Session 21 — 2026-03-27d

EBC Ioctl Numbers — Confirmed via Ghidra

Update struct (40 bytes, passed to 0x700c)

struct onyx_epdc_update {
    int32_t y;             // offset 0
    int32_t x;             // offset 4
    int32_t width;         // offset 8
    int32_t height;        // offset 12
    int32_t waveform_mode; // offset 16: 1=DU, 2=GC16, 0xff=auto
    int32_t update_mode;   // offset 20: from mode >> 5
    int32_t marker;        // offset 24: sequence counter
    int32_t dither;        // offset 28: 0x28 or 0x1000
    uint32_t flags;        // offset 32: 0x20000 (stock)
    int32_t reserved;      // offset 36: 0
};

Stock code never calls FBIOPUT_VSCREENINFO or FBIOPAN_DISPLAY. Flow: syncDataToExtendedBuffer (row-by-row copy to ebc mmap, pixel_stride=7488 not row_bytes=7552) → refreshScreen (ioctl 0x700c).

TWRP v1.7–v2.5 Iterations

Kernel log: SET_EBC_SEND_UPDATE -- magic[N] [x=0 y=0 w=1872 h=1404]! flags=0x20000! — the ioctl entry point runs and logs parameters, but no pixels reach the panel. Problem is below the ioctl dispatch — in MDSS pipeline state, onyx_epdc_put_image, or _epdc_update_wb_direct.

Build System Learnings

• Added device/onyx/noteair1/src-overlay/ mechanism — files copied over TWRP source before build; updated tools/twrp-build accordingly
• RECOVERY_GRAPHICS_FORCE_SINGLE_BUFFER flag unreliable with Soong cache — hardcode in source overlay instead
• Must delete stale libminuitwrp.so in recovery ramdisk staging and *relink* files before each build

Conclusion

Trial-and-error ioctl parameter tuning is exhausted. Strace of the stock recovery binary is the definitive next step to find what initialization step we are missing.

Session 20 — 2026-03-27c

Root Cause: Missing libresetprop.so

Running recovery binary manually revealed the real crash cause — not the /dev/fb0 path:

CANNOT LINK EXECUTABLE: library "libresetprop.so" not found

libresetprop.so (from Magisk’s resetprop, built by external/magisk-prebuilt) was compiled to the system image output directory but never copied into the recovery ramdisk. The dynamic linker failed instantly — before any graphics init, before any log creation — explaining why /tmp/recovery.log never appeared in v1.0–v1.5.

Fix: Copy the built library to device/onyx/noteair1/recovery/root/system/lib64/libresetprop.so. Files in that directory are merged directly into the recovery ramdisk. PRODUCT_PACKAGES does NOT work for recovery ramdisk inclusion — that targets the system image.

TWRP v1.6 — First Stable Recovery

E-ink Display Architecture

Two display paths exist:

1. /dev/graphics/fb0 — standard Linux framebuffer. TWRP writes pixels here. Pipeline is initialised (MDSS DSI → TC358762 → EPDC → MAX17135), but EPDC update completion never fires. Recovery hangs in onyx_epdc_wait_all_update_compelete.
2. /dev/ebc (char 10,35) — Onyx-proprietary EPDC control device. Stock recovery uses this exclusively via librecovery_ui.so‘s FBDev class. This is the reliable path.

Stock librecovery_ui.so — Key Symbols

Next Steps

1. Try quick sysfs unblock: write to /sys/devices/sepdc/submit_upd_work or toggle update_disable from ADB shell
2. If that fails: Ghidra on librecovery_ui.so to extract /dev/ebc ioctl numbers from FBDev::refreshScreen
3. Patch TWRP minui (graphics_fbdev.cpp) to open /dev/ebc and issue refresh ioctl