Skip to content

T1: extend canary oracle with 8814AU path-C/D BB regs #72

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
josephnef merged 1 commit into from
Jun 2, 2026
Merged

T1: extend canary oracle with 8814AU path-C/D BB regs #72

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions src/RadioManagementModule.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -337,6 +337,30 @@ void RadioManagementModule::phy_SwChnlAndSetBwMode8812() {
for (uint32_t a : rf_canary)
_logger->info("RF[B] 0x{:02x} = 0x{:05X}", a,
phy_query_rf_reg(RfPath::RF_PATH_B, a, 0xfffffu));

/* 8814AU extension: dump path-C/D BB-AGC + IGI + BB-swing. Paths C/D
* exist at BB-register-table level (0x18xx for path C, 0x1Axx for
* path D, see hal/Hal8814PhyReg.h). NB: the corresponding RF
* registers for paths C/D are write-only by HW design on 8814AU
* (see kaeru cite "RTL8814AU RF read mechanism — paths C/D
* write-only by HW design") — read attempts return undefined
* data, so we skip RF[C]/RF[D]. The BB-table state IS readable
* and is the canary surface for path-C/D init drift. */
if (_eepromManager->version_id.ICType == CHIP_8814A) {
static const uint16_t bb_canary_8814_pathCD[] = {
/* Path-C TX-AGC table */
0x1820, 0x1824, 0x1828, 0x182c, 0x1830, 0x1834, 0x1838, 0x183c,
0x1840,
/* Path-C BB-swing + IGI */
0x181c, 0x1850,
/* Path-D TX-AGC table */
0x1a20, 0x1a24, 0x1a28, 0x1a2c, 0x1a30, 0x1a34, 0x1a38, 0x1a3c,
0x1a40,
/* Path-D BB-swing + IGI */
0x1a1c, 0x1a50};
for (uint16_t a : bb_canary_8814_pathCD)
_logger->info("BB 0x{:04x} = 0x{:08X}", a, _device.rtw_read32(a));
}
_logger->info("=== END DEVOURER_DUMP_CANARY ===");
}

Expand Down
16 changes: 15 additions & 1 deletion tools/canary_kernel_dump.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,12 +38,14 @@
set -euo pipefail

if [[ $# -lt 2 ]]; then
echo "Usage: $0 <iface> <channel>" >&2
echo "Usage: $0 <iface> <channel> [chip]" >&2
echo " chip: 8812 (default) | 8814" >&2
exit 1
fi

IFACE="$1"
CHANNEL="$2"
CHIP="${3:-8812}"

if ! ip -o link show "$IFACE" >/dev/null 2>&1; then
echo "iface '$IFACE' not found — did you modprobe 88XXau?" >&2
Expand Down Expand Up @@ -93,4 +95,16 @@ for PATH_IDX in 0 1; do
done
done

# 8814AU extension: path-C/D BB-AGC + IGI + BB-swing. RF[C]/RF[D]
# are write-only by HW design on 8814AU (read attempts return undefined
# data), so we only dump BB-table state for paths C/D.
if [[ "$CHIP" = "8814" ]]; then
for ADDR in 0x1820 0x1824 0x1828 0x182c 0x1830 0x1834 0x1838 0x183c \
0x1840 0x181c 0x1850 \
0x1a20 0x1a24 0x1a28 0x1a2c 0x1a30 0x1a34 0x1a38 0x1a3c \
0x1a40 0x1a1c 0x1a50; do
printf "BB %s = %s\n" "$ADDR" "$(readreg $ADDR)"
done
fi

echo "=== END DEVOURER_DUMP_CANARY ==="
Loading