8.3. Wireless drivers and HAL¶

The wireless-radio slice of the vendor driver/HAL layer — split out from the general HAL catalogue (Vendor drivers and HALs) because it belongs next to the Bluetooth firmware/protocol pages in this section (Bluetooth / FM controller firmware (WCN3990 “Cherokee”), Bluetooth A2DP sink-latency: a two-bug chain in the HAL path (one confirmed, one inferred)). Covers Bluetooth, WLAN, and the present-but-disabled NFC/GNSS/FM/ANT+ HALs.

Everything here is from vendor_a.img (lib/modules/, bin/hw/, lib64/hw/, etc/vintf/manifest.xml) read with 7z, cross-checked against kernel_config.txt. No code was executed.

8.3.1. Loadable kernel module¶

Module	Role / hardware
`qca_cld3_wlan.ko`	the WLAN driver (~10.5 MB) — loads `wlanmdsp.mbn` + `bdwlan.*` board data (Firmware-blob inventory (the payloads)), paired with the `wifi@1.0` HAL

8.3.2. HAL services and implementations¶

HAL	Implementation	Hardware / cross-ref
`wifi@1.0-service` + `hostapd` / `wpa_supplicant`	(uses `qca_cld3_wlan.ko`)	WLAN (Firmware-blob inventory (the payloads))
`bluetooth@1.0-service-qti`	`bluetooth@1.0-impl-qti`, `bluetooth_audio`, `bluetooth_sar`, `btconfigstore`	QCA BT (Bluetooth / FM controller firmware (WCN3990 “Cherokee”))

The bluetooth_audio entry above is not just a static binding: static disassembly of btaudio_offload_if.so / libbluetooth_audio_session_qti.so against the Bluetooth Mainline APEX turned up a two-bug chain — a confirmed permanent latency-value staleness bug, plus an inferred 10⁵ unit-scaling bug that wraps through a 16-bit field — behind a real logged symptom — see Bluetooth A2DP sink-latency: a two-bug chain in the HAL path (one confirmed, one inferred).

8.3.3. Present HALs for disabled features¶

As with the SoC-fabric leftovers (Absent and vestigial hardware (reference-base leftovers)), several radio HALs ship from the Qualcomm/vendor reference image for features this device does not enable — declared unavailable in android.hardware.onyx_unavailable_features.xml (The e-ink software stack (Onyx EPDC)) even though the HAL is on disk:

NFC — vendor.nxp.hardware.nfc@2.0-service is present; NFC is declared unavailable.
GNSS/GPS — gnss@2.1-service-qti + vendor.qti.gnss@4.3-impl present; location.gps declared unavailable.
FM radio / ANT+ — vendor.qti.hardware.fm@1.0-impl and com.dsi.ant@1.0-impl present; no evidence either is wired.

Their presence is confirmed on disk; the reason is most plausibly reference-design baggage rather than something this device actually uses — an inference from the fact that they ship unused, not confirmed from any build note; the authoritative “what this device actually has” signal is the unavailable-features list plus the DTB population, not the HAL inventory.

8.3.4. Provenance¶

Source:: artifacts/super/vendor_a.img — lib/modules/{*.ko,modules.load} (module set + boot load order), bin/hw/* and lib64/hw/* (HAL service and implementation libraries), etc/vintf/manifest.xml (HAL declaration); artifacts/boot_a/kernel_config.txt.
Method:: ext4 image listed/extracted read-only with 7z; modules counted from modules.load; HAL from bin/hw / lib64/hw names and the VINTF manifest. No code executed.
Cross-refs:: Bluetooth / FM controller firmware (WCN3990 “Cherokee”) (BT firmware), Bluetooth A2DP sink-latency: a two-bug chain in the HAL path (one confirmed, one inferred) (the two-bug chain behind bluetooth_audio), Firmware-blob inventory (the payloads) (WLAN/BT firmware), Vendor drivers and HALs (the rest of the HAL/module catalogue), Absent and vestigial hardware (reference-base leftovers) (present-but-disabled HALs generally).