# B8F — Wi-Fi persistent: eMMC cache + autostart, 3/3 cold boots — **PASS** (2026-10-03)

## What went into the cache (only components proven in B8B–B8E)

cache `cache-extlinux-b8f.img` **857c9c30…** (ext2, exact B7C recipe; label `b8f`):
- `Image.gz-dtb` 50d63488 = B8D kernel (7.2.7-aurora-b8d, be30b1fa: bam1 + QCOM_WCNSS_PIL + WLAN/CFG80211/MAC80211/WCN36XX built-in) + B8B DTB;
- `aurora-b8f.dtb` cc74b57d = B8B (wcnss okay, wcnss_mem 0x8b600000/6 MiB, iris `qcom,wcn3620`);
- `initramfs-b8f.cpio.gz` abb3bd67 = B8D initramfs (B7C f219b04d + NV c6b71825 + iw 6.17/libnl 3.11) + overlay b5a6b087:
  `/init` = T4 + one autostart line (`/etc/init.d/aurora-wifi start`, same EMMC_RO/B1 gates as the modem), `/usr/sbin/aurora-wifi`,
  `/etc/init.d/aurora-wifi`, `/etc/aurora/wifi.conf` (0600), `/usr/libexec/aurora/wifi/{hostapd 2.11-r4, libssl/libcrypto 3.5.9, libnl}`;
- cmdline unchanged. No NAT/DHCP/DNS/firewall/VPN.

aurora-wifi: waits for modem `START OK`/`FAIL`/rollback (≤ 300 s; proven order B8C–B8E) → checks /firmware/image/wcnss.mdt + NV →
`echo start` WCNSS → wlan0 (≤ 30 s) → `ip link set wlan0 up` → hostapd (SSID `aurora-b8f`, ch 6, HT20, WPA2-PSK/CCMP) → `AP ENABLED`.
Logs: `/run/aurora-wifi/{wifi.log,hostapd.log,service.log}`, kmsg `[aurora-wifi]`. Cmdline `aurora.wifi=off` disables.

## Secrets
- Old B8E test passphrase removed: `b8/b8e/bundle/hostapd-b8e.conf` redacted; full scan of local mirror, 480s workspace + /tmp, memory → no occurrences.
- New temporary passphrase only in `b8/b8f/private/wifi.psk` (0600). Repository keeps `rootfs/etc/aurora/wifi.conf.in` with `@PSK@`.
- PSK-bearing artifacts (never publish): `b8/b8f/private/`, `b8/b8f/out/`, `b8/b8f/cache/cache-extlinux-b8f.img`, `logs/b8/b8f/W/*.bin`.
- Text logs scanned for the PSK: 0 hits (hostapd runs without -d/-K).

## Before the write
- RAM pre-test (ram1, fastboot, class A) of the identical kernel/DTB/initramfs: START OK 82.2 s → AP ENABLED 86.5 s (no input), phone WPA2 connected,
  held 204+ s, SNTP +0.37 s, Pronto crash 0, eMMC w=0.
- lk2nd emulator: S5 regression (B7C) == b7c emu; S6 candidate "Trying to boot 'b8f'": kernel be30b1fa 23955464 B (image_size 0x1760000),
  DTB @DDR+0x20AA000, ramdisk 16077951 B @DDR+0x22AA000 — no overlap; F1/F3/F10 → android boot (emmc1).
  (Emulator note: kernel hash length is argv[3]; default is the golden 23015432.)
- Backup: live cache read before write = B7C 14fe453a (`logs/b8/b8f/W/pre-cache.bin`), plus `b7/b7c/cache/cache-extlinux-b7c.img`.

## Write (HW EDL, `b8/b8f/cache/B8F-write.sh` = B7C-write.sh with image/hashes/rollback refs/log dir changed)
All gates passed (old cache == B7C 14fe453a, GPT/boot/aboot unchanged) → **CACHE_MATCH 857c9c30** → sbl1/rpm/tz/hyp/recovery/modemst1/2/fsg/fsc/persist == A3,
modem/system/userdata == A4pre → **B8F_WRITE_VERIFIED**. Logs `logs/b8/b8f/W/`. Rollback: `b8/b8f/cache/B8F-rollback.sh` (→ B7C 14fe453a, HW EDL).

## 3 normal cold boots (power off ≥ 90 s, battery → USB, no RESET/fastboot, no manual commands)

| boot | class (RTC) | START OK | AP ENABLED | SNTP vs VNIIFTRI | phone WPA2/CCMP | held | Pronto | LTE | eMMC |
|---|---|---|---|---|---|---|---|---|---|
| cold1 | A (3 s) | 89.2 s (in 79.8) | 93.5 s | +0.403 s | connected, 4-way HS completed, −26 dBm | 188 s, 0 disconnects | crash/wd/fatal 0 | ping OK, BEARER_CONNECTED | w=0 |
| cold2 | A (3 s) | 85.2 s (in 75.8) | 89.8 s | **+0.996 s** | connected, −25 dBm | 172 s, 0 disconnects | 0 | OK | w=0 |
| cold3 | A (3 s) | 72.2 s (in 62.8) | 76.4 s | +0.029 s | connected, −29 dBm | 168 s, 0 disconnects | 0 | OK | w=0 |

All boots: lk2nd extlinux `b8f` (model string "JZ08AU Aurora (RAM boot B8B)" = B8B DTB, kernel 7.2.7-aurora-b8d), wcn36xx FW
`WCN v2.0 RadioPhy vUnknown with 19.2MHz XO` / CRM CNSS-PR-1-4-2-c4-00084, MAC <MAC>, SSID visible, B7 TIME SET.

**B8F = PASS 3/3. B8 closed.** Power-on → Wi-Fi AP ≈ 76–94 s (gated by LTE START OK by design).

## Open items (not fixed in B8, by decision)
1. **Delivery to sleeping STAs**: AP→client frames for a client in power save are delayed up to ~10 s (B8E: ping 65/120, RTT steps of 1 s).
   wcn36xx has no `set_tim`/AP_LINK_PS → TIM likely not updated (hypothesis). Client-initiated traffic is fast. JZ02 has the same config.
2. **No regulatory.db** → world regdomain `00` (ch 12–13 no-IR); `CFG80211_REQUIRE_SIGNED_REGDB=y`. Needed for RU country setting.
3. **Production MAC**: AP uses `<MAC>` (lk DT, derived from eMMC serial; stable, locally administered). Stock Android used `<MAC>`, source unknown.
4. Iris model: 19.2 MHz XO confirmed by FW, `qcom,wcn3620` works and matches JZ02; exact chip not proven (FW says `RadioPhy vUnknown`).
5. B7 residual reached +0.996 s on cold2 (NITZ whole-second granularity; B7C range was 0.04–0.84 s) — at the edge of the "< 1 s" claim; not a B8 regression.
6. rmtfs logs one modem EFS write (RAM buffer only, eMMC 0) whenever WCNSS starts; `timeout waiting for ssctl service` on WCNSS stop.

## Files
`b8/b8f/`: `build-b8f.sh`, `rootfs/` (init, aurora-wifi, init.d, wifi.conf.in), `init-t4-vs-b8f.diff`, `b8f-boot.sh`, `b8f-phone.sh`,
`cache/` (mkfs-cache-b8f.sh, extlinux-b8f.conf, B8F-write.sh, B8F-rollback.sh, B8F-PREFLIGHT.md, cache-diff-b7c-vs-b8f.txt, emu/, SHA256SUMS).
`logs/b8/b8f/`: ram1/, cold1–3/ (host-actions, snapshot, phone-1/2, dmesg.full, uart.log), *.console, W/ (write logs; *.bin private).