114 lines
5.2 KiB
Markdown
114 lines
5.2 KiB
Markdown
# eSIM Slots Fix — OnePlus 15R (macan)
|
||
|
||
Built with Qwen3.8 Max!1!1!1!11
|
||
|
||
Full eSIM support for **OnePlus 15R (macan / CPH2767)** running LineageOS-based Android 16 ports.
|
||
|
||
---
|
||
|
||
## The Problem
|
||
|
||
AOSP-based ports for OnePlus 15R ship without working eSIM, even though the hardware (eUICC chip) and Oplus vendor HALs are fully present:
|
||
|
||
1. **Settings does not show the eSIM page.** AOSP `EuiccManager` only enables the embedded SIM UI when a slot is reported as a non-removable eUICC. The Oplus stock framework injects this at runtime; AOSP ports do not.
|
||
2. **The eUICC chip is never powered on at boot.** On ColorOS/OxygenOS, proprietary Oplus framework services run the power-up sequence (`setUimPower` / `setEsimStatus` / `setEsimGpio`) through the vendor eSIM HAL. Those services do not exist on AOSP ports, so the chip stays dead.
|
||
3. **The RIL does not treat slot 1 as an eUICC.** Qualcomm RIL expects an Oplus-specific `SET_SIM_TYPE` configuration push after boot; without it the modem ignores the embedded slot.
|
||
|
||
## What This Module Does
|
||
|
||
| Component | File | Purpose |
|
||
|---|---|---|
|
||
| RRO overlay | `product/overlay/EuiccSlotsFix.apk` | Overrides `config_non_removable_euicc_slots` to `[1]` so Settings and EuiccManager expose the eSIM UI |
|
||
| Activation daemon | `esimd.sh` | Powers the eUICC during boot animation and drives the full RIL activation sequence |
|
||
| Manual cycle | `esimd-manual.sh` | One-shot activation with live progress output |
|
||
| KSU action button | `action.sh` | Module action in KernelSU Manager: status + manual activation |
|
||
| Watchdog | `service.sh` | Respawns the daemon if it dies |
|
||
| Boot hook | `post-fs-data.sh` | Mounts the RRO overlay (tmpfs) and starts the daemon early |
|
||
|
||
### Daemon phases
|
||
|
||
- **Phase A (boot animation):** waits for `vendor.oplus.hardware.esim.IOplusEsim/default`, then powers the eUICC via the Oplus HAL power sequence. The chip is alive before Android finishes booting — the same timing as stock firmware.
|
||
- **Phase B (radio up):** waits for the `phone` service, gives the RIL up to 60 s to detect the eUICC on its own. If not detected, runs up to 6 activation attempts: `SET_SIM_TYPE [1,1]` → qcrild restart → wait for RIL re-sync (`Received GET_SIM_TYPE_INFO`) → `SET_SIM_TYPE [1,2]` → wait for card detection.
|
||
- **Phase C (runtime monitor):** checks eSIM presence every 30 s forever. Two consecutive failures trigger automatic re-activation. The eSIM comes back without user interaction.
|
||
|
||
## Technical Details
|
||
|
||
### eUICC power sequence (Oplus vendor HALs)
|
||
|
||
```
|
||
vendor.oplus.hardware.esim.IOplusEsim/default
|
||
tx 1 = getEsimGpio
|
||
tx 3 = setEsimGpio(1)
|
||
tx 5 = setUimPower(0|1)
|
||
|
||
vendor.oplus.hardware.subsys_interface.subsys_radio.ISubsysRadio/slot1
|
||
tx 289 = setEsimStatus(91, 1)
|
||
|
||
Order: setUimPower(0) -> setEsimStatus(91,1) -> setEsimGpio(1) -> setUimPower(1)
|
||
GPIO readback must return 00000001
|
||
```
|
||
|
||
### SET_SIM_TYPE (ITelephony transaction 175)
|
||
|
||
```
|
||
service call phone 175 \
|
||
i32 2 i32 1 i32 0 i32 0 i32 0 i32 1 i32 1 i32 0 i32 1 i32 1 i32 <T>
|
||
|
||
T = 1 physical-only slot map (forces RIL reset)
|
||
T = 2 physical + eUICC (final configuration)
|
||
```
|
||
|
||
The `[1,1] → qcrild restart → [1,2]` order is required: the modem applies the
|
||
eUICC slot type only after a clean RIL re-initialization.
|
||
|
||
### Success markers
|
||
|
||
- radio logcat: `Received GET_SIM_TYPE_INFO` (RIL re-synced)
|
||
- radio logcat: `[1] recv card status:3` (eUICC card responding)
|
||
- `dumpsys isub`: active subscription with `simSlotIndex=1 portIndex=0 isEmbedded=1`
|
||
|
||
## Requirements
|
||
|
||
- OnePlus 15R (macan, CPH2767), LineageOS-based Android 16 port
|
||
- KernelSU (tested on KSU 3.3.0 with SUSfs)
|
||
- Oplus vendor image with working `esim` and `subsys_radio` HALs
|
||
- At least one eSIM profile downloaded to the eUICC (tested with MTS BY; profile switching MTS BY ⇄ Roamless works)
|
||
|
||
> Note: KernelSU 3.x has no magic mount, so the RRO is deployed with a tmpfs
|
||
> bind over `/product/overlay` in `post-fs-data.sh` instead of a `system/` dir.
|
||
|
||
## Usage
|
||
|
||
- **Automatic:** nothing to do. eUICC powers during boot animation, eSIM registers ~20–30 s after boot.
|
||
- **Manual:** KernelSU → Modules → *eSIM Slots Fix* → action button. Shows current status, runs the full activation cycle with live progress, prints the result and recent log lines.
|
||
|
||
## Logs
|
||
|
||
- `/data/adb/euicc_daemon.log` — daemon activity, manual cycles, monitor events (auto-truncated at 256 KB)
|
||
- `/data/adb/esimd.pid` — daemon PID
|
||
|
||
## Limitations
|
||
|
||
- The device has a **single eUICC chip**: only one eSIM profile can be active at a time. Simultaneous dual-eSIM (MEP) is not supported by the modem configuration — same behavior as stock firmware.
|
||
- Physical nano-SIM + eSIM work simultaneously (DSDS, 2 active subscriptions).
|
||
- Bundled extras unrelated to eSIM: satellite telephony feature flag and a SurfaceFlinger idle-timer override (anti-flicker for LTPO panels).
|
||
|
||
## Project Layout
|
||
|
||
```
|
||
EuiccSlotsFix/
|
||
├── README.md this file
|
||
├── README-RU.md Russian readme
|
||
└── module/
|
||
├── module.prop
|
||
├── customize.sh
|
||
├── post-fs-data.sh
|
||
├── service.sh
|
||
├── action.sh
|
||
├── esimd.sh
|
||
├── esimd-manual.sh
|
||
└── product/
|
||
├── overlay/EuiccSlotsFix.apk
|
||
└── etc/permissions/android.hardware.telephony.satellite.xml
|
||
```
|