=============
DTBO overlays
=============

``dtbo_a.bin`` is an Android DTBO image holding three device-tree overlays,
one per PCB revision (v10/v20/v30) of the Note Air5 C; how ABL selects one
and what actually differs between them is under "Container" and "Difference
between the three revisions" below.

Container
=========

Android DTBO image (magic ``0xd7b7ab1e``), header v0, page 4096, total
1,529,557 B (partition is 24 MB; the remainder is zero pad). 3 overlay
entries, each ~510 KB, all ``id=0 rev=0 custom=0``:

.. list-table::
   :header-rows: 1

   * - Entry
     - File offset
     - Size
     - Decompiled
     - ``model``
     - ``onyx,pcbver-id``
   * - 0
     - ``0x80``
     - 509,847
     - ``overlay_0.dts`` (6888 ln)
     - Lagoon MTP NoteAir5C v30
     - ``0x02``
   * - 1
     - ``0x7c817``
     - 509,735
     - ``overlay_1.dts`` (6877 ln)
     - Lagoon MTP NoteAir5C v10
     - ``0x00``
   * - 2
     - ``0xf8f3e``
     - 509,847
     - ``overlay_2.dts`` (6888 ln)
     - Lagoon MTP NoteAir5C v20
     - ``0x01``

All three: ``compatible = "qcom,lagoon-mtp","qcom,lagoon","qcom,mtp"``,
``qcom,msm-id=<0x1b2 0x10000 0x1cb 0x10000>`` (SoC 434/459),
``qcom,board-id=<0x08 0x00>``. Each is a full board description (109/108/109
fragments, 51 distinct ``compatible``\ s), not a small patch — ABL picks one
whose board-id/pcbver matches the running PCB and applies it over the base SoC
DTB (``../artifacts/boot_a/board.dts``). Fragment targets are unresolved
symbolic placeholders (``target = <0xffffffff>``, fixed up at apply-time via
``__symbols__``/``__fixups__``), so a raw ``board.dts`` diff is not meaningful
— the overlays are the board tree.

Difference between the three revisions
======================================

The v10/v20/v30 blobs are near-identical clones. Stripping phandle noise, the
entire substantive delta is the PCB-version tag and the e-ink TCON firmware
product-id:

.. list-table::
   :header-rows: 1

   * -
     - v10 (pcbver 0)
     - v20 (pcbver 1)
     - v30 (pcbver 2)
   * - ``onyx,lfcpnx@0 fw-product-id``
     - ``0x9e``
     - ``0x9e`` + ``0xa5``
     - ``0x9e`` + ``0xa7``

- ``onyx,lfcpnx@0`` = the LFCPNX100 e-ink TCON (timing controller),
  SPI-attached (``spi-cs-gpios``, ``spi-gpios``, ``status="okay"``).
  ``fw-product-id`` selects which TCON firmware blob the kernel loads (matches
  the ``lfcpnx/lfcpnx100_tcon_fw_*`` bundle in the kernel config,
  :doc:`/boot/boot-image`).
- v20/v30 add a second ``lfcpnx@0`` fragment carrying a newer product-id
  (``0xa5``/``0xa7``) alongside the base ``0x9e`` — later PCB revisions ship a
  revised e-ink panel/TCON firmware variant. No panel-technology change, no
  SoC change, no memory-map change between revisions — this TCON firmware id
  is the overlay set's reason to exist.

Onyx-specific hardware the overlays wire up
===========================================

Distinct ``onyx,*`` compatibles (identical across all three revisions):

.. list-table::
   :header-rows: 1

   * - Node
     - Hardware
   * - ``onyx,lfcpnx``
     - color e-ink TCON (LFCPNX100), SPI
   * - ``onyx,lfe5u_i2c``
     - Lattice ECP5 (LFE5U) FPGA bridge over I²C (e-ink pipeline glue)
   * - ``onyx,wacom_i2c``
     - Wacom EMR stylus digitizer (I²C)
   * - ``onyx,backlight`` + ``onyx,lm3630a_v3``
     - front-light (TI LM3630A dual LED driver — warm/cold)
   * - ``onyx,kb-serial`` + ``onyx,keyboard-ultra2``
     - detachable magnetic keyboard (serial)
   * - ``onyx,onyx-hall``
     - Hall sensor (magnetic cover / folio detect)
   * - ``onyx,power-manager``
     - Onyx power-management node

E-ink waveform tunables present in the overlay: ``onyx,tcon-mode-support``,
``epdc-regal_nm-enable``, ``epdc-gu-regal-enable`` (Regal grayscale for pen),
``epdc-a2-enhance-*`` (A2 fast-refresh mode).

Cross-check
===========

This hardware inventory (LFCPNX100 TCON, Lattice ECP5 FPGA bridge, Parade
capacitive touch, Wacom EMR digitizer, LM3630A front-light, Hall sensor,
serial keyboard — Parade's ``compatible``/I²C-address/GPIO bindings are also
sourced from this overlay, see :doc:`/sensors/touchscreen`) matches the
kernel-driver inventory in :doc:`/boot/boot-image` item for item, and
refutes the leftover XBL AMOLED panel entry noted there.

Artifacts
=========

- ``../artifacts/dtbo_a/overlay_{0,1,2}.dtb`` (raw) and
  ``overlay_{0,1,2}.dts`` (decompiled: 0=v30, 1=v10, 2=v20).

Provenance
==========

:Source: ``../_READONLY/lun4/dtbo_a.bin`` (READ-ONLY). Extracted blobs and
   decompiled overlays in ``../artifacts/dtbo_a/``.
:Method: Parse DTBO header (``struct`` big-endian) into 3 entries; carve each
   blob; ``dtc -I dtb -O dts``. Diff decompiled overlays pairwise, filtering
   phandle/``target``/``fragment`` noise to isolate real deltas.
:Cross-refs: :doc:`/boot/boot-image`.