eSIM Slots Fix — OnePlus 15R (macan)

Built with Qwen3.8 Max!1!1!1!11

Full eSIM support for OnePlus 15R (macan / CPH2767) running LineageOS-based Android 16 ports.

---

The Problem

AOSP-based ports for OnePlus 15R ship without working eSIM, even though the hardware (eUICC chip) and Oplus vendor HALs are fully present:

1. Settings does not show the eSIM page. AOSP EuiccManager only enables the embedded SIM UI when a slot is reported as a non-removable eUICC. The Oplus stock framework injects this at runtime; AOSP ports do not.
2. The eUICC chip is never powered on at boot. On ColorOS/OxygenOS, proprietary Oplus framework services run the power-up sequence (setUimPower / setEsimStatus / setEsimGpio) through the vendor eSIM HAL. Those services do not exist on AOSP ports, so the chip stays dead.
3. The RIL does not treat slot 1 as an eUICC. Qualcomm RIL expects an Oplus-specific SET_SIM_TYPE configuration push after boot; without it the modem ignores the embedded slot.

What This Module Does

Component	File	Purpose
RRO overlay	product/overlay/EuiccSlotsFix.apk	Overrides config_non_removable_euicc_slots to [1] so Settings and EuiccManager expose the eSIM UI
Activation daemon	esimd.sh	Powers the eUICC during boot animation and drives the full RIL activation sequence
Manual cycle	esimd-manual.sh	One-shot activation with live progress output
KSU action button	action.sh	Module action in KernelSU Manager: status + manual activation
Watchdog	service.sh	Respawns the daemon if it dies
Boot hook	post-fs-data.sh	Mounts the RRO overlay (tmpfs) and starts the daemon early

Daemon phases

• Phase A (boot animation): waits for vendor.oplus.hardware.esim.IOplusEsim/default, then powers the eUICC via the Oplus HAL power sequence. The chip is alive before Android finishes booting — the same timing as stock firmware.
• Phase B (radio up): waits for the phone service, gives the RIL up to 60 s to detect the eUICC on its own. If not detected, runs up to 6 activation attempts: SET_SIM_TYPE [1,1] → qcrild restart → wait for RIL re-sync (Received GET_SIM_TYPE_INFO) → SET_SIM_TYPE [1,2] → wait for card detection.
• Phase C (runtime monitor): checks eSIM presence every 30 s forever. Two consecutive failures trigger automatic re-activation. The eSIM comes back without user interaction.

Technical Details

eUICC power sequence (Oplus vendor HALs)

vendor.oplus.hardware.esim.IOplusEsim/default
    tx 1  = getEsimGpio
    tx 3  = setEsimGpio(1)
    tx 5  = setUimPower(0|1)

vendor.oplus.hardware.subsys_interface.subsys_radio.ISubsysRadio/slot1
    tx 289 = setEsimStatus(91, 1)

Order: setUimPower(0) -> setEsimStatus(91,1) -> setEsimGpio(1) -> setUimPower(1)
GPIO readback must return 00000001

SET_SIM_TYPE (ITelephony transaction 175)

service call phone 175 \
  i32 2 i32 1 i32 0 i32 0 i32 0 i32 1 i32 1 i32 0 i32 1 i32 1 i32 <T>

T = 1  physical-only slot map (forces RIL reset)
T = 2  physical + eUICC (final configuration)

The [1,1] → qcrild restart → [1,2] order is required: the modem applies the eUICC slot type only after a clean RIL re-initialization.

Success markers

• radio logcat: Received GET_SIM_TYPE_INFO (RIL re-synced)
• radio logcat: [1] recv card status:3 (eUICC card responding)
• dumpsys isub: active subscription with simSlotIndex=1 portIndex=0 isEmbedded=1

Requirements

• OnePlus 15R (macan, CPH2767), LineageOS-based Android 16 port
• KernelSU (tested on KSU 3.3.0 with SUSfs)
• Oplus vendor image with working esim and subsys_radio HALs
• At least one eSIM profile downloaded to the eUICC (tested with MTS BY; profile switching MTS BY ⇄ Roamless works)

Note: KernelSU 3.x has no magic mount, so the RRO is deployed with a tmpfs bind over /product/overlay in post-fs-data.sh instead of a system/ dir.

Usage

• Automatic: nothing to do. eUICC powers during boot animation, eSIM registers ~20–30 s after boot.
• Manual: KernelSU → Modules → eSIM Slots Fix → action button. Shows current status, runs the full activation cycle with live progress, prints the result and recent log lines.

Logs

• /data/adb/euicc_daemon.log — daemon activity, manual cycles, monitor events (auto-truncated at 256 KB)
• /data/adb/esimd.pid — daemon PID

Limitations

• The device has a single eUICC chip: only one eSIM profile can be active at a time. Simultaneous dual-eSIM (MEP) is not supported by the modem configuration — same behavior as stock firmware.
• Physical nano-SIM + eSIM work simultaneously (DSDS, 2 active subscriptions).
• Bundled extras unrelated to eSIM: satellite telephony feature flag and a SurfaceFlinger idle-timer override (anti-flicker for LTPO panels).

Project Layout

EuiccSlotsFix/
├── README.md            this file
├── README-RU.md         Russian readme
└── module/
    ├── module.prop
    ├── customize.sh
    ├── post-fs-data.sh
    ├── service.sh
    ├── action.sh
    ├── esimd.sh
    ├── esimd-manual.sh
    └── product/
        ├── overlay/EuiccSlotsFix.apk
        └── etc/permissions/android.hardware.telephony.satellite.xml