8.1. Bluetooth / FM controller firmware (WCN3990 “Cherokee”)

bluetooth_a is not an MBN/ELF firmware image like the coprocessor partitions — it is a FAT filesystem holding the patch and NVM (non-volatile config) files for the on-package Bluetooth + FM controller. Unlike the PIL images (TZ, HYP, ADSP, …) which XBL loads and authenticates at boot, these files are pushed into the controller by the kernel’s Bluetooth driver after the OS is up — but the firmware itself is below the Android userspace, so it is in scope here.

The device tree names the part exactly (artifacts/boot_a/board.dts):

bt_wcn3990 { compatible = "qca,wcn3990"; };
wcn3990   { compatible = "qcom,btfmslim_slave";
            qcom,btfm-slim-ifd = "btfmslim_slave_ifd";
            qcom,btfm-slim-ifd-elemental-addr = [00 00 20 02 17 02]; };

so the connectivity part is the Qualcomm QCA WCN3990 — an integrated WLAN + Bluetooth + FM combo. Its WLAN side is the Helium firmware (WLAN.HL.3.3.1-01884 in core_nhlos_a, loaded via qcom,icnss into wlan_fw_region@0x8b500000 — MSA phandle 0xb9 in Base kernel device tree (the SoC boot contract)); its Bluetooth/FM side is the Cherokee firmware in this partition. The two are the two subsystems of the same WCN3990 die. (NFC is a separate device; cellular MPSS is dormant, ADSP and CDSP firmware.)

8.1.1. Container

FAT (MSDOS5.0 BPB, volume label “NO NAME”), partition size 1 MiB. The BPB uses 4096-byte sectors (matching the UFS logical block size, Partition map and checksums), 4 sectors/cluster, 2 FATs. Files use VFAT long names; the payload is the standard QCA Cherokee set — crbtfwNN.tlv (BT patch, TLV-framed) paired with crnvNN.bin (BT NVM/calibration defaults), one pair per controller ROM revision:

Firmware files (by size / type)

Type

Size(s)

Role

*.tlv (BT patch)

230,260 (×2), 125,120, 56,180, 56,052, 29,368

crbtfwNN.tlv — TLV-framed controller patch RAM images, one per ROM rev

*.bin (BT NVM)

5,516 (×2), 4,875, 4,710, 3,936, 2,798, 1,243

crnvNN.bin — NVM / calibration and BD-address defaults per ROM rev

8.1.2. Version inventory

Embedded QC_IMAGE-style tags identify the Cherokee firmware revisions carried — selected at runtime by the driver based on the reported rom_version/ build_version (see Load mechanism below); that these five tags correspond to distinct silicon-stepping variants, specifically, is inferred from the naming/count, not confirmed from any Qualcomm document:

  • BTFM.CHE.1.1.0-00027-QCACHROM-1

  • BTFM.CHE.2.0.0-00082-QCACHROMZ-1

  • BTFM.CHE.2.1.5-00291-QCACHROMZ-1

  • BTFM.CHE.3.2.1-00273-QCACHROMZ-2

  • CI_BTFM.CHE.2.0.0-00076.1-QCACHROM-16 (a CI build)

BTFM.CHE = Bluetooth + FM, CHErokee (the WCN3990 BT/FM core); QCACHROMZ is the build variant. Multiple revisions (1.1 → 3.2) are shipped together, consistent with covering more than one WCN3990 stepping variant — the same inference as above, not confirmed from any Qualcomm document.

8.1.3. Load mechanism

The controller reports its own ROM identity, logged with the legacy patch-download format string retained from the earlier “Rome” combo:

Rome Patch... rom_version(0x%04x), build_version(0x%04x)

The host driver reads rom_version / build_version from the WCN3990 BT core, selects the matching crbtfwNN.tlv + crnvNN.bin, and downloads the TLV patch and NVM over the BT transport before the controller is brought up. (The “Rome Patch” wording is the historical name for this TLV patch mechanism; the silicon here is Cherokee/WCN3990, per the device tree, not Rome.)

8.1.4. Controller features (from firmware strings)

  • Coexistence with the on-die WLAN and with LTE: MCI_LOG BT WAIT CAL TO, MCI_LOG WLAN GRANT BT CAL (MCI = the WLAN↔BT message/coexistence interface), plus _COEX_MWS_, LTE STATE_IND / E_IND and SEND BT CAL / BT CAL DONE — the MWS (Mobile Wireless Standards) coex and BT calibration hand-shakes.

  • BLE Audio-over-LE (AoLE): AOLE: Voice, AOLE: SM, B_LE_AoL, SDB_LE_Ao — LE audio / voice streaming state machine.

  • BLE multi-advertising (MultiAdvInf) and temperature calibration (TempCal / Write_TempCal) — RF drift compensation.

  • FM radio shares the die; BT/FM audio is routed over SLIMbus (btfmslim_slave, elemental address 00 00 20 02 17 02 above) to the audio codec, distinct from the HCI control transport.

8.1.5. Relationship to the rest of the platform

This partition is one of the connectivity firmwares; the picture across the WCN3990 combo is:

Subsystem

Firmware

Loaded by / into

WLAN

Helium WLAN.HL.3.3.1-01884 (core_nhlos_a)

qcom,icnss → wlan_fw_region@0x8b500000 (Base kernel device tree (the SoC boot contract))

Bluetooth / FM

Cherokee BTFM.CHE.* (this partition)

host BT driver → WCN3990 BT core; audio via SLIMbus

Unlike the boot-critical PIL images, bluetooth_a is not part of the authenticated boot chain — it is plain FAT content read at runtime — so a bootloader replacement neither loads it nor is constrained by it. It is documented here to complete the connectivity firmware census alongside the WLAN image.

8.1.6. Provenance

Source:

_READONLY/lun4/bluetooth_a.bin (read-only); part identity from artifacts/boot_a/board.dts (qca,wcn3990 / btfmslim_slave nodes).

Method:

BPB/FAT header read; VFAT long-name and 8.3 directory-entry enumeration (file names/sizes); strings census for the BTFM.CHE version tags, the patch-download log format, and the coex / AoLE / TempCal feature tokens. No code executed; no files extracted.

Cross-refs:

ADSP and CDSP firmware (WLAN Helium firmware, MPSS), Base kernel device tree (the SoC boot contract) (ICNSS WLAN MSA region, connectivity DT nodes), Partition map and checksums (FAT partition, UFS block size), Secure world and coprocessors (TZ, HYP, trustlets) (contrast: PIL-authenticated coprocessors).