=============================
Partition map and checksums
=============================

The Qualcomm UFS storage on this unit holds 6 LUNs (physical_partition_number
0–5) of 4096-byte sectors in an A/B slotted layout. This page is the verified
partition map: every partition's location, size, presence in the dump, and
SHA256 checksum, cross-checked against the images on disk.

Storage and dump summary
========================

- Storage: Qualcomm UFS, 6 LUNs (physical_partition_number 0–5), 4096-byte
  sectors, A/B slotted.
- Program entries parsed: 95 across 6 rawprogram XML files.
- SHA256 verification: 106/106 OK, 0 mismatches (``shasum -a 256 -c
  SHA256SUMS``, exit 0). This covers every image ``.bin``, every ``gpt_*``
  table, and each rawprogram XML.
- Only image not present: ``lun0/userdata.bin`` (userdata, 12,977,651 sectors
  ≈ 49.5 GB) — referenced in ``rawprogram0.xml`` but excluded from the dump
  (not in SHA256SUMS). Everything else referenced by XML exists.
- No orphan images: every ``.bin`` on disk is accounted for by a rawprogram
  entry.
- A/B slots are *mostly* identical — see `A/B pairs are mostly identical —
  with exceptions`_ below. Slot selection itself is carried in GPT attribute
  bits, not in ``misc`` — see `Boot-control block (misc) and A/B slot
  selection`_.
- Blank (all-``0x00``) partitions and what each would hold:

  .. list-table::
     :header-rows: 1
     :widths: 30 70

     * - Blank partitions
       - What they would hold
     * - ``keystore``, ``ssd``
       - credential/secure-storage blobs; unprovisioned (``keystore`` is
         re-confirmed byte-for-byte in :doc:`/userspace/security`)
     * - ``apdp``, ``spunvm``, ``secdata``, ``storsec``
       - anti-rollback/DP provisioning, SPU NV, MDTP secure data,
         secure-storage seed — none provisioned
     * - ``mdtp_a/b``, ``mdtpsecapp_a/b``
       - Mobile Device Theft Protection image + data — MDTP disabled
         (:doc:`/trustzone/secure-world`)
     * - ``catefv``, ``cateloader``, ``catecontentfv``, ``toolsfv``, ``questdatafv``
       - manufacturing / field-diagnostic UEFI FVs — empty on production
     * - ``dip``, ``limits-cdsp``, ``cdt``
       - device-info provisioning, CDSP thermal limits, CDT (board identity
         — decoded in :doc:`/xbl/platform-state`) — empty
     * - ``fsc``, ``fsg``
       - modem filesystem cache/gold — no cellular provisioning
     * - ``recovery_b``, ``vbmeta_system_b``
       - slot-B recovery and vbmeta_system — **not** populated (see below)
     * - ``splash`` (32.6 MB)
       - boot/charging imagery — XBL disables splash-partition loading, see
         :doc:`/display/splash`; its zero-hash is unique to its size, so it
         is not in the shared zero-hash groups below

  The near-blank state partitions — ``misc`` (below), ``devinfo``
  (:doc:`/abl/verified-boot`), ``ddr``/``uefivarstore``
  (:doc:`/xbl/platform-state`), ``frp`` (:doc:`/userspace/security`) — carry
  a small amount of real structure and are documented on their own pages.
- **Not blank, despite sitting next to blank ``fsg``/``fsc``:** ``modemst1``/
  ``modemst2`` (LUN5) are 99.6% non-zero, real Qualcomm EFS2 modem-NV-store
  images — see :doc:`/audio/dsp-firmware`.

Partition map by LUN
====================

UFS LUN 0 — bulk/userspace (super, userdata, persist, metadata, config)
-----------------------------------------------------------------------

.. list-table::
   :header-rows: 1

   * - Label
     - File
     - Start sector
     - Start byte
     - Sectors
     - Size
     - On disk
     - SHA256 (12)
   * - PrimaryGPT
     - ``gpt_main0.bin``
     - 0
     - ``0x0``
     - 6
     - 24 KB
     - yes
     - ``553d3a07a268``
   * - ssd
     - ``ssd.bin``
     - 6
     - ``0x6000``
     - 2
     - 8 KB
     - yes
     - ``9f1dcbc35c35``
   * - persist
     - ``persist.bin``
     - 8
     - ``0x8000``
     - 8192
     - 32.0 MB
     - yes
     - ``b956146c9d8c``
   * - misc
     - ``misc.bin``
     - 8200
     - ``0x2008000``
     - 256
     - 1.0 MB
     - yes
     - ``8da2a417164d``
   * - keystore
     - ``keystore.bin``
     - 8456
     - ``0x2108000``
     - 128
     - 512 KB
     - yes
     - ``07854d2fef29``
   * - frp
     - ``frp.bin``
     - 8584
     - ``0x2188000``
     - 128
     - 512 KB
     - yes
     - ``7662a9a143c4``
   * - metadata
     - ``metadata.bin``
     - 8712
     - ``0x2208000``
     - 4096
     - 16.0 MB
     - yes
     - ``d2c97a8ecdbe``
   * - rawdump
     - ``rawdump.bin``
     - 12808
     - ``0x3208000``
     - 32768
     - 128.0 MB
     - yes
     - ``254bcc3fc4f2``
   * - super
     - ``super.bin``
     - 45576
     - ``0xb208000``
     - 1572864
     - 6.00 GB
     - yes
     - ``975b5d1d3815``
   * - onyxconfig
     - ``onyxconfig.bin``
     - 1618440
     - ``0x18b208000``
     - 6144
     - 24.0 MB
     - yes
     - ``a6afc7373e20``
   * - userdata
     - ``userdata.bin``
     - 1624584
     - ``0x18ca08000``
     - 12977651
     - 49.51 GB
     - NO
     - ``—``
   * - BackupGPT
     - ``gpt_backup0.bin``
     - ``NUM_DISK_SECTORS-5.``
     - ``(4096*NUM_DISK_SECTORS)-20480.``
     - 5
     - 20 KB
     - yes
     - ``edfa5dd867e4``

UFS LUN 1 — boot slot A firmware (xbl_a)
----------------------------------------

.. list-table::
   :header-rows: 1

   * - Label
     - File
     - Start sector
     - Start byte
     - Sectors
     - Size
     - On disk
     - SHA256 (12)
   * - PrimaryGPT
     - ``gpt_main1.bin``
     - 0
     - ``0x0``
     - 6
     - 24 KB
     - yes
     - ``4de29b8fa3e4``
   * - xbl_a
     - ``xbl_a.bin``
     - 6
     - ``0x6000``
     - 896
     - 3.5 MB
     - yes
     - ``ec83394b14f8``
   * - xbl_config_a
     - ``xbl_config_a.bin``
     - 902
     - ``0x386000``
     - 32
     - 128 KB
     - yes
     - ``42b8ae103c6e``
   * - BackupGPT
     - ``gpt_backup1.bin``
     - ``NUM_DISK_SECTORS-5.``
     - ``(4096*NUM_DISK_SECTORS)-20480.``
     - 5
     - 20 KB
     - yes
     - ``afaf609b3cfc``

UFS LUN 2 — boot slot B firmware (xbl_b)
----------------------------------------

.. list-table::
   :header-rows: 1

   * - Label
     - File
     - Start sector
     - Start byte
     - Sectors
     - Size
     - On disk
     - SHA256 (12)
   * - PrimaryGPT
     - ``gpt_main2.bin``
     - 0
     - ``0x0``
     - 6
     - 24 KB
     - yes
     - ``9af7dc6a23e5``
   * - xbl_b
     - ``xbl_b.bin``
     - 6
     - ``0x6000``
     - 896
     - 3.5 MB
     - yes
     - ``ec83394b14f8``
   * - xbl_config_b
     - ``xbl_config_b.bin``
     - 902
     - ``0x386000``
     - 32
     - 128 KB
     - yes
     - ``42b8ae103c6e``
   * - BackupGPT
     - ``gpt_backup2.bin``
     - ``NUM_DISK_SECTORS-5.``
     - ``(4096*NUM_DISK_SECTORS)-20480.``
     - 5
     - 20 KB
     - yes
     - ``1e3350a79465``

UFS LUN 3 — platform config (cdt, ddr)
--------------------------------------

.. list-table::
   :header-rows: 1

   * - Label
     - File
     - Start sector
     - Start byte
     - Sectors
     - Size
     - On disk
     - SHA256 (12)
   * - PrimaryGPT
     - ``gpt_main3.bin``
     - 0
     - ``0x0``
     - 6
     - 24 KB
     - yes
     - ``1b7879f22478``
   * - ALIGN_TO_128K_1
     - ``ALIGN_TO_128K_1.bin``
     - 6
     - ``0x6000``
     - 26
     - 104 KB
     - yes
     - ``caa961e702d5``
   * - cdt
     - ``cdt.bin``
     - 32
     - ``0x20000``
     - 32
     - 128 KB
     - yes
     - ``fa43239bcee7``
   * - ddr
     - ``ddr.bin``
     - 64
     - ``0x40000``
     - 256
     - 1.0 MB
     - yes
     - ``c98120889dcb``
   * - BackupGPT
     - ``gpt_backup3.bin``
     - ``NUM_DISK_SECTORS-5.``
     - ``(4096*NUM_DISK_SECTORS)-20480.``
     - 5
     - 20 KB
     - yes
     - ``3227169e05a9``

UFS LUN 4 — main A/B firmware set (63 partitions)
-------------------------------------------------

.. list-table::
   :header-rows: 1

   * - Label
     - File
     - Start sector
     - Start byte
     - Sectors
     - Size
     - On disk
     - SHA256 (12)
   * - PrimaryGPT
     - ``gpt_main4.bin``
     - 0
     - ``0x0``
     - 6
     - 24 KB
     - yes
     - ``689551751ae6``
   * - aop_a
     - ``aop_a.bin``
     - 6
     - ``0x6000``
     - 128
     - 512 KB
     - yes
     - ``387c092bff93``
   * - tz_a
     - ``tz_a.bin``
     - 134
     - ``0x86000``
     - 1024
     - 4.0 MB
     - yes
     - ``6192aa583777``
   * - multiimgoem_a
     - ``multiimgoem_a.bin``
     - 1158
     - ``0x486000``
     - 8
     - 32 KB
     - yes
     - ``1379dbd89d8e``
   * - hyp_a
     - ``hyp_a.bin``
     - 1166
     - ``0x48e000``
     - 128
     - 512 KB
     - yes
     - ``687abd6e6de8``
   * - modem_a
     - ``modem_a.bin``
     - 1294
     - ``0x50e000``
     - 49920
     - 195.0 MB
     - yes
     - ``78aea3b562ad``
   * - bluetooth_a
     - ``bluetooth_a.bin``
     - 51214
     - ``0xc80e000``
     - 256
     - 1.0 MB
     - yes
     - ``aa37aad18bd2``
   * - mdtpsecapp_a
     - ``mdtpsecapp_a.bin``
     - 51470
     - ``0xc90e000``
     - 1024
     - 4.0 MB
     - yes
     - ``bb9f8df61474``
   * - mdtp_a
     - ``mdtp_a.bin``
     - 52494
     - ``0xcd0e000``
     - 8192
     - 32.0 MB
     - yes
     - ``83ee47245398``
   * - abl_a
     - ``abl_a.bin``
     - 60686
     - ``0xed0e000``
     - 256
     - 1.0 MB
     - yes
     - ``e61d0e6023fd``
   * - dsp_a
     - ``dsp_a.bin``
     - 60942
     - ``0xee0e000``
     - 16384
     - 64.0 MB
     - yes
     - ``3cf822079d54``
   * - keymaster_a
     - ``keymaster_a.bin``
     - 77326
     - ``0x12e0e000``
     - 128
     - 512 KB
     - yes
     - ``4ac2570c7a70``
   * - boot_a
     - ``boot_a.bin``
     - 77454
     - ``0x12e8e000``
     - 24576
     - 96.0 MB
     - yes
     - ``3e3c68d871e2``
   * - devcfg_a
     - ``devcfg_a.bin``
     - 102030
     - ``0x18e8e000``
     - 32
     - 128 KB
     - yes
     - ``bcd742b788ce``
   * - qupfw_a
     - ``qupfw_a.bin``
     - 102062
     - ``0x18eae000``
     - 20
     - 80 KB
     - yes
     - ``ff8921c62607``
   * - recovery_a
     - ``recovery_a.bin``
     - 102082
     - ``0x18ec2000``
     - 24576
     - 96.0 MB
     - yes
     - ``d28a7cb08856``
   * - vbmeta_system_a
     - ``vbmeta_system_a.bin``
     - 126658
     - ``0x1eec2000``
     - 16
     - 64 KB
     - yes
     - ``54efbab6fac0``
   * - vbmeta_a
     - ``vbmeta_a.bin``
     - 126674
     - ``0x1eed2000``
     - 16
     - 64 KB
     - yes
     - ``e6de89fc8d3c``
   * - dtbo_a
     - ``dtbo_a.bin``
     - 126690
     - ``0x1eee2000``
     - 6144
     - 24.0 MB
     - yes
     - ``c17e63f7b247``
   * - imagefv_a
     - ``imagefv_a.bin``
     - 132834
     - ``0x206e2000``
     - 512
     - 2.0 MB
     - yes
     - ``f0339d3e9952``
   * - uefisecapp_a
     - ``uefisecapp_a.bin``
     - 133346
     - ``0x208e2000``
     - 512
     - 2.0 MB
     - yes
     - ``b123f4daee04``
   * - core_nhlos_a
     - ``core_nhlos_a.bin``
     - 133858
     - ``0x20ae2000``
     - 43520
     - 170.0 MB
     - yes
     - ``c12678c8461c``
   * - featenabler_a
     - ``featenabler_a.bin``
     - 177378
     - ``0x2b4e2000``
     - 32
     - 128 KB
     - yes
     - ``da31d9ba9251``
   * - questdatafv
     - ``questdatafv.bin``
     - 177410
     - ``0x2b502000``
     - 4096
     - 16.0 MB
     - yes
     - ``080acf35a507``
   * - aop_b
     - ``aop_b.bin``
     - 181506
     - ``0x2c502000``
     - 128
     - 512 KB
     - yes
     - ``387c092bff93``
   * - tz_b
     - ``tz_b.bin``
     - 181634
     - ``0x2c582000``
     - 1024
     - 4.0 MB
     - yes
     - ``6192aa583777``
   * - multiimgoem_b
     - ``multiimgoem_b.bin``
     - 182658
     - ``0x2c982000``
     - 8
     - 32 KB
     - yes
     - ``1379dbd89d8e``
   * - hyp_b
     - ``hyp_b.bin``
     - 182666
     - ``0x2c98a000``
     - 128
     - 512 KB
     - yes
     - ``687abd6e6de8``
   * - modem_b
     - ``modem_b.bin``
     - 182794
     - ``0x2ca0a000``
     - 49920
     - 195.0 MB
     - yes
     - ``78aea3b562ad``
   * - bluetooth_b
     - ``bluetooth_b.bin``
     - 232714
     - ``0x38d0a000``
     - 256
     - 1.0 MB
     - yes
     - ``aa37aad18bd2``
   * - mdtpsecapp_b
     - ``mdtpsecapp_b.bin``
     - 232970
     - ``0x38e0a000``
     - 1024
     - 4.0 MB
     - yes
     - ``bb9f8df61474``
   * - mdtp_b
     - ``mdtp_b.bin``
     - 233994
     - ``0x3920a000``
     - 8192
     - 32.0 MB
     - yes
     - ``83ee47245398``
   * - abl_b
     - ``abl_b.bin``
     - 242186
     - ``0x3b20a000``
     - 256
     - 1.0 MB
     - yes
     - ``e61d0e6023fd``
   * - dsp_b
     - ``dsp_b.bin``
     - 242442
     - ``0x3b30a000``
     - 16384
     - 64.0 MB
     - yes
     - ``3cf822079d54``
   * - keymaster_b
     - ``keymaster_b.bin``
     - 258826
     - ``0x3f30a000``
     - 128
     - 512 KB
     - yes
     - ``4ac2570c7a70``
   * - boot_b
     - ``boot_b.bin``
     - 258954
     - ``0x3f38a000``
     - 24576
     - 96.0 MB
     - yes
     - ``3e3c68d871e2``
   * - devcfg_b
     - ``devcfg_b.bin``
     - 283530
     - ``0x4538a000``
     - 32
     - 128 KB
     - yes
     - ``bcd742b788ce``
   * - qupfw_b
     - ``qupfw_b.bin``
     - 283562
     - ``0x453aa000``
     - 20
     - 80 KB
     - yes
     - ``ff8921c62607``
   * - recovery_b
     - ``recovery_b.bin``
     - 283582
     - ``0x453be000``
     - 24576
     - 96.0 MB
     - yes
     - ``425382d5857f``
   * - vbmeta_system_b
     - ``vbmeta_system_b.bin``
     - 308158
     - ``0x4b3be000``
     - 16
     - 64 KB
     - yes
     - ``de2f256064a0``
   * - vbmeta_b
     - ``vbmeta_b.bin``
     - 308174
     - ``0x4b3ce000``
     - 16
     - 64 KB
     - yes
     - ``e6de89fc8d3c``
   * - dtbo_b
     - ``dtbo_b.bin``
     - 308190
     - ``0x4b3de000``
     - 6144
     - 24.0 MB
     - yes
     - ``c17e63f7b247``
   * - featenabler_b
     - ``featenabler_b.bin``
     - 314334
     - ``0x4cbde000``
     - 32
     - 128 KB
     - yes
     - ``da31d9ba9251``
   * - imagefv_b
     - ``imagefv_b.bin``
     - 314366
     - ``0x4cbfe000``
     - 512
     - 2.0 MB
     - yes
     - ``f0339d3e9952``
   * - uefisecapp_b
     - ``uefisecapp_b.bin``
     - 314878
     - ``0x4cdfe000``
     - 512
     - 2.0 MB
     - yes
     - ``b123f4daee04``
   * - core_nhlos_b
     - ``core_nhlos_b.bin``
     - 315390
     - ``0x4cffe000``
     - 43520
     - 170.0 MB
     - yes
     - ``c12678c8461c``
   * - devinfo
     - ``devinfo.bin``
     - 358910
     - ``0x579fe000``
     - 1
     - 4 KB
     - yes
     - ``d8e937106704``
   * - dip
     - ``dip.bin``
     - 358911
     - ``0x579ff000``
     - 256
     - 1.0 MB
     - yes
     - ``30e14955ebf1``
   * - apdp
     - ``apdp.bin``
     - 359167
     - ``0x57aff000``
     - 64
     - 256 KB
     - yes
     - ``8a39d2abd399``
   * - spunvm
     - ``spunvm.bin``
     - 359231
     - ``0x57b3f000``
     - 2048
     - 8.0 MB
     - yes
     - ``2daeb1f36095``
   * - splash
     - ``splash.bin``
     - 361279
     - ``0x5833f000``
     - 8356
     - 32.6 MB
     - yes
     - ``efd199079045``
   * - limits
     - ``limits.bin``
     - 369635
     - ``0x5a3e3000``
     - 1
     - 4 KB
     - yes
     - ``e1bf8fa91170``
   * - limits-cdsp
     - ``limits-cdsp.bin``
     - 369636
     - ``0x5a3e4000``
     - 1
     - 4 KB
     - yes
     - ``ad7facb2586f``
   * - toolsfv
     - ``toolsfv.bin``
     - 369637
     - ``0x5a3e5000``
     - 256
     - 1.0 MB
     - yes
     - ``30e14955ebf1``
   * - logfs
     - ``logfs.bin``
     - 369893
     - ``0x5a4e5000``
     - 2048
     - 8.0 MB
     - yes
     - ``b8b5ac87f3d9``
   * - cateloader
     - ``cateloader.bin``
     - 371941
     - ``0x5ace5000``
     - 512
     - 2.0 MB
     - yes
     - ``5647f05ec189``
   * - logdump
     - ``logdump.bin``
     - 372453
     - ``0x5aee5000``
     - 16384
     - 64.0 MB
     - yes
     - ``3b6a07d0d404``
   * - storsec
     - ``storsec.bin``
     - 388837
     - ``0x5eee5000``
     - 32
     - 128 KB
     - yes
     - ``fa43239bcee7``
   * - uefivarstore
     - ``uefivarstore.bin``
     - 388869
     - ``0x5ef05000``
     - 128
     - 512 KB
     - yes
     - ``8b08214a90a6``
   * - secdata
     - ``secdata.bin``
     - 388997
     - ``0x5ef85000``
     - 7
     - 28 KB
     - yes
     - ``18619b678a5c``
   * - catefv
     - ``catefv.bin``
     - 389004
     - ``0x5ef8c000``
     - 128
     - 512 KB
     - yes
     - ``07854d2fef29``
   * - catecontentfv
     - ``catecontentfv.bin``
     - 389132
     - ``0x5f00c000``
     - 256
     - 1.0 MB
     - yes
     - ``30e14955ebf1``
   * - BackupGPT
     - ``gpt_backup4.bin``
     - ``NUM_DISK_SECTORS-5.``
     - ``(4096*NUM_DISK_SECTORS)-20480.``
     - 5
     - 20 KB
     - yes
     - ``387837891ea4``

UFS LUN 5 — modem NV storage (modemst/fsg/fsc)
----------------------------------------------

.. list-table::
   :header-rows: 1

   * - Label
     - File
     - Start sector
     - Start byte
     - Sectors
     - Size
     - On disk
     - SHA256 (12)
   * - PrimaryGPT
     - ``gpt_main5.bin``
     - 0
     - ``0x0``
     - 6
     - 24 KB
     - yes
     - ``286f9c6acc2d``
   * - ALIGN_TO_128K_2
     - ``ALIGN_TO_128K_2.bin``
     - 6
     - ``0x6000``
     - 26
     - 104 KB
     - yes
     - ``caa961e702d5``
   * - modemst1
     - ``modemst1.bin``
     - 32
     - ``0x20000``
     - 640
     - 2.5 MB
     - yes
     - ``5e3e83e25ebf``
   * - modemst2
     - ``modemst2.bin``
     - 672
     - ``0x2a0000``
     - 640
     - 2.5 MB
     - yes
     - ``ceaa31bb4d02``
   * - fsg
     - ``fsg.bin``
     - 1312
     - ``0x520000``
     - 640
     - 2.5 MB
     - yes
     - ``6de7493c5c90``
   * - fsc
     - ``fsc.bin``
     - 1952
     - ``0x7a0000``
     - 32
     - 128 KB
     - yes
     - ``fa43239bcee7``
   * - BackupGPT
     - ``gpt_backup5.bin``
     - ``NUM_DISK_SECTORS-5.``
     - ``(4096*NUM_DISK_SECTORS)-20480.``
     - 5
     - 20 KB
     - yes
     - ``6321bc650121``

Duplicate-hash groups (byte-identical images)
=============================================

A/B pairs proving both slots hold the same image, plus blank partitions
sharing an all-zero hash.

.. list-table::
   :header-rows: 1

   * - SHA256 (12)
     - Files
     - Note
   * - ``07854d2fef29``
     - ``lun0/keystore.bin``, ``lun4/catefv.bin``
     - blank / all-0x00
   * - ``ec83394b14f8``
     - ``lun1/xbl_a.bin``, ``lun2/xbl_b.bin``
     - A/B slots identical
   * - ``42b8ae103c6e``
     - ``lun1/xbl_config_a.bin``, ``lun2/xbl_config_b.bin``
     - A/B slots identical
   * - ``e61d0e6023fd``
     - ``lun4/abl_a.bin``, ``lun4/abl_b.bin``
     - A/B slots identical
   * - ``387c092bff93``
     - ``lun4/aop_a.bin``, ``lun4/aop_b.bin``
     - A/B slots identical
   * - ``aa37aad18bd2``
     - ``lun4/bluetooth_a.bin``, ``lun4/bluetooth_b.bin``
     - A/B slots identical
   * - ``3e3c68d871e2``
     - ``lun4/boot_a.bin``, ``lun4/boot_b.bin``
     - A/B slots identical
   * - ``c12678c8461c``
     - ``lun4/core_nhlos_b.bin``, ``lun4/core_nhlos_a.bin``
     - A/B slots identical
   * - ``bcd742b788ce``
     - ``lun4/devcfg_b.bin``, ``lun4/devcfg_a.bin``
     - A/B slots identical
   * - ``30e14955ebf1``
     - ``lun4/dip.bin``, ``lun4/catecontentfv.bin``, ``lun4/toolsfv.bin``
     - blank / all-0x00
   * - ``3cf822079d54``
     - ``lun4/dsp_b.bin``, ``lun4/dsp_a.bin``
     - A/B slots identical
   * - ``c17e63f7b247``
     - ``lun4/dtbo_b.bin``, ``lun4/dtbo_a.bin``
     - A/B slots identical
   * - ``da31d9ba9251``
     - ``lun4/featenabler_b.bin``, ``lun4/featenabler_a.bin``
     - A/B slots identical
   * - ``687abd6e6de8``
     - ``lun4/hyp_a.bin``, ``lun4/hyp_b.bin``
     - A/B slots identical
   * - ``f0339d3e9952``
     - ``lun4/imagefv_b.bin``, ``lun4/imagefv_a.bin``
     - A/B slots identical
   * - ``4ac2570c7a70``
     - ``lun4/keymaster_b.bin``, ``lun4/keymaster_a.bin``
     - A/B slots identical
   * - ``83ee47245398``
     - ``lun4/mdtp_a.bin``, ``lun4/mdtp_b.bin``
     - A/B slots identical
   * - ``bb9f8df61474``
     - ``lun4/mdtpsecapp_b.bin``, ``lun4/mdtpsecapp_a.bin``
     - A/B slots identical
   * - ``78aea3b562ad``
     - ``lun4/modem_a.bin``, ``lun4/modem_b.bin``
     - A/B slots identical
   * - ``1379dbd89d8e``
     - ``lun4/multiimgoem_a.bin``, ``lun4/multiimgoem_b.bin``
     - A/B slots identical
   * - ``ff8921c62607``
     - ``lun4/qupfw_b.bin``, ``lun4/qupfw_a.bin``
     - A/B slots identical
   * - ``6192aa583777``
     - ``lun4/tz_b.bin``, ``lun4/tz_a.bin``
     - A/B slots identical
   * - ``b123f4daee04``
     - ``lun4/uefisecapp_b.bin``, ``lun4/uefisecapp_a.bin``
     - A/B slots identical
   * - ``e6de89fc8d3c``
     - ``lun4/vbmeta_b.bin``, ``lun4/vbmeta_a.bin``
     - A/B slots identical
   * - ``caa961e702d5``
     - ``lun5/ALIGN_TO_128K_2.bin``, ``lun3/ALIGN_TO_128K_1.bin``
     -
   * - ``fa43239bcee7``
     - ``lun5/fsc.bin``, ``lun3/cdt.bin``, ``lun4/storsec.bin``
     - blank / all-0x00

A/B pairs are *mostly* identical — with exceptions
=====================================================

Most ``_a``/``_b`` firmware pairs are byte-identical (one shared SHA-256,
per the duplicate-hash groups above): ``xbl``, ``xbl_config``, ``boot``,
``tz``, ``abl``, ``vbmeta``, ``dtbo``, ``modem`` all match across slots. The
exceptions are the partitions whose **slot B is blank**: ``recovery_b``
(slot A is a full 100 MB image) and ``vbmeta_system_b`` (slot A populated).
So the general "both slots equal" picture holds for the core firmware but
not for ``recovery`` or ``vbmeta_system``.

Boot-control block (``misc``) and A/B slot selection
========================================================

``misc.bin`` (LUN0, 1 MB) is the standard Android/Qualcomm bootloader
message block. On this unit it is **idle**:

- ``command[0:32]``, ``status[32:64]``, ``recovery[64:...]`` — all empty
  (no pending "boot-recovery" / "bootonce-bootloader" command).
- The AOSP A/B ``bootloader_control`` (magic ``BCAB``) is **not present**
  in ``misc`` — there is no ``_a``/``_b`` suffix or slot struct anywhere in
  it. Slot state lives in the GPT instead (below).
- A single ~15-byte record sits at ``0x8000`` (``02 b0 0a 74 56 …``) —
  vendor/OTA bookkeeping, not the AOSP slot struct.

So the classic "write a command to ``misc`` and reboot to recovery" path
exists (the fields are there and ABL's ``RESET_PARAM``/recovery handling
reads them — :doc:`/boot/keys`), but slot selection does **not** go
through ``misc`` here.

This is a slotted device, but the active-slot / retry / success
bookkeeping is carried in the **GPT partition-entry attribute field** (the
top 16 bits of the 8-byte attributes), exactly as ABL's
``PartitionTableUpdate.h`` defines:

.. list-table::
   :header-rows: 1
   :widths: 30 14 56

   * - Field
     - Bit(s)
     - Meaning
   * - ``PART_ATT_PRIORITY``
     - 48–49
     - 2-bit slot priority (0–3); highest wins
   * - ``PART_ATT_ACTIVE``
     - 50
     - slot is the active/selected one
   * - ``PART_ATT_MAX_RETRY_CNT``
     - 51–53
     - 3-bit remaining boot attempts (0–7)
   * - ``PART_ATT_SUCCESS``
     - 54
     - slot booted successfully at least once
   * - ``PART_ATT_UNBOOTABLE``
     - 55
     - slot must not be tried
   * - ``PART_ATT_READONLY``
     - 60
     - partition is read-only (immutable firmware)

Decoded live from ``gpt_main4.bin``:

.. list-table::
   :header-rows: 1
   :widths: 22 26 52

   * - Partition
     - Attributes
     - Decode
   * - ``boot_a``
     - ``0x0077000000000000``
     - **prio=3 active=1 retry=6 success=1** — the live, healthy slot
   * - ``boot_b``
     - ``0x0000000000000000``
     - prio=0 inactive — dormant/empty slot
   * - ``xbl_a``, ``tz_a``, ``abl_a``, ``modem_a`` …
     - ``0x1044000000000000``
     - active=1 success=1 **ro=1** — immutable firmware, slot A
   * - ``devcfg_a``, ``dtbo_a``, ``hyp_a``, ``qupfw_a``
     - ``0x0044000000000000``
     - active=1 success=1 **ro=0** — updatable, slot A
   * - firmware ``_b`` (populated), most partitions
     - ``0x1000000000000000``
     - inactive, ``ro=1`` — slot-B copy present but not selected

This "inactive, ``ro=1``" pattern holds for ``modem_b``, ``bluetooth_b``,
``mdtpsecapp_b``, ``mdtp_b``, ``abl_b``, ``dsp_b`` and ``keymaster_b``, but
it is not a universal rule: ``tz_b``, ``hyp_b``, ``aop_b`` and
``multiimgoem_b`` all read ``0x0000000000000000`` — inactive with **no**
``ro`` bit set at all — even though these are populated, byte-identical
firmware (per the previous section, which lists ``tz`` as byte-identical
across slots). So a firmware-B slot being populated does not guarantee its
GPT entry carries ``ro=1``.

The selection rule XBL/ABL implement: among a partition's slots, pick the
highest ``PRIORITY`` that is not ``UNBOOTABLE`` and has ``retry > 0``;
decrement retry per attempt; the OS sets ``SUCCESS`` once it confirms a
good boot. The ``READONLY`` bit (60) cleanly separates the **immutable**
firmware (``xbl``, ``tz``, ``aop``, ``modem``, ``abl``, ``dsp``,
``keymaster``, ``vbmeta`` — ``ro=1`` on their ``_a`` slots) from the
**mutable** partitions (``boot``, ``recovery``, ``dtbo``, ``devcfg``,
``qupfw``, ``hyp``, ``xbl_config`` — ``ro=0``); this divides less cleanly on
the ``_b`` slots (above). A bootloader that replaces
ABL must honour these bits (or deliberately ignore slots and boot ``_a``
unconditionally, which is valid on a single-active-slot unit like this
one).

GPT type / unique / disk GUIDs
==============================

Extracted directly from the ``gpt_main{0..5}.bin`` tables (not the rawprogram
XML, which carries only labels/offsets). Two structural facts matter for a
bootloader that resolves partitions by **type GUID** rather than by name:

- Every ``_a`` slot partition on LUN4 carries a **distinct** type GUID; every
  ``_b`` slot partition shares one placeholder type GUID
  ``77036cd4-03d5-42bb-8ed1-37e5a88baa34``. So a type-GUID lookup uniquely
  identifies ``_a`` partitions but cannot distinguish ``_b`` partitions from one
  another — name-based lookup (as stock ABL uses) has no such asymmetry.
- Per-LUN disk GUIDs: present (one random UUID per LUN, standard GPT disk
  identity) but not reproduced here — each is unique per physical unit
  (generated at factory flash time), unlike the type GUIDs below which are
  fixed by the firmware build and identical across every unit.

Boot-chain ``_a`` type GUIDs (LUN1/LUN4), the ones a replacement loader would key
on:

.. list-table::
   :header-rows: 1
   :widths: 20 40

   * - Partition
     - Type GUID
   * - ``xbl_a`` (LUN1)
     - ``dea0ba2c-cbdd-4805-b4f9-f428251c3e98``
   * - ``xbl_config_a`` (LUN1)
     - ``5a325ae4-4276-b66d-0add-3494df27706a``
   * - ``aop_a``
     - ``d69e90a5-4cab-0071-f6df-ab977f141a7f``
   * - ``tz_a``
     - ``a053aa7f-40b8-4b1c-ba08-2f68ac71a4f4``
   * - ``hyp_a``
     - ``e1a6a689-0c8d-4cc6-b4e8-55a4320fbd8a``
   * - ``abl_a``
     - ``bd6928a1-4ce0-a038-4f3a-1495e3eddffb``
   * - ``boot_a``
     - ``20117f86-e985-4357-b9ee-374bc1d8487d``
   * - ``dtbo_a``
     - ``24d0d418-d31d-4d8d-ac2c-4d4305188450``
   * - ``vbmeta_a``
     - ``4b7a15d6-322c-42ac-8110-88b7da0c5d77``
   * - ``vbmeta_system_a``
     - ``1344859d-3a6a-4c14-a316-9e696b3a5400``
   * - ``devcfg_a``
     - ``f65d4b16-343d-4e25-aafc-be99b6556a6d``
   * - ``recovery_a``
     - ``d504d6db-fa92-4853-b59e-c7f292e2ea19``
   * - ``devinfo``
     - ``65addcf4-0c5c-4d9a-ac2d-d90b5cbfcd03``

The remaining partitions' type/unique GUIDs are reproducible from the
``gpt_main*.bin`` tables (standard GPT: 92-byte header at the second block,
128-byte entries following; 4096-byte sectors on this unit).

Provenance
==========

:Source: ``../_READONLY/rawprogram[0-5].xml`` (Qualcomm firehose flash
   descriptors) and the images on disk; ``../_READONLY/SHA256SUMS``;
   ``../_READONLY/lun[0-5]/gpt_main*.bin`` (GPT type/unique/disk GUIDs).
:Method: Parse ``rawprogram[0-5].xml`` into 95 program entries; cross-check
   every ``filename=`` against files on disk (1 missing: userdata; 0 orphans);
   run ``shasum -a 256 -c SHA256SUMS`` over all ~13 GB (106/106 OK); verify
   blank partitions with a distinct-byte-value scan (single value ``0x00``);
   GPT attribute bits decoded per ``QcomModulePkg/Include/Library/
   PartitionTableUpdate.h``.
:Cross-refs: :doc:`/display/splash` (blank splash partition),
   :doc:`/userspace/security` (persist/metadata/keystore/frp content),
   :doc:`/audio/dsp-firmware` (modemst1/2 content),
   :doc:`/xbl/platform-state` (cdt/ddr/uefivarstore),
   :doc:`/abl/verified-boot` (devinfo lock state),
   :doc:`/boot/keys` (misc/RESET_PARAM recovery path).