7. SoC platform fabric

The SM6350 (lagoon) on-die fabric that sits below the peripheral drivers and below Android userspace: the storage controllers and their inline crypto, the TLMM pin-mux, the clock controllers, the RPMh-voted interconnect and system cache, the GPU/GMU coprocessor, the Always-On Processor (AOP), the PMICs, the IPA modem-data accelerator, and thermal management. These are the blocks a replacement bootloader has to bring up (clocks, pinmux, storage) or account for (GPU, system cache) before it can load and hand off an image. TrustZone and the other secure-world images are documented separately, in TrustZone.

Everything here is static: device-tree nodes from artifacts/boot_a/board.dts and the dtbo_a overlays, the XBL uefiplat.cfg MMAP table and config keys carved from _READONLY/lun1/xbl_a.bin, and artifacts/boot_a/kernel_config.txt. No code was executed; where a fact needs a live register read to confirm, it is called out as such and folded into Open questions and limits of analysis.

• 7.1. Storage controllers — UFS, ICE, and SDCC
• 7.2. Pin control — TLMM and the PMIC GPIOs
• 7.3. Clock tree — GCC, domain CCs, RPMh
• 7.4. Interconnect — NoC / BCM and the LLCC
• 7.5. GPU — Adreno A619, the GMU, and the zap shader
• 7.6. Absent and vestigial hardware (reference-base leftovers)
• 7.7. PMIC reset timers, charging and reachability
• 7.8. AOP — the Always-On Processor (RPMh / power back-end)
• 7.9. IPA — the networking datapath accelerator
• 7.10. Thermal management (tsens, zones, mitigation)