4.2. EDL / Firehose interface¶

The device exposes the Qualcomm Emergency Download (EDL) interface: PBL/Sahara on USB 05c6:9008, into which a Firehose programmer is uploaded to operate on UFS storage and memory.

4.2.1. Prerequisites¶

Entry: adb reboot edl (kernel writes the IMEM download cookie) or a deep-flash cable driving D+→GND at power-on. See EDL / 9008 entry and the deep-flash cable.
Host tooling: bkerler edl V3.62 (tested working against this device; not independently verified against other units or firmware).
Programmer: A Firehose loader whose Sahara segment load addresses fall in this SoC’s reserved window (0x807x). The stock lenovo_motorola …[REDACTED]… fhprg.bin satisfies this; a foreign loader built for a different DDR base is rejected at Sahara (NAK 0x12). See Firehose fuse read and secure-boot confirmation for load-address validation.
Exit: edl reset.

4.2.2. Device identity¶

Reported by the Sahara handshake (pre-Firehose) and the running loader:

Field	Value
Sahara protocol	v2 (device); host supports v1
HWID	`0x0013f0e100000000` (encodes MSM_ID below; a chip-family ID, not unique per unit)
MSM_ID	`0x0013f0e1` (SM6350 “Bitra” chip-family ID, shared by every unit of this SoC)
OEM_ID	`0x0000` (un-fused)
MODEL_ID	`0x0000`
CPU	`bitra_SDM` (platform Bitra / SM6350)
Chip serial	(redacted — unique per physical unit)
OEM_PK_HASH	`[REDACTED]` (48 bytes / SHA-384 — redacted, see note below)

OEM_ID = 0x0000 corroborates an un-fused / non-secure-boot unit; see Secure boot and image signing.

4.2.3. `OEM_PK_HASH` — source and value¶

Source: Sahara CMD_EXEC sub-command 0x03 (the OemPkHash command), read by the PBL before any Firehose loader is uploaded. Not a QFPROM MMIO peek.

Value (48 bytes / SHA-384, read 2026-09-14): [REDACTED] — withheld here out of caution, since its origin is not established (see below) and publishing it could still turn out to help identify this specific unit.

Not all-zero. SEC_BOOT unfused means the PBL never checks this register at boot, but the register itself holds this value; origin unknown (OEM_ID/MODEL_ID are both 0x0000, so not OEM-provisioned).

Cross-check attempted: a raw QFPROM peek at 0x780000 returns USBError(5, Input/Output Error) — an XPU-protected window (see Firehose fuse read and secure-boot confirmation). The peek was issued with the project’s read-only loader (tools/roloader).

4.2.4. Storage¶

From getstorageinfo:

Field	Value
Type	UFS
Part	`H9HQ15AECMBDAR` (SK Hynix)
Manufacturer ID	`0x1AD` (JEDEC: SK Hynix)
FW version	`043`
UFS serial	(redacted — unique per physical unit)
Physical LUNs	6
Block / page size	4096 B / 4096 B
LUN total blocks	`14602240` (×4096 ≈ 59.8 GB)

Geometry matches Partition map and checksums.

4.2.5. Slot and partition state¶

Active slot: a (xbl_a Active, xbl_b inactive; all LUN4 _a partitions Active). Bootloader-patch experiments target the inactive b slot.
Live GPT (all 6 LUNs) is byte-identical to the partition dump — no drift.

4.2.6. Capabilities — achievable¶

The stock loader advertises 17 functions and reports build date 2020-08-21:

program  read     nop       patch      configure  setbootablestoragedrive
erase    power    firmwarewrite         getstorageinfo  benchmark
emmc     ufs      fixgpt    getsha256digest  getvar   dump

Read / verify (proven on all 6 LUNs at ~33 MB/s):

read / dump — full partition and raw-sector reads.
getsha256digest — on-device SHA-256 of a region.
getstorageinfo / getvar — geometry and variables.

Raw-memory read (peek) is not implemented by the stock loader on this unit (Firehose fuse read and secure-boot confirmation). Where a peek-capable programmer is used instead, <peek> addresses the low 4 GB only (get_attr is 32-bit).

4.2.7. Limitations — blocked¶

By hardware (even with a working peek)

QFPROM / SECURITY_CONTROL window 0x780000 — XPU-protected; reads may fault or return 0x00/0xFF.
PMIC over SPMI 0xc40a000 — arbiter-gated; a peek may hang the bus.

Consequently the fuse/PMIC reads behind open questions OQ4/OQ5 remain uncertain. OEM_PK_HASH itself is read (Sahara CMD_EXEC, see above, OQ6) — this line covers everything else in that window.

4.2.8. Provenance¶

Source:: on-device EDL session, 2026-09-12; bkerler edl V3.62 with the lenovo_motorola … fhprg.bin loader over UFS.
Cross-refs:: Partition map and checksums (geometry), Secure boot and image signing (OEM_ID), EDL / 9008 entry and the deep-flash cable (entry), Firehose fuse read and secure-boot confirmation (hash gate, load-address validation, peek).