====================================== Firmware-blob inventory (the payloads) ====================================== The below-userspace documentation describes every firmware *loader* on this device: the TrustZone PAS authentication path and its PAS-ids (:doc:`/trustzone/secure-world`), the kernel PIL / ``subsys`` framework that brings up the DSPs and other peripherals (:doc:`/audio/dsp-firmware`), the GPU zap/GMU load (:doc:`/soc/gpu`), the IPA microcontroller load (:doc:`/soc/ipa`) and the Bluetooth firmware download (:doc:`/wireless/bluetooth`). What none of those can show — because the files live *in Android userspace partitions* — is the actual **payload bits**. This page is the inventory: every firmware blob shipped on the device, where it lives, and which loader consumes it. Everything here is read statically from the extracted partition images (``artifacts/super/vendor_a.img``) and the raw firmware-bearing partitions (``_READONLY/lun4/{modem,core_nhlos,dsp,bluetooth}_a.bin``) with ``7z``. No code was executed. Where firmware lives ==================== Qualcomm's ``subsys`` / PIL loader and the kernel ``request_firmware`` path search several mount points. On this device the firmware-bearing partitions are: .. list-table:: :header-rows: 1 :widths: 20 20 60 * - Partition - Mount / raw image - Holds * - ``vendor`` (dir) - ``/vendor/firmware`` - GPU zap+GMU, fingerprint, IPA, camera-ICP, audio-PA config, touch, WLAN config — the peripheral blobs (`The /vendor/firmware directory`_) * - ``modem`` - ``/firmware/image``, ``modem_a.bin`` - the base PIL images (``adsp``/``cdsp``/``modem``/``npu``/``venus`` …), ``wlanmdsp.mbn`` and the WLAN board-data (`The modem / NON-HLOS partitions`_) * - ``core_nhlos`` - ``core_nhlos_a.bin`` - carrier ``mcfg`` configs, ``widevine``, ``rtic``, mirrored WLAN board-data (`The modem / NON-HLOS partitions`_) * - ``dsp`` - ``/vendor/dsp``, ``dsp_a.bin`` - runtime-loadable Hexagon modules (`The dsp partition`_) * - ``bluetooth`` - ``/vendor/bt_firmware/image``, ``bluetooth_a.bin`` - the QCA Bluetooth firmware (`The bt_firmware partition`_) ``/vendor/firmware`` also contains the ``rfs/`` symlink skeleton (``rfs/{msm,mdm,apq}/{adsp,cdsp,mpss,slpi,…}/readonly/firmware``) that points the DSPs at their remote-filesystem storage — no payload of its own, just the RFS plumbing. The /vendor/firmware directory ============================== .. list-table:: :header-rows: 1 :widths: 30 44 26 * - Blob(s) - What it is / loaded by - Loader doc * - ``a615_zap.{mdt,b00,b01,b02,elf}`` - the GPU **zap shader** — authenticated & run by TZ via **PAS-id 13** (the ``a615_zap`` the DTB names, despite the A619 GPU) - :doc:`/soc/gpu`, :doc:`/trustzone/secure-world` * - ``a619_gmu.bin`` - the Adreno **A619 GMU** microcontroller microcode, loaded by the in-kernel ``kgsl`` driver - :doc:`/soc/gpu` * - ``a630_sqe.fw`` - the a6xx **CP SQE** microcode (the a6xx family shares one SQE image), loaded by ``kgsl`` - :doc:`/soc/gpu` * - ``a620_zap.*``, ``a650_zap.*``, ``a650_gmu.bin``, ``a650_sqe.fw`` - reference-design leftovers for other Adreno parts — **unused** on the A619 - :doc:`/soc/absent-hardware` * - ``ipa_fws.*`` + ``lagoon_ipa_fws.*`` - the **IPA** (IP Accelerator) microcontroller firmware; the ``lagoon_`` variant is the SM6350-specific one - :doc:`/soc/ipa` * - ``fpchips64.*``, ``mafp.{mbn,mdt,b*}``, ``sw_fp.*`` - three **fingerprint**-vendor firmware sets (matching the kernel's ChipSailing / MicroArray / Fortsense drivers; ``mafp`` ≈ MicroArray). The device is inferred, from the blob-selection logic, to load whichever matches the installed sensor — not confirmed by a runtime trace - :doc:`/soc/pinctrl` (FP IRQ/reset/CS pins) * - ``awinic/aw87xxx_acf.bin`` - the **Awinic aw87xxx smart-PA** (speaker amplifier) tuning config, used by the audio driver - :doc:`/audio/dsp-firmware` (audio fabric) * - ``tp_fw/PT_PIP2_NOTEX_SHENGDIRUI2_5DMM_FW.bin`` - the **Parade** touch-controller firmware (PIP2 protocol), flashed by the touch driver - :doc:`/display/stack`, :doc:`/soc/pinctrl` * - ``CAMERA_ICP.elf`` - the camera **ICP** (Image Control Processor) firmware — **unused** (no camera) - :doc:`/soc/absent-hardware` * - ``wigig/wigig.ini`` - 60 GHz **WiGig** config — **unused** - :doc:`/soc/absent-hardware` * - ``wlan/qca_cld/{WCNSS_qcom_cfg.ini, wlan_mac.bin}``, ``wlanmdsp.otaupdate`` - WLAN driver config + MAC-address file (the WLAN *firmware* itself is ``wlanmdsp.mbn`` on the modem partition, below) - :doc:`/audio/dsp-firmware` The GPU entries directly confirm the firmware-inventory table in :doc:`/soc/gpu`: ``a615_zap`` (TZ/PAS), ``a619_gmu.bin`` and ``a630_sqe.fw`` (kernel-loaded) are all present; the ``a620``/``a650`` blobs are the unused reference leftovers. The modem / NON-HLOS partitions =============================== The ``modem`` partition mounts at ``/firmware`` and carries the base PIL images — the ``.mdt`` metadata/hash headers plus their ``.bNN`` loadable segments, in the same TZ-signed MBN/MDT format as the rest of the boot chain (:doc:`/trustzone/secure-world`). ``/firmware/image`` holds: - ``adsp.mdt`` (+ ~33 ``adsp.bNN``), ``cdsp.mdt``, ``modem.mdt`` — the audio DSP, compute DSP and modem (MPSS) images, i.e. the payloads for the PIL subsystems described in :doc:`/audio/dsp-firmware`; - ``npu.mdt``, ``venus.mdt`` — the NPU and Venus (video codec) images; - ``featenabler.mdt``, ``qwes.mdt`` — the feature-enabler and Qualcomm Wireless Edge Services images; - ``gptest.mdt``, ``smplap32/64.mdt``, ``soter64.mdt``, ``loadalgota64.mdt`` — secure test / helper trustapp images; - ``wlanmdsp.mbn`` (~4 MB) — the **WLAN firmware** for the integrated WCN subsystem, plus **43 ``bdwlan.*`` board-data files** (per-board / per-region RF calibration, selected by board-id). The separate ``core_nhlos`` partition carries the non-HLOS remainder: the modem carrier-configuration tree ``modem_pr/mcfg/`` (``mcfg_hw`` for DSDS/SS/CDMA-less variants and dozens of ``mcfg_sw`` carrier profiles), a mirrored WLAN board-data set, and ``widevine``, ``rtic`` (Real-Time Integrity Checker) and version-info blobs. The full carrier ``mcfg`` set is present even though **telephony is declared unavailable** on this device (``android.hardware.telephony`` is in ``onyx_unavailable_features.xml``) — inferred to be reference-design baggage, left dormant for lack of a cellular front-end, rather than confirmed removed or disabled by any specific flag (:doc:`/soc/absent-hardware`, :doc:`/audio/dsp-firmware`). The dsp partition ================= The ``dsp`` partition (ext4, ``/vendor/dsp``) does not hold base images — it holds the **runtime-loadable** Hexagon shared objects that the ADSP and CDSP pull on demand over fastRPC once they are running: - ``adsp/`` — audio codec modules (``*DecoderModule.so`` for FLAC/ALAC/APE/ Vorbis/WMA/HE-AAC, ``LdacModule``), the **Fluence** voice-processing suite (``fluence_*``, ``smecns``/``mmecns`` echo-cancel/noise-suppression) and sensor modules (``sns_*``); - ``cdsp/`` — the compute-DSP runtime (``libc++``, ``libsysmon*``, ``libvpp_*`` video post-processing, ``libhta_dsp_skel`` NN offload, ``libbenchmark_skel``). These are the second stage of the DSP story: :doc:`/audio/dsp-firmware` covers bringing the DSP *up* (the ``adsp``/``cdsp`` PIL images above); these modules are what runs *on* it afterward. The bt_firmware partition ========================= The ``bluetooth`` partition (FAT, ``/vendor/bt_firmware/image``) holds the QCA Bluetooth firmware downloaded by the BT driver over the UART/SMD link (:doc:`/wireless/bluetooth`): patch/firmware TLVs ``crbtfw{11,20,21,32}.tlv`` and ``apbtfw{10,11}.tlv`` with their NV/calibration files ``crnv{11,20,21,32}.bin`` (and ``crnv32u``) / ``apnv{10,11}.bin`` — multiple chip-revision variants, the driver selecting the pair that matches the silicon it finds. Format and authentication ========================= The ``.mdt`` / ``.bNN`` and ``.mbn`` blobs are Qualcomm's split/​combined ELF firmware format: the ``.mdt`` is the ELF header plus the hash-table segment that TrustZone verifies, and the ``.bNN`` files are the individual loadable segments; a ``.mbn`` is the same thing combined into one file. Authentication is a TZ/PAS action keyed by PAS-id — the mechanism, the signing story and the test-key situation are all in :doc:`/trustzone/secure-world`. This page only locates the files; it does not re-describe the trust model. Scope boundary ============== This inventory is the payload half of the firmware story; the loader half is the below-userspace documentation it cross-references. Not covered: the *contents* of the signed blobs (they are opaque authenticated images, and the DSP/modem/GPU firmware itself was not decompiled), the ``persist`` calibration partition, and anything in the ``system``/``product`` partitions that is pure Android userspace. Provenance ========== :Source: ``artifacts/super/vendor_a.img`` (the ``/vendor/firmware`` tree, the ``rfs`` skeleton, ``lib/modules`` census), and the raw partitions ``_READONLY/lun4/modem_a.bin`` (``/firmware/image`` PIL images, ``wlanmdsp.mbn``, ``bdwlan.*``), ``core_nhlos_a.bin`` (``modem_pr/mcfg``, ``widevine``, ``rtic``), ``dsp_a.bin`` (``/vendor/dsp`` runtime modules), ``bluetooth_a.bin`` (``bt_firmware`` TLV/NV). Absent-hardware cross-checks from ``android.hardware.onyx_unavailable_features.xml``. :Method: ext4/FAT images listed read-only with ``7z``; blobs identified by name, split-segment layout and size. No code executed and no blob contents parsed. :Cross-refs: :doc:`/trustzone/secure-world` (PAS/TZ authentication, PAS-ids), :doc:`/audio/dsp-firmware` (ADSP/CDSP/MPSS PIL subsystems + audio), :doc:`/soc/gpu` (zap/GMU/SQE), :doc:`/soc/ipa` (IPA firmware), :doc:`/wireless/bluetooth` (BT download), :doc:`/partition-map` (partition layout), :doc:`/soc/absent-hardware` (unused camera/WiGig/carrier assets), :doc:`/display/stack` (touch firmware, CONFIG_EXTRA_FIRMWARE waveform).