10.1. Display pipeline — DSI transport to the color e-ink TCON¶

The Note Air5 C is a color e-ink device, but the firmware describes a Qualcomm DSI/AMOLED display stack: the standard SM6350 SDE/DPU + DSI pipeline is present and used — but only as the pixel transport into an Onyx e-ink TCON (timing controller), which drives the actual EPD panel. The AMOLED panel names are reference-design vestiges; the panel timings are e-ink. This consolidates facts that were split across Boot image: kernel, DTB, ramdisk, config (kernel e-ink firmware), DTBO overlays (per-PCB TCON id) and Splash partition, and adds the device-tree evidence (including the EPD PMICs below).

10.1.1. The stock DSI/DPU pipeline (base DTB)¶

artifacts/boot_a/board.dts carries the full, unmodified SM6350 MDSS display subsystem:

DPU/SDE — qcom,sde-kms (qcom,mdss_mdp), mdp_phys ``0xae00000`` (+ VBIF 0xaeb0000, RegDMA 0xaeac000, SID 0xae8f000, SW-fuse 0xaf50000), display IRQ 0x53, two mixers, primary display preference.
DSI — qcom,dsi-ctrl-hw-v2.4 “dsi-ctrl-0” ``0xae94000``; qcom,dsi-phy-v3.0 “dsi-phy-0” ``0xae94400``; qcom,mdss_dsi_pll_10nm at 0xae94a00; a qcom,mdss_dp_pll_10nm (DisplayPort PLL) is also present.

A whole-file scan finds no EPD/EBC/e-ink display-controller compatible in the base DTB — only this DSI/DPU path. (Apparent “ebc” hits are the clock literal 0xbEBC200 = 200 MHz, not a controller.) So at the SoC level the only display output described is DSI; the e-ink specifics live one layer out.

10.1.2. The panel node: AMOLED name, e-ink reality¶

The overlay (DTBO overlays) attaches the panel. The node is named for a Visionox AMOLED part but is overridden for e-ink:

name qcom,mdss_dsi_rm69299_visionox_amoled_video / -panel-name = "rm69299 amoled fhd+ video mode dsi visionox panel" — a reference-design AMOLED identifier;
but it declares ``onyx,tcon-mode-support`` — the Onyx property that puts the DSI link into TCON mode (the DSI feeds a timing controller, not a panel);
and its timing is ``2480 × 1860`` (panel-width = 0x9b0, panel-height = 0x744) at 38 Hz (framerate = 0x26), h-porches 40/40 (0x28), physical 207 × 155 mm (0xcf × 0x9b), RGB888 (bpp = 0x18). That is a ~10.3-inch, ~300-dpi e-ink panel geometry — not the ~1080-wide AMOLED “fhd+” the name implies;
and its DSI on/off commands are trivial — only DCS 0x11 (sleep-out) / 0x10 (sleep-in) (on-command = [05 01 00 00 ff 00 02 11 00], off-command = […10 00]). A real AMOLED panel would typically need a long init sequence here; a lone sleep-out is consistent instead with a TCON front-end, where the FPGA — not the DSI link — initialises the actual panel, matching onyx,tcon-mode-support above. (The long DSI init blobs elsewhere in the overlay belong to the unused reference AMOLED nodes.)

So the DSI output is genuinely used, but its endpoint is the e-ink TCON, which converts the DSI pixel stream into EPD source/gate drive. The overlay carries several such reference DSI panel definitions (rm69299 video and command mode, r66451 AMOLED with DSC), all in TCON mode; the per-PCB variant is selected by board id (DTBO overlays).

10.1.3. E-ink firmware (compiled into the kernel)¶

The e-ink-specific firmware is baked into the kernel image via CONFIG_EXTRA_FIRMWARE (so it ships inside boot_a, not as its own partition — Boot image: kernel, DTB, ramdisk, config):

Firmware blob(s)	Role
`waveform/eink_waveform.wbf`	the EPD waveform table — the per-temperature voltage/timing sequences that drive grayscale/color pixel transitions
`mxo/mxo1300_nvcm_{81,82,83,84,86,87}.ied` (85 absent from the bundle), `mxo/mxo4300_nvcm_{81,82}.ied`	MXO EPD source-driver / controller NVCM (non-volatile config) images — several panel/stepping variants
`lfcpnx/lfcpnx100_tcon_fw_{99,9e,9f,a2,a5,a7}.bin`	LFCPNX100 TCON firmware — the FPGA bitstream for the timing controller (a Lattice ECP5-UM / LFE5UM-85F), several variants; this PCB’s DT (DTBO overlays `overlay_0.dts`) carries two fragments targeting the same TCON node — an earlier one (`fragment@69`) sets `fw-product-id = 0x9e`, but a later one (`fragment@80`) overrides it to `0xa7`. Under DT-overlay apply semantics the later fragment wins, so the effective value is `0xa7`, selecting `…_a7.bin`, not `…_9e.bin`. The FPGA loads it over bit-banged SPI; the driver-side protocol is in E-ink driver internals (register-level, from the kernel).

Multiple variants of each are bundled so one kernel serves the PCB revisions; the running TCON/EPD-controller id selects the match (the same pattern as the Bluetooth patch set, Bluetooth / FM controller firmware (WCN3990 “Cherokee”)).

10.1.4. EPD power (XBL)¶

EPD panels need specialized high-voltage rails (±15 V gate/source, VCOM). Those are sequenced in XBL DXE by the e-ink PMICs, not by the SoC PMIC RPMh rails: fp9931_power_on / max17135_power_on (FP9931, MAX17135 EPD PMICs), gvdd/gvee power-up/down and gpio_pmic_pwrgood (found directly in the XBL DXE strings). XBL brings EPD power up for the boot splash (Splash partition) and hands a live panel to the kernel.

10.1.5. Reference-design vestiges vs. what is real¶

Reference-design item vs. actual status:

Item	Status	Note
SDE/DPU + DSI ctrl/phy (base DTB)	real / used	the pixel transport into the TCON
`rm69299` / `r66451` AMOLED panel names	vestigial	reference-design identifiers; timings are overridden to e-ink 2480×1860
`qcom,mdss_dp_pll` (DisplayPort)	unused	stock SM6350 asset; no DP connector
XBL AMOLED splash path	partly vestigial	the AMOLED panel references are leftovers; EPD power/splash is real (Splash partition)
TCON fw / EPD waveform / MXO NVCM / FP9931 / MAX17135	real / e-ink	the actual color e-ink pipeline

This is the same reference-design-carried-unchanged pattern as the mmWave/5G RF-card assets (unpopulated configuration for absent boards, not to be confused with the separately-dormant MPSS baseband) in ADSP and CDSP firmware.

10.1.6. Provenance¶

Source:: artifacts/boot_a/board.dts (SDE/DSI nodes, addresses), artifacts/dtbo_a/overlay_0.dts (panel node: onyx,tcon-mode-support, 2480×1860 timing, physical size), artifacts/boot_a/kernel_config.txt (CONFIG_EXTRA_FIRMWARE e-ink blob list), and the XBL DXE EPD-PMIC strings found directly in xbl_a.bin.
Method:: DTB/overlay node reading and a whole-file EPD/EBC controller scan (negative); firmware-name extraction from the kernel config. No code executed.
Cross-refs:: Boot image: kernel, DTB, ramdisk, config (kernel EXTRA_FIRMWARE, onyx input), DTBO overlays (per-PCB TCON product-id, panel selection), Splash partition (boot splash on the EPD panel), E-ink driver internals (register-level, from the kernel) (the kernel-side FPGA-TCON / EPDC / EPD-PMIC register-level drivers), ADSP and CDSP firmware (reference-base RF leftovers, same pattern).