Skip to content

RTL8821AU: remove redundant PR #37 trace-derived post-fwdl pokes#43

Closed
josephnef wants to merge 1 commit into
masterfrom
cleanup/remove-pr37-trace-pokes
Closed

RTL8821AU: remove redundant PR #37 trace-derived post-fwdl pokes#43
josephnef wants to merge 1 commit into
masterfrom
cleanup/remove-pr37-trace-pokes

Conversation

@josephnef
Copy link
Copy Markdown
Collaborator

Cleanup follow-up to #42. Drops 113 lines from HalModule::rtl8812au_hal_init's if (CHIP_8821) post-fwdl block — the trace-replay parity originally added in #37, now made redundant by #42's proper 8821-specific init flow.

What's removed

Inside the if (CHIP_8821) branch:

  • Hardcoded T2U Plus MAC at 0x0610..0x0615 (k8821Mac static)
  • ~13 trace-captured register pokes (0x004c, 0x004e, 0x0040, 0x0208, 0x0520, 0x0670, 0x0a0a, 0x1874-0x187f)
  • BB/AGC value overrides (0x0830/0834/8a4/8b0, 0x0c20-0x0c44 cluster, 0x0c50/0c54/0c90/0cb4/0e90)
  • Mislabeled "8814 post-fwdl init" RRSR/queue-ctrl/RA-table block — actually inside the 8821 branch, wrong comment header. Writes 0x0440, 0x04bc, 0x04c6, 0x0520, 0x0524, 0x0670, 0x0990-0x09a4.

The double-writes to 0x0520 and 0x0670 (different values per write within the same if (CHIP_8821) block) were the smell — the trace replay had never been fully reasoned through. PR #42's proper init lands the chip in MAC-RX-ready state from any starting condition, making the replay unnecessary.

Linux validation

tests/regress.py --full-matrix --channel 100 on 8814 + 8821 T2U Plus, VM mode. No regressions; 8821 cells preserved within RF variance:

TX → RX post-#42 (with trace pokes) this PR
8814 kernel → 8821 kernel 430 ✓ 435 ✓
8814 kernel → 8821 devourer 400 ✓ 400 ✓
8821 kernel → 8814 kernel 365 ✓ 372 ✓
8821 devourer → 8814 kernel 5865 ✓ 5933 ✓

8814-TX cells (2, 4) and 8814-RX cells (7, 8) unchanged at 0 — known separate issues.

What this doesn't validate

Android-side hotplug end-to-end. PR #42 was confirmed by @RomanLut to fix hotplug on PixelPilot + hx-esp32cam-fpv with the trace pokes still in place. This PR removes them. Proper init flow alone should be sufficient (that's the whole point of #42 — driving the chip from any starting state without relying on pre-captured pokes that matched one specific state) — but it deserves re-validation.

@RomanLut — when you have a moment, could you re-build PixelPilot / hx-esp32cam-fpv against this branch and confirm hotplug still works on 8821AU? Single replug cycle is enough. If it regresses, the trace pokes were load-bearing for hotplug specifically (unlikely IMO but possible) and we revert.

What this PR doesn't touch

Test plan

  • Build clean
  • CI matrix (all 5 OS/compiler combos)
  • --full-matrix no regressions on Linux
  • @RomanLut confirms 8821AU hotplug still works on Android against this branch

🤖 Generated with Claude Code

Drops 113 lines from `HalModule::rtl8812au_hal_init`'s `if (CHIP_8821)`
post-fwdl block:

- Hardcoded T2U Plus MAC at 0x0610..0x0615
- ~13 trace-captured register pokes (0x004c, 0x004e, 0x0040, 0x0208,
  0x0520, 0x0670, 0x0a0a, 0x1874-0x187f)
- BB/AGC value overrides (0x0830/0834/8a4/8b0, 0x0c20-0x0c44, 0x0c50/
  0c54/0c90/0cb4/0e90)
- Mislabeled "8814 post-fwdl init" RRSR / queue-ctrl / RA-table block
  (was inside the 8821 branch — wrong comment header) writing 0x0440,
  0x04bc, 0x04c6, 0x0520 (second value, overwriting first), 0x0524,
  0x0670 (second value), 0x0990-0x09a4

All originally captured from an aircrack-ng/88XXau cold-init usbmon
trace in PR #37 to compensate for master's flat 8821 init path. The
double-writes to 0x0520 and 0x0670 (different values per write) were a
smell that the trace replay had never been fully reasoned through.

PR #42's proper 8821-specific init flow makes this block redundant —
the chip lands in MAC-RX-ready state from any starting condition
without needing the trace replay.

## Validation

Linux full matrix on 8814AU + 8821AU T2U Plus, channel 100, VM mode.
No regressions on 8821 cells; counts within normal RF variance:

| TX → RX                       | post-#42 (with trace pokes) | this PR |
|-------------------------------|-----------------------------|---------|
| 8814 kernel → 8821 kernel     | 430 ✓                       | 435 ✓   |
| 8814 kernel → 8821 devourer   | 400 ✓                       | 400 ✓   |
| 8821 kernel → 8814 kernel     | 365 ✓                       | 372 ✓   |
| 8821 devourer → 8814 kernel   | 5865 ✓                      | 5933 ✓  |

8814-TX cells (2, 4) and 8814-RX cells (7, 8) unchanged at 0 — known
separate issues.

## What this PR doesn't validate

Android-side hotplug end-to-end. PR #42 was confirmed by @RomanLut to
fix hotplug on PixelPilot + hx-esp32cam-fpv with the trace pokes still
applied. This PR removes them — re-validation needed to confirm the
proper init flow alone is sufficient.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@josephnef
Copy link
Copy Markdown
Collaborator Author

Closing — superseded by a scope-tighter rebase.

This PR removed 113 lines from rtl8812au_hal_init's if (CHIP_8821) block, which at the time included a mis-labelled "8814 post-fwdl init" sub-block (RRSR / queue-ctrl / RA-table at 0x0990-0x09a4). PR #57 (merged 2026-05-29) later discovered that sub-block was actually 8814-AU-specific init that had been mis-gated under if (CHIP_8821) — instead of deleting it, #57 moved it to a new if (is_8814a) block with byte-reversed u32 literals. Had #43 landed first, that 8814 init would have been lost rather than rescued.

The remaining content (hardcoded T2U Plus MAC + trace-derived register pokes + BB/AGC value overrides) is still a valid cleanup target — those are genuinely 8821-only and redundant after PR #42's proper init flow. Re-opening as a scope-tighter PR against current master that only removes the 8821 sub-blocks.

@josephnef josephnef closed this May 30, 2026
@josephnef josephnef deleted the cleanup/remove-pr37-trace-pokes branch May 30, 2026 17:32
josephnef added a commit that referenced this pull request May 30, 2026
Re-scope of #43 (closed) against current master.

## What's removed

The 86-line `if (CHIP_8821)` block in `HalModule::rtl8812au_hal_init`
immediately after the post-fwdl REG_CR / REG_RXFLTMAP2 setup:

- **Hardcoded T2U Plus MAC** at REG_MACID (0x0610..0x0615) — burned-in
to one specific chip's address (`e0:d3:62:97:a9:72`); wrong for every
other 8821AU. PR #42's proper 8821-specific init flow programs MAC from
EFUSE.
- **~13 trace-derived register pokes** at
0x004c/0x004e/0x0040/0x0208/0x0520/0x0670/0x0a0a/0x1874-0x187f —
captured from one aircrack-ng/88XXau cold-init session on the T2U Plus,
never re-derived from first principles. Made redundant by #42 driving
the chip from any starting state.
- **BB/AGC value-override cluster** at 0x0830/0834/8a4/8b0 +
0x0c20-0x0c44 + 0x0c50/0c54/0c90/0cb4/0e90 — mirrored what aircrack-ng's
phydm runtime AGC settles on after init. Devourer doesn't run phydm; the
override was a \"best we can do\" shortcut. Removed pending a proper
port.

The double-writes to 0x0520 and 0x0670 with different values per write
(one from this block, one from the \"8814 post-fwdl init\" block
underneath) were the original smell that surfaced this in #43.

## What this PR does NOT touch

The *\"Trace-derived 8814 post-fwdl init writes\"* sub-block that USED
to live inside this same `if (CHIP_8821)` branch. PR #57 (merged
2026-05-29) moved it to its proper `if (is_8814a)` location with
byte-reversed u32 literals after discovering it had been mis-gated. That
block stays. **This is the only difference from #43.**

## Linux validation (carried over from #43)

`tests/regress.py --full-matrix --channel 100` on 8814 + 8821 T2U Plus,
VM mode. No regressions; 8821 cells preserved within RF variance:

| TX → RX | post-#42 (with trace pokes) | this PR |
|---|---|---|
| 8814 kernel → 8821 kernel | 430 ✓ | **435 ✓** |
| 8814 kernel → 8821 devourer | 400 ✓ | **400 ✓** |
| 8821 kernel → 8814 kernel | 365 ✓ | **372 ✓** |
| 8821 devourer → 8814 kernel | 5865 ✓ | **5933 ✓** |

NB: that matrix was captured against the #43 branch state; will need a
fresh run against this PR before merge.

## What this PR doesn't validate

Android-side hotplug end-to-end. PR #42 was originally confirmed by
@RomanLut to fix hotplug on PixelPilot + hx-esp32cam-fpv **with the
trace pokes still in place**. This PR removes them. Proper init flow
alone *should* be sufficient (that's the whole point of #42 — driving
the chip from any starting state without relying on pre-captured pokes)
— but it deserves re-validation before merge.

@RomanLut — when you have a moment, could you re-build PixelPilot /
hx-esp32cam-fpv against this branch and confirm 8821AU hotplug still
works on Android? Single replug cycle is enough. If it regresses, the
trace pokes were load-bearing for hotplug specifically (unlikely IMO but
possible) and we revert.

## Test plan

- [x] Build clean (Linux gcc + clang)
- [ ] CI matrix
- [ ] `--full-matrix` re-run against this branch tip
- [ ] @RomanLut confirms 8821AU Android hotplug still works

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant