Onyx Boox Note Air5 C (Qualcomm SM6350)

Static analysis of the EDL/Firehose partition dump in ../_READONLY/ (read-only), plus on-device EDL results. Scope is the full boot chain and hardware below Android userspace — PBL/XBL/ABL/TZ/HYP/AOP firmware, device tree, partition layout, PMIC, USB PHY — plus the Android userspace layers that bridge to it (e-ink stack, drivers/HALs, security/DRM, platform scaffolding and app inventory, Android userspace (bridge to the firmware)), since the end goal is general device documentation (bootloader replacement, Linux porting, or any other use), not bootloader work alone. Extracted artifacts live in ../artifacts/.

Reference

• 1. XBL
  • 1.1. Container and segment layout
  • 1.2. Signing envelope
• 2. ABL
  • 2.1. ABL overview, key handling, fastboot
  • 2.2. ABL entry point and top-level orchestration
  • 2.3. Kernel/DTB/ramdisk load and the kernel hand-off
  • 2.4. AVB enforcement code path (LoadImageAndAuth / libavb)
  • 2.5. Fastboot handler internals (FastbootLib)
  • 2.6. ABL function map and upstream-source correlation
• 3. Boot
  • 3.1. Boot chain and exception-level hand-off (PBL → XBL → ABL)
  • 3.2. Secure boot and image signing
  • 3.3. Boot image: kernel, DTB, ramdisk, config
  • 3.4. Recovery ramdisk (recovery environment)
  • 3.5. Physical keys: power, volume, and the boot-mode dispatcher
  • 3.6. Below UEFI — execution state and hardware register surface
  • 3.7. Base kernel device tree (the SoC boot contract)
  • 3.8. USB transport — the DWC3 controller behind every off-device path
  • 3.9. QUP/GENI serial-engine bus map (what is wired where)
  • 3.10. DTBO overlays
• 4. EDL
  • 4.1. EDL / 9008 entry and the deep-flash cable
  • 4.2. EDL / Firehose interface
  • 4.3. Firehose fuse read and secure-boot confirmation
• 5. Partition map and checksums
  • 5.1. Storage and dump summary
  • 5.2. Partition map by LUN
  • 5.3. Duplicate-hash groups (byte-identical images)
  • 5.4. A/B pairs are mostly identical — with exceptions
  • 5.5. Boot-control block (misc) and A/B slot selection
  • 5.6. GPT type / unique / disk GUIDs
  • 5.7. Provenance
• 6. TrustZone
  • 6.1. Secure world and coprocessors (TZ, HYP, trustlets)
  • 6.2. Crypto engine (QCE) and hardware RNG
• 7. SoC platform fabric
  • 7.1. Storage controllers — UFS, ICE, and SDCC
  • 7.2. Pin control — TLMM and the PMIC GPIOs
  • 7.3. Clock tree — GCC, domain CCs, RPMh
  • 7.4. Interconnect — NoC / BCM and the LLCC
  • 7.5. GPU — Adreno A619, the GMU, and the zap shader
  • 7.6. Absent and vestigial hardware (reference-base leftovers)
  • 7.7. PMIC reset timers, charging and reachability
  • 7.8. AOP — the Always-On Processor (RPMh / power back-end)
  • 7.9. IPA — the networking datapath accelerator
  • 7.10. Thermal management (tsens, zones, mitigation)
• 8. Wireless
  • 8.1. Bluetooth / FM controller firmware (WCN3990 “Cherokee”)
  • 8.2. Bluetooth A2DP sink-latency: a two-bug chain in the HAL path (one confirmed, one inferred)
  • 8.3. Wireless drivers and HAL
• 9. Sensors
  • 9.1. Peripheral map (DT overlay)
• 10. Display
  • 10.1. Display pipeline — DSI transport to the color e-ink TCON
  • 10.2. Splash partition
  • 10.3. The e-ink software stack (Onyx EPDC)
  • 10.4. E-ink driver internals (register-level, from the kernel)
  • 10.5. The /dev/ebc interface: ioctls, update modes, and the waveform format
  • 10.6. Wacom EMR pen digitizer driver
  • 10.7. Display drivers and HAL
• 11. Audio
  • 11.1. ADSP and CDSP firmware
  • 11.2. Audio drivers and HAL
• 12. Android userspace (bridge to the firmware)
  • 12.1. Firmware-blob inventory (the payloads)
  • 12.2. Vendor drivers and HALs
  • 12.3. Security and DRM userspace
  • 12.4. The Onyx/Boox platform layer
  • 12.5. Userspace boot — init, SELinux, A/B updates
  • 12.6. Preinstalled apps (Boox, GMS, AOSP)
  • 12.7. APK sweep: bulk decompile of the remaining 123 system/product apps
  • 12.8. OAT containers: what’s actually AOT-compiled to native code, and where
  • 12.9. Vendor diagnostic, factory-test and provisioning tools in bin/xbin
• 13. Open questions and limits of analysis
  • 13.1. Open questions
  • 13.2. Resolved by targeted reverse-engineering
  • 13.3. Low-level components examined
  • 13.4. Boot-chain firmware versions
  • 13.5. Static end of the hardware-silicon ropes
  • 13.6. Requires a live device or bench — summary
• 14. Mainline Linux port readiness — per-subsystem status
  • 14.1. Method
  • 14.2. Per-subsystem status
  • 14.3. Live confirmation attempted
  • 14.4. What this page still doesn’t cover

Device at a glance

SoC:

Qualcomm SM6350 / Snapdragon 690 5G; codename lagoon; platform “Bitra” — the SM6350 platform/CDT board family (BITRALAZ, BitraPkgLAA, BITRA-1).

PMICs:

pm6350 + pm6150l + pm7250b (charger, smb5, Type-C). EPD PMICs FP9931 / MAX17135.

Kernel:

Linux 4.19.157 arm64 (-perf); Android 11 (release-keys).

Build provenance:

build owner wfy; tree sm6350_androidT_rom (an “androidT” firmware base even though the shipped OS is Android 11 per vbmeta — the firmware/modem base is newer); modem/boot line BOOT.XF.3.3; platform BitraLAA/BitraPkgLAA; XBL DXE = RELEASE, ABL = DEBUG.

Security posture:

bootloader LOCKED (is_unlocked=0), AVB on — but the boot chain is test-key-signed and secure boot is not fused, so it is bypassable in practice (the re-signing acceptance behind this has been confirmed on-device; flashing a patched ABL specifically has not); module signing off. PBL enforces image integrity (SHA-384) but not authenticity (see Secure boot and image signing, Firehose fuse read and secure-boot confirmation).

Buttons:

Power (KPDPWR) + Volume-Down (RESIN) only. Recovery = power-off → hold Power to LED → release → hold ~3–8 s → release → tap Power ×5.

Storage:

UFS, SK Hynix H9HQ15AECMBDAR (mfr 0x1AD, fw 043), 6 LUNs, 4096-byte blocks.

Identity:

Sahara HWID 0x0013f0e100000000 (MSM_ID 0x0013f0e1, OEM_ID 0x0000, MODEL_ID 0x0000), CPU bitra_SDM (chip serial redacted — unique per unit). Active slot = a. See EDL / Firehose interface.

EDL tooling:

the stock lenovo_motorola Firehose loader reads and writes but implements no <peek> (raw-memory read); a separate peek-capable loader was used for live memory reads (Open questions and limits of analysis, OQ2/OQ8). QFPROM/SPMI remain XPU-limited in hardware regardless of loader (EDL / Firehose interface).

Firmware version inventory

From QC_IMAGE_VERSION_STRING:

Image	Version	Notes
xbl_a	BOOT.XF.3.3-00340-BITRALAZ-1	IMAGE_VARIANT BitraPkgLAA, OEM wfy
aop_a	AOP.HO.2.0-00069	Always-On Processor
tz_a	TZ.XF.5.10-00304-1	variant SAJAANAAA
hyp_a	TZ.XF.5.10-00304-1	bundled with TZ
modem_a	ADSP.VT.5.6-00702.1 + MPSS.HI.2.5.1-01197 + CDSP.VT.2.6 + NPU.FW.2.3	multi-subsystem non-HLOS bundle; each sub-image is separately header-tagged (variants bitra.{adsp,gennm,cdsp,npu}). MPSS baseband present but dormant. See ADSP and CDSP firmware
core_nhlos_a	MPSS.HI.2.5.1-01188 + WLAN.HL.3.3.1-01884	second non-HLOS pack; carries the Wi-Fi radio firmware (bitra.gen.prodQ)
abl / keymaster / uefisecapp / dsp / devcfg / qupfw	(no top-level version string)	MBN-wrapped; abl = DEBUG_CLANG35 build

Unresolved items

Everything the static, single-dump analysis cannot answer — and what access would resolve each — is collected in Open questions and limits of analysis. The low-level analysis is otherwise complete: every partition below Android userspace has been opened or accounted for.