12.2. Vendor drivers and HALs

Between the SoC hardware documented in SoC platform fabric and the Android framework sits the vendor driver/HAL layer: the loadable kernel modules that init inserts at boot, and the HAL (Hardware Abstraction Layer) services and libraries that expose each device to the framework over hwbinder. The bulk of this layer is domain-specific and lives next to the relevant hardware pages instead of one giant catalogue:

This page is the leftover: the loadable modules and HALs that don’t belong to any single domain above, plus the totals for the layer as a whole.

Everything here is from vendor_a.img (lib/modules/, bin/hw/, lib64/hw/, etc/vintf/manifest.xml) read with 7z, cross-checked against kernel_config.txt. No code was executed.

12.2.1. Loadable kernel modules

/vendor/lib/modules holds 37 .ko files; modules.load gives the boot insertion order. 29 of the 37 are the audio fabric (Audio drivers and HAL) and 1 is the WLAN driver (Wireless drivers and HAL); the remaining 7 are generic SoC/platform plumbing with no single domain home:

Module

Role / hardware

llcc_perfmon.ko

performance counters for the LLCC system cache (Interconnect — NoC / BCM and the LLCC)

rmnet_shs.ko / rmnet_perf.ko

the modem-data (RmNet) steering/perf accelerators for the IPA path (IPA — the networking datapath accelerator, ADSP and CDSP firmware)

mpq-adapter.ko / mpq-dmx-hw-plugin.ko

the MPEG/DVB demux adapter + hardware demux plugin (media pipeline; largely vestigial on an e-reader)

rdbg.ko

remote-debug transport to the DSP subsystems (a debug facility)

Note what is not a module because it is built into the kernel: UFS/ICE and SDCC (Storage controllers — UFS, ICE, and SDCC), the clock/pinctrl/interconnect controllers (Clock tree — GCC, domain CCs, RPMh, Pin control — TLMM and the PMIC GPIOs), the GPU kgsl driver (GPU — Adreno A619, the GMU, and the zap shader), and every Onyx input/display/backlight driver (Display drivers and HAL, Sensor drivers and HAL).

12.2.2. HAL services and implementations

The VINTF manifest (etc/vintf/manifest.xml) declares 58 HAL entries in total, almost all over hwbinder, realised as ~44 service binaries in /vendor/bin/hw and ~60 implementation libraries in /vendor/lib64/hw. Audio, wireless, sensor and display HALs are catalogued on their own pages (above); security/DRM HALs are in Security and DRM userspace. What’s left is generic platform plumbing and GPU/media compute:

HAL

Implementation

Hardware / cross-ref

(renderscript / neuralnetworks / media)

vulkan.adreno.so, renderscript@1.0-impl, neuralnetworks@1.3-service-qti, media.c2 / media.omx

Adreno A619 + the compute DSP / NPU (GPU — Adreno A619, the GMU, and the zap shader, ADSP and CDSP firmware)

vibrator / power / thermal@2.0 / health@2.1 / usb@1.2 / boot@1.1

vibrator.default, power.default, pasrmanager, perf@2.2, iop@2.0, limits@1.0

Awinic haptic, DCVS/thermal/limits (Thermal management (tsens, zones, mitigation)), charger (PMIC reset timers, charging and reachability), A/B boot-control (Security and DRM userspace)

Security and DRM HALs — keymaster@4.{0,1}, gatekeeper, the Widevine / ClearKey DRM services, cas, qseecom / qteeconnector / soter / tui_comm / esepowermanager (embedded Secure Element power management, pairs with the disabled NFC HAL in Wireless drivers and HAL) — are catalogued in Security and DRM userspace. The cas HAL (android.hardware.cas@1.2-service, for broadcast/streaming Conditional Access) pairs with the mpq-* demux modules above; both are largely vestigial here.

12.2.3. Present HALs for disabled features

As with the SoC-fabric leftovers (Absent and vestigial hardware (reference-base leftovers)) and the wireless-specific ones in Wireless drivers and HAL, one more HAL ships from the Qualcomm/vendor reference image for hardware this device does not have — declared unavailable in android.hardware.onyx_unavailable_features.xml (The e-ink software stack (Onyx EPDC)) even though the HAL is on disk:

Its presence on disk is reference-image baggage, not evidence of the hardware — the unavailable-features list plus the DTB population settle that question.

12.2.4. Provenance

Source:

artifacts/super/vendor_a.img — lib/modules/{*.ko,modules.load} (module set + boot load order), bin/hw/* and lib64/hw/* (HAL services and implementation libraries), etc/vintf/manifest.xml (HAL declarations); artifacts/boot_a/kernel_config.txt (which drivers are built-in vs modular).

Method:

ext4 image listed/extracted read-only with 7z; modules counted from modules.load; HALs from bin/hw / lib64/hw names and the VINTF manifest. No code executed.

Cross-refs:

Audio drivers and HAL, Wireless drivers and HAL, Sensor drivers and HAL, Display drivers and HAL (domain-specific driver/HAL detail), Security and DRM userspace (security/DRM HALs), Interconnect — NoC / BCM and the LLCC (LLCC perfmon), IPA — the networking datapath accelerator (RmNet), Absent and vestigial hardware (reference-base leftovers) (present-but-disabled HALs generally).