Firstly you could refer the article about how to provision the phone firmware.
Like phonebook provisioning, PBX acts as TFTP server for the clients to download.
1. File Path
In the SSH or FTP, you could find the path to check or debug.
The firmware you upload would store in the path: /ysdisk/tftpboot/upload/firmware.
2. Firmware Parameter in Configuration File
You might consider how does the IP phone know where to download the firmware file.
The key is in the configuration file.
You could enter the SSH path: /ysdisk/tftpboot. In the following figure, it shows a Yealink configuration file.
If you check this file, you would the file phonebook config in it. See the URL in the red fram of following figure.
The firmware download flow would happen after the phone load the configuration file by provisioning. Which is very similar with the phonebook download.