=======================================
Onyx Boox Note Air5 C (Qualcomm SM6350)
=======================================

Static analysis of the EDL/Firehose partition dump in ``../_READONLY/``
(read-only), plus on-device EDL results. Scope is the full boot chain and
hardware below Android userspace — PBL/XBL/ABL/TZ/HYP/AOP firmware, device
tree, partition layout, PMIC, USB PHY — **plus** the Android userspace layers
that bridge to it (e-ink stack, drivers/HALs, security/DRM, platform
scaffolding and app inventory, :doc:`userspace/index`), since the end goal is
general device documentation (bootloader replacement, Linux porting, or any
other use), not bootloader work alone. Extracted artifacts live in
``../artifacts/``.

.. toctree::
   :maxdepth: 2
   :numbered:
   :caption: Reference

   xbl/index
   abl/index
   boot/index
   edl/index
   partition-map
   trustzone/index
   soc/index
   wireless/index
   sensors/index
   display/index
   audio/index
   userspace/index
   open-questions
   linux-port-status

Device at a glance
==================

:SoC: Qualcomm SM6350 / Snapdragon 690 5G; codename ``lagoon``; platform
   "Bitra" — the SM6350 platform/CDT board family (``BITRALAZ``,
   ``BitraPkgLAA``, ``BITRA-1``).
:PMICs: pm6350 + pm6150l + pm7250b (charger, smb5, Type-C). EPD PMICs
   FP9931 / MAX17135.
:Kernel: Linux 4.19.157 arm64 (``-perf``); Android 11 (release-keys).
:Build provenance: build owner ``wfy``; tree ``sm6350_androidT_rom`` (an
   "androidT" firmware base even though the shipped OS is Android 11 per
   vbmeta — the firmware/modem base is newer); modem/boot line
   ``BOOT.XF.3.3``; platform ``BitraLAA``/``BitraPkgLAA``; XBL DXE =
   RELEASE, ABL = DEBUG.
:Security posture: bootloader LOCKED (``is_unlocked=0``), AVB on — but the boot
   chain is test-key-signed and secure boot is not fused, so it is bypassable
   in practice (the re-signing acceptance behind this has been confirmed
   on-device; flashing a patched ABL specifically has not); module signing
   off. PBL enforces image integrity (SHA-384) but not authenticity (see
   :doc:`/boot/secure-boot`, :doc:`/edl/firehose`).
:Buttons: Power (KPDPWR) + Volume-Down (RESIN) only. Recovery = power-off →
   hold Power to LED → release → hold ~3–8 s → release → tap Power ×5.
:Storage: UFS, SK Hynix ``H9HQ15AECMBDAR`` (mfr ``0x1AD``, fw ``043``), 6 LUNs,
   4096-byte blocks.
:Identity: Sahara HWID ``0x0013f0e100000000`` (MSM_ID ``0x0013f0e1``,
   OEM_ID ``0x0000``, MODEL_ID ``0x0000``), CPU ``bitra_SDM`` (chip serial
   redacted — unique per unit). Active slot = ``a``. See :doc:`/edl/interface`.
:EDL tooling: the stock ``lenovo_motorola`` Firehose loader reads and writes but
   implements no ``<peek>`` (raw-memory read); a separate peek-capable loader
   was used for live memory reads (:doc:`/open-questions`, OQ2/OQ8).
   QFPROM/SPMI remain XPU-limited in hardware regardless of loader
   (:doc:`/edl/interface`).

Firmware version inventory
===========================

From ``QC_IMAGE_VERSION_STRING``:

.. list-table::
   :header-rows: 1

   * - Image
     - Version
     - Notes
   * - xbl_a
     - ``BOOT.XF.3.3-00340-BITRALAZ-1``
     - IMAGE_VARIANT ``BitraPkgLAA``, OEM ``wfy``
   * - aop_a
     - ``AOP.HO.2.0-00069``
     - Always-On Processor
   * - tz_a
     - ``TZ.XF.5.10-00304-1``
     - variant ``SAJAANAAA``
   * - hyp_a
     - ``TZ.XF.5.10-00304-1``
     - bundled with TZ
   * - modem_a
     - ``ADSP.VT.5.6-00702.1`` + ``MPSS.HI.2.5.1-01197`` + ``CDSP.VT.2.6`` +
       ``NPU.FW.2.3``
     - multi-subsystem non-HLOS bundle; each sub-image is separately
       header-tagged (variants ``bitra.{adsp,gennm,cdsp,npu}``). MPSS
       baseband present but dormant. See :doc:`/audio/dsp-firmware`
   * - core_nhlos_a
     - ``MPSS.HI.2.5.1-01188`` + ``WLAN.HL.3.3.1-01884``
     - second non-HLOS pack; carries the Wi-Fi radio firmware
       (``bitra.gen.prodQ``)
   * - abl / keymaster / uefisecapp / dsp / devcfg / qupfw
     - (no top-level version string)
     - MBN-wrapped; abl = DEBUG_CLANG35 build

Unresolved items
================

Everything the static, single-dump analysis cannot answer — and what access
would resolve each — is collected in :doc:`/open-questions`. The low-level
analysis is otherwise complete: every partition below Android userspace has been
opened or accounted for.