TX beamforming apply (monitor mode, Jaguar3): mechanism wired + steers TX, but closed-loop gain needs rate-split + CBR-gating

[josephnef]

Summary

Investigated closing the loop on TX beamforming in monitor mode for Jaguar3 (8822E/8812E) — steer injected TX toward a peer for a free +several-dB link budget (no PA power → no heat/MPE/noise-floor rise), inspired by libc0607's rtl88x2eu beamforming_research branch. Two prior deep-dives (see notes) established the handshake is favourable: the WMAC builds the V matrix from the peer's Compressed Beamforming Report autonomously (no software linear algebra — reference/rtl88x2cu/hal/rtl8822c/rtl8822c_bf_monitor.c), and devourer's 8822E RF-mode table is already byte-exact (HalJaguar3::txbf_rfmode_sounder). devourer already sounds, arms a beamformee, and captures CBRs (50k/20s validated).

I wired the missing WMAC config + the apply toggle and measured. Result: the mechanism is correct and demonstrably steers TX, but a clean RSSI gain was not achieved — closing the loop needs materially more than a toggle. Reverting the code (measure-first discipline, cf. #199 dis_cca, #202 active-NF); this issue is the complete record so it can be finished.

What was built (reverted; recipe below is complete)

• bf::arm_beamformer_entry(peer_mac, rx_nss) — the beamformer-entry regs arm_sounder doesn't write: BFMER0_INFO (0x06E4)=peer MAC; TX_CSI_RPT_PARAM_BW20 (0x06F4)=(3<<10)|(1<<8)|(1<<3)|(rx_nss-1); SND_NDP_STANDBY (0x071B)=0x70; BBPSF_CTRL (0x06DC)|=BIT30 (+BIT12 if g_id=63); CSI_RRSR (0x1678)=0x550.
• bf::apply_vmatrix(en, bw) — the toggle: TXBF_CTRL (0x042C) clear [11:9], on-enable set BIT9(20)/+BIT10(40)/+BIT11(80) + BIT15 (DIS_NDP_BFEN). (Ported from bf_monitor_sounding_config.)
• DEVOURER_TX_NDPA=N — periodic NDPA (every Nth frame; 1=every frame = old behaviour) so data frames remain interleaved & steerable.
• DEVOURER_BF_TXBF=<peer_mac> — configures the entry + applies the toggle (blind).

Measurements (8822EU beamformer A → 8822CU beamformee B, ch100, GetRxQuality sensor)

1. The apply toggle lands and demonstrably affects TX. With it on, B's RX shifts measurably (e.g. rssi_mean −73→−80, or frame delivery 800→84/window) — proof the 0x042C[11:9] path is live.
2. Blind apply DEGRADES (−7 dB / 10× frame loss), because no valid V was ingested → you MUST gate the apply on a captured/ingested CBR (bf_monitor_enable_txbf only applies when csi_matrix_len>0). This gate was deferred; the measurement shows it's required, not optional.
3. Periodic NDPA sounds fine — period 1/8/64 → 16363/6556/831 CBRs (clean scaling), 8822EU as sounder confirmed.
4. Rate split needed. Sounding needs a 2-stream NDP (VHT2SS produced CBRs; VHT1SS gave 0), but libc0607's steered data must be 1SS (HT MCS0-7 / VHT NSS1). One DEVOURER_TX_RATE can't be both — the NDPA frames need to be forced to 2SS while data stays 1SS (per-packet radiotap rate could do it; the demo doesn't).
5. Unconfirmed: whether the beamformer's WMAC actually ingests the CBR in pure monitor mode (no V-matrix readback; the blind-apply degradation is consistent with no-ingest OR wrong-V). The beamformer needs RX open (DEVOURER_TX_WITH_RX) to receive the CBR at all.

What's needed to finish

1. CBR-ingest → apply gating: wire BfReportDetect (already detects the VHT CBR, cat 0x15 act 0x00, SA=beamformee) into a runtime signal that enables apply_vmatrix only after a valid report from the target peer — and re-sounds/re-applies periodically (mobility staleness).
2. Per-frame rate split: force NDPA frames to VHT2SS (proper sounding) while injected data stays VHT NSS1 / HT (steerable) — via the per-packet radiotap rate.
3. Confirm WMAC ingest in monitor mode — the make-or-break; needs a positive RSSI/SNR A/B once (1)+(2) are in place (beamformer RX open, marginal setpoint to dodge the near-field RSSI ceiling).

Refs: the CBR→V handshake + 8822E RF-table analyses (this session), #199 (dis_cca), #202 (active noise-floor) — same measure-first-null discipline.