RTL8814AU: iterate HT_MCS24-31 + VHT_4SS in per-path TX power apply#56
Closed
josephnef wants to merge 1 commit into
Closed
RTL8814AU: iterate HT_MCS24-31 + VHT_4SS in per-path TX power apply#56josephnef wants to merge 1 commit into
josephnef wants to merge 1 commit into
Conversation
`phy_set_tx_power_level_by_path` was stopping at 3SS for 8814AU, but
upstream `PHY_SetTxPowerLevel8814` iterates all sections including 4SS
even though USB-2 can't sustain 4-SS data rates — the chip's TXAGC
table at BB 0x1998 still needs to be fully populated. The existing
comment ("upstream PHY_SetTxPowerLevel8814 iterates all sections")
documented the intent but the patch stopped at 3SS.
Cold-init usbmon diff against `aircrack-ng/88XXau` in the
devourer-testrig VM (2026-05-28):
Kernel writes BB 0x1998: 1029 times
Devourer (pre-patch): 781 times
Devourer (post-patch): 925 times
The 144-write delta matches (8 HT_MCS24-31 + 10 VHT_4SS) rates × 4 RF
paths × 2 `PHY_SetTxPowerLevel8812` applies per cold init = 144.
Empirically does NOT close the on-air TX gate on 8814AU on its own
(sniffer-attached run still shows 0 frames matching the canonical SA)
but matches upstream wire shape and removes a port-incomplete bug
flagged by `tools/usbmon_pcap_diff.py` (introduced in #55).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
phy_set_tx_power_level_by_pathwas stopping at 3SS for 8814AU, but upstreamPHY_SetTxPowerLevel8814iterates all sections including 4SS — even though USB-2 can't sustain 4-SS data rates, the chip's TXAGC table at BB 0x1998 still needs the full per-(path, rate) population to read correct gains for the rates that DO go on air. The existing comment inphy_set_tx_power_level_by_path("upstream PHY_SetTxPowerLevel8814 iterates all sections") documented the intent but the patch stopped at 3SS.Found via the new pcapng diff from #55. Cold-init usbmon diff against
aircrack-ng/88XXauin thedevourer-testrigVM (2026-05-28):88XXauThe +144 delta matches (8 HT_MCS24-31 + 10 VHT_4SS) × 4 RF paths × 2
PHY_SetTxPowerLevel8812applies per cold init = 144.Caveat
Empirically does NOT close the on-air TX gate on 8814AU on its own — sniffer-attached AR9271 run on ch6 with this patch +
DEVOURER_DRAIN_BULK_IN=1(from #55) still shows 0 frames matching CANONICAL_SA. The remaining 104-write gap on 0x1998 plus new divergence signal at 0x0994 (kernel 55 / devourer 1), 0x0838 (devourer 49 / kernel 1), 0x08b0 (devourer 27 / kernel 1) suggests devourer and the kernel driver take different IQK / calibration paths — separate investigation.This is a clean port-completion fix worth landing on its own.
Test plan
cmake --build build -jclean on Linux gcc / clang (CI will exercise macos + msvc)WiFiDriverTxDemowithDEVOURER_PID=0x8813 DEVOURER_CHANNEL=6runs through init + TX loop, no regressions🤖 Generated with Claude Code