RIL_Init():

If /efs/uart_path exists (not on sample trace, so can probably be ignored):
    echo 0 > /sys/class/sec/uart_switch/UART_SEL/value

If getprop ril.RildInit != 1:
    boot_6160(); (sleep(2) && repeat 5 times if boot fails)

-----------------------------------------------------------------------------

boot_6160():

- Read 'radio' partition from /dev/mtd5ro (read size=0xC00000)
- Prepare PSI from modem image
- ioctl IOCTL_MODEM_RESET (0x6f20); usleep(400000);

xmit_bootloader(/dev/s3c2410_serial3 115200 8N1, psi_info):
    xmit_AT():
        Repeat 20 times:
            write("AT", 2);
            usleep(1000000);
        bootcore_version = read(1); (fail if version != 0xf0)
        info_size = read(1); (trace result: 0x16)

    xmit_PSI():
        write(??, 1);
        write(psi_info.size_byte1, 1);
        write(psi_info.size_byte2, 1);

        [write psi.data, rest of function needs to be reversed]

xmit_images(/dev/modem_ctl):
    xmit_img(modem.img):
        write in chunks of 0xFB000

    xmit_nvdata(/efs/nv_data.bin):
        load_md5_state(/efs/.nv_state):
            If nv_state file does not exist:
                - Backup /efs/nv_data.bin to /efs/.nv_data.bak
                - Backup /efs/nv_data.bin.md5 to /efs/.nv_data.bak.md5
                - Calculate and store MD5 (as shown below)
                - Write ASCII 1 to /efs/.nv_state

            - MD5 info stored in /efs/nv_data.bin.md5 (ASCII MD5 hash)

        check_nv_data_validity():

            check_nv_data_size(/efs/nv_data.bin):
                - Check if file size = 0x200000

            check_md5():
                - Verify MD5 of /efs/nv_data.bin against /efs/nv_data.bin.md5 contents

            If check_md5 failed:
                restore_nv_data():
                    - Restore nv_data backup
                    - On failure, call create_default_nv_data()

        - Open /efs/nv_data.bin or create_default_nv_data() on failure:
            lseek(fd_modem_ctl, 0xD80000, 0)
            write 0x200000 in chunks of 0x100000

- ioctl IOCTL_MODEM_START (0x6f21);