Skip to content

T1: port StopTxBeacon — clears MAC 0x420[22] in monitor mode init#68

Merged
josephnef merged 1 commit into
masterfrom
t1-mac-420-stop-tx-beacon
Jun 2, 2026
Merged

T1: port StopTxBeacon — clears MAC 0x420[22] in monitor mode init#68
josephnef merged 1 commit into
masterfrom
t1-mac-420-stop-tx-beacon

Conversation

@josephnef
Copy link
Copy Markdown
Collaborator

Summary

Closes one more T1 canary-diff line. Pre-fix at any channel:

MAC 0x420 byte 2: kernel = 0x31, devourer = 0x71

Bit 22 (= BIT6 of byte 2 = "HW treats packet as real beacon" enable) was at the chip's reset-state 1 on devourer; kernel had it cleared by StopTxBeacon.

Root cause

Upstream's rtw_hal_set_hwreg(HW_VAR_NET_TYPE, ...) path (hal_com.c:14283) calls StopTxBeacon(Adapter) whenever the MSR transitions to _HW_STATE_NOLINK_ or _HW_STATE_STATION_ and no AP/mesh port is up. StopTxBeacon body (hal_com.c:14158):

rtw_write8(REG_FWHW_TXQ_CTRL + 2,
           rtw_read8(REG_FWHW_TXQ_CTRL + 2) & ~BIT6);
rtw_write8(REG_TBTT_PROHIBIT + 1, TBTT_HOLD_STOP_BCN & 0xff);
rtw_write8(REG_TBTT_PROHIBIT + 2,
           (rtw_read8(REG_TBTT_PROHIBIT + 2) & 0xf0) |
           (TBTT_HOLD_STOP_BCN >> 8));

devourer's _InitNetworkType_8812A set MSR to NT_NO_LINK (PR #64) but didn't call StopTxBeacon afterwards. Port the body inline so monitor-mode init matches the kernel's MSR-transition handler.

Test plan

  • Build clean.
  • DEVOURER_DUMP_CANARY=1 at ch6 confirms MAC 0x420 now matches kernel 0xFF311F00 (was 0xFF711F00). Verification pending: 8812 dongle dropped off USB during this PR's prep — re-plug + re-capture once the rig stabilises.
  • No regression on the matrix at ch6/ch36/ch100 — the fix is cosmetic to live operation (monitor mode doesn't use HW beacon TX), so no behavioural change expected.

🤖 Generated with Claude Code

T1 canary residual at MAC 0x420 byte 2: kernel `0x31` vs devourer
`0x71`. Bit 22 of REG_FWHW_TXQ_CTRL (= BIT6 of byte 2 = "HW treats
packet as real beacon" enable) was at the chip's reset-state 1 on
devourer, while kernel ran a setup that cleared it.

Root cause: upstream's `rtw_hal_set_hwreg(HW_VAR_NET_TYPE, ...)`
path (`hal_com.c:14283`) calls `StopTxBeacon(Adapter)` whenever the
MSR transitions to `_HW_STATE_NOLINK_` or `_HW_STATE_STATION_` and
no AP/mesh port is up. The body of `StopTxBeacon` (hal_com.c:14158):

  rtw_write8(REG_FWHW_TXQ_CTRL + 2,
             rtw_read8(REG_FWHW_TXQ_CTRL + 2) & ~BIT6);
  rtw_write8(REG_TBTT_PROHIBIT + 1, TBTT_HOLD_STOP_BCN & 0xff);
  rtw_write8(REG_TBTT_PROHIBIT + 2,
             (rtw_read8(REG_TBTT_PROHIBIT + 2) & 0xf0) |
             (TBTT_HOLD_STOP_BCN >> 8));

devourer's `_InitNetworkType_8812A` set MSR to NT_NO_LINK (PR #64)
but didn't call StopTxBeacon afterwards. Port the body inline so
monitor-mode init matches the kernel's MSR-transition handler.

`TBTT_PROHIBIT_HOLD_TIME_STOP_BCN = 0x64` (3.2 ms, 32 µs units) is
the canonical hold-time-when-stopping-beacon value from
`include/hal_com.h:341`.

Functional effect: monitor mode wasn't going to use HW beacon TX
either way, so the bit-state was cosmetic to live operation. The
fix is canary-parity only — closes another line of the T1 init-drift
diff against `aircrack-ng/88XXau`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@josephnef josephnef force-pushed the t1-mac-420-stop-tx-beacon branch from b6be1af to de16c55 Compare June 2, 2026 14:47
@josephnef josephnef merged commit c13fab2 into master Jun 2, 2026
5 checks passed
@josephnef josephnef deleted the t1-mac-420-stop-tx-beacon branch June 2, 2026 14:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant