RTL8733B: unadvertised capabilities — SGI root-cause, LDPC/STBC, ACK/A-MPDU, FastRetune, CCA disable

[josephnef]

The RTL8733B backend merged in #388 deliberately advertises a narrow, hardware-witnessed surface: 1SS BCC, legacy CCK/OFDM + HT MCS0–7, 20/40 MHz, forced long GI. Everything below is refused or absent because it was not validated, not because the silicon cannot do it. This issue collects those gaps so they are worked deliberately rather than rediscovered.

Most items want a second board (BL-M8733BU2, #392) so the DUT can be one end of a two-adapter test without borrowing the only known-good unit.

1. SGI — root-cause the descriptor/air mismatch

The most interesting open item, because the hardware disagreed with the descriptor. A descriptor with its short-GI bit set submitted successfully, but an independent RTL8812AU witness decoded both broadcast and unicast probes as long GI. ht_request_supported_8733b therefore refuses SGI outright.

Either the descriptor field is at the wrong offset for this 40-byte HALMAC 87xx descriptor, or SGI needs a BB/MAC enable this port does not perform, or the witness misreported. Read the vendor tree's per-chip branch rather than diffing registers — the established lesson on this codebase is that a chip-dispatched source path answers this class of question and a register golden-diff does not.

Worth roughly +11% PHY rate at the top of the ladder if recovered.

2. LDPC and STBC

Both rejected. The vendor reports TX-LDPC but not RX-LDPC for this part, and the whole injection path was validated with global BCC forced. LDPC is worth ~+3 dB of coding gain at the 10%-delivery crossing on the generations where it is measured (tests/ldpc_waterfall.sh), so it is the highest-value item here for a long-range link — but it needs its own witnessed waterfall on this chip, not an inherited claim. The descriptor encoder writes no STBC field at all; on a 1T1R part STBC is likely moot, which should be confirmed and written down rather than left as an unexplained refusal.

3. Hardware ACK / BlockAck, A-MPDU

Neither validated nor advertised. SetAckResponder + SetAmpduMode are the hardware-ARQ and aggregation levers on the other generations. Note the measured shape before assuming a win: A-MPDU is ~+30% goodput at the PHY ceiling for high-MCS broadcast but −8% delivered at MCS3 under unicast ARQ, and per-frame CCX accounting does not survive AGG_EN. Measure delivered payload, not occupancy.

4. FastRetune

Falls back to the full SetMonitorChannel path. The FHSS and channel-migration subsystems both sit on this primitive, so an RTL8733B in an FHSS role currently pays the full ~90 ms retune. tests/hop_parity_check.sh is the register full-vs-fast check to port.

5. CCA control — and a silent config drop

SetCcaMode(true) (DEVOURER_DIS_CCA) throws: the HALMAC 87xx carrier-sense gate has not been located and measured on this part, and the backend refuses rather than guessing at writes it cannot read back. SetCcaMode(false) — the universal default — correctly succeeds as a no-op.

The gap: _cfg.tuning.disable_cca is silently dropped during bring-up on this backend. Every other generation applies it (if (_cfg.tuning.disable_cca) SetCcaMode(true); — jaguar1 :82/:1349, jaguar2 :251, jaguar3 :102/:868, kestrel :257), so DEVOURER_DIS_CCA=1 vanishes without a word here while the direct setter refuses loudly. That asymmetry should close one way or the other — a warn at bring-up is probably the better trade than a hard InitWrite throw, given the knob is on by default for the streamtx FPV downlink.

Porting the real thing is worth ~1.5–2.2× injection rate against a co-channel transmitter on the generations where it is measured (tests/dis_cca_tx_onair.sh).

Suggested order

SGI (a correctness question with a known-wrong observation) → CCA (small, and the config asymmetry is a papercut today) → LDPC (highest link-budget value, needs a waterfall) → FastRetune → ACK/A-MPDU.

Each item ships only with its own witnessed evidence; the point of #388's narrow surface is that nothing is advertised on inference.

Follow-up to #388. Related: #392.

[josephnef]

Two items on this list have moved since it was filed.

CCA disable — the config half is done. tuning.disable_cca no longer vanishes silently: InitWrite warns and airs with carrier-sense (64d77b5, #395). Porting the actual disable is unchanged and stays here — the HALMAC 87xx carrier-sense gate has not been located and measured on this part.

SGI remains the most interesting item and is now first in the suggested order for a concrete reason: the descriptor bit is set, the frame submits, and the witness decodes long GI. That is a disagreement between the descriptor and the air, which is a narrower and more answerable question than the other entries — and per the house lesson, the way in is the vendor tree's per-chip call site, not a register golden-diff. The RTL8733B TSSI work that followed the merge is the worked example: the answer was that the vendor never calls the function at runtime at all, which no amount of register inspection would have surfaced.

[snokvist]

The tuning.disable_cca sub-item is done and can be struck from this list — #395 shipped it and #396 refines it, so nothing here is outstanding on that point.

Final shape in #396: the warning sites in bring_up_to_phy rather than InitWrite, so an RX-only session that set the knob is told too and it fires exactly once per bring-up (both existed briefly after the two concurrent fixes). Wording names both spellings — DEVOURER_DIS_CCA / tuning.disable_cca — so a grep for either finds it.

To be clear about what is not resolved, since it is the actual subject of this issue: the CCA gate itself is still unported. SetCcaMode(false) succeeds as a no-op, SetCcaMode(true) throws, and the config path warns. The HALMAC 87xx carrier-sense gate has not been located or measured on this part, so there is no evidence here about what clearing it would do — only that the request is no longer silently dropped.

One note for whoever picks up the CCA-disable work: on Jaguar3 the payoff was measured as ~1.5-2.2x inject-rate recovery against a co-channel transmitter, with the primary-CCA bit doing the work and the energy bit alone being null. Worth reproducing that A/B shape here rather than just finding the register and declaring it done, because "the write landed" and "deferral actually dropped" are different claims and only the second one is the feature.