--- dts/msm8916-jz08-aurora-emmc1.dts	2026-09-30 03:49:29.083717184 +0600
+++ dts/msm8916-jz08-aurora-modem1.dts	2026-09-30 04:08:54.921612695 +0600
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
  * Project Aurora — JZ08AU-XPA-7J-R3 (MSM8916, 512 MB, ST7735S SPI panel).
- * RAM-BOOT EMMC1: USB1 + internal eMMC (sdhc_1) for READ-ONLY verification. Everything that could touch
+ * RAM-BOOT MODEM1: EMMC1 + MPSS remoteproc (native Aurora firmware, rmtfs -r). No BAM-DMUX/WWAN/WCNSS. Everything that could touch
  * storage, radios or power management is explicitly disabled.
  *
  * Hardware facts from stock Aurora dtb_01 (see NOTES.md S2.1/S12):
@@ -14,7 +14,7 @@
 #include "msm8916-pm8916.dtsi"	/* + RPM regulators (USB PHY L7/L13) */
 
 / {
-	model = "JZ08AU Aurora (RAM boot EMMC1)";
+	model = "JZ08AU Aurora (RAM boot MODEM1)";
 	compatible = "jz08au,aurora", "qcom,msm8916";
 	chassis-type = "embedded";
 
@@ -35,11 +35,11 @@
 	status = "okay";
 };
 
-/* --- RAM boot EMMC1 safety: no SD slot, no radios --- */
+/* --- RAM boot MODEM1 safety: no SD slot, no Wi-Fi, no modem data plane --- */
 /* sdhc_1 (eMMC): enabled below, READ-ONLY enforced by initramfs (blockdev --setro) */
 &sdhc_2 { status = "disabled"; };
 /* usb: see peripheral block below */
-&mpss { status = "disabled"; };
+/* mpss: enabled below */
 &bam_dmux { status = "disabled"; };
 &bam_dmux_dma { status = "disabled"; };
 &wcnss { status = "disabled"; };	/* WCNSS/pronto remoteproc */
@@ -72,3 +72,49 @@
 &sdhc_1 {
 	status = "okay";
 };
+
+/*
+ * MPSS (modem) remoteproc, native Aurora firmware from the RO-mounted modem FAT.
+ * mpss_mem: stock Aurora "modem_adsp_region" base 0x86800000 size 78 MiB (0x4e00000);
+ * Aurora modem.mdt load span 0x86800000..0x8b300000 (75 MiB), same as stock PIL log.
+ * mba_mem: upstream dynamic 1 MiB. pll-supply (pm8916_l7), cx/mx rpmpd from msm8916(-pm8916).dtsi.
+ * Driver has auto_boot = false: MSS starts only when rmtfs (-s) requests it.
+ * BAM-DMUX stays disabled (no data plane at this stage).
+ */
+&mba_mem {
+	status = "okay";
+};
+
+&mpss_mem {
+	reg = <0x0 0x86800000 0x0 0x4e00000>;
+	status = "okay";
+};
+
+&mpss {
+	pinctrl-0 = <&sim_ctrl_default>;
+	pinctrl-names = "default";
+	status = "okay";
+};
+
+/*
+ * SIM routing as found on stock Aurora (dtb_01 gpio-leds default-state and live
+ * Android /sys/kernel/debug/gpio): gpio1 (sim3_switch) high, gpio20 (sim_hotdet),
+ * gpio22 (sim1_switch), gpio23 (sim2_switch) low. Passive routing only.
+ */
+&tlmm {
+	sim_ctrl_default: sim-ctrl-default-state {
+		sim-low-pins {
+			pins = "gpio20", "gpio22", "gpio23";
+			function = "gpio";
+			bias-disable;
+			output-low;
+		};
+
+		sim-high-pins {
+			pins = "gpio1";
+			function = "gpio";
+			bias-disable;
+			output-high;
+		};
+	};
+};