MCC/FCS investigation: reject as an FHSS primitive (exp 3/5)#320
Merged
Conversation
Source-maps the vendor MCC state machine, H2C 0x10/0x16/0x17/0x18/0x19 schedule-upload sequence, C2H MCC_RPT_* status codes, and the live policy table (fixed 100 TU period, 20-80 TU slot splits). Hardware finding: the capability gate engages (en_mcc=1 with two non-groupable linked STAs) but the firmware schedule (mcc_status=DOING_MCC) does not start from the cfg80211 association path — it needs the vendor's internal P2P-anchored join flow, unreachable in the constrained measurement VM; no on-air dwell is claimed from a schedule not observed running. The chbw_grouped gate also means adjacent pairs like 36+40 take the single-radio union path and never engage MCC. Go/no-go: reject. MCC is a two-context time-share (TU-quantized slots, fixed ~102 ms period, two channels, non-groupable pairs, P2P-gated) — not a hopping engine. Its slot-boundary switch is the same H2C 0x1D already shipped as DEVOURER_FASTRETUNE_FW; exp 4-5 should build on that direct switch, not the MCC scheduler. README index + offload-doc forward reference updated. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The policy table (fixed 100 TU period, 20/80/36/30 TU splits) is identical in the Jaguar1/2/3 vendor trees — 8812/8814/8821A, 8822B, 8821C, 8822C, 8822E (8822E differs only by 3 TU of guard). Kestrel has no hal_mcc.c; its multi-channel support is rtw89 chanctx, separately P2P-driven. So the reject-as-FHSS conclusion generalises by shared source, not just the measured 8822B. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Third in the standard-driver FHSS series (#269 baseline, #270/#316 firmware offload). Determines whether Realtek's Multi-Channel Concurrency / Fast Channel Switch — one radio holding two channel contexts under a firmware schedule — can be repurposed as a frequency-hopping primitive. It cannot; this is a documented negative result. Docs-only.
Findings
Source map (
hal_mcc.c+rtw_mlme_ext.c): the FCS schedule-upload H2C sequence (0x10MCC_LOCATION→ 0x16MACID_BITMAP→ 0x17/0x18MCC_CTRL→ 0x19TIME_SETTING), theC2H_MCCMCC_RPT_*status codes, and the live-read policy table — all four policies have a fixed 100 TU (~102 ms) period with 20/80/36/30 TU slot splits. Contexts are pre-loaded to reserved pages once; the firmware flips between them autonomously, so a slot boundary is the same on-chip RF switch measured in exp-2, not a per-slot host H2C.Two hardware findings (RTL8822BU, MCC-variant vendor build, pinned-kernel VM, two helper APs):
chbw_groupedgate — MCC starts only for channel pairs that can't share one radio channel. Adjacent 20 MHz pairs like the nominal "36↔40" fit inside one 40 MHz channel and take the single-radio union path; MCC never engages. Confirmed on air (ch1+ch11 non-groupable co-associate stably; 36+40 starves one vif).iw connectpath —en_mcc:1engages with two linked non-groupable STAs, butmcc_statusnever reachesDOING_MCCand noMCC_RPT_READYarrives. The start hook is in the vendor's internal join flow and the reserved-page builder emits P2P-GO NOA content: MCC here needs a P2P GO/GC anchor, not dual open-BSS STA (matching rtw89's P2P-driven MCC). Per the experiment's rule, no on-air dwell is claimed from a schedule not observed running.Cross-chip: the same
hal_mcc.cengine and policy table ship in every 11ac vendor tree — Jaguar1 (8812/8814/8821A), Jaguar2 (8822B, 8821C), Jaguar3 (8822C, 8822E; 8822E differs by 3 TU of guard only). Kestrel (8852B/C) has nohal_mcc.c— its multi-channel path is rtw89chanctx, separately P2P-driven. The verdict holds family-wide by shared source.Go/no-go: reject
MCC is a two-context time-share (TU-quantized ≥20 ms slots, fixed ~102 ms period, two channels, non-groupable pairs, P2P-gated) — not a hopping engine. Its one hopping-relevant element, the slot-boundary RF switch, is the H2C 0x1D switch already shipped as
DEVOURER_FASTRETUNE_FW(#318/#319). Experiments 4–5 should build on that direct switch, not the MCC scheduler.Adds
docs/mcc-fcs-investigation.md; updates the offload-doc forward reference and the README index.🤖 Generated with Claude Code