3.3. Boot image: kernel, DTB, ramdisk, config

boot_a.bin is an Android boot image (ANDROID! header version 2, page size 4096) holding the production kernel, first-stage-init ramdisk, and board device tree for the Note Air5 C.

3.3.1. Android boot image structure

Components are page-aligned, after the 1-page header:

Component	Size	Type	SHA256
kernel	60,735,504	ARM64 Linux Image (uncompressed, LE, 4K)	4e2d5e15…c027b8b1f
ramdisk	1,146,790	gzip cpio (first-stage init)	d5beb5ab…fab26639
dtb	407,904	FDT v17 (one real DTB + 173-byte pad tail)	ad8e0ec9…65ee9b17
second	0	—
recovery_dtbo	0	—

Kernel cmdline (from header):

console=ttyMSM0,115200,n8 earlycon=msm_geni_serial,0x888000 androidboot.hardware=qcom
androidboot.console=ttyMSM0 androidboot.memcg=1 lpm_levels.sleep_disabled=1
video=vfb:640x400,bpp=32,memsize=3072000 msm_rtb.filter=0x237 service_locator.enable=1
androidboot.usbcontroller=a600000.dwc3 swiotlb=2048 cgroup.memory=nokmem,nosocket
loop.max_part=7 buildvariant=user

3.3.2. Kernel

• Linux 4.19.157, arm64, CONFIG_LOCALVERSION="-perf" (production/perf build).

• Config embedded via CONFIG_IKCONFIG (IKCFG_ST at 0x158b820); full config in ../artifacts/boot_a/kernel_config.txt (6,228 lines).

3.3.2.1. Security-relevant kernel config

Option	Value	Meaning
CONFIG_MODULES	y	loadable modules enabled
CONFIG_MODVERSIONS	y	version CRC check only
CONFIG_MODULE_SIG	not set	kernel modules are not cryptographically signed/verified; any compatible .ko can be loaded
CONFIG_DM_VERITY	y	dm-verity available
CONFIG_DM_VERITY_FEC	y	forward-error-correction
CONFIG_DM_VERITY_AVB	not set	verity roothash comes from AVB via first-stage init/fstab, not the in-kernel AVB glue
CONFIG_SECURITY_SELINUX	y	SELinux on
CONFIG_SECURITY_SELINUX_DEVELOP	y	runtime permissive switch compiled in
CONFIG_RANDOMIZE_BASE	y	KASLR
CONFIG_STACKPROTECTOR_STRONG	y	stack canaries
CONFIG_STRICT_KERNEL_RWX	y	RO/NX kernel mappings
CONFIG_FORTIFY_SOURCE	y	buffer hardening
CONFIG_INIT_ON_ALLOC_DEFAULT_ON	not set	heap not zeroed by default
CONFIG_MAGIC_SYSRQ /		debug aids present
CONFIG_KALLSYMS	y

Userspace-facing hardening is present (KASLR, RWX, canaries, dm-verity+FEC on the read-only partitions), but module signing is off. Combined with the test-key-signed, unfused bootloader chain (Secure boot and image signing), the kernel/module integrity layer is bypassable once the bootloader chain itself is unlocked or re-signed — this specific chain has not been walked end to end by actually loading an unsigned module, but each link (no module signing, re-signable bootloader) is independently confirmed above.

3.3.2.2. Kernel shape and storage crypto

• Shape: ARM64_VA_BITS=39 (3-level, 4 KiB pages — ARM64_4K_PAGES/PAGE_SHIFT=12), NR_CPUS=8 (matches the DTB’s 6+2 cores, Base kernel device tree (the SoC boot contract)), HZ=250, PREEMPT=y with Qualcomm’s WALT scheduler (SCHED_WALT), GZIP-compressed image (KERNEL_GZIP).

• Command line: the kernel carries a built-in CONFIG_CMDLINE = "cgroup_disable=pressure" with CMDLINE_EXTEND — it is appended to the bootloader-supplied bootargs (Base kernel device tree (the SoC boot contract) /chosen), not a replacement. UNMAP_KERNEL_AT_EL0 (KPTI) is compiled out, consistent with the kpti=off boot argument.

• No CFI generation: CFI_CLANG, SHADOW_CALL_STACK, ARM64_PTR_AUTH and ARM64_BTI_KERNEL are absent/off — this 4.19 -perf build predates the GKI control-flow-integrity generation; stack canaries (STACKPROTECTOR_STRONG) are the backstop.

• Encryption: File-Based Encryption is on (FS_ENCRYPTION + FS_ENCRYPTION_INLINE_CRYPT) and rides the UFS Inline Crypto Engine (SCSI_UFS_CRYPTO, the ufs_ice block in Storage controllers — UFS, ICE, and SDCC); metadata encryption via DM_DEFAULT_KEY; DM_CRYPT also built.

3.3.2.3. Platform drivers — the kernel’s side of the firmware interfaces

The -perf config binds a kernel driver to nearly every firmware component documented in this set. This is the near (EL1) side of each interface whose far side is a coprocessor or the secure world:

Kernel driver(s) (=y unless noted)	Firmware / interface on the far side	Doc
QCOM_SCM / QCOM_SCM_64	SMC calls into the TZ/QSEE EL3 monitor (secure state, fuses, KeyMaster; PSCI is the sibling path)	Secure world and coprocessors (TZ, HYP, trustlets)
QCOM_RPMH, QCOM_COMMAND_DB, REGULATOR_QCOM_RPMH, MSM_QMP	RPMh votes + cmd-db + QMP mailbox to the AOP	AOP — the Always-On Processor (RPMh / power back-end)
MSM_PIL, QCOM_MDT_LOADER, MSM_SUBSYSTEM_RESTART, MSM_PIL_SSR_GENERIC	PIL load + subsystem-restart of ADSP / CDSP / modem into their reserved regions	ADSP and CDSP firmware
QSEECOM, HDCP_QSEECOM, QTEE_SHM_BRIDGE	QSEE trustlet command channel + shared-memory bridge (keymaster, uefisecapp, Widevine)	Secure world and coprocessors (TZ, HYP, trustlets)
ICNSS, ICNSS_QMI, CNSS_UTILS, CNSS_GENL	WLAN (Helium) bring-up into wlan_fw_region	Bluetooth / FM controller firmware (WCN3990 “Cherokee”)
QRTR (+ SMD/MHI), QCOM_QMI_HELPERS, QMI_RMNET/DFC/POWER_COLLAPSE	QMI/QRTR IPC router + RMNET data path to modem/DSP (dormant modem)	ADSP and CDSP firmware
QCOM_GLINK, QCOM_GLINK_PKT	GLINK IPC transport to the coprocessors	Secure world and coprocessors (TZ, HYP, trustlets)
SPMI, SPMI_MSM_PMIC_ARB, SPMI_PMIC_CLKDIV	SPMI bus to the PMICs	PMIC reset timers, charging and reachability
QCOM_SMEM	SMEM shared memory (smem@0x80900000)	Base kernel device tree (the SoC boot contract)
MSM_BOOT_STATS, QCOM_MEMORY_DUMP_V2	the boot_stats / mem_dump_table IMEM cells + mem_dump_region	Base kernel device tree (the SoC boot contract)
QCOM_LLCC (+ LLCC_PMU/PERFMON)	last-level (system) cache controller behind the shared L3	Base kernel device tree (the SoC boot contract)
SCSI_UFS_QCOM, SCSI_UFS_CRYPTO	UFS host controller + inline crypto engine (ICE)	Storage controllers — UFS, ICE, and SDCC

The presence of every one of these drivers is consistent with the firmware inventory reverse-engineered elsewhere in this set: what XBL’s PIL loads and what the secure world exposes, the kernel is compiled to drive.

3.3.2.4. Onyx / hardware-specific config

Note Air5 C is a color e-ink device.

• E-ink stack (color): CONFIG_EXTRA_FIRMWARE bundles waveform/eink_waveform.wbf, MXO EPD controller firmware (mxo/mxo1300_nvcm_*, mxo4300_nvcm_*), and LFCPNX100 TCON firmware (lfcpnx/lfcpnx100_tcon_fw_*). How these fit the DSI→TCON→EPD pipeline (and why the DTB still names an AMOLED panel) is in Display pipeline — DSI transport to the color e-ink TCON.

• Touch/stylus: CONFIG_TOUCHSCREEN_ONYX_WACOM + ONYX_WACOM_FW_UPDATE (EMR stylus), CONFIG_TOUCHSCREEN_ONYX_PARADE / CYTTSP5 (Parade/Cypress capacitive touch), plus a family of CONFIG_ONYX_TP_* tunables (including ONYX_TP_DEBUG_ENABLE=y).

3.3.3. Device tree

Decompiled with dtc to ../artifacts/boot_a/board.dts.

• SoC identity, CPU topology and the memory/board-id placeholder fields are decoded in Base kernel device tree (the SoC boot contract); not restated here.

• PMICs including pm6150l (SPMI @ c440000) — AMOLED/OLEDB/AB/IBB regulator nodes present (drives the front-light / display rails).

• One real board DTB; the 2nd d00dfeed at 0x638b3 is a 173-byte padding tail, not a usable DTB.

3.3.4. Ramdisk (first-stage init)

System-as-root first stage (15 entries): init (1.5 MB), fstab.default, fstab.emmc, e2fsck, and GSI AVB keys avb/{q,r,s}-gsi.avbpubkey (allow booting Google GSIs under AVB).

3.3.4.1. fstab

../artifacts/boot_a/fstab.default. All dynamic/logical partitions are mounted read-only with AVB:

Mount	fs	Verify
system, system_ext, product	ext4 ro	avb=vbmeta_system, logical, first_stage_mount (system also lists avb_keys=…gsi.avbpubkey)
vendor, odm	ext4 ro	avb, logical, first_stage_mount
metadata	ext4	check, formattable
userdata	f2fs	FBE fileencryption=aes-256-xts:aes-256-cts:v2 + metadata_encryption=aes-256-xts (wrapped keys), quota, checkpoint
persist	ext4	plain
modem/dsp/bluetooth firmware	vfat/ext4 ro	slotselect, SELinux context=
onyxconfig	ext4	defaults — Onyx custom partition, no verity

The fstab requests AVB/dm-verity on the read-only partitions and full file-based + metadata encryption on userdata: verification is configured in software. Enforcement depends on the bootloader root of trust, which is test-key-signed and unfused (see Secure boot and image signing).

3.3.5. XBL display-panel config (reference-base leftover)

XBL’s DisplayDxe carries panel definitions this e-ink device does not use: a Visonox Single DSI FHD Plus Video Mode AMOLED Panel (1080x2248 24bpp) (VISONOX_AMOLED_FHD_PLUS_VIDEO) and a VirtioDSI (640x480) emulator panel — both in ../_READONLY/lun1/xbl_a.bin. The Note Air5 C drives color e-ink via the MXO / LFCPNX100 TCON, with the Lattice FPGA itself as the runtime EPD power/timing controller; the FP9931/MAX17135 EPD PMIC drivers are also present (used by XBL for the boot splash, and relevant to sibling PCB variants) but are not this device’s runtime bind path (see the kernel config above, Display pipeline — DSI transport to the color e-ink TCON, and E-ink driver internals (register-level, from the kernel)). The AMOLED/Virtio panel XML is inherited from the SM6350/Motorola reference base and is not the shipping display path.

3.3.6. Artifacts

In ../artifacts/boot_a/:

• kernel_config.txt — full extracted kernel config

• board.dts — decompiled device tree

• dtb.img — raw device-tree blob

• fstab.default — first-stage mount table

3.3.7. Provenance

Source:

../_READONLY/lun4/boot_a.bin (read-only), 2026-09-12; extracted artifacts in ../artifacts/boot_a/.

Method:

Header/component carving via a hand-rolled Python parser of boot_img_hdr_v2 (page-aligned offsets). Config: located IKCFG_ST, gunzip of the following gzip stream. DTB: dtc -I dtb -O dts. Ramdisk: gunzip | cpio -idm. All values machine-derived from the image bytes.

Cross-refs:

Secure boot and image signing (root of trust, test keys), Base kernel device tree (the SoC boot contract) (SoC identity, CPU topology, memory placeholder), ABL overview, key handling, fastboot (SM6350 build-path confirmation), Display pipeline — DSI transport to the color e-ink TCON (EPD display path), Recovery ramdisk (recovery environment) (shared kernel, recovery ramdisk).