12.1. Firmware-blob inventory (the payloads)¶

The below-userspace documentation describes every firmware loader on this device: the TrustZone PAS authentication path and its PAS-ids (Secure world and coprocessors (TZ, HYP, trustlets)), the kernel PIL / subsys framework that brings up the DSPs and other peripherals (ADSP and CDSP firmware), the GPU zap/GMU load (GPU — Adreno A619, the GMU, and the zap shader), the IPA microcontroller load (IPA — the networking datapath accelerator) and the Bluetooth firmware download (Bluetooth / FM controller firmware (WCN3990 “Cherokee”)). What none of those can show — because the files live in Android userspace partitions — is the actual payload bits. This page is the inventory: every firmware blob shipped on the device, where it lives, and which loader consumes it.

Everything here is read statically from the extracted partition images (artifacts/super/vendor_a.img) and the raw firmware-bearing partitions (_READONLY/lun4/{modem,core_nhlos,dsp,bluetooth}_a.bin) with 7z. No code was executed.

12.1.1. Where firmware lives¶

Qualcomm’s subsys / PIL loader and the kernel request_firmware path search several mount points. On this device the firmware-bearing partitions are:

Partition	Mount / raw image	Holds
`vendor` (dir)	`/vendor/firmware`	GPU zap+GMU, fingerprint, IPA, camera-ICP, audio-PA config, touch, WLAN config — the peripheral blobs (The /vendor/firmware directory)
`modem`	`/firmware/image`, `modem_a.bin`	the base PIL images (`adsp`/`cdsp`/`modem`/`npu`/`venus` …), `wlanmdsp.mbn` and the WLAN board-data (The modem / NON-HLOS partitions)
`core_nhlos`	`core_nhlos_a.bin`	carrier `mcfg` configs, `widevine`, `rtic`, mirrored WLAN board-data (The modem / NON-HLOS partitions)
`dsp`	`/vendor/dsp`, `dsp_a.bin`	runtime-loadable Hexagon modules (The dsp partition)
`bluetooth`	`/vendor/bt_firmware/image`, `bluetooth_a.bin`	the QCA Bluetooth firmware (The bt_firmware partition)

/vendor/firmware also contains the rfs/ symlink skeleton (rfs/{msm,mdm,apq}/{adsp,cdsp,mpss,slpi,…}/readonly/firmware) that points the DSPs at their remote-filesystem storage — no payload of its own, just the RFS plumbing.

12.1.2. The /vendor/firmware directory¶

Blob(s)	What it is / loaded by	Loader doc
`a615_zap.{mdt,b00,b01,b02,elf}`	the GPU zap shader — authenticated & run by TZ via PAS-id 13 (the `a615_zap` the DTB names, despite the A619 GPU)	GPU — Adreno A619, the GMU, and the zap shader, Secure world and coprocessors (TZ, HYP, trustlets)
`a619_gmu.bin`	the Adreno A619 GMU microcontroller microcode, loaded by the in-kernel `kgsl` driver	GPU — Adreno A619, the GMU, and the zap shader
`a630_sqe.fw`	the a6xx CP SQE microcode (the a6xx family shares one SQE image), loaded by `kgsl`	GPU — Adreno A619, the GMU, and the zap shader
`a620_zap.`, `a650_zap.`, `a650_gmu.bin`, `a650_sqe.fw`	reference-design leftovers for other Adreno parts — unused on the A619	Absent and vestigial hardware (reference-base leftovers)
`ipa_fws.` + `lagoon_ipa_fws.`	the IPA (IP Accelerator) microcontroller firmware; the `lagoon_` variant is the SM6350-specific one	IPA — the networking datapath accelerator
`fpchips64.`, `mafp.{mbn,mdt,b}`, `sw_fp.*`	three fingerprint-vendor firmware sets (matching the kernel’s ChipSailing / MicroArray / Fortsense drivers; `mafp` ≈ MicroArray). The device is inferred, from the blob-selection logic, to load whichever matches the installed sensor — not confirmed by a runtime trace	Pin control — TLMM and the PMIC GPIOs (FP IRQ/reset/CS pins)
`awinic/aw87xxx_acf.bin`	the Awinic aw87xxx smart-PA (speaker amplifier) tuning config, used by the audio driver	ADSP and CDSP firmware (audio fabric)
`tp_fw/PT_PIP2_NOTEX_SHENGDIRUI2_5DMM_FW.bin`	the Parade touch-controller firmware (PIP2 protocol), flashed by the touch driver	The e-ink software stack (Onyx EPDC), Pin control — TLMM and the PMIC GPIOs
`CAMERA_ICP.elf`	the camera ICP (Image Control Processor) firmware — unused (no camera)	Absent and vestigial hardware (reference-base leftovers)
`wigig/wigig.ini`	60 GHz WiGig config — unused	Absent and vestigial hardware (reference-base leftovers)
`wlan/qca_cld/{WCNSS_qcom_cfg.ini, wlan_mac.bin}`, `wlanmdsp.otaupdate`	WLAN driver config + MAC-address file (the WLAN firmware itself is `wlanmdsp.mbn` on the modem partition, below)	ADSP and CDSP firmware

The GPU entries directly confirm the firmware-inventory table in GPU — Adreno A619, the GMU, and the zap shader: a615_zap (TZ/PAS), a619_gmu.bin and a630_sqe.fw (kernel-loaded) are all present; the a620/a650 blobs are the unused reference leftovers.

12.1.3. The modem / NON-HLOS partitions¶

The modem partition mounts at /firmware and carries the base PIL images — the .mdt metadata/hash headers plus their .bNN loadable segments, in the same TZ-signed MBN/MDT format as the rest of the boot chain (Secure world and coprocessors (TZ, HYP, trustlets)). /firmware/image holds:

adsp.mdt (+ ~33 adsp.bNN), cdsp.mdt, modem.mdt — the audio DSP, compute DSP and modem (MPSS) images, i.e. the payloads for the PIL subsystems described in ADSP and CDSP firmware;
npu.mdt, venus.mdt — the NPU and Venus (video codec) images;
featenabler.mdt, qwes.mdt — the feature-enabler and Qualcomm Wireless Edge Services images;
gptest.mdt, smplap32/64.mdt, soter64.mdt, loadalgota64.mdt — secure test / helper trustapp images;
wlanmdsp.mbn (~4 MB) — the WLAN firmware for the integrated WCN subsystem, plus 43 ``bdwlan.*`` board-data files (per-board / per-region RF calibration, selected by board-id).

The separate core_nhlos partition carries the non-HLOS remainder: the modem carrier-configuration tree modem_pr/mcfg/ (mcfg_hw for DSDS/SS/CDMA-less variants and dozens of mcfg_sw carrier profiles), a mirrored WLAN board-data set, and widevine, rtic (Real-Time Integrity Checker) and version-info blobs. The full carrier mcfg set is present even though telephony is declared unavailable on this device (android.hardware.telephony is in onyx_unavailable_features.xml) — inferred to be reference-design baggage, left dormant for lack of a cellular front-end, rather than confirmed removed or disabled by any specific flag (Absent and vestigial hardware (reference-base leftovers), ADSP and CDSP firmware).

12.1.4. The dsp partition¶

The dsp partition (ext4, /vendor/dsp) does not hold base images — it holds the runtime-loadable Hexagon shared objects that the ADSP and CDSP pull on demand over fastRPC once they are running:

adsp/ — audio codec modules (*DecoderModule.so for FLAC/ALAC/APE/ Vorbis/WMA/HE-AAC, LdacModule), the Fluence voice-processing suite (fluence_*, smecns/mmecns echo-cancel/noise-suppression) and sensor modules (sns_*);
cdsp/ — the compute-DSP runtime (libc++, libsysmon*, libvpp_* video post-processing, libhta_dsp_skel NN offload, libbenchmark_skel).

These are the second stage of the DSP story: ADSP and CDSP firmware covers bringing the DSP up (the adsp/cdsp PIL images above); these modules are what runs on it afterward.

12.1.5. The bt_firmware partition¶

The bluetooth partition (FAT, /vendor/bt_firmware/image) holds the QCA Bluetooth firmware downloaded by the BT driver over the UART/SMD link (Bluetooth / FM controller firmware (WCN3990 “Cherokee”)): patch/firmware TLVs crbtfw{11,20,21,32}.tlv and apbtfw{10,11}.tlv with their NV/calibration files crnv{11,20,21,32}.bin (and crnv32u) / apnv{10,11}.bin — multiple chip-revision variants, the driver selecting the pair that matches the silicon it finds.

12.1.6. Format and authentication¶

The .mdt / .bNN and .mbn blobs are Qualcomm’s split/combined ELF firmware format: the .mdt is the ELF header plus the hash-table segment that TrustZone verifies, and the .bNN files are the individual loadable segments; a .mbn is the same thing combined into one file. Authentication is a TZ/PAS action keyed by PAS-id — the mechanism, the signing story and the test-key situation are all in Secure world and coprocessors (TZ, HYP, trustlets). This page only locates the files; it does not re-describe the trust model.

12.1.7. Scope boundary¶

This inventory is the payload half of the firmware story; the loader half is the below-userspace documentation it cross-references. Not covered: the contents of the signed blobs (they are opaque authenticated images, and the DSP/modem/GPU firmware itself was not decompiled), the persist calibration partition, and anything in the system/product partitions that is pure Android userspace.

12.1.8. Provenance¶

Source:: artifacts/super/vendor_a.img (the /vendor/firmware tree, the rfs skeleton, lib/modules census), and the raw partitions _READONLY/lun4/modem_a.bin (/firmware/image PIL images, wlanmdsp.mbn, bdwlan.*), core_nhlos_a.bin (modem_pr/mcfg, widevine, rtic), dsp_a.bin (/vendor/dsp runtime modules), bluetooth_a.bin (bt_firmware TLV/NV). Absent-hardware cross-checks from android.hardware.onyx_unavailable_features.xml.
Method:: ext4/FAT images listed read-only with 7z; blobs identified by name, split-segment layout and size. No code executed and no blob contents parsed.
Cross-refs:: Secure world and coprocessors (TZ, HYP, trustlets) (PAS/TZ authentication, PAS-ids), ADSP and CDSP firmware (ADSP/CDSP/MPSS PIL subsystems + audio), GPU — Adreno A619, the GMU, and the zap shader (zap/GMU/SQE), IPA — the networking datapath accelerator (IPA firmware), Bluetooth / FM controller firmware (WCN3990 “Cherokee”) (BT download), Partition map and checksums (partition layout), Absent and vestigial hardware (reference-base leftovers) (unused camera/WiGig/carrier assets), The e-ink software stack (Onyx EPDC) (touch firmware, CONFIG_EXTRA_FIRMWARE waveform).