# eSIM Slots Fix — OnePlus 15R (macan)

Built with Qwen3.8 Max!1!1!1!11

Full eSIM support for **OnePlus 15R (macan / CPH2767)** running LineageOS-based Android 16 ports.

---

## The Problem

AOSP-based ports for OnePlus 15R ship without working eSIM, even though the hardware (eUICC chip) and Oplus vendor HALs are fully present:

1. **Settings does not show the eSIM page.** AOSP `EuiccManager` only enables the embedded SIM UI when a slot is reported as a non-removable eUICC. The Oplus stock framework injects this at runtime; AOSP ports do not.
2. **The eUICC chip is never powered on at boot.** On ColorOS/OxygenOS, proprietary Oplus framework services run the power-up sequence (`setUimPower` / `setEsimStatus` / `setEsimGpio`) through the vendor eSIM HAL. Those services do not exist on AOSP ports, so the chip stays dead.
3. **The RIL does not treat slot 1 as an eUICC.** Qualcomm RIL expects an Oplus-specific `SET_SIM_TYPE` configuration push after boot; without it the modem ignores the embedded slot.

## What This Module Does

| Component | File | Purpose |
|---|---|---|
| RRO overlay | `product/overlay/EuiccSlotsFix.apk` | Overrides `config_non_removable_euicc_slots` to `[1]` so Settings and EuiccManager expose the eSIM UI |
| Activation daemon | `esimd.sh` | Powers the eUICC during boot animation and drives the full RIL activation sequence |
| Manual cycle | `esimd-manual.sh` | One-shot activation with live progress output |
| KSU action button | `action.sh` | Module action in KernelSU Manager: status + manual activation |
| Watchdog | `service.sh` | Respawns the daemon if it dies |
| Boot hook | `post-fs-data.sh` | Mounts the RRO overlay (tmpfs) and starts the daemon early |

### Daemon phases

- **Phase A (boot animation):** waits for `vendor.oplus.hardware.esim.IOplusEsim/default`, then powers the eUICC via the Oplus HAL power sequence. The chip is alive before Android finishes booting — the same timing as stock firmware.
- **Phase B (radio up):** waits for the `phone` service, gives the RIL up to 60 s to detect the eUICC on its own. If not detected, runs up to 6 activation attempts: `SET_SIM_TYPE [1,1]` → qcrild restart → wait for RIL re-sync (`Received GET_SIM_TYPE_INFO`) → `SET_SIM_TYPE [1,2]` → wait for card detection.
- **Phase C (runtime monitor):** checks eSIM presence every 30 s forever. Two consecutive failures trigger automatic re-activation. The eSIM comes back without user interaction.

## Technical Details

### eUICC power sequence (Oplus vendor HALs)

```
vendor.oplus.hardware.esim.IOplusEsim/default
    tx 1  = getEsimGpio
    tx 3  = setEsimGpio(1)
    tx 5  = setUimPower(0|1)

vendor.oplus.hardware.subsys_interface.subsys_radio.ISubsysRadio/slot1
    tx 289 = setEsimStatus(91, 1)

Order: setUimPower(0) -> setEsimStatus(91,1) -> setEsimGpio(1) -> setUimPower(1)
GPIO readback must return 00000001
```

### SET_SIM_TYPE (ITelephony transaction 175)

```
service call phone 175 \
  i32 2 i32 1 i32 0 i32 0 i32 0 i32 1 i32 1 i32 0 i32 1 i32 1 i32 <T>

T = 1  physical-only slot map (forces RIL reset)
T = 2  physical + eUICC (final configuration)
```

The `[1,1] → qcrild restart → [1,2]` order is required: the modem applies the
eUICC slot type only after a clean RIL re-initialization.

### Success markers

- radio logcat: `Received GET_SIM_TYPE_INFO` (RIL re-synced)
- radio logcat: `[1] recv card status:3` (eUICC card responding)
- `dumpsys isub`: active subscription with `simSlotIndex=1 portIndex=0 isEmbedded=1`

## Requirements

- OnePlus 15R (macan, CPH2767), LineageOS-based Android 16 port
- KernelSU (tested on KSU 3.3.0 with SUSfs)
- Oplus vendor image with working `esim` and `subsys_radio` HALs
- At least one eSIM profile downloaded to the eUICC (tested with MTS BY; profile switching MTS BY ⇄ Roamless works)

> Note: KernelSU 3.x has no magic mount, so the RRO is deployed with a tmpfs
> bind over `/product/overlay` in `post-fs-data.sh` instead of a `system/` dir.

## Usage

- **Automatic:** nothing to do. eUICC powers during boot animation, eSIM registers ~20–30 s after boot.
- **Manual:** KernelSU → Modules → *eSIM Slots Fix* → action button. Shows current status, runs the full activation cycle with live progress, prints the result and recent log lines.

## Logs

- `/data/adb/euicc_daemon.log` — daemon activity, manual cycles, monitor events (auto-truncated at 256 KB)
- `/data/adb/esimd.pid` — daemon PID

## Limitations

- The device has a **single eUICC chip**: only one eSIM profile can be active at a time. Simultaneous dual-eSIM (MEP) is not supported by the modem configuration — same behavior as stock firmware.
- Physical nano-SIM + eSIM work simultaneously (DSDS, 2 active subscriptions).
- Bundled extras unrelated to eSIM: satellite telephony feature flag and a SurfaceFlinger idle-timer override (anti-flicker for LTPO panels).

## Project Layout

```
EuiccSlotsFix/
├── README.md            this file
├── README-RU.md         Russian readme
└── module/
    ├── module.prop
    ├── customize.sh
    ├── post-fs-data.sh
    ├── service.sh
    ├── action.sh
    ├── esimd.sh
    ├── esimd-manual.sh
    └── product/
        ├── overlay/EuiccSlotsFix.apk
        └── etc/permissions/android.hardware.telephony.satellite.xml
```