==========================================
Android userspace (bridge to the firmware)
==========================================

Everything else in this documentation set stops at the Android userspace
boundary: the boot chain, the SoC fabric, the secure world and the DSP/PIL
images are all described up to the point where the Linux kernel hands off to
``init`` and the ``system`` / ``vendor`` partitions take over. This section
deliberately crosses that line, for the userspace layers that are *continuous*
with the below-userspace work and cannot be understood without it — except
the peripheral-hardware slices (e-ink/pen, wireless, sensors, audio), which
each now live next to their own hardware section instead of here:

- the **firmware-blob inventory** — the actual payload files that the
  below-userspace loaders (TZ/PAS, the kernel PIL/``subsys`` framework, the
  in-kernel driver firmware requests) authenticate and load. Below userspace we
  documented the *loaders*; this locates the *bits* they load;
- the **vendor drivers and HALs** — the loadable kernel modules and HAL services
  that bind the SoC blocks in :doc:`/soc/index` to Android, and don't belong to
  a single peripheral domain (audio/wireless/sensors/display each have their
  own ``hal`` page now — see :doc:`/audio/hal`, :doc:`/wireless/hal`,
  :doc:`/sensors/hal`, :doc:`/display/hal`);
- the **security and DRM userspace** — the keystore/keymaster, storage
  encryption, DRM and biometric clients that depend on the secure world in
  :doc:`/trustzone/secure-world`; and
- the **platform userspace** — the Onyx/Boox framework customisation, the
  init/SELinux/A-B boot machinery, and the preinstalled-app / GMS audit, to the
  extent each touches the hardware or the boot chain.

Everything here is static, read out of the extracted partition images
(``artifacts/super/*.img``), the raw firmware-bearing partitions
(``_READONLY/lun4/*.bin``), the decompressed kernel ``Image``
(``artifacts/kernel``) and its ``kernel_config.txt``. No code was executed and
nothing was run on a device. Pure-AOSP internals that are unchanged from stock
Android are described only where they touch the hardware bridge or the boot
chain — this is not a general Android teardown. (On the version split — an
Android-15 system over an Android-11 vendor on a 4.19 kernel — see
:doc:`onyx-platform`.)

.. toctree::
   :maxdepth: 1

   firmware-blobs
   drivers-hals
   security
   onyx-platform
   platform-boot
   app-inventory
   apk-sweep-findings
   oat-native-code
   vendor-diag-tools