=======================
Vendor drivers and HALs
=======================

Between the SoC hardware documented in :doc:`/soc/index` and the Android
framework sits the vendor driver/HAL layer: the loadable kernel modules that
init inserts at boot, and the HAL (Hardware Abstraction Layer) services and
libraries that expose each device to the framework over hwbinder. The bulk
of this layer is domain-specific and lives next to the relevant hardware
pages instead of one giant catalogue:

- **Audio** (29 of the 37 ``.ko`` modules, the ``audio.service`` HAL) —
  :doc:`/audio/hal`.
- **Wireless** (WLAN module, WiFi/Bluetooth HALs, disabled NFC/GNSS/FM/ANT+) —
  :doc:`/wireless/hal`.
- **Sensors** (sensors/fingerprint HALs) — :doc:`/sensors/hal`.
- **Display** (``lcd.ko``, composer/allocator/lights HALs) —
  :doc:`/display/hal`.
- **Security/DRM** (keymaster, gatekeeper, Widevine/ClearKey, cas, qseecom,
  soter, eSE) — :doc:`security`.

This page is the leftover: the loadable modules and HALs that don't belong to
any single domain above, plus the totals for the layer as a whole.

Everything here is from ``vendor_a.img`` (``lib/modules/``, ``bin/hw/``,
``lib64/hw/``, ``etc/vintf/manifest.xml``) read with ``7z``, cross-checked
against ``kernel_config.txt``. No code was executed.

Loadable kernel modules
========================

``/vendor/lib/modules`` holds **37** ``.ko`` files; ``modules.load`` gives the
boot insertion order. 29 of the 37 are the audio fabric (:doc:`/audio/hal`)
and 1 is the WLAN driver (:doc:`/wireless/hal`); the remaining **7** are
generic SoC/platform plumbing with no single domain home:

.. list-table::
   :header-rows: 1
   :widths: 26 74

   * - Module
     - Role / hardware
   * - ``llcc_perfmon.ko``
     - performance counters for the LLCC system cache (:doc:`/soc/interconnect`)
   * - ``rmnet_shs.ko`` / ``rmnet_perf.ko``
     - the modem-data (RmNet) steering/perf accelerators for the IPA path
       (:doc:`/soc/ipa`, :doc:`/audio/dsp-firmware`)
   * - ``mpq-adapter.ko`` / ``mpq-dmx-hw-plugin.ko``
     - the MPEG/DVB demux adapter + hardware demux plugin (media pipeline;
       largely vestigial on an e-reader)
   * - ``rdbg.ko``
     - remote-debug transport to the DSP subsystems (a debug facility)

Note what is **not** a module because it is built into the kernel: UFS/ICE and
SDCC (:doc:`/soc/storage`), the clock/pinctrl/interconnect controllers
(:doc:`/soc/clocks`, :doc:`/soc/pinctrl`), the GPU ``kgsl`` driver
(:doc:`/soc/gpu`), and every Onyx input/display/backlight driver
(:doc:`/display/hal`, :doc:`/sensors/hal`).

HAL services and implementations
==================================

The VINTF manifest (``etc/vintf/manifest.xml``) declares **58 HAL entries**
in total, almost all over hwbinder, realised as ~44 service binaries in
``/vendor/bin/hw`` and ~60 implementation libraries in ``/vendor/lib64/hw``.
Audio, wireless, sensor and display HALs are catalogued on their own pages
(above); security/DRM HALs are in :doc:`security`. What's left is generic
platform plumbing and GPU/media compute:

.. list-table::
   :header-rows: 1
   :widths: 26 40 34

   * - HAL
     - Implementation
     - Hardware / cross-ref
   * - (renderscript / neuralnetworks / media)
     - ``vulkan.adreno.so``, ``renderscript@1.0-impl``,
       ``neuralnetworks@1.3-service-qti``, ``media.c2`` / ``media.omx``
     - Adreno A619 + the compute DSP / NPU (:doc:`/soc/gpu`,
       :doc:`/audio/dsp-firmware`)
   * - ``vibrator`` / ``power`` / ``thermal@2.0`` / ``health@2.1`` /
       ``usb@1.2`` / ``boot@1.1``
     - ``vibrator.default``, ``power.default``, ``pasrmanager``, ``perf@2.2``,
       ``iop@2.0``, ``limits@1.0``
     - Awinic haptic, DCVS/thermal/limits (:doc:`/soc/thermal`), charger
       (:doc:`/soc/pmic`), A/B boot-control (:doc:`security`)

Security and DRM HALs — ``keymaster@4.{0,1}``, ``gatekeeper``, the Widevine /
ClearKey DRM services, ``cas``, ``qseecom`` / ``qteeconnector`` / ``soter`` /
``tui_comm`` / ``esepowermanager`` (embedded Secure Element power management,
pairs with the disabled NFC HAL in :doc:`/wireless/hal`) — are catalogued in
:doc:`security`. The ``cas`` HAL (``android.hardware.cas@1.2-service``, for
broadcast/streaming Conditional Access) pairs with the ``mpq-*`` demux
modules above; both are largely vestigial here.

Present HALs for disabled features
=====================================

As with the SoC-fabric leftovers (:doc:`/soc/absent-hardware`) and the
wireless-specific ones in :doc:`/wireless/hal`, one more HAL ships from the
Qualcomm/vendor reference image for hardware this device does not have —
declared unavailable in ``android.hardware.onyx_unavailable_features.xml``
(:doc:`/display/stack`) even though the HAL is on disk:

- **Camera** — ``camera.qcom.so`` + ``com.qti.chi.override.bitra.so`` (the
  Bitra-platform CHI) are present; no camera (:doc:`/soc/absent-hardware`).

Its presence on disk is reference-image baggage, not evidence of the
hardware — the unavailable-features list plus the DTB population settle
that question.

Provenance
==========

:Source: ``artifacts/super/vendor_a.img`` — ``lib/modules/{*.ko,modules.load}``
   (module set + boot load order), ``bin/hw/*`` and ``lib64/hw/*`` (HAL services
   and implementation libraries), ``etc/vintf/manifest.xml`` (HAL declarations);
   ``artifacts/boot_a/kernel_config.txt`` (which drivers are built-in vs modular).
:Method: ext4 image listed/extracted read-only with ``7z``; modules counted from
   ``modules.load``; HALs from ``bin/hw`` / ``lib64/hw`` names and the VINTF
   manifest. No code executed.
:Cross-refs: :doc:`/audio/hal`, :doc:`/wireless/hal`, :doc:`/sensors/hal`,
   :doc:`/display/hal` (domain-specific driver/HAL detail), :doc:`security`
   (security/DRM HALs), :doc:`/soc/interconnect` (LLCC perfmon),
   :doc:`/soc/ipa` (RmNet), :doc:`/soc/absent-hardware` (present-but-disabled
   HALs generally).