========================
EDL / Firehose interface
========================

The device exposes the Qualcomm Emergency Download (EDL) interface: PBL/Sahara
on USB ``05c6:9008``, into which a Firehose *programmer* is uploaded to operate
on UFS storage and memory.

Prerequisites
=============

Entry
   ``adb reboot edl`` (kernel writes the IMEM download cookie) or a deep-flash
   cable driving D+→GND at power-on. See :doc:`entry`.

Host tooling
   bkerler ``edl`` V3.62 (tested working against this device; not
   independently verified against other units or firmware).

Programmer
   A Firehose loader whose Sahara segment load addresses fall in this SoC's
   reserved window (``0x807x``). The stock ``lenovo_motorola
   …[REDACTED]… fhprg.bin`` satisfies this; a foreign loader built for a
   different DDR base is rejected at Sahara (``NAK 0x12``). See
   :doc:`firehose` for load-address validation.

Exit
   ``edl reset``.

Device identity
===============

Reported by the Sahara handshake (pre-Firehose) and the running loader:

===================  =========================================================
Field                Value
===================  =========================================================
Sahara protocol      v2 (device); host supports v1
HWID                 ``0x0013f0e100000000`` (encodes MSM_ID below; a
                     chip-family ID, not unique per unit)
MSM_ID               ``0x0013f0e1`` (SM6350 "Bitra" chip-family ID, shared
                     by every unit of this SoC)
OEM_ID               ``0x0000`` (un-fused)
MODEL_ID             ``0x0000``
CPU                  ``bitra_SDM`` (platform Bitra / SM6350)
Chip serial          *(redacted — unique per physical unit)*
OEM_PK_HASH          ``[REDACTED]`` (48 bytes / SHA-384 — redacted, see
                     note below)
===================  =========================================================

``OEM_ID = 0x0000`` corroborates an un-fused / non-secure-boot unit; see
:doc:`/boot/secure-boot`.

``OEM_PK_HASH`` — source and value
====================================

Source: Sahara ``CMD_EXEC`` sub-command ``0x03`` (the ``OemPkHash`` command),
read by the PBL before any Firehose loader is uploaded. Not a QFPROM MMIO peek.

Value (48 bytes / SHA-384, read 2026-09-14): ``[REDACTED]`` — withheld here
out of caution, since its origin is not established (see below) and
publishing it could still turn out to help identify this specific unit.

Not all-zero. ``SEC_BOOT`` unfused means the PBL never checks this register
at boot, but the register itself holds this value; origin unknown
(OEM_ID/MODEL_ID are both ``0x0000``, so not OEM-provisioned).

Cross-check attempted: a raw QFPROM ``peek`` at ``0x780000`` returns
``USBError(5, Input/Output Error)`` — an XPU-protected window (see
:doc:`firehose`). The peek was issued with the project's read-only loader
(``tools/roloader``).

Storage
=======

From ``getstorageinfo``:

==================  ==========================================================
Field               Value
==================  ==========================================================
Type                UFS
Part                ``H9HQ15AECMBDAR`` (SK Hynix)
Manufacturer ID     ``0x1AD`` (JEDEC: SK Hynix)
FW version          ``043``
UFS serial          *(redacted — unique per physical unit)*
Physical LUNs       6
Block / page size   4096 B / 4096 B
LUN total blocks    ``14602240`` (×4096 ≈ 59.8 GB)
==================  ==========================================================

Geometry matches :doc:`/partition-map`.

Slot and partition state
========================

- Active slot: **a** (``xbl_a`` Active, ``xbl_b`` inactive; all LUN4 ``_a``
  partitions Active). Bootloader-patch experiments target the inactive **b**
  slot.
- Live GPT (all 6 LUNs) is byte-identical to the partition dump — no drift.

Capabilities — achievable
=========================

The stock loader advertises 17 functions and reports build date 2020-08-21::

   program  read     nop       patch      configure  setbootablestoragedrive
   erase    power    firmwarewrite         getstorageinfo  benchmark
   emmc     ufs      fixgpt    getsha256digest  getvar   dump

Read / verify (proven on all 6 LUNs at ~33 MB/s):

- ``read`` / ``dump`` — full partition and raw-sector reads.
- ``getsha256digest`` — on-device SHA-256 of a region.
- ``getstorageinfo`` / ``getvar`` — geometry and variables.

Raw-memory read (``peek``) is not implemented by the stock loader on this
unit (:doc:`firehose`). Where a peek-capable programmer is used instead,
``<peek>`` addresses the low 4 GB only (``get_attr`` is 32-bit).

Limitations — blocked
=====================

By hardware (even with a working ``peek``)
   - QFPROM / SECURITY_CONTROL window ``0x780000`` — XPU-protected; reads may
     fault or return ``0x00``/``0xFF``.
   - PMIC over SPMI ``0xc40a000`` — arbiter-gated; a peek may hang the bus.

   Consequently the fuse/PMIC reads behind open questions OQ4/OQ5 remain
   uncertain. ``OEM_PK_HASH`` itself is read (Sahara ``CMD_EXEC``, see above,
   OQ6) — this line covers everything else in that window.

Provenance
==========

:Source: on-device EDL session, 2026-09-12; bkerler ``edl`` V3.62 with the
   ``lenovo_motorola … fhprg.bin`` loader over UFS.
:Cross-refs: :doc:`/partition-map` (geometry),
   :doc:`/boot/secure-boot` (OEM_ID), :doc:`entry`
   (entry), :doc:`firehose` (hash gate, load-address
   validation, peek).