RTL8814AU: TX FIFO bring-up fixes + cross-adapter validation tooling

[josephnef]

Summary

Three logically separate improvements that fell out of investigating the
RTL8814AU TX path. TX is still not validated end-to-end, but each change
in this PR is independently correct and verified on hardware to not regress
the existing RX path on either 8812 or 8814.

Commits

1. demo: cross-adapter TX-validation tooling for the Jaguar family

   • txdemo learns a Linux VID/PID open path (Termux argv[1]=fd still works
     when present and parses to a positive int).
   • Fork-RX child gated behind DEVOURER_TX_WITH_RX=1 — on plain Linux
     libusb the post-fork parent/child race on the shared handle and both
     crash with rtw_read: iostream error before TX begins. Cross-adapter
     (TX on one adapter, RX on another) is the only configuration that
     actually works on regular Linux.
   • DEVOURER_PID / DEVOURER_CHANNEL / DEVOURER_SKIP_RESET env vars
     for parity with the RX demo.
   • Both demos detect the txdemo's hardcoded injected-beacon SA
     (57:42:75:05:d6:00) and log <devourer-tx-hit> on match. A clean
     signal for cross-adapter TX validation.

2. 8814AU: TX FIFO bring-up — page allocation, auto-LLT, REG_CR preserve
   Three real chip-init bugs the 8812-path init silently no-ops on the 8814:

   • Page allocation. The 8812 writes 8-bit REG_RQPN / REG_BCNQ_BDNY
     / REG_TRXFF_BNDY (256-page TX FIFO model). The 8814 has a 2048-page
     TX FIFO and uses 32-bit REG_FIFOPAGE_INFO_{1..5}_8814A + 16-bit
     boundary registers. Port _InitQueueReservedPage_8814AUsb and
     _InitPageBoundary_8814AUsb from upstream
     hal/rtl8814a/usb/usb_halinit.c. Verified: HPQ=32, PUB=1912,
     bndy=0x07F8 after the fix.
   • Auto-LLT trigger. Without auto-LLT firing post-fwdl the per-queue
     free-page linked-list never gets built (page counts advertised but no
     actual pages linked). Upstream's InitLLTTable8814A writes BIT0 of an
     8-bit access at 0x208 — that's the wrong bit; the actual trigger
     per hal_com_reg.h:1424 is BIT_AUTO_INIT_LLT = BIT(16) of the 32-bit
     register. Use the correct BIT(16) trigger as a 32-bit RMW. Verified:
     BIT16 self-clears within 2ms, confirming the chip processed it.
   • REG_CR preserve. Final-state force-write to REG_CR now reads
     observed value first and OR's in our minimum-required bits, instead of
     clobbering the whole word. Defensive — on this hardware fw doesn't
     set high bits but the read-OR-write shape is the safer pattern.

3. 8814AU: TX-state diagnostic dump + send_packet pre-TX probe + DEVOURER_TX_EP

   • Post-init dump of REG_CR / TXPAUSE / FWHW_TXQ_CTRL / FIFOPAGE_*
     / MCUFWDL / TXDMA_STATUS / TXDMA_OFFSET_CHK / HWSEQ_CTRL / TCR / RCR.
     One log per register (Logger format helper truncates multi-placeholder
     lines).
   • send_packet: on first call only, log CR / TXPAUSE / TXDMA_OFFSET_CHK
     / FWHW_TXQ_CTRL / MCUFWDL / HCIPWR. Surfaces any clobber between
     init-end and the actual first TX.
   • DEVOURER_TX_EP=0xNN overrides the hardcoded bulk OUT endpoint 0x02
     for EP-bisection diagnostics without a rebuild.

All diagnostic output is gated behind CHIP_8814A or env vars; 8812 path
is untouched at runtime.

Known limitation

8814 TX end-to-end still doesn't work. All three OUT EPs (0x02 / 0x03 / 0x04)
silently time out (LIBUSB_TRANSFER_TIMED_OUT, actual_length=0). Chip
state at TX time looks correct on every register we've examined — CR=0x00FF,
TXPAUSE=0x00, FW running (MCUFWDL[0]=0x78), queues have pages, auto-LLT
fires, TX descriptor checksum matches upstream byte-for-byte. The remaining
gate is somewhere we haven't dumped yet. Diagnostic infrastructure in
commit 3 is ready for the next investigation.

Test plan

• Build clean on Linux (trainer-arch, kernel 6.18-lts, gcc 15.2.1).
• 8812 RX regression: WiFiDriverDemo on 0bda:8812, channel 36 — 8000+
  frames received in 18s.
• 8814 RX regression: WiFiDriverDemo on 0bda:8813, channel 36 — should
  still receive (page allocation + auto-LLT + REG_CR-preserve only
  enhance bring-up, none remove or rewrite registers the RX path
  requires).
• 8814 TX: deferred. Tooling in commit 1 + diagnostics in commit 3
  make this a future PR; chip-init fixes in commit 2 are landed
  regardless.

🤖 Generated with Claude Code