Modem Firmware Updates

Advanced9 min read

Assumes: 7.1 AMSS/MPSS, 8.1 Partition Map

TL;DR

Modem firmware updates follow a separate path from AAOS/QNX OTA. The AMSS/MPSS image lives in modem_a / modem_b A/B partitions on UFS LUN 1, independent of system_a/b or QNX IFS. In production, TelAF Firmware Update Service stages and applies modem images over QMI with verification and slot switching. In the factory and lab, you flash modem via QFIL/fastboot as an explicit step, often after AP images. QXDM is your diagnostic window into modem state during and after update. This is why modem flash is a separate step in your flashing procedure: skip it or use the wrong MPSS build ID and you get a booting IVI with dead telematics.

You’ve OTA’d Android a dozen times. You’ve flashed QNX IFS. But the modem? It has its own partition pair, its own build artifact, its own verification, and its own failure signature. Treating modem update as “just another partition in the Android OTA zip” is how programs lose weeks. Updating the modem is like changing tires on a moving car: the rest of the system really prefers you get it right.

Think About It

You OTA-update AAOS successfully, but after reboot the modem firmware is the old version. Why?

Reveal Answer

AAOS OTA and modem OTA are separate deliverables — the Android OTA agent switches system_a/b via ABL bootctrl but does not touch modem_a/b unless a coordinated TelAF Firmware Update Service package was included and applied. PIL loads MPSS from the active modem slot at boot, completely outside the hypervisor and Android update path. Query DMS Get Revision via TelAF or QXDM after reboot, confirm the active modem slot in factory diagnostics, and check whether your release manifest listed a separate MPSS build ID — if it didn’t, the Android OTA never had modem firmware to apply.

Two Update Worlds on One SoC

	AAOS / QNX OTA	Modem Firmware Update
Target partitions	boot, vendor, system, QNX IFS, etc.	modem_a / modem_b
Managed by	OTA agent, A/B bootctrl (ABL)	TelAF FW Update Service or factory flash tool
Subsystem restarted	Guest VM / kernel reboot	Modem subsystem reset (PIL reload)
Hypervisor role	Schedules VM reboot	None (modem is outside QHEE)
Typical artifact	.zip OTA package, super partition images	MPSS .mbn / composite modem image, signed per carrier/region
Wrong image symptom	Boot loop, AVB rejection	Silent telematics death: IVI boots fine

flowchart LR
    subgraph OTA["AAOS / QNX OTA Path"]
        OTA_AGENT["OTA Agent"]
        AB["bootctrl / ABL<br/>slot_a ↔ slot_b"]
        OS_PARTS["system_a/b · vendor_a/b<br/>QNX IFS"]
    end

    subgraph MODEM["Modem Update Path"]
        TELAF_FW["TelAF Firmware<br/>Update Service"]
        MOD_PARTS["modem_a / modem_b"]
        PIL["PIL / remoteproc<br/>reload"]
    end

    OTA_AGENT --> OS_PARTS
    OTA_AGENT --> AB
    TELAF_FW --> MOD_PARTS
    MOD_PARTS --> PIL
    PIL --> AMSS["AMSS / MPSS Running"]

Two OTAs, one chip: OS OTA and modem OTA. If your release notes only mention “system image,” check for a separate MPSS release.

modem_a / modem_b: A/B for the Modem

Just like Android system_a and system_b, modem firmware uses A/B slotting for safer updates:

Partition	Role
modem_a	Slot A modem firmware image
modem_b	Slot B modem firmware image
Active slot marker	Stored in modem NV / partition metadata; PIL loads the active slot at boot

Update flow (simplified):

1. Identify inactive slot (if running modem_a, target modem_b)
2. Write new MPSS image to inactive partition (factory: QFIL; field: TelAF FW Update)
3. Verify signature and compatibility (carrier config, RF calibration NV must match)
4. Switch active slot and trigger modem subsystem restart
5. PIL loads new image; QMI services re-register; telematics daemon reconnects

If step 5 fails, a well-designed system falls back to the previous slot, but factory mis-flashes without valid fallback NV can brick cellular until USB reflash.

Common Gotcha

If you flash modem_a when the device boots from modem_b, you updated the wrong slot. The device keeps running the old firmware. Always check active modem slot in diagnostics (DMS QMI or factory menu) before manual flash. This is the modem equivalent of writing system_b while booted from system_a. Looks successful, changes nothing.

TelAF Firmware Update Service

In field and service updates, the TelAF Firmware Update Service orchestrates modem OTA without QFIL:

Phase	What Happens
Download	Modem image fetched via data session (cloud OTA) or sideloaded; often delta packages to minimize download size
Stage	Image written to inactive modem partition; checksum verified
Pre-check	Version compatibility, carrier match, battery/ignition constraints
Apply	Slot switch + modem reset requested via QMI
Verify	Post-update DMS version query, registration smoke test
Rollback	On failure, revert active slot marker to previous

Your QNX telematics daemon (or a dedicated update manager) calls TelAF APIs. Application code doesn’t write raw bytes to UFS. The service enforces signed image policy matching secure boot on the modem subsystem. Coordinate AP-side modem drivers (MHI/QRTR) with the new MPSS build — a modem OTA without a matching AP BSP can break QMI IPC even when the flash succeeds.

Mental Model

Think of modem update as replacing the engine in a car while the dashboard still works. AAOS/QNX OTA is replacing the dashboard UI. You can swap the dashboard without touching the engine, and vice versa. But swap the engine with the wrong model and the dashboard lights up fine while nothing moves. TelAF FW Update is the certified mechanic who knows which engine fits and how to test it before you leave the garage.

Modem OTA ≠ AAOS OTA. Different firmware, different partition, different update path. Two separate mailboxes.

Factory Flash: Why Modem Is a Separate Step

Your flashing procedure XML / batch script likely has distinct sections:

1. LUN 0 — XBL, UEFI, ABL, TZ          (boot chain — touch carefully)
2. LUN 1 — QNX IFS, Android boot/vendor/system
3. LUN 1 — ADSP/CDSP                    (DSP firmware)
4. LUN 1 — modem                        (AMSS/MPSS)  ← SEPARATE STEP
5. Persist / calibration NV             (RF, carrier-specific)

Why separated:

• Different build system: MPSS comes from Qualcomm modem team builds, not your Android lunch target
• Different signing: Carrier and region certificates; wrong signature = load failure
• Different dependencies: RF calibration NV in persist must match modem variant
• Different validation: Post-flash requires QXDM registration test, not just adb wait-for-device

Flash order: Boot, OS, DSP, Modem, Persist. Modem is its own step for good reason.

MPSS Build ID — The String That Matters

Modem images are identified by MPSS build IDs (e.g., MPSS.HA.1.1-XXXXX-SA8155P-XXXXX), not your Android ro.build.display.id. Mismatch between MPSS build, RF card variant, and calibration NV is the #1 factory “no service” defect. Your release manifest should list three IDs: Android build, QNX IFS version, and MPSS build. If release notes omit MPSS, ask before flashing.

QXDM: Diagnostics During and After Modem Update

QXDM (Qualcomm eXtensible Diagnostic Monitor) is the Windows/Linux diagnostic tool for modem subsystem bring-up and debug. During modem update validation:

QXDM Use	What You’re Checking
Connection status	Diag port over USB: AP and modem diag channels
NAS log	Network registration, PLMN search, attach success
QMI message view	FW update service transactions, error codes
RF metrics	TX power, RSRP/RSRQ; post-calibration sanity
Crash dumps	Modem subsystem fatal events after bad flash

QXDM speaks to the modem through Diag protocol, parallel to QMI, not through adb logcat. If your team says “pull QXDM logs,” they mean modem-side logs, not Android.

Common post-update QXDM checks:

1. DMS Get Revision: confirms new MPSS version string
2. NAS Get Serving System: registered on network
3. WDS Get Data Bearer: data call active with correct APN
4. Voice call test: MO/MT in lab mode (not live 112)

QXDM is the microscope for the modem, not the AP.

Failure Modes You’ll Actually See

Symptom	Likely Cause	Fix Direction
IVI boots, no modem version in DMS	PIL load failure, wrong unsigned image	Reflash correct modem partition; check secure boot logs
Version shows, no registration	RF NV/calibration mismatch, wrong carrier config	Reflash matching persist / re-run RF calibration
Update “succeeds,” old version still reported	Wrote inactive slot but didn’t switch	Check slot marker; force slot switch via TelAF/DMS
Modem crashes loop after update	Incompatible MPSS for silicon stepping	Rollback slot; escalate to Qualcomm modem release
Data works, voice/eCall fails	IMS profile not updated with modem	Refresh carrier IMS config, not just MPSS

Connect the Dots

Module 0.3 introduced modem_a / modem_b on UFS LUN 1. Module 7.1 explained PIL loading and why the modem is outside the hypervisor. Module 7.2 showed TelAF as the application API, including Firmware Update Service. This page closes the loop on how the image gets there. Module 8 (OTA Architecture) covers AAOS/QNX update orchestration. Coordinate with modem OTA in release planning, but never assume they’re the same package.

Remember

1. Modem updates are separate from AAOS/QNX OTA: different partitions, tools, and restart domain.
2. modem_a / modem_b A/B slotting mirrors Android. Check active slot before manual flash.
3. TelAF Firmware Update Service handles field modem OTA with staging, verify, and rollback.
4. QXDM validates modem health post-update: registration, data, voice, version.
5. Factory flash procedures list modem as an explicit step for good reason.

Where You'll See This

This is why modem flash is a separate step in your flashing procedure.

Before signing off any flash session:

1. Confirm MPSS build ID in release manifest matches target hardware variant (SA8155P vs SA8295P, RF card, region).
2. Flash modem to the correct slot, or flash both slots with the same verified image during initial bring-up.
3. Post-flash: query modem version via factory diagnostic or TelAF DMS. Don’t trust “flash succeeded” alone.
4. Run registration smoke test: QXDM NAS log or factory network test before handing board to next station.
5. Coordinate with persist/calibration: modem flash without matching RF NV produces the infamous “bars but no data” or “no bars at all.”

When Android OTA succeeds but telematics regresses after a combined release, check whether MPSS was included and slot-switched. The Android OTA agent may not have touched the modem at all, or may have staged an incompatible MPSS build. Split the problem: adb shell getprop for Android, DMS revision for modem. Two worlds, two answers.

Check Your Understanding

1. Which UFS partitions hold the AMSS/MPSS firmware image?

Recall

A. `modem_a` / `modem_b`B. `vendor_a` / `vendor_b`C. `boot_a` / `boot_b`D. `system_a` / `system_b`

2. Which tool is primary for validating modem registration and post-update RF state — not Android app logs?

Recall

A. QXDM with Diag connection to modem subsystemB. Android Studio ProfilerC. adb logcatD. QNX pidin

3. After a successful AAOS OTA, telematics stops working but the new Android build is confirmed active. Most likely explanation?

Applied

A. Hypervisor corrupted the AAOS VM memory during the OTA write sequenceB. eCall service automatically disabled all data sessions after the OTA rebootC. QXDM replaced adb as the primary Android debug transport after the updateD. OTA updated Android but modem FW is stale, incompatible, or slot not switched

4. You manually flashed a new MPSS image to modem_b, but DMS still reports the old firmware version after reboot. What should you check first?

Applied

A. Whether booting from modem_a — you may have updated inactive slot onlyB. Whether the QNX IFS slot needs switching via ABL after the modem updateC. Whether the Android system partition is full and blocking the modem flashD. Whether the Adreno GPU firmware needs a matching update after modem flash

5. TelAF Firmware Update Service reports 'apply succeeded,' but telematics cannot open QMI data calls. QXDM shows the new MPSS version active. AP-side MHI driver still matches the previous BSP. Next step?

Applied

A. Update AP modem drivers (MHI/QRTR) to match new MPSS — IPC may differB. Disable V2X PC5 sidelink to free modem bandwidth for the LTE data bearerC. Replace the cellular antenna — RF path failed after the modem OTA updateD. Reflash the AAOS system partition — modem OTA likely corrupted Android

6. Release planning bundles an AAOS OTA zip and a separate MPSS delta package. Why must modem OTA remain a distinct deliverable from the Android OTA agent?

Synthesis

Connects to: Module 8 — OTA Architecture

A. Modem updates always require physical QFIL — over-the-air is not possibleB. MPSS images are too large to fit in any OTA delivery or staging mechanismC. Different partitions (modem_a/b), signing, TelAF path, PIL — ABL doesn't manageD. The hypervisor blocks any OTA transaction that touches UFS LUN 1 partitions

Further Reading

• Qualcomm TelAF Firmware Update Service — TelAF SDK documentation covering modem OTA staging, verification, and slot switching over QMI.
• GSMA FOTA Guidelines — Industry context for firmware-over-the-air update practices applicable to modem subsystem updates.
• 3GPP TS 23.502 — 5G System Procedures — Network attach and session management procedures relevant to post-update registration smoke tests.
• Android A/B System Updates — AOSP OTA architecture for A/B slotting — the same pattern modem_a/modem_b uses for safer modem firmware updates.
• Qualcomm QXDM Tool — Diagnostic tool for validating modem registration, RF metrics, and crash dumps after MPSS flash.
• ETSI TS 102 223 — Smart Card Application Toolkit — SIM/eUICC provisioning standards relevant to carrier certification after modem firmware changes.
• Qualcomm Secure Boot for Modems — Security architecture context for signed MPSS images and verification during TelAF firmware update.