Modem Firmware Updates

TL;DR

Modem firmware updates follow a separate path from AAOS/QNX OTA. The AMSS/MPSS image lives in modem_a / modem_b A/B partitions on UFS LUN 1, independent of system_a/b or QNX IFS. In production, TelAF Firmware Update Service stages and applies modem images over QMI with verification and slot switching. In the factory and lab, you flash modem via QFIL/fastboot as an explicit step, often after AP images. QXDM is your diagnostic window into modem state during and after update. This is why modem flash is a separate step in your flashing procedure: skip it or use the wrong MPSS build ID and you get a booting IVI with dead telematics.

You’ve OTA’d Android a dozen times. You’ve flashed QNX IFS. But the modem? It has its own partition pair, its own build artifact, its own verification, and its own failure signature. Treating modem update as “just another partition in the Android OTA zip” is how programs lose weeks.

Two Update Worlds on One SoC

	AAOS / QNX OTA	Modem Firmware Update
Target partitions	boot, vendor, system, QNX IFS, etc.	modem_a / modem_b
Managed by	OTA agent, A/B bootctrl (ABL)	TelAF FW Update Service or factory flash tool
Subsystem restarted	Guest VM / kernel reboot	Modem subsystem reset (PIL reload)
Hypervisor role	Schedules VM reboot	None (modem is outside QHEE)
Typical artifact	.zip OTA package, super partition images	MPSS .mbn / composite modem image, signed per carrier/region
Wrong image symptom	Boot loop, AVB rejection	Silent telematics death: IVI boots fine

flowchart LR
    subgraph OTA["AAOS / QNX OTA Path"]
        OTA_AGENT["OTA Agent"]
        AB["bootctrl / ABL<br/>slot_a ↔ slot_b"]
        OS_PARTS["system_a/b · vendor_a/b<br/>QNX IFS"]
    end

    subgraph MODEM["Modem Update Path"]
        TELAF_FW["TelAF Firmware<br/>Update Service"]
        MOD_PARTS["modem_a / modem_b"]
        PIL["PIL / remoteproc<br/>reload"]
    end

    OTA_AGENT --> OS_PARTS
    OTA_AGENT --> AB
    TELAF_FW --> MOD_PARTS
    MOD_PARTS --> PIL
    PIL --> AMSS["AMSS / MPSS Running"]

Two OTAs, one chip: OS OTA and modem OTA. If your release notes only mention “system image,” check for a separate MPSS release.

modem_a / modem_b: A/B for the Modem

Just like Android system_a and system_b, modem firmware uses A/B slotting for safer updates:

Partition	Role
modem_a	Slot A modem firmware image
modem_b	Slot B modem firmware image
Active slot marker	Stored in modem NV / partition metadata; PIL loads the active slot at boot

Update flow (simplified):

1. Identify inactive slot (if running modem_a, target modem_b)
2. Write new MPSS image to inactive partition (factory: QFIL; field: TelAF FW Update)
3. Verify signature and compatibility (carrier config, RF calibration NV must match)
4. Switch active slot and trigger modem subsystem restart
5. PIL loads new image; QMI services re-register; telematics daemon reconnects

If step 5 fails, a well-designed system falls back to the previous slot, but factory mis-flashes without valid fallback NV can brick cellular until USB reflash.

Common Gotcha

Flashing modem_a when the device boots from modem_b: you updated the wrong slot. The device keeps running the old firmware. Always check active modem slot in diagnostics (DMS QMI or factory menu) before manual flash. This is the modem equivalent of writing system_b while booted from system_a. Looks successful, changes nothing.

TelAF Firmware Update Service

In field and service updates, the TelAF Firmware Update Service orchestrates modem OTA without QFIL:

Phase	What Happens
Download	Modem image fetched via data session (cloud OTA) or sideloaded
Stage	Image written to inactive modem partition; checksum verified
Pre-check	Version compatibility, carrier match, battery/ignition constraints
Apply	Slot switch + modem reset requested via QMI
Verify	Post-update DMS version query, registration smoke test
Rollback	On failure, revert active slot marker to previous

Your QNX telematics daemon (or a dedicated update manager) calls TelAF APIs. Application code doesn’t write raw bytes to UFS. The service enforces signed image policy matching secure boot on the modem subsystem.

Mental Model

Think of modem update as replacing the engine in a car while the dashboard still works. AAOS/QNX OTA is replacing the dashboard UI. You can swap the dashboard without touching the engine, and vice versa. But swap the engine with the wrong model and the dashboard lights up fine while nothing moves. TelAF FW Update is the certified mechanic who knows which engine fits and how to test it before you leave the garage.

Factory Flash: Why Modem Is a Separate Step

Your flashing procedure XML / batch script likely has distinct sections:

1. LUN 0 — XBL, UEFI, ABL, TZ          (boot chain — touch carefully)
2. LUN 1 — QNX IFS, Android boot/vendor/system
3. LUN 1 — ADSP/CDSP                    (DSP firmware)
4. LUN 1 — modem                        (AMSS/MPSS)  ← SEPARATE STEP
5. Persist / calibration NV             (RF, carrier-specific)

Why separated:

• Different build system: MPSS comes from Qualcomm modem team builds, not your Android lunch target
• Different signing: Carrier and region certificates; wrong signature = load failure
• Different dependencies: RF calibration NV in persist must match modem variant
• Different validation: Post-flash requires QXDM registration test, not just adb wait-for-device

Flash order: Boot, OS, DSP, Modem, Persist. Modem is its own step for good reason.

MPSS Build ID — The String That Matters

Modem images are identified by MPSS build IDs (e.g., MPSS.HA.1.1-XXXXX-SA8155P-XXXXX), not your Android ro.build.display.id. Mismatch between MPSS build, RF card variant, and calibration NV is the #1 factory “no service” defect. Your release manifest should list three IDs: Android build, QNX IFS version, and MPSS build. If release notes omit MPSS, ask before flashing.

QXDM: Diagnostics During and After Modem Update

QXDM (Qualcomm eXtensible Diagnostic Monitor) is the Windows/Linux diagnostic tool for modem subsystem bring-up and debug. During modem update validation:

QXDM Use	What You’re Checking
Connection status	Diag port over USB: AP and modem diag channels
NAS log	Network registration, PLMN search, attach success
QMI message view	FW update service transactions, error codes
RF metrics	TX power, RSRP/RSRQ; post-calibration sanity
Crash dumps	Modem subsystem fatal events after bad flash

QXDM speaks to the modem through Diag protocol, parallel to QMI, not through adb logcat. If your team says “pull QXDM logs,” they mean modem-side logs, not Android.

Common post-update QXDM checks:

1. DMS Get Revision: confirms new MPSS version string
2. NAS Get Serving System: registered on network
3. WDS Get Data Bearer: data call active with correct APN
4. Voice call test: MO/MT in lab mode (not live 112)

QXDM is the microscope for the modem, not the AP.

Failure Modes You’ll Actually See

Symptom	Likely Cause	Fix Direction
IVI boots, no modem version in DMS	PIL load failure, wrong unsigned image	Reflash correct modem partition; check secure boot logs
Version shows, no registration	RF NV/calibration mismatch, wrong carrier config	Reflash matching persist / re-run RF calibration
Update “succeeds,” old version still reported	Wrote inactive slot but didn’t switch	Check slot marker; force slot switch via TelAF/DMS
Modem crashes loop after update	Incompatible MPSS for silicon stepping	Rollback slot; escalate to Qualcomm modem release
Data works, voice/eCall fails	IMS profile not updated with modem	Refresh carrier IMS config, not just MPSS

Connect the Dots

Module 0.3 introduced modem_a / modem_b on UFS LUN 1. Module 7.1 explained PIL loading and why the modem is outside the hypervisor. Module 7.2 showed TelAF as the application API, including Firmware Update Service. This page closes the loop on how the image gets there. Module 8 (OTA Architecture) covers AAOS/QNX update orchestration. Coordinate with modem OTA in release planning, but never assume they’re the same package.

Remember

1. Modem updates are separate from AAOS/QNX OTA: different partitions, tools, and restart domain.
2. modem_a / modem_b A/B slotting mirrors Android. Check active slot before manual flash.
3. TelAF Firmware Update Service handles field modem OTA with staging, verify, and rollback.
4. QXDM validates modem health post-update: registration, data, voice, version.
5. Factory flash procedures list modem as an explicit step for good reason.

Where You'll See This

This is why modem flash is a separate step in your flashing procedure.

Before signing off any flash session:

1. Confirm MPSS build ID in release manifest matches target hardware variant (SA8155P vs SA8295P, RF card, region).
2. Flash modem to the correct slot, or flash both slots with the same verified image during initial bring-up.
3. Post-flash: query modem version via factory diagnostic or TelAF DMS. Don’t trust “flash succeeded” alone.
4. Run registration smoke test: QXDM NAS log or factory network test before handing board to next station.
5. Coordinate with persist/calibration: modem flash without matching RF NV produces the infamous “bars but no data” or “no bars at all.”

When Android OTA succeeds but telematics regresses after a combined release, check whether MPSS was included and slot-switched. The Android OTA agent may not have touched the modem at all, or may have staged an incompatible MPSS build. Split the problem: adb shell getprop for Android, DMS revision for modem. Two worlds, two answers.

Check Your Understanding

1. After a successful AAOS OTA, telematics stops working but the new Android build is confirmed active. Most likely explanation?

A. Hypervisor corrupted the AAOS VM during OTAB. The OTA updated Android partitions but modem firmware was not updated, is incompatible, or failed slot switch — modem domain is independentC. QXDM replaced adb as the Android debug transportD. eCall automatically disabled all data sessions after OTA

2. You manually flashed a new MPSS image to modem_b, but DMS still reports the old firmware version after reboot. What should you check first?

A. Whether the device is booting from modem_a — you may have updated the inactive slot without switchingB. Whether Adreno GPU firmware needs matching updateC. Whether QNX IFS slot needs switching via ABLD. Whether Android system partition is full

3. Which tool is primary for validating modem registration and post-update RF state — not Android app logs?

A. adb logcatB. QXDM with Diag connection to modem subsystemC. QNX pidinD. Android Studio Profiler