aports: extract aw88261_acf.bin on-device instead of shipping it
New package fp6-vendor-blobs: a manifest-driven systemd oneshot that
copies proprietary blobs out of the stock Android partitions on first
boot. pmOS installs flash only boot+userdata, so every installed unit
still carries the stock vendor/dsp partitions - the device duplicates a
file it already contains, for its own operation, and nothing proprietary
is distributed by us. Partitions are mounted read-only (ext4 additionally
with noload - not even a journal replay touches the stock data), every
copy is sha256-pinned and a miss fails loudly, and the consuming devices
are unbound and re-probed afterwards so the feature works the same boot.
The rebind is unconditional by design: aw88261 binds on a bare i2c
chip-id probe and requests the ACF only at ASoC card init (~21 s, after
SoundWire enumeration), so a bound device can still be one that lost the
firmware race - and that failed request is never retried.
soc-fairphone-fp6-audio (pkgver 4) stops shipping the blob, installs the
manifest fragment instead, and re-runs the extractor from
post-install/post-upgrade so upgrades restore the file immediately (the
old package version removed it on upgrade). License drops back to plain
BSD-3-Clause - nothing proprietary left in the package.
Verified on the dev phone (fp6 repo journal/blobs/captures/
2026-08-24-first-boot-extractor-verification.txt): first-boot extraction
+ same-boot audio, mid-session post-upgrade recovery, and the everyday
fast-path no-op; committed files byte-identical to the tested deployment.
Assisted-by: Claude:claude-fable-5
2026-08-24 21:00:34 +02:00
|
|
|
# First-boot, on-device extraction of proprietary blobs from the stock
|
|
|
|
|
# Android partitions, so the image never has to ship or distribute them.
|
|
|
|
|
# pmOS installs flash only boot+userdata: the stock vendor/dsp partitions
|
|
|
|
|
# stay on every installed unit, and the device duplicates files it already
|
|
|
|
|
# lawfully contains, for its own operation. Design, legal frame and the
|
|
|
|
|
# on-phone verification: fp6 repo journal/blobs/.
|
|
|
|
|
#
|
|
|
|
|
# Consumers depend on this package and install a manifest fragment into
|
|
|
|
|
# /usr/share/fp6-vendor-blobs/manifest.d/ (syntax in the extract script);
|
|
|
|
|
# their post-install/post-upgrade should also run
|
|
|
|
|
# /usr/lib/fp6-vendor-blobs/extract --if-device so a package upgrade that
|
|
|
|
|
# drops a previously-shipped blob restores the file immediately instead of
|
fp6-vendor-blobs 1-r3: extract from the active slot, and stop pinning a hash on a signed image
Two field units got no fingerprint sensor from fingerprintd 0.2.3's
manifest: its focal64 line pinned the sha256 of one Android build's
trustlet (16.82.0, the dev phone's), and Fairphone re-signs that trustlet
every release, so the pin matches exactly one of the six builds seen. A
user on 16.100.0 had to edit the manifest by hand; another ended up with
a file QTEE refuses.
The extractor now tries the active slot's partitions first
(androidboot.slot_suffix from the kernel command line): for a signed
image only the running TZ's own slot is guaranteed to load. An mbn line
may give '-' instead of a hash, which means structural verification
only: ELF64 header, every segment present at the size its program header
declares, page-aligned offsets, a sane total. The loader in TZ verifies
the signature and the per-segment hashes itself and refuses a damaged or
foreign image (one flipped byte -> ERROR_ELF_SIGNATURE_ERROR, measured),
so the whole-image hash added fragility and no protection. A real sha256
is still honoured, and the sha256 of what was installed is logged either
way.
--refresh re-derives mbn dests even when a file exists, replacing it
only with an image that verifies; consumers call it from
post-install/post-upgrade so a fresh 'apk add' needs no reboot and a
hand-placed or wrongly pinned trustlet is replaced on the next upgrade.
Verified on the dev phone (busybox): malformed inputs are refused with a
reason (missing, truncated or oversize segment; non-ELF, ELF32 or short
mdt; a garbage offset), both slots reassemble to the known-good hash, a
foreign file survives a plain run and is replaced by --refresh, a failed
refresh keeps the old file, pins still work, and the real post-upgrade
path re-derived the installed trustlet with the daemon restarting on it.
Record: fp6 repo journal/blobs/ and journal/fingerprint/, 2026-09-11.
2026-09-11 13:03:22 +02:00
|
|
|
# at the next boot (--refresh in addition for an mbn consumer: it re-derives
|
|
|
|
|
# the trustlet from the active slot even if a file is present). Consumers:
|
fp6-vendor-blobs 1-r4: build the ath11k board data from the stock modem partition
The device tree asks ath11k for the Fairphone_Gen_6 board data entry.
Upstream linux-firmware's WCN6750 board-2.bin has no Fairphone entry, so
the driver silently falls back to the generic board-id 255 data: the FP6
Plus does not associate on it at all (user report 2026-10-14), and the FP6
keeps its channel list but its scans no longer find the 5 GHz networks
around it (two scans found 0 and 1 5 GHz BSSes against 14 with the
device's data, the home AP at -37 dBm among the missing), so it
associates on 2.4 GHz only (dev phone A/B). The stock modem partition
carries the device's own calibration as image/qca6750/bdwlan.elf.
New manifest directive ath11k-bdf: copy that ELF and wrap it into a
container under /lib/firmware/updates (searched first by the loader) that
is upstream's board-2.bin with every entry kept plus one BOARD entry under
the requested name. Verified structurally (ELF magic, size, the container
magic), no hash pin: the ELF belongs to the stock modem image and can
change with it. The sha256 of the base is kept beside the
override: a changed base (a linux-firmware upgrade) rebuilds it at the
next run, and a rebuild that reproduces the existing file installs
nothing; an entry upstream ships under the same name is taken first by the
driver, so the appended copy then goes unused. The fragment has no
rebind line: the service is ordered before udev's coldplug, which loads
the driver, so a fresh install builds the container before the first
probe (dev phone, the override removed and rebooted: built at 7.2 s,
coldplug from 7.3 s, the driver's board-data load at 8.7 s, the first
association on 5 GHz), and an installed phone gets it at its next boot; a
re-probe from a package hook would restart wifi in the middle of the
upgrade.
zstd joins the dependencies to read the compressed base. Dev phone: the
built container is byte-identical to the one hand-made from the stock
image by the reporter (sha256 186202ee...); the hook's call with the
override absent built it over a wifi session that stayed up, a second
call installed nothing and a --refresh call left the container unchanged.
2026-10-14 17:38:55 +02:00
|
|
|
# soc-fairphone-fp6-audio (aw88261 acf), fingerprintd (focal64 trustlet);
|
|
|
|
|
# this package's own 30-ath11k-board-data fragment (WLAN board data).
|
fp6-vendor-blobs 1-r3: extract from the active slot, and stop pinning a hash on a signed image
Two field units got no fingerprint sensor from fingerprintd 0.2.3's
manifest: its focal64 line pinned the sha256 of one Android build's
trustlet (16.82.0, the dev phone's), and Fairphone re-signs that trustlet
every release, so the pin matches exactly one of the six builds seen. A
user on 16.100.0 had to edit the manifest by hand; another ended up with
a file QTEE refuses.
The extractor now tries the active slot's partitions first
(androidboot.slot_suffix from the kernel command line): for a signed
image only the running TZ's own slot is guaranteed to load. An mbn line
may give '-' instead of a hash, which means structural verification
only: ELF64 header, every segment present at the size its program header
declares, page-aligned offsets, a sane total. The loader in TZ verifies
the signature and the per-segment hashes itself and refuses a damaged or
foreign image (one flipped byte -> ERROR_ELF_SIGNATURE_ERROR, measured),
so the whole-image hash added fragility and no protection. A real sha256
is still honoured, and the sha256 of what was installed is logged either
way.
--refresh re-derives mbn dests even when a file exists, replacing it
only with an image that verifies; consumers call it from
post-install/post-upgrade so a fresh 'apk add' needs no reboot and a
hand-placed or wrongly pinned trustlet is replaced on the next upgrade.
Verified on the dev phone (busybox): malformed inputs are refused with a
reason (missing, truncated or oversize segment; non-ELF, ELF32 or short
mdt; a garbage offset), both slots reassemble to the known-good hash, a
foreign file survives a plain run and is replaced by --refresh, a failed
refresh keeps the old file, pins still work, and the real post-upgrade
path re-derived the installed trustlet with the daemon restarting on it.
Record: fp6 repo journal/blobs/ and journal/fingerprint/, 2026-09-11.
2026-09-11 13:03:22 +02:00
|
|
|
#
|
|
|
|
|
# 1-r3 (2026-09-11): active slot first, an unpinned ('-') structurally
|
|
|
|
|
# verified mode for mbn, --refresh -- after two field units got no
|
|
|
|
|
# fingerprint sensor from a whole-image hash pin that can only match one
|
|
|
|
|
# Android build (fp6 repo journal/blobs/, journal/fingerprint/).
|
fp6-vendor-blobs 1-r4: build the ath11k board data from the stock modem partition
The device tree asks ath11k for the Fairphone_Gen_6 board data entry.
Upstream linux-firmware's WCN6750 board-2.bin has no Fairphone entry, so
the driver silently falls back to the generic board-id 255 data: the FP6
Plus does not associate on it at all (user report 2026-10-14), and the FP6
keeps its channel list but its scans no longer find the 5 GHz networks
around it (two scans found 0 and 1 5 GHz BSSes against 14 with the
device's data, the home AP at -37 dBm among the missing), so it
associates on 2.4 GHz only (dev phone A/B). The stock modem partition
carries the device's own calibration as image/qca6750/bdwlan.elf.
New manifest directive ath11k-bdf: copy that ELF and wrap it into a
container under /lib/firmware/updates (searched first by the loader) that
is upstream's board-2.bin with every entry kept plus one BOARD entry under
the requested name. Verified structurally (ELF magic, size, the container
magic), no hash pin: the ELF belongs to the stock modem image and can
change with it. The sha256 of the base is kept beside the
override: a changed base (a linux-firmware upgrade) rebuilds it at the
next run, and a rebuild that reproduces the existing file installs
nothing; an entry upstream ships under the same name is taken first by the
driver, so the appended copy then goes unused. The fragment has no
rebind line: the service is ordered before udev's coldplug, which loads
the driver, so a fresh install builds the container before the first
probe (dev phone, the override removed and rebooted: built at 7.2 s,
coldplug from 7.3 s, the driver's board-data load at 8.7 s, the first
association on 5 GHz), and an installed phone gets it at its next boot; a
re-probe from a package hook would restart wifi in the middle of the
upgrade.
zstd joins the dependencies to read the compressed base. Dev phone: the
built container is byte-identical to the one hand-made from the stock
image by the reporter (sha256 186202ee...); the hook's call with the
override absent built it over a wifi session that stayed up, a second
call installed nothing and a --refresh call left the container unchanged.
2026-10-14 17:38:55 +02:00
|
|
|
# 1-r4 (2026-10-14): the ath11k-bdf directive -- the WLAN board data the
|
|
|
|
|
# device tree asks for, built on-device from the stock modem partition
|
|
|
|
|
# (the FP6 Plus does not associate on upstream's generic data).
|
aports: extract aw88261_acf.bin on-device instead of shipping it
New package fp6-vendor-blobs: a manifest-driven systemd oneshot that
copies proprietary blobs out of the stock Android partitions on first
boot. pmOS installs flash only boot+userdata, so every installed unit
still carries the stock vendor/dsp partitions - the device duplicates a
file it already contains, for its own operation, and nothing proprietary
is distributed by us. Partitions are mounted read-only (ext4 additionally
with noload - not even a journal replay touches the stock data), every
copy is sha256-pinned and a miss fails loudly, and the consuming devices
are unbound and re-probed afterwards so the feature works the same boot.
The rebind is unconditional by design: aw88261 binds on a bare i2c
chip-id probe and requests the ACF only at ASoC card init (~21 s, after
SoundWire enumeration), so a bound device can still be one that lost the
firmware race - and that failed request is never retried.
soc-fairphone-fp6-audio (pkgver 4) stops shipping the blob, installs the
manifest fragment instead, and re-runs the extractor from
post-install/post-upgrade so upgrades restore the file immediately (the
old package version removed it on upgrade). License drops back to plain
BSD-3-Clause - nothing proprietary left in the package.
Verified on the dev phone (fp6 repo journal/blobs/captures/
2026-08-24-first-boot-extractor-verification.txt): first-boot extraction
+ same-boot audio, mid-session post-upgrade recovery, and the everyday
fast-path no-op; committed files byte-identical to the tested deployment.
Assisted-by: Claude:claude-fable-5
2026-08-24 21:00:34 +02:00
|
|
|
maintainer="Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>"
|
|
|
|
|
pkgname=fp6-vendor-blobs
|
|
|
|
|
pkgver=1
|
fp6-vendor-blobs 1-r4: build the ath11k board data from the stock modem partition
The device tree asks ath11k for the Fairphone_Gen_6 board data entry.
Upstream linux-firmware's WCN6750 board-2.bin has no Fairphone entry, so
the driver silently falls back to the generic board-id 255 data: the FP6
Plus does not associate on it at all (user report 2026-10-14), and the FP6
keeps its channel list but its scans no longer find the 5 GHz networks
around it (two scans found 0 and 1 5 GHz BSSes against 14 with the
device's data, the home AP at -37 dBm among the missing), so it
associates on 2.4 GHz only (dev phone A/B). The stock modem partition
carries the device's own calibration as image/qca6750/bdwlan.elf.
New manifest directive ath11k-bdf: copy that ELF and wrap it into a
container under /lib/firmware/updates (searched first by the loader) that
is upstream's board-2.bin with every entry kept plus one BOARD entry under
the requested name. Verified structurally (ELF magic, size, the container
magic), no hash pin: the ELF belongs to the stock modem image and can
change with it. The sha256 of the base is kept beside the
override: a changed base (a linux-firmware upgrade) rebuilds it at the
next run, and a rebuild that reproduces the existing file installs
nothing; an entry upstream ships under the same name is taken first by the
driver, so the appended copy then goes unused. The fragment has no
rebind line: the service is ordered before udev's coldplug, which loads
the driver, so a fresh install builds the container before the first
probe (dev phone, the override removed and rebooted: built at 7.2 s,
coldplug from 7.3 s, the driver's board-data load at 8.7 s, the first
association on 5 GHz), and an installed phone gets it at its next boot; a
re-probe from a package hook would restart wifi in the middle of the
upgrade.
zstd joins the dependencies to read the compressed base. Dev phone: the
built container is byte-identical to the one hand-made from the stock
image by the reporter (sha256 186202ee...); the hook's call with the
override absent built it over a wifi session that stayed up, a second
call installed nothing and a --refresh call left the container unchanged.
2026-10-14 17:38:55 +02:00
|
|
|
pkgrel=4
|
aports: extract aw88261_acf.bin on-device instead of shipping it
New package fp6-vendor-blobs: a manifest-driven systemd oneshot that
copies proprietary blobs out of the stock Android partitions on first
boot. pmOS installs flash only boot+userdata, so every installed unit
still carries the stock vendor/dsp partitions - the device duplicates a
file it already contains, for its own operation, and nothing proprietary
is distributed by us. Partitions are mounted read-only (ext4 additionally
with noload - not even a journal replay touches the stock data), every
copy is sha256-pinned and a miss fails loudly, and the consuming devices
are unbound and re-probed afterwards so the feature works the same boot.
The rebind is unconditional by design: aw88261 binds on a bare i2c
chip-id probe and requests the ACF only at ASoC card init (~21 s, after
SoundWire enumeration), so a bound device can still be one that lost the
firmware race - and that failed request is never retried.
soc-fairphone-fp6-audio (pkgver 4) stops shipping the blob, installs the
manifest fragment instead, and re-runs the extractor from
post-install/post-upgrade so upgrades restore the file immediately (the
old package version removed it on upgrade). License drops back to plain
BSD-3-Clause - nothing proprietary left in the package.
Verified on the dev phone (fp6 repo journal/blobs/captures/
2026-08-24-first-boot-extractor-verification.txt): first-boot extraction
+ same-boot audio, mid-session post-upgrade recovery, and the everyday
fast-path no-op; committed files byte-identical to the tested deployment.
Assisted-by: Claude:claude-fable-5
2026-08-24 21:00:34 +02:00
|
|
|
pkgdesc="On-device extraction of vendor blobs from the stock Android partitions"
|
|
|
|
|
url="https://forgejo.catcrafts.net/Catcrafts/fp6-img"
|
|
|
|
|
arch="noarch"
|
2026-10-16 23:08:14 +02:00
|
|
|
license="GPL-3.0-only"
|
aports: extract aw88261_acf.bin on-device instead of shipping it
New package fp6-vendor-blobs: a manifest-driven systemd oneshot that
copies proprietary blobs out of the stock Android partitions on first
boot. pmOS installs flash only boot+userdata, so every installed unit
still carries the stock vendor/dsp partitions - the device duplicates a
file it already contains, for its own operation, and nothing proprietary
is distributed by us. Partitions are mounted read-only (ext4 additionally
with noload - not even a journal replay touches the stock data), every
copy is sha256-pinned and a miss fails loudly, and the consuming devices
are unbound and re-probed afterwards so the feature works the same boot.
The rebind is unconditional by design: aw88261 binds on a bare i2c
chip-id probe and requests the ACF only at ASoC card init (~21 s, after
SoundWire enumeration), so a bound device can still be one that lost the
firmware race - and that failed request is never retried.
soc-fairphone-fp6-audio (pkgver 4) stops shipping the blob, installs the
manifest fragment instead, and re-runs the extractor from
post-install/post-upgrade so upgrades restore the file immediately (the
old package version removed it on upgrade). License drops back to plain
BSD-3-Clause - nothing proprietary left in the package.
Verified on the dev phone (fp6 repo journal/blobs/captures/
2026-08-24-first-boot-extractor-verification.txt): first-boot extraction
+ same-boot audio, mid-session post-upgrade recovery, and the everyday
fast-path no-op; committed files byte-identical to the tested deployment.
Assisted-by: Claude:claude-fable-5
2026-08-24 21:00:34 +02:00
|
|
|
# fallback mapper for when the initramfs didn't map the dynamic partitions
|
fp6-vendor-blobs 1-r4: build the ath11k board data from the stock modem partition
The device tree asks ath11k for the Fairphone_Gen_6 board data entry.
Upstream linux-firmware's WCN6750 board-2.bin has no Fairphone entry, so
the driver silently falls back to the generic board-id 255 data: the FP6
Plus does not associate on it at all (user report 2026-10-14), and the FP6
keeps its channel list but its scans no longer find the 5 GHz networks
around it (two scans found 0 and 1 5 GHz BSSes against 14 with the
device's data, the home AP at -37 dBm among the missing), so it
associates on 2.4 GHz only (dev phone A/B). The stock modem partition
carries the device's own calibration as image/qca6750/bdwlan.elf.
New manifest directive ath11k-bdf: copy that ELF and wrap it into a
container under /lib/firmware/updates (searched first by the loader) that
is upstream's board-2.bin with every entry kept plus one BOARD entry under
the requested name. Verified structurally (ELF magic, size, the container
magic), no hash pin: the ELF belongs to the stock modem image and can
change with it. The sha256 of the base is kept beside the
override: a changed base (a linux-firmware upgrade) rebuilds it at the
next run, and a rebuild that reproduces the existing file installs
nothing; an entry upstream ships under the same name is taken first by the
driver, so the appended copy then goes unused. The fragment has no
rebind line: the service is ordered before udev's coldplug, which loads
the driver, so a fresh install builds the container before the first
probe (dev phone, the override removed and rebooted: built at 7.2 s,
coldplug from 7.3 s, the driver's board-data load at 8.7 s, the first
association on 5 GHz), and an installed phone gets it at its next boot; a
re-probe from a package hook would restart wifi in the middle of the
upgrade.
zstd joins the dependencies to read the compressed base. Dev phone: the
built container is byte-identical to the one hand-made from the stock
image by the reporter (sha256 186202ee...); the hook's call with the
override absent built it over a wifi session that stayed up, a second
call installed nothing and a --refresh call left the container unchanged.
2026-10-14 17:38:55 +02:00
|
|
|
depends="make-dynpart-mappings zstd"
|
aports: extract vendor blobs before udev coldplug so first-boot audio fully works
The preset fix (6ecc1dc) makes the unit run, but multi-user is too late: the
sound card probes at ~21 s, hard-fails (-2, no retry) on the missing ACF, and
the extractor's amp rebind at ~60 s cannot re-form a card whose machine
driver already failed. Re-probing the machine driver does re-form it, but a
late-formed card has a dead capture path - the wcd9378 TX sequencer refuses
PS0 (act_ps 0x3) until the next boot. So rebinding after the fact can never
fully win; extraction has to happen before the drivers probe.
- fp6-vendor-blobs.service: DefaultDependencies=no, run after remount-fs and
before systemd-udev-trigger, so blobs exist before module coldplug.
multi-user stays a second Wants as a post-udev retry if the early run
failed (by-partlabel/make-dynpart-mappings fallbacks need udev).
- aw88261-acf.manifest: add 'rebind platform sound' so the fallback path at
least recovers playback the same boot (capture then heals on reboot).
- fp6-vendor-blobs.post-upgrade (pkgrel 1): systemctl preset + immediate
extract, so installs of the 2026-08-24 image (unit shipped disabled, no
version bump to deliver the preset) finally heal via plain apk upgrade.
- soc-fairphone-fp6-audio pkgrel 1: carries the manifest change.
Verified on the dev phone with the exact staged bytes (sha256-compared):
simulated fresh install (ACF removed, reboot) extracts at 13.3 s, coldplug
probes the amps at 15.1 s, card init at 20.9 s loads the ACF cleanly, and a
1 kHz speaker-to-mic loopback passes on that same first boot with zero TX
sequencer warnings; next boot takes the all-dests-present fast path in 25 ms.
Evidence: fp6 repo journal/blobs/, 2026-08-29.
Assisted-by: Claude:claude-fable-5
2026-08-29 21:53:02 +02:00
|
|
|
install="$pkgname.post-upgrade"
|
aports: extract aw88261_acf.bin on-device instead of shipping it
New package fp6-vendor-blobs: a manifest-driven systemd oneshot that
copies proprietary blobs out of the stock Android partitions on first
boot. pmOS installs flash only boot+userdata, so every installed unit
still carries the stock vendor/dsp partitions - the device duplicates a
file it already contains, for its own operation, and nothing proprietary
is distributed by us. Partitions are mounted read-only (ext4 additionally
with noload - not even a journal replay touches the stock data), every
copy is sha256-pinned and a miss fails loudly, and the consuming devices
are unbound and re-probed afterwards so the feature works the same boot.
The rebind is unconditional by design: aw88261 binds on a bare i2c
chip-id probe and requests the ACF only at ASoC card init (~21 s, after
SoundWire enumeration), so a bound device can still be one that lost the
firmware race - and that failed request is never retried.
soc-fairphone-fp6-audio (pkgver 4) stops shipping the blob, installs the
manifest fragment instead, and re-runs the extractor from
post-install/post-upgrade so upgrades restore the file immediately (the
old package version removed it on upgrade). License drops back to plain
BSD-3-Clause - nothing proprietary left in the package.
Verified on the dev phone (fp6 repo journal/blobs/captures/
2026-08-24-first-boot-extractor-verification.txt): first-boot extraction
+ same-boot audio, mid-session post-upgrade recovery, and the everyday
fast-path no-op; committed files byte-identical to the tested deployment.
Assisted-by: Claude:claude-fable-5
2026-08-24 21:00:34 +02:00
|
|
|
options="!check"
|
|
|
|
|
source="
|
|
|
|
|
fp6-vendor-blobs-extract
|
|
|
|
|
fp6-vendor-blobs.service
|
2026-09-15 22:36:12 +02:00
|
|
|
fp6-vendor-blobs.preset
|
fp6-vendor-blobs 1-r4: build the ath11k board data from the stock modem partition
The device tree asks ath11k for the Fairphone_Gen_6 board data entry.
Upstream linux-firmware's WCN6750 board-2.bin has no Fairphone entry, so
the driver silently falls back to the generic board-id 255 data: the FP6
Plus does not associate on it at all (user report 2026-10-14), and the FP6
keeps its channel list but its scans no longer find the 5 GHz networks
around it (two scans found 0 and 1 5 GHz BSSes against 14 with the
device's data, the home AP at -37 dBm among the missing), so it
associates on 2.4 GHz only (dev phone A/B). The stock modem partition
carries the device's own calibration as image/qca6750/bdwlan.elf.
New manifest directive ath11k-bdf: copy that ELF and wrap it into a
container under /lib/firmware/updates (searched first by the loader) that
is upstream's board-2.bin with every entry kept plus one BOARD entry under
the requested name. Verified structurally (ELF magic, size, the container
magic), no hash pin: the ELF belongs to the stock modem image and can
change with it. The sha256 of the base is kept beside the
override: a changed base (a linux-firmware upgrade) rebuilds it at the
next run, and a rebuild that reproduces the existing file installs
nothing; an entry upstream ships under the same name is taken first by the
driver, so the appended copy then goes unused. The fragment has no
rebind line: the service is ordered before udev's coldplug, which loads
the driver, so a fresh install builds the container before the first
probe (dev phone, the override removed and rebooted: built at 7.2 s,
coldplug from 7.3 s, the driver's board-data load at 8.7 s, the first
association on 5 GHz), and an installed phone gets it at its next boot; a
re-probe from a package hook would restart wifi in the middle of the
upgrade.
zstd joins the dependencies to read the compressed base. Dev phone: the
built container is byte-identical to the one hand-made from the stock
image by the reporter (sha256 186202ee...); the hook's call with the
override absent built it over a wifi session that stayed up, a second
call installed nothing and a --refresh call left the container unchanged.
2026-10-14 17:38:55 +02:00
|
|
|
30-ath11k-board-data.manifest
|
aports: extract aw88261_acf.bin on-device instead of shipping it
New package fp6-vendor-blobs: a manifest-driven systemd oneshot that
copies proprietary blobs out of the stock Android partitions on first
boot. pmOS installs flash only boot+userdata, so every installed unit
still carries the stock vendor/dsp partitions - the device duplicates a
file it already contains, for its own operation, and nothing proprietary
is distributed by us. Partitions are mounted read-only (ext4 additionally
with noload - not even a journal replay touches the stock data), every
copy is sha256-pinned and a miss fails loudly, and the consuming devices
are unbound and re-probed afterwards so the feature works the same boot.
The rebind is unconditional by design: aw88261 binds on a bare i2c
chip-id probe and requests the ACF only at ASoC card init (~21 s, after
SoundWire enumeration), so a bound device can still be one that lost the
firmware race - and that failed request is never retried.
soc-fairphone-fp6-audio (pkgver 4) stops shipping the blob, installs the
manifest fragment instead, and re-runs the extractor from
post-install/post-upgrade so upgrades restore the file immediately (the
old package version removed it on upgrade). License drops back to plain
BSD-3-Clause - nothing proprietary left in the package.
Verified on the dev phone (fp6 repo journal/blobs/captures/
2026-08-24-first-boot-extractor-verification.txt): first-boot extraction
+ same-boot audio, mid-session post-upgrade recovery, and the everyday
fast-path no-op; committed files byte-identical to the tested deployment.
Assisted-by: Claude:claude-fable-5
2026-08-24 21:00:34 +02:00
|
|
|
"
|
|
|
|
|
|
|
|
|
|
package() {
|
|
|
|
|
install -Dm755 "$srcdir"/fp6-vendor-blobs-extract \
|
|
|
|
|
"$pkgdir"/usr/lib/fp6-vendor-blobs/extract
|
|
|
|
|
install -Dm644 "$srcdir"/fp6-vendor-blobs.service \
|
|
|
|
|
"$pkgdir"/usr/lib/systemd/system/fp6-vendor-blobs.service
|
|
|
|
|
# enabled unconditionally: the unit is a fast no-op once every manifest
|
fp6-vendor-blobs 1-r4: build the ath11k board data from the stock modem partition
The device tree asks ath11k for the Fairphone_Gen_6 board data entry.
Upstream linux-firmware's WCN6750 board-2.bin has no Fairphone entry, so
the driver silently falls back to the generic board-id 255 data: the FP6
Plus does not associate on it at all (user report 2026-10-14), and the FP6
keeps its channel list but its scans no longer find the 5 GHz networks
around it (two scans found 0 and 1 5 GHz BSSes against 14 with the
device's data, the home AP at -37 dBm among the missing), so it
associates on 2.4 GHz only (dev phone A/B). The stock modem partition
carries the device's own calibration as image/qca6750/bdwlan.elf.
New manifest directive ath11k-bdf: copy that ELF and wrap it into a
container under /lib/firmware/updates (searched first by the loader) that
is upstream's board-2.bin with every entry kept plus one BOARD entry under
the requested name. Verified structurally (ELF magic, size, the container
magic), no hash pin: the ELF belongs to the stock modem image and can
change with it. The sha256 of the base is kept beside the
override: a changed base (a linux-firmware upgrade) rebuilds it at the
next run, and a rebuild that reproduces the existing file installs
nothing; an entry upstream ships under the same name is taken first by the
driver, so the appended copy then goes unused. The fragment has no
rebind line: the service is ordered before udev's coldplug, which loads
the driver, so a fresh install builds the container before the first
probe (dev phone, the override removed and rebooted: built at 7.2 s,
coldplug from 7.3 s, the driver's board-data load at 8.7 s, the first
association on 5 GHz), and an installed phone gets it at its next boot; a
re-probe from a package hook would restart wifi in the middle of the
upgrade.
zstd joins the dependencies to read the compressed base. Dev phone: the
built container is byte-identical to the one hand-made from the stock
image by the reporter (sha256 186202ee...); the hook's call with the
override absent built it over a wifi session that stayed up, a second
call installed nothing and a --refresh call left the container unchanged.
2026-10-14 17:38:55 +02:00
|
|
|
# dest exists and every ath11k-bdf override is current against its base,
|
|
|
|
|
# and blobs appearing on first boot must not depend on a manual
|
|
|
|
|
# systemctl enable. sysinit = the real (pre-coldplug) run;
|
aports: extract vendor blobs before udev coldplug so first-boot audio fully works
The preset fix (6ecc1dc) makes the unit run, but multi-user is too late: the
sound card probes at ~21 s, hard-fails (-2, no retry) on the missing ACF, and
the extractor's amp rebind at ~60 s cannot re-form a card whose machine
driver already failed. Re-probing the machine driver does re-form it, but a
late-formed card has a dead capture path - the wcd9378 TX sequencer refuses
PS0 (act_ps 0x3) until the next boot. So rebinding after the fact can never
fully win; extraction has to happen before the drivers probe.
- fp6-vendor-blobs.service: DefaultDependencies=no, run after remount-fs and
before systemd-udev-trigger, so blobs exist before module coldplug.
multi-user stays a second Wants as a post-udev retry if the early run
failed (by-partlabel/make-dynpart-mappings fallbacks need udev).
- aw88261-acf.manifest: add 'rebind platform sound' so the fallback path at
least recovers playback the same boot (capture then heals on reboot).
- fp6-vendor-blobs.post-upgrade (pkgrel 1): systemctl preset + immediate
extract, so installs of the 2026-08-24 image (unit shipped disabled, no
version bump to deliver the preset) finally heal via plain apk upgrade.
- soc-fairphone-fp6-audio pkgrel 1: carries the manifest change.
Verified on the dev phone with the exact staged bytes (sha256-compared):
simulated fresh install (ACF removed, reboot) extracts at 13.3 s, coldplug
probes the amps at 15.1 s, card init at 20.9 s loads the ACF cleanly, and a
1 kHz speaker-to-mic loopback passes on that same first boot with zero TX
sequencer warnings; next boot takes the all-dests-present fast path in 25 ms.
Evidence: fp6 repo journal/blobs/, 2026-08-29.
Assisted-by: Claude:claude-fable-5
2026-08-29 21:53:02 +02:00
|
|
|
# multi-user = the post-udev retry if the early run failed (see unit)
|
|
|
|
|
mkdir -p "$pkgdir"/etc/systemd/system/sysinit.target.wants \
|
|
|
|
|
"$pkgdir"/etc/systemd/system/multi-user.target.wants
|
|
|
|
|
ln -s /usr/lib/systemd/system/fp6-vendor-blobs.service \
|
|
|
|
|
"$pkgdir"/etc/systemd/system/sysinit.target.wants/fp6-vendor-blobs.service
|
aports: extract aw88261_acf.bin on-device instead of shipping it
New package fp6-vendor-blobs: a manifest-driven systemd oneshot that
copies proprietary blobs out of the stock Android partitions on first
boot. pmOS installs flash only boot+userdata, so every installed unit
still carries the stock vendor/dsp partitions - the device duplicates a
file it already contains, for its own operation, and nothing proprietary
is distributed by us. Partitions are mounted read-only (ext4 additionally
with noload - not even a journal replay touches the stock data), every
copy is sha256-pinned and a miss fails loudly, and the consuming devices
are unbound and re-probed afterwards so the feature works the same boot.
The rebind is unconditional by design: aw88261 binds on a bare i2c
chip-id probe and requests the ACF only at ASoC card init (~21 s, after
SoundWire enumeration), so a bound device can still be one that lost the
firmware race - and that failed request is never retried.
soc-fairphone-fp6-audio (pkgver 4) stops shipping the blob, installs the
manifest fragment instead, and re-runs the extractor from
post-install/post-upgrade so upgrades restore the file immediately (the
old package version removed it on upgrade). License drops back to plain
BSD-3-Clause - nothing proprietary left in the package.
Verified on the dev phone (fp6 repo journal/blobs/captures/
2026-08-24-first-boot-extractor-verification.txt): first-boot extraction
+ same-boot audio, mid-session post-upgrade recovery, and the everyday
fast-path no-op; committed files byte-identical to the tested deployment.
Assisted-by: Claude:claude-fable-5
2026-08-24 21:00:34 +02:00
|
|
|
ln -s /usr/lib/systemd/system/fp6-vendor-blobs.service \
|
|
|
|
|
"$pkgdir"/etc/systemd/system/multi-user.target.wants/fp6-vendor-blobs.service
|
2026-09-15 22:36:12 +02:00
|
|
|
# ...and a preset, because the symlink alone does NOT survive: image
|
|
|
|
|
# build runs `systemctl preset-all`, which removes .wants links for any
|
|
|
|
|
# unit not enabled by a preset. That is what shipped the 2026-08-24
|
|
|
|
|
# image with the service `disabled; preset: disabled` -- no blob
|
|
|
|
|
# extracted, no sound card. See journal/blobs/ 2026-08-28.
|
|
|
|
|
install -Dm644 "$srcdir"/fp6-vendor-blobs.preset \
|
|
|
|
|
"$pkgdir"/usr/lib/systemd/system-preset/50-fp6-vendor-blobs.preset
|
fp6-vendor-blobs 1-r4: build the ath11k board data from the stock modem partition
The device tree asks ath11k for the Fairphone_Gen_6 board data entry.
Upstream linux-firmware's WCN6750 board-2.bin has no Fairphone entry, so
the driver silently falls back to the generic board-id 255 data: the FP6
Plus does not associate on it at all (user report 2026-10-14), and the FP6
keeps its channel list but its scans no longer find the 5 GHz networks
around it (two scans found 0 and 1 5 GHz BSSes against 14 with the
device's data, the home AP at -37 dBm among the missing), so it
associates on 2.4 GHz only (dev phone A/B). The stock modem partition
carries the device's own calibration as image/qca6750/bdwlan.elf.
New manifest directive ath11k-bdf: copy that ELF and wrap it into a
container under /lib/firmware/updates (searched first by the loader) that
is upstream's board-2.bin with every entry kept plus one BOARD entry under
the requested name. Verified structurally (ELF magic, size, the container
magic), no hash pin: the ELF belongs to the stock modem image and can
change with it. The sha256 of the base is kept beside the
override: a changed base (a linux-firmware upgrade) rebuilds it at the
next run, and a rebuild that reproduces the existing file installs
nothing; an entry upstream ships under the same name is taken first by the
driver, so the appended copy then goes unused. The fragment has no
rebind line: the service is ordered before udev's coldplug, which loads
the driver, so a fresh install builds the container before the first
probe (dev phone, the override removed and rebooted: built at 7.2 s,
coldplug from 7.3 s, the driver's board-data load at 8.7 s, the first
association on 5 GHz), and an installed phone gets it at its next boot; a
re-probe from a package hook would restart wifi in the middle of the
upgrade.
zstd joins the dependencies to read the compressed base. Dev phone: the
built container is byte-identical to the one hand-made from the stock
image by the reporter (sha256 186202ee...); the hook's call with the
override absent built it over a wifi session that stayed up, a second
call installed nothing and a --refresh call left the container unchanged.
2026-10-14 17:38:55 +02:00
|
|
|
install -Dm644 "$srcdir"/30-ath11k-board-data.manifest \
|
|
|
|
|
"$pkgdir"/usr/share/fp6-vendor-blobs/manifest.d/30-ath11k-board-data.manifest
|
aports: extract aw88261_acf.bin on-device instead of shipping it
New package fp6-vendor-blobs: a manifest-driven systemd oneshot that
copies proprietary blobs out of the stock Android partitions on first
boot. pmOS installs flash only boot+userdata, so every installed unit
still carries the stock vendor/dsp partitions - the device duplicates a
file it already contains, for its own operation, and nothing proprietary
is distributed by us. Partitions are mounted read-only (ext4 additionally
with noload - not even a journal replay touches the stock data), every
copy is sha256-pinned and a miss fails loudly, and the consuming devices
are unbound and re-probed afterwards so the feature works the same boot.
The rebind is unconditional by design: aw88261 binds on a bare i2c
chip-id probe and requests the ACF only at ASoC card init (~21 s, after
SoundWire enumeration), so a bound device can still be one that lost the
firmware race - and that failed request is never retried.
soc-fairphone-fp6-audio (pkgver 4) stops shipping the blob, installs the
manifest fragment instead, and re-runs the extractor from
post-install/post-upgrade so upgrades restore the file immediately (the
old package version removed it on upgrade). License drops back to plain
BSD-3-Clause - nothing proprietary left in the package.
Verified on the dev phone (fp6 repo journal/blobs/captures/
2026-08-24-first-boot-extractor-verification.txt): first-boot extraction
+ same-boot audio, mid-session post-upgrade recovery, and the everyday
fast-path no-op; committed files byte-identical to the tested deployment.
Assisted-by: Claude:claude-fable-5
2026-08-24 21:00:34 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
sha512sums="
|
fp6-vendor-blobs 1-r4: build the ath11k board data from the stock modem partition
The device tree asks ath11k for the Fairphone_Gen_6 board data entry.
Upstream linux-firmware's WCN6750 board-2.bin has no Fairphone entry, so
the driver silently falls back to the generic board-id 255 data: the FP6
Plus does not associate on it at all (user report 2026-10-14), and the FP6
keeps its channel list but its scans no longer find the 5 GHz networks
around it (two scans found 0 and 1 5 GHz BSSes against 14 with the
device's data, the home AP at -37 dBm among the missing), so it
associates on 2.4 GHz only (dev phone A/B). The stock modem partition
carries the device's own calibration as image/qca6750/bdwlan.elf.
New manifest directive ath11k-bdf: copy that ELF and wrap it into a
container under /lib/firmware/updates (searched first by the loader) that
is upstream's board-2.bin with every entry kept plus one BOARD entry under
the requested name. Verified structurally (ELF magic, size, the container
magic), no hash pin: the ELF belongs to the stock modem image and can
change with it. The sha256 of the base is kept beside the
override: a changed base (a linux-firmware upgrade) rebuilds it at the
next run, and a rebuild that reproduces the existing file installs
nothing; an entry upstream ships under the same name is taken first by the
driver, so the appended copy then goes unused. The fragment has no
rebind line: the service is ordered before udev's coldplug, which loads
the driver, so a fresh install builds the container before the first
probe (dev phone, the override removed and rebooted: built at 7.2 s,
coldplug from 7.3 s, the driver's board-data load at 8.7 s, the first
association on 5 GHz), and an installed phone gets it at its next boot; a
re-probe from a package hook would restart wifi in the middle of the
upgrade.
zstd joins the dependencies to read the compressed base. Dev phone: the
built container is byte-identical to the one hand-made from the stock
image by the reporter (sha256 186202ee...); the hook's call with the
override absent built it over a wifi session that stayed up, a second
call installed nothing and a --refresh call left the container unchanged.
2026-10-14 17:38:55 +02:00
|
|
|
6aee5f56bc7bc960537b7ca1069305b56a5ec8da99a58298ba1715e93f002d391a2bd24be78214428b0297f9e3cfd1003a243c76a2d08397dcac63a7d800d302 fp6-vendor-blobs-extract
|
aports: extract vendor blobs before udev coldplug so first-boot audio fully works
The preset fix (6ecc1dc) makes the unit run, but multi-user is too late: the
sound card probes at ~21 s, hard-fails (-2, no retry) on the missing ACF, and
the extractor's amp rebind at ~60 s cannot re-form a card whose machine
driver already failed. Re-probing the machine driver does re-form it, but a
late-formed card has a dead capture path - the wcd9378 TX sequencer refuses
PS0 (act_ps 0x3) until the next boot. So rebinding after the fact can never
fully win; extraction has to happen before the drivers probe.
- fp6-vendor-blobs.service: DefaultDependencies=no, run after remount-fs and
before systemd-udev-trigger, so blobs exist before module coldplug.
multi-user stays a second Wants as a post-udev retry if the early run
failed (by-partlabel/make-dynpart-mappings fallbacks need udev).
- aw88261-acf.manifest: add 'rebind platform sound' so the fallback path at
least recovers playback the same boot (capture then heals on reboot).
- fp6-vendor-blobs.post-upgrade (pkgrel 1): systemctl preset + immediate
extract, so installs of the 2026-08-24 image (unit shipped disabled, no
version bump to deliver the preset) finally heal via plain apk upgrade.
- soc-fairphone-fp6-audio pkgrel 1: carries the manifest change.
Verified on the dev phone with the exact staged bytes (sha256-compared):
simulated fresh install (ACF removed, reboot) extracts at 13.3 s, coldplug
probes the amps at 15.1 s, card init at 20.9 s loads the ACF cleanly, and a
1 kHz speaker-to-mic loopback passes on that same first boot with zero TX
sequencer warnings; next boot takes the all-dests-present fast path in 25 ms.
Evidence: fp6 repo journal/blobs/, 2026-08-29.
Assisted-by: Claude:claude-fable-5
2026-08-29 21:53:02 +02:00
|
|
|
b4c290095d9f39515378dfef08de720ce49324210342aa13c131dfce1103785e796e6f821f0c659671a4c44b46f466ce0e03f11f216fdcdee2a99db5e7970800 fp6-vendor-blobs.service
|
2026-09-15 22:36:12 +02:00
|
|
|
9e79dd0aed13f11a71282aa24b2a26331e85c105e25ab0c0fed6189b8c300769a5f4308b18b91d9855868d658ad3a57c03e26c9b11bd27fd5e03f9a5decbbd6a fp6-vendor-blobs.preset
|
fp6-vendor-blobs 1-r4: build the ath11k board data from the stock modem partition
The device tree asks ath11k for the Fairphone_Gen_6 board data entry.
Upstream linux-firmware's WCN6750 board-2.bin has no Fairphone entry, so
the driver silently falls back to the generic board-id 255 data: the FP6
Plus does not associate on it at all (user report 2026-10-14), and the FP6
keeps its channel list but its scans no longer find the 5 GHz networks
around it (two scans found 0 and 1 5 GHz BSSes against 14 with the
device's data, the home AP at -37 dBm among the missing), so it
associates on 2.4 GHz only (dev phone A/B). The stock modem partition
carries the device's own calibration as image/qca6750/bdwlan.elf.
New manifest directive ath11k-bdf: copy that ELF and wrap it into a
container under /lib/firmware/updates (searched first by the loader) that
is upstream's board-2.bin with every entry kept plus one BOARD entry under
the requested name. Verified structurally (ELF magic, size, the container
magic), no hash pin: the ELF belongs to the stock modem image and can
change with it. The sha256 of the base is kept beside the
override: a changed base (a linux-firmware upgrade) rebuilds it at the
next run, and a rebuild that reproduces the existing file installs
nothing; an entry upstream ships under the same name is taken first by the
driver, so the appended copy then goes unused. The fragment has no
rebind line: the service is ordered before udev's coldplug, which loads
the driver, so a fresh install builds the container before the first
probe (dev phone, the override removed and rebooted: built at 7.2 s,
coldplug from 7.3 s, the driver's board-data load at 8.7 s, the first
association on 5 GHz), and an installed phone gets it at its next boot; a
re-probe from a package hook would restart wifi in the middle of the
upgrade.
zstd joins the dependencies to read the compressed base. Dev phone: the
built container is byte-identical to the one hand-made from the stock
image by the reporter (sha256 186202ee...); the hook's call with the
override absent built it over a wifi session that stayed up, a second
call installed nothing and a --refresh call left the container unchanged.
2026-10-14 17:38:55 +02:00
|
|
|
f13d7b384a9b577762693c6831fbf28cb9e92e4f943af1917ddeba121c582f0c85c81a3e01e8e9ff6367c3717b6c37743f019db297f75339871292cf816bfc91 30-ath11k-board-data.manifest
|
aports: extract aw88261_acf.bin on-device instead of shipping it
New package fp6-vendor-blobs: a manifest-driven systemd oneshot that
copies proprietary blobs out of the stock Android partitions on first
boot. pmOS installs flash only boot+userdata, so every installed unit
still carries the stock vendor/dsp partitions - the device duplicates a
file it already contains, for its own operation, and nothing proprietary
is distributed by us. Partitions are mounted read-only (ext4 additionally
with noload - not even a journal replay touches the stock data), every
copy is sha256-pinned and a miss fails loudly, and the consuming devices
are unbound and re-probed afterwards so the feature works the same boot.
The rebind is unconditional by design: aw88261 binds on a bare i2c
chip-id probe and requests the ACF only at ASoC card init (~21 s, after
SoundWire enumeration), so a bound device can still be one that lost the
firmware race - and that failed request is never retried.
soc-fairphone-fp6-audio (pkgver 4) stops shipping the blob, installs the
manifest fragment instead, and re-runs the extractor from
post-install/post-upgrade so upgrades restore the file immediately (the
old package version removed it on upgrade). License drops back to plain
BSD-3-Clause - nothing proprietary left in the package.
Verified on the dev phone (fp6 repo journal/blobs/captures/
2026-08-24-first-boot-extractor-verification.txt): first-boot extraction
+ same-boot audio, mid-session post-upgrade recovery, and the everyday
fast-path no-op; committed files byte-identical to the tested deployment.
Assisted-by: Claude:claude-fable-5
2026-08-24 21:00:34 +02:00
|
|
|
"
|