========================================= Boot image: kernel, DTB, ramdisk, config ========================================= ``boot_a.bin`` is an Android boot image (``ANDROID!`` header version 2, page size 4096) holding the production kernel, first-stage-init ramdisk, and board device tree for the Note Air5 C. Android boot image structure ============================ Components are page-aligned, after the 1-page header: .. list-table:: :header-rows: 1 :widths: 18 14 42 26 * - Component - Size - Type - SHA256 * - kernel - 60,735,504 - ARM64 Linux ``Image`` (uncompressed, LE, 4K) - ``4e2d5e15…c027b8b1f`` * - ramdisk - 1,146,790 - gzip cpio (first-stage init) - ``d5beb5ab…fab26639`` * - dtb - 407,904 - FDT v17 (one real DTB + 173-byte pad tail) - ``ad8e0ec9…65ee9b17`` * - second - 0 - — - * - recovery_dtbo - 0 - — - Kernel cmdline (from header):: console=ttyMSM0,115200,n8 earlycon=msm_geni_serial,0x888000 androidboot.hardware=qcom androidboot.console=ttyMSM0 androidboot.memcg=1 lpm_levels.sleep_disabled=1 video=vfb:640x400,bpp=32,memsize=3072000 msm_rtb.filter=0x237 service_locator.enable=1 androidboot.usbcontroller=a600000.dwc3 swiotlb=2048 cgroup.memory=nokmem,nosocket loop.max_part=7 buildvariant=user Kernel ====== - Linux 4.19.157, arm64, ``CONFIG_LOCALVERSION="-perf"`` (production/perf build). - Config embedded via ``CONFIG_IKCONFIG`` (``IKCFG_ST`` at ``0x158b820``); full config in ``../artifacts/boot_a/kernel_config.txt`` (6,228 lines). Security-relevant kernel config ------------------------------- =================================== ========== ===================================================== Option Value Meaning =================================== ========== ===================================================== ``CONFIG_MODULES`` y loadable modules enabled ``CONFIG_MODVERSIONS`` y version CRC check only ``CONFIG_MODULE_SIG`` not set kernel modules are not cryptographically signed/verified; any compatible ``.ko`` can be loaded ``CONFIG_DM_VERITY`` y dm-verity available ``CONFIG_DM_VERITY_FEC`` y forward-error-correction ``CONFIG_DM_VERITY_AVB`` not set verity roothash comes from AVB via first-stage init/fstab, not the in-kernel AVB glue ``CONFIG_SECURITY_SELINUX`` y SELinux on ``CONFIG_SECURITY_SELINUX_DEVELOP`` y runtime permissive switch compiled in ``CONFIG_RANDOMIZE_BASE`` y KASLR ``CONFIG_STACKPROTECTOR_STRONG`` y stack canaries ``CONFIG_STRICT_KERNEL_RWX`` y RO/NX kernel mappings ``CONFIG_FORTIFY_SOURCE`` y buffer hardening ``CONFIG_INIT_ON_ALLOC_DEFAULT_ON`` not set heap not zeroed by default ``CONFIG_MAGIC_SYSRQ`` / debug aids present ``CONFIG_KALLSYMS`` y =================================== ========== ===================================================== Userspace-facing hardening is present (KASLR, RWX, canaries, dm-verity+FEC on the read-only partitions), but module signing is off. Combined with the test-key-signed, unfused bootloader chain (:doc:`/boot/secure-boot`), the kernel/module integrity layer is bypassable once the bootloader chain itself is unlocked or re-signed — this specific chain has not been walked end to end by actually loading an unsigned module, but each link (no module signing, re-signable bootloader) is independently confirmed above. Kernel shape and storage crypto ------------------------------- - **Shape:** ``ARM64_VA_BITS=39`` (3-level, 4 KiB pages — ``ARM64_4K_PAGES``/``PAGE_SHIFT=12``), ``NR_CPUS=8`` (matches the DTB's 6+2 cores, :doc:`/boot/base-dtb`), ``HZ=250``, ``PREEMPT=y`` with Qualcomm's WALT scheduler (``SCHED_WALT``), GZIP-compressed image (``KERNEL_GZIP``). - **Command line:** the kernel carries a built-in ``CONFIG_CMDLINE = "cgroup_disable=pressure"`` with ``CMDLINE_EXTEND`` — it is *appended* to the bootloader-supplied ``bootargs`` (:doc:`/boot/base-dtb` ``/chosen``), not a replacement. ``UNMAP_KERNEL_AT_EL0`` (KPTI) is compiled **out**, consistent with the ``kpti=off`` boot argument. - **No CFI generation:** ``CFI_CLANG``, ``SHADOW_CALL_STACK``, ``ARM64_PTR_AUTH`` and ``ARM64_BTI_KERNEL`` are absent/off — this 4.19 ``-perf`` build predates the GKI control-flow-integrity generation; stack canaries (``STACKPROTECTOR_STRONG``) are the backstop. - **Encryption:** File-Based Encryption is on (``FS_ENCRYPTION`` + ``FS_ENCRYPTION_INLINE_CRYPT``) and rides the **UFS Inline Crypto Engine** (``SCSI_UFS_CRYPTO``, the ``ufs_ice`` block in :doc:`/soc/storage`); metadata encryption via ``DM_DEFAULT_KEY``; ``DM_CRYPT`` also built. Platform drivers — the kernel's side of the firmware interfaces --------------------------------------------------------------- The ``-perf`` config binds a kernel driver to nearly every firmware component documented in this set. This is the near (EL1) side of each interface whose far side is a coprocessor or the secure world: .. list-table:: :header-rows: 1 :widths: 40 42 18 * - Kernel driver(s) (``=y`` unless noted) - Firmware / interface on the far side - Doc * - ``QCOM_SCM`` / ``QCOM_SCM_64`` - SMC calls into the **TZ/QSEE EL3** monitor (secure state, fuses, KeyMaster; PSCI is the sibling path) - :doc:`/trustzone/secure-world` * - ``QCOM_RPMH``, ``QCOM_COMMAND_DB``, ``REGULATOR_QCOM_RPMH``, ``MSM_QMP`` - RPMh votes + cmd-db + **QMP mailbox** to the **AOP** - :doc:`/soc/aop` * - ``MSM_PIL``, ``QCOM_MDT_LOADER``, ``MSM_SUBSYSTEM_RESTART``, ``MSM_PIL_SSR_GENERIC`` - PIL load + subsystem-restart of **ADSP / CDSP / modem** into their reserved regions - :doc:`/audio/dsp-firmware` * - ``QSEECOM``, ``HDCP_QSEECOM``, ``QTEE_SHM_BRIDGE`` - QSEE **trustlet** command channel + shared-memory bridge (keymaster, uefisecapp, Widevine) - :doc:`/trustzone/secure-world` * - ``ICNSS``, ``ICNSS_QMI``, ``CNSS_UTILS``, ``CNSS_GENL`` - **WLAN** (Helium) bring-up into ``wlan_fw_region`` - :doc:`/wireless/bluetooth` * - ``QRTR`` (+ ``SMD``/``MHI``), ``QCOM_QMI_HELPERS``, ``QMI_RMNET``/``DFC``/``POWER_COLLAPSE`` - QMI/QRTR IPC router + RMNET data path to modem/DSP (dormant modem) - :doc:`/audio/dsp-firmware` * - ``QCOM_GLINK``, ``QCOM_GLINK_PKT`` - GLINK IPC transport to the coprocessors - :doc:`/trustzone/secure-world` * - ``SPMI``, ``SPMI_MSM_PMIC_ARB``, ``SPMI_PMIC_CLKDIV`` - SPMI bus to the **PMICs** - :doc:`/soc/pmic` * - ``QCOM_SMEM`` - SMEM shared memory (``smem@0x80900000``) - :doc:`/boot/base-dtb` * - ``MSM_BOOT_STATS``, ``QCOM_MEMORY_DUMP_V2`` - the ``boot_stats`` / ``mem_dump_table`` **IMEM** cells + ``mem_dump_region`` - :doc:`/boot/base-dtb` * - ``QCOM_LLCC`` (+ ``LLCC_PMU``/``PERFMON``) - last-level (system) cache controller behind the shared L3 - :doc:`/boot/base-dtb` * - ``SCSI_UFS_QCOM``, ``SCSI_UFS_CRYPTO`` - UFS host controller + inline crypto engine (ICE) - :doc:`/soc/storage` The presence of every one of these drivers is consistent with the firmware inventory reverse-engineered elsewhere in this set: what XBL's PIL loads and what the secure world exposes, the kernel is compiled to drive. Onyx / hardware-specific config ------------------------------- Note Air5 C is a color e-ink device. - E-ink stack (color): ``CONFIG_EXTRA_FIRMWARE`` bundles ``waveform/eink_waveform.wbf``, MXO EPD controller firmware (``mxo/mxo1300_nvcm_*``, ``mxo4300_nvcm_*``), and LFCPNX100 TCON firmware (``lfcpnx/lfcpnx100_tcon_fw_*``). How these fit the DSI→TCON→EPD pipeline (and why the DTB still names an AMOLED panel) is in :doc:`/display/panel`. - Touch/stylus: ``CONFIG_TOUCHSCREEN_ONYX_WACOM`` + ``ONYX_WACOM_FW_UPDATE`` (EMR stylus), ``CONFIG_TOUCHSCREEN_ONYX_PARADE`` / ``CYTTSP5`` (Parade/Cypress capacitive touch), plus a family of ``CONFIG_ONYX_TP_*`` tunables (including ``ONYX_TP_DEBUG_ENABLE=y``). Device tree =========== Decompiled with ``dtc`` to ``../artifacts/boot_a/board.dts``. - SoC identity, CPU topology and the ``memory``/``board-id`` placeholder fields are decoded in :doc:`/boot/base-dtb`; not restated here. - PMICs including ``pm6150l`` (SPMI @ c440000) — AMOLED/OLEDB/AB/IBB regulator nodes present (drives the front-light / display rails). - One real board DTB; the 2nd ``d00dfeed`` at ``0x638b3`` is a 173-byte padding tail, not a usable DTB. Ramdisk (first-stage init) ========================== System-as-root first stage (15 entries): ``init`` (1.5 MB), ``fstab.default``, ``fstab.emmc``, ``e2fsck``, and GSI AVB keys ``avb/{q,r,s}-gsi.avbpubkey`` (allow booting Google GSIs under AVB). fstab ----- ``../artifacts/boot_a/fstab.default``. All dynamic/logical partitions are mounted read-only with AVB: .. list-table:: :header-rows: 1 :widths: 34 12 54 * - Mount - fs - Verify * - system, system_ext, product - ext4 ro - ``avb=vbmeta_system``, logical, first_stage_mount (system also lists ``avb_keys=…gsi.avbpubkey``) * - vendor, odm - ext4 ro - ``avb``, logical, first_stage_mount * - metadata - ext4 - check, formattable * - userdata - f2fs - FBE ``fileencryption=aes-256-xts:aes-256-cts:v2`` + ``metadata_encryption=aes-256-xts`` (wrapped keys), quota, checkpoint * - persist - ext4 - plain * - modem/dsp/bluetooth firmware - vfat/ext4 ro - slotselect, SELinux ``context=`` * - onyxconfig - ext4 - ``defaults`` — Onyx custom partition, no verity The fstab requests AVB/dm-verity on the read-only partitions and full file-based + metadata encryption on userdata: verification is configured in software. Enforcement depends on the bootloader root of trust, which is test-key-signed and unfused (see :doc:`/boot/secure-boot`). XBL display-panel config (reference-base leftover) ================================================== XBL's DisplayDxe carries panel definitions this e-ink device does not use: a ``Visonox Single DSI FHD Plus Video Mode AMOLED Panel (1080x2248 24bpp)`` (``VISONOX_AMOLED_FHD_PLUS_VIDEO``) and a ``VirtioDSI`` (640x480) emulator panel — both in ``../_READONLY/lun1/xbl_a.bin``. The Note Air5 C drives color e-ink via the MXO / LFCPNX100 TCON, with the Lattice FPGA itself as the runtime EPD power/timing controller; the FP9931/MAX17135 EPD PMIC drivers are also present (used by XBL for the boot splash, and relevant to sibling PCB variants) but are not this device's runtime bind path (see the kernel config above, :doc:`/display/panel`, and :doc:`/display/tcon`). The AMOLED/Virtio panel XML is inherited from the SM6350/Motorola reference base and is not the shipping display path. Artifacts ========= In ``../artifacts/boot_a/``: - ``kernel_config.txt`` — full extracted kernel config - ``board.dts`` — decompiled device tree - ``dtb.img`` — raw device-tree blob - ``fstab.default`` — first-stage mount table Provenance ========== :Source: ``../_READONLY/lun4/boot_a.bin`` (read-only), 2026-09-12; extracted artifacts in ``../artifacts/boot_a/``. :Method: Header/component carving via a hand-rolled Python parser of ``boot_img_hdr_v2`` (page-aligned offsets). Config: located ``IKCFG_ST``, ``gunzip`` of the following gzip stream. DTB: ``dtc -I dtb -O dts``. Ramdisk: ``gunzip | cpio -idm``. All values machine-derived from the image bytes. :Cross-refs: :doc:`/boot/secure-boot` (root of trust, test keys), :doc:`/boot/base-dtb` (SoC identity, CPU topology, memory placeholder), :doc:`/abl/container` (SM6350 build-path confirmation), :doc:`/display/panel` (EPD display path), :doc:`/boot/recovery` (shared kernel, recovery ramdisk).