# How Filogic (MT7981/MT7986) WiFi boots — the four images and three cores

All claims cited to Linux source (mt76 driver unless noted) or to observed
blob content (`docs/findings.md`, `dataset/history.jsonl`). Inference is
marked INFERENCE.

## The cast

The WiFi subsystem of a Filogic SoC contains three processor cores plus a
masked boot ROM, programmed by the kernel driver at probe time:

| Image | Runs on | Role |
|---|---|---|
| `mt79xx_rom_patch.bin` | patch RAM over boot ROM behavior | small fixup applied before main firmware (evidence: `mt76_connac2_load_patch()`; patch strings `sys_patch_common_mcu.c`) |
| `mt79xx_wm.bin` | WM core ("neptune") | main MAC/PHY firmware: TX/RX control, rate adaptation, MU (MURU) scheduling, calibration, power/thermal (INFERENCE from strings: `RA_PARAM_*`, `MURU_*`, `DPD Pparam … Do Cal`, `LPTPO`/`EVMTPO`) |
| `mt79xx_wa.bin` | WA core | offload/queue-management firmware (INFERENCE: separate load target in driver; distinct ILM/DLM addresses `0x10200000`/`0x10300000`) |
| `mt79xx_wo*.bin` | WED offload core | packet DMA between WiFi and ethernet; FreeRTOS v10.0/NDS32 (string evidence). Loaded NOT by mt76 but by the ethernet WED driver: `drivers/net/ethernet/mediatek/mtk_wed_mcu.c` |

WM/WA/WO firmware is NDS32LE (`docs/format.md` §ISA).

## Load sequence (mt7915e driver, SoC/PCIe)

Cited: `mt7915/mcu.c: mt7915_mcu_init()` →
`mt7915_load_firmware()`; helpers in `mt76_connac_mcu.c`.

1. Driver acquires the patch semaphore
   (`mt76_connac_mcu_get_patch_sem()`, MCU PATCH_SEM_CONTROL message).
2. Patch download: `mt76_connac2_load_patch()` parses the BE patch
   container, busmaster-writes each section to its `addr` (observed
   `0x00900000` patch RAM), resets the MCU, waits for `FW_STATE_RDY`
   handshake.
3. Patch semaphore released; WM container loaded
   (`mt76_connac2_load_ram` → `mt76_connac2_send_ram`): regions streamed in
   table order to their `addr` destinations.
4. WA container loaded the same way, then the driver polls for
   firmware-ready (`mt7915_mcu_fw_log`, `fw_own` handshake in
   `mt76_connac_mcu.c`).
5. On SoCs with WED, `mtk_wed` (ethernet driver) separately loads WO
   firmware for the offload core (cited: `mtk_wed_mcu.c`).

No signature verification exists anywhere on this path: the loader computes
nothing cryptographic, and the optional per-region encryption
(`FW_FEATURE_SET_ENCRYPT`) is unset in every observed revision — so blobs on
this platform are freely replaceable at the OS level
(INFERENCE from absence + plaintext; hardware-empirical confirmation is a
planned P2 milestone).

## Download destinations (observed, mt7981 WM)

| Address family | feature_set | observed in |
|---|---|---|
| `0x0041xxxx`, `0x0023xxxx` | 0x00 | data-ish regions |
| `0x0220xxxx–0x0233xxxx` | 0x00 / 0x20 | code+data (region 0 carries OVERRIDE_ADDR) |
| `0xe003xxxx–0xe009xxxx` | 0x00 | large code regions |
| `0xf000xxxx–0xf009xxxx` | **0x80 (bit7, undefined upstream — U1)** | consistently flagged |

Meaning of these bus ranges beyond "download destinations": not yet
established (see PLAN open items; will be mapped in P1 RE against
`mt7915/regs.h`).