The “firmware” is whatever program a microcontroller runs. On an
Arduino, it is typically the program you write and upload into the
microcontroller's flash memory.
If by “firmware” you mean the core library (the source code of
digitalRead() and so on), it is here:
If by “firmware” you mean the bootloader (the small program that runs at
reset and will accept the upload of your firmware), is is here:
Note that this is valid for the AVR-based Arduinos.
The cores and bootloaders used in other architectures are stored is
separate repositories, e.g.