+/dev/fuse /storage/uicc0 fuse rw,nosuid,nodev,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
+/dev/fuse /storage/usbotg fuse rw,nosuid,nodev,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
+/dev/fuse /storage/emulated/legacy fuse rw,nosuid,nodev,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0
--- a/android/net.txt
+++ b/android/net.txt
@ -0,0 +1,75 @@
+rev_rmnet7 DOWN                                   0.0.0.0/0   0x00001002 <MAC>
+rev_rmnet5 DOWN                                   0.0.0.0/0   0x00001002 <MAC>
+rev_rmnet6 DOWN                                   0.0.0.0/0   0x00001002 <MAC>
+rev_rmnet4 DOWN                                   0.0.0.0/0   0x00001002 <MAC>
+rev_rmnet2 DOWN                                   0.0.0.0/0   0x00001002 <MAC>
+rev_rmnet3 DOWN                                   0.0.0.0/0   0x00001002 <MAC>
+rev_rmnet8 DOWN                                   0.0.0.0/0   0x00001002 <MAC>
+rev_rmnet1 DOWN                                   0.0.0.0/0   0x00001002 <MAC>
+rev_rmnet0 DOWN                                   0.0.0.0/0   0x00001002 <MAC>
+rmnet1   DOWN                                   0.0.0.0/0   0x00000000 <MAC>
+rmnet0   DOWN                                   0.0.0.0/0   0x00000000 <MAC>
+rmnet7   DOWN                                   0.0.0.0/0   0x00000000 <MAC>
+rmnet5   DOWN                                   0.0.0.0/0   0x00000000 <MAC>
+rmnet6   DOWN                                   0.0.0.0/0   0x00000000 <MAC>
+rmnet4   DOWN                                   0.0.0.0/0   0x00000000 <MAC>
+rmnet2   DOWN                                   0.0.0.0/0   0x00000000 <MAC>
+rmnet3   DOWN                                   0.0.0.0/0   0x00000000 <MAC>
+dummy0   DOWN                                   0.0.0.0/0   0x00000082 <MAC>
+rmnet_usb0 DOWN                                   0.0.0.0/0   0x00001002 <MAC>
+sit0     DOWN                                   0.0.0.0/0   0x00000080 <MAC>
+lo       UP                                   127.0.0.1/8   0x00000049 <MAC>
+wlan0    UP                               192.168.100.1/24  0x00001043 <MAC>
+1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN 
+    link/loopback <MAC> brd <MAC>
+    inet 127.0.0.1/8 scope host lo
+       valid_lft forever preferred_lft forever
+    inet6 ::1/128 scope host 
+       valid_lft forever preferred_lft forever
+2: dummy0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN 
+    link/ether <MAC> brd <MAC>
+3: rmnet0: <> mtu 2000 qdisc noop state DOWN qlen 1000
+    link/[530] 
+4: rmnet1: <> mtu 2000 qdisc noop state DOWN qlen 1000
+    link/[530] 
+5: rmnet2: <> mtu 2000 qdisc noop state DOWN qlen 1000
+    link/[530] 
+6: rmnet3: <> mtu 2000 qdisc noop state DOWN qlen 1000
+    link/[530] 
+7: rmnet4: <> mtu 2000 qdisc noop state DOWN qlen 1000
+    link/[530] 
+8: rmnet5: <> mtu 2000 qdisc noop state DOWN qlen 1000
+    link/[530] 
+9: rmnet6: <> mtu 2000 qdisc noop state DOWN qlen 1000
+    link/[530] 
+10: rmnet7: <> mtu 2000 qdisc noop state DOWN qlen 1000
+    link/[530] 
+11: rmnet_usb0: <BROADCAST,MULTICAST> mtu 2000 qdisc noop state DOWN qlen 1000
+    link/ether <MAC> brd <MAC>
+12: rev_rmnet0: <BROADCAST,MULTICAST> mtu 2000 qdisc noop state DOWN qlen 1000
+    link/ether <MAC> brd <MAC>
+13: rev_rmnet1: <BROADCAST,MULTICAST> mtu 2000 qdisc noop state DOWN qlen 1000
+    link/ether <MAC> brd <MAC>
+14: rev_rmnet2: <BROADCAST,MULTICAST> mtu 2000 qdisc noop state DOWN qlen 1000
+    link/ether <MAC> brd <MAC>
+15: rev_rmnet3: <BROADCAST,MULTICAST> mtu 2000 qdisc noop state DOWN qlen 1000
+    link/ether <MAC> brd <MAC>
+16: rev_rmnet4: <BROADCAST,MULTICAST> mtu 2000 qdisc noop state DOWN qlen 1000
+    link/ether <MAC> brd <MAC>
+17: rev_rmnet5: <BROADCAST,MULTICAST> mtu 2000 qdisc noop state DOWN qlen 1000
+    link/ether <MAC> brd <MAC>
+18: rev_rmnet6: <BROADCAST,MULTICAST> mtu 2000 qdisc noop state DOWN qlen 1000
+    link/ether <MAC> brd <MAC>
+19: rev_rmnet7: <BROADCAST,MULTICAST> mtu 2000 qdisc noop state DOWN qlen 1000
+    link/ether <MAC> brd <MAC>
+20: rev_rmnet8: <BROADCAST,MULTICAST> mtu 2000 qdisc noop state DOWN qlen 1000
+    link/ether <MAC> brd <MAC>
+21: sit0: <NOARP> mtu 1480 qdisc noop state DOWN 
+    link/sit 0.0.0.0 brd 0.0.0.0
+22: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
+    link/ether <MAC> brd <MAC>
+    inet 192.168.100.1/24 brd 192.168.100.255 scope global wlan0
+       valid_lft forever preferred_lft forever
+    inet6 fe80::2ee:f2ff:fe87:440/64 scope link 
+       valid_lft forever preferred_lft forever
+192.168.100.0/24 dev wlan0  proto kernel  scope link  src 192.168.100.1 
--- a/android/partitions.txt
+++ b/android/partitions.txt
@ -0,0 +1,32 @@
+major minor  #blocks  name
+
+ 253        0     196608 zram0
+ 179        0    3817472 mmcblk0
+ 179        1      65536 mmcblk0p1
+ 179        2        512 mmcblk0p2
+ 179        3        512 mmcblk0p3
+ 179        4       1024 mmcblk0p4
+ 179        5       1024 mmcblk0p5
+ 179        6        512 mmcblk0p6
+ 179        7        512 mmcblk0p7
+ 179        8        512 mmcblk0p8
+ 179        9        512 mmcblk0p9
+ 179       10        512 mmcblk0p10
+ 179       11        512 mmcblk0p11
+ 179       12       1024 mmcblk0p12
+ 179       13       1536 mmcblk0p13
+ 179       14       1536 mmcblk0p14
+ 179       15       1024 mmcblk0p15
+ 179       16          1 mmcblk0p16
+ 179       17          8 mmcblk0p17
+ 179       18      10240 mmcblk0p18
+ 179       19         32 mmcblk0p19
+ 179       20       1536 mmcblk0p20
+ 179       21         16 mmcblk0p21
+ 179       22      16384 mmcblk0p22
+ 179       23     819200 mmcblk0p23
+ 179       24      32768 mmcblk0p24
+ 179       25     131072 mmcblk0p25
+ 179       26      16384 mmcblk0p26
+ 179       27    2603455 mmcblk0p27
+ 179       32       4096 mmcblk0rpmb
--- a/android/power_supply.txt
+++ b/android/power_supply.txt
@ -0,0 +1,35 @@
+POWER_SUPPLY_NAME=battery
+POWER_SUPPLY_CHARGING_ENABLED=1
+POWER_SUPPLY_STATUS=Charging
+POWER_SUPPLY_CHARGE_TYPE=Fast
+POWER_SUPPLY_HEALTH=Good
+POWER_SUPPLY_PRESENT=1
+POWER_SUPPLY_VOLTAGE_MAX_DESIGN=4200000
+POWER_SUPPLY_VOLTAGE_MIN_DESIGN=4308000
+POWER_SUPPLY_VOLTAGE_NOW=3890842
+POWER_SUPPLY_CAPACITY=24
+POWER_SUPPLY_CURRENT_NOW=-411638
+POWER_SUPPLY_TEMP=214
+POWER_SUPPLY_TEMP_COOL=100
+POWER_SUPPLY_TEMP_WARM=450
+POWER_SUPPLY_SYSTEM_TEMP_LEVEL=0
+POWER_SUPPLY_NAME=bms
+POWER_SUPPLY_CAPACITY=24
+POWER_SUPPLY_STATUS=Charging
+POWER_SUPPLY_RESISTANCE=210
+POWER_SUPPLY_RESISTANCE_CAPACITIVE=50
+POWER_SUPPLY_CURRENT_NOW=-411638
+POWER_SUPPLY_VOLTAGE_OCV=3752694
+POWER_SUPPLY_HI_POWER=0
+POWER_SUPPLY_LOW_POWER=1
+POWER_SUPPLY_BATTERY_TYPE=palladium_1500mah
+POWER_SUPPLY_TEMP=214
+POWER_SUPPLY_NAME=usb
+POWER_SUPPLY_HEALTH=Unknown
+POWER_SUPPLY_PRESENT=1
+POWER_SUPPLY_ONLINE=1
+POWER_SUPPLY_VOLTAGE_MAX=0
+POWER_SUPPLY_CURRENT_MAX=500000
+POWER_SUPPLY_SCOPE=Device
+POWER_SUPPLY_TYPE=USB
+POWER_SUPPLY_VOLTAGE_NOW=-19
--- a/android/ps.txt
+++ b/android/ps.txt
@ -0,0 +1,230 @@
+USER     PID   PPID  VSIZE  RSS     WCHAN    PC         NAME
+root      1     0     704    536   ffffffff 00000000 S /init
+root      2     0     0      0     ffffffff 00000000 S kthreadd
+root      3     2     0      0     ffffffff 00000000 S ksoftirqd/0
+root      4     2     0      0     ffffffff 00000000 S kworker/0:0
+root      5     2     0      0     ffffffff 00000000 S kworker/0:0H
+root      6     2     0      0     ffffffff 00000000 D kworker/u8:0
+root      7     2     0      0     ffffffff 00000000 S migration/0
+root      8     2     0      0     ffffffff 00000000 S rcuc/0
+root      9     2     0      0     ffffffff 00000000 S rcub/0
+root      10    2     0      0     ffffffff 00000000 S rcu_preempt
+root      11    2     0      0     ffffffff 00000000 S rcu_bh
+root      12    2     0      0     ffffffff 00000000 S rcu_sched
+root      13    2     0      0     ffffffff 00000000 S watchdog/0
+root      14    2     0      0     ffffffff 00000000 S watchdog/1
+root      15    2     0      0     ffffffff 00000000 S rcuc/1
+root      16    2     0      0     ffffffff 00000000 S migration/1
+root      17    2     0      0     ffffffff 00000000 S ksoftirqd/1
+root      18    2     0      0     ffffffff 00000000 S kworker/1:0
+root      19    2     0      0     ffffffff 00000000 S kworker/1:0H
+root      20    2     0      0     ffffffff 00000000 S watchdog/2
+root      21    2     0      0     ffffffff 00000000 S rcuc/2
+root      22    2     0      0     ffffffff 00000000 S migration/2
+root      23    2     0      0     ffffffff 00000000 S ksoftirqd/2
+root      24    2     0      0     ffffffff 00000000 S kworker/2:0
+root      25    2     0      0     ffffffff 00000000 S kworker/2:0H
+root      26    2     0      0     ffffffff 00000000 R watchdog/3
+root      27    2     0      0     ffffffff 00000000 R rcuc/3
+root      28    2     0      0     ffffffff 00000000 R migration/3
+root      29    2     0      0     ffffffff 00000000 R ksoftirqd/3
+root      30    2     0      0     ffffffff 00000000 S kworker/3:0
+root      31    2     0      0     ffffffff 00000000 S kworker/3:0H
+root      32    2     0      0     ffffffff 00000000 S khelper
+root      33    2     0      0     ffffffff 00000000 S netns
+root      34    2     0      0     ffffffff 00000000 S kworker/0:1
+root      35    2     0      0     ffffffff 00000000 S kworker/3:1
+root      36    2     0      0     ffffffff 00000000 S kworker/2:1
+root      37    2     0      0     ffffffff 00000000 S kworker/1:1
+root      38    2     0      0     ffffffff 00000000 S kworker/0:1H
+root      39    2     0      0     ffffffff 00000000 S smd_channel_clo
+root      40    2     0      0     ffffffff 00000000 S smsm_cb_wq
+root      41    2     0      0     ffffffff 00000000 S kworker/u8:1
+root      42    2     0      0     ffffffff 00000000 D kworker/u9:0
+root      43    2     0      0     ffffffff 00000000 S rpm-smd
+root      44    2     0      0     ffffffff 00000000 S kworker/u9:1
+root      45    2     0      0     ffffffff 00000000 S irq/47-cpr
+root      46    2     0      0     ffffffff 00000000 S deferwq
+root      47    2     0      0     ffffffff 00000000 S mpm
+root      48    2     0      0     ffffffff 00000000 S kworker/u8:2
+root      49    2     0      0     ffffffff 00000000 S writeback
+root      50    2     0      0     ffffffff 00000000 S bioset
+root      51    2     0      0     ffffffff 00000000 S kblockd
+root      52    2     0      0     ffffffff 00000000 S khubd
+root      53    2     0      0     ffffffff 00000000 S system
+root      54    2     0      0     ffffffff 00000000 S irq/75-msm_iomm
+root      55    2     0      0     ffffffff 00000000 S irq/75-msm_iomm
+root      56    2     0      0     ffffffff 00000000 S irq/273-msm_iom
+root      57    2     0      0     ffffffff 00000000 S irq/274-msm_iom
+root      58    2     0      0     ffffffff 00000000 S irq/102-msm_iom
+root      59    2     0      0     ffffffff 00000000 S irq/102-msm_iom
+root      60    2     0      0     ffffffff 00000000 S irq/102-msm_iom
+root      61    2     0      0     ffffffff 00000000 S irq/102-msm_iom
+root      62    2     0      0     ffffffff 00000000 S irq/102-msm_iom
+root      63    2     0      0     ffffffff 00000000 S irq/102-msm_iom
+root      64    2     0      0     ffffffff 00000000 S irq/102-msm_iom
+root      65    2     0      0     ffffffff 00000000 S irq/102-msm_iom
+root      66    2     0      0     ffffffff 00000000 S irq/102-msm_iom
+root      67    2     0      0     ffffffff 00000000 S irq/102-msm_iom
+root      68    2     0      0     ffffffff 00000000 S irq/102-msm_iom
+root      69    2     0      0     ffffffff 00000000 S irq/102-msm_iom
+root      70    2     0      0     ffffffff 00000000 S irq/102-msm_iom
+root      71    2     0      0     ffffffff 00000000 S irq/102-msm_iom
+root      72    2     0      0     ffffffff 00000000 S irq/102-msm_iom
+root      73    2     0      0     ffffffff 00000000 S irq/102-msm_iom
+root      74    2     0      0     ffffffff 00000000 S irq/102-msm_iom
+root      75    2     0      0     ffffffff 00000000 S irq/102-msm_iom
+root      76    2     0      0     ffffffff 00000000 S irq/102-msm_iom
+root      77    2     0      0     ffffffff 00000000 S irq/102-msm_iom
+root      78    2     0      0     ffffffff 00000000 S devfreq_wq
+root      79    2     0      0     ffffffff 00000000 S cfg80211
+root      80    2     0      0     ffffffff 00000000 S kswapd0
+root      81    2     0      0     ffffffff 00000000 S ksmd
+root      82    2     0      0     ffffffff 00000000 S fsnotify_mark
+root      83    2     0      0     ffffffff 00000000 S crypto
+root      102   2     0      0     ffffffff 00000000 S apr_driver
+root      103   2     0      0     ffffffff 00000000 S pil_vote_wq
+root      104   2     0      0     ffffffff 00000000 S mem_share_svc
+root      105   2     0      0     ffffffff 00000000 S qmi_hndl0000000
+root      106   2     0      0     ffffffff 00000000 S kworker/0:2
+root      107   2     0      0     ffffffff 00000000 S diag_real_time_
+root      108   2     0      0     ffffffff 00000000 S diag_modem_data
+root      109   2     0      0     ffffffff 00000000 S diag_lpass_data
+root      110   2     0      0     ffffffff 00000000 S diag_wcnss_data
+root      111   2     0      0     ffffffff 00000000 S diag_wq
+root      112   2     0      0     ffffffff 00000000 S diag_usb_wq
+root      113   2     0      0     ffffffff 00000000 S diag_cntl_wq
+root      114   2     0      0     ffffffff 00000000 S diag_dci_wq
+root      115   2     0      0     ffffffff 00000000 S kgsl-3d0
+root      116   2     0      0     ffffffff 00000000 S kgsl-events
+root      117   2     0      0     ffffffff 00000000 S kgsl_devfreq_wq
+root      118   2     0      0     ffffffff 00000000 S proximity_als
+root      119   2     0      0     ffffffff 00000000 S spi0
+root      122   2     0      0     ffffffff 00000000 S usbnet
+root      123   2     0      0     ffffffff 00000000 S kworker/0:3
+root      124   2     0      0     ffffffff 00000000 S k_gserial
+root      125   2     0      0     ffffffff 00000000 S uether
+root      126   2     0      0     ffffffff 00000000 S kpsmoused
+root      129   2     0      0     ffffffff 00000000 S msm_cpp_workque
+root      130   2     0      0     ffffffff 00000000 S cfinteractive
+root      131   2     0      0     ffffffff 00000000 S irq/170-7824900
+root      132   2     0      0     ffffffff 00000000 S binder
+root      133   2     0      0     ffffffff 00000000 S usb_bam_wq
+root      134   2     0      0     ffffffff 00000000 S krfcommd
+root      135   2     0      0     ffffffff 00000000 S msm_ipc_router
+root      136   2     0      0     ffffffff 00000000 S kworker/u8:3
+root      137   2     0      0     ffffffff 00000000 S irq/455-wcnss
+root      138   2     0      0     ffffffff 00000000 S irq/423-modem
+root      139   2     0      0     ffffffff 00000000 S msm_vidc_worker
+root      140   2     0      0     ffffffff 00000000 S pm_workerq_venu
+root      141   2     0      0     ffffffff 00000000 S mmcqd/0
+root      142   2     0      0     ffffffff 00000000 S mmcqd/0rpmb
+root      143   2     0      0     ffffffff 00000000 S irq/309-fifo_up
+root      144   2     0      0     ffffffff 00000000 S irq/310-fsm_sta
+root      145   2     0      0     ffffffff 00000000 S kworker/1:2
+root      146   2     0      0     ffffffff 00000000 S irq/298-fastchg
+root      147   2     0      0     ffffffff 00000000 S irq/301-batt_pr
+root      148   2     0      0     ffffffff 00000000 S rq_stats
+root      149   2     0      0     ffffffff 00000000 S bam_dmux_rx
+root      150   2     0      0     ffffffff 00000000 S bam_dmux_tx
+root      151   2     0      0     ffffffff 00000000 S f_mtp
+root      152   2     0      0     ffffffff 00000000 S file-storage
+root      153   2     0      0     ffffffff 00000000 S msm_thermal:hot
+root      154   2     0      0     ffffffff 00000000 S msm_thermal:fre
+root      155   2     0      0     ffffffff 00000000 S msm_thermal:the
+root      156   1     548    240   ffffffff 00000000 S /sbin/ueventd
+root      158   2     0      0     ffffffff 00000000 S jbd2/mmcblk0p23
+root      159   2     0      0     ffffffff 00000000 S ext4-dio-unwrit
+root      163   2     0      0     ffffffff 00000000 S jbd2/mmcblk0p27
+root      164   2     0      0     ffffffff 00000000 S ext4-dio-unwrit
+root      166   2     0      0     ffffffff 00000000 S jbd2/mmcblk0p25
+root      167   2     0      0     ffffffff 00000000 S ext4-dio-unwrit
+root      168   2     0      0     ffffffff 00000000 S jbd2/mmcblk0p24
+root      169   2     0      0     ffffffff 00000000 S ext4-dio-unwrit
+root      193   2     0      0     ffffffff 00000000 S IPCRTR
+root      194   2     0      0     ffffffff 00000000 S kworker/u8:4
+root      195   2     0      0     ffffffff 00000000 S modem_IPCRTR
+root      196   2     0      0     ffffffff 00000000 S irq/318-mbhc sw
+root      197   2     0      0     ffffffff 00000000 S irq/316-Button 
+root      198   2     0      0     ffffffff 00000000 S irq/315-Button 
+root      199   2     0      0     ffffffff 00000000 S irq/314-Elect I
+root      200   2     0      0     ffffffff 00000000 S irq/317-Elect R
+root      201   2     0      0     ffffffff 00000000 S irq/321-HPH_L O
+root      202   2     0      0     ffffffff 00000000 S irq/320-HPH_R O
+root      203   1     1436   148   ffffffff 00000000 S /sbin/healthd
+system    204   1     1352   624   ffffffff 00000000 S /system/bin/servicemanager
+root      205   1     4752   1188  ffffffff 00000000 S /system/bin/vold
+system    207   1     2492   816   ffffffff 00000000 S /system/bin/rfs_access
+system    210   1     2484   824   ffffffff 00000000 S /system/bin/qseecomd
+root      211   1     11204  1636  ffffffff 00000000 S /system/bin/netd
+root      212   1     1336   680   ffffffff 00000000 S /system/bin/debuggerd
+radio     213   1     29364  7236  ffffffff 00000000 S /system/bin/rild
+system    214   1     38556  10484 ffffffff 00000000 S /system/bin/surfaceflinger
+root      215   1     317240 41356 ffffffff 00000000 S zygote
+drm       216   1     11028  3604  ffffffff 00000000 S /system/bin/drmserver
+media     218   1     30412  9080  ffffffff 00000000 S /system/bin/mediaserver
+install   219   1     1292   700   ffffffff 00000000 S /system/bin/installd
+keystore  220   1     3660   1344  ffffffff 00000000 S /system/bin/keystore
+root      221   1     5276   1416  ffffffff 00000000 S /system/bin/qcom-system-daemon
+system    224   1     3568   1052  ffffffff 00000000 S /system/bin/ptt_socket_app
+system    226   1     1224   640   ffffffff 00000000 S /system/bin/qrngd
+root      227   1     33872  1512  ffffffff 00000000 S /system/bin/thermal-engine
+root      229   2     0      0     ffffffff 00000000 S kworker/3:1H
+radio     247   1     12376  1320  ffffffff 00000000 S /system/bin/qmuxd
+radio     254   1     9696   1796  ffffffff 00000000 S /system/bin/netmgrd
+gps       257   1     1400   764   ffffffff 00000000 S /system/bin/loc_launcher
+system    259   1     6232   1508  ffffffff 00000000 S /system/bin/ATFWD-daemon
+media_rw  260   1     2776   728   ffffffff 00000000 S /system/bin/sdcard
+media_rw  261   1     3808   696   ffffffff 00000000 S /system/bin/sdcard
+media_rw  263   1     3808   696   ffffffff 00000000 S /system/bin/sdcard
+root      264   2     0      0     ffffffff 00000000 S kworker/1:1H
+media_rw  265   1     3808   696   ffffffff 00000000 S /system/bin/sdcard
+camera    266   1     17612  4848  ffffffff 00000000 S /system/bin/mm-qcamera-daemon
+system    267   1     7928   1260  ffffffff 00000000 S /system/bin/time_daemon
+system    268   1     8052   2580  ffffffff 00000000 S /system/bin/audiod
+system    272   1     4012   1328  ffffffff 00000000 S /system/bin/wcnss_service
+root      273   2     0      0     ffffffff 00000000 S kworker/2:1H
+root      274   1     1404   776   ffffffff 00000000 S /system/bin/sh
+nobody    284   1     6432   824   ffffffff 00000000 S /system/bin/rmt_storage
+shell     295   1     4592   232   ffffffff 00000000 S /sbin/adbd
+root      299   2     0      0     ffffffff 00000000 S k_gsmd
+root      300   2     0      0     ffffffff 00000000 S k_gbam
+root      301   2     0      0     ffffffff 00000000 S gsmd_ctrl
+system    304   1     1360   740   ffffffff 00000000 S /system/bin/vm_bms
+gps       305   257   948    464   ffffffff 00000000 S /system/bin/location-mq
+gps       306   257   5404   696   ffffffff 00000000 S /system/bin/lowi-server
+gps       307   257   14888  1296  ffffffff 00000000 S /system/bin/xtwifi-inet-agent
+gps       308   257   12760  2116  ffffffff 00000000 S /system/bin/xtwifi-client
+gps       310   257   1400   304   ffffffff 00000000 S /system/bin/loc_launcher
+system    355   210   6716   708   ffffffff 00000000 S /system/bin/qseecomd
+root      367   2     0      0     ffffffff 00000000 S kworker/u8:5
+root      411   2     0      0     ffffffff 00000000 S kworker/u8:6
+root      450   2     0      0     ffffffff 00000000 D mdss_fb0
+root      639   2     0      0     ffffffff 00000000 S IPCRTR
+root      654   2     0      0     ffffffff 00000000 S wcnss_IPCRTR
+system    871   215   407004 38404 ffffffff 00000000 S system_server
+u0_a5     935   215   345044 30680 ffffffff 00000000 S com.android.systemui
+u0_a1     992   215   330048 23144 ffffffff 00000000 S android.process.acore
+u0_a10    1012  215   368076 42460 ffffffff 00000000 S com.youdo.server
+u0_a15    1038  215   335028 24372 ffffffff 00000000 S com.android.inputmethod.latin
+radio     1057  215   345352 25816 ffffffff 00000000 S com.android.phone
+system    1070  215   337852 19040 ffffffff 00000000 S com.qualcomm.services.location
+system    1095  215   330552 18348 ffffffff 00000000 S com.qualcomm.location.XT
+radio     1169  215   327164 17708 ffffffff 00000000 S com.qualcomm.qcrilmsgtunnel
+u0_a6     1203  215   327132 22256 ffffffff 00000000 S android.process.media
+system    1219  215   328792 19880 ffffffff 00000000 S com.android.settings
+system    1232  215   326360 18136 ffffffff 00000000 S com.qualcomm.telephony
+root      1251  2     0      0     ffffffff 00000000 S VosWDThread
+root      1253  2     0      0     ffffffff 00000000 S VosMCThread
+root      1254  2     0      0     ffffffff 00000000 S VosTXThread
+root      1255  2     0      0     ffffffff 00000000 S VosRXThread
+root      1274  1     7544   824   ffffffff 00000000 S /system/bin/mpdecision
+root      1289  2     0      0     ffffffff 00000000 S wlan_logging_th
+wifi      1294  211   2732   1292  ffffffff 00000000 S /system/bin/hostapd
+radio     1303  211   0      0     ffffffff 00000000 Z radish
+nobody    1306  211   1332   756   ffffffff 00000000 S /system/bin/dnsmasq
+u0_a3     1334  215   328500 19252 ffffffff 00000000 S com.android.dialer
+u0_a7     1381  215   325060 17276 ffffffff 00000000 S com.android.onetimeinitializer
+system    1395  215   325100 17112 ffffffff 00000000 S com.qualcomm.display
+radio     1444  215   326316 18220 ffffffff 00000000 S com.qualcomm.qti.modemtestmode
+shell     1522  295   1540   720   00000000 b6f694ac R ps
--- a/android/regs.txt
+++ b/android/regs.txt
@ -0,0 +1 @@
+/system/bin/sh: cat: /d/regulator/*/name: No such file or directory
--- a/android/sysclass-ls.txt
+++ b/android/sysclass-ls.txt
--- a/android/thermal.txt
+++ b/android/thermal.txt
@ -0,0 +1,8 @@
+tsens_tz_sensor0
+tsens_tz_sensor1
+tsens_tz_sensor2
+tsens_tz_sensor4
+tsens_tz_sensor5
+pm8916_tz
+bms
+battery
--- a/android/version.txt
+++ b/android/version.txt
@ -0,0 +1 @@
+Linux version 3.10.28 (richal@msa2) (gcc version 4.7 (GCC) ) #1 SMP PREEMPT Tue Apr 14 19:25:03 CST 2026
--- a/b5a/A4-rollback.sh
+++ b/b5a/A4-rollback.sh
@ -0,0 +1,11 @@
+#!/bin/bash
+# B5a rollback — restore pre-B5a state (aboot first, then boot). Needs 9008 (HW EDL: battery on, D+->GND, plug USB, release).
+cd ~/doc/modem/jz08-aurora || exit 1
+L=firehose/007050e100000000_394a2e47cf830150_fhprg_peek.bin ; O=logs/b5a/rollback ; mkdir -p $O
+E(){ edl --loader=$L "$@"; }
+E printgpt > $O/00-printgpt.log 2>&1
+E w aboot bootchain-migration/aboot-lk1st-aurora.pad1M > $O/aboot-w.log 2>&1       # e4addbf8… (forced-fastboot lk1st)
+E r aboot $O/aboot-rb.bin > /dev/null 2>&1 ; cmp bootchain-migration/aboot-lk1st-aurora.pad1M $O/aboot-rb.bin && echo ABOOT_RESTORED
+E w boot partitions/boot.bin > $O/boot-w.log 2>&1                                  # 1342def7… (stock Android boot)
+E r boot $O/boot-rb.bin > /dev/null 2>&1 ; cmp partitions/boot.bin $O/boot-rb.bin && echo BOOT_RESTORED
+sha256sum $O/*.bin
--- a/b5a/A4-write.sh
+++ b/b5a/A4-write.sh
@ -0,0 +1,53 @@
+#!/bin/bash
+# B5a A4 — the ONLY writes: boot, then aboot. Run on 480s ONLY after explicit GO.
+# Stops at the first failed gate. Never runs `edl reset`. Board must be in 05c6:9008.
+cd ~/doc/modem/jz08-aurora || exit 1
+L=firehose/007050e100000000_394a2e47cf830150_fhprg_peek.bin
+O=logs/b5a/A4 ; A3=logs/b5a/A3 ; mkdir -p $O
+BOOT_NEW=b5a/boot-emmc1-16MiB.img              ; BOOT_NEW_SHA=e9579f33c7304cd47f487f2b61cd9226dc04fd3a63775d62b4b95fc15bd3ebff
+ABOOT_NEW=b5a/aboot-lk1st-aurora-autoboot.pad1M ; ABOOT_NEW_SHA=3b8cd2667837fc7083cb28991d849f9b408a07fa743bfd05eafee7b053760f85
+BOOT_OLD_SHA=1342def7e0f0c245385d4bac2852d361537a520abd8a45708618983cdab43c0a
+ABOOT_OLD_SHA=e4addbf80eb86f6ad8b112e5a3115c7b721bbd2cca8cc109d135aeceb6194482
+die(){ echo "STOP: $*"; exit 1; }
+sha(){ sha256sum "$1" | cut -d' ' -f1; }
+E(){ edl --loader=$L "$@"; }
+
+echo "== G0 inputs"
+[ "$(sha $L)" = 53f193500c03248f0d671ab57bfe9ca8a42967e97f28403294b4b3f854075aca ] || die loader
+[ "$(sha $BOOT_NEW)" = $BOOT_NEW_SHA ] || die boot-candidate-sha
+[ "$(sha $ABOOT_NEW)" = $ABOOT_NEW_SHA ] || die aboot-candidate-sha
+[ $(stat -c %s $BOOT_NEW) = 16777216 ] && [ $(stat -c %s $ABOOT_NEW) = 1048576 ] || die sizes
+lsusb | grep -q 05c6:9008 || die "no 9008"
+
+echo "== G1 identity + geometry"
+E printgpt > $O/00-printgpt.log 2>&1 || die printgpt
+grep -aq "Serial: *0x<SAHARA_SERIAL>" $O/00-printgpt.log || grep -aq "Mode detected: firehose" $O/00-printgpt.log || die serial
+grep -a "^boot:" $O/00-printgpt.log | grep -q "Offset 0x000000000c18c000, Length 0x0000000001000000" || die boot-geometry
+grep -a "^aboot:" $O/00-printgpt.log | grep -q "Offset 0x0000000008100000, Length 0x0000000000100000" || die aboot-geometry
+E rs 0 34 $O/pre-gptp.bin >/dev/null 2>&1 ; cmp $O/pre-gptp.bin $A3/gpt-primary-34.bin || die gpt-primary-changed
+E r boot  $O/pre-boot.bin  >/dev/null 2>&1 ; [ "$(sha $O/pre-boot.bin)"  = $BOOT_OLD_SHA ]  || die boot-not-stock
+E r aboot $O/pre-aboot.bin >/dev/null 2>&1 ; [ "$(sha $O/pre-aboot.bin)" = $ABOOT_OLD_SHA ] || die aboot-not-e4addbf8
+
+echo "== W1 boot := emmc1 (LBA 396384, 32768 sectors)"
+E w boot $BOOT_NEW > $O/10-boot-write.log 2>&1 ; echo "rc=$?"; grep -a "Wrote" $O/10-boot-write.log
+E r boot $O/11-boot-readback.bin > $O/11-boot-readback.log 2>&1 || die boot-readback-rc
+sha256sum $BOOT_NEW $O/11-boot-readback.bin
+cmp $BOOT_NEW $O/11-boot-readback.bin || die "BOOT READBACK MISMATCH — do NOT write aboot, do NOT reboot"
+echo BOOT_MATCH
+
+echo "== W2 aboot := lk1st autoboot (LBA 264192, 2048 sectors)"
+E w aboot $ABOOT_NEW > $O/20-aboot-write.log 2>&1 ; echo "rc=$?"; grep -a "Wrote" $O/20-aboot-write.log
+E r aboot $O/21-aboot-readback.bin > $O/21-aboot-readback.log 2>&1 || die aboot-readback-rc
+sha256sum $ABOOT_NEW $O/21-aboot-readback.bin
+cmp $ABOOT_NEW $O/21-aboot-readback.bin || die "ABOOT READBACK MISMATCH — do NOT reboot; roll back aboot"
+echo ABOOT_MATCH
+
+echo "== V post-write: everything else == A3"
+E rs 0 34        $O/post-gptp.bin  >/dev/null 2>&1; cmp $O/post-gptp.bin  $A3/gpt-primary-34.bin || die gptp
+E rs 7634911 33  $O/post-gptb.bin  >/dev/null 2>&1; cmp $O/post-gptb.bin  $A3/gpt-backup-33.bin  || die gptb
+E rs 305184 1024 $O/post-tzbak.bin >/dev/null 2>&1; cmp $O/post-tzbak.bin $A3/tzbak-305184.bin   || die tzbak
+for p in sbl1 rpm tz hyp recovery modemst1 modemst2 fsg fsc persist; do
+  E r $p $O/post-$p.bin >/dev/null 2>&1; cmp $O/post-$p.bin $A3/$p.bin || die "$p changed"; echo "$p == A3"
+done
+(cd $O && sha256sum *.bin > SHA256SUMS)
+echo "B5A_WRITES_VERIFIED — power off fully (USB, then battery) before first autonomous boot"
--- a/b5a/SHA256SUMS
+++ b/b5a/SHA256SUMS
@ -0,0 +1,4 @@
+7b3fb5b36b933b40e2cd099495419cfe954bf018bcd5c6d4337337620168ae67  aboot-lk1st-aurora-autoboot.mbn
+33c452e4b0629b3f46a38091679700af4a3ddec64d3e494ac7ec8ba56a348b5b  lk1st-aurora-autoboot-unsigned.mbn
+3b8cd2667837fc7083cb28991d849f9b408a07fa743bfd05eafee7b053760f85  aboot-lk1st-aurora-autoboot.pad1M
+e9579f33c7304cd47f487f2b61cd9226dc04fd3a63775d62b4b95fc15bd3ebff  boot-emmc1-16MiB.img
--- a/b5a/build-autoboot.log
+++ b/b5a/build-autoboot.log
@ -0,0 +1,227 @@
+make[1]: Entering directory '/tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce'
+NOTE: Display support is disabled without display/panel selection
+including app/aboot dev/fbcon dev/gcdb/display dev/keys dev/pmic/pm8x41 dev/vib lib/debug lib/heap lib/libc lib/libfdt lib/ptable lk2nd lk2nd/boot lk2nd/device lk2nd/fastboot lk2nd/fastboot/debug lk2nd/hw/gpio lk2nd/hw/i2c lk2nd/ramoops lk2nd/rng-seed lk2nd/serialno lk2nd/smp lk2nd/smp/spin-table lk2nd/version
+including lib/bio lib/fs lib/zlib_inflate lk2nd/hw/bdev lk2nd/hw/regulator
+including lib/fs/ext2 lib/partition
+including lib/bcache
+generating build-lk1st-msm8916/config.h
+compiling lk2nd/device/dts/msm8916/msm8916-512mb-mtp.dts
+generating build-lk1st-msm8916/system-onesegment.ld
+generating build-lk1st-msm8916/lk2nd/version/tag.c for lk2nd 23.1
+compiling arch/arm/crt0.S
+compiling target/msm8916/init.c
+compiling target/msm8916/meminfo.c
+compiling target/msm8916/target_display.c
+compiling target/msm8916/oem_panel.c
+compiling platform/msm8916/platform.c
+compiling platform/msm8916/acpuclock.c
+compiling platform/msm8916/msm8916-clock.c
+compiling platform/msm8916/gpio.c
+compiling platform/msm_shared/debug.c
+compiling platform/msm_shared/smem.c
+compiling platform/msm_shared/smem_ptable.c
+compiling platform/msm_shared/partition_parser.c
+compiling platform/msm_shared/ab_partition_parser.c
+compiling platform/msm_shared/hsusb.c
+compiling platform/msm_shared/boot_stats.c
+compiling platform/msm_shared/qgic_common.c
+compiling platform/msm_shared/crc32.c
+compiling platform/msm_shared/sdhci.c
+compiling platform/msm_shared/sdhci_msm.c
+compiling platform/msm_shared/mmc_sdhci.c
+compiling platform/msm_shared/mmc_wrapper.c
+compiling platform/msm_shared/rpm-ipc.c
+compiling platform/msm_shared/qgic.c
+compiling platform/msm_shared/qtimer.c
+compiling platform/msm_shared/qtimer_mmap.c
+compiling platform/msm_shared/interrupts.c
+compiling platform/msm_shared/clock.c
+compiling platform/msm_shared/clock_pll.c
+compiling platform/msm_shared/clock_lib2.c
+compiling platform/msm_shared/uart_dm.c
+compiling platform/msm_shared/board.c
+compiling platform/msm_shared/spmi.c
+compiling platform/msm_shared/bam.c
+compiling platform/msm_shared/scm.c
+compiling platform/msm_shared/dload_util.c
+compiling platform/msm_shared/gpio.c
+compiling platform/msm_shared/dev_tree.c
+compiling platform/msm_shared/mdp5.c
+compiling platform/msm_shared/display.c
+compiling platform/msm_shared/mipi_dsi.c
+compiling platform/msm_shared/mipi_dsi_phy.c
+compiling platform/msm_shared/mipi_dsi_autopll.c
+compiling platform/msm_shared/shutdown_detect.c
+compiling platform/msm_shared/certificate.c
+compiling platform/msm_shared/crypto_hash.c
+compiling platform/msm_shared/crypto5_eng.c
+compiling platform/msm_shared/crypto5_wrapper.c
+compiling platform/msm_shared/i2c_qup.c
+compiling platform/msm_shared/mipi_dsi_i2c.c
+compiling platform/msm_shared/regulator.c
+compiling platform/msm_shared/reboot.c
+compiling arch/arm/arch.c
+compiling arch/arm/asm.S
+compiling arch/arm/cache.c
+compiling arch/arm/cache-ops.S
+compiling arch/arm/ops.S
+compiling arch/arm/exceptions.S
+compiling arch/arm/faults.c
+compiling arch/arm/thread.c
+compiling arch/arm/dcc.S
+compiling arch/arm/mmu.c
+compiling platform/debug.c
+compiling platform/init.c
+compiling target/init.c
+compiling target/target_display.c
+compiling kernel/debug.c
+compiling kernel/dpc.c
+compiling kernel/event.c
+compiling kernel/main.c
+compiling kernel/mutex.c
+compiling kernel/thread.c
+compiling kernel/timer.c
+compiling dev/dev.c
+compiling app/app.c
+compiling app/aboot/aboot.c
+compiling app/aboot/fastboot.c
+compiling dev/fbcon/fbcon.c
+compiling dev/gcdb/display/gcdb_display.c
+compiling dev/gcdb/display/gcdb_display_param.c
+compiling dev/gcdb/display/panel_display.c
+compiling dev/gcdb/display/gcdb_autopll.c
+compiling dev/keys/keys.c
+compiling dev/pmic/pm8x41/pm8x41.c
+compiling dev/pmic/pm8x41/pm8x41_adc.c
+compiling dev/pmic/pm8x41/pm8x41_wled.c
+compiling dev/pmic/pm8x41/pm8x41_vib.c
+compiling dev/pmic/pm8x41/pm_pwm.c
+compiling dev/vib/vibrator.c
+compiling lib/debug/debug.c
+compiling lib/heap/heap.c
+compiling lib/libc/atoi.c
+compiling lib/libc/bsearch.c
+compiling lib/libc/ctype.c
+compiling lib/libc/errno.c
+compiling lib/libc/gcd_lcm.c
+compiling lib/libc/itoa.c
+compiling lib/libc/printf.c
+compiling lib/libc/malloc.c
+compiling lib/libc/rand.c
+compiling lib/libc/stdio.c
+compiling lib/libc/eabi.c
+compiling lib/libc/string/arch/arm/memcpy.S
+compiling lib/libc/string/arch/arm/memset.S
+compiling lib/libc/string/memchr.c
+compiling lib/libc/string/memcmp.c
+compiling lib/libc/string/memscpy.c
+compiling lib/libc/string/strcasecmp.c
+compiling lib/libc/string/strcat.c
+compiling lib/libc/string/strchr.c
+compiling lib/libc/string/strcmp.c
+compiling lib/libc/string/strcoll.c
+compiling lib/libc/string/strcpy.c
+compiling lib/libc/string/strdup.c
+compiling lib/libc/string/strerror.c
+compiling lib/libc/string/strlcat.c
+compiling lib/libc/string/strlcpy.c
+compiling lib/libc/string/strlen.c
+compiling lib/libc/string/strncat.c
+compiling lib/libc/string/strncpy.c
+compiling lib/libc/string/strncmp.c
+compiling lib/libc/string/strnicmp.c
+compiling lib/libc/string/strnlen.c
+compiling lib/libc/string/strpbrk.c
+compiling lib/libc/string/strrchr.c
+compiling lib/libc/string/strrev.c
+compiling lib/libc/string/strspn.c
+compiling lib/libc/string/strstr.c
+compiling lib/libc/string/strtok.c
+compiling lib/libc/string/strxfrm.c
+compiling lib/libfdt/fdt.c
+compiling lib/libfdt/fdt_ro.c
+compiling lib/libfdt/fdt_wip.c
+compiling lib/libfdt/fdt_sw.c
+compiling lib/libfdt/fdt_rw.c
+compiling lib/libfdt/fdt_strerror.c
+compiling lib/libfdt/fdt_empty_tree.c
+compiling lib/libfdt/fdt_addresses.c
+compiling lib/libfdt/fdt_overlay.c
+compiling lib/libfdt/fdt_check.c
+compiling lib/ptable/ptable.c
+compiling lk2nd/init.c
+compiling lk2nd/util/cmdline.c
+compiling lk2nd/util/lkfdt.c
+compiling lk2nd/util/mmu.c
+compiling lk2nd/boot/boot.c
+compiling lk2nd/boot/extlinux.c
+compiling lk2nd/boot/util.c
+compiling lk2nd/device/device.c
+compiling lk2nd/device/panel.c
+compiling lk2nd/device/keys.c
+compiling lk2nd/device/leds.c
+compiling lk2nd/device/regulator-fixed.c
+compiling lk2nd/device/regulator-ldo.c
+compiling lk2nd/device/sdhc.c
+compiling lk2nd/device/smb1360/smb1360.c
+compiling lk2nd/device/smb1360/gpl/battery-idol347.c
+compiling lk2nd/device/smb1360/gpl/battery-wt88047.c
+compiling lk2nd/device/smb1360/gpl/battery-qcom.c
+compiling lk2nd/fastboot/fetch.c
+compiling lk2nd/fastboot/hash.c
+compiling lk2nd/fastboot/misc.c
+compiling lk2nd/fastboot/dtb.c
+compiling lk2nd/fastboot/debug/cpuid.c
+compiling lk2nd/fastboot/debug/register.c
+compiling lk2nd/fastboot/debug/regulator.c
+compiling lk2nd/hw/gpio/gpio.c
+compiling lk2nd/hw/gpio/tlmm.c
+compiling lk2nd/hw/gpio/pm8x41.c
+compiling lk2nd/hw/i2c/dt.c
+compiling lk2nd/hw/i2c/gpio_i2c.c
+compiling lk2nd/ramoops/ramoops.c
+compiling lk2nd/rng-seed/rng-seed.c
+compiling lk2nd/serialno/mac.c
+compiling lk2nd/serialno/serialno.c
+compiling lk2nd/smp/clock-msm8916.c
+compiling lk2nd/smp/cpu-boot.c
+compiling lk2nd/smp/cortex-a.c
+compiling lk2nd/smp/spin-table/spin-table.c
+compiling lk2nd/version/version.c
+compiling build-lk1st-msm8916/lk2nd/version/tag.c
+compiling lib/bio/bio.c
+compiling lib/bio/debug.c
+compiling lib/bio/mem.c
+compiling lib/bio/subdev.c
+compiling lib/fs/fs.c
+compiling lib/fs/debug.c
+compiling lib/zlib_inflate/zutil.c
+compiling lib/zlib_inflate/adler32.c
+compiling lib/zlib_inflate/inftrees.c
+compiling lib/zlib_inflate/inflate.c
+compiling lib/zlib_inflate/inffast.c
+compiling lib/zlib_inflate/uncompr.c
+compiling lib/zlib_inflate/decompress.c
+compiling lk2nd/hw/bdev/bdev.c
+compiling lk2nd/hw/bdev/util.c
+compiling lk2nd/hw/bdev/wrapper.c
+compiling lk2nd/hw/bdev/mmc_sdhci.c
+compiling lk2nd/hw/regulator/gpl/qcom_spmi-regulator.c
+compiling lib/fs/ext2/ext2.c
+compiling lib/fs/ext2/dir.c
+compiling lib/fs/ext2/io.c
+compiling lib/fs/ext2/file.c
+compiling lib/partition/partition.c
+compiling lib/bcache/bcache.c
+linking build-lk1st-msm8916/lk
+generating image: build-lk1st-msm8916/lk.bin
+generating listing: build-lk1st-msm8916/lk.lst
+generating listing: build-lk1st-msm8916/lk.debug.lst
+generating symbols: build-lk1st-msm8916/lk.sym
+   text	   data	    bss	    dec	    hex	filename
+ 202300	  59340	 224720	 486360	  76bd8	build-lk1st-msm8916/lk
+arm-none-eabi-objcopy -O binary build-lk1st-msm8916/lk build-lk1st-msm8916/lk.bin
+generating size map: build-lk1st-msm8916/lk.size
+generating stripped elf: build-lk1st-msm8916/lk_s.elf
+cp -f ./build-lk1st-msm8916/lk_s.elf ./build-lk1st-msm8916/emmc_appsboot.mbn
+make[1]: Leaving directory '/tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce'
--- a/b5a/build-repro-force.log
+++ b/b5a/build-repro-force.log
@ -0,0 +1,227 @@
+make[1]: Entering directory '/tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/force'
+NOTE: Display support is disabled without display/panel selection
+including app/aboot dev/fbcon dev/gcdb/display dev/keys dev/pmic/pm8x41 dev/vib lib/debug lib/heap lib/libc lib/libfdt lib/ptable lk2nd lk2nd/boot lk2nd/device lk2nd/fastboot lk2nd/fastboot/debug lk2nd/hw/gpio lk2nd/hw/i2c lk2nd/ramoops lk2nd/rng-seed lk2nd/serialno lk2nd/smp lk2nd/smp/spin-table lk2nd/version
+including lib/bio lib/fs lib/zlib_inflate lk2nd/hw/bdev lk2nd/hw/regulator
+including lib/fs/ext2 lib/partition
+including lib/bcache
+generating build-lk1st-msm8916/config.h
+compiling lk2nd/device/dts/msm8916/msm8916-512mb-mtp.dts
+generating build-lk1st-msm8916/system-onesegment.ld
+generating build-lk1st-msm8916/lk2nd/version/tag.c for lk2nd 23.1
+compiling arch/arm/crt0.S
+compiling target/msm8916/init.c
+compiling target/msm8916/meminfo.c
+compiling target/msm8916/target_display.c
+compiling target/msm8916/oem_panel.c
+compiling platform/msm8916/platform.c
+compiling platform/msm8916/acpuclock.c
+compiling platform/msm8916/msm8916-clock.c
+compiling platform/msm8916/gpio.c
+compiling platform/msm_shared/debug.c
+compiling platform/msm_shared/smem.c
+compiling platform/msm_shared/smem_ptable.c
+compiling platform/msm_shared/partition_parser.c
+compiling platform/msm_shared/ab_partition_parser.c
+compiling platform/msm_shared/hsusb.c
+compiling platform/msm_shared/boot_stats.c
+compiling platform/msm_shared/qgic_common.c
+compiling platform/msm_shared/crc32.c
+compiling platform/msm_shared/sdhci.c
+compiling platform/msm_shared/sdhci_msm.c
+compiling platform/msm_shared/mmc_sdhci.c
+compiling platform/msm_shared/mmc_wrapper.c
+compiling platform/msm_shared/rpm-ipc.c
+compiling platform/msm_shared/qgic.c
+compiling platform/msm_shared/qtimer.c
+compiling platform/msm_shared/qtimer_mmap.c
+compiling platform/msm_shared/interrupts.c
+compiling platform/msm_shared/clock.c
+compiling platform/msm_shared/clock_pll.c
+compiling platform/msm_shared/clock_lib2.c
+compiling platform/msm_shared/uart_dm.c
+compiling platform/msm_shared/board.c
+compiling platform/msm_shared/spmi.c
+compiling platform/msm_shared/bam.c
+compiling platform/msm_shared/scm.c
+compiling platform/msm_shared/dload_util.c
+compiling platform/msm_shared/gpio.c
+compiling platform/msm_shared/dev_tree.c
+compiling platform/msm_shared/mdp5.c
+compiling platform/msm_shared/display.c
+compiling platform/msm_shared/mipi_dsi.c
+compiling platform/msm_shared/mipi_dsi_phy.c
+compiling platform/msm_shared/mipi_dsi_autopll.c
+compiling platform/msm_shared/shutdown_detect.c
+compiling platform/msm_shared/certificate.c
+compiling platform/msm_shared/crypto_hash.c
+compiling platform/msm_shared/crypto5_eng.c
+compiling platform/msm_shared/crypto5_wrapper.c
+compiling platform/msm_shared/i2c_qup.c
+compiling platform/msm_shared/mipi_dsi_i2c.c
+compiling platform/msm_shared/regulator.c
+compiling platform/msm_shared/reboot.c
+compiling arch/arm/arch.c
+compiling arch/arm/asm.S
+compiling arch/arm/cache.c
+compiling arch/arm/cache-ops.S
+compiling arch/arm/ops.S
+compiling arch/arm/exceptions.S
+compiling arch/arm/faults.c
+compiling arch/arm/thread.c
+compiling arch/arm/dcc.S
+compiling arch/arm/mmu.c
+compiling platform/debug.c
+compiling platform/init.c
+compiling target/init.c
+compiling target/target_display.c
+compiling kernel/debug.c
+compiling kernel/dpc.c
+compiling kernel/event.c
+compiling kernel/main.c
+compiling kernel/mutex.c
+compiling kernel/thread.c
+compiling kernel/timer.c
+compiling dev/dev.c
+compiling app/app.c
+compiling app/aboot/aboot.c
+compiling app/aboot/fastboot.c
+compiling dev/fbcon/fbcon.c
+compiling dev/gcdb/display/gcdb_display.c
+compiling dev/gcdb/display/gcdb_display_param.c
+compiling dev/gcdb/display/panel_display.c
+compiling dev/gcdb/display/gcdb_autopll.c
+compiling dev/keys/keys.c
+compiling dev/pmic/pm8x41/pm8x41.c
+compiling dev/pmic/pm8x41/pm8x41_adc.c
+compiling dev/pmic/pm8x41/pm8x41_wled.c
+compiling dev/pmic/pm8x41/pm8x41_vib.c
+compiling dev/pmic/pm8x41/pm_pwm.c
+compiling dev/vib/vibrator.c
+compiling lib/debug/debug.c
+compiling lib/heap/heap.c
+compiling lib/libc/atoi.c
+compiling lib/libc/bsearch.c
+compiling lib/libc/ctype.c
+compiling lib/libc/errno.c
+compiling lib/libc/gcd_lcm.c
+compiling lib/libc/itoa.c
+compiling lib/libc/printf.c
+compiling lib/libc/malloc.c
+compiling lib/libc/rand.c
+compiling lib/libc/stdio.c
+compiling lib/libc/eabi.c
+compiling lib/libc/string/arch/arm/memcpy.S
+compiling lib/libc/string/arch/arm/memset.S
+compiling lib/libc/string/memchr.c
+compiling lib/libc/string/memcmp.c
+compiling lib/libc/string/memscpy.c
+compiling lib/libc/string/strcasecmp.c
+compiling lib/libc/string/strcat.c
+compiling lib/libc/string/strchr.c
+compiling lib/libc/string/strcmp.c
+compiling lib/libc/string/strcoll.c
+compiling lib/libc/string/strcpy.c
+compiling lib/libc/string/strdup.c
+compiling lib/libc/string/strerror.c
+compiling lib/libc/string/strlcat.c
+compiling lib/libc/string/strlcpy.c
+compiling lib/libc/string/strlen.c
+compiling lib/libc/string/strncat.c
+compiling lib/libc/string/strncpy.c
+compiling lib/libc/string/strncmp.c
+compiling lib/libc/string/strnicmp.c
+compiling lib/libc/string/strnlen.c
+compiling lib/libc/string/strpbrk.c
+compiling lib/libc/string/strrchr.c
+compiling lib/libc/string/strspn.c
+compiling lib/libc/string/strrev.c
+compiling lib/libc/string/strstr.c
+compiling lib/libc/string/strtok.c
+compiling lib/libc/string/strxfrm.c
+compiling lib/libfdt/fdt.c
+compiling lib/libfdt/fdt_ro.c
+compiling lib/libfdt/fdt_wip.c
+compiling lib/libfdt/fdt_sw.c
+compiling lib/libfdt/fdt_rw.c
+compiling lib/libfdt/fdt_strerror.c
+compiling lib/libfdt/fdt_empty_tree.c
+compiling lib/libfdt/fdt_addresses.c
+compiling lib/libfdt/fdt_overlay.c
+compiling lib/libfdt/fdt_check.c
+compiling lib/ptable/ptable.c
+compiling lk2nd/init.c
+compiling lk2nd/util/cmdline.c
+compiling lk2nd/util/lkfdt.c
+compiling lk2nd/util/mmu.c
+compiling lk2nd/boot/boot.c
+compiling lk2nd/boot/extlinux.c
+compiling lk2nd/boot/util.c
+compiling lk2nd/device/device.c
+compiling lk2nd/device/panel.c
+compiling lk2nd/device/keys.c
+compiling lk2nd/device/leds.c
+compiling lk2nd/device/regulator-fixed.c
+compiling lk2nd/device/regulator-ldo.c
+compiling lk2nd/device/sdhc.c
+compiling lk2nd/device/smb1360/smb1360.c
+compiling lk2nd/device/smb1360/gpl/battery-idol347.c
+compiling lk2nd/device/smb1360/gpl/battery-wt88047.c
+compiling lk2nd/device/smb1360/gpl/battery-qcom.c
+compiling lk2nd/fastboot/fetch.c
+compiling lk2nd/fastboot/hash.c
+compiling lk2nd/fastboot/misc.c
+compiling lk2nd/fastboot/dtb.c
+compiling lk2nd/fastboot/debug/cpuid.c
+compiling lk2nd/fastboot/debug/register.c
+compiling lk2nd/fastboot/debug/regulator.c
+compiling lk2nd/hw/gpio/gpio.c
+compiling lk2nd/hw/gpio/tlmm.c
+compiling lk2nd/hw/gpio/pm8x41.c
+compiling lk2nd/hw/i2c/dt.c
+compiling lk2nd/hw/i2c/gpio_i2c.c
+compiling lk2nd/ramoops/ramoops.c
+compiling lk2nd/rng-seed/rng-seed.c
+compiling lk2nd/serialno/mac.c
+compiling lk2nd/serialno/serialno.c
+compiling lk2nd/smp/clock-msm8916.c
+compiling lk2nd/smp/cpu-boot.c
+compiling lk2nd/smp/cortex-a.c
+compiling lk2nd/smp/spin-table/spin-table.c
+compiling lk2nd/version/version.c
+compiling build-lk1st-msm8916/lk2nd/version/tag.c
+compiling lib/bio/bio.c
+compiling lib/bio/debug.c
+compiling lib/bio/mem.c
+compiling lib/bio/subdev.c
+compiling lib/fs/fs.c
+compiling lib/fs/debug.c
+compiling lib/zlib_inflate/zutil.c
+compiling lib/zlib_inflate/adler32.c
+compiling lib/zlib_inflate/inftrees.c
+compiling lib/zlib_inflate/inflate.c
+compiling lib/zlib_inflate/inffast.c
+compiling lib/zlib_inflate/uncompr.c
+compiling lib/zlib_inflate/decompress.c
+compiling lk2nd/hw/bdev/bdev.c
+compiling lk2nd/hw/bdev/util.c
+compiling lk2nd/hw/bdev/wrapper.c
+compiling lk2nd/hw/bdev/mmc_sdhci.c
+compiling lk2nd/hw/regulator/gpl/qcom_spmi-regulator.c
+compiling lib/fs/ext2/ext2.c
+compiling lib/fs/ext2/dir.c
+compiling lib/fs/ext2/io.c
+compiling lib/fs/ext2/file.c
+compiling lib/partition/partition.c
+compiling lib/bcache/bcache.c
+linking build-lk1st-msm8916/lk
+generating image: build-lk1st-msm8916/lk.bin
+generating listing: build-lk1st-msm8916/lk.lst
+generating listing: build-lk1st-msm8916/lk.debug.lst
+generating symbols: build-lk1st-msm8916/lk.sym
+   text	   data	    bss	    dec	    hex	filename
+ 202308	  59388	 224720	 486416	  76c10	build-lk1st-msm8916/lk
+arm-none-eabi-objcopy -O binary build-lk1st-msm8916/lk build-lk1st-msm8916/lk.bin
+generating size map: build-lk1st-msm8916/lk.size
+generating stripped elf: build-lk1st-msm8916/lk_s.elf
+cp -f ./build-lk1st-msm8916/lk_s.elf ./build-lk1st-msm8916/emmc_appsboot.mbn
+make[1]: Leaving directory '/tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/force'
--- a/b5a/config-autoboot.h
+++ b/b5a/config-autoboot.h
@ -0,0 +1,97 @@
+#ifndef __CONFIG_H
+#define __CONFIG_H
+#define BOARD lk1st-msm8916
+#define LK 1
+#define USE_LE_SYSTEMD 0
+#define MOUNT_EMMC_LE 0
+#define TARGET_USE_SYSTEM_AS_ROOT_IMAGE 0
+#define ENABLE_KASLRSEED_SUPPORT 1
+#define WITH_DEBUG_LOG_BUF 1
+#define WITH_DEBUG_UART 1
+#define ENABLE_FBCON_LOGGING 1
+#define DEVICE_TREE 1
+#define CRYPTO_BAM 1
+#define SPMI_CORE_V2 1
+#define BAM_V170 1
+#define ABOOT_IGNORE_BOOT_HEADER_ADDRS 1
+#define LONG_PRESS_POWER_ON 1
+#define MMC_SDHCI_SUPPORT 1
+#define _EMMC_BOOT 1
+#define PON_VIB_SUPPORT 1
+#define PLATFORM_USE_SCM_DLOAD 1
+#define USE_PON_REBOOT_REG 1
+#define WITH_DEBUG_LOG_BUF 1
+#define LK_LOG_BUF_SIZE 32768
+#define GENERATE_CMDLINE_ONLY_FOR_ANDROID 1
+#define DISABLE_SPLASH_PARTITION 1
+#define FASTBOOT_HELP 1
+#define DISPLAY_TYPE_MIPI 1
+#define DISPLAY_TYPE_DSI6G 1
+#define MEMSIZE 0x00100000
+#define MEMBASE 0x8F600000
+#define BASE_ADDR 0x80000000
+#define SCRATCH_ADDR 0x90000000
+#define ARM_CPU_CORE_A7
+#define PERIPH_BLK_BLSP 1
+#define WITH_CPU_EARLY_INIT 0
+#define WITH_CPU_WARM_BOOT 0
+#define MMC_SLOT 1
+#define PANIC_REBOOT_MODE EMERGENCY_DLOAD
+#define DISPLAY_TYPE_MDSS 1
+#define DTBO_DISABLED 1
+#define ARM_CPU_CORTEX_A8 1
+#define ARM_WITH_CP15 1
+#define ARM_WITH_MMU 1
+#define ARM_ISA_ARMV7 1
+#define ARM_WITH_VFP 1
+#define ARM_WITH_NEON 1
+#define ARM_WITH_THUMB 1
+#define ARM_WITH_THUMB2 1
+#define ARM_WITH_CACHE 1
+#define ARM_WITH_L2 1
+#define ASSERT_ON_TAMPER 1
+#define ABOOT_STANDALONE 1
+#define GPL 1
+#define LK2ND_BOOT_MEM_SIZE 0x03200000
+#define LK2ND_BUNDLE_DTB "./build-lk1st-msm8916/lk2nd/device/dts/msm8916/msm8916-512mb-mtp.dtb"
+#define CPU_BOOT_CORTEX_A 1
+#define PROJECT_LK1ST_MSM8916 1
+#define TARGET_MSM8916 1
+#define PLATFORM_MSM8916 1
+#define ARCH_ARM 1
+#define WITH_APP_ABOOT 1
+#define WITH_DEV_FBCON 1
+#define WITH_DEV_GCDB_DISPLAY 1
+#define WITH_DEV_KEYS 1
+#define WITH_DEV_PMIC_PM8X41 1
+#define WITH_DEV_VIB 1
+#define WITH_LIB_BCACHE 1
+#define WITH_LIB_BIO 1
+#define WITH_LIB_DEBUG 1
+#define WITH_LIB_FS 1
+#define WITH_LIB_FS_EXT2 1
+#define WITH_LIB_HEAP 1
+#define WITH_LIB_LIBC 1
+#define WITH_LIB_LIBFDT 1
+#define WITH_LIB_PARTITION 1
+#define WITH_LIB_PTABLE 1
+#define WITH_LIB_ZLIB_INFLATE 1
+#define WITH_LK2ND 1
+#define WITH_LK2ND_BOOT 1
+#define WITH_LK2ND_DEVICE 1
+#define WITH_LK2ND_FASTBOOT 1
+#define WITH_LK2ND_FASTBOOT_DEBUG 1
+#define WITH_LK2ND_HW_BDEV 1
+#define WITH_LK2ND_HW_GPIO 1
+#define WITH_LK2ND_HW_I2C 1
+#define WITH_LK2ND_HW_REGULATOR 1
+#define WITH_LK2ND_RAMOOPS 1
+#define WITH_LK2ND_RNG_SEED 1
+#define WITH_LK2ND_SERIALNO 1
+#define WITH_LK2ND_SMP 1
+#define WITH_LK2ND_SMP_SPIN_TABLE 1
+#define WITH_LK2ND_VERSION 1
+#define MEMRWOFF .
+#define DEBUG 1
+#define _EMMC_BOOT 1
+#endif
--- a/b5a/config-force-repro.h
+++ b/b5a/config-force-repro.h
@ -0,0 +1,98 @@
+#ifndef __CONFIG_H
+#define __CONFIG_H
+#define BOARD lk1st-msm8916
+#define LK 1
+#define USE_LE_SYSTEMD 0
+#define MOUNT_EMMC_LE 0
+#define TARGET_USE_SYSTEM_AS_ROOT_IMAGE 0
+#define ENABLE_KASLRSEED_SUPPORT 1
+#define WITH_DEBUG_LOG_BUF 1
+#define WITH_DEBUG_UART 1
+#define ENABLE_FBCON_LOGGING 1
+#define DEVICE_TREE 1
+#define CRYPTO_BAM 1
+#define SPMI_CORE_V2 1
+#define BAM_V170 1
+#define ABOOT_IGNORE_BOOT_HEADER_ADDRS 1
+#define LONG_PRESS_POWER_ON 1
+#define MMC_SDHCI_SUPPORT 1
+#define _EMMC_BOOT 1
+#define PON_VIB_SUPPORT 1
+#define PLATFORM_USE_SCM_DLOAD 1
+#define USE_PON_REBOOT_REG 1
+#define WITH_DEBUG_LOG_BUF 1
+#define LK_LOG_BUF_SIZE 32768
+#define LK2ND_FORCE_FASTBOOT 1
+#define GENERATE_CMDLINE_ONLY_FOR_ANDROID 1
+#define DISABLE_SPLASH_PARTITION 1
+#define FASTBOOT_HELP 1
+#define DISPLAY_TYPE_MIPI 1
+#define DISPLAY_TYPE_DSI6G 1
+#define MEMSIZE 0x00100000
+#define MEMBASE 0x8F600000
+#define BASE_ADDR 0x80000000
+#define SCRATCH_ADDR 0x90000000
+#define ARM_CPU_CORE_A7
+#define PERIPH_BLK_BLSP 1
+#define WITH_CPU_EARLY_INIT 0
+#define WITH_CPU_WARM_BOOT 0
+#define MMC_SLOT 1
+#define PANIC_REBOOT_MODE EMERGENCY_DLOAD
+#define DISPLAY_TYPE_MDSS 1
+#define DTBO_DISABLED 1
+#define ARM_CPU_CORTEX_A8 1
+#define ARM_WITH_CP15 1
+#define ARM_WITH_MMU 1
+#define ARM_ISA_ARMV7 1
+#define ARM_WITH_VFP 1
+#define ARM_WITH_NEON 1
+#define ARM_WITH_THUMB 1
+#define ARM_WITH_THUMB2 1
+#define ARM_WITH_CACHE 1
+#define ARM_WITH_L2 1
+#define ASSERT_ON_TAMPER 1
+#define ABOOT_STANDALONE 1
+#define GPL 1
+#define LK2ND_BOOT_MEM_SIZE 0x03200000
+#define LK2ND_BUNDLE_DTB "./build-lk1st-msm8916/lk2nd/device/dts/msm8916/msm8916-512mb-mtp.dtb"
+#define CPU_BOOT_CORTEX_A 1
+#define PROJECT_LK1ST_MSM8916 1
+#define TARGET_MSM8916 1
+#define PLATFORM_MSM8916 1
+#define ARCH_ARM 1
+#define WITH_APP_ABOOT 1
+#define WITH_DEV_FBCON 1
+#define WITH_DEV_GCDB_DISPLAY 1
+#define WITH_DEV_KEYS 1
+#define WITH_DEV_PMIC_PM8X41 1
+#define WITH_DEV_VIB 1
+#define WITH_LIB_BCACHE 1
+#define WITH_LIB_BIO 1
+#define WITH_LIB_DEBUG 1
+#define WITH_LIB_FS 1
+#define WITH_LIB_FS_EXT2 1
+#define WITH_LIB_HEAP 1
+#define WITH_LIB_LIBC 1
+#define WITH_LIB_LIBFDT 1
+#define WITH_LIB_PARTITION 1
+#define WITH_LIB_PTABLE 1
+#define WITH_LIB_ZLIB_INFLATE 1
+#define WITH_LK2ND 1
+#define WITH_LK2ND_BOOT 1
+#define WITH_LK2ND_DEVICE 1
+#define WITH_LK2ND_FASTBOOT 1
+#define WITH_LK2ND_FASTBOOT_DEBUG 1
+#define WITH_LK2ND_HW_BDEV 1
+#define WITH_LK2ND_HW_GPIO 1
+#define WITH_LK2ND_HW_I2C 1
+#define WITH_LK2ND_HW_REGULATOR 1
+#define WITH_LK2ND_RAMOOPS 1
+#define WITH_LK2ND_RNG_SEED 1
+#define WITH_LK2ND_SERIALNO 1
+#define WITH_LK2ND_SMP 1
+#define WITH_LK2ND_SMP_SPIN_TABLE 1
+#define WITH_LK2ND_VERSION 1
+#define MEMRWOFF .
+#define DEBUG 1
+#define _EMMC_BOOT 1
+#endif
--- a/b5a/config.diff
+++ b/b5a/config.diff
@ -0,0 +1,10 @@
+--- config-force-repro.h	2026-09-30 17:25:56.607262520 +0600
+++ config-autoboot.h	2026-09-30 17:25:56.599262481 +0600
+@@ -22,7 +22,6 @@
+ #define USE_PON_REBOOT_REG 1
+ #define WITH_DEBUG_LOG_BUF 1
+ #define LK_LOG_BUF_SIZE 32768
+-#define LK2ND_FORCE_FASTBOOT 1
+ #define GENERATE_CMDLINE_ONLY_FOR_ANDROID 1
+ #define DISABLE_SPLASH_PARTITION 1
+ #define FASTBOOT_HELP 1
--- a/b5b/B5b-rollback.sh
+++ b/b5b/B5b-rollback.sh
@ -0,0 +1,9 @@
+#!/bin/bash
+# B5b rollback — restore pre-B5b cache (Android ext4, 817118e4). Needs 9008 via HW EDL. After this, power-on boots emmc1 from boot again.
+cd ~/doc/modem/jz08-aurora || exit 1
+L=firehose/007050e100000000_394a2e47cf830150_fhprg_peek.bin ; O=logs/b5b/rollback ; mkdir -p $O
+B=b5b/backup/cache-current-817118e4.bin
+edl --loader=$L printgpt > $O/00-printgpt.log 2>&1
+edl --loader=$L w cache $B > $O/cache-w.log 2>&1
+edl --loader=$L r cache $O/cache-rb.bin > /dev/null 2>&1 ; cmp $B $O/cache-rb.bin && echo CACHE_RESTORED
+sha256sum $B $O/cache-rb.bin
--- a/b5b/B5b-write.sh
+++ b/b5b/B5b-write.sh
@ -0,0 +1,46 @@
+#!/bin/bash
+# B5b — the ONLY write: cache := minimal ext2 with exact golden mm1 components. Run on 480s ONLY after explicit GO.
+# Entry: HW EDL (battery on, D+->GND, plug USB, release). Never `edl reset`. Stops at first failed gate.
+cd ~/doc/modem/jz08-aurora || exit 1
+L=firehose/007050e100000000_394a2e47cf830150_fhprg_peek.bin
+O=logs/b5b/W ; A3=logs/b5a/A3 ; P=logs/b5a/A4pre ; mkdir -p $O
+NEW=b5b/cache-extlinux-mm1.img            ; NEW_SHA=409bbb11c34d95c867c5cc1a33a686a7ecd5fcb4d43b5c592f334cd402114ed9
+OLD_SHA=817118e44545268014c76cfe4775866be7b9939699d214e009e27413dc5d8c9e
+BOOT_SHA=e9579f33c7304cd47f487f2b61cd9226dc04fd3a63775d62b4b95fc15bd3ebff
+ABOOT_SHA=3b8cd2667837fc7083cb28991d849f9b408a07fa743bfd05eafee7b053760f85
+die(){ echo "STOP: $*"; exit 1; }
+sha(){ sha256sum "$1" | cut -d" " -f1; }
+E(){ edl --loader=$L "$@"; }
+echo "== G0 inputs"
+[ "$(sha $L)" = 53f193500c03248f0d671ab57bfe9ca8a42967e97f28403294b4b3f854075aca ] || die loader
+[ "$(sha $NEW)" = $NEW_SHA ] && [ $(stat -c %s $NEW) = 134217728 ] || die candidate
+[ "$(sha b5b/backup/cache-current-817118e4.bin)" = $OLD_SHA ] || die backup
+lsusb | grep -q 05c6:9008 || die "no 9008"
+echo "== G1 identity + geometry + baseline"
+E printgpt > $O/00-printgpt.log 2>&1 || die printgpt
+grep -aq "Serial: *0x<SAHARA_SERIAL>" $O/00-printgpt.log || grep -aq "Mode detected: firehose" $O/00-printgpt.log || die serial
+grep -a "^cache:" $O/00-printgpt.log | grep -q "Offset 0x000000004118c000, Length 0x0000000008000000" || die cache-geometry
+E rs 0 34 $O/pre-gptp.bin >/dev/null 2>&1; cmp $O/pre-gptp.bin $A3/gpt-primary-34.bin || die gpt-changed
+E r boot  $O/pre-boot.bin  >/dev/null 2>&1; [ "$(sha $O/pre-boot.bin)"  = $BOOT_SHA ]  || die boot-not-emmc1
+E r aboot $O/pre-aboot.bin >/dev/null 2>&1; [ "$(sha $O/pre-aboot.bin)" = $ABOOT_SHA ] || die aboot-not-autoboot
+E r cache $O/pre-cache.bin >/dev/null 2>&1; [ "$(sha $O/pre-cache.bin)" = $OLD_SHA ]  || die cache-not-backup
+echo "== W cache := candidate (LBA 2133088, 262144 sectors)"
+E w cache $NEW > $O/10-cache-write.log 2>&1; echo "rc=$?"; grep -a "Wrote" $O/10-cache-write.log
+E r cache $O/11-cache-readback.bin > $O/11-cache-readback.log 2>&1 || die readback-rc
+sha256sum $NEW $O/11-cache-readback.bin
+cmp $NEW $O/11-cache-readback.bin || die "CACHE READBACK MISMATCH — do NOT reboot; run B5b-rollback.sh"
+echo CACHE_MATCH
+echo "== V everything else unchanged"
+E rs 0 34        $O/post-gptp.bin  >/dev/null 2>&1; cmp $O/post-gptp.bin  $A3/gpt-primary-34.bin || die gptp
+E rs 7634911 33  $O/post-gptb.bin  >/dev/null 2>&1; cmp $O/post-gptb.bin  $A3/gpt-backup-33.bin  || die gptb
+E rs 305184 1024 $O/post-tzbak.bin >/dev/null 2>&1; cmp $O/post-tzbak.bin $A3/tzbak-305184.bin   || die tzbak
+E r boot  $O/post-boot.bin  >/dev/null 2>&1; [ "$(sha $O/post-boot.bin)"  = $BOOT_SHA ]  || die boot
+E r aboot $O/post-aboot.bin >/dev/null 2>&1; [ "$(sha $O/post-aboot.bin)" = $ABOOT_SHA ] || die aboot
+for p in sbl1 rpm tz hyp recovery modemst1 modemst2 fsg fsc persist; do
+  E r $p $O/post-$p.bin >/dev/null 2>&1; cmp $O/post-$p.bin $A3/$p.bin || die "$p changed"; echo "$p == A3"
+done
+for p in modem system userdata; do
+  E r $p $O/post-$p.bin >/dev/null 2>&1; cmp $O/post-$p.bin $P/$p.bin || die "$p changed"; echo "$p == A4pre"; rm -f $O/post-$p.bin
+done
+(cd $O && sha256sum *.bin > SHA256SUMS)
+echo "B5B_WRITE_VERIFIED — power off fully (USB, then battery) before first boot"
--- a/b5b/SHA256SUMS
+++ b/b5b/SHA256SUMS
@ -0,0 +1,12 @@
+409bbb11c34d95c867c5cc1a33a686a7ecd5fcb4d43b5c592f334cd402114ed9  cache-extlinux-mm1.img
+e14e9ad60e4914bd122368d43dd632959b984716de1c601743ef86f9683628b1  extlinux.conf
+045cc857a5e27313188aaedcba80d93df4a0db1d450f2c7074169273374fafee  mkfs-candidate.sh
+c0ebd361d2bd09a54d7cd1f88316de3a8551814fcb369a0817ea6c9980e9c34f  B5b-write.sh
+72d3deb1e6e77d5b0caa45688acab640de1b628f622c7408d2df32821f6ef88e  B5b-rollback.sh
+817118e44545268014c76cfe4775866be7b9939699d214e009e27413dc5d8c9e  backup/cache-current-817118e4.bin
+9c20a372aedf94dfec5b758320a3ab7dac0a806258441efab60219678985079d  components/Image.gz
+0ff9c802346697a029aea28e6f571fa669c8907c8c73430c2c2639e388ad82a3  components/Image.gz-dtb
+a10056c50a6cc89dd14c3a418fc1de4ed4b21986f4661ad959184fc0e6ab2c7b  components/aurora-mm1.dtb
+cc54d780cca61927b0b98d638f5ef304a0b65d688f4b2ae40f990a8e7a5d68e3  components/cmdline.txt
+250bf8eea58cb64cba0b8f18a14e5b0d1a8aec3e99bb1009826e4d1126d0bd81  components/initramfs.cpio.gz
+d4be800b8658968f381a4b33fc2d42c95bafe50b8ab159b2d8e7982717b85ed7  emu/lk2nd-scan-emu
--- a/b5b/components/cmdline.txt
+++ b/b5b/components/cmdline.txt
@ -0,0 +1 @@
+earlycon console=ttyMSM0,115200n8 ignore_loglevel loglevel=8 rdinit=/init
--- a/b5b/emu/F1-no-conf.out
+++ b/b5b/emu/F1-no-conf.out
@ -0,0 +1,42 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] boot: Bootable file system not found. Reverting to android boot.
+HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
+HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=0
+HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
+HARNESS: total bytes read 45568
--- a/b5b/emu/F10-zeroed-cache.out
+++ b/b5b/emu/F10-zeroed-cache.out
@ -0,0 +1,42 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] boot: Bootable file system not found. Reverting to android boot.
+HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
+HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
+HARNESS: total bytes read 28160
--- a/b5b/emu/F11-bad-superblock.out
+++ b/b5b/emu/F11-bad-superblock.out
@ -0,0 +1,42 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] boot: Bootable file system not found. Reverting to android boot.
+HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
+HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
+HARNESS: total bytes read 28160
--- a/b5b/emu/F2-no-kernel.out
+++ b/b5b/emu/F2-no-kernel.out
@ -0,0 +1,44 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] Kernel /wrp0p24//Image.gz-dtb does not exist
+[lk] Failed to parse extlinux.conf
+[lk] boot: Bootable file system not found. Reverting to android boot.
+HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
+HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=0
+HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
+HARNESS: total bytes read 53760
--- a/b5b/emu/F3-no-initrd.out
+++ b/b5b/emu/F3-no-initrd.out
@ -0,0 +1,44 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] Initramfs /wrp0p24//initramfs.cpio.gz does not exist
+[lk] Failed to parse extlinux.conf
+[lk] boot: Bootable file system not found. Reverting to android boot.
+HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
+HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=0
+HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
+HARNESS: total bytes read 57856
--- a/b5b/emu/F4-no-dtb.out
+++ b/b5b/emu/F4-no-dtb.out
@ -0,0 +1,44 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] FDT /wrp0p24//aurora-mm1.dtb does not exist
+[lk] Failed to parse extlinux.conf
+[lk] boot: Bootable file system not found. Reverting to android boot.
+HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
+HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=0
+HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
+HARNESS: total bytes read 57856
--- a/b5b/emu/F5-garbage-conf.out
+++ b/b5b/emu/F5-garbage-conf.out
@ -0,0 +1,44 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] No labels in the extlinux.conf
+[lk] Failed to parse extlinux.conf
+[lk] boot: Bootable file system not found. Reverting to android boot.
+HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
+HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=0
+HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
+HARNESS: total bytes read 49664
--- a/b5b/emu/F6-no-fdt-line.out
+++ b/b5b/emu/F6-no-fdt-line.out
@ -0,0 +1,44 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] Neither fdt nor fdtdir is specified
+[lk] Failed to parse extlinux.conf
+[lk] boot: Bootable file system not found. Reverting to android boot.
+HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
+HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=0
+HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
+HARNESS: total bytes read 49664
--- a/b5b/emu/F7-crlf-conf.out
+++ b/b5b/emu/F7-crlf-conf.out
@ -0,0 +1,44 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] Kernel /wrp0p24//Image.gz-dtb
 does not exist
+[lk] Failed to parse extlinux.conf
+[lk] boot: Bootable file system not found. Reverting to android boot.
+HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
+HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=0
+HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
+HARNESS: total bytes read 53760
--- a/b5b/emu/F8-no-final-newline.out
+++ b/b5b/emu/F8-no-final-newline.out
@ -0,0 +1,44 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] Failed to parse the extlinux.conf
+[lk] Failed to parse extlinux.conf
+[lk] boot: Bootable file system not found. Reverting to android boot.
+HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
+HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=0
+HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
+HARNESS: total bytes read 49664
--- a/b5b/emu/F9-corrupt-gzip-kernel.out
+++ b/b5b/emu/F9-corrupt-gzip-kernel.out
@ -0,0 +1,46 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] Trying to boot 'mm1'
+[lk] Decompressing the kernel...
+[lk] uncompression error 
+[lk] Failed to decompress the kernel: -1
+[lk] boot: Bootable file system not found. Reverting to android boot.
+HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
+HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=0
+HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
+HARNESS: total bytes read 8081920
--- a/b5b/emu/S0-current.out
+++ b/b5b/emu/S0-current.out
@ -0,0 +1,42 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] boot: Bootable file system not found. Reverting to android boot.
+HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
+HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
+HARNESS: total bytes read 28160
--- a/b5b/emu/S1-candidate.out
+++ b/b5b/emu/S1-candidate.out
@ -0,0 +1,40 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] Trying to boot 'mm1'
+[lk] Decompressing the kernel...
+HARNESS: boot_linux reached: kernel @DDR+0x0 tags @DDR+0x249b000 ramdisk @DDR+0x269b000 (11944942) boot_type 0
+HARNESS: kernel magic 0x644d5241 image_size 0x1680000 end @DDR+0x1680000
+HARNESS: cmdline 'earlycon console=ttyMSM0,115200n8 ignore_loglevel loglevel=8 rdinit=/init'
+HARNESS: kernel   sha256 4603b02f8ae36dcf14582a00198715e7cf64fb18bfc5c3212ef464e9ecd20032 (23015432 bytes)
+HARNESS: dtb      sha256 a10056c50a6cc89dd14c3a418fc1de4ed4b21986f4661ad959184fc0e6ab2c7b (65769 bytes)
+HARNESS: ramdisk  sha256 250bf8eea58cb64cba0b8f18a14e5b0d1a8aec3e99bb1009826e4d1126d0bd81 (11944942 bytes)
--- a/b5b/emu/map-S0-current.txt
+++ b/b5b/emu/map-S0-current.txt
@ -0,0 +1,28 @@
+0 34 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/gpt-primary-34.bin
+131072 131072 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/modem.bin
+262144 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/sbl1.bin
+263168 1024 /home/q/doc/modem/jz08-aurora/partitions/sbl1bak.bin
+264192 2048 /home/q/doc/modem/jz08-aurora/b5a/aboot-lk1st-aurora-autoboot.pad1M
+266240 2048 /home/q/doc/modem/jz08-aurora/partitions/abootbak.bin
+268288 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/rpm.bin
+269312 1024 /home/q/doc/modem/jz08-aurora/partitions/rpmbak.bin
+270336 2048 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tz.bin
+305184 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tzbak-305184.bin
+272384 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/hyp.bin
+273408 1024 /home/q/doc/modem/jz08-aurora/partitions/hypbak.bin
+274432 2048 /home/q/doc/modem/jz08-aurora/partitions/pad.bin
+276480 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst1.bin
+279552 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst2.bin
+282624 2048 /home/q/doc/modem/jz08-aurora/partitions/misc.bin
+284672 2 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsc.bin
+284674 16 /home/q/doc/modem/jz08-aurora/partitions/ssd.bin
+284690 20480 /home/q/doc/modem/jz08-aurora/partitions/splash.bin
+393216 64 /home/q/doc/modem/jz08-aurora/partitions/DDR.bin
+393280 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsg.bin
+396352 32 /home/q/doc/modem/jz08-aurora/partitions/sec.bin
+396384 32768 /home/q/doc/modem/jz08-aurora/b5a/boot-emmc1-16MiB.img
+429152 1638400 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/system.bin
+2067552 65536 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/persist.bin
+2133088 262144 /home/q/doc/modem/jz08-aurora/b5b/backup/cache-current-817118e4.bin
+2395232 32768 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/recovery.bin
+2428000 5206911 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/userdata.bin
--- a/b5b/emu/map-S1-candidate.txt
+++ b/b5b/emu/map-S1-candidate.txt
@ -0,0 +1,28 @@
+0 34 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/gpt-primary-34.bin
+131072 131072 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/modem.bin
+262144 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/sbl1.bin
+263168 1024 /home/q/doc/modem/jz08-aurora/partitions/sbl1bak.bin
+264192 2048 /home/q/doc/modem/jz08-aurora/b5a/aboot-lk1st-aurora-autoboot.pad1M
+266240 2048 /home/q/doc/modem/jz08-aurora/partitions/abootbak.bin
+268288 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/rpm.bin
+269312 1024 /home/q/doc/modem/jz08-aurora/partitions/rpmbak.bin
+270336 2048 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tz.bin
+305184 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tzbak-305184.bin
+272384 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/hyp.bin
+273408 1024 /home/q/doc/modem/jz08-aurora/partitions/hypbak.bin
+274432 2048 /home/q/doc/modem/jz08-aurora/partitions/pad.bin
+276480 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst1.bin
+279552 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst2.bin
+282624 2048 /home/q/doc/modem/jz08-aurora/partitions/misc.bin
+284672 2 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsc.bin
+284674 16 /home/q/doc/modem/jz08-aurora/partitions/ssd.bin
+284690 20480 /home/q/doc/modem/jz08-aurora/partitions/splash.bin
+393216 64 /home/q/doc/modem/jz08-aurora/partitions/DDR.bin
+393280 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsg.bin
+396352 32 /home/q/doc/modem/jz08-aurora/partitions/sec.bin
+396384 32768 /home/q/doc/modem/jz08-aurora/b5a/boot-emmc1-16MiB.img
+429152 1638400 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/system.bin
+2067552 65536 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/persist.bin
+2133088 262144 /home/q/doc/modem/jz08-aurora/b5b/cache-extlinux-mm1.img
+2395232 32768 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/recovery.bin
+2428000 5206911 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/userdata.bin
--- a/b5b/emu/mkmap.py
+++ b/b5b/emu/mkmap.py
@ -0,0 +1,16 @@
+import struct,sys
+R="/home/q/doc/modem/jz08-aurora/"
+src={"modem":"logs/b5a/A4pre/modem.bin","sbl1":"logs/b5a/A3/sbl1.bin","sbl1bak":"partitions/sbl1bak.bin","aboot":"b5a/aboot-lk1st-aurora-autoboot.pad1M",
+"abootbak":"partitions/abootbak.bin","rpm":"logs/b5a/A3/rpm.bin","rpmbak":"partitions/rpmbak.bin","tz":"logs/b5a/A3/tz.bin","tzbak":"logs/b5a/A3/tzbak-305184.bin",
+"hyp":"logs/b5a/A3/hyp.bin","hypbak":"partitions/hypbak.bin","pad":"partitions/pad.bin","modemst1":"logs/b5a/A3/modemst1.bin","modemst2":"logs/b5a/A3/modemst2.bin",
+"misc":"partitions/misc.bin","fsc":"logs/b5a/A3/fsc.bin","ssd":"partitions/ssd.bin","splash":"partitions/splash.bin","DDR":"partitions/DDR.bin","fsg":"logs/b5a/A3/fsg.bin",
+"sec":"partitions/sec.bin","boot":"b5a/boot-emmc1-16MiB.img","system":"logs/b5a/A4pre/system.bin","persist":"logs/b5a/A3/persist.bin",
+"cache":sys.argv[1],"recovery":"logs/b5a/A3/recovery.bin","userdata":"logs/b5a/A4pre/userdata.bin"}
+g=open(R+"logs/b5a/A3/gpt-primary-34.bin","rb").read()
+print(0,34,R+"logs/b5a/A3/gpt-primary-34.bin")
+for i in range(128):
+    e=g[1024+128*i:1024+128*(i+1)]
+    if e[:16]==bytes(16): continue
+    f,l=struct.unpack("<QQ",e[32:48]); n=e[56:128].decode("utf-16le").rstrip("\0")
+    p=src[n]; p=p if p.startswith("/") else R+p
+    print(f,l-f+1,p)
--- a/b5b/emu/mkvariants.sh
+++ b/b5b/emu/mkvariants.sh
@ -0,0 +1,18 @@
+#!/bin/bash
+# Offline fault-injection copies of the candidate (in /tmp). Candidate itself untouched.
+set -e
+C=/home/q/doc/modem/jz08-aurora/b5b/cache-extlinux-mm1.img; D=/tmp/b5b-var; rm -rf $D; mkdir -p $D
+v(){ cp $C $D/$1.img; chmod u+w $D/$1.img; }
+v F1-no-conf;      debugfs -w -R "rm /extlinux/extlinux.conf" $D/F1-no-conf.img
+v F2-no-kernel;    debugfs -w -R "rm /Image.gz-dtb" $D/F2-no-kernel.img
+v F3-no-initrd;    debugfs -w -R "rm /initramfs.cpio.gz" $D/F3-no-initrd.img
+v F4-no-dtb;       debugfs -w -R "rm /aurora-mm1.dtb" $D/F4-no-dtb.img
+put(){ debugfs -w -R "rm $2" $D/$1.img; debugfs -w -R "write $3 $2" $D/$1.img; }
+printf "this is not an extlinux config\n" > $D/bad.conf;                         v F5-garbage-conf; put F5-garbage-conf /extlinux/extlinux.conf $D/bad.conf
+printf "default mm1\nlabel mm1\n\tlinux /Image.gz-dtb\n\tinitrd /initramfs.cpio.gz\n" > $D/nofdt.conf; v F6-no-fdt-line; put F6-no-fdt-line /extlinux/extlinux.conf $D/nofdt.conf
+sed "s/\$/\r/" ../extlinux.conf > $D/crlf.conf;                                  v F7-crlf-conf; put F7-crlf-conf /extlinux/extlinux.conf $D/crlf.conf
+printf "default mm1\nlabel mm1\n\tlinux /Image.gz-dtb\n\tfdt /aurora-mm1.dtb\n\tinitrd /initramfs.cpio.gz\n\tappend x" > $D/nonl.conf; v F8-no-final-newline; put F8-no-final-newline /extlinux/extlinux.conf $D/nonl.conf
+{ printf "\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\x03"; head -c 8000000 /dev/zero | tr "\0" "\377"; } > $D/badk;  v F9-corrupt-gzip-kernel; put F9-corrupt-gzip-kernel /Image.gz-dtb $D/badk
+head -c 134217728 /dev/zero > $D/F10-zeroed-cache.img
+cp $C $D/F11-bad-superblock.img; chmod u+w $D/F11-bad-superblock.img; printf "\x00\x00" | dd of=$D/F11-bad-superblock.img bs=1 seek=1080 conv=notrunc status=none
+ls $D/*.img
--- a/b5b/emu/shim.c
+++ b/b5b/emu/shim.c
@ -0,0 +1,120 @@
+/* Host shim for running exact lk2nd 23.1 boot scan / extlinux / ext2 code against eMMC image files. */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdarg.h>
+#include <stdint.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <openssl/sha.h>
+#include "shim/partition_parser.h"
+
+int _dprintf(const char *fmt, ...) { va_list ap; va_start(ap, fmt); printf("[lk] "); int r = vprintf(fmt, ap); va_end(ap); return r; }
+void platform_halt(void) { printf("HARNESS: platform_halt (panic)\n"); exit(3); }
+void _panic(void *caller, const char *fmt, ...) { va_list ap; va_start(ap, fmt); printf("HARNESS: PANIC "); vprintf(fmt, ap); va_end(ap); exit(3); }
+
+/* ---- virtual disk: LBA ranges -> files ---- */
+struct seg { uint64_t lba, n; const char *file; int fd; };
+static struct seg segs[64]; static int nsegs;
+static uint64_t disk_sectors = 7634944;
+static struct partition_entry ents[128]; static unsigned nents;
+uint64_t reads_bytes;
+
+static void load_map(const char *mapfile) {
+	FILE *f = fopen(mapfile, "r"); char path[512]; unsigned long long lba, n;
+	if (!f) { perror(mapfile); exit(2); }
+	while (fscanf(f, "%llu %llu %511s", &lba, &n, path) == 3) {
+		segs[nsegs].lba = lba; segs[nsegs].n = n; segs[nsegs].file = strdup(path);
+		segs[nsegs].fd = open(path, O_RDONLY); if (segs[nsegs].fd < 0) { perror(path); exit(2); }
+		off_t sz = lseek(segs[nsegs].fd, 0, SEEK_END);
+		if ((uint64_t)sz < n * 512) { fprintf(stderr, "short file %s\n", path); exit(2); }
+		nsegs++;
+	}
+	fclose(f);
+}
+static void load_gpt(const char *gptfile) {
+	unsigned char g[17408]; int fd = open(gptfile, O_RDONLY); if (fd < 0 || read(fd, g, sizeof g) != sizeof g) { perror(gptfile); exit(2); }
+	close(fd);
+	for (int i = 0; i < 128; i++) {
+		unsigned char *e = g + 1024 + 128 * i; int z = 1; for (int k = 0; k < 16; k++) if (e[k]) z = 0; if (z) continue;
+		memcpy(&ents[nents].first_lba, e + 32, 8); memcpy(&ents[nents].last_lba, e + 40, 8);
+		ents[nents].size = ents[nents].last_lba - ents[nents].first_lba + 1;
+		for (int k = 0; k < 36; k++) ents[nents].name[k] = e[56 + 2 * k];
+		nents++;
+	}
+}
+struct partition_entry *partition_get_partition_entries(void) { return ents; }
+unsigned partition_get_partition_count(void) { return nents; }
+uint32_t mmc_get_device_blocksize(void) { return 512; }
+uint64_t mmc_get_device_capacity(void) { return disk_sectors * 512; }
+uint32_t mmc_read(uint64_t addr, uint32_t *out, uint32_t len) {
+	uint8_t *o = (uint8_t *)out; reads_bytes += len;
+	while (len) {
+		uint64_t lba = addr / 512; struct seg *s = NULL;
+		for (int i = 0; i < nsegs; i++) if (lba >= segs[i].lba && lba < segs[i].lba + segs[i].n) s = &segs[i];
+		if (!s) { fprintf(stderr, "HARNESS: read of unmapped LBA %llu\n", (unsigned long long)lba); exit(4); }
+		uint64_t end = (s->lba + s->n) * 512, chunk = end - addr; if (chunk > len) chunk = len;
+		if (pread(s->fd, o, chunk, addr - s->lba * 512) != (ssize_t)chunk) { perror("pread"); exit(4); }
+		o += chunk; addr += chunk; len -= chunk;
+	}
+	return 0;
+}
+/* writes must never happen */
+uint32_t mmc_write(uint64_t a, uint32_t l, void *b) { (void)a;(void)l;(void)b; fprintf(stderr, "HARNESS: WRITE ATTEMPT\n"); abort(); }
+
+/* ---- target / platform ---- */
+uint8_t *fake_ddr; static uint8_t *scratch;
+void *target_get_scratch_address(void) { return scratch; }
+unsigned target_get_max_flash_size(void) { return 256u * 1024 * 1024; }
+unsigned board_machtype(void) { return 0; }
+void arch_clean_invalidate_cache_range(uintptr_t a, size_t l) { (void)a; (void)l; }
+const char *const *lk2nd_device_get_dtb_hints(void) { return NULL; }
+int fdt_open_into(const void *f, void *b, int s) { (void)f;(void)b;(void)s; return -1; }
+int fdt_overlay_apply(void *f, void *o) { (void)f;(void)o; return -1; }
+int fdt_pack(void *f) { (void)f; return -1; }
+
+static void hx(const char *what, const void *p, size_t n) {
+	unsigned char h[32]; SHA256(p, n, h); printf("HARNESS: %-8s sha256 ", what); for (int i = 0; i < 32; i++) printf("%02x", h[i]); printf(" (%zu bytes)\n", n);
+}
+void boot_linux(void *kernel, unsigned *tags, const char *cmdline, unsigned machtype, void *ramdisk, unsigned ramdisk_size, int boot_type) {
+	(void)machtype;
+	uint32_t *k = kernel; uint64_t image_size; memcpy(&image_size, (uint8_t *)kernel + 16, 8);
+	uint32_t dtsz = __builtin_bswap32(tags[1]);
+	printf("HARNESS: boot_linux reached: kernel @DDR+0x%lx tags @DDR+0x%lx ramdisk @DDR+0x%lx (%u) boot_type %d\n",
+	       (long)((uint8_t *)kernel - fake_ddr), (long)((uint8_t *)tags - fake_ddr), (long)((uint8_t *)ramdisk - fake_ddr), ramdisk_size, boot_type);
+	printf("HARNESS: kernel magic 0x%08x image_size 0x%llx end @DDR+0x%llx\n", k[14], (unsigned long long)image_size,
+	       (unsigned long long)((uint8_t *)kernel - fake_ddr) + image_size);
+	printf("HARNESS: cmdline '%s'\n", cmdline);
+	extern unsigned harness_kernel_len; hx("kernel", kernel, harness_kernel_len);
+	hx("dtb", tags, dtsz); hx("ramdisk", ramdisk, ramdisk_size);
+	exit(0);
+}
+unsigned harness_kernel_len = 23015432;
+
+void lk2nd_boot(void);
+void bio_init(void);
+void fs_init(void);
+void ext2_init(void);
+int main(int argc, char **argv) {
+	if (argc < 3) { fprintf(stderr, "usage: %s map gpt [kernel_len]\n", argv[0]); return 2; }
+	if (argc > 3) harness_kernel_len = strtoul(argv[3], 0, 0);
+	setvbuf(stdout, NULL, _IONBF, 0);
+	fake_ddr = calloc(1, 0x3200000); scratch = calloc(1, 256u * 1024 * 1024);
+	load_map(argv[1]); load_gpt(argv[2]);
+	bio_init(); fs_init();
+	lk2nd_boot();
+	printf("HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)\n");
+	{ /* diagnostics: mount result per scan candidate, same criteria as lk2nd_scan_devices */
+	  extern struct bdev_struct *bio_get_bdevs(void); extern int fs_mount(const char*,const char*,const char*); extern int fs_unmount(const char*);
+	  struct hl { struct hl *prev, *next; };
+	  struct hb { struct hl node; volatile int ref; char *name; long long size; size_t block_size; uint32_t block_count; char *label; _Bool is_leaf; };
+	  struct hl *head = (struct hl *)bio_get_bdevs();
+	  for (struct hl *n = head->next; n != head; n = n->next) { struct hb *b = (struct hb *)n; char mp[32];
+	    if (!b->is_leaf) continue;
+	    if (b->size < 16*1024*1024 && !(b->label && !strncmp(b->label, "boot", 4))) continue;
+	    snprintf(mp, sizeof mp, "/diag-%s", b->name); int r = fs_mount(mp, "ext2", b->name);
+	    printf("HARNESS: scan-candidate %-8s (%s) ext2 mount rc=%d\n", b->name, b->label ? b->label : "", r); if (r == 0) fs_unmount(mp); } }
+	printf("HARNESS: total bytes read %llu\n", (unsigned long long)reads_bytes);
+	return 1;
+}
+int atomic_add(volatile int *p, int v) { int o = *p; *p = o + v; return o; }
--- a/b5b/emu/shim/arch.h
+++ b/b5b/emu/shim/arch.h
@ -0,0 +1 @@
+#pragma once
--- a/b5b/emu/shim/arch/defines.h
+++ b/b5b/emu/shim/arch/defines.h
@ -0,0 +1,3 @@
+#pragma once
+#define PAGE_SIZE 4096
+#define CACHE_LINE 64
--- a/b5b/emu/shim/decompress.h
+++ b/b5b/emu/shim/decompress.h
@ -0,0 +1,3 @@
+#pragma once
+int decompress(unsigned char *in_buf, unsigned int in_len, unsigned char *out_buf, unsigned int out_buf_len, unsigned int *pos, unsigned int *out_len);
+int is_gzip_package(unsigned char *buf, unsigned int len);
--- a/b5b/emu/shim/harness_pre.h
+++ b/b5b/emu/shim/harness_pre.h
@ -0,0 +1,5 @@
+#pragma once
+#include <sys/types.h>
+enum boot_type { BOOT_TYPE_HARNESS_DUMMY = 0 };
+void arch_clean_invalidate_cache_range(addr_t start, size_t len);
+int atomic_add(volatile int *ptr, int val);
--- a/b5b/emu/shim/kernel/mutex.h
+++ b/b5b/emu/shim/kernel/mutex.h
@ -0,0 +1,5 @@
+#pragma once
+typedef struct { int x; } mutex_t;
+static inline void mutex_init(mutex_t *m) { (void)m; }
+static inline int mutex_acquire(mutex_t *m) { (void)m; return 0; }
+static inline int mutex_release(mutex_t *m) { (void)m; return 0; }
--- a/b5b/emu/shim/libfdt.h
+++ b/b5b/emu/shim/libfdt.h
@ -0,0 +1,4 @@
+#pragma once
+int fdt_open_into(const void *fdt, void *buf, int bufsize);
+int fdt_overlay_apply(void *fdt, void *fdto);
+int fdt_pack(void *fdt);
--- a/b5b/emu/shim/lk2nd/boot.h
+++ b/b5b/emu/shim/lk2nd/boot.h
@ -0,0 +1,2 @@
+#pragma once
+void lk2nd_boot(void);
--- a/b5b/emu/shim/lk2nd/device.h
+++ b/b5b/emu/shim/lk2nd/device.h
@ -0,0 +1,2 @@
+#pragma once
+const char *const *lk2nd_device_get_dtb_hints(void);
--- a/b5b/emu/shim/lk2nd/hw/bdev.h
+++ b/b5b/emu/shim/lk2nd/hw/bdev.h
@ -0,0 +1,2 @@
+#pragma once
+void lk2nd_bdev_init(void);
--- a/b5b/emu/shim/lk2nd/init.h
+++ b/b5b/emu/shim/lk2nd/init.h
@ -0,0 +1,2 @@
+#pragma once
+#define LK2ND_INIT(f)
--- a/b5b/emu/shim/partition_parser.h
+++ b/b5b/emu/shim/partition_parser.h
@ -0,0 +1,11 @@
+#pragma once
+#define MAX_GPT_NAME_SIZE 72
+struct partition_entry {
+	unsigned long long first_lba, last_lba, size;
+	unsigned char name[MAX_GPT_NAME_SIZE];
+};
+struct partition_entry *partition_get_partition_entries(void);
+unsigned partition_get_partition_count(void);
+uint32_t mmc_get_device_blocksize(void);
+uint64_t mmc_get_device_capacity(void);
+uint32_t mmc_read(uint64_t data_addr, uint32_t *out, uint32_t data_len);
--- a/b5b/emu/shim/platform.h
+++ b/b5b/emu/shim/platform.h
@ -0,0 +1 @@
+#pragma once
--- a/b5b/emu/shim/platform/debug.h
+++ b/b5b/emu/shim/platform/debug.h
@ -0,0 +1,4 @@
+#pragma once
+#include <stdarg.h>
+int _dprintf(const char *fmt, ...);
+void platform_halt(void);
--- a/b5b/emu/shim/platform/iomap.h
+++ b/b5b/emu/shim/platform/iomap.h
@ -0,0 +1,4 @@
+#pragma once
+#include <stdint.h>
+extern uint8_t *fake_ddr;
+#define DDR_START ((uintptr_t)fake_ddr)
--- a/b5b/emu/shim/printf.h
+++ b/b5b/emu/shim/printf.h
@ -0,0 +1,7 @@
+#pragma once
+#include <stdarg.h>
+#include <stddef.h>
+int printf(const char *fmt, ...);
+int sprintf(char *str, const char *fmt, ...);
+int snprintf(char *str, size_t len, const char *fmt, ...);
+int vsnprintf(char *str, size_t len, const char *fmt, va_list ap);
--- a/b5b/emu/shim/smem.h
+++ b/b5b/emu/shim/smem.h
@ -0,0 +1 @@
+#pragma once
--- a/b5b/emu/shim/target.h
+++ b/b5b/emu/shim/target.h
@ -0,0 +1,4 @@
+#pragma once
+void *target_get_scratch_address(void);
+unsigned target_get_max_flash_size(void);
+unsigned board_machtype(void);
--- a/b5b/emu/srclist
+++ b/b5b/emu/srclist
@ -0,0 +1 @@
+/tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lk2nd/boot/boot.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lk2nd/boot/extlinux.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lk2nd/boot/util.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lk2nd/hw/bdev/bdev.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lk2nd/hw/bdev/wrapper.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lk2nd/hw/bdev/util.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/bio/bio.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/bio/subdev.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/partition/partition.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/fs/fs.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/fs/ext2/ext2.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/fs/ext2/dir.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/fs/ext2/file.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/fs/ext2/io.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/bcache/bcache.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/zlib_inflate/decompress.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/zlib_inflate/inflate.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/zlib_inflate/inffast.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/zlib_inflate/inftrees.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/zlib_inflate/zutil.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/zlib_inflate/crc32.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/zlib_inflate/adler32.c
--- a/b5b/extlinux.conf
+++ b/b5b/extlinux.conf
@ -0,0 +1,6 @@
+default mm1
+label mm1
+	linux /Image.gz-dtb
+	fdt /aurora-mm1.dtb
+	initrd /initramfs.cpio.gz
+	append earlycon console=ttyMSM0,115200n8 ignore_loglevel loglevel=8 rdinit=/init
--- a/b5b/mkfs-candidate.sh
+++ b/b5b/mkfs-candidate.sh
@ -0,0 +1,20 @@
+#!/bin/bash
+# B5b candidate: minimal ext2 image, exactly cache-sized (134217728 B), deterministic. Offline only.
+set -e
+cd ~/doc/modem/jz08-aurora/b5b
+OUT=${1:-cache-extlinux-mm1.img}
+ST=$(mktemp -d)
+mkdir -p $ST/extlinux
+cp components/Image.gz-dtb components/aurora-mm1.dtb components/initramfs.cpio.gz $ST/
+printf "default mm1\nlabel mm1\n\tlinux /Image.gz-dtb\n\tfdt /aurora-mm1.dtb\n\tinitrd /initramfs.cpio.gz\n\tappend %s\n" "$(cat components/cmdline.txt)" > $ST/extlinux/extlinux.conf
+cp $ST/extlinux/extlinux.conf extlinux.conf
+chmod 0644 $ST/*.* $ST/extlinux/extlinux.conf; chmod 0755 $ST $ST/extlinux
+find $ST -exec touch -h -d @1790000000 {} +
+rm -f $OUT; truncate -s 134217728 $OUT
+E2FSPROGS_FAKE_TIME=1790000000 /sbin/mke2fs -F -q -t ext2 -O none,filetype,sparse_super \
+  -b 4096 -I 128 -N 64 -m 0 -L aurora-mm1 -U 4a5a3038-b5b0-4000-8000-00000000b5b0 \
+  -E root_owner=0:0,hash_seed=4a5a3038-b5b0-4000-8000-00000000b5b1 -d $ST $OUT 32768
+rm -rf $ST
+for f in / /lost+found /extlinux /extlinux/extlinux.conf /Image.gz-dtb /aurora-mm1.dtb /initramfs.cpio.gz; do for t in atime ctime mtime; do echo "sif $f $t @1790000000"; done; done > /tmp/b5b-sif.$$
+/sbin/debugfs -w -f /tmp/b5b-sif.$$ $OUT >/dev/null 2>&1; rm -f /tmp/b5b-sif.$$
+stat -c "%n %s" $OUT; sha256sum $OUT
--- a/b6/SHA256SUMS
+++ b/b6/SHA256SUMS
@ -0,0 +1,8 @@
+df26d58a38eac85ecb5516ba03d183ebb43a1d35ecbf14d4e1849276bcab56ef  aurora-modem
+7e3521b0e6e71d4b5527845298f04d9d812ccf3bc4070b5ec6e93cb5e08bdaf6  aurora-modem.conf
+3a31c16cdcdd86b52f0097b8eefd16de9b44f83b307ed60d16f743e3f5c0f436  aurora-modem-datatest
+a235b7b6b2041e51a3b9b9ebdc8200ba1bc434194e9b9c242205ae53e11b2373  b6-run.sh
+5c7a610a48f1773710214f5f800a385d2d6806172614ed0ca2c6391ba72638a7  aurora-modem-start
+aad437c22a37b2b7491c0628288c5dc34908d14b0ac7cca07863d394df04b5e7  aurora-modem-stop
+60e5868ee407e0e800c1c41bef3f3900292f104ad25a485ef8f9558f4eaf2338  aurora-modem-status
+2ddb249630f7420cd1325bba704d015978710ed466fe3305138c54813cfb43a5  ro-check.sh
--- a/b6/aurora-modem
+++ b/b6/aurora-modem
@ -0,0 +1,293 @@
+#!/bin/sh
+# B6 RAM-only modem lifecycle controller for Aurora (golden mm1). Lives in /tmp only.
+#   aurora-modem start | stop | status | addroute <ipv4>
+# Reconstructs the proven flow (NOTES sessions 14-22 Aurora, JZ02 stopcycle/wwanfix/openrc):
+#   start: RO gates -> rmtfs -r -P -s -v (rmtfs -s starts MSS) -> MSS running -> wwan0qmi0+wwan0 (+2 s, JZ02 port-race guard)
+#          -> qmicli -p DMS online (one SET, only if not online) -> NAS registered + PS attached -> kill qmi-proxy
+#          -> udevd/dbus/polkitd/ModemManager -> MM modem registered -> ONE simple-connect -> bearer IPv4 on wwanN
+#          + /32 host routes only (no default route, usb0 untouched).
+#   stop:  simple-disconnect -> MM disable (radio low-power = detach) -> del our /32 routes, flush+down all wwan* -> stop MM (+qmi-proxy) -> BAM-DMUX suspended
+#          -> SIGTERM rmtfs: rmtfs writes "stop" to remoteproc state (MSS stops while rmtfs still serves) -> rmtfs exits LAST.
+# Never writes eMMC/NV: rmtfs -r keeps EFS writes in RAM; the script refuses to run unless the NV partitions are getro=1.
+# Exit: 0 ok, 1 failure/timeout (start rolls back with a full stop unless MODEM_KEEP_ON_FAIL=1), 2 usage/config error.
+
+CONF=${MODEM_CONF:-/tmp/aurora-modem.conf}
+D=/tmp/aurora-modem.d; mkdir -p $D
+LOG=$D/lifecycle.log; STATE=$D/state; ROUTES=$D/routes; BEARER=$D/bearer
+RPNAME=4080000.remoteproc
+BAM=/sys/bus/platform/devices/4080000.remoteproc:bam-dmux
+Q="qmicli -p -d /dev/wwan0qmi0"
+
+# --- timeouts (s); override in $CONF
+T_RMTFS=5 T_MSS=60 T_QMI_DEV=30 T_QMI=45 T_SIM=60 T_ONLINE=30 T_REG=180 T_MM_DETECT=150 T_MM_REG=60 T_CONNECT=150
+MODEM_REATTACH_HOLDOFF=120	# s between radio stop and next MSS start (B6: re-attach <=61 s after stop was rejected 3/3 by Beeline)
+T_DISCONNECT=60 T_DISABLE=30 T_MM_EXIT=30 T_BAM_IDLE=15 T_MSS_STOP=30 T_RMTFS_EXIT=15
+MODEM_APN= MODEM_USER= MODEM_PASSWORD= MODEM_AUTH= MODEM_IP_TYPE=ipv4 MODEM_TEST_ROUTES= KEEP=${MODEM_KEEP_ON_FAIL:-0}
+[ -f "$CONF" ] && . "$CONF"
+MODEM_KEEP_ON_FAIL=${MODEM_KEEP_ON_FAIL:-$KEEP}
+
+mmc() { mmcli "$@" 2>/dev/null | tr -d '\033' | sed 's/\[[0-9;]*m//g'; }	# mmcli colours values even without a tty
+now() { cut -d' ' -f1 /proc/uptime; }
+log() { m="[$(now)] $*"; echo "$m" >> $LOG; echo "$m"; echo "<5>[aurora-modem] $*" > /dev/kmsg 2>/dev/null; }
+setstate() { o=$(cat $STATE 2>/dev/null); echo "$1" > $STATE; log "STATE ${o:-OFF} -> $1"; }
+die() { log "FAIL: $*"; exit 1; }
+# wait_for TIMEOUT INTERVAL cmd... : poll a real condition, no blind sleeps
+wait_for() { _to=$1; _iv=$2; shift 2; _t0=$(now)
+	while :; do "$@" && return 0
+		[ "$(awk -v a="$(now)" -v b="$_t0" -v t="$_to" 'BEGIN{print (a-b>=t)}')" = 1 ] && return 1
+		sleep $_iv; done; }
+since() { awk -v a="$(now)" -v b="$1" 'BEGIN{printf "%.1f", a-b}'; }
+
+rp() { for r in /sys/class/remoteproc/remoteproc*; do [ "$(cat $r/name 2>/dev/null)" = $RPNAME ] && echo $r && return; done; }
+mss_state() { r=$(rp); [ -n "$r" ] && cat $r/state || echo none; }
+mss_is() { [ "$(mss_state)" = "$1" ]; }
+rmtfs_pid() { pidof rmtfs; }
+mm_pid() { pidof ModemManager; }
+bam_pm() { cat $BAM/power/runtime_status 2>/dev/null || echo none; }
+bam_suspended() { [ "$(bam_pm)" = suspended ]; }
+qmi_dev() { [ -e /dev/wwan0qmi0 ] && [ -e /sys/class/net/wwan0 ]; }
+link_up() { [ $(( $(cat /sys/class/net/$1/flags) & 1 )) -ne 0 ]; }
+mm_idx() { mmc -L | grep -oE "Modem/[0-9]+" | head -1 | cut -d/ -f2; }
+mm_has_modem() { [ -n "$(mm_idx)" ]; }
+mm_state() { mmc -m "$(mm_idx)" | awk -F': ' '/\| +state: /{gsub(/ /,"",$2); print $2; exit}'; }
+# MM initialized: proven session 22 pass 1 connected from 'disabled' (Simple.Connect enables the modem itself)
+mm_usable() { case "$(mm_state)" in disabled|enabling|enabled|searching|registered|connected|connecting) return 0;; esac; return 1; }
+qmi_ok() { timeout 20 $Q --dms-get-operating-mode > $D/qmi-mode.txt 2>&1 && grep -q "Mode:" $D/qmi-mode.txt; }
+qmi_reg() { timeout 20 $Q --nas-get-serving-system > $D/qmi-ss.txt 2>&1
+	grep -q "Registration state: 'registered'" $D/qmi-ss.txt && grep -q "PS: 'attached'" $D/qmi-ss.txt; }
+sim_ready() { timeout 20 $Q --uim-get-card-status > $D/qmi-uim.txt 2>&1
+	grep -q "Card state: 'present'" $D/qmi-uim.txt && grep -q "Application state: 'ready'" $D/qmi-uim.txt; }
+set_online() { timeout 20 $Q --dms-set-operating-mode=online > $D/qmi-set.txt 2>&1; r=$?; cat $D/qmi-set.txt >> $LOG
+	[ $r = 0 ] && return 0; grep -q "DeviceNotReady" $D/qmi-set.txt || { echo hard > $D/qmi-set.err; return 0; }; return 1; }
+# this mmcli has no --list-bearers ("no actions specified"); use 'Bearer | paths:' of mmcli -m, not the initial (attach) bearer
+bearers() { mmc -m "$(mm_idx)" | grep -v "initial bearer" | grep -oE "Bearer/[0-9]+" | cut -d/ -f2; }
+any_bearer_connected() { for b in $(bearers); do mmc -b $b | grep -q "connected: yes" && return 0; done; return 1; }
+bearer_field() { awk -F': ' -v k="$1" '$1 ~ " "k"$" {gsub(/ /,"",$2); print $2; exit}' $BEARER.txt; }
+
+check_safety() {
+	for p in modemst1 modemst2 fsc fsg persist; do
+		d=/dev/disk/by-partlabel/$p; [ -e $d ] || return 1
+		[ "$(blockdev --getro $(readlink -f $d))" = 1 ] || { log "SAFETY: $p not RO"; return 1; }
+	done
+	[ "$(blockdev --getro /dev/mmcblk0)" = 1 ] || { log "SAFETY: mmcblk0 not RO"; return 1; }
+	grep -q " /firmware .* ro," /proc/mounts || { log "SAFETY: /firmware not mounted ro"; return 1; }
+	[ "$(cat /sys/module/firmware_class/parameters/path)" = /firmware/image ] || { log "SAFETY: firmware path"; return 1; }
+	return 0
+}
+connect_args() {
+	for v in "$MODEM_APN" "$MODEM_USER" "$MODEM_PASSWORD" "$MODEM_AUTH" "$MODEM_IP_TYPE"; do
+		case "$v" in *[,\"\'=]*) echo "BAD"; return;; esac; done
+	a="apn=$MODEM_APN"
+	[ -n "$MODEM_USER" ] && a="$a,user=$MODEM_USER"
+	[ -n "$MODEM_PASSWORD" ] && a="$a,password=$MODEM_PASSWORD"
+	[ -n "$MODEM_AUTH" ] && a="$a,allowed-auth=$MODEM_AUTH"
+	echo "$a,ip-type=$MODEM_IP_TYPE"
+}
+addroute() { # /32 via the bearer interface, recorded so stop removes exactly what we added
+	ip=$1; . $D/ipcfg 2>/dev/null || { echo "no bearer ipcfg"; return 1; }
+	grep -qx "$ip" $ROUTES 2>/dev/null && return 0
+	ip route add $ip/32 dev $IF src $A && echo $ip >> $ROUTES
+}
+diag() { # snapshot before rollback
+	{ echo "### diag $(now) state=$(cat $STATE 2>/dev/null) mss=$(mss_state) rmtfs=$(rmtfs_pid) mm=$(mm_pid) bam=$(bam_pm)"
+	  [ -n "$(mm_pid)" ] && { mmc -L; mmc -m "$(mm_idx)"; }
+	  cat $D/qmi-mode.txt $D/qmi-ss.txt 2>/dev/null; dmesg | tail -40; } > $D/diag-$(now).txt 2>&1
+}
+fail_start() { log "FAIL in $(cat $STATE 2>/dev/null): $*"; diag
+	if [ "$MODEM_KEEP_ON_FAIL" = 1 ]; then log "MODEM_KEEP_ON_FAIL=1: leaving stack as is"
+	else log "rollback: full stop"; do_stop; fi
+	exit 1; }
+
+do_start() {
+	T0=$(now); log "=== START (conf $CONF, apn '${MODEM_APN}', ip-type $MODEM_IP_TYPE)"
+	[ -n "$MODEM_APN" ] || { log "config: MODEM_APN empty - refusing (no APN guessing)"; exit 2; }
+	CA=$(connect_args); [ "$CA" = BAD ] && { log "config: forbidden character in APN/user/password/auth"; exit 2; }
+	check_safety || { log "FAIL: safety gate (RO) - nothing started"; exit 1; }
+	[ -n "$(rp)" ] || { log "FAIL: remoteproc $RPNAME not found"; exit 1; }
+
+	# OFF -> RMTFS_READY -> MPSS_BOOTING -> MPSS_RUNNING
+	if [ -n "$(rmtfs_pid)" ] && mss_is running; then log "rmtfs $(rmtfs_pid) + MSS running already - reuse"
+	elif [ -n "$(rmtfs_pid)" ] || ! mss_is offline; then
+		log "FAIL: inconsistent (rmtfs='$(rmtfs_pid)' MSS=$(mss_state)); run stop first"; exit 1
+	else
+		if [ -f $D/last-radio-stop ]; then
+			w=$(awk -v a="$(now)" -v b="$(cat $D/last-radio-stop)" -v h="$MODEM_REATTACH_HOLDOFF" 'BEGIN{d=h-(a-b); printf "%d", (d>0)?d+1:0}')
+			[ "$w" -gt 0 ] && { log "re-attach holdoff: last radio stop $(since $(cat $D/last-radio-stop))s ago, waiting ${w}s (MODEM_REATTACH_HOLDOFF=$MODEM_REATTACH_HOLDOFF)"; sleep $w; }
+		fi
+		: > $ROUTES; rm -f $D/ipcfg
+		LD_PRELOAD=/usr/lib/linebuf.so rmtfs -r -P -s -v >> $D/rmtfs.log 2>&1 &
+		echo $! > $D/rmtfs.pid
+		wait_for $T_RMTFS 0.2 sh -c "kill -0 $(cat $D/rmtfs.pid) 2>/dev/null && grep -q 'registering services' $D/rmtfs.log" \
+			|| fail_start "rmtfs did not start (pid $(cat $D/rmtfs.pid))"
+		setstate RMTFS_READY
+		setstate MPSS_BOOTING
+		t=$(now); wait_for $T_MSS 0.2 mss_is running || fail_start "MSS not running after ${T_MSS}s (state $(mss_state))"
+		log "MSS running after $(since $t)s"
+	fi
+	setstate MPSS_RUNNING
+
+	# -> QMI_READY
+	t=$(now); wait_for $T_QMI_DEV 0.2 qmi_dev || fail_start "wwan0qmi0/wwan0 missing after ${T_QMI_DEV}s"
+	log "wwan0qmi0 + wwan0 present after $(since $t)s; +2 s (JZ02 rpmsg_wwan_ctrl port-race guard, proven start_post)"
+	sleep 2
+	[ "$(bam_pm)" = error ] && fail_start "BAM-DMUX runtime_status=error"
+
+	# -> RADIO_ONLINE -> REGISTERED  (Aurora-proven: qmicli online + NAS poll before ModemManager)
+	if [ -n "$(mm_pid)" ]; then
+		log "ModemManager already running - skip qmicli, use MM state"
+		setstate QMI_READY
+	else
+		t=$(now); wait_for $T_QMI 1 qmi_ok || fail_start "QMI DMS not answering after ${T_QMI}s"
+		setstate QMI_READY; log "DMS $(grep -o "Mode: '[^']*'" $D/qmi-mode.txt) after $(since $t)s"
+		t=$(now); wait_for $T_SIM 1 sim_ready || fail_start "SIM/USIM not ready after ${T_SIM}s ($(grep -E "Card state|Application state" $D/qmi-uim.txt | head -2 | tr -s ' \t\n' ' '))"
+		setstate SIM_READY; log "UIM card present, USIM app ready after $(since $t)s"
+		if ! grep -q "Mode: 'online'" $D/qmi-mode.txt; then
+			log "SET: $Q --dms-set-operating-mode=online (retried only on DeviceNotReady, <= ${T_ONLINE}s)"
+			rm -f $D/qmi-set.err; t=$(now); wait_for $T_ONLINE 1 set_online || fail_start "SET online: DeviceNotReady for ${T_ONLINE}s"
+			[ -f $D/qmi-set.err ] && fail_start "SET online failed: $(grep -i error $D/qmi-set.txt | head -1)"
+			qmi_ok && grep -q "Mode: 'online'" $D/qmi-mode.txt || fail_start "mode not online after SET"
+			log "DMS online after $(since $t)s"
+		fi
+		setstate RADIO_ONLINE
+		t=$(now); wait_for $T_REG 2 qmi_reg || fail_start "not registered+PS attached after ${T_REG}s ($(grep -E "Registration state" $D/qmi-ss.txt | tr -s ' \t'))"
+		log "registered: $(grep -oE "(MCC|MNC|Description): '[^']*'" $D/qmi-ss.txt | tr '\n' ' ')after $(since $t)s"
+		setstate REGISTERED
+		killall qmi-proxy 2>/dev/null; wait_for 5 0.2 sh -c '! pidof qmi-proxy >/dev/null'
+	fi
+
+	# -> MM_READY  (mm-up order: udevd, trigger, settle, dbus, polkitd, ModemManager)
+	pidof udevd >/dev/null || { udevd --daemon; udevadm trigger --action=add; udevadm settle --timeout=15; log "udevd started"; }
+	if ! pidof dbus-daemon >/dev/null; then
+		mkdir -p /run/dbus /var/lib/dbus /var/lib/polkit; rm -f /run/dbus/pid; dbus-uuidgen --ensure
+		dbus-daemon --system --fork || fail_start "dbus-daemon"; log "dbus started"; fi
+	pidof polkitd >/dev/null || { /usr/lib/polkit-1/polkitd --no-debug >> $D/polkitd.log 2>&1 & log "polkitd started"; }
+	if [ -z "$(mm_pid)" ]; then
+		N=$(ls $D/mm-*.log 2>/dev/null | wc -l)
+		ModemManager --debug > $D/mm-$N.log 2>&1 &
+		echo $! > $D/mm.pid; log "ModemManager started pid $! (log mm-$N.log)"
+	fi
+	t=$(now); wait_for $T_MM_DETECT 2 mm_has_modem || fail_start "MM: no modem after ${T_MM_DETECT}s"
+	log "MM modem $(mm_idx) detected after $(since $t)s"
+	mmc -m "$(mm_idx)" > $D/mm-modem.txt
+	grep -q "plugin: qcom-soc" $D/mm-modem.txt || fail_start "MM plugin is not qcom-soc"
+	grep -q "primary port: wwan0qmi0" $D/mm-modem.txt || fail_start "MM primary port is not wwan0qmi0"
+	setstate MM_READY
+	t=$(now); wait_for $T_MM_REG 2 mm_usable || fail_start "MM state '$(mm_state)' not usable after ${T_MM_REG}s"
+	log "MM state $(mm_state) after $(since $t)s"
+
+	# -> BEARER_CONNECTED  (exactly one simple-connect)
+	if any_bearer_connected; then log "bearer already connected - reuse"
+	else
+		log "mmcli -m $(mm_idx) --simple-connect=\"$(echo "$CA" | sed 's/password=[^,]*/password=***/')\""
+		timeout $T_CONNECT mmcli -m "$(mm_idx)" --simple-connect="$CA" >> $LOG 2>&1 || fail_start "simple-connect failed/timeout"
+	fi
+	BR=; for b in $(bearers); do mmc -b $b | grep -q "connected: yes" && BR=$b; done
+	[ -n "$BR" ] || fail_start "no connected bearer after simple-connect"
+	mmc -m "$(mm_idx)" > $D/mm-modem.txt
+	grep -qE "registration: (home|roaming)" $D/mm-modem.txt || fail_start "MM registration not home/roaming after connect"
+	log "MM state $(mm_state), $(grep -oE "registration: [a-z]+" $D/mm-modem.txt)"
+	mmc -b $BR > $BEARER.txt
+	IF=$(bearer_field interface); A=$(bearer_field address); PF=$(bearer_field prefix); GW=$(bearer_field gateway)
+	DNS=$(bearer_field dns); MTU=$(bearer_field mtu)
+	echo "$IF" | grep -qE '^wwan[0-7]$' && [ -n "$A" ] && [ -n "$PF" ] || fail_start "bearer $BR bad ipv4 config IF=$IF A=$A PF=$PF"
+	printf 'BR=%s\nIF=%s\nA=%s\nPF=%s\nGW=%s\nDNS=%s\nMTU=%s\n' "$BR" "$IF" "$A" "$PF" "$GW" "$DNS" "$MTU" > $D/ipcfg
+	log "bearer $BR: $IF $A/$PF gw $GW dns $DNS mtu $MTU"
+	ip addr flush dev $IF; ip addr add $A/$PF dev $IF || fail_start "ip addr add"
+	[ -n "$MTU" ] && ip link set $IF mtu $MTU
+	ip link set $IF up || fail_start "ip link set $IF up (bam-dmux runtime PM?)"
+	link_up $IF || fail_start "$IF not UP"
+	for h in $(echo "$DNS" | tr ',' ' ') $MODEM_TEST_ROUTES; do addroute $h || fail_start "route $h"; done
+	ip route get 172.16.42.2 2>&1 | grep -q "dev usb0" || fail_start "management route no longer via usb0"
+	ip route | grep -q "^default" && log "WARNING: a default route exists (not created by us)"
+	setstate BEARER_CONNECTED
+	log "=== START OK in $(since $T0)s ($IF $A/$PF, routes: $(tr '\n' ' ' < $ROUTES))"
+}
+
+do_stop() {
+	T0=$(now); log "=== STOP (from $(cat $STATE 2>/dev/null || echo OFF): mss=$(mss_state) rmtfs=$(rmtfs_pid) mm=$(mm_pid) bam=$(bam_pm))"
+	rc=0
+	# 1. disconnect bearer(s)
+	if [ -n "$(mm_pid)" ] && mm_has_modem; then
+		timeout $T_DISCONNECT mmcli -m "$(mm_idx)" --simple-disconnect >> $LOG 2>&1; log "simple-disconnect rc=$? (bearers: $(bearers | tr '\n' ' '))"
+		wait_for 15 1 sh -c "! sh $0 _anyconn" && log "no bearer connected" || { log "WARNING: bearer still connected"; rc=1; }
+		# 1b. radio off / network detach before MSS goes away (B6 addition: abrupt MSS stop while EPS-attached
+		#     was followed by attach rejection 'limited' on quick restart). MM disable = DMS low-power.
+		timeout $T_DISABLE mmcli -m "$(mm_idx)" --disable >> $LOG 2>&1; r=$?
+		wait_for 10 0.5 sh -c "[ \"\$(sh $0 _mmstate)\" = disabled ]" && log "MM disable rc=$r -> state disabled (radio low-power, detached)" \
+			|| { log "WARNING: MM disable rc=$r state '$(mm_state)'"; rc=1; }
+	elif [ -e /dev/wwan0qmi0 ] && mss_is running; then
+		timeout 20 $Q --dms-set-operating-mode=low-power >> $LOG 2>&1; log "qmicli low-power rc=$? (MM not running)"
+	fi
+	# 2. our /32 routes, 3. flush + DOWN every wwan*
+	for h in $(cat $ROUTES 2>/dev/null); do ip route del $h/32 2>/dev/null; done; : > $ROUTES
+	for d in /sys/class/net/wwan*; do [ -e "$d" ] || continue; w=${d##*/}
+		ip addr flush dev $w 2>/dev/null; ip link set $w down 2>/dev/null
+		link_up $w && { log "ERROR: $w still UP"; rc=1; }; done
+	rm -f $D/ipcfg
+	ip route | grep -q " dev wwan" && { log "ERROR: routes via wwan remain: $(ip route | grep ' dev wwan' | tr '\n' ';')"; rc=1; }
+	log "wwan links down, addresses/routes removed"
+	[ -n "$(cat $STATE 2>/dev/null)" ] && setstate WWAN_DOWN
+	# 4. stop ModemManager (+ its qmi-proxy)
+	if [ -n "$(mm_pid)" ]; then
+		kill -TERM $(mm_pid); wait_for $T_MM_EXIT 0.5 sh -c '! pidof ModemManager >/dev/null' \
+			|| { log "MM did not exit in ${T_MM_EXIT}s - SIGKILL"; kill -KILL $(mm_pid) 2>/dev/null; rc=1; }
+		log "ModemManager stopped"
+	fi
+	pidof qmi-proxy >/dev/null && { killall qmi-proxy; wait_for 5 0.2 sh -c '! pidof qmi-proxy >/dev/null'; log "qmi-proxy stopped"; }
+	setstate MM_STOPPED
+	# 5. BAM-DMUX idle
+	if [ -e $BAM ] && ! mss_is offline; then
+		t=$(now); if wait_for $T_BAM_IDLE 0.5 bam_suspended; then log "BAM-DMUX suspended after $(since $t)s"
+		else log "ERROR: BAM-DMUX '$(bam_pm)' not suspended after ${T_BAM_IDLE}s - NOT stopping MSS"; exit 1; fi
+	fi
+	# 6. MSS stop via rmtfs -s (SIGTERM -> pwrite "stop" to remoteproc state -> exit), 7. rmtfs exits last
+	P=$(rmtfs_pid)
+	mss_is running && now > $D/last-radio-stop
+	if [ -n "$P" ]; then
+		t=$(now); kill -TERM $P; log "SIGTERM rmtfs $P (rmtfs stops MSS, then exits)"
+		wait_for $T_MSS_STOP 0.2 mss_is offline && log "MSS offline after $(since $t)s (rmtfs alive: $(kill -0 $P 2>/dev/null && echo yes || echo no))" \
+			|| { log "ERROR: MSS '$(mss_state)' after ${T_MSS_STOP}s"; rc=1; }
+		setstate MPSS_STOPPED
+		wait_for $T_RMTFS_EXIT 0.2 sh -c "! kill -0 $P 2>/dev/null" && log "rmtfs exited after $(since $t)s" \
+			|| { log "rmtfs still alive - second SIGTERM"; kill -TERM $P; wait_for 5 0.2 sh -c "! kill -0 $P 2>/dev/null" || { kill -KILL $P; rc=1; }; }
+	elif ! mss_is offline && [ -n "$(rp)" ]; then
+		log "MSS $(mss_state) without rmtfs - echo stop > state"; echo stop > $(rp)/state
+		wait_for $T_MSS_STOP 0.2 mss_is offline || rc=1
+	fi
+	mss_is offline || mss_is none || { log "ERROR: MSS state $(mss_state)"; rc=1; }
+	setstate OFF
+	log "=== STOP done rc=$rc in $(since $T0)s (mss=$(mss_state) rmtfs='$(rmtfs_pid)' mm='$(mm_pid)' bam=$(bam_pm))"
+	return $rc
+}
+
+do_status() {
+	r=$(rp)
+	echo "controller: $(cat $STATE 2>/dev/null || echo OFF)"
+	echo "remoteproc: $RPNAME $(mss_state) ($r) fw=$(cat $r/firmware 2>/dev/null)"
+	echo "rmtfs:      pid='$(rmtfs_pid)' writes_logged=$(grep -c 'write ' $D/rmtfs.log 2>/dev/null)"
+	echo "qmi dev:    $(ls /dev/wwan0qmi0 2>/dev/null || echo absent)  qmi-proxy='$(pidof qmi-proxy)'"
+	echo "daemons:    udevd='$(pidof udevd)' dbus='$(pidof dbus-daemon)' polkitd='$(pidof polkitd)' ModemManager='$(mm_pid)'"
+	if [ -n "$(mm_pid)" ] && mm_has_modem; then
+		mmc -m "$(mm_idx)" | grep -E "\| +(state|power state|registration|operator name|access tech|signal quality|plugin|primary port): " \
+			| sed -E 's/^[^|]*\| */  mm /'
+		for b in $(bearers); do echo "  bearer $b: $(mmc -b $b | grep -E 'connected:|interface:|address:' | tr -s ' |' ' ' | tr '\n' ';')"; done
+	else echo "  mm: n/a"; fi
+	for d in /sys/class/net/wwan*; do [ -e "$d" ] || continue; w=${d##*/}
+		link_up $w && echo "wwan:       $w UP $(ip -4 addr show $w | awk '/inet /{print $2}')"; done
+	echo "wwan up:    $(n=0; for d in /sys/class/net/wwan*; do [ -e $d ] && link_up ${d##*/} && n=$((n+1)); done; echo $n) of $(ls -d /sys/class/net/wwan* 2>/dev/null | wc -l)"
+	echo "routes:     $(ip route | grep ' dev wwan' | tr '\n' ';')"
+	echo "bam-dmux:   $(bam_pm) active_ms=$(cat $BAM/power/runtime_active_time 2>/dev/null) suspended_ms=$(cat $BAM/power/runtime_suspended_time 2>/dev/null) control=$(cat $BAM/power/control 2>/dev/null)"
+	echo "usb0:       $(ip -4 addr show usb0 | awk '/inet /{print $2}') route-to-host: $(ip route get 172.16.42.2 2>&1 | head -1)"
+	echo "emmc:       $(awk '{print "writes_completed="$5" sectors_written="$7}' /sys/block/mmcblk0/stat)"
+	echo "dmesg-errs: $(dmesg | grep -cE 'Failed to resume|Resource temporarily|crash detected|fatal error|[Ww]atchdog|Oops|Kernel panic|Unable to handle')"
+}
+
+case "$1" in
+	start) do_start;;
+	stop) do_stop; exit $?;;
+	status) do_status;;
+	addroute) [ -n "$2" ] || exit 2; addroute "$2";;
+	_anyconn) any_bearer_connected;;
+	_mmstate) mm_state;;
+	*) echo "usage: $0 start|stop|status|addroute <ipv4>"; exit 2;;
+esac
--- a/b6/aurora-modem-datatest
+++ b/b6/aurora-modem-datatest
@ -0,0 +1,28 @@
+#!/bin/sh
+# B6 data-path test through the bearer set up by aurora-modem start. Output dir $1. Uses only /32 routes (aurora-modem addroute).
+O=${1:-/tmp/b6/dt}; mkdir -p $O; . /tmp/aurora-modem.d/ipcfg || { echo "DT: no ipcfg"; exit 1; }
+CU="env LD_LIBRARY_PATH=/tmp/cu/usr/lib /tmp/cu/usr/bin/curl --cacert /tmp/cu/etc/ssl/certs/ca-certificates.crt --interface $IF -4 --connect-timeout 10 -sS"
+W='code=%{http_code} remote=%{remote_ip}:%{remote_port} local=%{local_ip} ssl_verify=%{ssl_verify_result} t_total=%{time_total}\n'
+D1=${DNS%%,*}
+{ for n in ya.ru www.google.com; do echo "### nslookup $n $D1"; timeout 20 nslookup $n $D1 2>&1; done; } > $O/dns.txt
+ips() { awk -v n="$1" '/^### nslookup/{c=($3==n)} c && /^Address[^:]*: *[0-9.]+$/{print $NF}' $O/dns.txt | grep -v "^$D1$" | sort -u | head -2; }
+YA=$(ips ya.ru); GO=$(ips www.google.com); YA1=$(echo $YA | cut -d' ' -f1); GO1=$(echo $GO | cut -d' ' -f1)
+for y in $YA $GO; do sh /tmp/aurora-modem addroute $y; done
+{ echo "ya.ru=$YA google=$GO"; for h in 77.88.8.8 $YA1 172.16.42.2 8.8.4.4; do echo "--- route get $h: $(ip route get $h 2>&1 | head -1)"; done; } > $O/routes.txt
+{ for h in 77.88.8.8 1.1.1.1; do echo "### ping $h"; ping -c 3 -W 3 $h 2>&1; done; } > $O/ping.txt
+Y=$(date -u +%Y)
+{ echo "### http://ya.ru/"; timeout 40 $CU --resolve ya.ru:80:$YA1 -o /dev/null -w "$W" http://ya.ru/ 2>&1; echo "rc=$?"
+  if [ "$Y" -ge 2026 ]; then
+    echo "### https://www.google.com/generate_204"; timeout 40 $CU --resolve www.google.com:443:$GO1 -o /dev/null -w "$W" https://www.google.com/generate_204 2>&1; echo "rc=$?"
+    echo "### https://1.1.1.1/cdn-cgi/trace"; timeout 40 $CU -o /dev/null -w "$W" https://1.1.1.1/cdn-cgi/trace 2>&1; echo "rc=$?"
+  else echo "### HTTPS skipped: clock year $Y (not a cellular failure)"; fi; } > $O/http.txt
+DNSOK=$([ -n "$YA1" ] && [ -n "$GO1" ] && echo 1 || echo 0)
+PING=$(grep -oE "[0-9]+ packets received" $O/ping.txt | cut -d' ' -f1 | tr '\n' '+'); PING=${PING%+}
+PINGOK=$(grep -qE "[1-9][0-9]* packets received" $O/ping.txt && echo 1 || echo 0)
+HTTP=$(grep -A1 "^### http://" $O/http.txt | grep -oE "code=[0-9]+" | head -1)
+HTTPS=$(grep -oE "code=[0-9]+" $O/http.txt | tail -n +2 | tr '\n' ' ')
+HTTPOK=$(echo "$HTTP" | grep -qE "code=[1-5][0-9][0-9]" && echo 1 || echo 0)
+if [ "$Y" -ge 2026 ]; then echo "$HTTPS" | grep -q "code=204" && echo "$HTTPS" | grep -q "code=200" && HTTPSOK=1 || HTTPSOK=0; else HTTPSOK=skip; fi
+V=FAIL; [ $DNSOK$PINGOK$HTTPOK = 111 ] && [ "$HTTPSOK" != 0 ] && V=PASS
+echo "DATATEST $V dns=$DNSOK(ya=$YA1 go=$GO1) ping=$PING http=$HTTP https=[$HTTPS]($HTTPSOK) if=$IF addr=$A" | tee $O/verdict.txt
+[ $V = PASS ]
--- a/b6/aurora-modem-start
+++ b/b6/aurora-modem-start
@ -0,0 +1,2 @@
+#!/bin/sh
+exec sh /tmp/aurora-modem start "$@"
--- a/b6/aurora-modem-status
+++ b/b6/aurora-modem-status
@ -0,0 +1,2 @@
+#!/bin/sh
+exec sh /tmp/aurora-modem status "$@"
--- a/b6/aurora-modem-stop
+++ b/b6/aurora-modem-stop
@ -0,0 +1,2 @@
+#!/bin/sh
+exec sh /tmp/aurora-modem stop "$@"
--- a/b6/aurora-modem.conf
+++ b/b6/aurora-modem.conf
@ -0,0 +1,10 @@
+# B6 operator config (sourced by /tmp/aurora-modem). Lifecycle logic is operator-independent;
+# only this file names an operator. No APN auto-selection: empty MODEM_APN => start refuses (exit 2).
+# Proven Beeline (session 22). For T2 use: MODEM_APN=internet and empty USER/PASSWORD/AUTH.
+MODEM_APN=internet.beeline.ru
+MODEM_USER=beeline
+MODEM_PASSWORD=beeline
+MODEM_AUTH=pap
+MODEM_IP_TYPE=ipv4
+# /32 host routes via the bearer interface (in addition to the bearer DNS servers). No default route.
+MODEM_TEST_ROUTES="77.88.8.8 1.1.1.1"
--- a/b6/b6-run.sh
+++ b/b6/b6-run.sh
@ -0,0 +1,46 @@
+#!/bin/sh
+# B6I harness: N x (aurora-modem start -> datatest -> aurora-modem stop) in one boot, checks after each cycle. RAM only.
+N=${1:-1}; C0=${2:-1}; O=/tmp/b6; mkdir -p $O; M="sh /tmp/aurora-modem"
+mask() { sed -E 's/([0-9]{6,})([0-9]{4})/******\2/g'; }
+mk() { echo "<5>[b6] $*" > /dev/kmsg; echo "[$(cut -d' ' -f1 /proc/uptime)] $*" | tee -a $O/run.log; }
+nv() { for want in modemst1 modemst2 fsg fsc persist; do for p in /sys/class/block/mmcblk0p*; do
+	[ "$(sed -n 's/^PARTNAME=//p' $p/uevent)" = "$want" ] && echo "$want $(basename $p) $(sha256sum /dev/$(basename $p) | cut -d' ' -f1)"; done; done; }
+ERR='Failed to resume|-110|Resource temporarily|EAGAIN|crash detected|fatal error|[Ww]atchdog|Oops|Kernel panic|Unable to handle|BUG:'
+REF="modemst1:637a71d1 modemst2:9bb10190 fsg:b0a3b7e4 fsc:5f70bf18 persist:ee48a843"
+[ -f $O/nv-boot.txt ] || cp /tmp/nv-before.txt $O/nv-boot.txt
+for c in $(seq $C0 $((C0+N-1))); do
+	X=$O/c$c; mkdir -p $X; dmesg | wc -l > $X/dmesg-off; wc -l < /tmp/aurora-modem.d/lifecycle.log > $X/log-off 2>/dev/null || echo 0 > $X/log-off
+	mk "CYCLE $c begin: $(awk '{print "w="$5" s="$7}' /sys/block/mmcblk0/stat) mss=$(cat /sys/class/remoteproc/remoteproc0/state)"
+	$M start > $X/start.out 2>&1; SR=$?; mk "CYCLE $c start rc=$SR"
+	$M status 2>&1 | mask > $X/status-up.txt
+	if [ $SR = 0 ]; then sh /tmp/aurora-modem-datatest $X/dt > $X/dt.out 2>&1; DR=$?; else DR=9; fi; mk "CYCLE $c $(cat $X/dt/verdict.txt 2>/dev/null || echo DATATEST not-run) rc=$DR"
+	[ $SR = 0 ] && { $M stop > $X/stop.out 2>&1; PR=$?; } || PR=$(grep -q "STOP done rc=0" $X/start.out && echo 0 || echo 1)
+	mk "CYCLE $c stop rc=$PR"; sleep 2
+	$M status 2>&1 | mask > $X/status-down.txt
+	nv > $X/nv.txt; cat /sys/block/mmcblk0/stat > $X/stat.txt
+	dmesg | tail -n +$(( $(cat $X/dmesg-off) + 1 )) > $X/dmesg-delta.txt
+	grep -E "$ERR" $X/dmesg-delta.txt > $X/dmesg-errs.txt
+	B=/sys/bus/platform/devices/4080000.remoteproc:bam-dmux
+	F=""
+	[ $SR = 0 ] || F="$F start"; [ $DR = 0 ] || F="$F data"; [ $PR = 0 ] || F="$F stop"
+	[ "$(cat /sys/class/remoteproc/remoteproc0/state)" = offline ] || F="$F mss"
+	[ -z "$(pidof rmtfs)" ] || F="$F rmtfs"; [ -z "$(pidof ModemManager)" ] || F="$F mm"; [ -z "$(pidof qmi-proxy)" ] || F="$F qmi-proxy"
+	for d in /sys/class/net/wwan*; do [ -e $d ] || continue; w=${d##*/}
+		[ $(( $(cat $d/flags) & 1 )) -ne 0 ] && F="$F $w-up"; ip -4 addr show $w | grep -q "inet " && F="$F $w-addr"; done
+	ip route | grep -q " dev wwan" && F="$F routes"; ip route | grep -q "^default" && F="$F default-route"
+	[ "$(cat $B/power/runtime_status)" = suspended ] || F="$F bam-$(cat $B/power/runtime_status)"
+	[ -s $X/dmesg-errs.txt ] && F="$F dmesg-errs"
+	for r in $REF; do grep -q "^${r%%:*} .* ${r#*:}" $X/nv.txt || F="$F nv-${r%%:*}"; done
+	grep -v '^stat' $O/nv-boot.txt | awk '{print $1,$3}' > $X/nv-a; awk '{print $1,$3}' $X/nv.txt > $X/nv-b; cmp -s $X/nv-a $X/nv-b || F="$F nv-vs-boot"
+	awk '{exit !($5==0 && $7==0)}' $X/stat.txt || F="$F emmc-writes"
+	ping -c 2 -W 2 172.16.42.2 > $X/usb-ping.txt 2>&1 || F="$F usb-ncm"
+	CHO=$(grep -c "Channel already open" $X/dmesg-delta.txt)
+	tail -n +$(( $(cat $X/log-off) + 1 )) /tmp/aurora-modem.d/lifecycle.log | mask > $X/lifecycle.log
+	[ -z "$F" ] && V=PASS || V="FAIL:$F"
+	mk "CYCLE $c RESULT $V (bam=$(cat $B/power/runtime_status) emmc=$(awk '{print $5"/"$7}' $X/stat.txt) chan-already-open=$CHO dmesg-errs=$(wc -l < $X/dmesg-errs.txt))"
+	[ -z "$F" ] || { mk "STOPPING after failed cycle $c"; break; }
+	sleep 5
+done
+for f in /tmp/aurora-modem.d/mm-*.log; do [ -f $f ] && mask < $f > $O/$(basename $f); done
+cp /tmp/aurora-modem.d/rmtfs.log /tmp/aurora-modem.d/lifecycle.log $O/ 2>/dev/null; mask < /tmp/aurora-modem.d/lifecycle.log > $O/lifecycle.log
+tar -C /tmp -cf /tmp/b6.tar b6; mk "B6-RUN-END"
--- a/b6/ro-check.sh
+++ b/b6/ro-check.sh
@ -0,0 +1,4 @@
+#!/bin/sh
+n=0; bad=0; for d in /dev/mmcblk0 /dev/mmcblk0p* /dev/mmcblk0boot*; do [ -b "$d" ] || continue; n=$((n+1)); [ "$(blockdev --getro $d)" = 1 ] || { bad=$((bad+1)); echo "NOT-RO $d"; }; done
+echo "RO-CHECK devices=$n not_ro=$bad"; for p in modemst1 modemst2 fsc fsg persist; do f=$(readlink -f /dev/disk/by-partlabel/$p); echo "$p $f getro=$(blockdev --getro $f)"; done
+awk '{print "emmc writes_completed="$5" sectors_written="$7}' /sys/block/mmcblk0/stat
--- a/bootchain-migration/PREFLIGHT.md
+++ b/bootchain-migration/PREFLIGHT.md
@ -0,0 +1,68 @@
+# Aurora bootchain migration preflight (ARM64) — 2026-09-30. NOTHING WRITTEN.
+
+## 1. Why ARM64 fails today (proven)
+lk2nd 23.1 `spin-table.c:54`: `!is_scm_armv8_support()` && ARM64 kernel → "Cannot boot ARM64 with old SCM calling convention";
+`scm.c` ~1060–1085: 32→64 switch = SCM `SCM_SVC_MILESTONE_32_64`; legacy-SCM TZ returns → `ASSERT(0)`.
+Stock TZ = TZ.BF.2.2-2.2.0026 (ELF32, legacy SCM, no PSCI), ELF-identical to JZ02 stock.
+
+## 2. Component requirements (evidence: JZ02 PLAN-B runs on IDENTICAL stock sbl1/rpm/tz/hyp ELF + qhypstub README)
+| component | verdict | evidence |
+|---|---|---|
+| TZ → DB410c TZ.BF.3.0-00714 (ELF64, armv8 SCM + PSCI) | **REQUIRED** | JZ02 S3: qhypstub with stock TZ.BF.2.2 → silence after SBL1. S4′: TZ.BF.3.0 + qhypstub → lk1st → PSCI v1.0 → arm64 Linux |
+| HYP → qhypstub | **REQUIRED (with TZ.BF.3.0)** | stock hyp is ELF32; JZ02 only proven pair = TZ64 + qhypstub. qhypstub also brings RPM out of reset. Alone: insufficient (JZ02 S3) |
+| GPT delta (tz 512K→1M, tzbak moved to empty gap) | **REQUIRED** | DB410c TZ = 605312 B > tz 524288 B, last segment ends at EOF (cannot truncate) |
+| ABOOT → lk1st | **REQUIRED for a proven chain** / stock aboot = UNKNOWN | Only proven combo is lk1st. Stock Aurora LK (32-bit, legacy-SCM era) under TZ.BF.3.0+qhypstub never tested on any board; qhypstub README says aarch32 LK in EL1 is supported in principle |
+| lk2nd in recovery | OPTIONAL (keep untouched) | with lk1st in aboot, lk1st itself gives `fastboot boot`; recovery stays as is |
+| SBL1 / RPM / DDR / sec / cdt | keep stock (NOT required) | JZ02 runs stock sbl1 BOOT.BF.3.0.1 + stock rpm RPM.BF.2.0.1 with TZ.BF.3.0; Aurora sbl1/DDR/sec byte-identical, rpm ELF identical |
+
+## 3. JZ02 (working ARM64) vs Aurora (stock)
+| component | JZ02 working | Aurora stock | same? | role | replace? | risk |
+|---|---|---|---|---|---|---|
+| SBL1 | stock 6a661ec9… BOOT.BF.3.0.1-00019 | 6a661ec9… | SAME (bytes) | DDR init, loads TZ/RPM/HYP/ABOOT | no | — |
+| RPM | stock 53b591bb… | ELF identical (slack differs) | SAME (ELF) | power/clocks | no | — |
+| DDR | stock | c3502047… = JZ02 | SAME (bytes) | DDR params for SBL1 | no | — |
+| TZ | DB410c TZ.BF.3.0-00714 (8481892f… padded 1M) | TZ.BF.2.2-2.2.0026 | DIFFERENT | secure monitor, SCM/PSCI | yes | high (runs before aboot) |
+| HYP | qhypstub (1a963047… padded 512K) | stock ELF32 (TZ.BF.2.2 hyp) | DIFFERENT | EL2, RPM release | yes | high |
+| ABOOT | lk1st JZ02 build (JZ02 node, -dirty) | stock LK 2026-07 (SPI panel, charger) | DIFFERENT | bootloader/fastboot | yes (Aurora lk1st) | medium (loses Android) |
+| GPT | tz 270336..272383, tzbak 305184..306207 | stock | DIFFERENT (2 entries) | layout | yes | high (table write) |
+| QCDT/DT | lk1st: appended kernel DTB | stock LK: QCDT dtb_01 | — | kernel DT | n/a (mainline DTB appended) | — |
+Aurora region layout (tz/tzbak/hyp LBAs, splash end 305169, gap 305170..393215 all-zero, DDR 393216) == JZ02 → same GPT delta applies.
+Memory map: upstream msm8916.dtsi reserves tz@86500000 (DB410c TZ) — proven on JZ02. DDR init owner = stock SBL1 (unchanged). PMIC PM8916 same; RPM unchanged.
+Board-id: lk1st does not use QCDT; kernel DTB appended ("Only one appended non-skales DTB").
+Display: stock LK powers + draws ST7735S splash (`Config SPI PANEL`); lk1st has no SPI-panel driver → **no boot splash** (expected change, not a fault).
+
+## 4. Options
+| | writes | ARM64 handoff | normal boot after | recovery/lk2nd | EDL | rollback | main brick risk |
+|---|---|---|---|---|---|---|---|
+| A hyp=qhypstub only | hyp | **NO** (JZ02 S3 hang) | hangs after SBL1 | unreachable | HW only | ws hyp | proven failure → rejected |
+| B tz=DB410c, hyp=qhypstub, aboot=stock | GPT, tz, hyp | plausible via lk2nd in recovery (armv8 SCM + PSCI) | UNKNOWN (stock LK + Android 3.10 on TZ64 never tested; qseecom/keymaster TZ apps built for TZ.BF.2.x) | lk2nd path kept (if stock LK runs) | adb only if Android boots, else HW | ws GPT/tz/hyp | stock LK hang → only HW EDL |
+| C tz=DB410c, hyp=qhypstub, aboot=lk1st | GPT, tz, hyp, aboot | **YES** (JZ02 S4′/S5, identical inputs) | lk1st forced fastboot (Android gone) | untouched, not needed | lk1st `fastboot oem reboot-edl` (proven JZ02) + HW | ws each stage | lower: every stage proven on JZ02 |
+| D staged C (JZ02 order) | same as C, one change per stage | YES at end | per stage | untouched | per stage | per stage | minimal: stage-by-stage verification |
+**Recommended: D (= C executed in JZ02's proven order).** Not hyp alone. Not B (unproven, and only saves Android which the target system does not need).
+
+## 5. HW EDL without ADB — OPEN BLOCKER (must be proven before S1)
+Currently proven on Aurora: only `adb reboot edl`. After S1 Android is gone; lk1st `oem reboot-edl` only works if lk1st boots.
+Evidence for a button path (NOT yet proven on Aurora):
+- JZ02: stock DT `key_reset` = GPIO37; user entered 9008 with the RESET button (PLAN-B "HW EDL proof", twice, also with lk1st in aboot).
+- upstream lk2nd `msm8916-512mb-mtp.dts`: GPIO37 is labelled "The EDL button" on UFI-001B/C sticks.
+- Aurora stock DT: `key_f2` = **GPIO37** (active-high, same pin).
+Test (non-destructive, no write): identify which physical button is KEY_F2 (`adb shell getevent -l`, press buttons),
+full power-off (USB + battery), hold that button, apply power/USB → expect `lsusb` 05c6:9008; exit = power-off.
+If this does not yield 9008: STOP — no bootloader writes without a hardware recovery path. Do NOT short test pads blindly.
+
+## 6. Recovery path
+recovery (lk2nd 23.1) stays untouched. With lk1st in aboot, development path becomes: power-on → lk1st fastboot → `fastboot boot`.
+lk1st PANIC_REBOOT_MODE=EMERGENCY_DLOAD (panic → EDL).
+
+## 7. UART
+lk1st = same lk2nd 23.1 target code: `uart_dm_init(2,0,0x78B0000)`, GPIO4/5 → UART stays on BLSP1 UART2 115200 (proven for lk2nd on Aurora, lk1st on JZ02).
+SBL1 prints its log on the same UART (seen). qhypstub/TZ print nothing (JZ02: SBL1 → silence → lk1st).
+
+## 8. Uncertainties
+1. HW EDL button on Aurora — unproven (blocker).
+2. DB410c TZ provenance: from OpenStick base.zip (JZ02); Linaro release server no longer serves files → cannot re-verify upstream origin online.
+   Mitigation: byte-identical to image running on JZ02 hardware; signed with Qualcomm test chain = Aurora PK_HASH root.
+3. lk1st-aurora is a new build (never run): same source/tag as the lk2nd running on Aurora, same config pattern as JZ02 lk1st (bundle 512mb-mtp dtb, force fastboot), no device node → generic.
+4. Battery/charging: stock LK off-mode charging + charger decisions disappear with lk1st; PM8916 charging behaviour under lk1st/mainline untested. Keep USB power connected.
+5. Aurora MPSS is a different build than JZ02 (re-signed 2026-04-30) — irrelevant for boot, relevant later for modem under TZ.BF.3.0.
+6. Android + stock recovery will no longer boot after S1 (expected); full stock restore = rollback all stages.
--- a/bootchain-migration/SHA256SUMS
+++ b/bootchain-migration/SHA256SUMS
@ -0,0 +1,19 @@
+003c484e5a2880819f45c2bd74543796d28758925c9c58c26b5bcbdcf42a6696  aboot-lk1st-aurora.mbn
+58d20d78b9eb5b9c5a6b41977c1646519456e695d0ede503e7afa98597cb6ed1  lk1st-aurora-unsigned.mbn
+e4addbf80eb86f6ad8b112e5a3115c7b721bbd2cca8cc109d135aeceb6194482  aboot-lk1st-aurora.pad1M
+ebcd0c9011ac887cdf208c2413c4447c2a7d88f4ced1f3ea4f826162c8f2f30d  orig-abootbak.bin
+fd1af1679f9dd24de2689dc79faf0d2b043c3e95200234bec36da9ed7df1053a  orig-aboot.bin
+428d25ebd86d047f33fa9fd2f22aa2d716e6ecf39735ad61bb34409a323f9082  orig-hypbak.bin
+340049c116faaab6db6cd5004ec7eb17c3fecd308df8456ede8b40aa3244c506  orig-hyp.bin
+c6f7db266a14227ca7e7b0343661089298e4c4320a9522e3e695b5e069e6b4af  orig-tzbak.bin
+4c8c7875501e0718b2afe6597f7159a510462cb4bd9b0e6f25ab142d256ddfb8  orig-tz.bin
+795952a1a5965ca2118afcb0add9cd1d358a09ec9a43ca4208cfad40c99de18f  aurora-new-gpt-backup-33sectors.bin
+6e850a5dfe5400da346962a54e41491cb0e4c5ac3543dd4799c8bc0ee5c3b8b6  aurora-new-gpt-primary-34sectors.bin
+8481892fe56fc810e4322b7e6838bf071695e4fc1380c16b21973d7fab325363  tz-db410c.pad1M
+2daaedaafeee5697b6d85aa329cc6af9bc7e661677e4594d75efb54e4b53fea1  tz-db410c-TZ.BF.3.0-00714.mbn
+c6414843b635a2b3e7ec58bc5a6c6c7c7aef7f5a31898dc5923c2085c9de1a2d  hyp-qhypstub.mbn
+1a963047a4302569da2ddbda726b65c57f5181c0e290ca983dcd2fc529f74555  hyp-qhypstub.pad512K
+0284863bf665a4fd945bb95796a2f40385bb9eeadbcc7c0e16cf830ddb1056b4  orig-tzarea-LBA270336-272383.bin
+07854d2fef297a06ba81685e660c332de36d5d18d546927d30daad6d7fda1541  orig-gap-LBA305184-306207.bin
+1dbb7727613108fbfb9a7caefbc8c120a6674d2ce95423385ff7f968e54568c6  orig-gpt-backup-LBA7634911-7634943.bin
+9b01428eb659eb95cc1f59c8b5c012278b82676774997f036d601057b7a8a8b5  orig-gpt-primary-LBA0-33.bin
--- a/bootchain-migration/WRITE-PLAN.md
+++ b/bootchain-migration/WRITE-PLAN.md
@ -0,0 +1,38 @@
+# Aurora ARM64 bootchain — staged write plan (NOT EXECUTED; each stage needs explicit user approval)
+Run on 480s:  cd ~/doc/modem/jz08-aurora ; M=bootchain-migration ; O=logs/bootchain ; mkdir -p $O
+L=firehose/007050e100000000_394a2e47cf830150_fhprg_peek.bin   (sha256 53f19350…5aca)
+Every edl call: --loader=$L . NEVER `edl reset`. After each stage: physical power-cycle + full UART log.
+Entry to EDL: S1 from Android `adb reboot edl`; later stages: lk1st `fastboot oem reboot-edl` or the HW button (S0).
+
+## S0 — prerequisite, NO WRITE: prove hardware EDL entry (button on GPIO37 / KEY_F2). If it fails: STOP.
+
+## S1 — aboot ← lk1st-aurora  (stock tz/hyp/GPT kept; proven order on JZ02)
+edl --loader=$L printgpt                                   # aboot must be 264192 / 0x100000
+edl --loader=$L w aboot $M/aboot-lk1st-aurora.pad1M          # e4addbf8…6482
+edl --loader=$L r aboot $O/S1-aboot-readback.bin
+sha256sum $M/aboot-lk1st-aurora.pad1M $O/S1-aboot-readback.bin ; cmp $M/aboot-lk1st-aurora.pad1M $O/S1-aboot-readback.bin && echo S1_MATCH
+expect after power-cycle: SBL1 → lk1st "welcome to lk" → forced fastboot 18d1:d00d, getvar product lk1st-msm8916; test `fastboot oem reboot-edl` → 9008.
+ROLLBACK S1: edl w aboot $M/orig-aboot.bin ; edl r aboot $O/S1-rb.bin ; cmp $M/orig-aboot.bin $O/S1-rb.bin   # fd1af167…053a
+
+## S2 — GPT delta + copy stock tzbak to its new place (tz content unchanged)
+edl --loader=$L ws 0       $M/aurora-new-gpt-primary-34sectors.bin    # 6e850a5d…b8b6
+edl --loader=$L ws 7634911 $M/aurora-new-gpt-backup-33sectors.bin     # 795952a1…e18f
+edl --loader=$L ws 305184  $M/orig-tzbak.bin                          # c6f7db26…b4af
+edl --loader=$L rs 0 34 $O/S2-gptp.bin ; edl --loader=$L rs 7634911 33 $O/S2-gptb.bin ; edl --loader=$L rs 305184 1024 $O/S2-tzbak.bin
+edl --loader=$L rs 270336 2048 $O/S2-tzarea.bin                        # must still equal orig-tzarea (unchanged bytes)
+cmp $M/aurora-new-gpt-primary-34sectors.bin $O/S2-gptp.bin ; cmp $M/aurora-new-gpt-backup-33sectors.bin $O/S2-gptb.bin
+cmp $M/orig-tzbak.bin $O/S2-tzbak.bin ; cmp $M/orig-tzarea-LBA270336-272383.bin $O/S2-tzarea.bin && echo S2_MATCH
+expect: identical boot to S1 (stock tz still first 512K of enlarged tz); getvar partition-size:tz 0x100000.
+ROLLBACK S2: ws 0 $M/orig-gpt-primary-LBA0-33.bin ; ws 7634911 $M/orig-gpt-backup-LBA7634911-7634943.bin ; ws 305184 $M/orig-gap-LBA305184-306207.bin ; rs + cmp each
+
+## S3 — tz + hyp as a PAIR (never hyp alone: JZ02 S3 proved hang)
+edl --loader=$L ws 270336 $M/tz-db410c.pad1M               # 8481892f…5363 (1 MiB, whole enlarged tz)
+edl --loader=$L ws 272384 $M/hyp-qhypstub.pad512K          # 1a963047…4555
+edl --loader=$L rs 270336 2048 $O/S3-tz.bin ; edl --loader=$L rs 272384 1024 $O/S3-hyp.bin
+cmp $M/tz-db410c.pad1M $O/S3-tz.bin ; cmp $M/hyp-qhypstub.pad512K $O/S3-hyp.bin && echo S3_MATCH
+expect: SBL1 → lk1st fastboot; lk1st detects PSCI.
+ROLLBACK S3: ws 270336 $M/orig-tzarea-LBA270336-272383.bin ; ws 272384 $M/orig-hyp.bin ; rs + cmp
+
+## S4 — RAM only: fastboot boot linux/ramboot1/aurora-ramboot1.img (470ce4f8…) via lk1st
+
+## FULL STOCK RESTORE (any state): S3 rollback → S2 rollback → S1 rollback (then Android + adb reboot edl return).
--- a/bootchain-migration/gptedit-aurora.py
+++ b/bootchain-migration/gptedit-aurora.py
@ -0,0 +1,27 @@
+import struct, zlib, uuid
+P = open("../gpt/gpt-primary-34sectors.bin", "rb").read()      # LBA 0..33
+B = open("../gpt/gpt-backup-33sectors.bin", "rb").read()      # entries (32 sectors) + header (last LBA)
+def entries_of(buf, off, n, esz): return bytearray(buf[off: off + n*esz])
+hdrP = bytearray(P[512:1024]); ent_lba, n, esz = struct.unpack("<QII", hdrP[72:88])
+ents = entries_of(P, ent_lba*512, n, esz)
+assert bytes(ents) == B[:n*esz], "primary/backup entry arrays differ"
+def name(i): return ents[i*esz+56:i*esz+128].decode("utf-16le").rstrip("\0")
+idx = {name(i): i for i in range(n) if ents[i*esz:i*esz+16] != b"\0"*16}
+def setlba(i, first, last): ents[i*esz+32:i*esz+48] = struct.pack("<QQ", first, last)
+def getlba(i): return struct.unpack("<QQ", ents[i*esz+32:i*esz+48])
+tz, tzb = idx["tz"], idx["tzbak"]
+assert getlba(tz) == (270336, 271359) and getlba(tzb) == (271360, 272383)
+setlba(tz, 270336, 272383)
+setlba(tzb, 305184, 306207)
+ecrc = zlib.crc32(bytes(ents)) & 0xffffffff
+def fix(h):
+    h = bytearray(h); h[88:92] = struct.pack("<I", ecrc); h[16:20] = b"\0"*4
+    hs = struct.unpack("<I", h[12:16])[0]; h[16:20] = struct.pack("<I", zlib.crc32(bytes(h[:hs])) & 0xffffffff); return h
+newP = bytearray(P); newP[512:1024] = fix(hdrP); newP[ent_lba*512: ent_lba*512+n*esz] = ents
+hdrB = B[32*512:33*512]; newB = bytearray(B); newB[:n*esz] = ents; newB[32*512:33*512] = fix(hdrB)
+open("aurora-new-gpt-primary-34sectors.bin", "wb").write(newP); open("aurora-new-gpt-backup-33sectors.bin", "wb").write(newB)
+# diff report
+for i in range(n):
+    a = P[ent_lba*512+i*esz: ent_lba*512+(i+1)*esz]; b = bytes(ents[i*esz:(i+1)*esz])
+    if a != b: print("changed entry %2d %-8s %s -> %s" % (i, name(i), struct.unpack("<QQ", a[32:48]), struct.unpack("<QQ", b[32:48])))
+nd = sum(1 for x, y in zip(P, newP) if x != y); print("primary bytes changed:", nd, " backup bytes changed:", sum(1 for x, y in zip(B, newB) if x != y))
--- a/bootchain-migration/gptvalidate-aurora.py
+++ b/bootchain-migration/gptvalidate-aurora.py
@ -0,0 +1,44 @@
+# Independent GPT validator (does not share code with gptedit.py)
+import struct, zlib, sys
+DISK_SECTORS = 7634944
+def check(prim_path, back_path):
+    P = open(prim_path, "rb").read(); B = open(back_path, "rb").read()
+    ok = True
+    def fail(m):
+        nonlocal ok; ok = False; print("  FAIL:", m)
+    def hdr(buf, label, expect_my, expect_alt):
+        h = buf
+        sig, rev, hsz, hcrc, _, my, alt, fu, lu = struct.unpack("<8sIII4sQQQQ", h[:56])
+        guid = h[56:72]; ent_lba, n, esz, ecrc = struct.unpack("<QIII", h[72:92])
+        calc = zlib.crc32(h[:16] + b"\0\0\0\0" + h[20:hsz]) & 0xffffffff
+        if sig != b"EFI PART": fail(label + " signature")
+        if calc != hcrc: fail("%s header CRC stored %08x calc %08x" % (label, hcrc, calc))
+        if my != expect_my: fail("%s my_lba %d != %d" % (label, my, expect_my))
+        if alt != expect_alt: fail("%s alternate_lba %d != %d" % (label, alt, expect_alt))
+        return dict(fu=fu, lu=lu, guid=guid, ent_lba=ent_lba, n=n, esz=esz, ecrc=ecrc)
+    hp = hdr(P[512:1024], "primary", 1, DISK_SECTORS - 1)
+    hb = hdr(B[32*512:33*512], "backup", DISK_SECTORS - 1, 1)
+    ep = P[hp["ent_lba"]*512: hp["ent_lba"]*512 + hp["n"]*hp["esz"]]
+    if hb["ent_lba"] != DISK_SECTORS - 33: fail("backup entries LBA %d" % hb["ent_lba"])
+    eb = B[:hb["n"]*hb["esz"]]
+    for lab, e, h in (("primary", ep, hp), ("backup", eb, hb)):
+        c = zlib.crc32(e) & 0xffffffff
+        if c != h["ecrc"]: fail("%s entries CRC stored %08x calc %08x" % (lab, h["ecrc"], c))
+    if ep != eb: fail("primary and backup entry arrays differ")
+    for k in ("fu", "lu", "guid", "n", "esz"):
+        if hp[k] != hb[k]: fail("header field %s differs" % k)
+    parts = []
+    for i in range(hp["n"]):
+        e = ep[i*128:(i+1)*128]
+        if e[:16] == b"\0"*16: continue
+        s, l = struct.unpack("<QQ", e[32:48]); nm = e[56:128].decode("utf-16le").rstrip("\0")
+        if not (hp["fu"] <= s <= l <= hp["lu"]): fail("%s outside usable range" % nm)
+        parts.append((s, l, nm))
+    parts.sort()
+    for a, b in zip(parts, parts[1:]):
+        if b[0] <= a[1]: fail("overlap %s / %s" % (a[2], b[2]))
+    if P[0x1fe:0x200] != b"\x55\xaa" or P[0x1c2] != 0xee: fail("protective MBR")
+    print("  %s: %d partitions, usable %d..%d -> %s" % (prim_path, len(parts), hp["fu"], hp["lu"], "OK" if ok else "INVALID"))
+    return ok
+for p, b in (("../gpt/gpt-primary-34sectors.bin", "../gpt/gpt-backup-33sectors.bin"), ("aurora-new-gpt-primary-34sectors.bin", "aurora-new-gpt-backup-33sectors.bin")):
+    check(p, b)
--- a/bootchain/boot/info.txt
+++ b/bootchain/boot/info.txt
@ -0,0 +1,23 @@
+kernel_size=0x624c90 kernel_addr=0x80008000
+ramdisk_size=0x82648 ramdisk_addr=0x81000000
+second_size=0x0 tags_addr=0x80000100 page_size=2048
+dt_size=0x46800
+name=b''
+cmdline=console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x3F ehci-hcd.park=3 androidboot.bootdevice=7824900.sdhci
+id=0ab51698aa1b85b20d5dde57d8c221f42a468b1d000000000000000000000000
+extra_cmdline_first_bytes=0000000000000000000000000000000000000000000000000000000000000000 (nonzero=False)
+image_end=0x6ee800 of 0x1000000
+tail_after_image_nonzero=537767
+kernel: 6442128 bytes sha256 8796a9cd21ef23a2219acecfa7539fbc7ce167612c265119b31e3b731655c6b7
+ramdisk: 534088 bytes sha256 f79c1e141d998f758ac72e47c0854ca4a774e1f35a6e86a791a3ebb641c95311
+dt.img: 288768 bytes sha256 6ba72582f4c3b2e5711143c8b502b46e3eaf707e22852e9a8075c4d5e59992fd
+no FDT magic in kernel (no appended DTB)
+QCDT version=2 entries=8
+  entry0: fields=['0xce', '0x8', '0x0', '0x0'] off=0x800 size=0x23000 -> dtb_00.dtb
+  entry1: fields=['0xce', '0x8', '0x100', '0x0'] off=0x23800 size=0x23000 -> dtb_01.dtb
+  entry2: fields=['0xf8', '0x8', '0x0', '0x0'] off=0x800 size=0x23000 -> dtb_00.dtb
+  entry3: fields=['0xf8', '0x8', '0x100', '0x0'] off=0x23800 size=0x23000 -> dtb_01.dtb
+  entry4: fields=['0xf9', '0x8', '0x0', '0x0'] off=0x800 size=0x23000 -> dtb_00.dtb
+  entry5: fields=['0xf9', '0x8', '0x100', '0x0'] off=0x23800 size=0x23000 -> dtb_01.dtb
+  entry6: fields=['0xfa', '0x8', '0x0', '0x0'] off=0x800 size=0x23000 -> dtb_00.dtb
+  entry7: fields=['0xfa', '0x8', '0x100', '0x0'] off=0x23800 size=0x23000 -> dtb_01.dtb
--- a/bootchain/boot/ramdisk.list
+++ b/bootchain/boot/ramdisk.list
@ -0,0 +1,51 @@
+-rwxr-x---   1 root     root       292844 Jan  1  1970 charger
+drwxrwx--x   1 root     root            0 Jan  1  1970 data
+-rw-r--r--   1 root     root          207 Jan  1  1970 default.prop
+drwxr-xr-x   1 root     root            0 Jan  1  1970 dev
+-rw-r--r--   1 root     root         9093 Jan  1  1970 file_contexts
+-rw-r-----   1 root     root         1316 Jan  1  1970 fstab.qcom
+-rwxr-x---   1 root     root       179476 Jan  1  1970 init
+-rwxr-x---   1 root     root         2823 Jan  1  1970 init.class_main.sh
+-rwxr-x---   1 root     root         1171 Jan  1  1970 init.environ.rc
+-rwxr-x---   1 root     root         1730 Jan  1  1970 init.mdm.sh
+-rwxr-x---   1 root     root         7374 Jan  1  1970 init.qcom.class_core.sh
+-rwxr-x---   1 root     root         6920 Jan  1  1970 init.qcom.early_boot.sh
+-rwxr-x---   1 root     root        12466 Jan  1  1970 init.qcom.factory.sh
+-rwxr-x---   1 root     root        26376 Jan  1  1970 init.qcom.rc
+-rwxr-x---   1 root     root         6370 Jan  1  1970 init.qcom.sh
+-rwxr-x---   1 root     root         4561 Jan  1  1970 init.qcom.ssr.sh
+-rwxr-x---   1 root     root         2962 Jan  1  1970 init.qcom.syspart_fixup.sh
+-rwxr-x---   1 root     root        53658 Jan  1  1970 init.qcom.usb.rc
+-rwxr-x---   1 root     root         8256 Jan  1  1970 init.qcom.usb.sh
+-rwxr-x---   1 root     root         2247 Jan  1  1970 init.qti.carrier.rc
+-rwxr-x---   1 root     root        28234 Jan  1  1970 init.rc
+-rwxr-x---   1 root     root         5802 Jan  1  1970 init.target.rc
+-rwxr-x---   1 root     root         1795 Jan  1  1970 init.trace.rc
+-rwxr-x---   1 root     root         3915 Jan  1  1970 init.usb.rc
+drwxr-xr-x   1 root     root            0 Jan  1  1970 proc
+-rw-r--r--   1 root     root         2161 Jan  1  1970 property_contexts
+drwxr-xr-x   1 root     root            0 Jan  1  1970 res
+drwxr-xr-x   1 root     root            0 Jan  1  1970 res/images
+drwxr-xr-x   1 root     root            0 Jan  1  1970 res/images/charger
+-rw-r--r--   1 root     root         1295 Jan  1  1970 res/images/charger/battery_0.png
+-rw-r--r--   1 root     root         1290 Jan  1  1970 res/images/charger/battery_1.png
+-rw-r--r--   1 root     root         1289 Jan  1  1970 res/images/charger/battery_2.png
+-rw-r--r--   1 root     root         1291 Jan  1  1970 res/images/charger/battery_3.png
+-rw-r--r--   1 root     root         1288 Jan  1  1970 res/images/charger/battery_4.png
+-rw-r--r--   1 root     root         1267 Jan  1  1970 res/images/charger/battery_5.png
+-rw-r--r--   1 root     root         2475 Jan  1  1970 res/images/charger/battery_charge.png
+-rw-r--r--   1 root     root         1805 Jan  1  1970 res/images/charger/battery_fail.png
+drwxr-xr-x   1 root     root            0 Jan  1  1970 res/images/mmi
+-rw-r--r--   1 root     root         3962 Jan  1  1970 res/images/mmi/fail.png
+-rw-r--r--   1 root     root         3767 Jan  1  1970 res/images/mmi/pass.png
+drwxr-x---   1 root     root            0 Jan  1  1970 sbin
+-rwxr-x---   1 root     root       161956 Jan  1  1970 sbin/adbd
+-rwxr-x---   1 root     root       120656 Jan  1  1970 sbin/healthd
+lrwxr-x---   1 root     root            7 Jan  1  1970 sbin/ueventd -> ../init
+lrwxr-x---   1 root     root            7 Jan  1  1970 sbin/watchdogd -> ../init
+-rw-r--r--   1 root     root          656 Jan  1  1970 seapp_contexts
+-rw-r--r--   1 root     root        75088 Jan  1  1970 sepolicy
+drwxr-xr-x   1 root     root            0 Jan  1  1970 sys
+drwxr-xr-x   1 root     root            0 Jan  1  1970 system
+-rw-r--r--   1 root     root         9740 Jan  1  1970 ueventd.qcom.rc
+-rw-r--r--   1 root     root         4023 Jan  1  1970 ueventd.rc
--- a/bootchain/boot/ramdisk.type
+++ b/bootchain/boot/ramdisk.type
@ -0,0 +1 @@
+gzip compressed data, from Unix, original size modulo 2^32 1060352
--- a/bootchain/elfinfo.txt
+++ b/bootchain/elfinfo.txt
@ -0,0 +1,39 @@
+sbl1.bin: ELF32 entry=0x8006560 phnum=8 image_end=0x3dc24 part=0x80000 img_sha256=dfb1ce5582f2694e tail_nonblank=0
+   segs=0x0+0x134(f0x7000000) 0x86782000+0x1a28(f0x2200000) 0x220000+0x2abc(f0x5) 0x223000+0x928(f0x6) 0x8005000+0x33f90(f0x80000005) 0x803b000+0x0(f0x6) 0x8041000+0x38b0(f0x6) 0x86700000+0x0(f0x6)
+   ver=[('QC_IMAGE_VERSION_STRING=BOOT.BF.3.0.1-00019', '0x32e64')]
+rpm.bin: ELF32 entry=0x9 phnum=4 image_end=0x24734 part=0x80000 img_sha256=d7b6517870a5d9e6 tail_nonblank=883
+   segs=0x0+0xb4(f0x7000000) 0x296000+0x19a8(f0x2200000) 0x200000+0x1c094(f0x80000005) 0x290000+0x56a0(f0x6)
+   ver=[('QC_IMAGE_VERSION_STRING=RPM.BF.2.0.1-00027', '0x1f0d4')]
+rpmbak.bin: ELF32 entry=0x9 phnum=4 image_end=0x24734 part=0x80000 img_sha256=d7b6517870a5d9e6 tail_nonblank=883
+   segs=0x0+0xb4(f0x7000000) 0x296000+0x19a8(f0x2200000) 0x200000+0x1c094(f0x80000005) 0x290000+0x56a0(f0x6)
+   ver=[('QC_IMAGE_VERSION_STRING=RPM.BF.2.0.1-00027', '0x1f0d4')]
+tz.bin: ELF32 entry=0x86500000 phnum=10 image_end=0x649ac part=0x80000 img_sha256=d992d0c25180ec61 tail_nonblank=19303
+   segs=0x0+0x174(f0x7000000) 0x86570000+0x1a68(f0x2200000) 0x86500000+0x352b8(f0x80000005) 0x86536000+0x5b98(f0x4) 0x8653c000+0xb604(f0x6) 0x8654dc00+0x4800(f0x6) 0x86567000+0xba8(f0x6) 0x86568000+0x3000(f0x6) 0x8656b000+0x1000(f0x6) 0x8656c000+0x4000(f0x6)
+   ver=[('QC_IMAGE_VERSION_STRING=TZ.BF.2.2-2.2.0026', '0x4c53c'), ('QC_IMAGE_VERSION_STRING=TZ.BF.2.5.C6-00025', '0x65624')]
+tzbak.bin: ELF32 entry=0x86500000 phnum=10 image_end=0x649ac part=0x80000 img_sha256=d992d0c25180ec61 tail_nonblank=102960
+   segs=0x0+0x174(f0x7000000) 0x86570000+0x1a68(f0x2200000) 0x86500000+0x352b8(f0x80000005) 0x86536000+0x5b98(f0x4) 0x8653c000+0xb604(f0x6) 0x8654dc00+0x4800(f0x6) 0x86567000+0xba8(f0x6) 0x86568000+0x3000(f0x6) 0x8656b000+0x1000(f0x6) 0x8656c000+0x4000(f0x6)
+   ver=[('QC_IMAGE_VERSION_STRING=TZ.BF.2.2-2.2.0026', '0x4c53c')]
+hyp.bin: ELF32 entry=0x86400000 phnum=4 image_end=0x4fd8 part=0x80000 img_sha256=13c3227c9cd9958e tail_nonblank=120320
+   segs=0x0+0xb4(f0x7000000) 0x86500000+0x19a8(f0x2200000) 0x86400000+0x1fd8(f0x80000007) 0x86410800+0x0(f0x6)
+   ver=[('QC_IMAGE_VERSION_STRING=TZ.BF.2.5.C6-00025', '0x25624')]
+hypbak.bin: ELF32 entry=0x86400000 phnum=4 image_end=0x4fd8 part=0x80000 img_sha256=13c3227c9cd9958e tail_nonblank=0
+   segs=0x0+0xb4(f0x7000000) 0x86500000+0x19a8(f0x2200000) 0x86400000+0x1fd8(f0x80000007) 0x86410800+0x0(f0x6)
+   ver=[]
+aboot.bin: ELF32 entry=0x8f600000 phnum=4 image_end=0x5b0c8 part=0x100000 img_sha256=aae4b59024e3b114 tail_nonblank=49015
+   segs=0x0+0xb4(f0x7000000) 0x8f648000+0x19a8(f0x2200000) 0x8f647dac+0x10(f0x4) 0x8f600000+0x530c8(f0x7)
+   ver=[]
+abootbak.bin: ELF32 entry=0x8f600000 phnum=4 image_end=0x5b0c8 part=0x100000 img_sha256=aae4b59024e3b114 tail_nonblank=49001
+   segs=0x0+0xb4(f0x7000000) 0x8f648000+0x19a8(f0x2200000) 0x8f647dac+0x10(f0x4) 0x8f600000+0x530c8(f0x7)
+   ver=[]
+/home/q/doc/modem/JZ02V30-UFI-@/backup/parts/rpm.bin: ELF32 entry=0x9 phnum=4 image_end=0x24734 part=0x80000 img_sha256=d7b6517870a5d9e6 tail_nonblank=0
+   segs=0x0+0xb4(f0x7000000) 0x296000+0x19a8(f0x2200000) 0x200000+0x1c094(f0x80000005) 0x290000+0x56a0(f0x6)
+   ver=[('QC_IMAGE_VERSION_STRING=RPM.BF.2.0.1-00027', '0x1f0d4')]
+/home/q/doc/modem/JZ02V30-UFI-@/backup/parts/tz.bin: ELF32 entry=0x86500000 phnum=10 image_end=0x649ac part=0x80000 img_sha256=d992d0c25180ec61 tail_nonblank=0
+   segs=0x0+0x174(f0x7000000) 0x86570000+0x1a68(f0x2200000) 0x86500000+0x352b8(f0x80000005) 0x86536000+0x5b98(f0x4) 0x8653c000+0xb604(f0x6) 0x8654dc00+0x4800(f0x6) 0x86567000+0xba8(f0x6) 0x86568000+0x3000(f0x6) 0x8656b000+0x1000(f0x6) 0x8656c000+0x4000(f0x6)
+   ver=[('QC_IMAGE_VERSION_STRING=TZ.BF.2.2-2.2.0026', '0x4c53c')]
+/home/q/doc/modem/JZ02V30-UFI-@/backup/parts/hyp.bin: ELF32 entry=0x86400000 phnum=4 image_end=0x4fd8 part=0x80000 img_sha256=13c3227c9cd9958e tail_nonblank=0
+   segs=0x0+0xb4(f0x7000000) 0x86500000+0x19a8(f0x2200000) 0x86400000+0x1fd8(f0x80000007) 0x86410800+0x0(f0x6)
+   ver=[]
+/home/q/doc/modem/JZ02V30-UFI-@/backup/parts/aboot.bin: ELF32 entry=0x8f600000 phnum=4 image_end=0x5cf5c part=0x100000 img_sha256=e57e88588f77e683 tail_nonblank=14
+   segs=0x0+0xb4(f0x7000000) 0x8f649000+0x19a8(f0x2200000) 0x8f648314+0x10(f0x4) 0x8f600000+0x54f5c(f0x7)
+   ver=[]
--- a/bootchain/recovery/info.txt
+++ b/bootchain/recovery/info.txt
@ -0,0 +1,23 @@
+kernel_size=0x624c90 kernel_addr=0x80008000
+ramdisk_size=0x1057a5 ramdisk_addr=0x81000000
+second_size=0x0 tags_addr=0x80000100 page_size=2048
+dt_size=0x46800
+name=b''
+cmdline=console=ttyHSL0,115200,n8 androidboot.console=ttyHSL0 androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x3F ehci-hcd.park=3 androidboot.bootdevice=7824900.sdhci
+id=bdf6015bb7d2b99457ac0411a63b30b4ca0eacfb000000000000000000000000
+extra_cmdline_first_bytes=0000000000000000000000000000000000000000000000000000000000000000 (nonzero=False)
+image_end=0x771800 of 0x1000000
+tail_after_image_nonzero=8558292
+kernel: 6442128 bytes sha256 8796a9cd21ef23a2219acecfa7539fbc7ce167612c265119b31e3b731655c6b7
+ramdisk: 1071013 bytes sha256 69fd1ba2719ab007b3431f0f483c0c69466e31c2008041032216335566a7a267
+dt.img: 288768 bytes sha256 6ba72582f4c3b2e5711143c8b502b46e3eaf707e22852e9a8075c4d5e59992fd
+no FDT magic in kernel (no appended DTB)
+QCDT version=2 entries=8
+  entry0: fields=['0xce', '0x8', '0x0', '0x0'] off=0x800 size=0x23000 -> dtb_00.dtb
+  entry1: fields=['0xce', '0x8', '0x100', '0x0'] off=0x23800 size=0x23000 -> dtb_01.dtb
+  entry2: fields=['0xf8', '0x8', '0x0', '0x0'] off=0x800 size=0x23000 -> dtb_00.dtb
+  entry3: fields=['0xf8', '0x8', '0x100', '0x0'] off=0x23800 size=0x23000 -> dtb_01.dtb
+  entry4: fields=['0xf9', '0x8', '0x0', '0x0'] off=0x800 size=0x23000 -> dtb_00.dtb
+  entry5: fields=['0xf9', '0x8', '0x100', '0x0'] off=0x23800 size=0x23000 -> dtb_01.dtb
+  entry6: fields=['0xfa', '0x8', '0x0', '0x0'] off=0x800 size=0x23000 -> dtb_00.dtb
+  entry7: fields=['0xfa', '0x8', '0x100', '0x0'] off=0x23800 size=0x23000 -> dtb_01.dtb
--- a/bootchain/recovery/ramdisk.list
+++ b/bootchain/recovery/ramdisk.list
@ -0,0 +1,73 @@
+-rwxr-x---   1 root     root       292844 Jan  1  1970 charger
+drwxrwx--x   1 root     root            0 Jan  1  1970 data
+-rw-r--r--   1 root     root         7133 Jan  1  1970 default.prop
+drwxr-xr-x   1 root     root            0 Jan  1  1970 dev
+drwxr-xr-x   1 root     root            0 Jan  1  1970 etc
+-rw-r--r--   1 root     root         2605 Jan  1  1970 etc/recovery.fstab
+-rw-r--r--   1 root     root         9093 Jan  1  1970 file_contexts
+-rw-r-----   1 root     root         1316 Jan  1  1970 fstab.qcom
+-rwxr-x---   1 root     root       179476 Jan  1  1970 init
+-rwxr-x---   1 root     root         2823 Jan  1  1970 init.class_main.sh
+-rwxr-x---   1 root     root         1730 Jan  1  1970 init.mdm.sh
+-rwxr-x---   1 root     root         7374 Jan  1  1970 init.qcom.class_core.sh
+-rwxr-x---   1 root     root         6920 Jan  1  1970 init.qcom.early_boot.sh
+-rwxr-x---   1 root     root        12466 Jan  1  1970 init.qcom.factory.sh
+-rwxr-x---   1 root     root         6370 Jan  1  1970 init.qcom.sh
+-rwxr-x---   1 root     root         4561 Jan  1  1970 init.qcom.ssr.sh
+-rwxr-x---   1 root     root         2962 Jan  1  1970 init.qcom.syspart_fixup.sh
+-rwxr-x---   1 root     root         8256 Jan  1  1970 init.qcom.usb.sh
+-rwxr-x---   1 root     root         1740 Jan  1  1970 init.rc
+drwxr-xr-x   1 root     root            0 Jan  1  1970 proc
+-rw-r--r--   1 root     root         2161 Jan  1  1970 property_contexts
+drwxr-xr-x   1 root     root            0 Jan  1  1970 res
+drwxr-xr-x   1 root     root            0 Jan  1  1970 res/images
+drwxr-xr-x   1 root     root            0 Jan  1  1970 res/images/charger
+-rw-r--r--   1 root     root         1295 Jan  1  1970 res/images/charger/battery_0.png
+-rw-r--r--   1 root     root         1290 Jan  1  1970 res/images/charger/battery_1.png
+-rw-r--r--   1 root     root         1289 Jan  1  1970 res/images/charger/battery_2.png
+-rw-r--r--   1 root     root         1291 Jan  1  1970 res/images/charger/battery_3.png
+-rw-r--r--   1 root     root         1288 Jan  1  1970 res/images/charger/battery_4.png
+-rw-r--r--   1 root     root         1267 Jan  1  1970 res/images/charger/battery_5.png
+-rw-r--r--   1 root     root         2475 Jan  1  1970 res/images/charger/battery_charge.png
+-rw-r--r--   1 root     root         1805 Jan  1  1970 res/images/charger/battery_fail.png
+-rw-r--r--   1 root     root        31491 Jan  1  1970 res/images/erasing_text.png
+-rw-r--r--   1 root     root        17504 Jan  1  1970 res/images/error_text.png
+-rw-r--r--   1 root     root        24437 Jan  1  1970 res/images/font.png
+-rw-r--r--   1 root     root        19306 Jan  1  1970 res/images/icon_error.png
+-rw-r--r--   1 root     root         3402 Jan  1  1970 res/images/icon_installing.png
+-rw-r--r--   1 root     root        10095 Jan  1  1970 res/images/icon_installing_overlay01.png
+-rw-r--r--   1 root     root         9990 Jan  1  1970 res/images/icon_installing_overlay02.png
+-rw-r--r--   1 root     root         9782 Jan  1  1970 res/images/icon_installing_overlay03.png
+-rw-r--r--   1 root     root         9817 Jan  1  1970 res/images/icon_installing_overlay04.png
+-rw-r--r--   1 root     root         9863 Jan  1  1970 res/images/icon_installing_overlay05.png
+-rw-r--r--   1 root     root         9944 Jan  1  1970 res/images/icon_installing_overlay06.png
+-rw-r--r--   1 root     root        10062 Jan  1  1970 res/images/icon_installing_overlay07.png
+-rw-r--r--   1 root     root          673 Jan  1  1970 res/images/indeterminate01.png
+-rw-r--r--   1 root     root          687 Jan  1  1970 res/images/indeterminate02.png
+-rw-r--r--   1 root     root          661 Jan  1  1970 res/images/indeterminate03.png
+-rw-r--r--   1 root     root          665 Jan  1  1970 res/images/indeterminate04.png
+-rw-r--r--   1 root     root          683 Jan  1  1970 res/images/indeterminate05.png
+-rw-r--r--   1 root     root          676 Jan  1  1970 res/images/indeterminate06.png
+-rw-r--r--   1 root     root        66592 Jan  1  1970 res/images/installing_text.png
+drwxr-xr-x   1 root     root            0 Jan  1  1970 res/images/mmi
+-rw-r--r--   1 root     root         3962 Jan  1  1970 res/images/mmi/fail.png
+-rw-r--r--   1 root     root         3767 Jan  1  1970 res/images/mmi/pass.png
+-rw-r--r--   1 root     root        40632 Jan  1  1970 res/images/no_command_text.png
+-rw-r--r--   1 root     root          118 Jan  1  1970 res/images/progress_empty.png
+-rw-r--r--   1 root     root          404 Jan  1  1970 res/images/progress_fill.png
+-rw-r--r--   1 root     root          322 Jan  1  1970 res/images/stage_empty.png
+-rw-r--r--   1 root     root          258 Jan  1  1970 res/images/stage_fill.png
+-rw-r--r--   1 root     root         1387 Jan  1  1970 res/keys
+drwxr-x---   1 root     root            0 Jan  1  1970 sbin
+-rwxr-x---   1 root     root       161956 Jan  1  1970 sbin/adbd
+-rwxr-x---   1 root     root       120656 Jan  1  1970 sbin/healthd
+-rwxr-x---   1 root     root       436816 Jan  1  1970 sbin/recovery
+lrwxr-x---   1 root     root            7 Jan  1  1970 sbin/ueventd -> ../init
+lrwxr-x---   1 root     root            7 Jan  1  1970 sbin/watchdogd -> ../init
+-rw-r--r--   1 root     root          656 Jan  1  1970 seapp_contexts
+-rw-r--r--   1 root     root        75088 Jan  1  1970 sepolicy
+drwxr-xr-x   1 root     root            0 Jan  1  1970 sys
+drwxr-xr-x   1 root     root            0 Jan  1  1970 system
+drwxr-xr-x   1 root     root            0 Jan  1  1970 tmp
+-rw-r--r--   1 root     root         9740 Jan  1  1970 ueventd.qcom.rc
+-rw-r--r--   1 root     root         4023 Jan  1  1970 ueventd.rc
--- a/Show more
+++ b/Show more
				`@ -0,0 +1 @@`
				`/system/bin/sh: cat: /proc/cmdline: Permission denied`
				`@ -0,0 +1 @@`
				`/system/bin/sh: cat: /d/regulator/*/name: No such file or directory`
				`@ -0,0 +1 @@`
				`Linux version 3.10.28 (richal@msa2) (gcc version 4.7 (GCC) ) #1 SMP PREEMPT Tue Apr 14 19:25:03 CST 2026`
				`@ -0,0 +1 @@`
				`earlycon console=ttyMSM0,115200n8 ignore_loglevel loglevel=8 rdinit=/init`
				`@ -0,0 +1 @@`
				/tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lk2nd/boot/boot.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lk2nd/boot/extlinux.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lk2nd/boot/util.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lk2nd/hw/bdev/bdev.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lk2nd/hw/bdev/wrapper.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lk2nd/hw/bdev/util.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/bio/bio.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/bio/subdev.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/partition/partition.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/fs/fs.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/fs/ext2/ext2.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/fs/ext2/dir.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/fs/ext2/file.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/fs/ext2/io.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/bcache/bcache.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/zlib_inflate/decompress.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/zlib_inflate/inflate.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/zlib_inflate/inffast.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/zlib_inflate/inftrees.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/zlib_inflate/zutil.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/zlib_inflate/crc32.c /tmp/claude-1000/-home-q-doc-my-modem-jz08-aurora/3ceb92b9-b861-427f-bf45-745cceff3c3d/scratchpad/b5a/noforce/lib/zlib_inflate/adler32.c
				`@ -0,0 +1 @@`
				`gzip compressed data, from Unix, original size modulo 2^32 1060352`