B6P: persistent modem autostart integration passed

NOTES.md

@@ -962,3 +962,225 @@ rmtfs.log, mm-*.log with IMSI masked), UART `logs/uart/b6-20260930-160910.log`.
   Hypothesis (not proven): "amnesic EFS" — with rmtfs -r, each rmtfs restart discards the RAM shadow (modem_fs2 write after attach), so every MSS boot presents the stale NAS context from disk
   (GUTI/KSI/NAS COUNT); the MME rejects it while it still holds the newer context, and a reject clears it. EMM reject cause not obtained (QMI GET has none).
 - Board final state: controller OFF, MSS offline, rmtfs/MM not running (udevd/dbus/polkitd left running), wwan all DOWN, USB NCM OK.
+
+# Session 29 — B6J1 capture registration-denied + B6J2 rmtfs audit (2026-09-30 17:37–17:51 MSK) — **J1 captured, J2 GO, J3 NOT STARTED (board hung in SBL1 on warm reboot)**. Nothing written to flash.
+Scripts `b6j/` (SHA256SUMS; b6j-in1.tar 16a53ac1…): controller copy with RAM-only knobs MODEM_STOP_DISABLE / MODEM_RMTFS_PERSIST / MODEM_REG_SNAP
+(original `b6/aurora-modem` untouched), j1.conf / j3.conf, j-snap.sh (QMI GET + AT read queries, AT port opened ONCE), j-run.sh (j1|j3 harness).
+Logs `logs/b6j/j1/` (j1.tar 2c60d128…), UART `logs/uart/b6-20260930-160910.log` (same boot as session 28, uptime 6694–7003 s).
+- J1 lifecycle = minimal proven: rmtfs -r -P -s -v per cycle, no MM --disable / qmicli low-power in stop, holdoff 0, MODEM_KEEP_ON_FAIL=1.
+  c1 PASS (reg 4.2 s, B3/1275 PCI 55 TAC <CELL> ECI <CELL>, DNS/ICMP/HTTP/HTTPS PASS, stop rc=0, rmtfs writes 0).
+  c2 FAIL: DMS online 3.2 s → 180 s `not-registered-searching`, PS detached; snapshot at +0.5 s, stack kept, then clean stop rc=0 (0.5 s).
+- c2 snapshot: serving-system limited, Forbidden no, CS/PS detached, PLMN 250-99; system-info LTE Status limited / True Status none / Domain none,
+  Cell 156465929 TAC <CELL>, **SIM reject info 'available'** (SIM not invalidated → not EMM #3/#6/#7/#8); signal RSRP −107 RSRQ −20 SNR −8.8;
+  cell-location: B1 EARFCN 550 PCI 35 TAC <CELL> ECI <CELL> (neighbours 149/308/147/187), rf-band eutran-3/1275 (inconsistent with cell-location);
+  DMS online; UIM slot1 present, USIM ready, PIN1 disabled. MM not running (fail precedes MM stage) → mmcli n/a.
+- AT (wwan0at0, one open/close, 3 s spacing, raw in c2/snap/at.txt): AT OK; +CEREG: 0,2; +CGREG: 0,2; +CREG: 0,2; +CGATT: 0; +COPS: 0;
+  +CEER: No cause information available. **CEREG n=0 → no reject cause; AT+CEREG=5 NOT sent (per instruction).**
+- rmtfs: c1 (PASS) 0 EFS writes; c2 (FAIL) 1 write `iovec 0 / write 0:1792` (modem_fs1, whole image) after the reject. Session 28: writes by caller 0 ×6, caller 1 ×2.
+- Safety: NV modemst1/2, fsg, fsc, persist before == after (== B2 refs); eMMC writes 0/0; BAM-DMUX suspended; dmesg Failed to resume/-110/-22/EAGAIN/SSR = 0; NCM OK.
+- J2 (`b6j/J2-rmtfs-audit.md`): in v1.3 the -r shadow_buf lives in a static rmtfds[] slot; storage_open() returns the existing slot for the same node+path
+  without re-reading; BYE/DEL_CLIENT are no-ops; ENETRESET loop keeps storage; only QMI CLOSE (never sent by this modem: 0 in 11+ boots) or process
+  exit frees it → **a long-lived rmtfs keeps MSS EFS writes across MSS restarts; backing partitions are re-read only by a new rmtfs process. GO.**
+- J3 start: `reboot -f` at 17:47:07 → SBL1 log stops after `Pre_DDR_clock_init` (no USB device on 480s, >4 min) = the known early pre-lk hang.
+  Needs a physical power-cycle. J3 not run.
+
+# Session 29b — B6J3 long-lived rmtfs (2026-09-30 18:01–18:10 MSK) — **3 PASS → FAIL on cycle 4; rmtfs hypothesis NOT supported. B6 stays OPEN.**
+User power-cycled the board after the SBL1 hang; fresh golden mm1 (Linux 7.2.7-aurora-bam1), clock from 480s. Logs `logs/b6j/j3/` (j3.tar d8b61543…), b6j-in2.tar.
+Baseline: 30/30 eMMC getro=1, /firmware vfat ro, MSS offline, no rmtfs/MM/qmi-proxy/udevd/dbus, NV == B2 refs, eMMC writes 0, NCM OK.
+ONE `rmtfs -r -P -v` (pid 1273, no -s), MSS start/stop via remoteproc sysfs, no MM disable, holdoff 0, KEEP_ON_FAIL=1.
+
+| c | reg | latency | cell (TAC/PCI/ECI, ch) | signal at reg | data | rmtfs writes |
+| 1 | PASS | 6.2 s | 7661/55/156465929 B3 1275 | RSRQ −15 SNR −2.2 | PASS 10.45.164.101 | 0 |
+| 2 | PASS | 2.1 s | same | RSRQ −16 SNR −1.0 | PASS 10.44.134.61 | 0 |
+| 3 | PASS | 8.2 s | same | RSRQ −19 SNR −5.8 | PASS 10.83.20.58 | 0 |
+| 4 | FAIL | >180 s registration-denied | **PLMN 250-01 (MTS), roaming on, Forbidden yes**, TAC <CELL> PCI 47 ECI <CELL> B3 1425 | RSRP −84 SNR 9.8 | not run | 1 (fs1, after reject) |
+All cycles: stop rc=0, BAM suspended, MSS offline, rmtfs pid constant, Failed to resume/-110/-22/EAGAIN/SSR 0, NCM ok, eMMC 0/0.
+End: MSS offline → rmtfs-stop rc=0; NV before == after; eMMC writes 0.
+rmtfs.log: 1× "registering services" for 4 MSS boots; each boot re-OPENs fs1/fs2/fsg/fsc → same caller ids 0..3 (slot reuse, no re-read per J2);
+**0 writes in c1–c3 → the shadow equalled the on-disk image up to c4**, i.e. MSS saw exactly the EFS content it saw in the old per-cycle-rmtfs flow.
+c4 AT: +CEREG 0,2 / +CGREG 0,2 / +CREG 0,2 / +CGATT 0 / +COPS 0 / +CEER "No cause information available" (CEREG=5 not sent). SIM reject info 'available'.
+
+Interpretation: PASS→PASS (twice) breaks the strict alternation, but a FAIL still occurs with one rmtfs process, and before it the RAM EFS never
+diverged from disk → the "amnesic EFS" mechanism cannot explain it. Hypothesis rejected. Two FAIL signatures across sessions 21/28/29:
+ (A) HPLMN 250-99 cell TAC <CELL>, Status limited, Forbidden no, not-registered-searching (s28 c2/c6 + debug, J1 c2; RSRQ −20, SNR −8.8);
+ (B) foreign PLMN camp, registration-denied, Forbidden yes, roaming (s28 c4: 250-02; J3 c4: 250-01, strong cell), s21: TAC <CELL>.
+Beeline radio at the board is marginal even on PASS (RSRQ −15…−20, SNR −1…−8), a strong foreign-PLMN cell exists. Cause of (A) still unknown
+(no EMM cause obtainable with n=0). Nothing persistent was changed; no retry workaround, no T2.
+
+# Session 29c — B6K reject-cause capture (2026-09-30 18:17–18:21 MSK) — **FAIL on cycle 1; AT+CEREG=5 / AT+CGREG=3 → ERROR; no numeric cause. STOP.**
+Same boot as 29b. Lifecycle fixed for the whole series = J1 variant (rmtfs -r -P -s -v per cycle, no MM disable/low-power, holdoff 0, KEEP_ON_FAIL=1)
++ RAM-only hooks: MODEM_HOOK_PRE_ONLINE (`k-at.sh gate`), MODEM_HOOK_PRE_MM (`k-at.sh close`). b6j-in3.tar a884ce31…; logs `logs/b6j/k/` (k.tar f15b06b7…).
+Baseline: 30/30 RO, MSS offline, rmtfs/MM/qmi-proxy absent, wwan0–7 down, BAM suspended, NCM ok; NV hashed by harness (before == after).
+- k-at: wwan0at0 opened once at 969.69 (MSS up + wwan0qmi0 + 2 s), held until the FAIL queries, closed 1181.73. Raw: c1/at/at.clean.txt.
+  AT OK; **AT+CEREG=5 → ERROR; AT+CGREG=3 → ERROR** (no other values tried); pre-online: +CEREG: 0,6 / +CGREG: 0,6 / +CREG: 0,6.
+  DMS online SET at 981.95 (first SET accepted, 0.1 s — no DeviceNotReady this time because the AT setup delayed it ~12 s).
+  No URCs during the 180 s (n=0). FAIL queries: +CEREG 0,2 / +CGREG 0,2 / +CREG 0,2 / +CGATT 0 / +COPS 0 / **+CEER: EMM attach failed**.
+- QMI at FAIL: controller saw 'registration-denied' at 1162.24; snapshot 0.5 s later 'not-registered-searching', PS detached, PLMN 250-99, Forbidden no,
+  Status limited, **True Status limited-regional, Domain camped**, SIM reject info available; cell ECI <CELL> **PCI 390**, B3 EARFCN 1275,
+  system-info TAC **41028** vs cell-location TAC <CELL>; RSRP −101/−102, RSRQ −18, SNR −3.0; neighbour PCI 55 (the PASS cell) RSRP −102.1 RSRQ −18.2.
+  DMS online; USIM ready. = exactly the session-21 FAIL cell (PCI 390, ECI <CELL>, TAC <CELL>/7661).
+- rmtfs: 1 write (fs1, after the failure) → RAM shadow only. eMMC 0/0, NV unchanged, BAM suspended, dmesg errors 0, NCM ok; MSS offline, rmtfs exited.
+- Observation (not proven): FAIL cells carry TAC <CELL> (s21 PCI 390 Beeline; J3 c4 250-01; now PCI 390 Beeline); PASS cell PCI 55 ECI <CELL> TAC <CELL>.
+
+# Session 29d — B6L passive recovery observation (2026-09-30 18:39–18:43 MSK) — **Scenario A: self-recovery PCI 390 → PCI 55, registered + PS attached, no intervention. STOP.**
+Same boot. Lifecycle = J1 variant (l.conf == j1.conf: rmtfs -r -P -s -v per cycle, minimal stop, holdoff 0, KEEP_ON_FAIL=1), no AT hooks.
+Observer b6j/l-obs.sh (QMI GETs + AT read queries; wwan0at0 opened once for the whole observation; 15 s period, 900 s max, stop 1 sample after PASS).
+b6j-in4.tar 8f99b548…; logs `logs/b6j/l/` (l.tar 9c9e7dbc…), timeline `l/c1/obs/timeline.tsv` (TAC/ECI per getter kept in separate columns).
+- Baseline: checksums OK, 30/30 RO, MSS offline, rmtfs/MM absent, BAM suspended, NCM ok.
+- Cycle 1 (first startup attempt): DMS online at 2276.21 → 180 s timeout at 2456.53 'not-registered-searching'. No cleanup; MSS/rmtfs/radio untouched, MM not started.
+- t=0 (2457.24): ss not-registered-searching, PS detached, 250-99, limited, Forbidden no; si limited / limited-regional / camped, si ECI <CELL>, si TAC <CELL>;
+  cl PLMN 25099, cl TAC <CELL>, cl ECI <CELL>, EARFCN 1275, **PCI 390**; RSRP −100 RSRQ −19 SNR −3.4; AT +CEREG 0,2 +CGREG 0,2 +CREG 0,2 +CGATT 0
+  +COPS: 0,0,"Beeline beeline",9.
+- t=15 s (2472.28): **ss registered, PS attached**, available; si available / domain ps, si ECI <CELL>, si TAC <CELL>; cl TAC <CELL>, cl ECI <CELL>,
+  EARFCN 1275, **PCI 55**; RSRP −100 RSRQ −19 SNR −1.6; AT +CEREG 0,1 +CGREG 0,1 +CREG 0,0 +CGATT 1 +COPS: 0,0,"Beeline beeline",7.
+  t=35 s: unchanged (registered/attached, PCI 55). → recovery happened between 2461.4 and 2472.3 = **185–196 s after DMS online**, i.e. just after
+  the controller's T_REG=180 s gives up.
+- Only GET/read queries were issued during the window (QMI via qmi-proxy, AT read queries); no mode/selection change.
+- Safety: MSS running throughout, BAM suspended, dmesg errors 0, NCM ok every sample, eMMC 0/0; clean stop rc=0 → MSS offline → rmtfs exited;
+  NV before == after. rmtfs: 1 write (fs1) in RAM shadow.
+- Interpretation: failures are cell selection/registration timing on marginal Beeline coverage (initial camp on PCI 390 whose system-info reports
+  TAC <CELL> / ECI <CELL> ≠ cell-location TAC <CELL> / ECI <CELL>; attach fails, "EMM attach failed"), and the modem recovers by itself by
+  reselecting PCI 55. The lifecycle is not the direct cause. Earlier "FAIL" verdicts may partly be an artefact of the 180 s registration timeout.
+
+# Session 29e — B6M registration state machine, 6-cycle target (2026-09-30 18:49–18:57 MSK) — **STOP on cycle 2: REGISTRATION_TIMEOUT (360 s). 1/2 PASS. B6 OPEN.**
+Same boot. Lifecycle = J1 variant + `MODEM_REG_SM=1`, T_REG=360 (m.conf; b6j-in5.tar 3f3cebfb…): 3 s poll of NAS serving-system + system-info; cell-location +
+signal only on state/cell change → `reg-trans.tsv`; immediate FAIL only for local errors (MSS, qmi dev, rmtfs, SIM, BAM error, dmesg crash/wdog, usb0 ping).
+Logs `logs/b6j/m/` (m.tar 3cac04d4…; m-table.tsv, c*/reg-trans.tsv). Baseline: checksums OK, 30/30 RO, MSS offline, rmtfs/MM absent, BAM suspended.
+- c1 PASS: searching → t+3.5 s limited/limited-regional camped PCI 55 → t+6.9 s registered + PS attached (PCI 55, TAC <CELL>); 0 denied; bearer 10.42.49.49;
+  DNS/ping 3+3/HTTP 302/HTTPS 204+200; stop rc=0 (4.0 s), BAM suspended.
+- c2 (started ~13 s after c1 stop) REGISTRATION_TIMEOUT: 12 transitions, 1 registration-denied, never registered. Path (PCI): 55 (250-99, limited-regional, camped)
+  → 47 (250-01 MTS, TAC <CELL>, denied, RSRP −83) → 55 → 64 (250-20 Tele2, TAC <CELL>, cl TAC <CELL>) → 55 → 149 → 147 (Beeline B1/550) → 55 → 187 → 149 → 55.
+  On PCI 55 the whole time: limited, True Status limited-regional/none, PS detached; RSRP −99…−113, RSRQ −12…−17, SNR −2…−5. **PCI 390 never seen.**
+  At 360 s: AT +CEREG 0,2 / +CGREG 0,2 / +CREG 0,2 / +CGATT 0 / +COPS 0 / +CEER: EMM attach failed; Forbidden no; SIM reject info available; DMS online; USIM ready.
+- Safety: no local failure; dmesg errors 0; NCM ok; eMMC 0/0; NV before == after; after STOP MSS offline, rmtfs exited, BAM suspended.
+- Consequences: (1) B6L "PCI 390 is the bad cell" is not sufficient — attach also fails for >360 s while camped on PCI 55, the PASS cell.
+  (2) Pattern again: a quick re-attach right after a successful session (MSS stop without detach, ~13 s gap) failed (same as s28 c1→c2, J1 c1→c2);
+  J3 c1→c2→c3 were counter-examples. (3) 'limited-regional' on TAC <CELL> is consistent with a TA-restriction type reject, but no EMM cause is available.
+  (Harness row label ">180s" is stale text; the deadline was 360 s. init_pci column '-' = first transition row had no cell yet; real initial PCI 55.)
+
+# Session 29f — B6N1 long-lived MSS, 6 bearer cycles (2026-09-30 19:02–19:06 MSK) — **N1 PASS 6/6**
+Same boot (warm-hung + power-cycled boot of 18:01). New RAM-only: `aurora-modem disconnect` (simple-disconnect, our /32 routes, flush+down all wwan*,
+wait BAM suspended; MSS, rmtfs, MM and DMS radio stay up); `start` with rmtfs+MSS+MM alive reuses them and only simple-connects.
+n.conf = j1.conf + MODEM_REG_SM=1, T_REG=600. Harness b6j/n-run.sh (b6j-in6.tar d5b551b5…). Logs `logs/b6j/n1/` (n1.tar 7be48a4a…, n-table.tsv).
+- One MSS start (rmtfs -r -P -s -v pid 25000): searching → t+3.6 s registered + PS attached, PCI 55 TAC <CELL>, 0 denied, no reselection.
+- 6 bearer cycles with MSS/rmtfs/MM (pid 25486) never restarted: connect rc=0 (cycles 2–6 ≈ 6 s), IPv4 10.38.215.205 each time (network kept the default bearer),
+  DNS ok, ping 3+3, HTTP 302, HTTPS 204+200, disconnect rc=0, stale routes 0, wwan none UP / no address, BAM suspended after each disconnect, NCM ok, eMMC 0/0, dmesg errs 0.
+- Shutdown: stop rc=0 3.7 s (MM stop → BAM suspended → SIGTERM rmtfs → MSS offline → rmtfs exited last). NV before == after; eMMC w=0 s=0.
+
+# Session 29g — B6N2 cold boots (2026-09-30, user power cycles; driver b6j/n2-boot.sh on 480s, logs `logs/b6j/n2bK/`)
+- Boot 1 (power-on 19:08, uptime 0 min at baseline): 30/30 RO, /firmware ro, MSS offline, no daemons, NV == refs. One MSS start → registered + PS attached
+  t+3.6 s, PCI 55 TAC <CELL> (RSRP −100 RSRQ −15 SNR −1.4), 0 denied, no reselection; bearer 10.46.102.140; DNS ok, ping 3+3, HTTP 302, HTTPS 204+200;
+  disconnect rc=0; clean stop rc=0; NV unchanged, eMMC 0/0, dmesg errs 0, NCM ok. **PASS** (n2b1.tar 360251b8…).
+- Boot 2 (power-on 19:11, uptime 0 min): baseline identical to boot 1 (30/30 RO, fw ro, MSS offline, no daemons, NV == refs). One MSS start →
+  t+3.5 s limited/limited-regional camped PCI 55 → t+41.6 s limited on 250-20 (Tele2) PCI 231 EARFCN 100 → t+54.4 s registered + PS attached PCI 55 TAC <CELL>
+  (RSRP −102 RSRQ −17 SNR −4.2); 0 denied, 2 reselections; bearer 10.40.197.148; DNS ok, ping 3+3, HTTP 302, HTTPS 204+200; disconnect rc=0; stop rc=0;
+  NV unchanged, eMMC 0/0, dmesg errs 0, NCM ok. **PASS** (n2b2.tar 48ffc4fb…).
+- Boot 3: user's power cycle; while re-plugging, the USB-C cable was briefly pulled → two power-ons (19:15:34 and 19:16:03, both from SBL1 Start), nothing
+  run in either; the test ran on the 19:16:03 boot (uptime 0 min at baseline, same baseline as boots 1–2). One MSS start → t+6.8 s registered + PS attached
+  on **PCI 149 (Beeline B1 EARFCN 550, TAC <CELL>, ECI <CELL>)**; the signal reading at that moment was a placeholder (−140 dBm / 0 dB / −18.4 dB = not measured yet);
+  0 denied; bearer 10.36.246.137; DNS ok, ping 3+3, HTTP 302, HTTPS 204+200; disconnect rc=0; stop rc=0; NV unchanged, eMMC 0/0, dmesg errs 0, NCM ok.
+  **PASS** (n2b3.tar 3896a0c4…).
+- **B6N result: N1 6/6 + N2 3/3 → B6 RAM lifecycle PASS** (per user's criteria; rapid MSS restart / re-attach reliability is a separate, non-blocking item).
+  Registration latency on cold boots: 3.6 / 54.4 / 6.8 s (min 3.6, median 6.8, max 54.4); N1 3.6 s. Transient denied: 0 in all N runs.
+  No SSR/watchdog, no BAM -110/-22/EAGAIN, NV unchanged, eMMC writes 0, USB management never lost. Nothing persistent was integrated.
+
+# Session 30 — B6P persistent integration P0–P5 (2026-09-30) — **candidate built, nothing written; P6 waits for fastboot entry**
+Details `b6p/B6P-DESIGN.md`; build `b6p/build-candidate.sh`; diffs `b6p/diff-b6n-vs-b6p.diff`, `b6p/diff-old-b6-vs-b6p.diff`; copy on 480s ~/doc/modem/jz08-aurora/b6p.
+- P0: production controller = proven b6j/aurora-modem (aa9e9aa2, B6N) minus diagnostic code; config /etc/aurora/modem.conf; state /run/aurora-modem.
+- P2: golden mm1 has NO OpenRC; PID 1 = custom busybox /init. User decision: no OpenRC, one `/etc/init.d/aurora-modem` started from /init after NCM
+  (only if EMMC_RO_OK and B1_OK); cmdline kill switch `aurora.modem=off`.
+- P5: `b6p/out/aurora-mm1-b6p.img` 20 617 216 B **18a25e39…9090**: golden kernel/header/cmdline, ramdisk = golden initramfs.cpio.gz (exact bytes) +
+  overlay gzip member 651fc826 (REPLACES /init 5db9dc7e→9d6694fb; NEW /usr/sbin/aurora-modem 6e922dec, /etc/init.d/aurora-modem 533f47ea,
+  /etc/aurora/modem.conf 6ffb206e). mkbootimg.py reproduces golden 38c960ef bit-for-bit. Golden initramfs not rebuildable from tree (mtimes, b4b2-mm edited).
+- P6 entry (lk1st autoboot source, aboot.c:5584–5598): PM8916 RESIN (Aurora RESET button = KEY_VOLUMEDOWN) pressed when lk1st starts → fastboot;
+  GPIO107 (VOLUMEUP) must NOT be pressed (both → dload). Not yet tried on hardware.
+- **P6 PASS** (2026-09-30 20:19–20:23, UART same log file; `logs/b6p/p6/` p6.tar 13f521fa, `logs/uart/b6p-p6-fastboot.txt`):
+  RESET held at power-on → lk1st `fastboot: processing commands` (18d1:d00d, serial <EMMC_SERIAL>, product lk1st-msm8916) — **RESIN fastboot entry works on hardware**.
+  `fastboot boot b6p/out/aurora-mm1-b6p.img` (18a25e39) rc=0 → Linux #5 BAM1, EMMC-RO 30/30, B1_OK=1, `aurora-modem: starting` at t=9.5 s, clock 1970 (not set).
+  Autostart: MSS 0.7 s → registered + PS attached t+3.6 s (PCI 390, TAC <CELL>, ECI <CELL>) → MM detected 40.2 s → connect → wwan0 10.80.93.64/25, **START OK 62.8 s**.
+  Data on autostart bearer: DNS ok, ping 3+3, HTTP 302 (HTTPS skipped: clock 1970, per P4). 3 × (disconnect rc=0 → 0 routes, no wwan UP, BAM suspended, MSS/rmtfs 1043/MM 1535
+  unchanged → start/reconnect → data PASS, same IPv4). Service stop rc=0 (4.0 s: MM → BAM → MSS offline → rmtfs last). NV == /tmp/nv-before, eMMC 0/0, dmesg errs 0, NCM ok.
+  Test tools only pushed at run time (b6p/test/p-run.sh, p-datatest, curl), not in the image.
+- **P7 boot 2 PASS** (20:38–20:40; p7b2.tar 9c660c70): RESET-held power-on → fastboot → `fastboot boot` 18a25e39 rc=0 → autostart t≈10 s (clock 1970) →
+  t+6.8 s limited/limited-regional camped PCI 390 → t+10.1 s registered + PS attached PCI 390 TAC <CELL> → START OK 77.9 s, wwan0 10.81.4.117/30;
+  DNS/ping 3+3/HTTP 302 PASS; service stop rc=0; NV unchanged, eMMC 0/0, dmesg errs 0, NCM ok.
+- **P7 boot 3 PASS** (20:44–20:46; p7b3.tar 78353764): autostart → t+6.9 s registered + PS attached PCI 55 TAC <CELL> → START OK 75.6 s, wwan0 10.41.108.226/30;
+  DNS/ping 3+3/HTTP 302 PASS; service stop rc=0 (4.0 s); NV unchanged, eMMC 0/0, dmesg errs 0, NCM ok. (MM log shows network NITZ time 2026-09-30 17:46:09 UTC — note for B7.)
+- **P6/P7 RAM result: 3/3 candidate boots PASS** (START OK 62.8 / 77.9 / 75.6 s; registration 3.6 / 10.1 / 6.9 s; 0 MSS retries), + 3/3 reconnects in P6.
+- P8: `b6p/cache-extlinux-b6p.img` **9fea693a…** (mkfs-cache-b6p.sh, B5b recipe; B5b recipe re-verified to reproduce 409bbb11). lk2nd emulator: S3 boots 'b6p'
+  (ramdisk 8dcb61c8 @+0x2699000, DTB @+0x2499000), F1–F11 → android boot (emmc1); harness regression == session 26.
+- P9: live RO hashes on the board: cache 409bbb11, boot e9579f33, aboot 3b8cd266, rest == A3, eMMC writes 0. Prepared (NOT run): `b6p/B6P-write.sh` 151c0498
+  (= B5b-write.sh with new hashes), `b6p/B6P-rollback.sh` 2d2532f0 (→ 409bbb11). Full list `b6p/B6P-PREFLIGHT.md`. **STOP — waiting for GO for the cache write.**
+
+# Session 31 — B6P cache write (2026-10-01, user GO, HW EDL) — **CACHE_MATCH, B6P_WRITE_VERIFIED**
+`b6p/B6P-write.sh` 151c0498 unchanged: gates OK (loader, candidate 9fea693a, rollback image 409bbb11, 9008, serial, cache geometry, GPT == A3, boot e9579f33,
+aboot 3b8cd266, pre-cache 409bbb11) → `Wrote b6p/cache-extlinux-b6p.img to sector 2133088` → readback **9fea693a == candidate (CACHE_MATCH)** →
+GPT p/b, tzbak, boot, aboot, sbl1, rpm, tz, hyp, recovery, modemst1/2, fsg, fsc, persist == A3; modem, system, userdata == A4pre. Logs `logs/b6p/W/`, `logs/b6p/B6P-write.out`.
+Flash now: cache 9fea693a (extlinux → B6P), boot e9579f33 (emmc1 fallback), aboot 3b8cd266; rest unchanged. Rollback: `b6p/B6P-rollback.sh` (→ 409bbb11).
+
+# Session 31b — B6P persistent cold boot 1 (2026-09-30 22:00–22:12 on 480s clock) — **boot path PASS, autostart/registration/bearer PASS, DATA FAIL. STOP.**
+- Two power-ons (user): 22:00:55 and 22:05:25; both lk1st → extlinux 'b6p' (`ramdisk @ 0x82699000 (11955862), tags/device tree @ 0x82499000` == emulator S3)
+  → Linux #5, EMMC-RO 30/30, B1_OK=1, service autostart. No host action on the boot path.
+- 22:00 boot: controller reached `SET ... online` at t=13.4 s, then **no further UART output at all for 4 min** (no "DMS online", no REG line) until the
+  22:05 power cycle. Its /run logs are lost; cause unknown (controller/qmicli stall vs. board hang — NCM was not probed then). Modem may have gone online/attached before the cut.
+- 22:05 boot (tested, logs `logs/b6p/pc1/`, pc1.tar fd83a3fb; `/run/aurora-modem` incl. MM debug log in `logs/b6p/pc1-run/`, pc1-run.tar):
+  t+3.6 s limited PCI 187 → t+38.7 s registered + PS attached PCI 147 (B1 EARFCN 550, TAC <CELL>, RSRP −108) → MM → simple-connect → Bearer/1 wwan0 10.46.122.74/30
+  gw .73, DNS 10.10.22.1/194.186.191.1, MTU 1500 → START OK 107.2 s. Clock 1970.
+  Data: nslookup ya.ru/google via 10.10.22.1 → timeout; ping 77.88.8.8 0/3, 1.1.1.1 0/3; routes correct (77.88.8.8 dev wwan0 src 10.46.122.74; usb0 intact).
+  BAM-DMUX runtime active_ms 1251 → 14813 during the test (TX was handed to BAM), but no RX at all.
+  MM data-path setup identical to passing cold boot B6N n2b1: WDA link layer 802-3 → raw-ip, Bind Data Port a2-mux-rmnet0 SUCCESS, Start Network OK, MTU 1500.
+  No network-side disconnect during the test (only our Stop Network at 141.9 s, cm 2000). dmesg errors 0. Service stop rc=0; NV unchanged; eMMC 0/0; NCM ok.
+- Test tooling glitch: first pc1.tar fetch empty (`nc: bind: Address already in use` on port 9995 on the board); refetched OK. Not a device issue.
+- Not proven: user-plane dead with a correctly established bearer; differences vs all passes = cell PCI 147 (B1) and the preceding abrupt power cut of an
+  online modem (22:00 boot). Same symptom family as JZ02 S9 PARTIAL (TX to BAM, zero RX).
+
+# Session 31c — B6P persistent cold boots 2–3 (2026-09-30 22:15–22:28) — **pc2: REGISTRATION_TIMEOUT + spontaneous reset during rollback stop; pc3 PASS. STOP.**
+pc-boot.sh fixed (test side only): UART offset from last `SBL1, Start`, unique fetch port 9960+K, NCM alive-probe every 30 s (logs/b6p/pcK-alive.txt).
+- pc2 (user power-on 22:15:37): extlinux b6p → autostart → 600 s limited service on Beeline, never registered: reselections among PCI 55 / 147 / 308 (B3 1275 / B1 550),
+  status limited (none/none), 0 denied → `FAIL in RADIO_ONLINE: REGISTRATION_TIMEOUT after 600s` → rollback full stop: wwan down, qmi-proxy stopped, BAM suspended,
+  `SIGTERM rmtfs 1045` at 22:25:59.377 → wwan ports disconnected → **no further kernel output; 11 s later (22:26:10.78) SBL1 Start** (batt_voltage=4199), i.e. a
+  reset with no panic/watchdog message. NCM alive-probe OK up to 22:25:52. User did not report a power cycle at that time (to confirm). /run logs of pc2 lost.
+- pc3 (= the boot after that reset, 22:26:10): extlinux b6p → autostart → t+3.6 s registered + PS attached PCI 55 TAC <CELL> → START OK 72.2 s, wwan0 10.47.193.46/30 →
+  DNS/ping 3+3/HTTP 302 PASS → service stop rc=0; NV unchanged; eMMC 0/0; dmesg errs 0; NCM ok. **PASS** (pc3.tar 2569bacc).
+- Tally of persistent boots: boot path extlinux 'b6p' 4/4 (22:00, 22:05, 22:15, 22:26); modem result: 22:00 silent after online SET (cut by user),
+  pc1 bearer up but no user-plane RX (PCI 147), pc2 no registration in 600 s + reset in stop, pc3 PASS (PCI 55).
+- **Reset reason (read 22:30 on the 22:26 boot, read-only regmap debugfs of PM8916 PON 0x800–0x80F):** PON_REASON1 0x808=0x10 → **USB charger insertion**;
+  POFF_REASON2 0x80D=0x20 → **UVLO (under-voltage lock-out)**; POFF_REASON1 0x80C=0x00; WARM_RESET_REASON1 0x80A=0x02 (PS_HOLD, probably stale).
+  Decode per downstream qpnp-power-on.c (`b6p/test/pon-decode.txt`). ⇒ the 22:26 reset was a supply under-voltage power-off (then re-power from USB), not a
+  kernel/SW reset — consistent with the known flaky battery contact during modem shutdown. pstore empty (no ramoops region in DT); /dev/watchdog present (qcom-wdt).
+  Test side: p-run.sh now records PON regs at the start of every boot (p-test.tar rebuilt). User decision: keep B6P cache; fix battery + better RF; 3 more cold boots.
+
+# Session 31d — B6P cold boots with secured battery + moved antenna (2026-09-30 23:10–)
+- 23:10:47 power-on stalled inside SBL1 after Pre_DDR_clock_init (known early pre-lk hang; during user handling), 23:11:33 power-on OK.
+- **pc4 PASS** (pc4.tar e00707db): PON 0808=10 (USB), 080a/080c/080d=00 (clean power removal). extlinux b6p → autostart → t+3.6 s registered + PS attached
+  PCI 55 (B3 1275, TAC <CELL>) → START OK 72.0 s wwan0 10.45.64.176/27 → DNS/ping 3+3/HTTP 302 → service stop rc=0; NV unchanged, eMMC 0/0, dmesg errs 0, NCM ok.
+- **pc5 power-on 23:26:59: HANG after `SBL1, End` (QSEE Execution done), no "UART_DM Initialized"/"welcome to lk", no USB device, NCM never up (>10 min).**
+  Same signature as B5b 15:41 (hang between SBL1 End and lk1st) — before lk1st runs, i.e. before cache/extlinux/B6P image is read. Not a B6P runtime event.
+  UART saved `logs/b6p/pc5-hang-uart.txt`. Early boot hangs so far: 15:41 (after SBL1 End), 15:45 + 23:10:47 (inside SBL1 DDR init), 23:26:59 (after SBL1 End).
+  Needs a power cycle; boot 5 of the 3-boot series to be repeated.
+- pc5 retry (user power cycle ~23:40, UART `logs/b6p/pc5b-uart.txt`): 23:40:25 SBL1 → lk1st → extlinux b6p → Linux (EMMC-RO at 1.9 s) → **23:40:39 new SBL1 Start with
+  no kernel message** (Linux ≈13 s old, inside /init before USB/modem) → lk1st hangs after `target_init()` ~11 s (known lk hang) → 23:40:50 SBL1 → **hang after SBL1 End**
+  (no lk, no USB, still at 23:41:41). batt_voltage 4197 mV at both SBL1 starts. Whether 23:40:39 was caused by the power-cycle handling is unknown.
+  Pre-lk / early-boot failures are now frequent (23:10:47, 23:26:59, 23:40:39→50) and independent of the B6P image (all before cache is read, or before modem start).
+- **pc5 PASS** (power-on 23:43:49; pc5.tar d36f1f2d): PON 0808=10 (USB), 080d=**20 (UVLO)** latched from the preceding power-off (pc4 after a user cycle showed 00 —
+  so the latched POFF depends on how power went away; not conclusive). extlinux b6p → autostart → t+3.6 s limited PCI 7 → t+6.9 s registered + PS attached PCI 55 (B3 1275) →
+  START OK 55.2 s wwan0 10.82.175.12/29; radio after autostart PCI 147 B1 EARFCN 550, RSRP −103, RSRQ −14, SNR −1.2 → DNS/ping 3+3/HTTP 302 PASS (data OK on PCI 147,
+  so pc1's dead user-plane is not simply "PCI 147") → service stop rc=0; NV unchanged, eMMC 0/0, dmesg errs 0, NCM ok.
+- **pc6 PASS** (power-on 23:45:57; pc6.tar b808a44a): PON 0808=10, 080d=20 (UVLO latched, as pc5). extlinux b6p → autostart → t+3.6 s limited PCI 7 → t+6.9 s registered + PS attached
+  PCI 7 (B3 1275, TAC <CELL>, ECI <CELL>) → START OK 64.4 s wwan0 10.82.7.27/29; radio after autostart PCI 390 B3 EARFCN 1275, RSRP −99, RSRQ −18, SNR −4.4 →
+  DNS/ping 3+3/HTTP 302 PASS → service stop rc=0; NV unchanged, eMMC 0/0, dmesg errs 0, NCM ok.
+- **Series with secured battery + moved antenna: pc4, pc5, pc6 = 3/3 PASS** (registration 3.6 / 6.9 / 6.9 s; START OK 72.0 / 55.2 / 64.4 s; 0 denied; no reset during runtime/stop).
+  Per user criteria: **B6P persistent integration = OPERATIONAL.** Separate open reliability issues (non-blocking for B6P):
+  R1 UVLO power-off during modem/rmtfs shutdown (pc2, 22:26; PON decode) — not repeated with secured battery;
+  R2 early boot hangs before lk1st / in lk1st (SBL1 DDR-init, after SBL1 End, lk target_init) and one unexplained restart 13 s into Linux (23:40:39) — all before modem start;
+  R3 pc1 bearer up but no user-plane RX (not reproduced; PCI 147 later worked in pc5);
+  R4 22:00 boot silent after online SET (cut by user; not reproduced);
+  R5 rapid MSS restart re-attach quirk (from B6M).
+
+## B6P status — PASS (2026-10-01)
+Implemented: extlinux boot from cache (9fea693a; rollback image 409bbb11), initramfs overlay on exact golden mm1 bytes, modem autostart (/init → /etc/init.d/aurora-modem,
+no OpenRC), aurora-modem controller (rmtfs → MSS → QMI → SIM → online → registration state machine ≤600 s → ModemManager → bearer; disconnect/reconnect without MSS restart;
+clean stop, rmtfs last). Validation: 3/3 RAM candidate boots, 3/3 cold boots from flash (pc4–pc6), LTE registration, bearer, DNS/ICMP/HTTP, clean shutdown.
+Safety: eMMC writes 0; NV partitions unchanged.
+Known issues: early boot hangs before Linux (SBL1 DDR-init / after SBL1 End / lk target_init); possible battery/contact instability (UVLO reset during modem stop, pc2);
+fast MSS restart re-attach needs investigation; single unreproduced cases (pc1 no RX, 22:00 stall after online SET); marginal Beeline RF at the install location.

README.md

@@ -9,7 +9,7 @@
 > (см. [docs/QUICKSTART.md](docs/QUICKSTART.md)). Никогда не прошивайте NV/EFS-разделы (`modemst1`, `modemst2`, `fsg`, `fsc`, `persist`)
 > с другого устройства — там калибровки RF и идентификаторы конкретного модема.
 
-## Статус (2026-09-30)
+## Статус (2026-10-01)
 
 | Подсистема | Статус |
 |---|---|
@@ -22,7 +22,8 @@
 | LTE registration | PASS |
 | LTE Internet (DNS/ICMP/HTTP/HTTPS) | PASS |
 | Direct boot с eMMC без хоста (B5) | **PASS / CLOSED** |
-| B6 — автоматический lifecycle модема | **IN PROGRESS** (см. ниже) |
+| B6 — lifecycle модема (RAM) | **PASS / CLOSED** |
+| B6P — автозапуск модема из flash (persistent) | **PASS** (см. ниже) |
 | Wi-Fi (WCNSS) | TODO |
 | Router stack (NAT/firewall/VPN) | TODO |
 | Дисплей в Linux | TODO |
@@ -32,7 +33,7 @@
 
 ```
 Power → stock SBL1 → DB410c TZ (TZ.BF.3.0) → qhypstub → lk1st (aboot, autoboot)
-      → cache: ext2 + extlinux/extlinux.conf → golden mm1 (Image.gz + DTB + initramfs) → ARM64 Linux
+      → cache: ext2 + extlinux/extlinux.conf → B6P (golden mm1 kernel/DTB + initramfs с автозапуском модема) → ARM64 Linux → LTE
 Fallback: extlinux не найден / не парсится / не грузится → Android boot image из раздела boot (emmc1 rescue)
 ```
 
@@ -46,20 +47,44 @@ Fallback: extlinux не найден / не парсится / не грузит
 | hyp | qhypstub, до 512 KiB | `1a963047` |
 | aboot | lk1st (lk2nd 23.1) autoboot, подписан qtestsign, до 1 MiB | `3b8cd266` |
 | boot | emmc1 rescue image (+ нули до 16 MiB) | `e9579f33` |
-| cache | ext2 + extlinux + точный golden mm1 | `409bbb11` |
+| cache | ext2 + extlinux + B6P (golden kernel/DTB/cmdline + B6P initramfs) | `9fea693a` (откат: B5b-образ `409bbb11`) |
 | recovery | lk2nd 23.1 (fastboot) | `0dfa60a0` |
 | modem, NV/EFS, persist, system, userdata | не менялись (Linux монтирует modem FAT только RO) | — |
 
 Golden mm1 (Android boot image, для `fastboot boot`): `aurora-mm1.img` sha256 `38c960ef…`, ядро `7.2.7-aurora-bam1 #5`.
 Все хэши целиком: `b5a/SHA256SUMS`, `b5b/SHA256SUMS`, `bootchain-migration/SHA256SUMS`, `linux/*/SHA256SUMS`, [docs/BLOBS.md](docs/BLOBS.md).
 
-## B6 — lifecycle модема (IN PROGRESS)
+## B6P status — PASS
 
-RAM-only контроллер `b6/aurora-modem start|stop|status` (rmtfs `-r -P -s` → MPSS → QMI → SIM → online → регистрация →
-ModemManager → bearer → только /32-маршруты; стоп: disconnect → detach → wwan down → MM stop → BAM-DMUX idle → MPSS stop → rmtfs последним).
-Полные циклы start→data→stop проходят чисто (0 ошибок BAM-DMUX/remoteproc, 0 записей eMMC, NV не меняются), **но** повторная
-регистрация в сети после перезапуска MPSS в одном boot чередуется PASS/FAIL (`limited` / `registration-denied`).
-Гипотеза (не доказана): с `rmtfs -r` модем при каждом старте теряет EFS-контекст NAS. Подробности — NOTES.md, сессия 28.
+Implemented:
+- extlinux boot from `cache` (ext2, lk2nd 23.1 extlinux path; fallback — emmc1 из `boot`)
+- custom initramfs overlay поверх точных байтов golden mm1 (заменён только `/init`, добавлены контроллер, сервис, конфиг)
+- modem autostart: `/init` → `/etc/init.d/aurora-modem start` (без OpenRC), конфиг `/etc/aurora/modem.conf`
+- контроллер `aurora-modem start|disconnect|stop|status`: rmtfs `-r -P -s` → MSS → QMI → SIM → online →
+  state machine регистрации (registered + PS attached, до 600 s) → udev/dbus/polkit/ModemManager → bearer → /32-маршруты;
+  reconnect без перезапуска MSS; stop: bearer → routes → wwan down → MM → BAM-DMUX idle → MSS offline → rmtfs последним
+
+Validation:
+- RAM (`fastboot boot` через RESET при включении): 3/3 загрузки, автозапуск, 3/3 reconnect без перезапуска MSS
+- 3/3 cold boots from flash (закреплённый АКБ): LTE registration 3.6–6.9 s, bearer established,
+  data connectivity verified (DNS/ICMP/HTTP; HTTPS не требуется — часы 1970 до B7), clean shutdown verified
+- Работает с часами 1970 (RTC/NTP не трогались)
+
+Safety:
+- eMMC writes: 0 (все блочные устройства getro=1, rmtfs `-r` держит EFS в RAM)
+- NV partitions unchanged (modemst1/2, fsg, fsc, persist — sha256 до/после каждой загрузки)
+- единственная запись во flash на этом этапе — `cache` с readback-сверкой; остальные разделы сверены с эталонами
+
+Материалы: `b6p/` (дизайн, preflight, сборка, скрипты записи/отката, тестовые скрипты), `b6j/` (диагностика B6J–B6N), NOTES.md сессии 29–31.
+
+## Known issues
+
+- Early boot hangs before Linux startup (внутри SBL1 DDR-init, после `SBL1, End`, в lk1st `target_init`) — до чтения `cache`, не связано с B6P
+- Possible battery/contact instability: один сброс во время остановки модема, PMIC POFF reason = UVLO (under-voltage);
+  с закреплённым АКБ не повторялся
+- Fast MSS restart may require investigation: повторная регистрация сразу после stop/start MSS в одном boot может не пройти
+- Единичные случаи (не воспроизведены): bearer поднят, но нет входящего трафика; зависание контроллера после online SET
+- Сигнал Beeline в месте установки маргинальный (RSRQ −13…−20 dB); регистрация иногда идёт через limited / соседние соты
 
 ## Структура репозитория
 
@@ -74,7 +99,9 @@ ModemManager → bearer → только /32-маршруты; стоп: disconn
 | `lk2nd-build/`, `b5a/` | запись сборки lk2nd/lk1st, config.h diff, скрипты записи/отката B5a |
 | `b5b/` | генератор ext2/extlinux-образа cache, эмулятор сканирования lk2nd (исходники + результаты) |
 | `bootchain-migration/` | preflight, write plan, редактор/валидатор GPT |
-| `b6/` | контроллер lifecycle модема (RAM-only прототип) и харнесс тестов |
+| `b6/` | первый RAM-only прототип контроллера (сессия 28) |
+| `b6j/` | диагностика B6J–B6N: rmtfs-аудит, AT/QMI-снимки, state machine регистрации, харнессы |
+| `b6p/` | persistent-интеграция: контроллер, сервис, конфиг, сборка initramfs/boot.img/cache, эмулятор, запись/откат, тесты |
 | `tools/` | утилиты: UART-логгер, Sahara probe, распаковка boot.img, sanitizer публикации |
 | `logs/` | sanitized логи: UART, QMI, ModemManager, EDL, результаты тестов |
 | `android/` | снимок стокового Android (getprop, gpio, input, leds, …), sanitized |

b6j/J2-rmtfs-audit.md

@@ -0,0 +1,41 @@
+# B6J2 — rmtfs v1.3 source audit: RAM shadow lifetime with `rmtfs -r -P -v` (no -s)
+
+Source: `linux/initramfs-modem1/dl/rmtfs-src` = git tag v1.3 (b30a3eb). Board binary: Alpine `rmtfs 1.3-r0` (aports commit 1628fd4c),
+sha256 1bf6b195… (same in initramfs-mm1); v1.3-specific strings present ("write to %zd bytes exceededs max size", "[RMTFS] bye from %d").
+
+## Data structures (storage.c)
+- `static struct rmtfd rmtfds[MAX_CALLERS=10]` — process-global static array; each slot: `id`, `node`, `fd`, `partition`, `shadow_buf`, `shadow_len`.
+- `storage_read_only` (= -r) is a process-global flag set once in `storage_init()`.
+- `storage_init()` is called exactly once in `main()` (rmtfs.c:575) and only initialises slots to fd=-1 / shadow_buf=NULL.
+
+## open/read path
+- QMI OPEN (rmtfs.c:55 `rmtfs_open`) → `storage_open(pkt->node, path)` (storage.c:112).
+- storage.c:131-137: **if a slot with `(fd != -1 || shadow_buf) && node == node && partition == part` exists, that slot is returned as-is**
+  — no `open()`, no `read()` of the partition.
+- Only for a free slot: `fd_open()` → with -r `storage_populate_shadow_buf()` (storage.c:280): open(O_RDONLY) the by-partlabel device,
+  `calloc(len)`, one `read()` of the whole partition into `shadow_buf`, close the fd. This is the only place the backing partition is read.
+
+## request handling
+- RW_IOVEC read → `storage_pread()`: with -r, memcpy from `shadow_buf` (storage.c:228-231).
+- RW_IOVEC write → `storage_pwrite()`: with -r, memcpy into `shadow_buf` (realloc if it grows), never touches the fd (storage.c:247-267);
+  `storage_sync()` is a no-op with -r (storage.c:274).
+- QMI CLOSE → `storage_close()` → `free(shadow_buf)` (storage.c:176-188). This and `storage_exit()` (process exit) are the ONLY frees.
+
+## reconnect behaviour (MSS stop/start while rmtfs lives)
+- QRTR BYE (`rmtfs_bye`) and DEL_CLIENT (`rmtfs_del_client`) handlers only dbgprintf and return 0 (rmtfs.c:346-358): nothing is closed or freed.
+- ENETRESET on the QRTR socket: `main()` loops `do { run_rmtfs() } while (ret == -ENETRESET)` (rmtfs.c:581-583); `run_rmtfs` only
+  re-opens/re-publishes the socket; `storage_init/exit` are outside the loop → shadows survive.
+- Without -s: `rprocfd = -1` → rmtfs never writes remoteproc state; SIGTERM → loop `break` → `storage_exit()` → process exits (rmtfs.c:453-455).
+- The modem on this board never sends QMI CLOSE: session-28 rmtfs.log (11 MSS boots) has 0 "close" lines; each MSS stop shows only
+  `del_client` + `bye from 0`. The next MSS boot re-opens the same 4 paths from the same node 0 and gets the same caller ids 0..3.
+
+## Answer
+With a single long-lived `rmtfs -r -P -v` process, a modem_fs1/fs2/fsg/fsc write received from MSS stays in that slot's `shadow_buf`
+for the lifetime of the process, and a later MSS boot (same node, no CLOSE) is served from that modified RAM copy — **the backing
+partitions are NOT re-read on MSS reconnect**. They are re-read only by a new rmtfs process (or after an explicit QMI CLOSE, which this
+modem does not send). The old B6 flow started a new rmtfs per cycle, so every MSS boot saw the on-disk EFS image.
+→ **GO for B6J3.**
+
+Caveats: (1) a hypothetical CLOSE from the modem would free the shadow (debug printf in `rmtfs_close` also passes an int for %s —
+would be UB with -v); not observed. (2) The shadow is only the EFS part of the modem's persistent state; USIM files (EF_EPSLOCI etc.)
+persist across MSS restarts in both flows.

b6j/SHA256SUMS

@@ -0,0 +1,15 @@
+aa9e9aa247443eaaa358548e7f763ccf64d7c73d558a468515b7352352e349c3  aurora-modem
+7e3521b0e6e71d4b5527845298f04d9d812ccf3bc4070b5ec6e93cb5e08bdaf6  aurora-modem.conf
+3a31c16cdcdd86b52f0097b8eefd16de9b44f83b307ed60d16f743e3f5c0f436  aurora-modem-datatest
+8fe1b79ca68500f5cdb3b5b54130e45a34a1de14db3e2609fab91d10605d8536  j1.conf
+2e58ee9787c688017e669699038515b9c8dba0b5596bbe8dcbe7fe742276455a  j3.conf
+0e0d8676bfdd57fe7c24c99bc1bf217d26791a87dcfbede7bbca70df2bcce273  k.conf
+a5337c75a0b2f9efc4c1764f9c4205ca0a176599146ea6ea280e7deeac9f8b70  l.conf
+883dd03b5b81d0e72162ba6d9bae84a2c02c8e998df237f192c371f650092f04  m.conf
+aa9e27af49d7edc68f94bfbd26b017d273ba85337f28373cded9b461abbb1ddf  n.conf
+6b2e46d0bd684791740cec52c0e53be3586daa8a5aa964eb03feb94b9a804616  j-snap.sh
+f1fa63cd9dbe39d9352575c0721688ae66c0e644294af0a580e8ce3d60ef8567  j-run.sh
+76c28c0a04646866ffe83bc12cef417b521c3e14d47498e469ac420ab31a5f7e  n-run.sh
+54a22224941fe45e69e358fa293b97063e6ba313de4dabd54c5f7aef5c5c78b5  k-at.sh
+96e4327665e7f1f1132f267911882b3bb3f91526d2f4578d12079cb11a5ca1db  l-obs.sh
+2ddb249630f7420cd1325bba704d015978710ed466fe3305138c54813cfb43a5  ro-check.sh

b6j/aurora-modem

@@ -0,0 +1,395 @@
+#!/bin/sh
+# B6 RAM-only modem lifecycle controller for Aurora (golden mm1). Lives in /tmp only.
+#   aurora-modem start | stop | status | addroute <ipv4>
+# Reconstructs the proven flow (NOTES sessions 14-22 Aurora, JZ02 stopcycle/wwanfix/openrc):
+#   start: RO gates -> rmtfs -r -P -s -v (rmtfs -s starts MSS) -> MSS running -> wwan0qmi0+wwan0 (+2 s, JZ02 port-race guard)
+#          -> qmicli -p DMS online (one SET, only if not online) -> NAS registered + PS attached -> kill qmi-proxy
+#          -> udevd/dbus/polkitd/ModemManager -> MM modem registered -> ONE simple-connect -> bearer IPv4 on wwanN
+#          + /32 host routes only (no default route, usb0 untouched).
+#   stop:  simple-disconnect -> MM disable (radio low-power = detach) -> del our /32 routes, flush+down all wwan* -> stop MM (+qmi-proxy) -> BAM-DMUX suspended
+#          -> SIGTERM rmtfs: rmtfs writes "stop" to remoteproc state (MSS stops while rmtfs still serves) -> rmtfs exits LAST.
+# Never writes eMMC/NV: rmtfs -r keeps EFS writes in RAM; the script refuses to run unless the NV partitions are getro=1.
+# B6J diagnostic knobs (all RAM-only, set in $CONF):
+#   MODEM_STOP_DISABLE=0   stop skips mmcli --disable / qmicli low-power (J1/J3: back to the minimal proven stop)
+#   MODEM_RMTFS_PERSIST=1  long-lived rmtfs: 'rmtfs -r -P -v' (no -s) started once, MSS via remoteproc sysfs start/stop,
+#                          stop leaves rmtfs alive; 'aurora-modem rmtfs-stop' ends it (only with MSS offline)
+#   MODEM_HOOK_PRE_ONLINE / MODEM_HOOK_PRE_MM  shell commands run right before DMS online SET / before udevd+MM start (B6K AT capture)
+#   MODEM_REG_SM=1         registration state machine (B6M): wait up to T_REG for registered+PS attached; searching/limited/detached and
+#                          transient registration-denied are NOT failures; immediate FAIL only on local errors (MSS/QMI dev/SIM/rmtfs/BAM/SSR/USB);
+#                          transitions (state or cell change) logged to $D/reg-trans.tsv
+#   MODEM_REG_SNAP=1       save read-only NAS system-info/cell-location/rf-band right after registration
+# Exit: 0 ok, 1 failure/timeout (start rolls back with a full stop unless MODEM_KEEP_ON_FAIL=1), 2 usage/config error.
+
+CONF=${MODEM_CONF:-/tmp/aurora-modem.conf}
+D=/tmp/aurora-modem.d; mkdir -p $D
+LOG=$D/lifecycle.log; STATE=$D/state; ROUTES=$D/routes; BEARER=$D/bearer
+RPNAME=4080000.remoteproc
+BAM=/sys/bus/platform/devices/4080000.remoteproc:bam-dmux
+Q="qmicli -p -d /dev/wwan0qmi0"
+
+# --- timeouts (s); override in $CONF
+T_RMTFS=5 T_MSS=60 T_QMI_DEV=30 T_QMI=45 T_SIM=60 T_ONLINE=30 T_REG=180 T_MM_DETECT=150 T_MM_REG=60 T_CONNECT=150
+MODEM_REATTACH_HOLDOFF=120	# s between radio stop and next MSS start (B6: re-attach <=61 s after stop was rejected 3/3 by Beeline)
+MODEM_STOP_DISABLE=1 MODEM_RMTFS_PERSIST=0 MODEM_REG_SNAP=0 MODEM_HOOK_PRE_ONLINE= MODEM_HOOK_PRE_MM= MODEM_REG_SM=0
+T_DISCONNECT=60 T_DISABLE=30 T_MM_EXIT=30 T_BAM_IDLE=15 T_MSS_STOP=30 T_RMTFS_EXIT=15
+MODEM_APN= MODEM_USER= MODEM_PASSWORD= MODEM_AUTH= MODEM_IP_TYPE=ipv4 MODEM_TEST_ROUTES= KEEP=${MODEM_KEEP_ON_FAIL:-0}
+[ -f "$CONF" ] && . "$CONF"
+MODEM_KEEP_ON_FAIL=${MODEM_KEEP_ON_FAIL:-$KEEP}
+
+mmc() { mmcli "$@" 2>/dev/null | tr -d '\033' | sed 's/\[[0-9;]*m//g'; }	# mmcli colours values even without a tty
+now() { cut -d' ' -f1 /proc/uptime; }
+log() { m="[$(now)] $*"; echo "$m" >> $LOG; echo "$m"; echo "<5>[aurora-modem] $*" > /dev/kmsg 2>/dev/null; }
+setstate() { o=$(cat $STATE 2>/dev/null); echo "$1" > $STATE; log "STATE ${o:-OFF} -> $1"; }
+die() { log "FAIL: $*"; exit 1; }
+# wait_for TIMEOUT INTERVAL cmd... : poll a real condition, no blind sleeps
+wait_for() { _to=$1; _iv=$2; shift 2; _t0=$(now)
+	while :; do "$@" && return 0
+		[ "$(awk -v a="$(now)" -v b="$_t0" -v t="$_to" 'BEGIN{print (a-b>=t)}')" = 1 ] && return 1
+		sleep $_iv; done; }
+since() { awk -v a="$(now)" -v b="$1" 'BEGIN{printf "%.1f", a-b}'; }
+
+rp() { for r in /sys/class/remoteproc/remoteproc*; do [ "$(cat $r/name 2>/dev/null)" = $RPNAME ] && echo $r && return; done; }
+mss_state() { r=$(rp); [ -n "$r" ] && cat $r/state || echo none; }
+mss_is() { [ "$(mss_state)" = "$1" ]; }
+rmtfs_pid() { pidof rmtfs; }
+mm_pid() { pidof ModemManager; }
+bam_pm() { cat $BAM/power/runtime_status 2>/dev/null || echo none; }
+bam_suspended() { [ "$(bam_pm)" = suspended ]; }
+qmi_dev() { [ -e /dev/wwan0qmi0 ] && [ -e /sys/class/net/wwan0 ]; }
+link_up() { [ $(( $(cat /sys/class/net/$1/flags) & 1 )) -ne 0 ]; }
+mm_idx() { mmc -L | grep -oE "Modem/[0-9]+" | head -1 | cut -d/ -f2; }
+mm_has_modem() { [ -n "$(mm_idx)" ]; }
+mm_state() { mmc -m "$(mm_idx)" | awk -F': ' '/\| +state: /{gsub(/ /,"",$2); print $2; exit}'; }
+# MM initialized: proven session 22 pass 1 connected from 'disabled' (Simple.Connect enables the modem itself)
+mm_usable() { case "$(mm_state)" in disabled|enabling|enabled|searching|registered|connected|connecting) return 0;; esac; return 1; }
+qmi_ok() { timeout 20 $Q --dms-get-operating-mode > $D/qmi-mode.txt 2>&1 && grep -q "Mode:" $D/qmi-mode.txt; }
+qmi_reg() { timeout 20 $Q --nas-get-serving-system > $D/qmi-ss.txt 2>&1
+	grep -q "Registration state: 'registered'" $D/qmi-ss.txt && grep -q "PS: 'attached'" $D/qmi-ss.txt; }
+sim_ready() { timeout 20 $Q --uim-get-card-status > $D/qmi-uim.txt 2>&1
+	grep -q "Card state: 'present'" $D/qmi-uim.txt && grep -q "Application state: 'ready'" $D/qmi-uim.txt; }
+set_online() { timeout 20 $Q --dms-set-operating-mode=online > $D/qmi-set.txt 2>&1; r=$?; cat $D/qmi-set.txt >> $LOG
+	[ $r = 0 ] && return 0; grep -q "DeviceNotReady" $D/qmi-set.txt || { echo hard > $D/qmi-set.err; return 0; }; return 1; }
+# this mmcli has no --list-bearers ("no actions specified"); use 'Bearer | paths:' of mmcli -m, not the initial (attach) bearer
+bearers() { mmc -m "$(mm_idx)" | grep -v "initial bearer" | grep -oE "Bearer/[0-9]+" | cut -d/ -f2; }
+any_bearer_connected() { for b in $(bearers); do mmc -b $b | grep -q "connected: yes" && return 0; done; return 1; }
+qv() { grep -m1 -oE "$1: *'[^']*'" $2 2>/dev/null | sed -E "s/.*'([^']*)'/\1/"; }
+# B6M registration state machine. rc 0 = registered+PS attached, 1 = REGISTRATION_TIMEOUT, 2 = local failure (reason in $D/reg-fail)
+reg_sm() {
+	T=$D/reg-trans.tsv; t0=$1; last=; n=0; nd=0; rm -f $D/reg-fail; D0=$(dmesg | wc -l)
+	printf 'uptime	t_online	reg	ps	status	true_status	domain	plmn	earfcn	pci	si_tac	si_eci	cl_tac	cl_eci	rsrp	rsrq	snr
+' > $T
+	lf() { echo "$*" > $D/reg-fail; return 2; }
+	while :; do n=$((n+1))
+		mss_is running || { lf "MSS state $(mss_state)"; return 2; }
+		[ -e /dev/wwan0qmi0 ] || { lf "wwan0qmi0 disappeared"; return 2; }
+		[ -n "$(rmtfs_pid)" ] || { lf "rmtfs died"; return 2; }
+		[ "$(bam_pm)" = error ] && { lf "BAM-DMUX runtime_status=error"; return 2; }
+		dmesg | tail -n +$((D0+1)) | grep -qE 'crash detected|fatal error|[Ww]atchdog|wdog|Oops|BUG:|Failed to resume' && { lf "dmesg: $(dmesg | tail -n +$((D0+1)) | grep -m1 -E 'crash detected|fatal error|[Ww]atchdog|wdog|Oops|BUG:|Failed to resume')"; return 2; }
+		if [ $((n % 5)) = 1 ]; then
+			sim_ready || { lf "SIM not ready: $(grep -E 'Card state|Application state' $D/qmi-uim.txt | head -2 | tr -s ' \t\n' ' ')"; return 2; }
+			ping -c1 -W2 172.16.42.2 >/dev/null 2>&1 || { sleep 1; ping -c1 -W2 172.16.42.2 >/dev/null 2>&1 || { lf "USB management (usb0 ping) lost"; return 2; }; }
+		fi
+		timeout 20 $Q --nas-get-serving-system > $D/qmi-ss.txt 2>&1
+		timeout 20 $Q --nas-get-system-info > $D/qmi-si-all.txt 2>&1; sed -n '/LTE service:/,/SIM reject/p' $D/qmi-si-all.txt > $D/qmi-si.txt
+		RG=$(qv 'Registration state' $D/qmi-ss.txt); PS=$(qv PS $D/qmi-ss.txt); ST=$(qv Status $D/qmi-si.txt); TS=$(qv 'True Status' $D/qmi-si.txt)
+		DM=$(qv Domain $D/qmi-si.txt); PL=$(qv MCC $D/qmi-si.txt)-$(qv MNC $D/qmi-si.txt); SIT=$(qv 'Tracking Area Code' $D/qmi-si.txt); SIE=$(qv 'Cell ID' $D/qmi-si.txt)
+		key="$RG|$PS|$ST|$TS|$DM|$PL|$SIT|$SIE"
+		if [ "$key" != "$last" ]; then
+			timeout 20 $Q --nas-get-cell-location-info > $D/qmi-cl.txt 2>&1; timeout 20 $Q --nas-get-signal-info > $D/qmi-sig.txt 2>&1
+			[ "$RG" = registration-denied ] && [ "${last%%|*}" != registration-denied ] && nd=$((nd+1))
+			printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' $(now) $(since $t0) "$RG" "$PS" "$ST" "$TS" "$DM" "$PL" \
+				"$(qv 'EUTRA Absolute RF Channel Number' $D/qmi-cl.txt)" "$(qv 'Serving Cell ID' $D/qmi-cl.txt)" "$SIT" "$SIE" \
+				"$(qv 'Tracking Area Code' $D/qmi-cl.txt)" "$(qv 'Global Cell ID' $D/qmi-cl.txt)" "$(qv RSRP $D/qmi-sig.txt)" "$(qv RSRQ $D/qmi-sig.txt)" "$(qv SNR $D/qmi-sig.txt)" >> $T
+			log "REG t+$(since $t0)s: $RG / PS $PS / $ST ($TS, $DM) $PL pci=$(qv 'Serving Cell ID' $D/qmi-cl.txt) si=$SIT/$SIE cl=$(qv 'Tracking Area Code' $D/qmi-cl.txt)/$(qv 'Global Cell ID' $D/qmi-cl.txt)"
+			last=$key
+		fi
+		echo $nd > $D/reg-denied-count
+		[ "$RG" = registered ] && [ "$PS" = attached ] && return 0
+		[ "$(awk -v a="$(now)" -v b="$t0" -v t="$T_REG" 'BEGIN{print (a-b>=t)}')" = 1 ] && { lf "REGISTRATION_TIMEOUT after ${T_REG}s ($RG, PS $PS)"; return 1; }
+		sleep 3
+	done
+}
+bearer_field() { awk -F': ' -v k="$1" '$1 ~ " "k"$" {gsub(/ /,"",$2); print $2; exit}' $BEARER.txt; }
+
+check_safety() {
+	for p in modemst1 modemst2 fsc fsg persist; do
+		d=/dev/disk/by-partlabel/$p; [ -e $d ] || return 1
+		[ "$(blockdev --getro $(readlink -f $d))" = 1 ] || { log "SAFETY: $p not RO"; return 1; }
+	done
+	[ "$(blockdev --getro /dev/mmcblk0)" = 1 ] || { log "SAFETY: mmcblk0 not RO"; return 1; }
+	grep -q " /firmware .* ro," /proc/mounts || { log "SAFETY: /firmware not mounted ro"; return 1; }
+	[ "$(cat /sys/module/firmware_class/parameters/path)" = /firmware/image ] || { log "SAFETY: firmware path"; return 1; }
+	return 0
+}
+connect_args() {
+	for v in "$MODEM_APN" "$MODEM_USER" "$MODEM_PASSWORD" "$MODEM_AUTH" "$MODEM_IP_TYPE"; do
+		case "$v" in *[,\"\'=]*) echo "BAD"; return;; esac; done
+	a="apn=$MODEM_APN"
+	[ -n "$MODEM_USER" ] && a="$a,user=$MODEM_USER"
+	[ -n "$MODEM_PASSWORD" ] && a="$a,password=$MODEM_PASSWORD"
+	[ -n "$MODEM_AUTH" ] && a="$a,allowed-auth=$MODEM_AUTH"
+	echo "$a,ip-type=$MODEM_IP_TYPE"
+}
+addroute() { # /32 via the bearer interface, recorded so stop removes exactly what we added
+	ip=$1; . $D/ipcfg 2>/dev/null || { echo "no bearer ipcfg"; return 1; }
+	grep -qx "$ip" $ROUTES 2>/dev/null && return 0
+	ip route add $ip/32 dev $IF src $A && echo $ip >> $ROUTES
+}
+diag() { # snapshot before rollback
+	{ echo "### diag $(now) state=$(cat $STATE 2>/dev/null) mss=$(mss_state) rmtfs=$(rmtfs_pid) mm=$(mm_pid) bam=$(bam_pm)"
+	  [ -n "$(mm_pid)" ] && { mmc -L; mmc -m "$(mm_idx)"; }
+	  cat $D/qmi-mode.txt $D/qmi-ss.txt 2>/dev/null; dmesg | tail -40; } > $D/diag-$(now).txt 2>&1
+}
+fail_start() { log "FAIL in $(cat $STATE 2>/dev/null): $*"; diag
+	if [ "$MODEM_KEEP_ON_FAIL" = 1 ]; then log "MODEM_KEEP_ON_FAIL=1: leaving stack as is"
+	else log "rollback: full stop"; do_stop; fi
+	exit 1; }
+
+do_start() {
+	T0=$(now); log "=== START (conf $CONF, apn '${MODEM_APN}', ip-type $MODEM_IP_TYPE)"
+	[ -n "$MODEM_APN" ] || { log "config: MODEM_APN empty - refusing (no APN guessing)"; exit 2; }
+	CA=$(connect_args); [ "$CA" = BAD ] && { log "config: forbidden character in APN/user/password/auth"; exit 2; }
+	check_safety || { log "FAIL: safety gate (RO) - nothing started"; exit 1; }
+	[ -n "$(rp)" ] || { log "FAIL: remoteproc $RPNAME not found"; exit 1; }
+
+	# OFF -> RMTFS_READY -> MPSS_BOOTING -> MPSS_RUNNING
+	if [ -n "$(rmtfs_pid)" ] && mss_is running; then log "rmtfs $(rmtfs_pid) + MSS running already - reuse"
+	elif [ "$MODEM_RMTFS_PERSIST" = 1 ] && mss_is offline; then
+		: > $ROUTES; rm -f $D/ipcfg
+		if [ -z "$(rmtfs_pid)" ]; then
+			n0=$(grep -c 'registering services' $D/rmtfs.log 2>/dev/null)
+			LD_PRELOAD=/usr/lib/linebuf.so rmtfs -r -P -v >> $D/rmtfs.log 2>&1 &
+			echo $! > $D/rmtfs.pid
+			wait_for $T_RMTFS 0.2 sh -c "kill -0 $(cat $D/rmtfs.pid) 2>/dev/null && [ \$(grep -c 'registering services' $D/rmtfs.log) -gt ${n0:-0} ]" \
+				|| fail_start "rmtfs did not start (pid $(cat $D/rmtfs.pid))"
+			log "long-lived rmtfs started: pid $(rmtfs_pid) (rmtfs -r -P -v, no -s)"
+		else log "long-lived rmtfs reused: pid $(rmtfs_pid)"; fi
+		setstate RMTFS_READY
+		setstate MPSS_BOOTING
+		t=$(now); (echo start > $(rp)/state) >> $LOG 2>&1 &
+		wait_for $T_MSS 0.2 mss_is running || fail_start "MSS not running after ${T_MSS}s (state $(mss_state))"
+		log "MSS running after $(since $t)s (sysfs start)"
+	elif [ -n "$(rmtfs_pid)" ] || ! mss_is offline; then
+		log "FAIL: inconsistent (rmtfs='$(rmtfs_pid)' MSS=$(mss_state)); run stop first"; exit 1
+	else
+		if [ -f $D/last-radio-stop ]; then
+			w=$(awk -v a="$(now)" -v b="$(cat $D/last-radio-stop)" -v h="$MODEM_REATTACH_HOLDOFF" 'BEGIN{d=h-(a-b); printf "%d", (d>0)?d+1:0}')
+			[ "$w" -gt 0 ] && { log "re-attach holdoff: last radio stop $(since $(cat $D/last-radio-stop))s ago, waiting ${w}s (MODEM_REATTACH_HOLDOFF=$MODEM_REATTACH_HOLDOFF)"; sleep $w; }
+		fi
+		: > $ROUTES; rm -f $D/ipcfg
+		LD_PRELOAD=/usr/lib/linebuf.so rmtfs -r -P -s -v >> $D/rmtfs.log 2>&1 &
+		echo $! > $D/rmtfs.pid
+		wait_for $T_RMTFS 0.2 sh -c "kill -0 $(cat $D/rmtfs.pid) 2>/dev/null && grep -q 'registering services' $D/rmtfs.log" \
+			|| fail_start "rmtfs did not start (pid $(cat $D/rmtfs.pid))"
+		setstate RMTFS_READY
+		setstate MPSS_BOOTING
+		t=$(now); wait_for $T_MSS 0.2 mss_is running || fail_start "MSS not running after ${T_MSS}s (state $(mss_state))"
+		log "MSS running after $(since $t)s"
+	fi
+	setstate MPSS_RUNNING
+
+	# -> QMI_READY
+	t=$(now); wait_for $T_QMI_DEV 0.2 qmi_dev || fail_start "wwan0qmi0/wwan0 missing after ${T_QMI_DEV}s"
+	log "wwan0qmi0 + wwan0 present after $(since $t)s; +2 s (JZ02 rpmsg_wwan_ctrl port-race guard, proven start_post)"
+	sleep 2
+	[ "$(bam_pm)" = error ] && fail_start "BAM-DMUX runtime_status=error"
+
+	# -> RADIO_ONLINE -> REGISTERED  (Aurora-proven: qmicli online + NAS poll before ModemManager)
+	if [ -n "$(mm_pid)" ]; then
+		log "ModemManager already running - skip qmicli, use MM state"
+		setstate QMI_READY
+	else
+		t=$(now); wait_for $T_QMI 1 qmi_ok || fail_start "QMI DMS not answering after ${T_QMI}s"
+		setstate QMI_READY; log "DMS $(grep -o "Mode: '[^']*'" $D/qmi-mode.txt) after $(since $t)s"
+		t=$(now); wait_for $T_SIM 1 sim_ready || fail_start "SIM/USIM not ready after ${T_SIM}s ($(grep -E "Card state|Application state" $D/qmi-uim.txt | head -2 | tr -s ' \t\n' ' '))"
+		setstate SIM_READY; log "UIM card present, USIM app ready after $(since $t)s"
+		[ -n "$MODEM_HOOK_PRE_ONLINE" ] && { sh -c "$MODEM_HOOK_PRE_ONLINE" >> $LOG 2>&1; log "pre-online hook rc=$?"; }
+		if ! grep -q "Mode: 'online'" $D/qmi-mode.txt; then
+			log "SET: $Q --dms-set-operating-mode=online (retried only on DeviceNotReady, <= ${T_ONLINE}s)"
+			rm -f $D/qmi-set.err; t=$(now); wait_for $T_ONLINE 1 set_online || fail_start "SET online: DeviceNotReady for ${T_ONLINE}s"
+			[ -f $D/qmi-set.err ] && fail_start "SET online failed: $(grep -i error $D/qmi-set.txt | head -1)"
+			qmi_ok && grep -q "Mode: 'online'" $D/qmi-mode.txt || fail_start "mode not online after SET"
+			log "DMS online after $(since $t)s"
+		fi
+		setstate RADIO_ONLINE
+		if [ "$MODEM_REG_SM" = 1 ]; then
+			t=$(now); reg_sm $t; rr=$?
+			[ $rr = 2 ] && fail_start "LOCAL FAILURE during registration: $(cat $D/reg-fail)"
+			[ $rr = 1 ] && fail_start "$(cat $D/reg-fail)"
+		else
+		t=$(now); wait_for $T_REG 2 qmi_reg || fail_start "not registered+PS attached after ${T_REG}s ($(grep -E "Registration state" $D/qmi-ss.txt | tr -s ' \t'))"
+		fi
+		log "registered: $(grep -oE "(MCC|MNC|Description): '[^']*'" $D/qmi-ss.txt | tr '\n' ' ')after $(since $t)s"
+		setstate REGISTERED
+		[ "$MODEM_REG_SNAP" = 1 ] && for a in nas-get-system-info nas-get-cell-location-info nas-get-rf-band-info nas-get-signal-info; do
+			timeout 20 $Q --$a > $D/reg-$a.txt 2>&1; done
+		killall qmi-proxy 2>/dev/null; wait_for 5 0.2 sh -c '! pidof qmi-proxy >/dev/null'
+	fi
+
+	[ -n "$MODEM_HOOK_PRE_MM" ] && { sh -c "$MODEM_HOOK_PRE_MM" >> $LOG 2>&1; log "pre-MM hook rc=$?"; }
+	# -> MM_READY  (mm-up order: udevd, trigger, settle, dbus, polkitd, ModemManager)
+	pidof udevd >/dev/null || { udevd --daemon; udevadm trigger --action=add; udevadm settle --timeout=15; log "udevd started"; }
+	if ! pidof dbus-daemon >/dev/null; then
+		mkdir -p /run/dbus /var/lib/dbus /var/lib/polkit; rm -f /run/dbus/pid; dbus-uuidgen --ensure
+		dbus-daemon --system --fork || fail_start "dbus-daemon"; log "dbus started"; fi
+	pidof polkitd >/dev/null || { /usr/lib/polkit-1/polkitd --no-debug >> $D/polkitd.log 2>&1 & log "polkitd started"; }
+	if [ -z "$(mm_pid)" ]; then
+		N=$(ls $D/mm-*.log 2>/dev/null | wc -l)
+		ModemManager --debug > $D/mm-$N.log 2>&1 &
+		echo $! > $D/mm.pid; log "ModemManager started pid $! (log mm-$N.log)"
+	fi
+	t=$(now); wait_for $T_MM_DETECT 2 mm_has_modem || fail_start "MM: no modem after ${T_MM_DETECT}s"
+	log "MM modem $(mm_idx) detected after $(since $t)s"
+	mmc -m "$(mm_idx)" > $D/mm-modem.txt
+	grep -q "plugin: qcom-soc" $D/mm-modem.txt || fail_start "MM plugin is not qcom-soc"
+	grep -q "primary port: wwan0qmi0" $D/mm-modem.txt || fail_start "MM primary port is not wwan0qmi0"
+	setstate MM_READY
+	t=$(now); wait_for $T_MM_REG 2 mm_usable || fail_start "MM state '$(mm_state)' not usable after ${T_MM_REG}s"
+	log "MM state $(mm_state) after $(since $t)s"
+
+	# -> BEARER_CONNECTED  (exactly one simple-connect)
+	if any_bearer_connected; then log "bearer already connected - reuse"
+	else
+		log "mmcli -m $(mm_idx) --simple-connect=\"$(echo "$CA" | sed 's/password=[^,]*/password=***/')\""
+		timeout $T_CONNECT mmcli -m "$(mm_idx)" --simple-connect="$CA" >> $LOG 2>&1 || fail_start "simple-connect failed/timeout"
+	fi
+	BR=; for b in $(bearers); do mmc -b $b | grep -q "connected: yes" && BR=$b; done
+	[ -n "$BR" ] || fail_start "no connected bearer after simple-connect"
+	mmc -m "$(mm_idx)" > $D/mm-modem.txt
+	grep -qE "registration: (home|roaming)" $D/mm-modem.txt || fail_start "MM registration not home/roaming after connect"
+	log "MM state $(mm_state), $(grep -oE "registration: [a-z]+" $D/mm-modem.txt)"
+	mmc -b $BR > $BEARER.txt
+	IF=$(bearer_field interface); A=$(bearer_field address); PF=$(bearer_field prefix); GW=$(bearer_field gateway)
+	DNS=$(bearer_field dns); MTU=$(bearer_field mtu)
+	echo "$IF" | grep -qE '^wwan[0-7]$' && [ -n "$A" ] && [ -n "$PF" ] || fail_start "bearer $BR bad ipv4 config IF=$IF A=$A PF=$PF"
+	printf 'BR=%s\nIF=%s\nA=%s\nPF=%s\nGW=%s\nDNS=%s\nMTU=%s\n' "$BR" "$IF" "$A" "$PF" "$GW" "$DNS" "$MTU" > $D/ipcfg
+	log "bearer $BR: $IF $A/$PF gw $GW dns $DNS mtu $MTU"
+	ip addr flush dev $IF; ip addr add $A/$PF dev $IF || fail_start "ip addr add"
+	[ -n "$MTU" ] && ip link set $IF mtu $MTU
+	ip link set $IF up || fail_start "ip link set $IF up (bam-dmux runtime PM?)"
+	link_up $IF || fail_start "$IF not UP"
+	for h in $(echo "$DNS" | tr ',' ' ') $MODEM_TEST_ROUTES; do addroute $h || fail_start "route $h"; done
+	ip route get 172.16.42.2 2>&1 | grep -q "dev usb0" || fail_start "management route no longer via usb0"
+	ip route | grep -q "^default" && log "WARNING: a default route exists (not created by us)"
+	setstate BEARER_CONNECTED
+	log "=== START OK in $(since $T0)s ($IF $A/$PF, routes: $(tr '\n' ' ' < $ROUTES))"
+}
+
+do_stop() {
+	T0=$(now); log "=== STOP (from $(cat $STATE 2>/dev/null || echo OFF): mss=$(mss_state) rmtfs=$(rmtfs_pid) mm=$(mm_pid) bam=$(bam_pm))"
+	rc=0
+	# 1. disconnect bearer(s)
+	if [ -n "$(mm_pid)" ] && mm_has_modem; then
+		timeout $T_DISCONNECT mmcli -m "$(mm_idx)" --simple-disconnect >> $LOG 2>&1; log "simple-disconnect rc=$? (bearers: $(bearers | tr '\n' ' '))"
+		wait_for 15 1 sh -c "! sh $0 _anyconn" && log "no bearer connected" || { log "WARNING: bearer still connected"; rc=1; }
+		# 1b. radio off / network detach before MSS goes away (B6 addition: abrupt MSS stop while EPS-attached
+		#     was followed by attach rejection 'limited' on quick restart). MM disable = DMS low-power.
+		if [ "$MODEM_STOP_DISABLE" = 1 ]; then
+		timeout $T_DISABLE mmcli -m "$(mm_idx)" --disable >> $LOG 2>&1; r=$?
+		wait_for 10 0.5 sh -c "[ \"\$(sh $0 _mmstate)\" = disabled ]" && log "MM disable rc=$r -> state disabled (radio low-power, detached)" \
+			|| { log "WARNING: MM disable rc=$r state '$(mm_state)'"; rc=1; }
+		else log "MODEM_STOP_DISABLE=0: no MM disable"; fi
+	elif [ "$MODEM_STOP_DISABLE" = 1 ] && [ -e /dev/wwan0qmi0 ] && mss_is running; then
+		timeout 20 $Q --dms-set-operating-mode=low-power >> $LOG 2>&1; log "qmicli low-power rc=$? (MM not running)"
+	fi
+	# 2. our /32 routes, 3. flush + DOWN every wwan*
+	for h in $(cat $ROUTES 2>/dev/null); do ip route del $h/32 2>/dev/null; done; : > $ROUTES
+	for d in /sys/class/net/wwan*; do [ -e "$d" ] || continue; w=${d##*/}
+		ip addr flush dev $w 2>/dev/null; ip link set $w down 2>/dev/null
+		link_up $w && { log "ERROR: $w still UP"; rc=1; }; done
+	rm -f $D/ipcfg
+	ip route | grep -q " dev wwan" && { log "ERROR: routes via wwan remain: $(ip route | grep ' dev wwan' | tr '\n' ';')"; rc=1; }
+	log "wwan links down, addresses/routes removed"
+	[ -n "$(cat $STATE 2>/dev/null)" ] && setstate WWAN_DOWN
+	# 4. stop ModemManager (+ its qmi-proxy)
+	if [ -n "$(mm_pid)" ]; then
+		kill -TERM $(mm_pid); wait_for $T_MM_EXIT 0.5 sh -c '! pidof ModemManager >/dev/null' \
+			|| { log "MM did not exit in ${T_MM_EXIT}s - SIGKILL"; kill -KILL $(mm_pid) 2>/dev/null; rc=1; }
+		log "ModemManager stopped"
+	fi
+	pidof qmi-proxy >/dev/null && { killall qmi-proxy; wait_for 5 0.2 sh -c '! pidof qmi-proxy >/dev/null'; log "qmi-proxy stopped"; }
+	setstate MM_STOPPED
+	# 5. BAM-DMUX idle
+	if [ -e $BAM ] && ! mss_is offline; then
+		t=$(now); if wait_for $T_BAM_IDLE 0.5 bam_suspended; then log "BAM-DMUX suspended after $(since $t)s"
+		else log "ERROR: BAM-DMUX '$(bam_pm)' not suspended after ${T_BAM_IDLE}s - NOT stopping MSS"; exit 1; fi
+	fi
+	# 6. MSS stop via rmtfs -s (SIGTERM -> pwrite "stop" to remoteproc state -> exit), 7. rmtfs exits last
+	P=$(rmtfs_pid)
+	mss_is running && now > $D/last-radio-stop
+	if [ "$MODEM_RMTFS_PERSIST" = 1 ] && ! mss_is offline && [ -n "$(rp)" ]; then
+		t=$(now); (echo stop > $(rp)/state) >> $LOG 2>&1; log "MSS stop via sysfs (long-lived rmtfs '${P}' stays)"
+		wait_for $T_MSS_STOP 0.2 mss_is offline && log "MSS offline after $(since $t)s (rmtfs alive: $([ -n "$P" ] && kill -0 $P 2>/dev/null && echo yes || echo no))" \
+			|| { log "ERROR: MSS '$(mss_state)' after ${T_MSS_STOP}s"; rc=1; }
+		setstate MPSS_STOPPED
+	elif [ "$MODEM_RMTFS_PERSIST" = 1 ]; then log "MSS already $(mss_state); long-lived rmtfs '${P}' stays"
+	elif [ -n "$P" ]; then
+		t=$(now); kill -TERM $P; log "SIGTERM rmtfs $P (rmtfs stops MSS, then exits)"
+		wait_for $T_MSS_STOP 0.2 mss_is offline && log "MSS offline after $(since $t)s (rmtfs alive: $(kill -0 $P 2>/dev/null && echo yes || echo no))" \
+			|| { log "ERROR: MSS '$(mss_state)' after ${T_MSS_STOP}s"; rc=1; }
+		setstate MPSS_STOPPED
+		wait_for $T_RMTFS_EXIT 0.2 sh -c "! kill -0 $P 2>/dev/null" && log "rmtfs exited after $(since $t)s" \
+			|| { log "rmtfs still alive - second SIGTERM"; kill -TERM $P; wait_for 5 0.2 sh -c "! kill -0 $P 2>/dev/null" || { kill -KILL $P; rc=1; }; }
+	elif ! mss_is offline && [ -n "$(rp)" ]; then
+		log "MSS $(mss_state) without rmtfs - echo stop > state"; echo stop > $(rp)/state
+		wait_for $T_MSS_STOP 0.2 mss_is offline || rc=1
+	fi
+	mss_is offline || mss_is none || { log "ERROR: MSS state $(mss_state)"; rc=1; }
+	setstate OFF
+	log "=== STOP done rc=$rc in $(since $T0)s (mss=$(mss_state) rmtfs='$(rmtfs_pid)' mm='$(mm_pid)' bam=$(bam_pm))"
+	return $rc
+}
+
+do_disconnect() { # B6N: bearer down only; MSS, rmtfs, MM (and DMS radio) stay up. Next 'start' reuses them and only simple-connects.
+	T0=$(now); log "=== DISCONNECT (from $(cat $STATE 2>/dev/null || echo OFF): mss=$(mss_state) rmtfs=$(rmtfs_pid) mm=$(mm_pid) bam=$(bam_pm))"; rc=0
+	[ -n "$(mm_pid)" ] && mm_has_modem || { log "DISCONNECT: no MM modem"; return 1; }
+	timeout $T_DISCONNECT mmcli -m "$(mm_idx)" --simple-disconnect >> $LOG 2>&1; log "simple-disconnect rc=$? (bearers: $(bearers | tr '\n' ' '))"
+	wait_for 15 1 sh -c "! sh $0 _anyconn" && log "no bearer connected" || { log "ERROR: bearer still connected"; rc=1; }
+	for h in $(cat $ROUTES 2>/dev/null); do ip route del $h/32 2>/dev/null; done; : > $ROUTES
+	for d in /sys/class/net/wwan*; do [ -e "$d" ] || continue; w=${d##*/}
+		ip addr flush dev $w 2>/dev/null; ip link set $w down 2>/dev/null
+		link_up $w && { log "ERROR: $w still UP"; rc=1; }; done
+	rm -f $D/ipcfg
+	ip route | grep -q " dev wwan" && { log "ERROR: routes via wwan remain: $(ip route | grep ' dev wwan' | tr '\n' ';')"; rc=1; }
+	t=$(now); wait_for $T_BAM_IDLE 0.5 bam_suspended && log "BAM-DMUX suspended after $(since $t)s" || { log "ERROR: BAM-DMUX '$(bam_pm)' not suspended"; rc=1; }
+	setstate MM_IDLE
+	log "=== DISCONNECT done rc=$rc in $(since $T0)s (mss=$(mss_state) rmtfs='$(rmtfs_pid)' mm='$(mm_pid)' mm_state=$(mm_state) bam=$(bam_pm))"
+	return $rc
+}
+
+do_status() {
+	r=$(rp)
+	echo "controller: $(cat $STATE 2>/dev/null || echo OFF)"
+	echo "remoteproc: $RPNAME $(mss_state) ($r) fw=$(cat $r/firmware 2>/dev/null)"
+	echo "rmtfs:      pid='$(rmtfs_pid)' writes_logged=$(grep -c 'write ' $D/rmtfs.log 2>/dev/null)"
+	echo "qmi dev:    $(ls /dev/wwan0qmi0 2>/dev/null || echo absent)  qmi-proxy='$(pidof qmi-proxy)'"
+	echo "daemons:    udevd='$(pidof udevd)' dbus='$(pidof dbus-daemon)' polkitd='$(pidof polkitd)' ModemManager='$(mm_pid)'"
+	if [ -n "$(mm_pid)" ] && mm_has_modem; then
+		mmc -m "$(mm_idx)" | grep -E "\| +(state|power state|registration|operator name|access tech|signal quality|plugin|primary port): " \
+			| sed -E 's/^[^|]*\| */  mm /'
+		for b in $(bearers); do echo "  bearer $b: $(mmc -b $b | grep -E 'connected:|interface:|address:' | tr -s ' |' ' ' | tr '\n' ';')"; done
+	else echo "  mm: n/a"; fi
+	for d in /sys/class/net/wwan*; do [ -e "$d" ] || continue; w=${d##*/}
+		link_up $w && echo "wwan:       $w UP $(ip -4 addr show $w | awk '/inet /{print $2}')"; done
+	echo "wwan up:    $(n=0; for d in /sys/class/net/wwan*; do [ -e $d ] && link_up ${d##*/} && n=$((n+1)); done; echo $n) of $(ls -d /sys/class/net/wwan* 2>/dev/null | wc -l)"
+	echo "routes:     $(ip route | grep ' dev wwan' | tr '\n' ';')"
+	echo "bam-dmux:   $(bam_pm) active_ms=$(cat $BAM/power/runtime_active_time 2>/dev/null) suspended_ms=$(cat $BAM/power/runtime_suspended_time 2>/dev/null) control=$(cat $BAM/power/control 2>/dev/null)"
+	echo "usb0:       $(ip -4 addr show usb0 | awk '/inet /{print $2}') route-to-host: $(ip route get 172.16.42.2 2>&1 | head -1)"
+	echo "emmc:       $(awk '{print "writes_completed="$5" sectors_written="$7}' /sys/block/mmcblk0/stat)"
+	echo "dmesg-errs: $(dmesg | grep -cE 'Failed to resume|Resource temporarily|crash detected|fatal error|[Ww]atchdog|Oops|Kernel panic|Unable to handle')"
+}
+
+case "$1" in
+	start) do_start;;
+	stop) do_stop; exit $?;;
+	disconnect) do_disconnect; exit $?;;
+	status) do_status;;
+	addroute) [ -n "$2" ] || exit 2; addroute "$2";;
+	rmtfs-stop) mss_is offline || { log "rmtfs-stop refused: MSS $(mss_state)"; exit 1; }
+		P=$(rmtfs_pid); [ -n "$P" ] || { log "rmtfs-stop: not running"; exit 0; }
+		kill -TERM $P; wait_for $T_RMTFS_EXIT 0.2 sh -c "! kill -0 $P 2>/dev/null" && { log "long-lived rmtfs $P exited"; exit 0; }
+		log "ERROR: rmtfs $P did not exit"; exit 1;;
+	_anyconn) any_bearer_connected;;
+	_mmstate) mm_state;;
+	*) echo "usage: $0 start|stop|status|addroute <ipv4>"; exit 2;;
+esac

b6j/aurora-modem-datatest

@@ -0,0 +1,28 @@
+#!/bin/sh
+# B6 data-path test through the bearer set up by aurora-modem start. Output dir $1. Uses only /32 routes (aurora-modem addroute).
+O=${1:-/tmp/b6/dt}; mkdir -p $O; . /tmp/aurora-modem.d/ipcfg || { echo "DT: no ipcfg"; exit 1; }
+CU="env LD_LIBRARY_PATH=/tmp/cu/usr/lib /tmp/cu/usr/bin/curl --cacert /tmp/cu/etc/ssl/certs/ca-certificates.crt --interface $IF -4 --connect-timeout 10 -sS"
+W='code=%{http_code} remote=%{remote_ip}:%{remote_port} local=%{local_ip} ssl_verify=%{ssl_verify_result} t_total=%{time_total}\n'
+D1=${DNS%%,*}
+{ for n in ya.ru www.google.com; do echo "### nslookup $n $D1"; timeout 20 nslookup $n $D1 2>&1; done; } > $O/dns.txt
+ips() { awk -v n="$1" '/^### nslookup/{c=($3==n)} c && /^Address[^:]*: *[0-9.]+$/{print $NF}' $O/dns.txt | grep -v "^$D1$" | sort -u | head -2; }
+YA=$(ips ya.ru); GO=$(ips www.google.com); YA1=$(echo $YA | cut -d' ' -f1); GO1=$(echo $GO | cut -d' ' -f1)
+for y in $YA $GO; do sh /tmp/aurora-modem addroute $y; done
+{ echo "ya.ru=$YA google=$GO"; for h in 77.88.8.8 $YA1 172.16.42.2 8.8.4.4; do echo "--- route get $h: $(ip route get $h 2>&1 | head -1)"; done; } > $O/routes.txt
+{ for h in 77.88.8.8 1.1.1.1; do echo "### ping $h"; ping -c 3 -W 3 $h 2>&1; done; } > $O/ping.txt
+Y=$(date -u +%Y)
+{ echo "### http://ya.ru/"; timeout 40 $CU --resolve ya.ru:80:$YA1 -o /dev/null -w "$W" http://ya.ru/ 2>&1; echo "rc=$?"
+  if [ "$Y" -ge 2026 ]; then
+    echo "### https://www.google.com/generate_204"; timeout 40 $CU --resolve www.google.com:443:$GO1 -o /dev/null -w "$W" https://www.google.com/generate_204 2>&1; echo "rc=$?"
+    echo "### https://1.1.1.1/cdn-cgi/trace"; timeout 40 $CU -o /dev/null -w "$W" https://1.1.1.1/cdn-cgi/trace 2>&1; echo "rc=$?"
+  else echo "### HTTPS skipped: clock year $Y (not a cellular failure)"; fi; } > $O/http.txt
+DNSOK=$([ -n "$YA1" ] && [ -n "$GO1" ] && echo 1 || echo 0)
+PING=$(grep -oE "[0-9]+ packets received" $O/ping.txt | cut -d' ' -f1 | tr '\n' '+'); PING=${PING%+}
+PINGOK=$(grep -qE "[1-9][0-9]* packets received" $O/ping.txt && echo 1 || echo 0)
+HTTP=$(grep -A1 "^### http://" $O/http.txt | grep -oE "code=[0-9]+" | head -1)
+HTTPS=$(grep -oE "code=[0-9]+" $O/http.txt | tail -n +2 | tr '\n' ' ')
+HTTPOK=$(echo "$HTTP" | grep -qE "code=[1-5][0-9][0-9]" && echo 1 || echo 0)
+if [ "$Y" -ge 2026 ]; then echo "$HTTPS" | grep -q "code=204" && echo "$HTTPS" | grep -q "code=200" && HTTPSOK=1 || HTTPSOK=0; else HTTPSOK=skip; fi
+V=FAIL; [ $DNSOK$PINGOK$HTTPOK = 111 ] && [ "$HTTPSOK" != 0 ] && V=PASS
+echo "DATATEST $V dns=$DNSOK(ya=$YA1 go=$GO1) ping=$PING http=$HTTP https=[$HTTPS]($HTTPSOK) if=$IF addr=$A" | tee $O/verdict.txt
+[ $V = PASS ]

b6j/aurora-modem.conf

@@ -0,0 +1,10 @@
+# B6 operator config (sourced by /tmp/aurora-modem). Lifecycle logic is operator-independent;
+# only this file names an operator. No APN auto-selection: empty MODEM_APN => start refuses (exit 2).
+# Proven Beeline (session 22). For T2 use: MODEM_APN=internet and empty USER/PASSWORD/AUTH.
+MODEM_APN=internet.beeline.ru
+MODEM_USER=beeline
+MODEM_PASSWORD=beeline
+MODEM_AUTH=pap
+MODEM_IP_TYPE=ipv4
+# /32 host routes via the bearer interface (in addition to the bearer DNS servers). No default route.
+MODEM_TEST_ROUTES="77.88.8.8 1.1.1.1"

b6j/j-run.sh

@@ -0,0 +1,101 @@
+#!/bin/sh
+# B6J harness. j1: cycles until the first registration failure, snapshot (j-snap.sh) BEFORE stop, then clean stop, end.
+#              j3: same cycle, ONE long-lived rmtfs (MODEM_RMTFS_PERSIST=1); stops at the first failure of any kind;
+#                  after the series: MSS offline -> then rmtfs-stop. RAM only.
+#              k:  j1 lifecycle + k-at.sh (runtime AT+CEREG=5/CGREG=3, port open from before DMS online until MM start / FAIL queries).
+MODE=$1; N=${2:-6}; O=/tmp/$MODE; mkdir -p $O; M="sh /tmp/aurora-modem"; D=/tmp/aurora-modem.d
+export MODEM_CONF=/tmp/$MODE.conf MODEM_KEEP_ON_FAIL=1
+B=/sys/bus/platform/devices/4080000.remoteproc:bam-dmux; RPS=/sys/class/remoteproc/remoteproc0/state
+mask() { sed -E 's/([0-9]{6,})([0-9]{4})/******\2/g'; }
+up() { cut -d' ' -f1 /proc/uptime; }
+mk() { echo "<5>[$MODE] $*" > /dev/kmsg; echo "[$(up)] $*" | tee -a $O/run.log; }
+nv() { for want in modemst1 modemst2 fsg fsc persist; do for p in /sys/class/block/mmcblk0p*; do
+	[ "$(sed -n 's/^PARTNAME=//p' $p/uevent)" = "$want" ] && echo "$want $(basename $p) $(sha256sum /dev/$(basename $p) | cut -d' ' -f1)"; done; done; }
+cnt() { grep -cE "$1" $2; }
+f() { grep -m1 -oE "$1: *'[^']*'" $2 2>/dev/null | sed -E "s/.*'([^']*)'/\1/"; }
+[ -f $O/nv-before.txt ] || { nv > $O/nv-before.txt; cat /sys/block/mmcblk0/stat > $O/stat-before.txt; }
+[ -f $O/table.tsv ] || printf 'cycle\treg\treg_latency_s\treg_state\tps\trat_band_ch\ttac_pci_eci\tbearer\tipv4\tdata\tbam\tmss\trmtfs_pid\trmtfs_writes\tfr_110_22_eagain_ssr\tusb\temmc_w\tresult\n' > $O/table.tsv
+for c in $(seq 1 $N); do
+	X=$O/c$c; mkdir -p $X; dmesg | wc -l > $X/dmesg-off
+	wc -l < $D/lifecycle.log > $X/log-off 2>/dev/null || echo 0 > $X/log-off
+	wc -l < $D/rmtfs.log > $X/rmtfs-off 2>/dev/null || echo 0 > $X/rmtfs-off
+	rm -f $D/reg-*.txt $D/qmi-ss.txt $D/bearer.txt
+	mk "CYCLE $c begin: emmc $(awk '{print "w="$5" s="$7}' /sys/block/mmcblk0/stat) mss=$(cat $RPS) rmtfs='$(pidof rmtfs)'"
+	[ $MODE = k ] && { sh /tmp/k-at.sh run $X/at > /dev/null 2>&1 & }
+	$M start > $X/start.out 2>&1; SR=$?; mk "CYCLE $c start rc=$SR"
+	cp $D/qmi-ss.txt $D/reg-*.txt $X/ 2>/dev/null; RPID=$(pidof rmtfs); cp $D/reg-trans.tsv $D/reg-denied-count $X/ 2>/dev/null
+	$M status 2>&1 | mask > $X/status-up.txt
+	if [ $SR = 0 ]; then
+		cp $D/bearer.txt $X/ 2>/dev/null; cp $D/ipcfg $X/ipcfg 2>/dev/null
+		sh /tmp/aurora-modem-datatest $X/dt > $X/dt.out 2>&1; DR=$?
+	else
+		DR=9; mk "CYCLE $c start FAILED in $(cat $D/state) - snapshot BEFORE stop"
+		[ $MODE = k ] && { sh /tmp/k-at.sh failq > $X/k-failq.out 2>&1; export AT_PORT=/dev/none-at-held-by-k-at; }
+		[ $MODE = l ] && export AT_PORT=/dev/none-l-mode
+		sh /tmp/j-snap.sh $X/snap > $X/snap.out 2>&1
+		if [ $MODE = l ]; then mk "CYCLE $c B6L passive observation 900 s (no cleanup, MSS/rmtfs/radio untouched)"
+			sh /tmp/l-obs.sh $X/obs 900 15 > $X/obs.out 2>&1; mk "CYCLE $c observation: $(cat $X/obs/result.txt)"
+			sh /tmp/j-snap.sh $X/snap-end > $X/snap-end.out 2>&1; fi; mk "CYCLE $c snapshot done"
+	fi
+	mk "CYCLE $c $(cat $X/dt/verdict.txt 2>/dev/null || echo DATATEST not-run) rc=$DR"
+	[ $MODE = k ] && sh /tmp/k-at.sh close > $X/k-close.out 2>&1
+	$M stop > $X/stop.out 2>&1; PR=$?; mk "CYCLE $c stop rc=$PR"; sleep 2
+	$M status 2>&1 | mask > $X/status-down.txt
+	cat /sys/block/mmcblk0/stat > $X/stat.txt
+	dmesg | tail -n +$(( $(cat $X/dmesg-off) + 1 )) > $X/dmesg-delta.txt
+	tail -n +$(( $(cat $X/log-off) + 1 )) $D/lifecycle.log | mask > $X/lifecycle.log
+	tail -n +$(( $(cat $X/rmtfs-off) + 1 )) $D/rmtfs.log > $X/rmtfs-delta.log
+	E1=$(cnt 'Failed to resume' $X/dmesg-delta.txt); E2=$(cnt '[-(]110\b|-110' $X/dmesg-delta.txt); E3=$(cnt '[ (=]-22\b' $X/dmesg-delta.txt)
+	E4=$(cnt 'EAGAIN|Resource temporarily' $X/dmesg-delta.txt); E5=$(cnt 'crash detected|fatal error|[Ww]atchdog|wdog|SSR|Oops|Kernel panic|Unable to handle|BUG:' $X/dmesg-delta.txt)
+	grep -iE 'remoteproc.*(fail|error)|Failed to resume|-110|EAGAIN|crash|fatal|atchdog|Oops|BUG:' $X/dmesg-delta.txt > $X/dmesg-errs.txt
+	F=""
+	[ $PR = 0 ] || F="$F stop"; [ "$(cat $RPS)" = offline ] || F="$F mss-$(cat $RPS)"
+	if [ $MODE = j3 ]; then [ -n "$(pidof rmtfs)" ] || F="$F rmtfs-died"; [ -z "$R0" ] && R0=$RPID; [ "$(pidof rmtfs)" = "$R0" ] || F="$F rmtfs-pid-changed"
+	else [ -z "$(pidof rmtfs)" ] || F="$F rmtfs-alive"; fi
+	[ -z "$(pidof ModemManager)" ] || F="$F mm"; [ -z "$(pidof qmi-proxy)" ] || F="$F qmi-proxy"
+	for d in /sys/class/net/wwan*; do [ -e $d ] || continue; w=${d##*/}
+		[ $(( $(cat $d/flags) & 1 )) -ne 0 ] && F="$F $w-up"; ip -4 addr show $w | grep -q "inet " && F="$F $w-addr"; done
+	ip route | grep -q " dev wwan" && F="$F routes"; ip route | grep -q "^default" && F="$F default-route"
+	BS=$(cat $B/power/runtime_status); [ "$BS" = suspended ] || F="$F bam-$BS"
+	[ $((E1+E2+E4+E5)) -gt 0 ] && F="$F dmesg-errs"
+	awk '{exit !($5==0 && $7==0)}' $X/stat.txt || F="$F emmc-writes"
+	ping -c 2 -W 2 172.16.42.2 > $X/usb-ping.txt 2>&1 && U=ok || { U=FAIL; F="$F usb-ncm"; }
+	# table row
+	if grep -q "registered: " $X/lifecycle.log; then REG=PASS; LAT=$(grep -m1 -oE "registered: .* after [0-9.]+s" $X/lifecycle.log | grep -oE "[0-9.]+s$")
+	elif grep -q "FAIL in RADIO_ONLINE" $X/lifecycle.log; then REG=FAIL; LAT=">180s"; else REG=n/a; LAT=-; fi
+	SS=$X/qmi-ss.txt; [ -s $SS ] || SS=$X/snap/qmi-ss.txt
+	RB=$(f "Active Band Class" $X/reg-nas-get-rf-band-info.txt)/$(f "Active Channel" $X/reg-nas-get-rf-band-info.txt)
+	[ "$REG" = FAIL ] && RB=$(f "Active Band Class" $X/snap/qmi.txt)/$(f "Active Channel" $X/snap/qmi.txt)
+	CL=$X/reg-nas-get-cell-location-info.txt; [ "$REG" = FAIL ] && CL=$X/snap/qmi.txt
+	TPE=$(f "Tracking Area Code" $CL)/$(f "Serving Cell ID" $CL)/$(f "Global Cell ID" $CL)
+	BR=$( [ $SR = 0 ] && echo connected || echo none ); IP=$(sed -n 's/^A=//p' $X/ipcfg 2>/dev/null)
+	DT=$(cut -d' ' -f2 $X/dt/verdict.txt 2>/dev/null || echo not-run)
+	RW=$(grep -c "write " $X/rmtfs-delta.log)
+	printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' $c $REG "$LAT" "$(f 'Registration state' $SS)" "$(f 'PS' $SS)" \
+		"lte:$RB" "$TPE" $BR "${IP:--}" $DT $BS $(cat $RPS) "${RPID:--}" $RW "$E1/$E2/$E3/$E4/$E5" $U "$(awk '{print $5"/"$7}' $X/stat.txt)" "${F:-ok}" >> $O/table.tsv
+	[ $MODE = k ] && { grep -E "\+C(E|G)?REG:|ERROR" $X/at/at.clean.txt > $X/urc.txt; mk "CYCLE $c AT: $(grep -cE '< \+CEREG:' $X/at/at.clean.txt) CEREG lines, last '$(grep -E '< \+CEREG:' $X/at/at.clean.txt | tail -1 | sed 's/.*< //')', ERROR x$(grep -c '< ERROR' $X/at/at.clean.txt)"; }
+	if [ $MODE = m ]; then
+		[ -f $O/m-table.tsv ] || printf 'cycle\treg\tlatency_s\ttransitions\tdenied\tsearching_rows\tinit_pci\tfinal_pci\treselection\tps\tbearer\tdns\tping\thttp\thttps\tstop\tchecks\n' > $O/m-table.tsv
+		TR=$X/reg-trans.tsv; NT=$(($(wc -l < $TR 2>/dev/null || echo 1)-1)); IP0=$(awk -F'\t' 'NR==2{print $10}' $TR); IP1=$(awk -F'\t' 'END{print $10}' $TR)
+		PCIS=$(awk -F'\t' 'NR>1 && $10!=""{print $10}' $TR | uniq | tr '\n' '>' | sed 's/>$//')
+		NS=$(awk -F'\t' 'NR>1 && $3=="not-registered-searching"' $TR | wc -l)
+		RL=$(grep -m1 -oE "registered: .* after [0-9.]+s" $X/lifecycle.log | grep -oE "[0-9.]+s$"); [ -n "$RL" ] || RL=$(grep -m1 -oE "REGISTRATION_TIMEOUT|LOCAL FAILURE[^(]*" $X/lifecycle.log)
+		V=$(cat $X/dt/verdict.txt 2>/dev/null)
+		printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' $c $REG "${RL:--}" $NT "$(cat $X/reg-denied-count 2>/dev/null)" $NS "${IP0:--}" "${IP1:--}" \
+			"$( [ "$(echo $PCIS | tr '>' '\n' | sort -u | wc -l)" -gt 1 ] && echo "yes:$PCIS" || echo "no:$PCIS")" "$(awk -F'\t' 'END{print $4}' $TR)" $BR \
+			"$(echo "$V" | grep -oE 'dns=[0-9]')" "$(echo "$V" | grep -oE 'ping=[0-9+]*')" "$(echo "$V" | grep -oE 'http=code=[0-9]*')" "$(echo "$V" | grep -oE 'https=\[[^]]*\]\([^)]*\)')" "rc=$PR" "${F:-ok}" >> $O/m-table.tsv
+	fi
+	mk "CYCLE $c RESULT reg=$REG lat=$LAT data=$DT checks=${F:-ok} rmtfs=$RPID->$(pidof rmtfs) writes=$RW bam=$BS"
+	[ $SR = 0 ] && [ $DR = 0 ] || { mk "SERIES STOP: cycle $c start/data failure"; break; }
+	[ -z "$F" ] || { mk "SERIES STOP: cycle $c new failure:$F"; break; }
+	sleep 5
+done
+if [ $MODE = j3 ]; then
+	mk "series end: MSS $(cat $RPS) -> rmtfs-stop"; [ "$(cat $RPS)" = offline ] && $M rmtfs-stop > $O/rmtfs-stop.out 2>&1; mk "rmtfs-stop rc=$? rmtfs='$(pidof rmtfs)'"
+fi
+nv > $O/nv-after.txt; cat /sys/block/mmcblk0/stat > $O/stat-after.txt
+cmp -s $O/nv-before.txt $O/nv-after.txt && NVR=unchanged || NVR=CHANGED
+mk "FINAL: nv $NVR, emmc $(awk '{print "w="$5" s="$7}' $O/stat-after.txt), mss=$(cat $RPS), rmtfs='$(pidof rmtfs)', mm='$(pidof ModemManager)', bam=$(cat $B/power/runtime_status), wwan-up=$(for d in /sys/class/net/wwan*; do [ $(( $(cat $d/flags) & 1 )) -ne 0 ] && echo ${d##*/}; done | tr '\n' ' '), usb $(ping -c 2 -W 2 172.16.42.2 >/dev/null 2>&1 && echo ok || echo FAIL)"
+for f in $D/mm-*.log; do [ -f $f ] && mask < $f > $O/$(basename $f); done
+cp $D/rmtfs.log $O/; mask < $D/lifecycle.log > $O/lifecycle.log; dmesg > $O/dmesg-full.txt
+tar -C /tmp -cf /tmp/$MODE.tar $MODE; mk "$MODE-RUN-END"

b6j/j-snap.sh

@@ -0,0 +1,30 @@
+#!/bin/sh
+# B6J1 snapshot of a failed registration, taken BEFORE any stop/restart. Read-only: QMI GETs, AT read queries (one port open/close).
+O=${1:-/tmp/j-snap}; mkdir -p $O; Q="qmicli -p -d /dev/wwan0qmi0"; D=/tmp/aurora-modem.d
+BAM=/sys/bus/platform/devices/4080000.remoteproc:bam-dmux; AT=${AT_PORT:-/dev/wwan0at0}
+ts() { echo "$(cut -d' ' -f1 /proc/uptime) $(date -u +%H:%M:%S)"; }
+echo "<5>[j-snap] begin" > /dev/kmsg
+{ echo "snapshot begin [$(ts)]"; cat $D/state; } > $O/meta.txt
+for a in nas-get-serving-system nas-get-system-info nas-get-signal-info dms-get-operating-mode uim-get-card-status \
+	nas-get-cell-location-info nas-get-rf-band-info; do
+	{ echo "### [$(ts)] qmicli -p -d /dev/wwan0qmi0 --$a"; timeout 20 $Q --$a 2>&1; echo "rc=$?"; } >> $O/qmi.txt; done
+if pidof ModemManager >/dev/null; then i=$(mmcli -L 2>/dev/null | grep -oE "Modem/[0-9]+" | head -1 | cut -d/ -f2)
+	{ echo "### [$(ts)] mmcli -m $i"; mmcli -m $i 2>&1 | sed 's/\x1b\[[0-9;]*m//g'; } > $O/mmcli.txt
+else echo "[$(ts)] ModemManager not running (failure occurred before the MM stage) - mmcli -m n/a" > $O/mmcli.txt; fi
+# AT: open the port ONCE, keep it open for all queries, close ONCE (JZ02: rapid open/close -> modem closes the channel)
+if [ -c $AT ] && ! pidof ModemManager >/dev/null; then
+	echo "[$(ts)] open $AT" > $O/at.txt
+	exec 3<>$AT
+	( while IFS= read -r l <&3; do echo "[$(ts)] < $l"; done ) >> $O/at.txt 2>&1 &
+	RP=$!
+	for c in AT AT+CEREG? AT+CGREG? AT+CREG? AT+CGATT? AT+COPS? AT+CEER; do
+		echo "[$(ts)] > $c" >> $O/at.txt; printf '%s\r' "$c" >&3; sleep 3; done
+	sleep 2; kill $RP 2>/dev/null; exec 3>&-; echo "[$(ts)] closed $AT" >> $O/at.txt
+else echo "[$(ts)] AT skipped: $AT missing or MM holds AT ports" > $O/at.txt; fi
+tr -d '\r' < $O/at.txt > $O/at.clean.txt
+{ echo "### [$(ts)] remoteproc"; for r in /sys/class/remoteproc/remoteproc*; do echo "$r $(cat $r/name) $(cat $r/state)"; done
+  echo "### bam-dmux"; for f in runtime_status runtime_active_time runtime_suspended_time control; do echo "$f=$(cat $BAM/power/$f)"; done
+  echo "### ip link"; ip link; echo "### ip addr"; ip addr; echo "### ip route"; ip route
+  echo "### ps"; ps; echo "### emmc"; cat /sys/block/mmcblk0/stat; } > $O/sys.txt 2>&1
+dmesg > $O/dmesg.txt; cp $D/lifecycle.log $D/rmtfs.log $O/ 2>/dev/null; cp $D/qmi-*.txt $O/ 2>/dev/null
+echo "snapshot end [$(ts)]" >> $O/meta.txt; echo "<5>[j-snap] end" > /dev/kmsg

b6j/j1.conf

@@ -0,0 +1,15 @@
+# B6 operator config (sourced by /tmp/aurora-modem). Lifecycle logic is operator-independent;
+# only this file names an operator. No APN auto-selection: empty MODEM_APN => start refuses (exit 2).
+# Proven Beeline (session 22). For T2 use: MODEM_APN=internet and empty USER/PASSWORD/AUTH.
+MODEM_APN=internet.beeline.ru
+MODEM_USER=beeline
+MODEM_PASSWORD=beeline
+MODEM_AUTH=pap
+MODEM_IP_TYPE=ipv4
+# /32 host routes via the bearer interface (in addition to the bearer DNS servers). No default route.
+MODEM_TEST_ROUTES="77.88.8.8 1.1.1.1"
+# --- B6J1 diagnostic lifecycle: minimal proven variant (no holdoff, no MM disable / low-power in stop), rmtfs -s per cycle
+MODEM_REATTACH_HOLDOFF=0
+MODEM_STOP_DISABLE=0
+MODEM_RMTFS_PERSIST=0
+MODEM_REG_SNAP=1

b6j/j3.conf

@@ -0,0 +1,15 @@
+# B6 operator config (sourced by /tmp/aurora-modem). Lifecycle logic is operator-independent;
+# only this file names an operator. No APN auto-selection: empty MODEM_APN => start refuses (exit 2).
+# Proven Beeline (session 22). For T2 use: MODEM_APN=internet and empty USER/PASSWORD/AUTH.
+MODEM_APN=internet.beeline.ru
+MODEM_USER=beeline
+MODEM_PASSWORD=beeline
+MODEM_AUTH=pap
+MODEM_IP_TYPE=ipv4
+# /32 host routes via the bearer interface (in addition to the bearer DNS servers). No default route.
+MODEM_TEST_ROUTES="77.88.8.8 1.1.1.1"
+# --- B6J3: as J1, but ONE long-lived 'rmtfs -r -P -v' (no -s); MSS start/stop via remoteproc sysfs
+MODEM_REATTACH_HOLDOFF=0
+MODEM_STOP_DISABLE=0
+MODEM_RMTFS_PERSIST=1
+MODEM_REG_SNAP=1

b6j/k-at.sh

@@ -0,0 +1,27 @@
+#!/bin/sh
+# B6K AT capture. 'run OUTDIR': wait for wwan0at0 (+wwan0qmi0, +2 s port-race guard), open it ONCE, enable runtime-only
+# extended registration URCs (AT+CEREG=5, AT+CGREG=3; no other values tried), keep the port open and log every line with timestamps
+# until told: 'close' (just close) or 'failq' (read-only FAIL queries, then close). 'gate': wait (<=30 s) until setup is done.
+AT=/dev/wwan0at0; K=/tmp/k-at.d; mkdir -p $K
+ts() { echo "$(cut -d' ' -f1 /proc/uptime) $(date -u +%H:%M:%S)"; }
+waitfile() { i=0; while [ ! -e $1 ] && [ $i -lt $(($2*5)) ]; do sleep 0.2; i=$((i+1)); done; [ -e $1 ]; }
+case "$1" in
+gate)	waitfile $K/ready 30 && { echo "k-at gate: ready ($(cat $K/ready))"; exit 0; }; echo "k-at gate: TIMEOUT (setup not done in 30 s)"; exit 1;;
+close|failq)
+	[ -f $K/pid ] && kill -0 $(cat $K/pid) 2>/dev/null || { echo "k-at $1: not running"; exit 0; }
+	echo $1 > $K/ctl; waitfile $K/done 45 && { echo "k-at $1: done"; exit 0; }; echo "k-at $1: TIMEOUT"; exit 1;;
+run)	O=${2:-/tmp/k-at}; mkdir -p $O; rm -f $K/ready $K/ctl $K/done; echo $$ > $K/pid; L=$O/at.txt
+	echo "[$(ts)] k-at waiting for $AT" > $L
+	waitfile $AT 90 && waitfile /dev/wwan0qmi0 30 || { echo "[$(ts)] $AT not present" >> $L; echo fail > $K/ready; touch $K/done; exit 1; }
+	sleep 2; exec 3<>$AT; echo "[$(ts)] open $AT" >> $L
+	( while IFS= read -r l <&3; do echo "[$(ts)] < $l"; done ) >> $L 2>&1 &
+	RP=$!
+	send() { echo "[$(ts)] > $1" >> $L; printf '%s\r' "$1" >&3; sleep ${2:-2}; }
+	for c in AT AT+CEREG=5 AT+CGREG=3 AT+CEREG? AT+CGREG? AT+CREG?; do send $c; done
+	echo "[$(ts)] setup done" >> $L; echo "$(ts)" > $K/ready
+	while :; do c=$(cat $K/ctl 2>/dev/null)
+		case "$c" in
+		failq) echo "[$(ts)] --- FAIL queries" >> $L; for q in AT+CEREG? AT+CGREG? AT+CREG? AT+CGATT? AT+COPS? AT+CEER; do send $q 3; done; break;;
+		close) break;; esac; sleep 0.5; done
+	sleep 1; kill $RP 2>/dev/null; exec 3>&-; echo "[$(ts)] closed $AT ($c)" >> $L; tr -d '\r' < $L > $O/at.clean.txt; touch $K/done;;
+esac

b6j/k.conf

@@ -0,0 +1,18 @@
+# B6 operator config (sourced by /tmp/aurora-modem). Lifecycle logic is operator-independent;
+# only this file names an operator. No APN auto-selection: empty MODEM_APN => start refuses (exit 2).
+# Proven Beeline (session 22). For T2 use: MODEM_APN=internet and empty USER/PASSWORD/AUTH.
+MODEM_APN=internet.beeline.ru
+MODEM_USER=beeline
+MODEM_PASSWORD=beeline
+MODEM_AUTH=pap
+MODEM_IP_TYPE=ipv4
+# /32 host routes via the bearer interface (in addition to the bearer DNS servers). No default route.
+MODEM_TEST_ROUTES="77.88.8.8 1.1.1.1"
+# --- B6J1 diagnostic lifecycle: minimal proven variant (no holdoff, no MM disable / low-power in stop), rmtfs -s per cycle
+MODEM_REATTACH_HOLDOFF=0
+MODEM_STOP_DISABLE=0
+MODEM_RMTFS_PERSIST=0
+MODEM_REG_SNAP=1
+# --- B6K: J1 lifecycle (rmtfs -r -P -s -v per cycle, minimal stop, holdoff 0) + runtime-only AT registration reporting
+MODEM_HOOK_PRE_ONLINE="sh /tmp/k-at.sh gate"
+MODEM_HOOK_PRE_MM="sh /tmp/k-at.sh close"

b6j/l-obs.sh

@@ -0,0 +1,40 @@
+#!/bin/sh
+# B6L passive observation of a failed registration: NO writes to the modem (QMI GETs + AT read queries only), no radio/mode change.
+# AT port opened ONCE for the whole observation (proven safe pattern; rapid open/close crashed JZ02 MPSS). Stops early when
+# registered + PS attached (scenario A, one extra sample recorded) or MSS leaves 'running'.
+O=${1:-/tmp/l-obs}; DUR=${2:-900}; P=${3:-15}; mkdir -p $O/raw; Q="qmicli -p -d /dev/wwan0qmi0"; AT=/dev/wwan0at0
+B=/sys/bus/platform/devices/4080000.remoteproc:bam-dmux; RPS=/sys/class/remoteproc/remoteproc0/state
+up() { cut -d' ' -f1 /proc/uptime; }
+v() { grep -m1 -oE "$1: *'[^']*'" $2 2>/dev/null | sed -E "s/.*'([^']*)'/\1/"; }
+lte() { sed -n '/LTE service:/,/SIM reject/p' $1; }
+atl() { grep -E "< \\$1:" $O/at.txt | tail -1 | sed -E 's/.*< //; s/\r//'; }
+D0=$(dmesg | wc -l); T0=$(up)
+printf 't_rel\tuptime\tss_reg\tss_ps\tss_plmn\tss_status\tss_forbidden\tsi_status\tsi_true\tsi_domain\tsi_plmn\tsi_eci\tsi_tac\tcl_plmn\tcl_tac\tcl_eci\tcl_earfcn\tcl_pci\tsig_rsrp\tsig_rsrq\tsig_snr\tat_cereg\tat_cgreg\tat_creg\tat_cgatt\tat_cops\tmss\tbam\tdmesg_err\tusb\temmc_w\n' > $O/timeline.tsv
+echo "[$(up)] open $AT" > $O/at.txt; exec 3<>$AT
+( while IFS= read -r l <&3; do echo "[$(up)] < $l"; done ) >> $O/at.txt 2>&1 &
+RP=$!; echo "<5>[l-obs] begin dur=$DUR period=$P" > /dev/kmsg
+n=0; RES=B; extra=0
+while :; do
+	ts=$(up); n=$((n+1)); R=$O/raw/$n; mkdir -p $R
+	for a in nas-get-serving-system nas-get-system-info nas-get-signal-info nas-get-cell-location-info; do timeout 20 $Q --$a > $R/$a.txt 2>&1; done
+	for c in AT+CEREG? AT+CGREG? AT+CREG? AT+CGATT? AT+COPS?; do echo "[$(up)] > $c (sample $n)" >> $O/at.txt; printf '%s\r' "$c" >&3; sleep 1; done
+	SS=$R/nas-get-serving-system.txt; SI=$R/si-lte.txt; lte $R/nas-get-system-info.txt > $SI; CL=$R/nas-get-cell-location-info.txt; SG=$R/nas-get-signal-info.txt
+	SP=$(sed -n '/Current PLMN/,/Description/p' $SS | grep -oE "M[CN]C: '[^']*'" | sed -E "s/.*'([^']*)'/\1/" | tr '\n' '-' | sed 's/-$//')
+	E=$(dmesg | tail -n +$((D0+1)) | grep -cE 'Failed to resume|-110|EAGAIN|Resource temporarily|crash detected|fatal error|[Ww]atchdog|wdog|Oops|BUG:|remoteproc.*(fail|error)')
+	U=$(ping -c1 -W2 172.16.42.2 >/dev/null 2>&1 && echo ok || echo FAIL)
+	printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' \
+		$(awk -v a=$ts -v b=$T0 'BEGIN{printf "%.0f", a-b}') $ts "$(v 'Registration state' $SS)" "$(v PS $SS)" "$SP" "$(v Status $SS)" "$(v Forbidden $SS)" \
+		"$(v Status $SI)" "$(v 'True Status' $SI)" "$(v Domain $SI)" "$(v MCC $SI)-$(v MNC $SI)" "$(v 'Cell ID' $SI)" "$(v 'Tracking Area Code' $SI)" \
+		"$(v PLMN $CL)" "$(v 'Tracking Area Code' $CL)" "$(v 'Global Cell ID' $CL)" "$(v 'EUTRA Absolute RF Channel Number' $CL)" "$(v 'Serving Cell ID' $CL)" \
+		"$(v RSRP $SG)" "$(v RSRQ $SG)" "$(v SNR $SG)" "$(atl +CEREG)" "$(atl +CGREG)" "$(atl +CREG)" "$(atl +CGATT)" "$(atl +COPS)" \
+		"$(cat $RPS)" "$(cat $B/power/runtime_status)" $E $U "$(awk '{print $5"/"$7}' /sys/block/mmcblk0/stat)" >> $O/timeline.tsv
+	[ "$(cat $RPS)" = running ] || { RES=MSS-$(cat $RPS); break; }
+	[ $extra = 1 ] && break
+	grep -q "Registration state: 'registered'" $SS && grep -q "PS: 'attached'" $SS && { RES=A-registered; extra=1; echo "<5>[l-obs] registered+attached at sample $n" > /dev/kmsg; }
+	[ $extra = 1 ] && { sleep $P; continue; }
+	[ "$(awk -v a=$(up) -v b=$T0 -v d=$DUR 'BEGIN{print (a-b>=d)}')" = 1 ] && break
+	w=$(awk -v a=$(up) -v b=$ts -v p=$P 'BEGIN{d=p-(a-b); printf "%.1f", (d>0)?d:0}'); sleep $w
+done
+sleep 1; kill $RP 2>/dev/null; exec 3>&-; echo "[$(up)] closed $AT" >> $O/at.txt; tr -d '\r' < $O/at.txt > $O/at.clean.txt
+echo "RESULT=$RES samples=$n dur=$(awk -v a=$(up) -v b=$T0 'BEGIN{printf "%.0f", a-b}')s" > $O/result.txt
+echo "<5>[l-obs] end $(cat $O/result.txt)" > /dev/kmsg; cat $O/result.txt

b6j/l.conf

@@ -0,0 +1,16 @@
+# B6 operator config (sourced by /tmp/aurora-modem). Lifecycle logic is operator-independent;
+# only this file names an operator. No APN auto-selection: empty MODEM_APN => start refuses (exit 2).
+# Proven Beeline (session 22). For T2 use: MODEM_APN=internet and empty USER/PASSWORD/AUTH.
+MODEM_APN=internet.beeline.ru
+MODEM_USER=beeline
+MODEM_PASSWORD=beeline
+MODEM_AUTH=pap
+MODEM_IP_TYPE=ipv4
+# /32 host routes via the bearer interface (in addition to the bearer DNS servers). No default route.
+MODEM_TEST_ROUTES="77.88.8.8 1.1.1.1"
+# --- B6J1 diagnostic lifecycle: minimal proven variant (no holdoff, no MM disable / low-power in stop), rmtfs -s per cycle
+MODEM_REATTACH_HOLDOFF=0
+MODEM_STOP_DISABLE=0
+MODEM_RMTFS_PERSIST=0
+MODEM_REG_SNAP=1
+# --- B6L: identical to j1.conf (J1 lifecycle); on FAIL the harness runs l-obs.sh (passive 15 min observation)

b6j/m.conf

@@ -0,0 +1,18 @@
+# B6 operator config (sourced by /tmp/aurora-modem). Lifecycle logic is operator-independent;
+# only this file names an operator. No APN auto-selection: empty MODEM_APN => start refuses (exit 2).
+# Proven Beeline (session 22). For T2 use: MODEM_APN=internet and empty USER/PASSWORD/AUTH.
+MODEM_APN=internet.beeline.ru
+MODEM_USER=beeline
+MODEM_PASSWORD=beeline
+MODEM_AUTH=pap
+MODEM_IP_TYPE=ipv4
+# /32 host routes via the bearer interface (in addition to the bearer DNS servers). No default route.
+MODEM_TEST_ROUTES="77.88.8.8 1.1.1.1"
+# --- B6J1 diagnostic lifecycle: minimal proven variant (no holdoff, no MM disable / low-power in stop), rmtfs -s per cycle
+MODEM_REATTACH_HOLDOFF=0
+MODEM_STOP_DISABLE=0
+MODEM_RMTFS_PERSIST=0
+MODEM_REG_SNAP=1
+# --- B6M: J1 lifecycle (rmtfs -r -P -s -v per cycle, minimal stop, holdoff 0) + registration state machine, deadline 360 s
+T_REG=360
+MODEM_REG_SM=1

b6j/n-run.sh

@@ -0,0 +1,47 @@
+#!/bin/sh
+# B6N harness: ONE modem start (rmtfs + MSS once, registration <= T_REG), then NB bearer cycles without MSS/rmtfs/MM/radio restart:
+#   cycle 1 = the connect done by 'start'; cycles 2..NB = 'start' (reuses rmtfs/MSS/MM, simple-connect only); each: datatest -> 'disconnect'.
+# Then full clean shutdown ('stop'). Stops at the first failure (snapshot before any stop). RAM only.
+NAME=$1; NB=${2:-6}; O=/tmp/$NAME; mkdir -p $O; M="sh /tmp/aurora-modem"; D=/tmp/aurora-modem.d
+export MODEM_CONF=/tmp/n.conf MODEM_KEEP_ON_FAIL=1
+B=/sys/bus/platform/devices/4080000.remoteproc:bam-dmux; RPS=/sys/class/remoteproc/remoteproc0/state
+mask() { sed -E 's/([0-9]{6,})([0-9]{4})/******\2/g'; }
+up() { cut -d' ' -f1 /proc/uptime; }
+mk() { echo "<5>[$NAME] $*" > /dev/kmsg; echo "[$(up)] $*" | tee -a $O/run.log; }
+nv() { for want in modemst1 modemst2 fsg fsc persist; do for p in /sys/class/block/mmcblk0p*; do
+	[ "$(sed -n 's/^PARTNAME=//p' $p/uevent)" = "$want" ] && echo "$want $(basename $p) $(sha256sum /dev/$(basename $p) | cut -d' ' -f1)"; done; done; }
+ERR='Failed to resume|-110|[ (=]-22\b|EAGAIN|Resource temporarily|crash detected|fatal error|[Ww]atchdog|wdog|Oops|Kernel panic|Unable to handle|BUG:'
+nv > $O/nv-before.txt; cat /sys/block/mmcblk0/stat > $O/stat-before.txt; D0=$(dmesg | wc -l); LO=$(wc -l < $D/lifecycle.log 2>/dev/null || echo 0)
+printf 'cycle\tconnect\tipv4\tdns\tping\thttp\thttps\tdisconnect\tstale_routes\twwan_up\tbam_after\tmss\trmtfs\tmm\tusb\temmc_w\tdmesg_err\n' > $O/n-table.tsv
+FAIL=
+for c in $(seq 1 $NB); do
+	X=$O/b$c; mkdir -p $X; mk "BEARER $c begin: mss=$(cat $RPS) rmtfs='$(pidof rmtfs)' mm='$(pidof ModemManager)'"
+	lo=$(wc -l < $D/lifecycle.log 2>/dev/null || echo 0)
+	$M start > $X/start.out 2>&1; SR=$?; mk "BEARER $c start/connect rc=$SR"
+	cp $D/reg-trans.tsv $D/reg-denied-count $D/reg-*.txt $X/ 2>/dev/null; cp $D/ipcfg $X/ 2>/dev/null
+	if [ $SR != 0 ]; then mk "BEARER $c FAILED in $(cat $D/state) - snapshot BEFORE stop"; sh /tmp/j-snap.sh $X/snap > $X/snap.out 2>&1
+		FAIL="start/connect in $(cat $D/state)"; tail -n +$((lo+1)) $D/lifecycle.log | mask > $X/lifecycle.log; break; fi
+	IP=$(sed -n 's/^A=//p' $X/ipcfg)
+	sh /tmp/aurora-modem-datatest $X/dt > $X/dt.out 2>&1; DR=$?; V=$(cat $X/dt/verdict.txt 2>/dev/null); mk "BEARER $c $V"
+	$M disconnect > $X/disc.out 2>&1; PR=$?; mk "BEARER $c disconnect rc=$PR"
+	ST=$(ip route | grep -c " dev wwan"); WU=$(for d in /sys/class/net/wwan*; do [ $(( $(cat $d/flags) & 1 )) -ne 0 ] && echo ${d##*/}; done | tr '\n' ' ')
+	WA=$(for d in /sys/class/net/wwan*; do ip -4 addr show ${d##*/} | grep -q "inet " && echo ${d##*/}; done | tr '\n' ' ')
+	U=$(ping -c2 -W2 172.16.42.2 >/dev/null 2>&1 && echo ok || echo FAIL); E=$(dmesg | tail -n +$((D0+1)) | grep -cE "$ERR")
+	tail -n +$((lo+1)) $D/lifecycle.log | mask > $X/lifecycle.log
+	printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' $c "rc=$SR" "${IP:--}" "$(echo "$V" | grep -oE 'dns=[0-9]')" "$(echo "$V" | grep -oE 'ping=[0-9+]*')" \
+		"$(echo "$V" | grep -oE 'http=code=[0-9]*')" "$(echo "$V" | grep -oE 'https=\[[^]]*\]\([^)]*\)')" "rc=$PR" $ST "${WU:-none}${WA:+ addr:$WA}" "$(cat $B/power/runtime_status)" \
+		"$(cat $RPS)" "$(pidof rmtfs)" "$(pidof ModemManager)" $U "$(awk '{print $5"/"$7}' /sys/block/mmcblk0/stat)" $E >> $O/n-table.tsv
+	F=""; [ $DR = 0 ] || F="$F data"; [ $PR = 0 ] || F="$F disconnect"; [ $ST = 0 ] || F="$F stale-routes"; [ -z "$WU$WA" ] || F="$F wwan"
+	[ $U = ok ] || F="$F usb"; [ $E = 0 ] || F="$F dmesg-errs"; awk '{exit !($5==0 && $7==0)}' /sys/block/mmcblk0/stat || F="$F emmc-writes"
+	[ "$(cat $RPS)" = running ] || F="$F mss-$(cat $RPS)"; [ -n "$(pidof rmtfs)" ] || F="$F rmtfs-gone"
+	mk "BEARER $c RESULT ${F:-PASS}"
+	[ -z "$F" ] || { FAIL="bearer $c:$F"; mk "STOP: bearer $c failure:$F (no shutdown before snapshot)"; sh /tmp/j-snap.sh $X/snap > $X/snap.out 2>&1; break; }
+	sleep 5
+done
+mk "SHUTDOWN (full clean stop): $(cat $D/state)"; $M stop > $O/stop.out 2>&1; SP=$?; sleep 2
+dmesg | tail -n +$((D0+1)) > $O/dmesg-delta.txt; grep -E "$ERR" $O/dmesg-delta.txt > $O/dmesg-errs.txt
+nv > $O/nv-after.txt; cat /sys/block/mmcblk0/stat > $O/stat-after.txt; cmp -s $O/nv-before.txt $O/nv-after.txt && NVR=unchanged || NVR=CHANGED
+tail -n +$((LO+1)) $D/lifecycle.log | mask > $O/lifecycle.log; cp $D/rmtfs.log $O/rmtfs.log 2>/dev/null
+for f in $D/mm-*.log; do [ -f $f ] && mask < $f > $O/$(basename $f); done
+mk "FINAL: ${FAIL:-all bearer cycles PASS}; stop rc=$SP; nv $NVR; emmc $(awk '{print "w="$5" s="$7}' $O/stat-after.txt); mss=$(cat $RPS) rmtfs='$(pidof rmtfs)' mm='$(pidof ModemManager)' bam=$(cat $B/power/runtime_status) wwan-up=$(for d in /sys/class/net/wwan*; do [ $(( $(cat $d/flags) & 1 )) -ne 0 ] && echo ${d##*/}; done | tr '\n' ' ') dmesg-errs=$(wc -l < $O/dmesg-errs.txt) usb=$(ping -c2 -W2 172.16.42.2 >/dev/null 2>&1 && echo ok || echo FAIL)"
+tar -C /tmp -cf /tmp/$NAME.tar $NAME; mk "$NAME-RUN-END"

b6j/n.conf

@@ -0,0 +1,18 @@
+# B6 operator config (sourced by /tmp/aurora-modem). Lifecycle logic is operator-independent;
+# only this file names an operator. No APN auto-selection: empty MODEM_APN => start refuses (exit 2).
+# Proven Beeline (session 22). For T2 use: MODEM_APN=internet and empty USER/PASSWORD/AUTH.
+MODEM_APN=internet.beeline.ru
+MODEM_USER=beeline
+MODEM_PASSWORD=beeline
+MODEM_AUTH=pap
+MODEM_IP_TYPE=ipv4
+# /32 host routes via the bearer interface (in addition to the bearer DNS servers). No default route.
+MODEM_TEST_ROUTES="77.88.8.8 1.1.1.1"
+# --- B6J1 diagnostic lifecycle: minimal proven variant (no holdoff, no MM disable / low-power in stop), rmtfs -s per cycle
+MODEM_REATTACH_HOLDOFF=0
+MODEM_STOP_DISABLE=0
+MODEM_RMTFS_PERSIST=0
+MODEM_REG_SNAP=1
+# --- B6N: J1 lifecycle (rmtfs -r -P -s -v, minimal stop) + registration state machine, deadline 600 s; MSS started ONCE per run
+T_REG=600
+MODEM_REG_SM=1

b6j/n2-boot.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+# 480s side, B6N2 one cold boot K: wait NCM -> push scripts+curl -> clock -> baseline -> n-run.sh n2bK 1 -> fetch n2bK.tar
+K=$1; cd ~/doc/modem/jz08-aurora; L=logs/uart/b6-20260930-160910.log; T=/dev/ttyUSB0
+for i in $(seq 1 100); do ping -c1 -W1 172.16.42.1 >/dev/null 2>&1 && break; sleep 3; done; echo "NCM up after ~$((i*3))s"; sleep 3
+wc -l < $L > /tmp/n2-off-$K
+printf "%s\r" "mkdir -p /tmp/in; nc -l -p 9990 > /tmp/in/n.tar & nc -l -p 9991 > /tmp/in/cu.tar & echo LN2" > $T; sleep 2
+ncat --send-only 172.16.42.1 9990 < b6j/b6j-in6.tar; ncat --send-only 172.16.42.1 9991 < linux/beeline/curl/cu.tar; sleep 1
+printf "%s\r" "cd /tmp && tar xf /tmp/in/n.tar && sha256sum -c SHA256SUMS | grep -vc OK; mkdir -p /tmp/cu && tar -C /tmp/cu -xf /tmp/in/cu.tar; sha256sum /tmp/in/cu.tar; cd /; date -u -s @$(date -u +%s); uptime; cat /proc/cmdline; sh /tmp/ro-check.sh; grep firmware /proc/mounts; echo mss=\$(cat /sys/class/remoteproc/remoteproc0/state) pids=\$(pidof rmtfs ModemManager qmi-proxy udevd dbus-daemon); cut -c1-40 /tmp/nv-before.txt; echo N2-BASE-END; sh /tmp/n-run.sh n2b$K 1 > /tmp/n2-run.out 2>&1 &" > $T
+until grep -aq "n2b$K-RUN-END" $L; do sleep 10; done
+tail -n +$(cat /tmp/n2-off-$K) $L | grep -a -A22 "n2-run.out 2>&1 &$" | head -22 | cut -c1-170; tail -n +$(cat /tmp/n2-off-$K) $L | grep -a "\[n2b$K\]\|REG t+\|registered:" | cut -c1-230
+printf "%s\r" "nc -l -p 9992 < /tmp/n2b$K.tar &" > $T; sleep 2; mkdir -p logs/b6j; ncat --recv-only 172.16.42.1 9992 > logs/b6j/n2b$K.tar; sha256sum logs/b6j/n2b$K.tar

b6j/ro-check.sh

@@ -0,0 +1,4 @@
+#!/bin/sh
+n=0; bad=0; for d in /dev/mmcblk0 /dev/mmcblk0p* /dev/mmcblk0boot*; do [ -b "$d" ] || continue; n=$((n+1)); [ "$(blockdev --getro $d)" = 1 ] || { bad=$((bad+1)); echo "NOT-RO $d"; }; done
+echo "RO-CHECK devices=$n not_ro=$bad"; for p in modemst1 modemst2 fsc fsg persist; do f=$(readlink -f /dev/disk/by-partlabel/$p); echo "$p $f getro=$(blockdev --getro $f)"; done
+awk '{print "emmc writes_completed="$5" sectors_written="$7}' /sys/block/mmcblk0/stat

b6p/B6P-DESIGN.md

@@ -0,0 +1,40 @@
+# B6P — persistent modem integration (P0–P5). Nothing written to flash.
+
+## P0 freeze — proven source
+Proven B6N implementation = `b6j/aurora-modem` aa9e9aa2… (b6j-in6.tar d5b551b5) + n.conf aa9e27af… + `b6j/n.conf` (J1 lifecycle, MODEM_REG_SM=1, T_REG=600).
+Production controller `rootfs/usr/sbin/aurora-modem` = that file with diagnostic code REMOVED only (diff-b6n-vs-b6p.diff):
+- removed: MODEM_RMTFS_PERSIST (J3), MODEM_HOOK_PRE_ONLINE/PRE_MM (B6K AT), MODEM_REG_SNAP, MODEM_STOP_DISABLE branch (mmcli --disable / qmicli low-power;
+  n.conf had it OFF), re-attach holdoff (n.conf had 0), old 180 s wait_for path (REG_SM is now the only path), `rmtfs-stop` command.
+- kept verbatim: start / disconnect / stop / status / addroute, registration state machine reg_sm (local-failure checks, transition log), safety gates,
+  rollback-on-failure (MODEM_KEEP_ON_FAIL=0 default), stop order.
+- changed: config file `/etc/aurora/modem.conf` (APN/USER/PASSWORD/AUTH/IP_TYPE/REG_TIMEOUT/ROUTES → mapped to the internal MODEM_* names);
+  state dir `/run/aurora-modem` (was /tmp/aurora-modem.d); rmtfs start check counts new 'registering services' lines (old: grep of an appended log
+  could match a previous run's line).
+- `diff-old-b6-vs-b6p.diff`: vs the original b6/ (session 28) for reference.
+
+## P1 runtime
+boot → /init: eMMC all RO → NV snapshot → /firmware vfat RO + firmware path → USB NCM 172.16.42.1 → `/etc/init.d/aurora-modem start` (background)
+→ controller: RO gates → rmtfs -r -P -s -v → MSS → wwan0qmi0 +2 s → SIM ready → DMS online → reg_sm (registered + PS attached, ≤600 s)
+→ udevd/dbus/polkitd/ModemManager → simple-connect → IPv4 on wwanN + /32 routes (bearer DNS + ROUTES), no default route, usb0 untouched.
+MSS/rmtfs/MM stay up. Reconnect: `aurora-modem disconnect` + `aurora-modem start` (MSS not restarted).
+Shutdown: `/etc/init.d/aurora-modem stop` = bearer disconnect → routes → wwan DOWN → MM stop → BAM suspended → rmtfs SIGTERM → MSS offline → rmtfs exits last.
+No automatic retry of MSS/rmtfs. On failure the controller rolls back with a full stop and the service stays idle.
+
+## P2 audit (golden mm1, initramfs 250bf8ee)
+- OpenRC: NOT present (no openrc, no /etc/init.d, no runlevels). PID 1 = custom `/init` (busybox sh): proc/sys/devtmpfs/configfs, eMMC setro + verify,
+  NV snapshot (/tmp/nv-before.txt), by-partlabel symlinks, modem FAT RO at /firmware, firmware_class path, USB gadget NCM, eMMC report, then endless UART shell.
+- udev/dbus/polkit/MM: not started at boot (only by bin/mm-up or the controller). Packages: 36 Alpine v3.24 apks (linux/initramfs-mm1/dl), rmtfs 1.3, busybox-static 1.37.
+- Decision (user, 2026-09-30): no OpenRC; one service script `/etc/init.d/aurora-modem` (start|stop|status) called once from /init. Kill switch: cmdline `aurora.modem=off`.
+
+## P3 config — /etc/aurora/modem.conf (Beeline test profile; operator-published default credentials, not private)
+
+## P4 time
+Controller timing uses /proc/uptime only; LTE start/bearer do not need wall time. RAM tests check DNS/ICMP/HTTP; HTTPS optional (skipped by datatest when year < 2026).
+RTC untouched, no NTP.
+
+## P5 candidate
+`out/aurora-mm1-b6p.img` (build-candidate.sh): kernel payload = golden Image.gz-dtb (0ff9c802), same header/addresses/cmdline, ramdisk =
+golden initramfs.cpio.gz (exact 11 944 942 bytes, 250bf8ee) + appended gzip member overlay.cpio.gz (kernel unpacks concatenated archives; later entry
+replaces /init). Golden itself is not rebuildable bit-for-bit from the current tree (built without -t → source mtimes; bin/b4b2-mm edited later),
+hence the append approach. mkbootimg.py reproduces golden 38c960ef bit-for-bit from golden inputs (checked in the build).
+Manifest diff (out/manifest-diff.txt): REPLACES /init; NEW /usr/sbin/aurora-modem, /etc/init.d/aurora-modem, /etc/aurora/modem.conf, dirs etc/aurora, etc/init.d.

b6p/B6P-PREFLIGHT.md

@@ -0,0 +1,36 @@
+# B6P P9 preflight — STOP before the first persistent write (cache). Nothing has been written.
+(Paths relative to ~/doc/modem/jz08-aurora on 480s; SHA256SUMS in b6p/.)
+
+1. Proven B6N files: b6j/aurora-modem aa9e9aa2 + b6j/n.conf aa9e27af (b6j-in6.tar d5b551b5; B6N N1 6/6, N2 3/3).
+2. Production layout (initramfs overlay): /usr/sbin/aurora-modem 6e922dec (B6N controller minus diagnostics, diff-b6n-vs-b6p.diff),
+   /etc/aurora/modem.conf 6ffb206e (APN/USER/PASSWORD/AUTH/IP_TYPE/REG_TIMEOUT=600/ROUTES), state /run/aurora-modem.
+3. Service: /etc/init.d/aurora-modem 533f47ea (start|stop|status; no OpenRC by decision), started once by /init 9d6694fb
+   after EMMC_RO_OK + B1_OK (/init diff = 2 comment/banner lines + 2-line hook); kill switch cmdline aurora.modem=off.
+4. Initramfs manifest diff (out/manifest-diff.txt): golden 472 entries untouched (exact 250bf8ee bytes) + overlay member 651fc826:
+   REPLACES /init; NEW /usr/sbin/aurora-modem, /etc/init.d/aurora-modem, /etc/aurora/modem.conf, dirs /etc/aurora, /etc/init.d.
+5. RAM candidate: b6p/out/aurora-mm1-b6p.img 20 617 216 B 18a25e399c96afaf22e8e84e0d7c8fef18518bb427c9a36440ad6435f71b9090
+   (initramfs-b6p.cpio.gz 11 955 862 B 8dcb61c8…; kernel/DTB/cmdline/header == golden 38c960ef, writer reproduces golden bit-for-bit).
+6. RAM tests (fastboot boot via RESET-held power-on, lk1st autoboot): P6 + P7 = 3/3 fresh boots PASS, autostart at ~10 s with 1970 clock,
+   registration 3.6 / 10.1 / 6.9 s, START OK 62.8 / 77.9 / 75.6 s, DNS/ICMP/HTTP PASS, P6 3/3 disconnect→reconnect without MSS restart,
+   service stop rc=0 each boot, NV unchanged, eMMC writes 0, dmesg errors 0, NCM ok, no MSS retry. Logs logs/b6p/{p6,p7b2,p7b3}.
+7. Cache image: b6p/cache-extlinux-b6p.img 134 217 728 B 9fea693a436b49ca56aed0857725ecdde8a0071700cf5d23b02dab9d9ff406b7
+   (mkfs-cache-b6p.sh = B5b recipe; rebuild identical; the B5b recipe still reproduces 409bbb11 on 480s). ext2 rev1, features filetype sparse_super
+   only, 4K, 64 inodes, e2fsck -fn clean. extlinux.conf 391e753b: default/label b6p, linux /Image.gz-dtb (0ff9c802), fdt /aurora-mm1.dtb (a10056c5),
+   initrd /initramfs-b6p.cpio.gz (8dcb61c8), append == golden cmdline.
+8. lk2nd 23.1 emulator (b5b/emu, real boot.c/extlinux.c/ext2/bio/zlib): harness regression S1 == session 26; S3 B6P: "Trying to boot 'b6p'" →
+   boot_linux kernel 4603b02f @+0 (end +0x1680000), DTB a10056c5 @+0x2499000, ramdisk 8dcb61c8 @+0x2699000 (11 955 862), cmdline exact;
+   F1–F11 (no conf/kernel/initrd/dtb, garbage/CRLF/no-fdt/no-newline conf, bad gzip, zeroed cache, bad superblock) → all "Reverting to android boot" (emmc1).
+   Not emulated (residual): LK hang on corrupt metadata; ASSERT in boot_linux DT; Linux starts but crashes (no fallback).
+9. Current cache/backup: live cache (read-only on the board 20:48, P9 run) = 409bbb11 == b5b/cache-extlinux-mm1.img == logs/b5b/W/11-cache-readback.bin.
+   Live also: boot e9579f33, aboot 3b8cd266, sbl1 6a661ec9, rpm 5a9b857b, tz 8481892f, hyp 1a963047, recovery 0dfa60a0, modemst1 637a71d1,
+   modemst2 9bb10190, fsg b0a3b7e4, fsc 5f70bf18, persist ee48a843 (== A3); eMMC writes 0 (p9-live-sha.txt).
+10. Write (after GO only; HW EDL: battery on, D+→GND, plug USB, release; on 480s): `bash b6p/B6P-write.sh`
+    = b5b/B5b-write.sh with only NEW/OLD hashes, rollback-image gates and log dir changed: gates (loader 53f19350, candidate 9fea693a, rollback image
+    409bbb11, 9008, serial, cache geometry 0x4118c000/0x8000000, GPT == A3, boot == e9579f33, aboot == 3b8cd266, cache == 409bbb11)
+    → `edl --loader=<fhprg_peek> w cache b6p/cache-extlinux-b6p.img` (LBA 2133088, 262144 sectors).
+11. Readback: `edl r cache logs/b6p/W/11-cache-readback.bin` + `cmp` with the candidate (CACHE_MATCH), then GPT p/b, tzbak, boot, aboot,
+    sbl1, rpm, tz, hyp, recovery, modemst1/2, fsg, fsc, persist == A3 and modem, system, userdata == A4pre.
+12. Rollback: `bash b6p/B6P-rollback.sh` (HW EDL) → cache := b5b/cache-extlinux-mm1.img 409bbb11 + readback cmp (CACHE_RESTORED_B5B).
+    Independent fallback without any write: any extlinux failure → lk1st boots emmc1 from `boot`; RESET-held power-on → fastboot → `fastboot boot` golden.
+13. Untouched: boot (emmc1 fallback), aboot, GPT, sbl1, rpm, tz, hyp, recovery, modem, modemst1/2, fsg, fsc, persist, system, userdata. Only `cache`.
+Post-write plan (for the GO message): power off fully; cold boot ×N without host → extlinux 'b6p' → autostart → registration → bearer → data.

b6p/B6P-rollback.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+# B6P rollback — restore the B5b cache (ext2 extlinux -> exact golden mm1, 409bbb11). Needs 9008 via HW EDL (D+->GND). boot/aboot untouched.
+# After this, power-on boots golden mm1 via extlinux again. (Deeper rollback to stock Android cache: b5b/B5b-rollback.sh, 817118e4.)
+cd ~/doc/modem/jz08-aurora || exit 1
+L=firehose/007050e100000000_394a2e47cf830150_fhprg_peek.bin ; O=logs/b6p/rollback ; mkdir -p $O
+B=b5b/cache-extlinux-mm1.img
+[ "$(sha256sum $B | cut -d' ' -f1)" = 409bbb11c34d95c867c5cc1a33a686a7ecd5fcb4d43b5c592f334cd402114ed9 ] || { echo "STOP: rollback image hash"; exit 1; }
+edl --loader=$L printgpt > $O/00-printgpt.log 2>&1
+edl --loader=$L w cache $B > $O/cache-w.log 2>&1
+edl --loader=$L r cache $O/cache-rb.bin > /dev/null 2>&1 ; cmp $B $O/cache-rb.bin && echo CACHE_RESTORED_B5B
+sha256sum $B $O/cache-rb.bin

b6p/B6P-write.sh

@@ -0,0 +1,48 @@
+#!/bin/bash
+# B6P — the ONLY write: cache := ext2 extlinux -> B6P candidate (golden kernel/DTB/cmdline + B6P initramfs). Run on 480s ONLY after explicit GO.
+# Derived from b5b/B5b-write.sh (used for the B5b write, CACHE_MATCH); only image, expected hashes and log dir changed.
+# Entry: HW EDL (battery on, D+->GND, plug USB, release). Never `edl reset`. Stops at first failed gate.
+cd ~/doc/modem/jz08-aurora || exit 1
+L=firehose/007050e100000000_394a2e47cf830150_fhprg_peek.bin
+O=logs/b6p/W ; A3=logs/b5a/A3 ; P=logs/b5a/A4pre ; mkdir -p $O
+NEW=b6p/cache-extlinux-b6p.img            ; NEW_SHA=9fea693a436b49ca56aed0857725ecdde8a0071700cf5d23b02dab9d9ff406b7
+OLD_SHA=409bbb11c34d95c867c5cc1a33a686a7ecd5fcb4d43b5c592f334cd402114ed9   # current cache = B5b golden-mm1 extlinux
+BOOT_SHA=e9579f33c7304cd47f487f2b61cd9226dc04fd3a63775d62b4b95fc15bd3ebff
+ABOOT_SHA=3b8cd2667837fc7083cb28991d849f9b408a07fa743bfd05eafee7b053760f85
+die(){ echo "STOP: $*"; exit 1; }
+sha(){ sha256sum "$1" | cut -d" " -f1; }
+E(){ edl --loader=$L "$@"; }
+echo "== G0 inputs"
+[ "$(sha $L)" = 53f193500c03248f0d671ab57bfe9ca8a42967e97f28403294b4b3f854075aca ] || die loader
+[ "$(sha $NEW)" = $NEW_SHA ] && [ $(stat -c %s $NEW) = 134217728 ] || die candidate
+[ "$(sha b5b/cache-extlinux-mm1.img)" = $OLD_SHA ] || die rollback-image
+[ "$(sha logs/b5b/W/11-cache-readback.bin)" = $OLD_SHA ] || die b5b-readback-backup
+lsusb | grep -q 05c6:9008 || die "no 9008"
+echo "== G1 identity + geometry + baseline"
+E printgpt > $O/00-printgpt.log 2>&1 || die printgpt
+grep -aq "Serial: *0x<SAHARA_SERIAL>" $O/00-printgpt.log || grep -aq "Mode detected: firehose" $O/00-printgpt.log || die serial
+grep -a "^cache:" $O/00-printgpt.log | grep -q "Offset 0x000000004118c000, Length 0x0000000008000000" || die cache-geometry
+E rs 0 34 $O/pre-gptp.bin >/dev/null 2>&1; cmp $O/pre-gptp.bin $A3/gpt-primary-34.bin || die gpt-changed
+E r boot  $O/pre-boot.bin  >/dev/null 2>&1; [ "$(sha $O/pre-boot.bin)"  = $BOOT_SHA ]  || die boot-not-emmc1
+E r aboot $O/pre-aboot.bin >/dev/null 2>&1; [ "$(sha $O/pre-aboot.bin)" = $ABOOT_SHA ] || die aboot-not-autoboot
+E r cache $O/pre-cache.bin >/dev/null 2>&1; [ "$(sha $O/pre-cache.bin)" = $OLD_SHA ]  || die cache-not-backup
+echo "== W cache := candidate (LBA 2133088, 262144 sectors)"
+E w cache $NEW > $O/10-cache-write.log 2>&1; echo "rc=$?"; grep -a "Wrote" $O/10-cache-write.log
+E r cache $O/11-cache-readback.bin > $O/11-cache-readback.log 2>&1 || die readback-rc
+sha256sum $NEW $O/11-cache-readback.bin
+cmp $NEW $O/11-cache-readback.bin || die "CACHE READBACK MISMATCH — do NOT reboot; run b6p/B6P-rollback.sh"
+echo CACHE_MATCH
+echo "== V everything else unchanged"
+E rs 0 34        $O/post-gptp.bin  >/dev/null 2>&1; cmp $O/post-gptp.bin  $A3/gpt-primary-34.bin || die gptp
+E rs 7634911 33  $O/post-gptb.bin  >/dev/null 2>&1; cmp $O/post-gptb.bin  $A3/gpt-backup-33.bin  || die gptb
+E rs 305184 1024 $O/post-tzbak.bin >/dev/null 2>&1; cmp $O/post-tzbak.bin $A3/tzbak-305184.bin   || die tzbak
+E r boot  $O/post-boot.bin  >/dev/null 2>&1; [ "$(sha $O/post-boot.bin)"  = $BOOT_SHA ]  || die boot
+E r aboot $O/post-aboot.bin >/dev/null 2>&1; [ "$(sha $O/post-aboot.bin)" = $ABOOT_SHA ] || die aboot
+for p in sbl1 rpm tz hyp recovery modemst1 modemst2 fsg fsc persist; do
+  E r $p $O/post-$p.bin >/dev/null 2>&1; cmp $O/post-$p.bin $A3/$p.bin || die "$p changed"; echo "$p == A3"
+done
+for p in modem system userdata; do
+  E r $p $O/post-$p.bin >/dev/null 2>&1; cmp $O/post-$p.bin $P/$p.bin || die "$p changed"; echo "$p == A4pre"; rm -f $O/post-$p.bin
+done
+(cd $O && sha256sum *.bin > SHA256SUMS)
+echo "B6P_WRITE_VERIFIED — power off fully (USB, then battery) before first boot"

b6p/SHA256SUMS

@@ -0,0 +1,16 @@
+18a25e399c96afaf22e8e84e0d7c8fef18518bb427c9a36440ad6435f71b9090  out/aurora-mm1-b6p.img
+8dcb61c8d839e8709c17abb2736f69a0ca4d0a689d931e79ddacaaf59933f5b9  out/initramfs-b6p.cpio.gz
+651fc826bebb789770faa22ab18edfcb883f267cb3c1dcfde784d1b030919258  out/overlay.cpio.gz
+9fea693a436b49ca56aed0857725ecdde8a0071700cf5d23b02dab9d9ff406b7  cache-extlinux-b6p.img
+391e753b8b4b7da6003f79f1f8565698625029a301436b76c95df2f9effb7968  extlinux-b6p.conf
+9d6694fbe35f9803c1de2ea35317cf0e67ee67464573395b50d732949d19c794  rootfs/init
+6e922dec3675891a652dfe6315006dd477728ed56ffd7253e35aacaa21ccf8ac  rootfs/usr/sbin/aurora-modem
+533f47eaaf966aaae36a2b799e506319eb7ee212366bc2c67d46068d64b78998  rootfs/etc/init.d/aurora-modem
+6ffb206e58c93236000d564adaa7629a9a70ea791a50fce59f8fffcefa3da212  rootfs/etc/aurora/modem.conf
+400420caa3f13c99bc18bfa8431e58665146f4088c44c2a488315df2804513e7  build-candidate.sh
+8fd4968ba3f08909d79b53c39647ef99fb836ea12e0c5641506b9d88da63941a  mkbootimg.py
+5aed6e3b86ffdb62c1ce2be56e5f162c5cc4334242eadeb9bdc5252f62759cb1  mkfs-cache-b6p.sh
+151c0498406959ffadf9a7ba4bdd5a9a448628a5a791a0437f23b91b9b92f7cb  B6P-write.sh
+2d2532f08f1595d1283ab84ed1f8530002ed4049c8b4292de360da4b834730e9  B6P-rollback.sh
+5b023d451e50d297d4d40537fc82985fa83fb948b67a1d3f58eb464f0100d46c  p-test.tar
+1f3ace506c598083243bca0b49f26e8e2fae4f79311568585db26c264cebc08d  p7-boot.sh

b6p/build-candidate.sh

@@ -0,0 +1,28 @@
+#!/bin/sh
+# B6P candidate build: golden mm1 kernel/DTB/cmdline + golden initramfs.cpio.gz (exact bytes) + appended B6P overlay cpio.gz.
+set -e; cd "$(dirname "$0")"; G=../linux/artifacts/ramboot-mm1; GI=../linux/initramfs-mm1; O=out; mkdir -p $O
+GEN=../linux/out/usr/gen_init_cpio; TS=1790726400	# fixed overlay mtime (2026-09-30 00:00 UTC)
+sha256sum -c golden.sha256
+# 0. prove the image writer reproduces golden bit-for-bit
+python3 ../tools/bootimg.py $G/aurora-mm1.img $O/golden-unpack > /dev/null
+python3 mkbootimg.py $O/golden-unpack/kernel $G/initramfs.cpio.gz $G/cmdline.txt $O/golden-rebuilt.img
+cmp $O/golden-rebuilt.img $G/aurora-mm1.img && echo "mkbootimg: golden reproduced bit-for-bit"
+# 1. overlay cpio
+cat > $O/overlay.list <<LIST
+dir /etc 0755 0 0
+dir /etc/aurora 0755 0 0
+dir /etc/init.d 0755 0 0
+dir /usr 0755 0 0
+dir /usr/sbin 0755 0 0
+dir /run 0755 0 0
+file /init rootfs/init 0755 0 0
+file /usr/sbin/aurora-modem rootfs/usr/sbin/aurora-modem 0755 0 0
+file /etc/init.d/aurora-modem rootfs/etc/init.d/aurora-modem 0755 0 0
+file /etc/aurora/modem.conf rootfs/etc/aurora/modem.conf 0644 0 0
+LIST
+$GEN -t $TS $O/overlay.list > $O/overlay.cpio
+gzip -9 -n -c $O/overlay.cpio > $O/overlay.cpio.gz
+cat $G/initramfs.cpio.gz $O/overlay.cpio.gz > $O/initramfs-b6p.cpio.gz
+python3 mkbootimg.py $O/golden-unpack/kernel $O/initramfs-b6p.cpio.gz $G/cmdline.txt $O/aurora-mm1-b6p.img
+sha256sum $O/overlay.cpio $O/overlay.cpio.gz $O/initramfs-b6p.cpio.gz $O/aurora-mm1-b6p.img rootfs/init rootfs/usr/sbin/aurora-modem rootfs/etc/init.d/aurora-modem rootfs/etc/aurora/modem.conf > $O/SHA256SUMS
+ls -l $O/aurora-mm1-b6p.img $O/initramfs-b6p.cpio.gz $O/overlay.cpio.gz

b6p/cache-components.sha256

@@ -0,0 +1,4 @@
+0ff9c802346697a029aea28e6f571fa669c8907c8c73430c2c2639e388ad82a3  ../b5b/components/Image.gz-dtb
+a10056c50a6cc89dd14c3a418fc1de4ed4b21986f4661ad959184fc0e6ab2c7b  ../b5b/components/aurora-mm1.dtb
+cc54d780cca61927b0b98d638f5ef304a0b65d688f4b2ae40f990a8e7a5d68e3  ../b5b/components/cmdline.txt
+8dcb61c8d839e8709c17abb2736f69a0ca4d0a689d931e79ddacaaf59933f5b9  out/initramfs-b6p.cpio.gz

b6p/diff-b6n-vs-b6p.diff

@@ -0,0 +1,167 @@
+--- b6j/aurora-modem	2026-09-30 22:02:25.214198989 +0600
++++ b6p/rootfs/usr/sbin/aurora-modem	2026-09-30 22:24:42.244902667 +0600
+@@ -1,27 +1,17 @@
+ #!/bin/sh
+-# B6 RAM-only modem lifecycle controller for Aurora (golden mm1). Lives in /tmp only.
+-#   aurora-modem start | stop | status | addroute <ipv4>
+-# Reconstructs the proven flow (NOTES sessions 14-22 Aurora, JZ02 stopcycle/wwanfix/openrc):
+-#   start: RO gates -> rmtfs -r -P -s -v (rmtfs -s starts MSS) -> MSS running -> wwan0qmi0+wwan0 (+2 s, JZ02 port-race guard)
+-#          -> qmicli -p DMS online (one SET, only if not online) -> NAS registered + PS attached -> kill qmi-proxy
+-#          -> udevd/dbus/polkitd/ModemManager -> MM modem registered -> ONE simple-connect -> bearer IPv4 on wwanN
+-#          + /32 host routes only (no default route, usb0 untouched).
+-#   stop:  simple-disconnect -> MM disable (radio low-power = detach) -> del our /32 routes, flush+down all wwan* -> stop MM (+qmi-proxy) -> BAM-DMUX suspended
+-#          -> SIGTERM rmtfs: rmtfs writes "stop" to remoteproc state (MSS stops while rmtfs still serves) -> rmtfs exits LAST.
+-# Never writes eMMC/NV: rmtfs -r keeps EFS writes in RAM; the script refuses to run unless the NV partitions are getro=1.
+-# B6J diagnostic knobs (all RAM-only, set in $CONF):
+-#   MODEM_STOP_DISABLE=0   stop skips mmcli --disable / qmicli low-power (J1/J3: back to the minimal proven stop)
+-#   MODEM_RMTFS_PERSIST=1  long-lived rmtfs: 'rmtfs -r -P -v' (no -s) started once, MSS via remoteproc sysfs start/stop,
+-#                          stop leaves rmtfs alive; 'aurora-modem rmtfs-stop' ends it (only with MSS offline)
+-#   MODEM_HOOK_PRE_ONLINE / MODEM_HOOK_PRE_MM  shell commands run right before DMS online SET / before udevd+MM start (B6K AT capture)
+-#   MODEM_REG_SM=1         registration state machine (B6M): wait up to T_REG for registered+PS attached; searching/limited/detached and
+-#                          transient registration-denied are NOT failures; immediate FAIL only on local errors (MSS/QMI dev/SIM/rmtfs/BAM/SSR/USB);
+-#                          transitions (state or cell change) logged to $D/reg-trans.tsv
+-#   MODEM_REG_SNAP=1       save read-only NAS system-info/cell-location/rf-band right after registration
++# Aurora (JZ08AU, MSM8916) modem lifecycle controller - B6P production build of the B6N-proven controller (b6j/aurora-modem).
++#   aurora-modem start | disconnect | stop | status | addroute <ipv4>
++#   start:      [rmtfs -r -P -s -v -> MSS -> wwan0qmi0 (+2 s port-race guard) -> SIM ready -> DMS online (one SET, retried only on DeviceNotReady)
++#               -> registration state machine (registered + PS attached, deadline REG_TIMEOUT, default 600 s)]  (skipped when rmtfs+MSS already run)
++#               -> udevd/dbus/polkitd/ModemManager (reused if running) -> ONE simple-connect -> bearer IPv4 on wwanN + /32 routes only (no default route).
++#   disconnect: simple-disconnect, our routes, flush+down all wwan*, wait BAM-DMUX suspended. MSS, rmtfs, MM and radio stay up; 'start' reconnects.
++#   stop:       disconnect -> stop MM (+qmi-proxy) -> BAM-DMUX suspended -> SIGTERM rmtfs (rmtfs writes 'stop' -> MSS offline) -> rmtfs exits last.
++# Never writes eMMC/NV: rmtfs -r keeps EFS writes in RAM; refuses to start unless modemst1/2, fsc, fsg, persist, mmcblk0 are getro=1 and /firmware is ro.
++# Does not need a valid wall clock (all timing from /proc/uptime). No automatic MSS/rmtfs retry.
+ # Exit: 0 ok, 1 failure/timeout (start rolls back with a full stop unless MODEM_KEEP_ON_FAIL=1), 2 usage/config error.
+ 
+-CONF=${MODEM_CONF:-/tmp/aurora-modem.conf}
+-D=/tmp/aurora-modem.d; mkdir -p $D
++CONF=${MODEM_CONF:-/etc/aurora/modem.conf}
++D=/run/aurora-modem; mkdir -p $D
+ LOG=$D/lifecycle.log; STATE=$D/state; ROUTES=$D/routes; BEARER=$D/bearer
+ RPNAME=4080000.remoteproc
+ BAM=/sys/bus/platform/devices/4080000.remoteproc:bam-dmux
+@@ -29,11 +19,10 @@
+ 
+ # --- timeouts (s); override in $CONF
+ T_RMTFS=5 T_MSS=60 T_QMI_DEV=30 T_QMI=45 T_SIM=60 T_ONLINE=30 T_REG=180 T_MM_DETECT=150 T_MM_REG=60 T_CONNECT=150
+-MODEM_REATTACH_HOLDOFF=120	# s between radio stop and next MSS start (B6: re-attach <=61 s after stop was rejected 3/3 by Beeline)
+-MODEM_STOP_DISABLE=1 MODEM_RMTFS_PERSIST=0 MODEM_REG_SNAP=0 MODEM_HOOK_PRE_ONLINE= MODEM_HOOK_PRE_MM= MODEM_REG_SM=0
+ T_DISCONNECT=60 T_DISABLE=30 T_MM_EXIT=30 T_BAM_IDLE=15 T_MSS_STOP=30 T_RMTFS_EXIT=15
+-MODEM_APN= MODEM_USER= MODEM_PASSWORD= MODEM_AUTH= MODEM_IP_TYPE=ipv4 MODEM_TEST_ROUTES= KEEP=${MODEM_KEEP_ON_FAIL:-0}
++APN= USER= PASSWORD= AUTH= IP_TYPE=ipv4 REG_TIMEOUT=600 ROUTES= KEEP=${MODEM_KEEP_ON_FAIL:-0}
+ [ -f "$CONF" ] && . "$CONF"
++MODEM_APN=$APN MODEM_USER=$USER MODEM_PASSWORD=$PASSWORD MODEM_AUTH=$AUTH MODEM_IP_TYPE=${IP_TYPE:-ipv4} MODEM_TEST_ROUTES=$ROUTES T_REG=${REG_TIMEOUT:-600}
+ MODEM_KEEP_ON_FAIL=${MODEM_KEEP_ON_FAIL:-$KEEP}
+ 
+ mmc() { mmcli "$@" 2>/dev/null | tr -d '\033' | sed 's/\[[0-9;]*m//g'; }	# mmcli colours values even without a tty
+@@ -154,32 +143,14 @@
+ 
+ 	# OFF -> RMTFS_READY -> MPSS_BOOTING -> MPSS_RUNNING
+ 	if [ -n "$(rmtfs_pid)" ] && mss_is running; then log "rmtfs $(rmtfs_pid) + MSS running already - reuse"
+-	elif [ "$MODEM_RMTFS_PERSIST" = 1 ] && mss_is offline; then
+-		: > $ROUTES; rm -f $D/ipcfg
+-		if [ -z "$(rmtfs_pid)" ]; then
+-			n0=$(grep -c 'registering services' $D/rmtfs.log 2>/dev/null)
+-			LD_PRELOAD=/usr/lib/linebuf.so rmtfs -r -P -v >> $D/rmtfs.log 2>&1 &
+-			echo $! > $D/rmtfs.pid
+-			wait_for $T_RMTFS 0.2 sh -c "kill -0 $(cat $D/rmtfs.pid) 2>/dev/null && [ \$(grep -c 'registering services' $D/rmtfs.log) -gt ${n0:-0} ]" \
+-				|| fail_start "rmtfs did not start (pid $(cat $D/rmtfs.pid))"
+-			log "long-lived rmtfs started: pid $(rmtfs_pid) (rmtfs -r -P -v, no -s)"
+-		else log "long-lived rmtfs reused: pid $(rmtfs_pid)"; fi
+-		setstate RMTFS_READY
+-		setstate MPSS_BOOTING
+-		t=$(now); (echo start > $(rp)/state) >> $LOG 2>&1 &
+-		wait_for $T_MSS 0.2 mss_is running || fail_start "MSS not running after ${T_MSS}s (state $(mss_state))"
+-		log "MSS running after $(since $t)s (sysfs start)"
+ 	elif [ -n "$(rmtfs_pid)" ] || ! mss_is offline; then
+ 		log "FAIL: inconsistent (rmtfs='$(rmtfs_pid)' MSS=$(mss_state)); run stop first"; exit 1
+ 	else
+-		if [ -f $D/last-radio-stop ]; then
+-			w=$(awk -v a="$(now)" -v b="$(cat $D/last-radio-stop)" -v h="$MODEM_REATTACH_HOLDOFF" 'BEGIN{d=h-(a-b); printf "%d", (d>0)?d+1:0}')
+-			[ "$w" -gt 0 ] && { log "re-attach holdoff: last radio stop $(since $(cat $D/last-radio-stop))s ago, waiting ${w}s (MODEM_REATTACH_HOLDOFF=$MODEM_REATTACH_HOLDOFF)"; sleep $w; }
+-		fi
+ 		: > $ROUTES; rm -f $D/ipcfg
++		n0=$(grep -c 'registering services' $D/rmtfs.log 2>/dev/null)
+ 		LD_PRELOAD=/usr/lib/linebuf.so rmtfs -r -P -s -v >> $D/rmtfs.log 2>&1 &
+ 		echo $! > $D/rmtfs.pid
+-		wait_for $T_RMTFS 0.2 sh -c "kill -0 $(cat $D/rmtfs.pid) 2>/dev/null && grep -q 'registering services' $D/rmtfs.log" \
++		wait_for $T_RMTFS 0.2 sh -c "kill -0 $(cat $D/rmtfs.pid) 2>/dev/null && [ \$(grep -c 'registering services' $D/rmtfs.log) -gt ${n0:-0} ]" \
+ 			|| fail_start "rmtfs did not start (pid $(cat $D/rmtfs.pid))"
+ 		setstate RMTFS_READY
+ 		setstate MPSS_BOOTING
+@@ -203,7 +174,6 @@
+ 		setstate QMI_READY; log "DMS $(grep -o "Mode: '[^']*'" $D/qmi-mode.txt) after $(since $t)s"
+ 		t=$(now); wait_for $T_SIM 1 sim_ready || fail_start "SIM/USIM not ready after ${T_SIM}s ($(grep -E "Card state|Application state" $D/qmi-uim.txt | head -2 | tr -s ' \t\n' ' '))"
+ 		setstate SIM_READY; log "UIM card present, USIM app ready after $(since $t)s"
+-		[ -n "$MODEM_HOOK_PRE_ONLINE" ] && { sh -c "$MODEM_HOOK_PRE_ONLINE" >> $LOG 2>&1; log "pre-online hook rc=$?"; }
+ 		if ! grep -q "Mode: 'online'" $D/qmi-mode.txt; then
+ 			log "SET: $Q --dms-set-operating-mode=online (retried only on DeviceNotReady, <= ${T_ONLINE}s)"
+ 			rm -f $D/qmi-set.err; t=$(now); wait_for $T_ONLINE 1 set_online || fail_start "SET online: DeviceNotReady for ${T_ONLINE}s"
+@@ -212,21 +182,15 @@
+ 			log "DMS online after $(since $t)s"
+ 		fi
+ 		setstate RADIO_ONLINE
+-		if [ "$MODEM_REG_SM" = 1 ]; then
+-			t=$(now); reg_sm $t; rr=$?
+-			[ $rr = 2 ] && fail_start "LOCAL FAILURE during registration: $(cat $D/reg-fail)"
+-			[ $rr = 1 ] && fail_start "$(cat $D/reg-fail)"
+-		else
+-		t=$(now); wait_for $T_REG 2 qmi_reg || fail_start "not registered+PS attached after ${T_REG}s ($(grep -E "Registration state" $D/qmi-ss.txt | tr -s ' \t'))"
+-		fi
++		t=$(now); reg_sm $t; rr=$?
++		[ $rr = 2 ] && fail_start "LOCAL FAILURE during registration: $(cat $D/reg-fail)"
++		[ $rr = 1 ] && fail_start "$(cat $D/reg-fail)"
++
+ 		log "registered: $(grep -oE "(MCC|MNC|Description): '[^']*'" $D/qmi-ss.txt | tr '\n' ' ')after $(since $t)s"
+ 		setstate REGISTERED
+-		[ "$MODEM_REG_SNAP" = 1 ] && for a in nas-get-system-info nas-get-cell-location-info nas-get-rf-band-info nas-get-signal-info; do
+-			timeout 20 $Q --$a > $D/reg-$a.txt 2>&1; done
+ 		killall qmi-proxy 2>/dev/null; wait_for 5 0.2 sh -c '! pidof qmi-proxy >/dev/null'
+ 	fi
+ 
+-	[ -n "$MODEM_HOOK_PRE_MM" ] && { sh -c "$MODEM_HOOK_PRE_MM" >> $LOG 2>&1; log "pre-MM hook rc=$?"; }
+ 	# -> MM_READY  (mm-up order: udevd, trigger, settle, dbus, polkitd, ModemManager)
+ 	pidof udevd >/dev/null || { udevd --daemon; udevadm trigger --action=add; udevadm settle --timeout=15; log "udevd started"; }
+ 	if ! pidof dbus-daemon >/dev/null; then
+@@ -282,15 +246,6 @@
+ 	if [ -n "$(mm_pid)" ] && mm_has_modem; then
+ 		timeout $T_DISCONNECT mmcli -m "$(mm_idx)" --simple-disconnect >> $LOG 2>&1; log "simple-disconnect rc=$? (bearers: $(bearers | tr '\n' ' '))"
+ 		wait_for 15 1 sh -c "! sh $0 _anyconn" && log "no bearer connected" || { log "WARNING: bearer still connected"; rc=1; }
+-		# 1b. radio off / network detach before MSS goes away (B6 addition: abrupt MSS stop while EPS-attached
+-		#     was followed by attach rejection 'limited' on quick restart). MM disable = DMS low-power.
+-		if [ "$MODEM_STOP_DISABLE" = 1 ]; then
+-		timeout $T_DISABLE mmcli -m "$(mm_idx)" --disable >> $LOG 2>&1; r=$?
+-		wait_for 10 0.5 sh -c "[ \"\$(sh $0 _mmstate)\" = disabled ]" && log "MM disable rc=$r -> state disabled (radio low-power, detached)" \
+-			|| { log "WARNING: MM disable rc=$r state '$(mm_state)'"; rc=1; }
+-		else log "MODEM_STOP_DISABLE=0: no MM disable"; fi
+-	elif [ "$MODEM_STOP_DISABLE" = 1 ] && [ -e /dev/wwan0qmi0 ] && mss_is running; then
+-		timeout 20 $Q --dms-set-operating-mode=low-power >> $LOG 2>&1; log "qmicli low-power rc=$? (MM not running)"
+ 	fi
+ 	# 2. our /32 routes, 3. flush + DOWN every wwan*
+ 	for h in $(cat $ROUTES 2>/dev/null); do ip route del $h/32 2>/dev/null; done; : > $ROUTES
+@@ -316,14 +271,7 @@
+ 	fi
+ 	# 6. MSS stop via rmtfs -s (SIGTERM -> pwrite "stop" to remoteproc state -> exit), 7. rmtfs exits last
+ 	P=$(rmtfs_pid)
+-	mss_is running && now > $D/last-radio-stop
+-	if [ "$MODEM_RMTFS_PERSIST" = 1 ] && ! mss_is offline && [ -n "$(rp)" ]; then
+-		t=$(now); (echo stop > $(rp)/state) >> $LOG 2>&1; log "MSS stop via sysfs (long-lived rmtfs '${P}' stays)"
+-		wait_for $T_MSS_STOP 0.2 mss_is offline && log "MSS offline after $(since $t)s (rmtfs alive: $([ -n "$P" ] && kill -0 $P 2>/dev/null && echo yes || echo no))" \
+-			|| { log "ERROR: MSS '$(mss_state)' after ${T_MSS_STOP}s"; rc=1; }
+-		setstate MPSS_STOPPED
+-	elif [ "$MODEM_RMTFS_PERSIST" = 1 ]; then log "MSS already $(mss_state); long-lived rmtfs '${P}' stays"
+-	elif [ -n "$P" ]; then
++	if [ -n "$P" ]; then
+ 		t=$(now); kill -TERM $P; log "SIGTERM rmtfs $P (rmtfs stops MSS, then exits)"
+ 		wait_for $T_MSS_STOP 0.2 mss_is offline && log "MSS offline after $(since $t)s (rmtfs alive: $(kill -0 $P 2>/dev/null && echo yes || echo no))" \
+ 			|| { log "ERROR: MSS '$(mss_state)' after ${T_MSS_STOP}s"; rc=1; }
+@@ -385,10 +333,6 @@
+ 	disconnect) do_disconnect; exit $?;;
+ 	status) do_status;;
+ 	addroute) [ -n "$2" ] || exit 2; addroute "$2";;
+-	rmtfs-stop) mss_is offline || { log "rmtfs-stop refused: MSS $(mss_state)"; exit 1; }
+-		P=$(rmtfs_pid); [ -n "$P" ] || { log "rmtfs-stop: not running"; exit 0; }
+-		kill -TERM $P; wait_for $T_RMTFS_EXIT 0.2 sh -c "! kill -0 $P 2>/dev/null" && { log "long-lived rmtfs $P exited"; exit 0; }
+-		log "ERROR: rmtfs $P did not exit"; exit 1;;
+ 	_anyconn) any_bearer_connected;;
+ 	_mmstate) mm_state;;
+ 	*) echo "usage: $0 start|stop|status|addroute <ipv4>"; exit 2;;

b6p/diff-old-b6-vs-b6p.diff

@@ -0,0 +1,172 @@
+--- b6/aurora-modem	2026-09-30 19:39:43.675393185 +0600
++++ b6p/rootfs/usr/sbin/aurora-modem	2026-09-30 22:24:42.244902667 +0600
+@@ -1,18 +1,17 @@
+ #!/bin/sh
+-# B6 RAM-only modem lifecycle controller for Aurora (golden mm1). Lives in /tmp only.
+-#   aurora-modem start | stop | status | addroute <ipv4>
+-# Reconstructs the proven flow (NOTES sessions 14-22 Aurora, JZ02 stopcycle/wwanfix/openrc):
+-#   start: RO gates -> rmtfs -r -P -s -v (rmtfs -s starts MSS) -> MSS running -> wwan0qmi0+wwan0 (+2 s, JZ02 port-race guard)
+-#          -> qmicli -p DMS online (one SET, only if not online) -> NAS registered + PS attached -> kill qmi-proxy
+-#          -> udevd/dbus/polkitd/ModemManager -> MM modem registered -> ONE simple-connect -> bearer IPv4 on wwanN
+-#          + /32 host routes only (no default route, usb0 untouched).
+-#   stop:  simple-disconnect -> MM disable (radio low-power = detach) -> del our /32 routes, flush+down all wwan* -> stop MM (+qmi-proxy) -> BAM-DMUX suspended
+-#          -> SIGTERM rmtfs: rmtfs writes "stop" to remoteproc state (MSS stops while rmtfs still serves) -> rmtfs exits LAST.
+-# Never writes eMMC/NV: rmtfs -r keeps EFS writes in RAM; the script refuses to run unless the NV partitions are getro=1.
++# Aurora (JZ08AU, MSM8916) modem lifecycle controller - B6P production build of the B6N-proven controller (b6j/aurora-modem).
++#   aurora-modem start | disconnect | stop | status | addroute <ipv4>
++#   start:      [rmtfs -r -P -s -v -> MSS -> wwan0qmi0 (+2 s port-race guard) -> SIM ready -> DMS online (one SET, retried only on DeviceNotReady)
++#               -> registration state machine (registered + PS attached, deadline REG_TIMEOUT, default 600 s)]  (skipped when rmtfs+MSS already run)
++#               -> udevd/dbus/polkitd/ModemManager (reused if running) -> ONE simple-connect -> bearer IPv4 on wwanN + /32 routes only (no default route).
++#   disconnect: simple-disconnect, our routes, flush+down all wwan*, wait BAM-DMUX suspended. MSS, rmtfs, MM and radio stay up; 'start' reconnects.
++#   stop:       disconnect -> stop MM (+qmi-proxy) -> BAM-DMUX suspended -> SIGTERM rmtfs (rmtfs writes 'stop' -> MSS offline) -> rmtfs exits last.
++# Never writes eMMC/NV: rmtfs -r keeps EFS writes in RAM; refuses to start unless modemst1/2, fsc, fsg, persist, mmcblk0 are getro=1 and /firmware is ro.
++# Does not need a valid wall clock (all timing from /proc/uptime). No automatic MSS/rmtfs retry.
+ # Exit: 0 ok, 1 failure/timeout (start rolls back with a full stop unless MODEM_KEEP_ON_FAIL=1), 2 usage/config error.
+ 
+-CONF=${MODEM_CONF:-/tmp/aurora-modem.conf}
+-D=/tmp/aurora-modem.d; mkdir -p $D
++CONF=${MODEM_CONF:-/etc/aurora/modem.conf}
++D=/run/aurora-modem; mkdir -p $D
+ LOG=$D/lifecycle.log; STATE=$D/state; ROUTES=$D/routes; BEARER=$D/bearer
+ RPNAME=4080000.remoteproc
+ BAM=/sys/bus/platform/devices/4080000.remoteproc:bam-dmux
+@@ -20,10 +19,10 @@
+ 
+ # --- timeouts (s); override in $CONF
+ T_RMTFS=5 T_MSS=60 T_QMI_DEV=30 T_QMI=45 T_SIM=60 T_ONLINE=30 T_REG=180 T_MM_DETECT=150 T_MM_REG=60 T_CONNECT=150
+-MODEM_REATTACH_HOLDOFF=120	# s between radio stop and next MSS start (B6: re-attach <=61 s after stop was rejected 3/3 by Beeline)
+ T_DISCONNECT=60 T_DISABLE=30 T_MM_EXIT=30 T_BAM_IDLE=15 T_MSS_STOP=30 T_RMTFS_EXIT=15
+-MODEM_APN= MODEM_USER= MODEM_PASSWORD= MODEM_AUTH= MODEM_IP_TYPE=ipv4 MODEM_TEST_ROUTES= KEEP=${MODEM_KEEP_ON_FAIL:-0}
++APN= USER= PASSWORD= AUTH= IP_TYPE=ipv4 REG_TIMEOUT=600 ROUTES= KEEP=${MODEM_KEEP_ON_FAIL:-0}
+ [ -f "$CONF" ] && . "$CONF"
++MODEM_APN=$APN MODEM_USER=$USER MODEM_PASSWORD=$PASSWORD MODEM_AUTH=$AUTH MODEM_IP_TYPE=${IP_TYPE:-ipv4} MODEM_TEST_ROUTES=$ROUTES T_REG=${REG_TIMEOUT:-600}
+ MODEM_KEEP_ON_FAIL=${MODEM_KEEP_ON_FAIL:-$KEEP}
+ 
+ mmc() { mmcli "$@" 2>/dev/null | tr -d '\033' | sed 's/\[[0-9;]*m//g'; }	# mmcli colours values even without a tty
+@@ -62,6 +61,43 @@
+ # this mmcli has no --list-bearers ("no actions specified"); use 'Bearer | paths:' of mmcli -m, not the initial (attach) bearer
+ bearers() { mmc -m "$(mm_idx)" | grep -v "initial bearer" | grep -oE "Bearer/[0-9]+" | cut -d/ -f2; }
+ any_bearer_connected() { for b in $(bearers); do mmc -b $b | grep -q "connected: yes" && return 0; done; return 1; }
++qv() { grep -m1 -oE "$1: *'[^']*'" $2 2>/dev/null | sed -E "s/.*'([^']*)'/\1/"; }
++# B6M registration state machine. rc 0 = registered+PS attached, 1 = REGISTRATION_TIMEOUT, 2 = local failure (reason in $D/reg-fail)
++reg_sm() {
++	T=$D/reg-trans.tsv; t0=$1; last=; n=0; nd=0; rm -f $D/reg-fail; D0=$(dmesg | wc -l)
++	printf 'uptime	t_online	reg	ps	status	true_status	domain	plmn	earfcn	pci	si_tac	si_eci	cl_tac	cl_eci	rsrp	rsrq	snr
++' > $T
++	lf() { echo "$*" > $D/reg-fail; return 2; }
++	while :; do n=$((n+1))
++		mss_is running || { lf "MSS state $(mss_state)"; return 2; }
++		[ -e /dev/wwan0qmi0 ] || { lf "wwan0qmi0 disappeared"; return 2; }
++		[ -n "$(rmtfs_pid)" ] || { lf "rmtfs died"; return 2; }
++		[ "$(bam_pm)" = error ] && { lf "BAM-DMUX runtime_status=error"; return 2; }
++		dmesg | tail -n +$((D0+1)) | grep -qE 'crash detected|fatal error|[Ww]atchdog|wdog|Oops|BUG:|Failed to resume' && { lf "dmesg: $(dmesg | tail -n +$((D0+1)) | grep -m1 -E 'crash detected|fatal error|[Ww]atchdog|wdog|Oops|BUG:|Failed to resume')"; return 2; }
++		if [ $((n % 5)) = 1 ]; then
++			sim_ready || { lf "SIM not ready: $(grep -E 'Card state|Application state' $D/qmi-uim.txt | head -2 | tr -s ' \t\n' ' ')"; return 2; }
++			ping -c1 -W2 172.16.42.2 >/dev/null 2>&1 || { sleep 1; ping -c1 -W2 172.16.42.2 >/dev/null 2>&1 || { lf "USB management (usb0 ping) lost"; return 2; }; }
++		fi
++		timeout 20 $Q --nas-get-serving-system > $D/qmi-ss.txt 2>&1
++		timeout 20 $Q --nas-get-system-info > $D/qmi-si-all.txt 2>&1; sed -n '/LTE service:/,/SIM reject/p' $D/qmi-si-all.txt > $D/qmi-si.txt
++		RG=$(qv 'Registration state' $D/qmi-ss.txt); PS=$(qv PS $D/qmi-ss.txt); ST=$(qv Status $D/qmi-si.txt); TS=$(qv 'True Status' $D/qmi-si.txt)
++		DM=$(qv Domain $D/qmi-si.txt); PL=$(qv MCC $D/qmi-si.txt)-$(qv MNC $D/qmi-si.txt); SIT=$(qv 'Tracking Area Code' $D/qmi-si.txt); SIE=$(qv 'Cell ID' $D/qmi-si.txt)
++		key="$RG|$PS|$ST|$TS|$DM|$PL|$SIT|$SIE"
++		if [ "$key" != "$last" ]; then
++			timeout 20 $Q --nas-get-cell-location-info > $D/qmi-cl.txt 2>&1; timeout 20 $Q --nas-get-signal-info > $D/qmi-sig.txt 2>&1
++			[ "$RG" = registration-denied ] && [ "${last%%|*}" != registration-denied ] && nd=$((nd+1))
++			printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' $(now) $(since $t0) "$RG" "$PS" "$ST" "$TS" "$DM" "$PL" \
++				"$(qv 'EUTRA Absolute RF Channel Number' $D/qmi-cl.txt)" "$(qv 'Serving Cell ID' $D/qmi-cl.txt)" "$SIT" "$SIE" \
++				"$(qv 'Tracking Area Code' $D/qmi-cl.txt)" "$(qv 'Global Cell ID' $D/qmi-cl.txt)" "$(qv RSRP $D/qmi-sig.txt)" "$(qv RSRQ $D/qmi-sig.txt)" "$(qv SNR $D/qmi-sig.txt)" >> $T
++			log "REG t+$(since $t0)s: $RG / PS $PS / $ST ($TS, $DM) $PL pci=$(qv 'Serving Cell ID' $D/qmi-cl.txt) si=$SIT/$SIE cl=$(qv 'Tracking Area Code' $D/qmi-cl.txt)/$(qv 'Global Cell ID' $D/qmi-cl.txt)"
++			last=$key
++		fi
++		echo $nd > $D/reg-denied-count
++		[ "$RG" = registered ] && [ "$PS" = attached ] && return 0
++		[ "$(awk -v a="$(now)" -v b="$t0" -v t="$T_REG" 'BEGIN{print (a-b>=t)}')" = 1 ] && { lf "REGISTRATION_TIMEOUT after ${T_REG}s ($RG, PS $PS)"; return 1; }
++		sleep 3
++	done
++}
+ bearer_field() { awk -F': ' -v k="$1" '$1 ~ " "k"$" {gsub(/ /,"",$2); print $2; exit}' $BEARER.txt; }
+ 
+ check_safety() {
+@@ -110,14 +146,11 @@
+ 	elif [ -n "$(rmtfs_pid)" ] || ! mss_is offline; then
+ 		log "FAIL: inconsistent (rmtfs='$(rmtfs_pid)' MSS=$(mss_state)); run stop first"; exit 1
+ 	else
+-		if [ -f $D/last-radio-stop ]; then
+-			w=$(awk -v a="$(now)" -v b="$(cat $D/last-radio-stop)" -v h="$MODEM_REATTACH_HOLDOFF" 'BEGIN{d=h-(a-b); printf "%d", (d>0)?d+1:0}')
+-			[ "$w" -gt 0 ] && { log "re-attach holdoff: last radio stop $(since $(cat $D/last-radio-stop))s ago, waiting ${w}s (MODEM_REATTACH_HOLDOFF=$MODEM_REATTACH_HOLDOFF)"; sleep $w; }
+-		fi
+ 		: > $ROUTES; rm -f $D/ipcfg
++		n0=$(grep -c 'registering services' $D/rmtfs.log 2>/dev/null)
+ 		LD_PRELOAD=/usr/lib/linebuf.so rmtfs -r -P -s -v >> $D/rmtfs.log 2>&1 &
+ 		echo $! > $D/rmtfs.pid
+-		wait_for $T_RMTFS 0.2 sh -c "kill -0 $(cat $D/rmtfs.pid) 2>/dev/null && grep -q 'registering services' $D/rmtfs.log" \
++		wait_for $T_RMTFS 0.2 sh -c "kill -0 $(cat $D/rmtfs.pid) 2>/dev/null && [ \$(grep -c 'registering services' $D/rmtfs.log) -gt ${n0:-0} ]" \
+ 			|| fail_start "rmtfs did not start (pid $(cat $D/rmtfs.pid))"
+ 		setstate RMTFS_READY
+ 		setstate MPSS_BOOTING
+@@ -149,7 +182,10 @@
+ 			log "DMS online after $(since $t)s"
+ 		fi
+ 		setstate RADIO_ONLINE
+-		t=$(now); wait_for $T_REG 2 qmi_reg || fail_start "not registered+PS attached after ${T_REG}s ($(grep -E "Registration state" $D/qmi-ss.txt | tr -s ' \t'))"
++		t=$(now); reg_sm $t; rr=$?
++		[ $rr = 2 ] && fail_start "LOCAL FAILURE during registration: $(cat $D/reg-fail)"
++		[ $rr = 1 ] && fail_start "$(cat $D/reg-fail)"
++
+ 		log "registered: $(grep -oE "(MCC|MNC|Description): '[^']*'" $D/qmi-ss.txt | tr '\n' ' ')after $(since $t)s"
+ 		setstate REGISTERED
+ 		killall qmi-proxy 2>/dev/null; wait_for 5 0.2 sh -c '! pidof qmi-proxy >/dev/null'
+@@ -210,13 +246,6 @@
+ 	if [ -n "$(mm_pid)" ] && mm_has_modem; then
+ 		timeout $T_DISCONNECT mmcli -m "$(mm_idx)" --simple-disconnect >> $LOG 2>&1; log "simple-disconnect rc=$? (bearers: $(bearers | tr '\n' ' '))"
+ 		wait_for 15 1 sh -c "! sh $0 _anyconn" && log "no bearer connected" || { log "WARNING: bearer still connected"; rc=1; }
+-		# 1b. radio off / network detach before MSS goes away (B6 addition: abrupt MSS stop while EPS-attached
+-		#     was followed by attach rejection 'limited' on quick restart). MM disable = DMS low-power.
+-		timeout $T_DISABLE mmcli -m "$(mm_idx)" --disable >> $LOG 2>&1; r=$?
+-		wait_for 10 0.5 sh -c "[ \"\$(sh $0 _mmstate)\" = disabled ]" && log "MM disable rc=$r -> state disabled (radio low-power, detached)" \
+-			|| { log "WARNING: MM disable rc=$r state '$(mm_state)'"; rc=1; }
+-	elif [ -e /dev/wwan0qmi0 ] && mss_is running; then
+-		timeout 20 $Q --dms-set-operating-mode=low-power >> $LOG 2>&1; log "qmicli low-power rc=$? (MM not running)"
+ 	fi
+ 	# 2. our /32 routes, 3. flush + DOWN every wwan*
+ 	for h in $(cat $ROUTES 2>/dev/null); do ip route del $h/32 2>/dev/null; done; : > $ROUTES
+@@ -242,7 +271,6 @@
+ 	fi
+ 	# 6. MSS stop via rmtfs -s (SIGTERM -> pwrite "stop" to remoteproc state -> exit), 7. rmtfs exits last
+ 	P=$(rmtfs_pid)
+-	mss_is running && now > $D/last-radio-stop
+ 	if [ -n "$P" ]; then
+ 		t=$(now); kill -TERM $P; log "SIGTERM rmtfs $P (rmtfs stops MSS, then exits)"
+ 		wait_for $T_MSS_STOP 0.2 mss_is offline && log "MSS offline after $(since $t)s (rmtfs alive: $(kill -0 $P 2>/dev/null && echo yes || echo no))" \
+@@ -260,6 +288,23 @@
+ 	return $rc
+ }
+ 
++do_disconnect() { # B6N: bearer down only; MSS, rmtfs, MM (and DMS radio) stay up. Next 'start' reuses them and only simple-connects.
++	T0=$(now); log "=== DISCONNECT (from $(cat $STATE 2>/dev/null || echo OFF): mss=$(mss_state) rmtfs=$(rmtfs_pid) mm=$(mm_pid) bam=$(bam_pm))"; rc=0
++	[ -n "$(mm_pid)" ] && mm_has_modem || { log "DISCONNECT: no MM modem"; return 1; }
++	timeout $T_DISCONNECT mmcli -m "$(mm_idx)" --simple-disconnect >> $LOG 2>&1; log "simple-disconnect rc=$? (bearers: $(bearers | tr '\n' ' '))"
++	wait_for 15 1 sh -c "! sh $0 _anyconn" && log "no bearer connected" || { log "ERROR: bearer still connected"; rc=1; }
++	for h in $(cat $ROUTES 2>/dev/null); do ip route del $h/32 2>/dev/null; done; : > $ROUTES
++	for d in /sys/class/net/wwan*; do [ -e "$d" ] || continue; w=${d##*/}
++		ip addr flush dev $w 2>/dev/null; ip link set $w down 2>/dev/null
++		link_up $w && { log "ERROR: $w still UP"; rc=1; }; done
++	rm -f $D/ipcfg
++	ip route | grep -q " dev wwan" && { log "ERROR: routes via wwan remain: $(ip route | grep ' dev wwan' | tr '\n' ';')"; rc=1; }
++	t=$(now); wait_for $T_BAM_IDLE 0.5 bam_suspended && log "BAM-DMUX suspended after $(since $t)s" || { log "ERROR: BAM-DMUX '$(bam_pm)' not suspended"; rc=1; }
++	setstate MM_IDLE
++	log "=== DISCONNECT done rc=$rc in $(since $T0)s (mss=$(mss_state) rmtfs='$(rmtfs_pid)' mm='$(mm_pid)' mm_state=$(mm_state) bam=$(bam_pm))"
++	return $rc
++}
++
+ do_status() {
+ 	r=$(rp)
+ 	echo "controller: $(cat $STATE 2>/dev/null || echo OFF)"
+@@ -285,6 +330,7 @@
+ case "$1" in
+ 	start) do_start;;
+ 	stop) do_stop; exit $?;;
++	disconnect) do_disconnect; exit $?;;
+ 	status) do_status;;
+ 	addroute) [ -n "$2" ] || exit 2; addroute "$2";;
+ 	_anyconn) any_bearer_connected;;

b6p/emu/F1-no-conf.out

@@ -0,0 +1,42 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] boot: Bootable file system not found. Reverting to android boot.
+HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
+HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=0
+HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
+HARNESS: total bytes read 45568

b6p/emu/F10-zeroed-cache.out

@@ -0,0 +1,42 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] boot: Bootable file system not found. Reverting to android boot.
+HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
+HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
+HARNESS: total bytes read 28160

b6p/emu/F11-bad-superblock.out

@@ -0,0 +1,42 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] boot: Bootable file system not found. Reverting to android boot.
+HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
+HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
+HARNESS: total bytes read 28160

b6p/emu/F2-no-kernel.out

@@ -0,0 +1,44 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] Kernel /wrp0p24//Image.gz-dtb does not exist
+[lk] Failed to parse extlinux.conf
+[lk] boot: Bootable file system not found. Reverting to android boot.
+HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
+HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=0
+HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
+HARNESS: total bytes read 53760

b6p/emu/F3-no-initrd.out

@@ -0,0 +1,44 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] Initramfs /wrp0p24//initramfs-b6p.cpio.gz does not exist
+[lk] Failed to parse extlinux.conf
+[lk] boot: Bootable file system not found. Reverting to android boot.
+HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
+HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=0
+HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
+HARNESS: total bytes read 57856

b6p/emu/F4-no-dtb.out

@@ -0,0 +1,44 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] FDT /wrp0p24//aurora-mm1.dtb does not exist
+[lk] Failed to parse extlinux.conf
+[lk] boot: Bootable file system not found. Reverting to android boot.
+HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
+HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=0
+HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
+HARNESS: total bytes read 57856

b6p/emu/F5-garbage-conf.out

@@ -0,0 +1,44 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] No labels in the extlinux.conf
+[lk] Failed to parse extlinux.conf
+[lk] boot: Bootable file system not found. Reverting to android boot.
+HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
+HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=0
+HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
+HARNESS: total bytes read 49664

b6p/emu/F6-no-fdt-line.out

@@ -0,0 +1,44 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] Neither fdt nor fdtdir is specified
+[lk] Failed to parse extlinux.conf
+[lk] boot: Bootable file system not found. Reverting to android boot.
+HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
+HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=0
+HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
+HARNESS: total bytes read 53760

b6p/emu/F7-crlf-conf.out

@@ -0,0 +1,44 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] Kernel /wrp0p24//Image.gz-dtb
 does not exist
+[lk] Failed to parse extlinux.conf
+[lk] boot: Bootable file system not found. Reverting to android boot.
+HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
+HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=0
+HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
+HARNESS: total bytes read 53760

b6p/emu/F8-no-final-newline.out

@@ -0,0 +1,44 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] Failed to parse the extlinux.conf
+[lk] Failed to parse extlinux.conf
+[lk] boot: Bootable file system not found. Reverting to android boot.
+HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
+HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=0
+HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
+HARNESS: total bytes read 49664

b6p/emu/F9-corrupt-gzip-kernel.out

@@ -0,0 +1,46 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] Trying to boot 'b6p'
+[lk] Decompressing the kernel...
+[lk] uncompression error 
+[lk] Failed to decompress the kernel: -1
+[lk] boot: Bootable file system not found. Reverting to android boot.
+HARNESS: lk2nd_boot() returned -> aboot would continue to boot_linux_from_mmc() (Android boot partition)
+HARNESS: scan-candidate wrp0p26  (userdata) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p25  (recovery) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p24  (cache) ext2 mount rc=0
+HARNESS: scan-candidate wrp0p23  (persist) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p22  (system) ext2 mount rc=-3
+HARNESS: scan-candidate wrp0p21  (boot) ext2 mount rc=-1
+HARNESS: scan-candidate wrp0p0   (modem) ext2 mount rc=-1
+HARNESS: total bytes read 8081920

b6p/emu/S1-b5b-candidate-regression.out

@@ -0,0 +1,40 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] Trying to boot 'mm1'
+[lk] Decompressing the kernel...
+HARNESS: boot_linux reached: kernel @DDR+0x0 tags @DDR+0x249b000 ramdisk @DDR+0x269b000 (11944942) boot_type 0
+HARNESS: kernel magic 0x644d5241 image_size 0x1680000 end @DDR+0x1680000
+HARNESS: cmdline 'earlycon console=ttyMSM0,115200n8 ignore_loglevel loglevel=8 rdinit=/init'
+HARNESS: kernel   sha256 4603b02f8ae36dcf14582a00198715e7cf64fb18bfc5c3212ef464e9ecd20032 (23015432 bytes)
+HARNESS: dtb      sha256 a10056c50a6cc89dd14c3a418fc1de4ed4b21986f4661ad959184fc0e6ab2c7b (65769 bytes)
+HARNESS: ramdisk  sha256 250bf8eea58cb64cba0b8f18a14e5b0d1a8aec3e99bb1009826e4d1126d0bd81 (11944942 bytes)

b6p/emu/S3-b6p-candidate.out

@@ -0,0 +1,40 @@
+[lk] Registering wrapper bio devices...
+[lk] block devices:
+[lk]  | dev        | label           | size       | Leaf |
+[lk]  | wrp0p26    | userdata        |   2542 MiB | Yes  |
+[lk]  | wrp0p25    | recovery        |     16 MiB | Yes  |
+[lk]  | wrp0p24    | cache           |    128 MiB | Yes  |
+[lk]  | wrp0p23    | persist         |     32 MiB | Yes  |
+[lk]  | wrp0p22    | system          |    800 MiB | Yes  |
+[lk]  | wrp0p21    | boot            |     16 MiB | Yes  |
+[lk]  | wrp0p20    | sec             |     16 KiB | Yes  |
+[lk]  | wrp0p19    | fsg             |      1 MiB | Yes  |
+[lk]  | wrp0p18    | DDR             |     32 KiB | Yes  |
+[lk]  | wrp0p17    | splash          |     10 MiB | Yes  |
+[lk]  | wrp0p16    | ssd             |      8 KiB | Yes  |
+[lk]  | wrp0p15    | fsc             |      1 KiB | Yes  |
+[lk]  | wrp0p14    | misc            |   1024 KiB | Yes  |
+[lk]  | wrp0p13    | modemst2        |      1 MiB | Yes  |
+[lk]  | wrp0p12    | modemst1        |      1 MiB | Yes  |
+[lk]  | wrp0p11    | pad             |   1024 KiB | Yes  |
+[lk]  | wrp0p10    | hypbak          |    512 KiB | Yes  |
+[lk]  | wrp0p9     | hyp             |    512 KiB | Yes  |
+[lk]  | wrp0p8     | tzbak           |    512 KiB | Yes  |
+[lk]  | wrp0p7     | tz              |   1024 KiB | Yes  |
+[lk]  | wrp0p6     | rpmbak          |    512 KiB | Yes  |
+[lk]  | wrp0p5     | rpm             |    512 KiB | Yes  |
+[lk]  | wrp0p4     | abootbak        |   1024 KiB | Yes  |
+[lk]  | wrp0p3     | aboot           |   1024 KiB | Yes  |
+[lk]  | wrp0p2     | sbl1bak         |    512 KiB | Yes  |
+[lk]  | wrp0p1     | sbl1            |    512 KiB | Yes  |
+[lk]  | wrp0p0     | modem           |     64 MiB | Yes  |
+[lk]  | wrp0       |                 |   3728 MiB |      |
+[lk] boot: Trying to boot from the file system...
+[lk] Trying to boot 'b6p'
+[lk] Decompressing the kernel...
+HARNESS: boot_linux reached: kernel @DDR+0x0 tags @DDR+0x2499000 ramdisk @DDR+0x2699000 (11955862) boot_type 0
+HARNESS: kernel magic 0x644d5241 image_size 0x1680000 end @DDR+0x1680000
+HARNESS: cmdline 'earlycon console=ttyMSM0,115200n8 ignore_loglevel loglevel=8 rdinit=/init'
+HARNESS: kernel   sha256 4603b02f8ae36dcf14582a00198715e7cf64fb18bfc5c3212ef464e9ecd20032 (23015432 bytes)
+HARNESS: dtb      sha256 a10056c50a6cc89dd14c3a418fc1de4ed4b21986f4661ad959184fc0e6ab2c7b (65769 bytes)
+HARNESS: ramdisk  sha256 8dcb61c8d839e8709c17abb2736f69a0ca4d0a689d931e79ddacaaf59933f5b9 (11955862 bytes)

b6p/emu/map-F1-no-conf.txt

@@ -0,0 +1,28 @@
+0 34 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/gpt-primary-34.bin
+131072 131072 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/modem.bin
+262144 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/sbl1.bin
+263168 1024 /home/q/doc/modem/jz08-aurora/partitions/sbl1bak.bin
+264192 2048 /home/q/doc/modem/jz08-aurora/b5a/aboot-lk1st-aurora-autoboot.pad1M
+266240 2048 /home/q/doc/modem/jz08-aurora/partitions/abootbak.bin
+268288 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/rpm.bin
+269312 1024 /home/q/doc/modem/jz08-aurora/partitions/rpmbak.bin
+270336 2048 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tz.bin
+305184 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tzbak-305184.bin
+272384 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/hyp.bin
+273408 1024 /home/q/doc/modem/jz08-aurora/partitions/hypbak.bin
+274432 2048 /home/q/doc/modem/jz08-aurora/partitions/pad.bin
+276480 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst1.bin
+279552 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst2.bin
+282624 2048 /home/q/doc/modem/jz08-aurora/partitions/misc.bin
+284672 2 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsc.bin
+284674 16 /home/q/doc/modem/jz08-aurora/partitions/ssd.bin
+284690 20480 /home/q/doc/modem/jz08-aurora/partitions/splash.bin
+393216 64 /home/q/doc/modem/jz08-aurora/partitions/DDR.bin
+393280 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsg.bin
+396352 32 /home/q/doc/modem/jz08-aurora/partitions/sec.bin
+396384 32768 /home/q/doc/modem/jz08-aurora/b5a/boot-emmc1-16MiB.img
+429152 1638400 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/system.bin
+2067552 65536 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/persist.bin
+2133088 262144 /tmp/b6p-var/F1-no-conf.img
+2395232 32768 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/recovery.bin
+2428000 5206911 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/userdata.bin

b6p/emu/map-F10-zeroed-cache.txt

@@ -0,0 +1,28 @@
+0 34 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/gpt-primary-34.bin
+131072 131072 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/modem.bin
+262144 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/sbl1.bin
+263168 1024 /home/q/doc/modem/jz08-aurora/partitions/sbl1bak.bin
+264192 2048 /home/q/doc/modem/jz08-aurora/b5a/aboot-lk1st-aurora-autoboot.pad1M
+266240 2048 /home/q/doc/modem/jz08-aurora/partitions/abootbak.bin
+268288 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/rpm.bin
+269312 1024 /home/q/doc/modem/jz08-aurora/partitions/rpmbak.bin
+270336 2048 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tz.bin
+305184 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tzbak-305184.bin
+272384 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/hyp.bin
+273408 1024 /home/q/doc/modem/jz08-aurora/partitions/hypbak.bin
+274432 2048 /home/q/doc/modem/jz08-aurora/partitions/pad.bin
+276480 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst1.bin
+279552 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst2.bin
+282624 2048 /home/q/doc/modem/jz08-aurora/partitions/misc.bin
+284672 2 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsc.bin
+284674 16 /home/q/doc/modem/jz08-aurora/partitions/ssd.bin
+284690 20480 /home/q/doc/modem/jz08-aurora/partitions/splash.bin
+393216 64 /home/q/doc/modem/jz08-aurora/partitions/DDR.bin
+393280 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsg.bin
+396352 32 /home/q/doc/modem/jz08-aurora/partitions/sec.bin
+396384 32768 /home/q/doc/modem/jz08-aurora/b5a/boot-emmc1-16MiB.img
+429152 1638400 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/system.bin
+2067552 65536 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/persist.bin
+2133088 262144 /tmp/b6p-var/F10-zeroed-cache.img
+2395232 32768 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/recovery.bin
+2428000 5206911 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/userdata.bin

b6p/emu/map-F11-bad-superblock.txt

@@ -0,0 +1,28 @@
+0 34 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/gpt-primary-34.bin
+131072 131072 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/modem.bin
+262144 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/sbl1.bin
+263168 1024 /home/q/doc/modem/jz08-aurora/partitions/sbl1bak.bin
+264192 2048 /home/q/doc/modem/jz08-aurora/b5a/aboot-lk1st-aurora-autoboot.pad1M
+266240 2048 /home/q/doc/modem/jz08-aurora/partitions/abootbak.bin
+268288 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/rpm.bin
+269312 1024 /home/q/doc/modem/jz08-aurora/partitions/rpmbak.bin
+270336 2048 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tz.bin
+305184 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tzbak-305184.bin
+272384 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/hyp.bin
+273408 1024 /home/q/doc/modem/jz08-aurora/partitions/hypbak.bin
+274432 2048 /home/q/doc/modem/jz08-aurora/partitions/pad.bin
+276480 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst1.bin
+279552 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst2.bin
+282624 2048 /home/q/doc/modem/jz08-aurora/partitions/misc.bin
+284672 2 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsc.bin
+284674 16 /home/q/doc/modem/jz08-aurora/partitions/ssd.bin
+284690 20480 /home/q/doc/modem/jz08-aurora/partitions/splash.bin
+393216 64 /home/q/doc/modem/jz08-aurora/partitions/DDR.bin
+393280 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsg.bin
+396352 32 /home/q/doc/modem/jz08-aurora/partitions/sec.bin
+396384 32768 /home/q/doc/modem/jz08-aurora/b5a/boot-emmc1-16MiB.img
+429152 1638400 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/system.bin
+2067552 65536 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/persist.bin
+2133088 262144 /tmp/b6p-var/F11-bad-superblock.img
+2395232 32768 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/recovery.bin
+2428000 5206911 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/userdata.bin

b6p/emu/map-F2-no-kernel.txt

@@ -0,0 +1,28 @@
+0 34 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/gpt-primary-34.bin
+131072 131072 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/modem.bin
+262144 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/sbl1.bin
+263168 1024 /home/q/doc/modem/jz08-aurora/partitions/sbl1bak.bin
+264192 2048 /home/q/doc/modem/jz08-aurora/b5a/aboot-lk1st-aurora-autoboot.pad1M
+266240 2048 /home/q/doc/modem/jz08-aurora/partitions/abootbak.bin
+268288 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/rpm.bin
+269312 1024 /home/q/doc/modem/jz08-aurora/partitions/rpmbak.bin
+270336 2048 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tz.bin
+305184 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tzbak-305184.bin
+272384 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/hyp.bin
+273408 1024 /home/q/doc/modem/jz08-aurora/partitions/hypbak.bin
+274432 2048 /home/q/doc/modem/jz08-aurora/partitions/pad.bin
+276480 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst1.bin
+279552 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst2.bin
+282624 2048 /home/q/doc/modem/jz08-aurora/partitions/misc.bin
+284672 2 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsc.bin
+284674 16 /home/q/doc/modem/jz08-aurora/partitions/ssd.bin
+284690 20480 /home/q/doc/modem/jz08-aurora/partitions/splash.bin
+393216 64 /home/q/doc/modem/jz08-aurora/partitions/DDR.bin
+393280 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsg.bin
+396352 32 /home/q/doc/modem/jz08-aurora/partitions/sec.bin
+396384 32768 /home/q/doc/modem/jz08-aurora/b5a/boot-emmc1-16MiB.img
+429152 1638400 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/system.bin
+2067552 65536 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/persist.bin
+2133088 262144 /tmp/b6p-var/F2-no-kernel.img
+2395232 32768 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/recovery.bin
+2428000 5206911 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/userdata.bin

b6p/emu/map-F3-no-initrd.txt

@@ -0,0 +1,28 @@
+0 34 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/gpt-primary-34.bin
+131072 131072 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/modem.bin
+262144 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/sbl1.bin
+263168 1024 /home/q/doc/modem/jz08-aurora/partitions/sbl1bak.bin
+264192 2048 /home/q/doc/modem/jz08-aurora/b5a/aboot-lk1st-aurora-autoboot.pad1M
+266240 2048 /home/q/doc/modem/jz08-aurora/partitions/abootbak.bin
+268288 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/rpm.bin
+269312 1024 /home/q/doc/modem/jz08-aurora/partitions/rpmbak.bin
+270336 2048 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tz.bin
+305184 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tzbak-305184.bin
+272384 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/hyp.bin
+273408 1024 /home/q/doc/modem/jz08-aurora/partitions/hypbak.bin
+274432 2048 /home/q/doc/modem/jz08-aurora/partitions/pad.bin
+276480 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst1.bin
+279552 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst2.bin
+282624 2048 /home/q/doc/modem/jz08-aurora/partitions/misc.bin
+284672 2 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsc.bin
+284674 16 /home/q/doc/modem/jz08-aurora/partitions/ssd.bin
+284690 20480 /home/q/doc/modem/jz08-aurora/partitions/splash.bin
+393216 64 /home/q/doc/modem/jz08-aurora/partitions/DDR.bin
+393280 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsg.bin
+396352 32 /home/q/doc/modem/jz08-aurora/partitions/sec.bin
+396384 32768 /home/q/doc/modem/jz08-aurora/b5a/boot-emmc1-16MiB.img
+429152 1638400 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/system.bin
+2067552 65536 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/persist.bin
+2133088 262144 /tmp/b6p-var/F3-no-initrd.img
+2395232 32768 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/recovery.bin
+2428000 5206911 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/userdata.bin

b6p/emu/map-F4-no-dtb.txt

@@ -0,0 +1,28 @@
+0 34 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/gpt-primary-34.bin
+131072 131072 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/modem.bin
+262144 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/sbl1.bin
+263168 1024 /home/q/doc/modem/jz08-aurora/partitions/sbl1bak.bin
+264192 2048 /home/q/doc/modem/jz08-aurora/b5a/aboot-lk1st-aurora-autoboot.pad1M
+266240 2048 /home/q/doc/modem/jz08-aurora/partitions/abootbak.bin
+268288 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/rpm.bin
+269312 1024 /home/q/doc/modem/jz08-aurora/partitions/rpmbak.bin
+270336 2048 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tz.bin
+305184 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tzbak-305184.bin
+272384 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/hyp.bin
+273408 1024 /home/q/doc/modem/jz08-aurora/partitions/hypbak.bin
+274432 2048 /home/q/doc/modem/jz08-aurora/partitions/pad.bin
+276480 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst1.bin
+279552 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst2.bin
+282624 2048 /home/q/doc/modem/jz08-aurora/partitions/misc.bin
+284672 2 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsc.bin
+284674 16 /home/q/doc/modem/jz08-aurora/partitions/ssd.bin
+284690 20480 /home/q/doc/modem/jz08-aurora/partitions/splash.bin
+393216 64 /home/q/doc/modem/jz08-aurora/partitions/DDR.bin
+393280 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsg.bin
+396352 32 /home/q/doc/modem/jz08-aurora/partitions/sec.bin
+396384 32768 /home/q/doc/modem/jz08-aurora/b5a/boot-emmc1-16MiB.img
+429152 1638400 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/system.bin
+2067552 65536 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/persist.bin
+2133088 262144 /tmp/b6p-var/F4-no-dtb.img
+2395232 32768 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/recovery.bin
+2428000 5206911 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/userdata.bin

b6p/emu/map-F5-garbage-conf.txt

@@ -0,0 +1,28 @@
+0 34 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/gpt-primary-34.bin
+131072 131072 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/modem.bin
+262144 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/sbl1.bin
+263168 1024 /home/q/doc/modem/jz08-aurora/partitions/sbl1bak.bin
+264192 2048 /home/q/doc/modem/jz08-aurora/b5a/aboot-lk1st-aurora-autoboot.pad1M
+266240 2048 /home/q/doc/modem/jz08-aurora/partitions/abootbak.bin
+268288 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/rpm.bin
+269312 1024 /home/q/doc/modem/jz08-aurora/partitions/rpmbak.bin
+270336 2048 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tz.bin
+305184 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tzbak-305184.bin
+272384 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/hyp.bin
+273408 1024 /home/q/doc/modem/jz08-aurora/partitions/hypbak.bin
+274432 2048 /home/q/doc/modem/jz08-aurora/partitions/pad.bin
+276480 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst1.bin
+279552 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst2.bin
+282624 2048 /home/q/doc/modem/jz08-aurora/partitions/misc.bin
+284672 2 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsc.bin
+284674 16 /home/q/doc/modem/jz08-aurora/partitions/ssd.bin
+284690 20480 /home/q/doc/modem/jz08-aurora/partitions/splash.bin
+393216 64 /home/q/doc/modem/jz08-aurora/partitions/DDR.bin
+393280 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsg.bin
+396352 32 /home/q/doc/modem/jz08-aurora/partitions/sec.bin
+396384 32768 /home/q/doc/modem/jz08-aurora/b5a/boot-emmc1-16MiB.img
+429152 1638400 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/system.bin
+2067552 65536 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/persist.bin
+2133088 262144 /tmp/b6p-var/F5-garbage-conf.img
+2395232 32768 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/recovery.bin
+2428000 5206911 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/userdata.bin

b6p/emu/map-F6-no-fdt-line.txt

@@ -0,0 +1,28 @@
+0 34 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/gpt-primary-34.bin
+131072 131072 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/modem.bin
+262144 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/sbl1.bin
+263168 1024 /home/q/doc/modem/jz08-aurora/partitions/sbl1bak.bin
+264192 2048 /home/q/doc/modem/jz08-aurora/b5a/aboot-lk1st-aurora-autoboot.pad1M
+266240 2048 /home/q/doc/modem/jz08-aurora/partitions/abootbak.bin
+268288 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/rpm.bin
+269312 1024 /home/q/doc/modem/jz08-aurora/partitions/rpmbak.bin
+270336 2048 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tz.bin
+305184 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tzbak-305184.bin
+272384 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/hyp.bin
+273408 1024 /home/q/doc/modem/jz08-aurora/partitions/hypbak.bin
+274432 2048 /home/q/doc/modem/jz08-aurora/partitions/pad.bin
+276480 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst1.bin
+279552 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst2.bin
+282624 2048 /home/q/doc/modem/jz08-aurora/partitions/misc.bin
+284672 2 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsc.bin
+284674 16 /home/q/doc/modem/jz08-aurora/partitions/ssd.bin
+284690 20480 /home/q/doc/modem/jz08-aurora/partitions/splash.bin
+393216 64 /home/q/doc/modem/jz08-aurora/partitions/DDR.bin
+393280 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsg.bin
+396352 32 /home/q/doc/modem/jz08-aurora/partitions/sec.bin
+396384 32768 /home/q/doc/modem/jz08-aurora/b5a/boot-emmc1-16MiB.img
+429152 1638400 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/system.bin
+2067552 65536 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/persist.bin
+2133088 262144 /tmp/b6p-var/F6-no-fdt-line.img
+2395232 32768 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/recovery.bin
+2428000 5206911 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/userdata.bin

b6p/emu/map-F7-crlf-conf.txt

@@ -0,0 +1,28 @@
+0 34 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/gpt-primary-34.bin
+131072 131072 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/modem.bin
+262144 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/sbl1.bin
+263168 1024 /home/q/doc/modem/jz08-aurora/partitions/sbl1bak.bin
+264192 2048 /home/q/doc/modem/jz08-aurora/b5a/aboot-lk1st-aurora-autoboot.pad1M
+266240 2048 /home/q/doc/modem/jz08-aurora/partitions/abootbak.bin
+268288 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/rpm.bin
+269312 1024 /home/q/doc/modem/jz08-aurora/partitions/rpmbak.bin
+270336 2048 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tz.bin
+305184 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tzbak-305184.bin
+272384 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/hyp.bin
+273408 1024 /home/q/doc/modem/jz08-aurora/partitions/hypbak.bin
+274432 2048 /home/q/doc/modem/jz08-aurora/partitions/pad.bin
+276480 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst1.bin
+279552 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst2.bin
+282624 2048 /home/q/doc/modem/jz08-aurora/partitions/misc.bin
+284672 2 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsc.bin
+284674 16 /home/q/doc/modem/jz08-aurora/partitions/ssd.bin
+284690 20480 /home/q/doc/modem/jz08-aurora/partitions/splash.bin
+393216 64 /home/q/doc/modem/jz08-aurora/partitions/DDR.bin
+393280 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsg.bin
+396352 32 /home/q/doc/modem/jz08-aurora/partitions/sec.bin
+396384 32768 /home/q/doc/modem/jz08-aurora/b5a/boot-emmc1-16MiB.img
+429152 1638400 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/system.bin
+2067552 65536 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/persist.bin
+2133088 262144 /tmp/b6p-var/F7-crlf-conf.img
+2395232 32768 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/recovery.bin
+2428000 5206911 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/userdata.bin

b6p/emu/map-F8-no-final-newline.txt

@@ -0,0 +1,28 @@
+0 34 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/gpt-primary-34.bin
+131072 131072 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/modem.bin
+262144 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/sbl1.bin
+263168 1024 /home/q/doc/modem/jz08-aurora/partitions/sbl1bak.bin
+264192 2048 /home/q/doc/modem/jz08-aurora/b5a/aboot-lk1st-aurora-autoboot.pad1M
+266240 2048 /home/q/doc/modem/jz08-aurora/partitions/abootbak.bin
+268288 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/rpm.bin
+269312 1024 /home/q/doc/modem/jz08-aurora/partitions/rpmbak.bin
+270336 2048 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tz.bin
+305184 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tzbak-305184.bin
+272384 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/hyp.bin
+273408 1024 /home/q/doc/modem/jz08-aurora/partitions/hypbak.bin
+274432 2048 /home/q/doc/modem/jz08-aurora/partitions/pad.bin
+276480 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst1.bin
+279552 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst2.bin
+282624 2048 /home/q/doc/modem/jz08-aurora/partitions/misc.bin
+284672 2 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsc.bin
+284674 16 /home/q/doc/modem/jz08-aurora/partitions/ssd.bin
+284690 20480 /home/q/doc/modem/jz08-aurora/partitions/splash.bin
+393216 64 /home/q/doc/modem/jz08-aurora/partitions/DDR.bin
+393280 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsg.bin
+396352 32 /home/q/doc/modem/jz08-aurora/partitions/sec.bin
+396384 32768 /home/q/doc/modem/jz08-aurora/b5a/boot-emmc1-16MiB.img
+429152 1638400 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/system.bin
+2067552 65536 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/persist.bin
+2133088 262144 /tmp/b6p-var/F8-no-final-newline.img
+2395232 32768 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/recovery.bin
+2428000 5206911 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/userdata.bin

b6p/emu/map-F9-corrupt-gzip-kernel.txt

@@ -0,0 +1,28 @@
+0 34 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/gpt-primary-34.bin
+131072 131072 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/modem.bin
+262144 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/sbl1.bin
+263168 1024 /home/q/doc/modem/jz08-aurora/partitions/sbl1bak.bin
+264192 2048 /home/q/doc/modem/jz08-aurora/b5a/aboot-lk1st-aurora-autoboot.pad1M
+266240 2048 /home/q/doc/modem/jz08-aurora/partitions/abootbak.bin
+268288 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/rpm.bin
+269312 1024 /home/q/doc/modem/jz08-aurora/partitions/rpmbak.bin
+270336 2048 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tz.bin
+305184 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tzbak-305184.bin
+272384 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/hyp.bin
+273408 1024 /home/q/doc/modem/jz08-aurora/partitions/hypbak.bin
+274432 2048 /home/q/doc/modem/jz08-aurora/partitions/pad.bin
+276480 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst1.bin
+279552 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst2.bin
+282624 2048 /home/q/doc/modem/jz08-aurora/partitions/misc.bin
+284672 2 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsc.bin
+284674 16 /home/q/doc/modem/jz08-aurora/partitions/ssd.bin
+284690 20480 /home/q/doc/modem/jz08-aurora/partitions/splash.bin
+393216 64 /home/q/doc/modem/jz08-aurora/partitions/DDR.bin
+393280 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsg.bin
+396352 32 /home/q/doc/modem/jz08-aurora/partitions/sec.bin
+396384 32768 /home/q/doc/modem/jz08-aurora/b5a/boot-emmc1-16MiB.img
+429152 1638400 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/system.bin
+2067552 65536 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/persist.bin
+2133088 262144 /tmp/b6p-var/F9-corrupt-gzip-kernel.img
+2395232 32768 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/recovery.bin
+2428000 5206911 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/userdata.bin

b6p/emu/map-S1-b5b-candidate-regression.txt

@@ -0,0 +1,28 @@
+0 34 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/gpt-primary-34.bin
+131072 131072 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/modem.bin
+262144 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/sbl1.bin
+263168 1024 /home/q/doc/modem/jz08-aurora/partitions/sbl1bak.bin
+264192 2048 /home/q/doc/modem/jz08-aurora/b5a/aboot-lk1st-aurora-autoboot.pad1M
+266240 2048 /home/q/doc/modem/jz08-aurora/partitions/abootbak.bin
+268288 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/rpm.bin
+269312 1024 /home/q/doc/modem/jz08-aurora/partitions/rpmbak.bin
+270336 2048 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tz.bin
+305184 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tzbak-305184.bin
+272384 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/hyp.bin
+273408 1024 /home/q/doc/modem/jz08-aurora/partitions/hypbak.bin
+274432 2048 /home/q/doc/modem/jz08-aurora/partitions/pad.bin
+276480 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst1.bin
+279552 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst2.bin
+282624 2048 /home/q/doc/modem/jz08-aurora/partitions/misc.bin
+284672 2 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsc.bin
+284674 16 /home/q/doc/modem/jz08-aurora/partitions/ssd.bin
+284690 20480 /home/q/doc/modem/jz08-aurora/partitions/splash.bin
+393216 64 /home/q/doc/modem/jz08-aurora/partitions/DDR.bin
+393280 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsg.bin
+396352 32 /home/q/doc/modem/jz08-aurora/partitions/sec.bin
+396384 32768 /home/q/doc/modem/jz08-aurora/b5a/boot-emmc1-16MiB.img
+429152 1638400 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/system.bin
+2067552 65536 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/persist.bin
+2133088 262144 /home/q/doc/modem/jz08-aurora/b5b/cache-extlinux-mm1.img
+2395232 32768 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/recovery.bin
+2428000 5206911 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/userdata.bin

b6p/emu/map-S3-b6p-candidate.txt

@@ -0,0 +1,28 @@
+0 34 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/gpt-primary-34.bin
+131072 131072 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/modem.bin
+262144 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/sbl1.bin
+263168 1024 /home/q/doc/modem/jz08-aurora/partitions/sbl1bak.bin
+264192 2048 /home/q/doc/modem/jz08-aurora/b5a/aboot-lk1st-aurora-autoboot.pad1M
+266240 2048 /home/q/doc/modem/jz08-aurora/partitions/abootbak.bin
+268288 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/rpm.bin
+269312 1024 /home/q/doc/modem/jz08-aurora/partitions/rpmbak.bin
+270336 2048 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tz.bin
+305184 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/tzbak-305184.bin
+272384 1024 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/hyp.bin
+273408 1024 /home/q/doc/modem/jz08-aurora/partitions/hypbak.bin
+274432 2048 /home/q/doc/modem/jz08-aurora/partitions/pad.bin
+276480 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst1.bin
+279552 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/modemst2.bin
+282624 2048 /home/q/doc/modem/jz08-aurora/partitions/misc.bin
+284672 2 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsc.bin
+284674 16 /home/q/doc/modem/jz08-aurora/partitions/ssd.bin
+284690 20480 /home/q/doc/modem/jz08-aurora/partitions/splash.bin
+393216 64 /home/q/doc/modem/jz08-aurora/partitions/DDR.bin
+393280 3072 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/fsg.bin
+396352 32 /home/q/doc/modem/jz08-aurora/partitions/sec.bin
+396384 32768 /home/q/doc/modem/jz08-aurora/b5a/boot-emmc1-16MiB.img
+429152 1638400 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/system.bin
+2067552 65536 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/persist.bin
+2133088 262144 /home/q/doc/modem/jz08-aurora/b6p/cache-extlinux-b6p.img
+2395232 32768 /home/q/doc/modem/jz08-aurora/logs/b5a/A3/recovery.bin
+2428000 5206911 /home/q/doc/modem/jz08-aurora/logs/b5a/A4pre/userdata.bin

b6p/emu/mkvariants-b6p.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+# Offline fault-injection copies of the candidate (in /tmp). Candidate itself untouched.
+set -e
+C=/home/q/doc/modem/jz08-aurora/b6p/cache-extlinux-b6p.img; D=/tmp/b6p-var; rm -rf $D; mkdir -p $D
+v(){ cp $C $D/$1.img; chmod u+w $D/$1.img; }
+v F1-no-conf;      debugfs -w -R "rm /extlinux/extlinux.conf" $D/F1-no-conf.img
+v F2-no-kernel;    debugfs -w -R "rm /Image.gz-dtb" $D/F2-no-kernel.img
+v F3-no-initrd;    debugfs -w -R "rm /initramfs-b6p.cpio.gz" $D/F3-no-initrd.img
+v F4-no-dtb;       debugfs -w -R "rm /aurora-mm1.dtb" $D/F4-no-dtb.img
+put(){ debugfs -w -R "rm $2" $D/$1.img; debugfs -w -R "write $3 $2" $D/$1.img; }
+printf "this is not an extlinux config\n" > $D/bad.conf;                         v F5-garbage-conf; put F5-garbage-conf /extlinux/extlinux.conf $D/bad.conf
+printf "default b6p\nlabel b6p\n\tlinux /Image.gz-dtb\n\tinitrd /initramfs-b6p.cpio.gz\n" > $D/nofdt.conf; v F6-no-fdt-line; put F6-no-fdt-line /extlinux/extlinux.conf $D/nofdt.conf
+sed "s/\$/\r/" /home/q/doc/modem/jz08-aurora/b6p/extlinux-b6p.conf > $D/crlf.conf;                                  v F7-crlf-conf; put F7-crlf-conf /extlinux/extlinux.conf $D/crlf.conf
+printf "default b6p\nlabel b6p\n\tlinux /Image.gz-dtb\n\tfdt /aurora-mm1.dtb\n\tinitrd /initramfs-b6p.cpio.gz\n\tappend x" > $D/nonl.conf; v F8-no-final-newline; put F8-no-final-newline /extlinux/extlinux.conf $D/nonl.conf
+{ printf "\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\x03"; head -c 8000000 /dev/zero | tr "\0" "\377"; } > $D/badk;  v F9-corrupt-gzip-kernel; put F9-corrupt-gzip-kernel /Image.gz-dtb $D/badk
+head -c 134217728 /dev/zero > $D/F10-zeroed-cache.img
+cp $C $D/F11-bad-superblock.img; chmod u+w $D/F11-bad-superblock.img; printf "\x00\x00" | dd of=$D/F11-bad-superblock.img bs=1 seek=1080 conv=notrunc status=none
+ls $D/*.img

b6p/emu/run-emu-b6p.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+# Run the real-lk2nd-23.1-code emulator (b5b/emu) against: S1 (old B5b candidate, regression of the harness), S2 (current flash = 409bbb11),
+# S3 (B6P cache candidate), and F1-F11 fault variants of the B6P image. Offline, 480s.
+cd ~/doc/modem/jz08-aurora/b6p/emu; E=../../b5b/emu; GPT=../../logs/b5a/A3/gpt-primary-34.bin
+run() { python3 $E/mkmap.py $2 > map-$1.txt; $E/lk2nd-scan-emu map-$1.txt $GPT > $1.out 2>&1; echo "== $1 rc=$? :: $(grep -E "Trying to boot|Reverting|boot_linux reached|ramdisk  sha256|Could not" $1.out | tr '\n' ' ' | cut -c1-260)"; }
+run S1-b5b-candidate-regression /home/q/doc/modem/jz08-aurora/b5b/cache-extlinux-mm1.img
+cmp <(grep HARNESS S1-b5b-candidate-regression.out) <(grep HARNESS $E/S1-candidate.out) && echo "   S1 HARNESS lines == session-26 S1-candidate.out"
+run S3-b6p-candidate /home/q/doc/modem/jz08-aurora/b6p/cache-extlinux-b6p.img
+grep HARNESS S3-b6p-candidate.out
+bash mkvariants-b6p.sh > /dev/null 2>&1
+for f in /tmp/b6p-var/F*.img; do n=$(basename $f .img); run $n $f; done

b6p/extlinux-b6p.conf

@@ -0,0 +1,6 @@
+default b6p
+label b6p
+	linux /Image.gz-dtb
+	fdt /aurora-mm1.dtb
+	initrd /initramfs-b6p.cpio.gz
+	append earlycon console=ttyMSM0,115200n8 ignore_loglevel loglevel=8 rdinit=/init

b6p/golden.sha256

@@ -0,0 +1,5 @@
+38c960ef156c44af37c025f6bd4d053777ab450bc68b5ff10c686a73b9aee926  ../linux/artifacts/ramboot-mm1/aurora-mm1.img
+250bf8eea58cb64cba0b8f18a14e5b0d1a8aec3e99bb1009826e4d1126d0bd81  ../linux/artifacts/ramboot-mm1/initramfs.cpio.gz
+0ff9c802346697a029aea28e6f571fa669c8907c8c73430c2c2639e388ad82a3  ../linux/artifacts/ramboot-mm1/Image.gz-dtb
+a10056c50a6cc89dd14c3a418fc1de4ed4b21986f4661ad959184fc0e6ab2c7b  ../linux/artifacts/ramboot-mm1/msm8916-jz08-aurora-bam1.dtb
+cc54d780cca61927b0b98d638f5ef304a0b65d688f4b2ae40f990a8e7a5d68e3  ../linux/artifacts/ramboot-mm1/cmdline.txt

b6p/mkbootimg.py

@@ -0,0 +1,10 @@
+#!/usr/bin/env python3
+# Minimal Android boot.img v0 writer (same layout as golden aurora-mm1.img: page 2048, base-relative addrs, sha1 id, zero padding).
+# usage: mkbootimg.py KERNEL RAMDISK CMDLINE_FILE OUT
+import struct, sys, hashlib
+k = open(sys.argv[1], 'rb').read(); r = open(sys.argv[2], 'rb').read(); cmd = open(sys.argv[3], 'rb').read().rstrip(b'\n'); PS = 2048
+h = hashlib.sha1(); [h.update(x) for x in (k, struct.pack('<I', len(k)), r, struct.pack('<I', len(r)), b'', struct.pack('<I', 0))]
+hdr = b'ANDROID!' + struct.pack('<10I', len(k), 0x80080000, len(r), 0x82000000, 0, 0, 0x81e00000, PS, 0, 0) + b'\0' * 16
+hdr += cmd.ljust(512, b'\0') + h.digest().ljust(32, b'\0') + b'\0' * 1024
+pad = lambda b: b + b'\0' * ((-len(b)) % PS)
+open(sys.argv[4], 'wb').write(pad(hdr) + pad(k) + pad(r))

b6p/mkfs-cache-b6p.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+# B6P cache candidate: same recipe as b5b/mkfs-candidate.sh (409bbb11 reproduced), components = golden Image.gz-dtb + DTB + cmdline, initrd = B6P initramfs.
+# Runs on 480s (mke2fs 1.47.2). Offline only; writes nothing to the board.
+set -e
+cd ~/doc/modem/jz08-aurora/b6p
+OUT=${1:-cache-extlinux-b6p.img}; B5=../b5b/components
+sha256sum -c cache-components.sha256
+ST=$(mktemp -d); mkdir -p $ST/extlinux
+cp $B5/Image.gz-dtb $B5/aurora-mm1.dtb $ST/; cp out/initramfs-b6p.cpio.gz $ST/
+printf "default b6p\nlabel b6p\n\tlinux /Image.gz-dtb\n\tfdt /aurora-mm1.dtb\n\tinitrd /initramfs-b6p.cpio.gz\n\tappend %s\n" "$(cat $B5/cmdline.txt)" > $ST/extlinux/extlinux.conf
+cp $ST/extlinux/extlinux.conf extlinux-b6p.conf
+chmod 0644 $ST/*.* $ST/extlinux/extlinux.conf; chmod 0755 $ST $ST/extlinux
+find $ST -exec touch -h -d @1790726400 {} +
+rm -f $OUT; truncate -s 134217728 $OUT
+E2FSPROGS_FAKE_TIME=1790726400 /sbin/mke2fs -F -q -t ext2 -O none,filetype,sparse_super \
+  -b 4096 -I 128 -N 64 -m 0 -L aurora-b6p -U 4a5a3038-b6f0-4000-8000-00000000b6f0 \
+  -E root_owner=0:0,hash_seed=4a5a3038-b6f0-4000-8000-00000000b6f1 -d $ST $OUT 32768
+rm -rf $ST
+for f in / /lost+found /extlinux /extlinux/extlinux.conf /Image.gz-dtb /aurora-mm1.dtb /initramfs-b6p.cpio.gz; do for t in atime ctime mtime; do echo "sif $f $t @1790726400"; done; done > /tmp/b6p-sif.$$
+/sbin/debugfs -w -f /tmp/b6p-sif.$$ $OUT >/dev/null 2>&1; rm -f /tmp/b6p-sif.$$
+stat -c "%n %s" $OUT; sha256sum $OUT

b6p/out/SHA256SUMS

@@ -0,0 +1,10 @@
+436b779cd47905cde360ee89500ae77031cb6d855f5f38c8ec600b8b8e473326  out/overlay.cpio
+651fc826bebb789770faa22ab18edfcb883f267cb3c1dcfde784d1b030919258  out/overlay.cpio.gz
+8dcb61c8d839e8709c17abb2736f69a0ca4d0a689d931e79ddacaaf59933f5b9  out/initramfs-b6p.cpio.gz
+18a25e399c96afaf22e8e84e0d7c8fef18518bb427c9a36440ad6435f71b9090  out/aurora-mm1-b6p.img
+9d6694fbe35f9803c1de2ea35317cf0e67ee67464573395b50d732949d19c794  rootfs/init
+6e922dec3675891a652dfe6315006dd477728ed56ffd7253e35aacaa21ccf8ac  rootfs/usr/sbin/aurora-modem
+533f47eaaf966aaae36a2b799e506319eb7ee212366bc2c67d46068d64b78998  rootfs/etc/init.d/aurora-modem
+6ffb206e58c93236000d564adaa7629a9a70ea791a50fce59f8fffcefa3da212  rootfs/etc/aurora/modem.conf
+aa9e9aa247443eaaa358548e7f763ccf64d7c73d558a468515b7352352e349c3  ../b6j/aurora-modem
+aa9e27af49d7edc68f94bfbd26b017d273ba85337f28373cded9b461abbb1ddf  ../b6j/n.conf

b6p/out/manifest-diff.txt

@@ -0,0 +1,12 @@
+gzip members: 2
+golden entries: 472  overlay entries: 10
+SAME      etc                          mode=0o40755 size=0 sha=e3b0c44298fc1c14
+NEW       etc/aurora                   mode=0o40755 size=0 sha=e3b0c44298fc1c14
+NEW       etc/init.d                   mode=0o40755 size=0 sha=e3b0c44298fc1c14
+SAME      usr                          mode=0o40755 size=0 sha=e3b0c44298fc1c14
+SAME      usr/sbin                     mode=0o40755 size=0 sha=e3b0c44298fc1c14
+SAME      run                          mode=0o40755 size=0 sha=e3b0c44298fc1c14
+REPLACES  init                         mode=0o100755 size=6126 sha=9d6694fbe35f9803  (golden size=5786 sha=5db9dc7eac1f979b)
+NEW       usr/sbin/aurora-modem        mode=0o100755 size=22814 sha=6e922dec3675891a
+NEW       etc/init.d/aurora-modem      mode=0o100755 size=1694 sha=533f47eaaf966aaa
+NEW       etc/aurora/modem.conf        mode=0o100644 size=634 sha=6ffb206e58c93236

b6p/out/overlay.list

@@ -0,0 +1,10 @@
+dir /etc 0755 0 0
+dir /etc/aurora 0755 0 0
+dir /etc/init.d 0755 0 0
+dir /usr 0755 0 0
+dir /usr/sbin 0755 0 0
+dir /run 0755 0 0
+file /init rootfs/init 0755 0 0
+file /usr/sbin/aurora-modem rootfs/usr/sbin/aurora-modem 0755 0 0
+file /etc/init.d/aurora-modem rootfs/etc/init.d/aurora-modem 0755 0 0
+file /etc/aurora/modem.conf rootfs/etc/aurora/modem.conf 0644 0 0

b6p/rootfs/etc/aurora/modem.conf

@@ -0,0 +1,12 @@
+# Aurora modem operator profile (read by /usr/sbin/aurora-modem). Logic lives in the controller; only this file names an operator.
+# Empty APN => start refuses (exit 2): no APN guessing.
+# Current test profile: Beeline RU (public, operator-published default credentials).
+APN=internet.beeline.ru
+USER=beeline
+PASSWORD=beeline
+AUTH=pap
+IP_TYPE=ipv4
+# registration deadline (s): wait for registered + PS attached; searching/limited/denied/detached are not failures before it.
+REG_TIMEOUT=600
+# extra /32 host routes via the bearer interface (bearer DNS servers are always added). No default route is created.
+ROUTES="77.88.8.8 1.1.1.1"

b6p/rootfs/etc/init.d/aurora-modem

@@ -0,0 +1,27 @@
+#!/bin/sh
+# Aurora modem service (B6P). Started once by /init after USB NCM; no OpenRC in this image.
+#   /etc/init.d/aurora-modem start | stop | status
+# start:  runs '/usr/sbin/aurora-modem start' in the background (registration may take up to REG_TIMEOUT s); returns at once.
+# stop:   ends a start still in progress, then '/usr/sbin/aurora-modem stop' (bearer down -> MM -> BAM idle -> MSS offline -> rmtfs last).
+# status: service state + controller status. Reconnect without MSS restart: 'aurora-modem disconnect' then 'aurora-modem start'.
+# Kernel cmdline 'aurora.modem=off' disables autostart.
+C=/usr/sbin/aurora-modem; D=/run/aurora-modem; P=$D/service.pid; L=$D/service.log
+mkdir -p $D
+running() { [ -f $P ] && kill -0 $(cat $P) 2>/dev/null; }
+case "$1" in
+start)
+	grep -qw aurora.modem=off /proc/cmdline && { echo "aurora-modem: disabled by cmdline"; exit 0; }
+	running && { echo "aurora-modem: start already in progress (pid $(cat $P))"; exit 0; }
+	echo "=== service start $(cut -d' ' -f1 /proc/uptime)" >> $L
+	( $C start >> $L 2>&1; echo "=== service start rc=$? $(cut -d' ' -f1 /proc/uptime)" >> $L ) &
+	echo $! > $P; echo "aurora-modem: starting (pid $!, log $L)";;
+stop)
+	if running; then echo "aurora-modem: aborting start in progress (pid $(cat $P))"; kill -TERM $(cat $P) 2>/dev/null
+		pkill -TERM -P $(cat $P) 2>/dev/null; sleep 1; fi
+	rm -f $P; echo "=== service stop $(cut -d' ' -f1 /proc/uptime)" >> $L
+	$C stop >> $L 2>&1; r=$?; echo "=== service stop rc=$r" >> $L; echo "aurora-modem: stop rc=$r"; exit $r;;
+status)
+	running && echo "service: start in progress (pid $(cat $P))" || echo "service: idle"
+	$C status;;
+*)	echo "usage: $0 start|stop|status"; exit 2;;
+esac

b6p/rootfs/init

@@ -0,0 +1,129 @@
+#!/bin/busybox sh
+# Aurora RAM boot MM1 — QMI1 + ModemManager (qcom-soc) + D-Bus + polkit + eudev.
+# B6P: after eMMC RO + /firmware RO + USB NCM, autostarts /etc/init.d/aurora-modem (B6N-proven lifecycle).
+# NEVER mounts, fsck's, formats, trims or writes any mmcblk* device.
+# No block devices, no firmware, no radios. Never exits (failures leave the UART shell).
+/bin/busybox mkdir -p /proc /sys /dev /tmp /usr/bin /usr/sbin /sbin
+/bin/busybox --install -s
+mount -t proc proc /proc
+mount -t sysfs sysfs /sys
+mount -t devtmpfs devtmpfs /dev 2>/dev/null
+mount -t configfs configfs /sys/kernel/config
+log() { echo "[init] $*"; echo "[init] $*" > /dev/kmsg 2>/dev/null; }
+echo
+echo "=== AURORA RAM BOOT MM1 + B6P modem service ==="
+uname -a
+echo "--- model";   cat /proc/device-tree/model; echo
+echo "--- cmdline"; cat /proc/cmdline
+
+emmc_ro() {
+	for i in $(seq 1 100); do [ -b /dev/mmcblk0 ] && break; sleep 0.1; done
+	if [ ! -b /dev/mmcblk0 ]; then log "EMMC: /dev/mmcblk0 did not appear"; return 1; fi
+	sleep 0.5	# let partition nodes settle
+	for d in /dev/mmcblk0 /dev/mmcblk0p* /dev/mmcblk0boot*; do [ -b "$d" ] && blockdev --setro "$d"; done
+	bad=0; n=0
+	for d in /dev/mmcblk0 /dev/mmcblk0p* /dev/mmcblk0boot*; do
+		[ -b "$d" ] || continue; n=$((n+1)); r=$(blockdev --getro "$d")
+		[ "$r" = "1" ] || { bad=1; log "EMMC-RO FAIL $d getro=$r"; }
+	done
+	echo "EMMC-RO-SUMMARY devices=$n all_ro=$([ $bad = 0 ] && echo YES || echo NO)"
+	[ $bad = 0 ] || return 2
+	log "EMMC: all $n block devices read-only (getro=1)"
+}
+emmc_report() {
+	echo "=== EMMC-INFO-BEGIN"
+	C=/sys/class/block/mmcblk0/device
+	for f in name manfid oemid cid date serial type; do echo "$f=$(cat $C/$f 2>/dev/null)"; done
+	echo "size_512=$(cat /sys/class/block/mmcblk0/size) logical_block=$(cat /sys/class/block/mmcblk0/queue/logical_block_size) bytes=$(blockdev --getsize64 /dev/mmcblk0)"
+	cat /proc/partitions
+	echo "=== EMMC-GPT-BEGIN (pN name start_512 size_512 ro)"
+	for p in /sys/class/block/mmcblk0p*; do
+		b=$(basename $p); nm=$(sed -n 's/^PARTNAME=//p' $p/uevent)
+		echo "$b $nm $(cat $p/start) $(cat $p/size) $(cat $p/ro)"
+	done
+	echo "=== EMMC-GPT-END"
+	echo "=== EMMC-SHA-BEGIN"
+	for want in sbl1 rpm DDR sec aboot hyp tz tzbak; do
+		for p in /sys/class/block/mmcblk0p*; do
+			nm=$(sed -n 's/^PARTNAME=//p' $p/uevent)
+			[ "$nm" = "$want" ] && echo "$nm $(basename $p) $(sha256sum /dev/$(basename $p) | cut -d' ' -f1)"
+		done
+	done
+	echo "=== EMMC-SHA-END"
+	echo "=== EMMC-INFO-END"
+}
+emmc_ro && EMMC_RO_OK=1	# RO FIRST, before anything else touches the disk
+
+nv_snapshot() {	# $1 = before|after ; reads RO block devices only
+	o=/tmp/nv-$1.txt; : > $o
+	for want in modemst1 modemst2 fsg fsc persist; do
+		for p in /sys/class/block/mmcblk0p*; do
+			[ "$(sed -n 's/^PARTNAME=//p' $p/uevent)" = "$want" ] && echo "$want $(basename $p) $(sha256sum /dev/$(basename $p) | cut -d' ' -f1)" >> $o
+		done
+	done
+	echo "stat $(cat /sys/block/mmcblk0/stat)" >> $o
+}
+b1_modem_fat() {
+	mkdir -p /dev/disk/by-partlabel /firmware
+	for p in /sys/class/block/mmcblk0p*; do
+		n=$(sed -n 's/^PARTNAME=//p' $p/uevent); [ -n "$n" ] && ln -sf /dev/$(basename $p) /dev/disk/by-partlabel/$n
+	done
+	M=$(readlink /dev/disk/by-partlabel/modem); echo "B1 modem partition by PARTLABEL: modem -> $M ro=$(blockdev --getro $M)"
+	[ "$(blockdev --getro $M)" = 1 ] || { log "B1: modem partition not RO - NOT mounting"; return 1; }
+	mount -t vfat -o ro,nosuid,nodev,noexec,shortname=lower $M /firmware || { log "B1: mount failed"; return 1; }
+	grep " /firmware " /proc/mounts
+	grep " /firmware " /proc/mounts | grep -q " ro," || { log "B1: /firmware is NOT ro - unmounting"; umount /firmware; return 1; }
+	(cd /firmware && find . -type f | sort | while read f; do echo "$(sha256sum "$f" | cut -d' ' -f1) ${f#./}"; done) > /tmp/fw-sha.txt
+	echo "B1 firmware files: $(wc -l < /tmp/fw-sha.txt)"
+	echo -n /firmware/image > /sys/module/firmware_class/parameters/path
+	log "B1: modem FAT mounted RO at /firmware, firmware path /firmware/image"
+}
+if [ "$EMMC_RO_OK" = 1 ]; then
+	echo "stat-before-B1 $(cat /sys/block/mmcblk0/stat)" > /tmp/stat-before-B1.txt
+	nv_snapshot before
+	b1_modem_fat && B1_OK=1
+fi
+
+usb_up() {
+	for i in $(seq 1 50); do
+		udc=$(ls /sys/class/udc 2>/dev/null | head -1)
+		[ -n "$udc" ] && break
+		sleep 0.2
+	done
+	echo "--- /sys/class/udc:"; ls -l /sys/class/udc 2>&1
+	if [ -z "$udc" ]; then log "NO UDC found - USB gadget skipped"; return 1; fi
+	# DEVELOPMENT-ONLY IDs (same dev setup as JZ02: Google 18d1:d001) - not for production
+	G=/sys/kernel/config/usb_gadget/aurora
+	mkdir -p $G || return 1
+	echo 0x18d1 > $G/idVendor
+	echo 0xd001 > $G/idProduct
+	mkdir -p $G/strings/0x409
+	echo "Aurora" > $G/strings/0x409/manufacturer
+	echo "Aurora RAM Boot" > $G/strings/0x409/product
+	echo "<EMMC_SERIAL>" > $G/strings/0x409/serialnumber
+	mkdir -p $G/functions/ncm.usb0 || { log "ncm function create FAILED"; return 1; }
+	mkdir -p $G/configs/c.1/strings/0x409
+	echo "NCM" > $G/configs/c.1/strings/0x409/configuration
+	ln -s $G/functions/ncm.usb0 $G/configs/c.1/
+	echo "$udc" > $G/UDC || { log "bind to UDC '$udc' FAILED"; return 1; }
+	log "usb gadget bound to UDC '$udc'"
+	ifc=$(cat $G/functions/ncm.usb0/ifname 2>/dev/null)
+	log "ncm ifname='$ifc' dev_addr=$(cat $G/functions/ncm.usb0/dev_addr) host_addr=$(cat $G/functions/ncm.usb0/host_addr)"
+	[ -n "$ifc" ] || return 1
+	ip link set lo up
+	ip addr add 172.16.42.1/24 dev "$ifc"
+	ip link set "$ifc" up
+	ip addr show "$ifc"
+	log "network: $ifc 172.16.42.1/24 up (static, no DHCP)"
+}
+usb_up || log "USB/NCM setup incomplete - staying on UART shell"
+
+if [ "$EMMC_RO_OK" = 1 ]; then emmc_report; else log "EMMC: RO not confirmed or device missing - NO further disk access"; fi
+echo "B1_OK=${B1_OK:-0}"
+# B6P: modem autostart only when every eMMC device is RO and the modem FAT is mounted RO (the controller re-checks both).
+if [ "$EMMC_RO_OK" = 1 ] && [ "$B1_OK" = 1 ]; then /etc/init.d/aurora-modem start; else log "B6P: modem autostart SKIPPED (EMMC_RO_OK=${EMMC_RO_OK:-0} B1_OK=${B1_OK:-0})"; fi
+echo "=== entering shell (exit restarts it) ==="
+while true; do
+	setsid cttyhack sh
+	echo "shell exited, restarting"; sleep 1
+done

b6p/rootfs/usr/sbin/aurora-modem

@@ -0,0 +1,339 @@
+#!/bin/sh
+# Aurora (JZ08AU, MSM8916) modem lifecycle controller - B6P production build of the B6N-proven controller (b6j/aurora-modem).
+#   aurora-modem start | disconnect | stop | status | addroute <ipv4>
+#   start:      [rmtfs -r -P -s -v -> MSS -> wwan0qmi0 (+2 s port-race guard) -> SIM ready -> DMS online (one SET, retried only on DeviceNotReady)
+#               -> registration state machine (registered + PS attached, deadline REG_TIMEOUT, default 600 s)]  (skipped when rmtfs+MSS already run)
+#               -> udevd/dbus/polkitd/ModemManager (reused if running) -> ONE simple-connect -> bearer IPv4 on wwanN + /32 routes only (no default route).
+#   disconnect: simple-disconnect, our routes, flush+down all wwan*, wait BAM-DMUX suspended. MSS, rmtfs, MM and radio stay up; 'start' reconnects.
+#   stop:       disconnect -> stop MM (+qmi-proxy) -> BAM-DMUX suspended -> SIGTERM rmtfs (rmtfs writes 'stop' -> MSS offline) -> rmtfs exits last.
+# Never writes eMMC/NV: rmtfs -r keeps EFS writes in RAM; refuses to start unless modemst1/2, fsc, fsg, persist, mmcblk0 are getro=1 and /firmware is ro.
+# Does not need a valid wall clock (all timing from /proc/uptime). No automatic MSS/rmtfs retry.
+# Exit: 0 ok, 1 failure/timeout (start rolls back with a full stop unless MODEM_KEEP_ON_FAIL=1), 2 usage/config error.
+
+CONF=${MODEM_CONF:-/etc/aurora/modem.conf}
+D=/run/aurora-modem; mkdir -p $D
+LOG=$D/lifecycle.log; STATE=$D/state; ROUTES=$D/routes; BEARER=$D/bearer
+RPNAME=4080000.remoteproc
+BAM=/sys/bus/platform/devices/4080000.remoteproc:bam-dmux
+Q="qmicli -p -d /dev/wwan0qmi0"
+
+# --- timeouts (s); override in $CONF
+T_RMTFS=5 T_MSS=60 T_QMI_DEV=30 T_QMI=45 T_SIM=60 T_ONLINE=30 T_REG=180 T_MM_DETECT=150 T_MM_REG=60 T_CONNECT=150
+T_DISCONNECT=60 T_DISABLE=30 T_MM_EXIT=30 T_BAM_IDLE=15 T_MSS_STOP=30 T_RMTFS_EXIT=15
+APN= USER= PASSWORD= AUTH= IP_TYPE=ipv4 REG_TIMEOUT=600 ROUTES= KEEP=${MODEM_KEEP_ON_FAIL:-0}
+[ -f "$CONF" ] && . "$CONF"
+MODEM_APN=$APN MODEM_USER=$USER MODEM_PASSWORD=$PASSWORD MODEM_AUTH=$AUTH MODEM_IP_TYPE=${IP_TYPE:-ipv4} MODEM_TEST_ROUTES=$ROUTES T_REG=${REG_TIMEOUT:-600}
+MODEM_KEEP_ON_FAIL=${MODEM_KEEP_ON_FAIL:-$KEEP}
+
+mmc() { mmcli "$@" 2>/dev/null | tr -d '\033' | sed 's/\[[0-9;]*m//g'; }	# mmcli colours values even without a tty
+now() { cut -d' ' -f1 /proc/uptime; }
+log() { m="[$(now)] $*"; echo "$m" >> $LOG; echo "$m"; echo "<5>[aurora-modem] $*" > /dev/kmsg 2>/dev/null; }
+setstate() { o=$(cat $STATE 2>/dev/null); echo "$1" > $STATE; log "STATE ${o:-OFF} -> $1"; }
+die() { log "FAIL: $*"; exit 1; }
+# wait_for TIMEOUT INTERVAL cmd... : poll a real condition, no blind sleeps
+wait_for() { _to=$1; _iv=$2; shift 2; _t0=$(now)
+	while :; do "$@" && return 0
+		[ "$(awk -v a="$(now)" -v b="$_t0" -v t="$_to" 'BEGIN{print (a-b>=t)}')" = 1 ] && return 1
+		sleep $_iv; done; }
+since() { awk -v a="$(now)" -v b="$1" 'BEGIN{printf "%.1f", a-b}'; }
+
+rp() { for r in /sys/class/remoteproc/remoteproc*; do [ "$(cat $r/name 2>/dev/null)" = $RPNAME ] && echo $r && return; done; }
+mss_state() { r=$(rp); [ -n "$r" ] && cat $r/state || echo none; }
+mss_is() { [ "$(mss_state)" = "$1" ]; }
+rmtfs_pid() { pidof rmtfs; }
+mm_pid() { pidof ModemManager; }
+bam_pm() { cat $BAM/power/runtime_status 2>/dev/null || echo none; }
+bam_suspended() { [ "$(bam_pm)" = suspended ]; }
+qmi_dev() { [ -e /dev/wwan0qmi0 ] && [ -e /sys/class/net/wwan0 ]; }
+link_up() { [ $(( $(cat /sys/class/net/$1/flags) & 1 )) -ne 0 ]; }
+mm_idx() { mmc -L | grep -oE "Modem/[0-9]+" | head -1 | cut -d/ -f2; }
+mm_has_modem() { [ -n "$(mm_idx)" ]; }
+mm_state() { mmc -m "$(mm_idx)" | awk -F': ' '/\| +state: /{gsub(/ /,"",$2); print $2; exit}'; }
+# MM initialized: proven session 22 pass 1 connected from 'disabled' (Simple.Connect enables the modem itself)
+mm_usable() { case "$(mm_state)" in disabled|enabling|enabled|searching|registered|connected|connecting) return 0;; esac; return 1; }
+qmi_ok() { timeout 20 $Q --dms-get-operating-mode > $D/qmi-mode.txt 2>&1 && grep -q "Mode:" $D/qmi-mode.txt; }
+qmi_reg() { timeout 20 $Q --nas-get-serving-system > $D/qmi-ss.txt 2>&1
+	grep -q "Registration state: 'registered'" $D/qmi-ss.txt && grep -q "PS: 'attached'" $D/qmi-ss.txt; }
+sim_ready() { timeout 20 $Q --uim-get-card-status > $D/qmi-uim.txt 2>&1
+	grep -q "Card state: 'present'" $D/qmi-uim.txt && grep -q "Application state: 'ready'" $D/qmi-uim.txt; }
+set_online() { timeout 20 $Q --dms-set-operating-mode=online > $D/qmi-set.txt 2>&1; r=$?; cat $D/qmi-set.txt >> $LOG
+	[ $r = 0 ] && return 0; grep -q "DeviceNotReady" $D/qmi-set.txt || { echo hard > $D/qmi-set.err; return 0; }; return 1; }
+# this mmcli has no --list-bearers ("no actions specified"); use 'Bearer | paths:' of mmcli -m, not the initial (attach) bearer
+bearers() { mmc -m "$(mm_idx)" | grep -v "initial bearer" | grep -oE "Bearer/[0-9]+" | cut -d/ -f2; }
+any_bearer_connected() { for b in $(bearers); do mmc -b $b | grep -q "connected: yes" && return 0; done; return 1; }
+qv() { grep -m1 -oE "$1: *'[^']*'" $2 2>/dev/null | sed -E "s/.*'([^']*)'/\1/"; }
+# B6M registration state machine. rc 0 = registered+PS attached, 1 = REGISTRATION_TIMEOUT, 2 = local failure (reason in $D/reg-fail)
+reg_sm() {
+	T=$D/reg-trans.tsv; t0=$1; last=; n=0; nd=0; rm -f $D/reg-fail; D0=$(dmesg | wc -l)
+	printf 'uptime	t_online	reg	ps	status	true_status	domain	plmn	earfcn	pci	si_tac	si_eci	cl_tac	cl_eci	rsrp	rsrq	snr
+' > $T
+	lf() { echo "$*" > $D/reg-fail; return 2; }
+	while :; do n=$((n+1))
+		mss_is running || { lf "MSS state $(mss_state)"; return 2; }
+		[ -e /dev/wwan0qmi0 ] || { lf "wwan0qmi0 disappeared"; return 2; }
+		[ -n "$(rmtfs_pid)" ] || { lf "rmtfs died"; return 2; }
+		[ "$(bam_pm)" = error ] && { lf "BAM-DMUX runtime_status=error"; return 2; }
+		dmesg | tail -n +$((D0+1)) | grep -qE 'crash detected|fatal error|[Ww]atchdog|wdog|Oops|BUG:|Failed to resume' && { lf "dmesg: $(dmesg | tail -n +$((D0+1)) | grep -m1 -E 'crash detected|fatal error|[Ww]atchdog|wdog|Oops|BUG:|Failed to resume')"; return 2; }
+		if [ $((n % 5)) = 1 ]; then
+			sim_ready || { lf "SIM not ready: $(grep -E 'Card state|Application state' $D/qmi-uim.txt | head -2 | tr -s ' \t\n' ' ')"; return 2; }
+			ping -c1 -W2 172.16.42.2 >/dev/null 2>&1 || { sleep 1; ping -c1 -W2 172.16.42.2 >/dev/null 2>&1 || { lf "USB management (usb0 ping) lost"; return 2; }; }
+		fi
+		timeout 20 $Q --nas-get-serving-system > $D/qmi-ss.txt 2>&1
+		timeout 20 $Q --nas-get-system-info > $D/qmi-si-all.txt 2>&1; sed -n '/LTE service:/,/SIM reject/p' $D/qmi-si-all.txt > $D/qmi-si.txt
+		RG=$(qv 'Registration state' $D/qmi-ss.txt); PS=$(qv PS $D/qmi-ss.txt); ST=$(qv Status $D/qmi-si.txt); TS=$(qv 'True Status' $D/qmi-si.txt)
+		DM=$(qv Domain $D/qmi-si.txt); PL=$(qv MCC $D/qmi-si.txt)-$(qv MNC $D/qmi-si.txt); SIT=$(qv 'Tracking Area Code' $D/qmi-si.txt); SIE=$(qv 'Cell ID' $D/qmi-si.txt)
+		key="$RG|$PS|$ST|$TS|$DM|$PL|$SIT|$SIE"
+		if [ "$key" != "$last" ]; then
+			timeout 20 $Q --nas-get-cell-location-info > $D/qmi-cl.txt 2>&1; timeout 20 $Q --nas-get-signal-info > $D/qmi-sig.txt 2>&1
+			[ "$RG" = registration-denied ] && [ "${last%%|*}" != registration-denied ] && nd=$((nd+1))
+			printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' $(now) $(since $t0) "$RG" "$PS" "$ST" "$TS" "$DM" "$PL" \
+				"$(qv 'EUTRA Absolute RF Channel Number' $D/qmi-cl.txt)" "$(qv 'Serving Cell ID' $D/qmi-cl.txt)" "$SIT" "$SIE" \
+				"$(qv 'Tracking Area Code' $D/qmi-cl.txt)" "$(qv 'Global Cell ID' $D/qmi-cl.txt)" "$(qv RSRP $D/qmi-sig.txt)" "$(qv RSRQ $D/qmi-sig.txt)" "$(qv SNR $D/qmi-sig.txt)" >> $T
+			log "REG t+$(since $t0)s: $RG / PS $PS / $ST ($TS, $DM) $PL pci=$(qv 'Serving Cell ID' $D/qmi-cl.txt) si=$SIT/$SIE cl=$(qv 'Tracking Area Code' $D/qmi-cl.txt)/$(qv 'Global Cell ID' $D/qmi-cl.txt)"
+			last=$key
+		fi
+		echo $nd > $D/reg-denied-count
+		[ "$RG" = registered ] && [ "$PS" = attached ] && return 0
+		[ "$(awk -v a="$(now)" -v b="$t0" -v t="$T_REG" 'BEGIN{print (a-b>=t)}')" = 1 ] && { lf "REGISTRATION_TIMEOUT after ${T_REG}s ($RG, PS $PS)"; return 1; }
+		sleep 3
+	done
+}
+bearer_field() { awk -F': ' -v k="$1" '$1 ~ " "k"$" {gsub(/ /,"",$2); print $2; exit}' $BEARER.txt; }
+
+check_safety() {
+	for p in modemst1 modemst2 fsc fsg persist; do
+		d=/dev/disk/by-partlabel/$p; [ -e $d ] || return 1
+		[ "$(blockdev --getro $(readlink -f $d))" = 1 ] || { log "SAFETY: $p not RO"; return 1; }
+	done
+	[ "$(blockdev --getro /dev/mmcblk0)" = 1 ] || { log "SAFETY: mmcblk0 not RO"; return 1; }
+	grep -q " /firmware .* ro," /proc/mounts || { log "SAFETY: /firmware not mounted ro"; return 1; }
+	[ "$(cat /sys/module/firmware_class/parameters/path)" = /firmware/image ] || { log "SAFETY: firmware path"; return 1; }
+	return 0
+}
+connect_args() {
+	for v in "$MODEM_APN" "$MODEM_USER" "$MODEM_PASSWORD" "$MODEM_AUTH" "$MODEM_IP_TYPE"; do
+		case "$v" in *[,\"\'=]*) echo "BAD"; return;; esac; done
+	a="apn=$MODEM_APN"
+	[ -n "$MODEM_USER" ] && a="$a,user=$MODEM_USER"
+	[ -n "$MODEM_PASSWORD" ] && a="$a,password=$MODEM_PASSWORD"
+	[ -n "$MODEM_AUTH" ] && a="$a,allowed-auth=$MODEM_AUTH"
+	echo "$a,ip-type=$MODEM_IP_TYPE"
+}
+addroute() { # /32 via the bearer interface, recorded so stop removes exactly what we added
+	ip=$1; . $D/ipcfg 2>/dev/null || { echo "no bearer ipcfg"; return 1; }
+	grep -qx "$ip" $ROUTES 2>/dev/null && return 0
+	ip route add $ip/32 dev $IF src $A && echo $ip >> $ROUTES
+}
+diag() { # snapshot before rollback
+	{ echo "### diag $(now) state=$(cat $STATE 2>/dev/null) mss=$(mss_state) rmtfs=$(rmtfs_pid) mm=$(mm_pid) bam=$(bam_pm)"
+	  [ -n "$(mm_pid)" ] && { mmc -L; mmc -m "$(mm_idx)"; }
+	  cat $D/qmi-mode.txt $D/qmi-ss.txt 2>/dev/null; dmesg | tail -40; } > $D/diag-$(now).txt 2>&1
+}
+fail_start() { log "FAIL in $(cat $STATE 2>/dev/null): $*"; diag
+	if [ "$MODEM_KEEP_ON_FAIL" = 1 ]; then log "MODEM_KEEP_ON_FAIL=1: leaving stack as is"
+	else log "rollback: full stop"; do_stop; fi
+	exit 1; }
+
+do_start() {
+	T0=$(now); log "=== START (conf $CONF, apn '${MODEM_APN}', ip-type $MODEM_IP_TYPE)"
+	[ -n "$MODEM_APN" ] || { log "config: MODEM_APN empty - refusing (no APN guessing)"; exit 2; }
+	CA=$(connect_args); [ "$CA" = BAD ] && { log "config: forbidden character in APN/user/password/auth"; exit 2; }
+	check_safety || { log "FAIL: safety gate (RO) - nothing started"; exit 1; }
+	[ -n "$(rp)" ] || { log "FAIL: remoteproc $RPNAME not found"; exit 1; }
+
+	# OFF -> RMTFS_READY -> MPSS_BOOTING -> MPSS_RUNNING
+	if [ -n "$(rmtfs_pid)" ] && mss_is running; then log "rmtfs $(rmtfs_pid) + MSS running already - reuse"
+	elif [ -n "$(rmtfs_pid)" ] || ! mss_is offline; then
+		log "FAIL: inconsistent (rmtfs='$(rmtfs_pid)' MSS=$(mss_state)); run stop first"; exit 1
+	else
+		: > $ROUTES; rm -f $D/ipcfg
+		n0=$(grep -c 'registering services' $D/rmtfs.log 2>/dev/null)
+		LD_PRELOAD=/usr/lib/linebuf.so rmtfs -r -P -s -v >> $D/rmtfs.log 2>&1 &
+		echo $! > $D/rmtfs.pid
+		wait_for $T_RMTFS 0.2 sh -c "kill -0 $(cat $D/rmtfs.pid) 2>/dev/null && [ \$(grep -c 'registering services' $D/rmtfs.log) -gt ${n0:-0} ]" \
+			|| fail_start "rmtfs did not start (pid $(cat $D/rmtfs.pid))"
+		setstate RMTFS_READY
+		setstate MPSS_BOOTING
+		t=$(now); wait_for $T_MSS 0.2 mss_is running || fail_start "MSS not running after ${T_MSS}s (state $(mss_state))"
+		log "MSS running after $(since $t)s"
+	fi
+	setstate MPSS_RUNNING
+
+	# -> QMI_READY
+	t=$(now); wait_for $T_QMI_DEV 0.2 qmi_dev || fail_start "wwan0qmi0/wwan0 missing after ${T_QMI_DEV}s"
+	log "wwan0qmi0 + wwan0 present after $(since $t)s; +2 s (JZ02 rpmsg_wwan_ctrl port-race guard, proven start_post)"
+	sleep 2
+	[ "$(bam_pm)" = error ] && fail_start "BAM-DMUX runtime_status=error"
+
+	# -> RADIO_ONLINE -> REGISTERED  (Aurora-proven: qmicli online + NAS poll before ModemManager)
+	if [ -n "$(mm_pid)" ]; then
+		log "ModemManager already running - skip qmicli, use MM state"
+		setstate QMI_READY
+	else
+		t=$(now); wait_for $T_QMI 1 qmi_ok || fail_start "QMI DMS not answering after ${T_QMI}s"
+		setstate QMI_READY; log "DMS $(grep -o "Mode: '[^']*'" $D/qmi-mode.txt) after $(since $t)s"
+		t=$(now); wait_for $T_SIM 1 sim_ready || fail_start "SIM/USIM not ready after ${T_SIM}s ($(grep -E "Card state|Application state" $D/qmi-uim.txt | head -2 | tr -s ' \t\n' ' '))"
+		setstate SIM_READY; log "UIM card present, USIM app ready after $(since $t)s"
+		if ! grep -q "Mode: 'online'" $D/qmi-mode.txt; then
+			log "SET: $Q --dms-set-operating-mode=online (retried only on DeviceNotReady, <= ${T_ONLINE}s)"
+			rm -f $D/qmi-set.err; t=$(now); wait_for $T_ONLINE 1 set_online || fail_start "SET online: DeviceNotReady for ${T_ONLINE}s"
+			[ -f $D/qmi-set.err ] && fail_start "SET online failed: $(grep -i error $D/qmi-set.txt | head -1)"
+			qmi_ok && grep -q "Mode: 'online'" $D/qmi-mode.txt || fail_start "mode not online after SET"
+			log "DMS online after $(since $t)s"
+		fi
+		setstate RADIO_ONLINE
+		t=$(now); reg_sm $t; rr=$?
+		[ $rr = 2 ] && fail_start "LOCAL FAILURE during registration: $(cat $D/reg-fail)"
+		[ $rr = 1 ] && fail_start "$(cat $D/reg-fail)"
+
+		log "registered: $(grep -oE "(MCC|MNC|Description): '[^']*'" $D/qmi-ss.txt | tr '\n' ' ')after $(since $t)s"
+		setstate REGISTERED
+		killall qmi-proxy 2>/dev/null; wait_for 5 0.2 sh -c '! pidof qmi-proxy >/dev/null'
+	fi
+
+	# -> MM_READY  (mm-up order: udevd, trigger, settle, dbus, polkitd, ModemManager)
+	pidof udevd >/dev/null || { udevd --daemon; udevadm trigger --action=add; udevadm settle --timeout=15; log "udevd started"; }
+	if ! pidof dbus-daemon >/dev/null; then
+		mkdir -p /run/dbus /var/lib/dbus /var/lib/polkit; rm -f /run/dbus/pid; dbus-uuidgen --ensure
+		dbus-daemon --system --fork || fail_start "dbus-daemon"; log "dbus started"; fi
+	pidof polkitd >/dev/null || { /usr/lib/polkit-1/polkitd --no-debug >> $D/polkitd.log 2>&1 & log "polkitd started"; }
+	if [ -z "$(mm_pid)" ]; then
+		N=$(ls $D/mm-*.log 2>/dev/null | wc -l)
+		ModemManager --debug > $D/mm-$N.log 2>&1 &
+		echo $! > $D/mm.pid; log "ModemManager started pid $! (log mm-$N.log)"
+	fi
+	t=$(now); wait_for $T_MM_DETECT 2 mm_has_modem || fail_start "MM: no modem after ${T_MM_DETECT}s"
+	log "MM modem $(mm_idx) detected after $(since $t)s"
+	mmc -m "$(mm_idx)" > $D/mm-modem.txt
+	grep -q "plugin: qcom-soc" $D/mm-modem.txt || fail_start "MM plugin is not qcom-soc"
+	grep -q "primary port: wwan0qmi0" $D/mm-modem.txt || fail_start "MM primary port is not wwan0qmi0"
+	setstate MM_READY
+	t=$(now); wait_for $T_MM_REG 2 mm_usable || fail_start "MM state '$(mm_state)' not usable after ${T_MM_REG}s"
+	log "MM state $(mm_state) after $(since $t)s"
+
+	# -> BEARER_CONNECTED  (exactly one simple-connect)
+	if any_bearer_connected; then log "bearer already connected - reuse"
+	else
+		log "mmcli -m $(mm_idx) --simple-connect=\"$(echo "$CA" | sed 's/password=[^,]*/password=***/')\""
+		timeout $T_CONNECT mmcli -m "$(mm_idx)" --simple-connect="$CA" >> $LOG 2>&1 || fail_start "simple-connect failed/timeout"
+	fi
+	BR=; for b in $(bearers); do mmc -b $b | grep -q "connected: yes" && BR=$b; done
+	[ -n "$BR" ] || fail_start "no connected bearer after simple-connect"
+	mmc -m "$(mm_idx)" > $D/mm-modem.txt
+	grep -qE "registration: (home|roaming)" $D/mm-modem.txt || fail_start "MM registration not home/roaming after connect"
+	log "MM state $(mm_state), $(grep -oE "registration: [a-z]+" $D/mm-modem.txt)"
+	mmc -b $BR > $BEARER.txt
+	IF=$(bearer_field interface); A=$(bearer_field address); PF=$(bearer_field prefix); GW=$(bearer_field gateway)
+	DNS=$(bearer_field dns); MTU=$(bearer_field mtu)
+	echo "$IF" | grep -qE '^wwan[0-7]$' && [ -n "$A" ] && [ -n "$PF" ] || fail_start "bearer $BR bad ipv4 config IF=$IF A=$A PF=$PF"
+	printf 'BR=%s\nIF=%s\nA=%s\nPF=%s\nGW=%s\nDNS=%s\nMTU=%s\n' "$BR" "$IF" "$A" "$PF" "$GW" "$DNS" "$MTU" > $D/ipcfg
+	log "bearer $BR: $IF $A/$PF gw $GW dns $DNS mtu $MTU"
+	ip addr flush dev $IF; ip addr add $A/$PF dev $IF || fail_start "ip addr add"
+	[ -n "$MTU" ] && ip link set $IF mtu $MTU
+	ip link set $IF up || fail_start "ip link set $IF up (bam-dmux runtime PM?)"
+	link_up $IF || fail_start "$IF not UP"
+	for h in $(echo "$DNS" | tr ',' ' ') $MODEM_TEST_ROUTES; do addroute $h || fail_start "route $h"; done
+	ip route get 172.16.42.2 2>&1 | grep -q "dev usb0" || fail_start "management route no longer via usb0"
+	ip route | grep -q "^default" && log "WARNING: a default route exists (not created by us)"
+	setstate BEARER_CONNECTED
+	log "=== START OK in $(since $T0)s ($IF $A/$PF, routes: $(tr '\n' ' ' < $ROUTES))"
+}
+
+do_stop() {
+	T0=$(now); log "=== STOP (from $(cat $STATE 2>/dev/null || echo OFF): mss=$(mss_state) rmtfs=$(rmtfs_pid) mm=$(mm_pid) bam=$(bam_pm))"
+	rc=0
+	# 1. disconnect bearer(s)
+	if [ -n "$(mm_pid)" ] && mm_has_modem; then
+		timeout $T_DISCONNECT mmcli -m "$(mm_idx)" --simple-disconnect >> $LOG 2>&1; log "simple-disconnect rc=$? (bearers: $(bearers | tr '\n' ' '))"
+		wait_for 15 1 sh -c "! sh $0 _anyconn" && log "no bearer connected" || { log "WARNING: bearer still connected"; rc=1; }
+	fi
+	# 2. our /32 routes, 3. flush + DOWN every wwan*
+	for h in $(cat $ROUTES 2>/dev/null); do ip route del $h/32 2>/dev/null; done; : > $ROUTES
+	for d in /sys/class/net/wwan*; do [ -e "$d" ] || continue; w=${d##*/}
+		ip addr flush dev $w 2>/dev/null; ip link set $w down 2>/dev/null
+		link_up $w && { log "ERROR: $w still UP"; rc=1; }; done
+	rm -f $D/ipcfg
+	ip route | grep -q " dev wwan" && { log "ERROR: routes via wwan remain: $(ip route | grep ' dev wwan' | tr '\n' ';')"; rc=1; }
+	log "wwan links down, addresses/routes removed"
+	[ -n "$(cat $STATE 2>/dev/null)" ] && setstate WWAN_DOWN
+	# 4. stop ModemManager (+ its qmi-proxy)
+	if [ -n "$(mm_pid)" ]; then
+		kill -TERM $(mm_pid); wait_for $T_MM_EXIT 0.5 sh -c '! pidof ModemManager >/dev/null' \
+			|| { log "MM did not exit in ${T_MM_EXIT}s - SIGKILL"; kill -KILL $(mm_pid) 2>/dev/null; rc=1; }
+		log "ModemManager stopped"
+	fi
+	pidof qmi-proxy >/dev/null && { killall qmi-proxy; wait_for 5 0.2 sh -c '! pidof qmi-proxy >/dev/null'; log "qmi-proxy stopped"; }
+	setstate MM_STOPPED
+	# 5. BAM-DMUX idle
+	if [ -e $BAM ] && ! mss_is offline; then
+		t=$(now); if wait_for $T_BAM_IDLE 0.5 bam_suspended; then log "BAM-DMUX suspended after $(since $t)s"
+		else log "ERROR: BAM-DMUX '$(bam_pm)' not suspended after ${T_BAM_IDLE}s - NOT stopping MSS"; exit 1; fi
+	fi
+	# 6. MSS stop via rmtfs -s (SIGTERM -> pwrite "stop" to remoteproc state -> exit), 7. rmtfs exits last
+	P=$(rmtfs_pid)
+	if [ -n "$P" ]; then
+		t=$(now); kill -TERM $P; log "SIGTERM rmtfs $P (rmtfs stops MSS, then exits)"
+		wait_for $T_MSS_STOP 0.2 mss_is offline && log "MSS offline after $(since $t)s (rmtfs alive: $(kill -0 $P 2>/dev/null && echo yes || echo no))" \
+			|| { log "ERROR: MSS '$(mss_state)' after ${T_MSS_STOP}s"; rc=1; }
+		setstate MPSS_STOPPED
+		wait_for $T_RMTFS_EXIT 0.2 sh -c "! kill -0 $P 2>/dev/null" && log "rmtfs exited after $(since $t)s" \
+			|| { log "rmtfs still alive - second SIGTERM"; kill -TERM $P; wait_for 5 0.2 sh -c "! kill -0 $P 2>/dev/null" || { kill -KILL $P; rc=1; }; }
+	elif ! mss_is offline && [ -n "$(rp)" ]; then
+		log "MSS $(mss_state) without rmtfs - echo stop > state"; echo stop > $(rp)/state
+		wait_for $T_MSS_STOP 0.2 mss_is offline || rc=1
+	fi
+	mss_is offline || mss_is none || { log "ERROR: MSS state $(mss_state)"; rc=1; }
+	setstate OFF
+	log "=== STOP done rc=$rc in $(since $T0)s (mss=$(mss_state) rmtfs='$(rmtfs_pid)' mm='$(mm_pid)' bam=$(bam_pm))"
+	return $rc
+}
+
+do_disconnect() { # B6N: bearer down only; MSS, rmtfs, MM (and DMS radio) stay up. Next 'start' reuses them and only simple-connects.
+	T0=$(now); log "=== DISCONNECT (from $(cat $STATE 2>/dev/null || echo OFF): mss=$(mss_state) rmtfs=$(rmtfs_pid) mm=$(mm_pid) bam=$(bam_pm))"; rc=0
+	[ -n "$(mm_pid)" ] && mm_has_modem || { log "DISCONNECT: no MM modem"; return 1; }
+	timeout $T_DISCONNECT mmcli -m "$(mm_idx)" --simple-disconnect >> $LOG 2>&1; log "simple-disconnect rc=$? (bearers: $(bearers | tr '\n' ' '))"
+	wait_for 15 1 sh -c "! sh $0 _anyconn" && log "no bearer connected" || { log "ERROR: bearer still connected"; rc=1; }
+	for h in $(cat $ROUTES 2>/dev/null); do ip route del $h/32 2>/dev/null; done; : > $ROUTES
+	for d in /sys/class/net/wwan*; do [ -e "$d" ] || continue; w=${d##*/}
+		ip addr flush dev $w 2>/dev/null; ip link set $w down 2>/dev/null
+		link_up $w && { log "ERROR: $w still UP"; rc=1; }; done
+	rm -f $D/ipcfg
+	ip route | grep -q " dev wwan" && { log "ERROR: routes via wwan remain: $(ip route | grep ' dev wwan' | tr '\n' ';')"; rc=1; }
+	t=$(now); wait_for $T_BAM_IDLE 0.5 bam_suspended && log "BAM-DMUX suspended after $(since $t)s" || { log "ERROR: BAM-DMUX '$(bam_pm)' not suspended"; rc=1; }
+	setstate MM_IDLE
+	log "=== DISCONNECT done rc=$rc in $(since $T0)s (mss=$(mss_state) rmtfs='$(rmtfs_pid)' mm='$(mm_pid)' mm_state=$(mm_state) bam=$(bam_pm))"
+	return $rc
+}
+
+do_status() {
+	r=$(rp)
+	echo "controller: $(cat $STATE 2>/dev/null || echo OFF)"
+	echo "remoteproc: $RPNAME $(mss_state) ($r) fw=$(cat $r/firmware 2>/dev/null)"
+	echo "rmtfs:      pid='$(rmtfs_pid)' writes_logged=$(grep -c 'write ' $D/rmtfs.log 2>/dev/null)"
+	echo "qmi dev:    $(ls /dev/wwan0qmi0 2>/dev/null || echo absent)  qmi-proxy='$(pidof qmi-proxy)'"
+	echo "daemons:    udevd='$(pidof udevd)' dbus='$(pidof dbus-daemon)' polkitd='$(pidof polkitd)' ModemManager='$(mm_pid)'"
+	if [ -n "$(mm_pid)" ] && mm_has_modem; then
+		mmc -m "$(mm_idx)" | grep -E "\| +(state|power state|registration|operator name|access tech|signal quality|plugin|primary port): " \
+			| sed -E 's/^[^|]*\| */  mm /'
+		for b in $(bearers); do echo "  bearer $b: $(mmc -b $b | grep -E 'connected:|interface:|address:' | tr -s ' |' ' ' | tr '\n' ';')"; done
+	else echo "  mm: n/a"; fi
+	for d in /sys/class/net/wwan*; do [ -e "$d" ] || continue; w=${d##*/}
+		link_up $w && echo "wwan:       $w UP $(ip -4 addr show $w | awk '/inet /{print $2}')"; done
+	echo "wwan up:    $(n=0; for d in /sys/class/net/wwan*; do [ -e $d ] && link_up ${d##*/} && n=$((n+1)); done; echo $n) of $(ls -d /sys/class/net/wwan* 2>/dev/null | wc -l)"
+	echo "routes:     $(ip route | grep ' dev wwan' | tr '\n' ';')"
+	echo "bam-dmux:   $(bam_pm) active_ms=$(cat $BAM/power/runtime_active_time 2>/dev/null) suspended_ms=$(cat $BAM/power/runtime_suspended_time 2>/dev/null) control=$(cat $BAM/power/control 2>/dev/null)"
+	echo "usb0:       $(ip -4 addr show usb0 | awk '/inet /{print $2}') route-to-host: $(ip route get 172.16.42.2 2>&1 | head -1)"
+	echo "emmc:       $(awk '{print "writes_completed="$5" sectors_written="$7}' /sys/block/mmcblk0/stat)"
+	echo "dmesg-errs: $(dmesg | grep -cE 'Failed to resume|Resource temporarily|crash detected|fatal error|[Ww]atchdog|Oops|Kernel panic|Unable to handle')"
+}
+
+case "$1" in
+	start) do_start;;
+	stop) do_stop; exit $?;;
+	disconnect) do_disconnect; exit $?;;
+	status) do_status;;
+	addroute) [ -n "$2" ] || exit 2; addroute "$2";;
+	_anyconn) any_bearer_connected;;
+	_mmstate) mm_state;;
+	*) echo "usage: $0 start|stop|status|addroute <ipv4>"; exit 2;;
+esac

b6p/test/SHA256SUMS

@@ -0,0 +1,3 @@
+c7bd3a03e5e515ad39f76e9699f7839cb688b194472190e7f6d8a8e963c49aa6  p-datatest
+596a438dd28bdf2ca20691c60f46d4ba9df9e366fd2ed621fa44546db4ddf8bf  p-run.sh
+0f1460e6aa4db91592d3855901c545c31849f141630b36a27f7cb8ca3ca0360b  pon-read.sh

b6p/test/p-datatest

@@ -0,0 +1,28 @@
+#!/bin/sh
+# B6 data-path test through the bearer set up by aurora-modem start. Output dir $1. Uses only /32 routes (aurora-modem addroute).
+O=${1:-/tmp/b6/dt}; mkdir -p $O; . /run/aurora-modem/ipcfg || { echo "DT: no ipcfg"; exit 1; }
+CU="env LD_LIBRARY_PATH=/tmp/cu/usr/lib /tmp/cu/usr/bin/curl --cacert /tmp/cu/etc/ssl/certs/ca-certificates.crt --interface $IF -4 --connect-timeout 10 -sS"
+W='code=%{http_code} remote=%{remote_ip}:%{remote_port} local=%{local_ip} ssl_verify=%{ssl_verify_result} t_total=%{time_total}\n'
+D1=${DNS%%,*}
+{ for n in ya.ru www.google.com; do echo "### nslookup $n $D1"; timeout 20 nslookup $n $D1 2>&1; done; } > $O/dns.txt
+ips() { awk -v n="$1" '/^### nslookup/{c=($3==n)} c && /^Address[^:]*: *[0-9.]+$/{print $NF}' $O/dns.txt | grep -v "^$D1$" | sort -u | head -2; }
+YA=$(ips ya.ru); GO=$(ips www.google.com); YA1=$(echo $YA | cut -d' ' -f1); GO1=$(echo $GO | cut -d' ' -f1)
+for y in $YA $GO; do /usr/sbin/aurora-modem addroute $y; done
+{ echo "ya.ru=$YA google=$GO"; for h in 77.88.8.8 $YA1 172.16.42.2 8.8.4.4; do echo "--- route get $h: $(ip route get $h 2>&1 | head -1)"; done; } > $O/routes.txt
+{ for h in 77.88.8.8 1.1.1.1; do echo "### ping $h"; ping -c 3 -W 3 $h 2>&1; done; } > $O/ping.txt
+Y=$(date -u +%Y)
+{ echo "### http://ya.ru/"; timeout 40 $CU --resolve ya.ru:80:$YA1 -o /dev/null -w "$W" http://ya.ru/ 2>&1; echo "rc=$?"
+  if [ "$Y" -ge 2026 ]; then
+    echo "### https://www.google.com/generate_204"; timeout 40 $CU --resolve www.google.com:443:$GO1 -o /dev/null -w "$W" https://www.google.com/generate_204 2>&1; echo "rc=$?"
+    echo "### https://1.1.1.1/cdn-cgi/trace"; timeout 40 $CU -o /dev/null -w "$W" https://1.1.1.1/cdn-cgi/trace 2>&1; echo "rc=$?"
+  else echo "### HTTPS skipped: clock year $Y (not a cellular failure)"; fi; } > $O/http.txt
+DNSOK=$([ -n "$YA1" ] && [ -n "$GO1" ] && echo 1 || echo 0)
+PING=$(grep -oE "[0-9]+ packets received" $O/ping.txt | cut -d' ' -f1 | tr '\n' '+'); PING=${PING%+}
+PINGOK=$(grep -qE "[1-9][0-9]* packets received" $O/ping.txt && echo 1 || echo 0)
+HTTP=$(grep -A1 "^### http://" $O/http.txt | grep -oE "code=[0-9]+" | head -1)
+HTTPS=$(grep -oE "code=[0-9]+" $O/http.txt | tail -n +2 | tr '\n' ' ')
+HTTPOK=$(echo "$HTTP" | grep -qE "code=[1-5][0-9][0-9]" && echo 1 || echo 0)
+if [ "$Y" -ge 2026 ]; then echo "$HTTPS" | grep -q "code=204" && echo "$HTTPS" | grep -q "code=200" && HTTPSOK=1 || HTTPSOK=0; else HTTPSOK=skip; fi
+V=FAIL; [ $DNSOK$PINGOK$HTTPOK = 111 ] && [ "$HTTPSOK" != 0 ] && V=PASS
+echo "DATATEST $V dns=$DNSOK(ya=$YA1 go=$GO1) ping=$PING http=$HTTP https=[$HTTPS]($HTTPSOK) if=$IF addr=$A" | tee $O/verdict.txt
+[ $V = PASS ]

b6p/test/p-run.sh

@@ -0,0 +1,41 @@
+#!/bin/sh
+# B6P RAM test on a candidate boot (test-side only, not part of the image). $1 = name, $2 = reconnect cycles (default 3).
+# Waits for the autostarted service, data test on the autostart bearer, N x (disconnect -> start/reconnect -> data), then service stop.
+NAME=$1; NR=${2:-3}; O=/tmp/$NAME; mkdir -p $O; C=/usr/sbin/aurora-modem; D=/run/aurora-modem
+B=/sys/bus/platform/devices/4080000.remoteproc:bam-dmux; RPS=/sys/class/remoteproc/remoteproc0/state
+up() { cut -d' ' -f1 /proc/uptime; }
+mk() { echo "<5>[$NAME] $*" > /dev/kmsg; echo "[$(up)] $*" | tee -a $O/run.log; }
+nv() { for want in modemst1 modemst2 fsg fsc persist; do for p in /sys/class/block/mmcblk0p*; do
+	[ "$(sed -n 's/^PARTNAME=//p' $p/uevent)" = "$want" ] && echo "$want $(basename $p) $(sha256sum /dev/$(basename $p) | cut -d' ' -f1)"; done; done; }
+ERR='Failed to resume|-110|[ (=]-22\b|EAGAIN|Resource temporarily|crash detected|fatal error|[Ww]atchdog|wdog|Oops|Kernel panic|Unable to handle|BUG:'
+mk "date=$(date -u +%Y-%m-%dT%H:%M:%S) (clock not set by test)"
+[ -f /tmp/pon-read.sh ] && { sh /tmp/pon-read.sh > $O/pon.txt 2>&1; mk "PON regs 0808/080a/080c/080d: $(grep -E '^080[8acd]:' $O/pon.txt | tr '\n' ' ')"; }
+i=0; while ! grep -q "=== service start rc=" $D/service.log 2>/dev/null; do sleep 5; i=$((i+5)); [ $i -ge 900 ] && break; done
+mk "autostart: $(grep '=== service start rc=' $D/service.log | tail -1) / $(grep -m1 -oE 'START OK in [0-9.]+s|FAIL[^(]*' $D/lifecycle.log)"
+/etc/init.d/aurora-modem status > $O/status-autostart.txt 2>&1
+for q in nas-get-signal-info nas-get-cell-location-info nas-get-rf-band-info; do timeout 20 qmicli -p -d /dev/wwan0qmi0 --$q > $O/$q.txt 2>&1; done	# read-only
+v() { grep -m1 -oE "$1: *'[^']*'" $2 2>/dev/null | sed -E "s/.*'([^']*)'/\\1/"; }
+mk "radio after autostart: pci=$(v 'Serving Cell ID' $O/nas-get-cell-location-info.txt) earfcn=$(v 'EUTRA Absolute RF Channel Number' $O/nas-get-cell-location-info.txt) band=$(v 'Active Band Class' $O/nas-get-rf-band-info.txt) rsrp=$(v RSRP $O/nas-get-signal-info.txt) rsrq=$(v RSRQ $O/nas-get-signal-info.txt) snr=$(v SNR $O/nas-get-signal-info.txt)"
+printf 'cycle\taction\trc\tipv4\tverdict\tstale_routes\twwan_up\tbam\tmss\trmtfs\tmm\tusb\temmc_w\tdmesg_err\n' > $O/p-table.tsv
+row() { printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' "$1" "$2" "$3" "$(sed -n 's/^A=//p' $D/ipcfg 2>/dev/null)" "$4" \
+	$(ip route | grep -c " dev wwan") "$(for d in /sys/class/net/wwan*; do [ $(( $(cat $d/flags) & 1 )) -ne 0 ] && echo ${d##*/}; done | tr '\n' ',')" \
+	"$(cat $B/power/runtime_status)" "$(cat $RPS)" "$(pidof rmtfs)" "$(pidof ModemManager)" "$(ping -c1 -W2 172.16.42.2 >/dev/null 2>&1 && echo ok || echo FAIL)" \
+	"$(awk '{print $5"/"$7}' /sys/block/mmcblk0/stat)" "$(dmesg | grep -cE "$ERR")" >> $O/p-table.tsv; }
+F=
+if grep -q "START OK" $D/lifecycle.log; then
+	sh /tmp/p-datatest $O/dt0 > $O/dt0.out 2>&1; r=$?; row 0 autostart+data $r "$(cat $O/dt0/verdict.txt)"; [ $r = 0 ] || F="data0"
+	for c in $(seq 1 $NR); do [ -n "$F" ] && break
+		$C disconnect > $O/disc$c.out 2>&1; r=$?; row $c disconnect $r "-"; [ $r = 0 ] || { F="disconnect$c"; break; }
+		sleep 5
+		$C start > $O/start$c.out 2>&1; r=$?; [ $r = 0 ] || { row $c reconnect $r "-"; F="reconnect$c"; break; }
+		sh /tmp/p-datatest $O/dt$c > $O/dt$c.out 2>&1; r=$?; row $c reconnect+data $r "$(cat $O/dt$c/verdict.txt)"; [ $r = 0 ] || F="data$c"
+		mk "cycle $c: $(tail -1 $O/p-table.tsv | tr '\t' ' ')"
+	done
+else F="autostart"; fi
+mk "RESULT before stop: ${F:-all PASS}"
+/etc/init.d/aurora-modem status > $O/status-before-stop.txt 2>&1
+/etc/init.d/aurora-modem stop > $O/stop.out 2>&1; SR=$?; sleep 2; row end service-stop $SR "-"
+nv > $O/nv-after.txt; awk '{print $1,$3}' /tmp/nv-before.txt | grep -v '^stat' > $O/a; awk '{print $1,$3}' $O/nv-after.txt > $O/b; cmp -s $O/a $O/b && NVR=unchanged || NVR=CHANGED
+dmesg > $O/dmesg.txt; cp $D/lifecycle.log $D/service.log $D/rmtfs.log $D/reg-trans.tsv $O/ 2>/dev/null; cp /tmp/nv-before.txt $O/
+mk "FINAL: ${F:-all PASS}; service stop rc=$SR; nv $NVR; emmc $(awk '{print "w="$5" s="$7}' /sys/block/mmcblk0/stat); mss=$(cat $RPS) rmtfs='$(pidof rmtfs)' mm='$(pidof ModemManager)' bam=$(cat $B/power/runtime_status) wwan-up=$(for d in /sys/class/net/wwan*; do [ $(( $(cat $d/flags) & 1 )) -ne 0 ] && echo ${d##*/}; done | tr '\n' ' ') dmesg-errs=$(dmesg | grep -cE "$ERR") usb=$(ping -c2 -W2 172.16.42.2 >/dev/null 2>&1 && echo ok || echo FAIL)"
+tar -C /tmp -cf /tmp/$NAME.tar $NAME; mk "$NAME-RUN-END"

b6p/test/p7-boot.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+# 480s side, B6P P7 candidate boot K: (board already in lk1st fastboot via RESET-held power-on) fastboot boot -> NCM -> push test tools -> p-run.sh p7bK 0 -> fetch
+K=$1; cd ~/doc/modem/jz08-aurora; L=logs/uart/b6-20260930-160910.log; T=/dev/ttyUSB0
+fastboot devices | grep -q <EMMC_SERIAL> || { echo "NOT IN FASTBOOT"; exit 1; }
+wc -l < $L > /tmp/p7-off-$K; sha256sum b6p/out/aurora-mm1-b6p.img | cut -c1-16
+{ echo "### $(date -Is) fastboot boot b6p/out/aurora-mm1-b6p.img (18a25e39, B6P P7 boot $K)"; fastboot boot b6p/out/aurora-mm1-b6p.img 2>&1; echo rc=$?; } | tee logs/uart/b6p-p7b$K-fastboot.txt
+for i in $(seq 1 60); do ping -c1 -W1 172.16.42.1 >/dev/null 2>&1 && break; sleep 2; done; sleep 3
+printf "%s\r" "mkdir -p /tmp/in; nc -l -p 9993 > /tmp/in/p.tar & nc -l -p 9994 > /tmp/in/cu.tar & echo LP7" > $T; sleep 2
+ncat --send-only 172.16.42.1 9993 < b6p/p-test.tar; ncat --send-only 172.16.42.1 9994 < linux/beeline/curl/cu.tar; sleep 1
+printf "%s\r" "cd /tmp && tar xf /tmp/in/p.tar && sha256sum -c SHA256SUMS && mkdir -p cu && tar -C cu -xf /tmp/in/cu.tar; cd /; sh /tmp/p-run.sh p7b$K 0 > /tmp/p7-run.out 2>&1 &" > $T
+until grep -aq "p7b$K-RUN-END" $L; do sleep 5; done
+tail -n +$(cat /tmp/p7-off-$K) $L | grep -a "Linux version\|EMMC-RO-SUMMARY\|B1_OK\|aurora-modem: starting\|REG t+\|START OK\|FAIL in\|\[p7b$K\]" | cut -c1-230
+printf "%s\r" "nc -l -p 9995 < /tmp/p7b$K.tar &" > $T; sleep 2; mkdir -p logs/b6p; ncat --recv-only 172.16.42.1 9995 > logs/b6p/p7b$K.tar; sha256sum logs/b6p/p7b$K.tar

b6p/test/p9-sha.sh

@@ -0,0 +1,4 @@
+#!/bin/sh
+for w in cache boot aboot sbl1 rpm tz hyp recovery modemst1 modemst2 fsg fsc persist; do for p in /sys/class/block/mmcblk0p*; do
+	b=$(basename $p); [ "$(sed -n 's/^PARTNAME=//p' $p/uevent)" = "$w" ] && echo "P9SHA $w $b ro=$(blockdev --getro /dev/$b) $(sha256sum /dev/$b | cut -d' ' -f1)"; done; done
+echo "P9END emmc_w=$(awk '{print $5"/"$7}' /sys/block/mmcblk0/stat)"

b6p/test/pc-boot.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+# 480s side, B6P persistent cold boot K (no host action on the boot path): wait NCM -> verify extlinux 'b6p' path in UART -> push test tools -> p-run.sh pcK 0 -> fetch
+K=$1; cd ~/doc/modem/jz08-aurora; L=logs/uart/b6-20260930-160910.log; T=/dev/ttyUSB0
+[ -f /tmp/pc-off-$K ] || { n=$(grep -an "SBL1, Start" $L | tail -1 | cut -d: -f1); echo $((n-1)) > /tmp/pc-off-$K; }	# from the last power-on
+O0=$(cat /tmp/pc-off-$K); mkdir -p logs/b6p; sed -n "$((O0>40?O0-40:1)),$((O0+1))p" $L > logs/b6p/pc$K-pre-sbl1.txt	# final UART lines before this power-on
+for i in $(seq 1 120); do ping -c1 -W1 172.16.42.1 >/dev/null 2>&1 && break; sleep 3; done; echo "NCM after ~$((i*3))s"; sleep 3
+printf "%s\r" "mkdir -p /tmp/in; nc -l -p 9993 > /tmp/in/p.tar & nc -l -p 9994 > /tmp/in/cu.tar & echo LPC" > $T; sleep 2
+ncat --send-only 172.16.42.1 9993 < b6p/p-test.tar; ncat --send-only 172.16.42.1 9994 < linux/beeline/curl/cu.tar; sleep 1
+printf "%s\r" "cd /tmp && tar xf /tmp/in/p.tar && sha256sum -c SHA256SUMS && mkdir -p cu && tar -C cu -xf /tmp/in/cu.tar; cd /; sh /tmp/p-run.sh pc$K 0 > /tmp/pc-run.out 2>&1 &" > $T
+n=0; until grep -aq "pc$K-RUN-END" $L; do sleep 5; n=$((n+1)); [ $((n % 6)) = 0 ] && echo "[$(date +%T)] alive-probe NCM $(ping -c1 -W2 172.16.42.1 >/dev/null 2>&1 && echo ok || echo LOST) last-uart: $(tail -1 $L | cut -c1-100)" >> logs/b6p/pc$K-alive.txt; done
+tail -n +$(cat /tmp/pc-off-$K) $L | grep -a "SBL1, Start\|booting linux\|ramdisk @\|Linux version\|EMMC-RO-SUMMARY\|B1_OK\|AURORA RAM BOOT\|aurora-modem: starting\|REG t+\|START OK\|FAIL in\|\[pc$K\]" | cut -c1-230
+FP=$((9960+K)); printf "%s\r" "nc -l -p $FP < /tmp/pc$K.tar &" > $T; sleep 2; mkdir -p logs/b6p; ncat --recv-only 172.16.42.1 $FP > logs/b6p/pc$K.tar; sha256sum logs/b6p/pc$K.tar

b6p/test/pon-decode.txt

@@ -0,0 +1,6 @@
+PM8916 PON (SPMI SID0, base 0x800) reason registers, read-only via /sys/kernel/debug/regmap/0-00/registers (9 B/line, offset reg*9).
+Bit names per Qualcomm downstream drivers/input/misc/qpnp-power-on.c tables (not verified against a PM8916 datasheet):
+ 0x808 PON_REASON1: b0 Hard Reset, b1 SMPL, b2 RTC alarm, b3 DC charger, b4 USB charger insertion, b5 PON1, b6 CBL, b7 KPD (power key)
+ 0x80A WARM_RESET_REASON1 / 0x80C POFF_REASON1: b0 SOFT, b1 PS_HOLD, b2 PMIC_WD, b3 GP1, b4 GP2, b5 KPDPWR_AND_RESIN, b6 RESIN_N, b7 KPDPWR_N
+ 0x80D POFF_REASON2: b3 CHARGER, b4 TFT (thermal fault), b5 UVLO (under-voltage lock-out), b6 OTST3 (over-temperature), b7 STAGE3
+2026-09-30 22:30 (boot after the 22:26:10 spontaneous reset): 0808=10 (USB charger insertion), 080a=02 (PS_HOLD, likely stale), 080c=00, 080d=20 (UVLO).

b6p/test/pon-read.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+# read-only: PM8916 PON block reason registers 0x0800-0x080F via regmap debugfs positioned read (no writes)
+grep -q " /sys/kernel/debug " /proc/mounts || mount -t debugfs debugfs /sys/kernel/debug
+R=/sys/kernel/debug/regmap/0-00/registers
+echo "uptime $(cut -d' ' -f1 /proc/uptime)"
+dd if=$R bs=9 skip=$((0x800)) count=16 2>/dev/null
+echo PON-READ-END

b6p/test/rr-probe.sh

@@ -0,0 +1,10 @@
+#!/bin/sh
+# read-only probe: what reset-reason sources exist
+grep -q " /sys/kernel/debug " /proc/mounts || mount -t debugfs debugfs /sys/kernel/debug
+echo "== regmap"; ls /sys/kernel/debug/regmap/ 2>&1
+for r in /sys/kernel/debug/regmap/*; do echo "$r name=$(cat $r/name 2>/dev/null)"; done
+echo "== pstore"; grep pstore /proc/mounts; mkdir -p /sys/fs/pstore 2>/dev/null; mount -t pstore pstore /sys/fs/pstore 2>&1; ls -la /sys/fs/pstore 2>&1
+dmesg | grep -iE "ramoops|pstore|pon|wdt|watchdog|reboot" | head -20
+echo "== watchdog"; ls -la /dev/watchdog* 2>&1; ls /sys/class/watchdog 2>&1
+echo "== dt"; ls /proc/device-tree/reserved-memory 2>&1 | tr '\n' ' '; echo; find /proc/device-tree -name "*pon*" -o -name "*watchdog*" 2>/dev/null | head
+echo RR-PROBE-END

logs/b6j/j1/c1/bearer.txt

@@ -0,0 +1,27 @@
+  ----------------------------------------
+  General            |               path: /org/freedesktop/ModemManager1/Bearer/1
+                     |               type: default
+  ----------------------------------------
+  Status             |          connected: yes
+                     | disconnect request: no
+                     |          suspended: no
+                     |        multiplexed: no
+                     |          interface: wwan0
+                     |         ip timeout: 20
+  ----------------------------------------
+  Properties         |                apn: internet.beeline.ru
+                     |            roaming: allowed
+                     |            ip type: ipv4
+                     |       allowed-auth: pap
+                     |               user: beeline
+                     |           password: beeline
+  ----------------------------------------
+  IPv4 configuration |             method: static
+                     |            address: 10.45.73.171
+                     |             prefix: 29
+                     |            gateway: 10.45.73.172
+                     |                dns: 10.10.22.3, 194.186.191.1
+                     |                mtu: 1500
+  ----------------------------------------
+  Statistics         |         start date: 2026-09-30T14:42:14Z
+                     |           attempts: 1

logs/b6j/j1/c1/dmesg-delta.txt

@@ -0,0 +1,63 @@
+[ 6694.516819] [j1] CYCLE 1 begin: emmc w=0 s=0 mss=offline rmtfs=''
+[ 6694.540131] [aurora-modem] === START (conf /tmp/j1.conf, apn 'internet.beeline.ru', ip-type ipv4)
+[ 6694.609472] remoteproc remoteproc0: powering up 4080000.remoteproc
+[ 6694.609845] remoteproc remoteproc0: Booting fw image mba.mbn, size 234176
+[ 6694.621199] [aurora-modem] STATE OFF -> RMTFS_READY
+[ 6694.626527] [aurora-modem] STATE RMTFS_READY -> MPSS_BOOTING
+[ 6694.656524] qcom-q6v5-mss 4080000.remoteproc: MBA booted without debug policy, loading mpss
+[ 6695.196652] remoteproc remoteproc0: remote processor 4080000.remoteproc is now up
+[ 6695.295360] [aurora-modem] MSS running after 0.7s
+[ 6695.300998] [aurora-modem] STATE MPSS_BOOTING -> MPSS_RUNNING
+[ 6695.768859] wwan wwan0: port wwan0at0 attached
+[ 6695.770830] wwan wwan0: port wwan0at1 attached
+[ 6695.944345] bam-dmux 4080000.remoteproc:bam-dmux: Channel already open: 0
+[ 6695.944408] bam-dmux 4080000.remoteproc:bam-dmux: Channel already open: 1
+[ 6695.950196] bam-dmux 4080000.remoteproc:bam-dmux: Channel already open: 2
+[ 6695.957056] bam-dmux 4080000.remoteproc:bam-dmux: Channel already open: 3
+[ 6695.963699] bam-dmux 4080000.remoteproc:bam-dmux: Channel already open: 4
+[ 6695.970458] bam-dmux 4080000.remoteproc:bam-dmux: Channel already open: 5
+[ 6695.977228] bam-dmux 4080000.remoteproc:bam-dmux: Channel already open: 6
+[ 6695.983997] bam-dmux 4080000.remoteproc:bam-dmux: Channel already open: 7
+[ 6695.991201] wwan wwan0: port wwan0qmi0 attached
+[ 6696.146297] [aurora-modem] wwan0qmi0 + wwan0 present after 0.8s; +2 s (JZ02 rpmsg_wwan_ctrl port-race guard, proven start_post)
+[ 6698.325929] [aurora-modem] STATE MPSS_RUNNING -> QMI_READY
+[ 6698.337186] [aurora-modem] DMS Mode: 'shutting-down' after 0.2s
+[ 6698.389759] [aurora-modem] STATE QMI_READY -> SIM_READY
+[ 6698.398560] [aurora-modem] UIM card present, USIM app ready after 0.1s
+[ 6698.405794] [aurora-modem] SET: qmicli -p -d /dev/wwan0qmi0 --dms-set-operating-mode=online (retried only on DeviceNotReady, <= 30s)
+[ 6701.635963] [aurora-modem] DMS online after 3.2s
+[ 6701.642542] [aurora-modem] STATE SIM_READY -> RADIO_ONLINE
+[ 6705.794748] [aurora-modem] registered: MCC: '250' MNC: '99' Description: 'Beeline' MCC: '250' MNC: '99' after 4.2s
+[ 6705.800099] [aurora-modem] STATE RADIO_ONLINE -> REGISTERED
+[ 6706.026185] [aurora-modem] ModemManager started pid 19880 (log mm-6.log)
+[ 6754.376894] [aurora-modem] MM modem 0 detected after 48.3s
+[ 6754.482620] [aurora-modem] STATE REGISTERED -> MM_READY
+[ 6754.675973] [aurora-modem] MM state disabled after 0.2s
+[ 6754.821610] [aurora-modem] mmcli -m 0 --simple-connect="apn=internet.beeline.ru,user=beeline,password=***,allowed-auth=pap,ip-type=ipv4"
+[ 6765.521865] [aurora-modem] MM state connected, registration: home
+[ 6765.607991] [aurora-modem] bearer 1: wwan0 10.45.73.171/29 gw 10.45.73.172 dns 10.10.22.3,194.186.191.1 mtu 1500
+[ 6765.676981] [aurora-modem] STATE MM_READY -> BEARER_CONNECTED
+[ 6765.687983] [aurora-modem] === START OK in 71.1s (wwan0 10.45.73.171/29, routes: 10.10.22.3 194.186.191.1 77.88.8.8 1.1.1.1 )
+[ 6765.688979] [j1] CYCLE 1 start rc=0
+[ 6771.459094] [j1] CYCLE 1 DATATEST PASS dns=1(ya=5.255.255.242 go=142.251.150.119) ping=3+3 http=code=302 https=[code=204 code=200 ](1) if=wwan0 addr=10.45.73.171 rc=0
+[ 6771.520388] [aurora-modem] === STOP (from BEARER_CONNECTED: mss=running rmtfs=19591 mm=19880 bam=active)
+[ 6772.157533] [aurora-modem] simple-disconnect rc=0 (bearers: 1 )
+[ 6772.329859] [aurora-modem] no bearer connected
+[ 6772.332249] [aurora-modem] MODEM_STOP_DISABLE=0: no MM disable
+[ 6772.417401] [aurora-modem] wwan links down, addresses/routes removed
+[ 6772.428158] [aurora-modem] STATE BEARER_CONNECTED -> WWAN_DOWN
+[ 6775.118745] [aurora-modem] ModemManager stopped
+[ 6775.166727] [aurora-modem] qmi-proxy stopped
+[ 6775.171866] [aurora-modem] STATE WWAN_DOWN -> MM_STOPPED
+[ 6775.196489] [aurora-modem] BAM-DMUX suspended after 0.0s
+[ 6775.223298] wwan wwan0: port wwan0at0 disconnected
+[ 6775.224011] [aurora-modem] SIGTERM rmtfs 19591 (rmtfs stops MSS, then exits)
+[ 6775.224476] wwan wwan0: port wwan0at1 disconnected
+[ 6775.235952] wwan wwan0: port wwan0qmi0 disconnected
+[ 6775.244669] remoteproc remoteproc0: stopped remote processor 4080000.remoteproc
+[ 6775.464920] [aurora-modem] MSS offline after 0.2s (rmtfs alive: no)
+[ 6775.470654] [aurora-modem] STATE MM_STOPPED -> MPSS_STOPPED
+[ 6775.489193] [aurora-modem] rmtfs exited after 0.3s
+[ 6775.503181] [aurora-modem] STATE MPSS_STOPPED -> OFF
+[ 6775.553088] [aurora-modem] === STOP done rc=0 in 4.0s (mss=offline rmtfs='' mm='' bam=suspended)
+[ 6775.553993] [j1] CYCLE 1 stop rc=0

logs/b6j/j1/c1/dmesg-off

@@ -0,0 +1 @@
+890

logs/b6j/j1/c1/dt.out

@@ -0,0 +1 @@
+DATATEST PASS dns=1(ya=5.255.255.242 go=142.251.150.119) ping=3+3 http=code=302 https=[code=204 code=200 ](1) if=wwan0 addr=10.45.73.171

logs/b6j/j1/c1/dt/dns.txt

@@ -0,0 +1,56 @@
+### nslookup ya.ru 10.10.22.3
+Server:		10.10.22.3
+Address:	10.10.22.3:53
+
+Non-authoritative answer:
+Name:	ya.ru
+Address: 5.255.255.242
+Name:	ya.ru
+Address: 77.88.44.242
+Name:	ya.ru
+Address: 77.88.55.242
+
+Non-authoritative answer:
+Name:	ya.ru
+Address: 2a02:6b8::2:242
+
+### nslookup www.google.com 10.10.22.3
+Server:		10.10.22.3
+Address:	10.10.22.3:53
+
+Non-authoritative answer:
+Name:	www.google.com
+Address: 142.251.156.119
+Name:	www.google.com
+Address: 142.251.150.119
+Name:	www.google.com
+Address: 142.251.153.119
+Name:	www.google.com
+Address: 142.251.152.119
+Name:	www.google.com
+Address: 142.251.155.119
+Name:	www.google.com
+Address: 142.251.151.119
+Name:	www.google.com
+Address: 142.251.157.119
+Name:	www.google.com
+Address: 142.251.154.119
+
+Non-authoritative answer:
+Name:	www.google.com
+Address: 2001:4860:482a:7700::
+Name:	www.google.com
+Address: 2001:4860:482b:7700::
+Name:	www.google.com
+Address: 2001:4860:4827:7700::
+Name:	www.google.com
+Address: 2001:4860:4828:7700::
+Name:	www.google.com
+Address: 2001:4860:4829:7700::
+Name:	www.google.com
+Address: 2001:4860:482c:7700::
+Name:	www.google.com
+Address: 2001:4860:4826:7700::
+Name:	www.google.com
+Address: 2001:4860:482d:7700::
+

logs/b6j/j1/c1/dt/http.txt

@@ -0,0 +1,9 @@
+### http://ya.ru/
+code=302 remote=5.255.255.242:80 local=10.45.73.171 ssl_verify=0 t_total=0.113091
+rc=0
+### https://www.google.com/generate_204
+code=204 remote=142.251.150.119:443 local=10.45.73.171 ssl_verify=0 t_total=0.238516
+rc=0
+### https://1.1.1.1/cdn-cgi/trace
+code=200 remote=1.1.1.1:443 local=10.45.73.171 ssl_verify=0 t_total=0.246662
+rc=0

logs/b6j/j1/c1/dt/ping.txt

@@ -0,0 +1,18 @@
+### ping 77.88.8.8
+PING 77.88.8.8 (77.88.8.8): 56 data bytes
+64 bytes from 77.88.8.8: seq=0 ttl=47 time=55.460 ms
+64 bytes from 77.88.8.8: seq=1 ttl=47 time=49.580 ms
+64 bytes from 77.88.8.8: seq=2 ttl=47 time=40.024 ms
+
+--- 77.88.8.8 ping statistics ---
+3 packets transmitted, 3 packets received, 0% packet loss
+round-trip min/avg/max = 40.024/48.354/55.460 ms
+### ping 1.1.1.1
+PING 1.1.1.1 (1.1.1.1): 56 data bytes
+64 bytes from 1.1.1.1: seq=0 ttl=50 time=44.825 ms
+64 bytes from 1.1.1.1: seq=1 ttl=50 time=53.896 ms
+64 bytes from 1.1.1.1: seq=2 ttl=50 time=61.524 ms
+
+--- 1.1.1.1 ping statistics ---
+3 packets transmitted, 3 packets received, 0% packet loss
+round-trip min/avg/max = 44.825/53.415/61.524 ms

logs/b6j/j1/c1/dt/routes.txt

@@ -0,0 +1,7 @@
+ya.ru=5.255.255.242
+77.88.44.242 google=142.251.150.119
+142.251.151.119
+--- route get 77.88.8.8: 77.88.8.8 dev wwan0  src 10.45.73.171 
+--- route get 5.255.255.242: 5.255.255.242 dev wwan0  src 10.45.73.171 
+--- route get 172.16.42.2: 172.16.42.2 dev usb0  src 172.16.42.1 
+--- route get 8.8.4.4: ip: RTNETLINK answers: Network is unreachable

logs/b6j/j1/c1/dt/verdict.txt

@@ -0,0 +1 @@
+DATATEST PASS dns=1(ya=5.255.255.242 go=142.251.150.119) ping=3+3 http=code=302 https=[code=204 code=200 ](1) if=wwan0 addr=10.45.73.171

logs/b6j/j1/c1/ipcfg

@@ -0,0 +1,7 @@
+BR=1
+IF=wwan0
+A=10.45.73.171
+PF=29
+GW=10.45.73.172
+DNS=10.10.22.3,194.186.191.1
+MTU=1500

logs/b6j/j1/c1/lifecycle.log

@@ -0,0 +1,46 @@
+[6694.39] === START (conf /tmp/j1.conf, apn 'internet.beeline.ru', ip-type ipv4)
+[6694.47] STATE OFF -> RMTFS_READY
+[6694.48] STATE RMTFS_READY -> MPSS_BOOTING
+[6695.15] MSS running after 0.7s
+[6695.15] STATE MPSS_BOOTING -> MPSS_RUNNING
+[6696.00] wwan0qmi0 + wwan0 present after 0.8s; +2 s (JZ02 rpmsg_wwan_ctrl port-race guard, proven start_post)
+[6698.18] STATE MPSS_RUNNING -> QMI_READY
+[6698.19] DMS Mode: 'shutting-down' after 0.2s
+[6698.24] STATE QMI_READY -> SIM_READY
+[6698.25] UIM card present, USIM app ready after 0.1s
+[6698.26] SET: qmicli -p -d /dev/wwan0qmi0 --dms-set-operating-mode=online (retried only on DeviceNotReady, <= 30s)
+error: couldn't set operating mode: QMI protocol error (52): 'DeviceNotReady'
+error: couldn't set operating mode: QMI protocol error (52): 'DeviceNotReady'
+error: couldn't set operating mode: QMI protocol error (52): 'DeviceNotReady'
+[/dev/wwan0qmi0] Operating mode set successfully
+[6701.49] DMS online after 3.2s
+[6701.49] STATE SIM_READY -> RADIO_ONLINE
+[6705.64] registered: MCC: '250' MNC: '99' Description: 'Beeline' MCC: '250' MNC: '99' after 4.2s
+[6705.65] STATE RADIO_ONLINE -> REGISTERED
+[6705.88] ModemManager started pid 19880 (log mm-6.log)
+[6754.23] MM modem 0 detected after 48.3s
+[6754.33] STATE REGISTERED -> MM_READY
+[6754.53] MM state disabled after 0.2s
+[6754.67] mmcli -m 0 --simple-connect="apn=internet.beeline.ru,user=beeline,password=***,allowed-auth=pap,ip-type=ipv4"
+successfully connected the modem at bearer /org/freedesktop/ModemManager1/Bearer/1
+[6765.37] MM state connected, registration: home
+[6765.46] bearer 1: wwan0 10.45.73.171/29 gw 10.45.73.172 dns 10.10.22.3,194.186.191.1 mtu 1500
+[6765.53] STATE MM_READY -> BEARER_CONNECTED
+[6765.54] === START OK in 71.1s (wwan0 10.45.73.171/29, routes: 10.10.22.3 194.186.191.1 77.88.8.8 1.1.1.1 )
+[6771.37] === STOP (from BEARER_CONNECTED: mss=running rmtfs=19591 mm=19880 bam=active)
+successfully disconnected all bearers in the modem
+[6772.00] simple-disconnect rc=0 (bearers: 1 )
+[6772.18] no bearer connected
+[6772.18] MODEM_STOP_DISABLE=0: no MM disable
+[6772.27] wwan links down, addresses/routes removed
+[6772.28] STATE BEARER_CONNECTED -> WWAN_DOWN
+[6774.97] ModemManager stopped
+[6775.02] qmi-proxy stopped
+[6775.02] STATE WWAN_DOWN -> MM_STOPPED
+[6775.05] BAM-DMUX suspended after 0.0s
+[6775.07] SIGTERM rmtfs 19591 (rmtfs stops MSS, then exits)
+[6775.31] MSS offline after 0.2s (rmtfs alive: no)
+[6775.32] STATE MM_STOPPED -> MPSS_STOPPED
+[6775.34] rmtfs exited after 0.3s
+[6775.35] STATE MPSS_STOPPED -> OFF
+[6775.40] === STOP done rc=0 in 4.0s (mss=offline rmtfs='' mm='' bam=suspended)

logs/b6j/j1/c1/log-off

@@ -0,0 +1 @@
+418

logs/b6j/j1/c1/qmi-ss.txt

@@ -0,0 +1,29 @@
+[/dev/wwan0qmi0] Successfully got serving system:
+	Registration state: 'registered'
+	CS: 'detached'
+	PS: 'attached'
+	Selected network: '3gpp'
+	Radio interfaces: '1'
+		[0]: 'lte'
+	Roaming status: 'off'
+	Data service capabilities: '1'
+		[0]: 'lte'
+	Current PLMN:
+		MCC: '250'
+		MNC: '99'
+		Description: 'Beeline'
+	Roaming indicators: '1'
+		[0]: 'off' (lte)
+	3GPP location area code: '<CELL>'
+	3GPP cell ID: '<CELL>'
+	Detailed status:
+		Status: 'available'
+		Capability: 'ps'
+		HDR Status: 'none'
+		HDR Hybrid: 'no'
+		Forbidden: 'no'
+	LTE tracking area code: '<CELL>'
+	Full operator code info:
+		MCC: '250'
+		MNC: '99'
+		MNC with PCS digit: 'no'

logs/b6j/j1/c1/reg-nas-get-cell-location-info.txt

@@ -0,0 +1,25 @@
+[/dev/wwan0qmi0] Successfully got cell location info
+Intrafrequency LTE Info
+	UE In Idle: 'no'
+	PLMN: '25099'
+	Tracking Area Code: '<CELL>'
+	Global Cell ID: '<CELL>'
+	EUTRA Absolute RF Channel Number: '1275' (E-UTRA band 3: 1800+)
+	Serving Cell ID: '55'
+	Cell [0]:
+		Physical Cell ID: '55'
+		RSRQ: '-15.5' dB
+		RSRP: '-99.8' dBm
+		RSSI: '-65.3' dBm
+	Cell [1]:
+		Physical Cell ID: '8'
+		RSRQ: '-19.3' dB
+		RSRP: '-105.0' dBm
+		RSSI: '-76.4' dBm
+Interfrequency LTE Info
+	UE In Idle: 'no'
+LTE Info Neighboring GSM
+	UE In Idle: 'no'
+LTE Info Neighboring WCDMA
+	UE In Idle: 'no'
+LTE Timing Advance: '2' us

logs/b6j/j1/c1/reg-nas-get-rf-band-info.txt

@@ -0,0 +1,5 @@
+[/dev/wwan0qmi0] Successfully got RF band info
+Band Information:
+	Radio Interface:   'lte'
+	Active Band Class: 'eutran-3'
+	Active Channel:    '1275'

logs/b6j/j1/c1/reg-nas-get-signal-info.txt

@@ -0,0 +1,6 @@
+[/dev/wwan0qmi0] Successfully got signal info
+LTE:
+	RSSI: '-66 dBm'
+	RSRQ: '-16 dB'
+	RSRP: '-100 dBm'
+	SNR: '-1.0 dB'

logs/b6j/j1/c1/reg-nas-get-system-info.txt

@@ -0,0 +1,29 @@
+[/dev/wwan0qmi0] Successfully got system info:
+	GSM service:
+		Status: 'none'
+		True Status: 'none'
+		Preferred data path: 'no'
+	WCDMA service:
+		Status: 'none'
+		True Status: 'none'
+		Preferred data path: 'no'
+	LTE service:
+		Status: 'available'
+		True Status: 'none'
+		Preferred data path: 'no'
+		Domain: 'ps'
+		Service capability: 'ps'
+		Roaming status: 'off'
+		Forbidden: 'no'
+		Cell ID: '<CELL>'
+		MCC: '250'
+		MNC: '99'
+		Tracking Area Code: '<CELL>'
+		Voice support: 'no'
+		IMS voice support: 'no'
+		eMBMS coverage info support: 'no'
+		eMBMS coverage info trace ID: '65535'
+		Cell access: 'all-calls'
+		Registration restriction: 'unrestricted'
+		Registration domain: 'not-applicable'
+	SIM reject info: 'available'

logs/b6j/j1/c1/rmtfs-delta.log

@@ -0,0 +1,24 @@
+registering services
+[RMTFS] packet; from: 0:4
+[RMTFS] open /boot/modem_fs1 => 0 (0:0)
+[RMTFS] packet; from: 0:5
+[RMTFS] open /boot/modem_fs2 => 1 (0:0)
+[RMTFS] packet; from: 0:6
+[RMTFS] open /boot/modem_fsg => 2 (0:0)
+[RMTFS] packet; from: 0:7
+[RMTFS] open /boot/modem_fsc => 3 (0:0)
+[RMTFS] packet; from: 0:7
+[RMTFS] alloc 0, 917504 => 0x86700000 (0:0)
+[RMTFS] packet; from: 0:7
+[RMTFS] iovec 0, not forced => (0:0)
+[RMTFS]       read 1:1 0x86700200
+[RMTFS] packet; from: 0:7
+[RMTFS] iovec 1, not forced => (0:0)
+[RMTFS]       read 1:1 0x86700200
+[RMTFS] packet; from: 0:7
+[RMTFS] iovec 1, not forced => (0:0)
+[RMTFS]       read 2:1790 0x86700400
+[RMTFS] packet; from: 1:-2
+[RMTFS] del_client 1:16385
+[RMTFS] packet; from: 1:-2
+[RMTFS] bye from 0

logs/b6j/j1/c1/rmtfs-off

@@ -0,0 +1 @@
+294

logs/b6j/j1/c1/start.out

@@ -0,0 +1,24 @@
+[6694.39] === START (conf /tmp/j1.conf, apn 'internet.beeline.ru', ip-type ipv4)
+[6694.47] STATE OFF -> RMTFS_READY
+[6694.48] STATE RMTFS_READY -> MPSS_BOOTING
+[6695.15] MSS running after 0.7s
+[6695.15] STATE MPSS_BOOTING -> MPSS_RUNNING
+[6696.00] wwan0qmi0 + wwan0 present after 0.8s; +2 s (JZ02 rpmsg_wwan_ctrl port-race guard, proven start_post)
+[6698.18] STATE MPSS_RUNNING -> QMI_READY
+[6698.19] DMS Mode: 'shutting-down' after 0.2s
+[6698.24] STATE QMI_READY -> SIM_READY
+[6698.25] UIM card present, USIM app ready after 0.1s
+[6698.26] SET: qmicli -p -d /dev/wwan0qmi0 --dms-set-operating-mode=online (retried only on DeviceNotReady, <= 30s)
+[6701.49] DMS online after 3.2s
+[6701.49] STATE SIM_READY -> RADIO_ONLINE
+[6705.64] registered: MCC: '250' MNC: '99' Description: 'Beeline' MCC: '250' MNC: '99' after 4.2s
+[6705.65] STATE RADIO_ONLINE -> REGISTERED
+[6705.88] ModemManager started pid 19880 (log mm-6.log)
+[6754.23] MM modem 0 detected after 48.3s
+[6754.33] STATE REGISTERED -> MM_READY
+[6754.53] MM state disabled after 0.2s
+[6754.67] mmcli -m 0 --simple-connect="apn=internet.beeline.ru,user=beeline,password=***,allowed-auth=pap,ip-type=ipv4"
+[6765.37] MM state connected, registration: home
+[6765.46] bearer 1: wwan0 10.45.73.171/29 gw 10.45.73.172 dns 10.10.22.3,194.186.191.1 mtu 1500
+[6765.53] STATE MM_READY -> BEARER_CONNECTED
+[6765.54] === START OK in 71.1s (wwan0 10.45.73.171/29, routes: 10.10.22.3 194.186.191.1 77.88.8.8 1.1.1.1 )

logs/b6j/j1/c1/stat.txt

@@ -0,0 +1 @@
+    4746       42  1192147     7958        0        0        0        0        0     6296     7958        0        0        0        0        0        0

logs/b6j/j1/c1/status-down.txt

@@ -0,0 +1,12 @@
+controller: OFF
+remoteproc: 4080000.remoteproc offline (/sys/class/remoteproc/remoteproc0) fw=mba.mbn
+rmtfs:      pid='' writes_logged=8
+qmi dev:    absent  qmi-proxy=''
+daemons:    udevd='20932 20931 20930 20929 2165' dbus='2195' polkitd='2199' ModemManager=''
+  mm: n/a
+wwan up:    0 of 8
+routes:     
+bam-dmux:   suspended active_ms=33010 suspended_ms=6743759 control=auto
+usb0:       172.16.42.1/24 route-to-host: 172.16.42.2 dev usb0  src 172.16.42.1 
+emmc:       writes_completed=0 sectors_written=0
+dmesg-errs: 0