Skip to content

iwlwifi: gen3 peripheral scratch structure - #395

Open
eKisNonos wants to merge 1 commit into
mainfrom
iwlwifi-gen3-prph-scratch
Open

iwlwifi: gen3 peripheral scratch structure#395
eKisNonos wants to merge 1 commit into
mainfrom
iwlwifi-gen3-prph-scratch

Conversation

@eKisNonos

Copy link
Copy Markdown
Contributor

The AX210-class boot ROM reads a context-information structure from host memory
and, from it, a peripheral scratch block that holds the control flags, the
platform-NVM and reduce-power table addresses, the default receive-buffer ring,
and the firmware DRAM image map. The context info was already built but pointed
at a scratch block that was never assembled, so the gen3 self-load had nothing
to hand the ROM.

This adds that block with the packed 1724-byte layout from iwl_prph_scratch
(pcie/iwl-context-info-v2.h): an 84-byte control and config header (version,
control, pnvm, hwm, rbd, reduce-power, step), then fseq_override,
step_analog_params, eight reserved dwords, and the DRAM map of three 64-entry
image arrays plus an eight-entry fseq array. write refuses an image with more
than 64 chunks or a short buffer rather than truncating firmware silently.

The gen3 proofs existed in the tree but were never linked into the harness.
This wires them in and pins the new structure to its documented offsets and
total size, next to the context-info, boot-register, and image-parser proofs
that now run for the first time. All checked byte-exact against the documented
struct layout and the real so-a0-gf-a0 image; the register sequence that starts
the load still needs validation on Intel silicon.

The AX210 boot ROM reads a peripheral-scratch block through the context info:
control flags, the platform-NVM and reduce-power addresses, the receive-buffer
ring, and a DRAM map of the firmware images. Both were missing, so the context
info pointed at nothing.

prph_scratch builds that block with the packed 1724-byte iwl_prph_scratch
layout. dram_map partitions the runtime image the way iwl_pcie_init_fw_sec
does, splitting the flat section list at the CPU1/CPU2 and paging separators
into the LMAC, UMAC and paged images, then stages each section one page apart
and reports its device address for the map.

The gen3 proofs were written but never linked into the harness. Wire them in
and pin the two structures to their documented offsets and to the real
so-a0-gf-a0 image: the 15/16/24 section split, the boundary offsets, and the
page-aligned staged addresses.
@eKisNonos
eKisNonos force-pushed the iwlwifi-gen3-prph-scratch branch from 0915203 to 7e3ab5c Compare July 21, 2026 19:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant