Hi Rob,
I've submitted PR #28 with the HTT protocol docs, FTM/UTF API documentation,
and the ath11k corrections we discussed last month:
https://codeberg.org/rsavoye/librephone/pulls/28It covers:
- docs/htt.md — full H2T/T2H message tables, handshake sequence, T2H dispatch
- docs/ftm.md — FTM/UTF testing API over WMI (ioctl + nl80211)
- docs/ath11k_corrections.md — fake-PCI/SNOC, missing HTT layer, CE clarification
I also built some analysis tools in Python (htt message lookup, MBN/MDT parser,
dependency tracer between WPSS blobs) that I can contribute once they're cleaned up.
**Next step — wpss.b12 analysis:**
I'd like to dig into wpss.b12 to verify the X.509 certificate chain
(Root CA, SCM call IDs, replaceability) you mentioned. But as we both figured
out, the OTA doesn't contain wlanmdsp.mbn — it lives in /data/vendor/firmware/
and gets excluded from OTAs.
Could you share the wlanmdsp.mbn (or the wpss.bNN segments) you've already
extracted from your FP6? I don't have an FP6 myself to do the adb pull.
If that's not possible, I'll work on the HIF layer documentation in the
meantime (SNOC/fake-PCI as you described) and keep building tools.
Thanks for reviewing the PR when you get a chance!
Best,
Gustavo