Beamforming self-sounding: Jaguar2 (8822BU) — three-generation matrix complete

[josephnef]

Executes the Jaguar-2 plan recorded in #151 (deferred there until the Jaguar-2 port landed, which #157 did): mirror the Jaguar-3 arming/NDPA blocks into src/jaguar2/ and validate on hardware. Self-sounding now covers all three devourer generations, in both directions, including the single-radio ground station. Closes #151.

What

• FrameParserJaguar2.h: SET_TX_DESC_NDPA_8822B / SET_TX_DESC_NAVUSEHDR_8822B (dword3 +0x0C bits [23:22] / bit 15 — verified against the vendor halmac_tx_desc_nic.h, same positions as Jaguar-3) and a ndpa param on fill_data_tx_desc_8822b. The NDPA block sits above the descriptor checksum: dword3 is inside the 32 bytes the 8822B HW checksums, and a mismatch silently drops the frame at TXDMA.
• RtlJaguar2Device: beamformee arm in Init (DEVOURER_BF_ARM_BFEE / _MU) using the shared kBfeeJaguar23 — which was transcribed from hal_txbf_8822b_enter(), i.e. it is the 8822B recipe — with self-MAC 00:e0:4c:88:22:bb programmed to 0x0610 (Jaguar-2 bring-up, like Jaguar-3's, never writes it) and placed after bring_up so the recipe's RXFLTMAP RMW follows init_wmac_cfg; sounder arm in InitWrite (DEVOURER_BF_ARM_SOUNDER, protocol byte 0xDB); DEVOURER_TX_NDPA gate in send_packet.
• tests/bf_selfsound_jaguar2.sh: 3-cell matrix — unarmed/armed beamformee direction (+ optional RUN_MU=1 cell), and a sounder-direction cell that doubles as the single-radio ground-station check (DEVOURER_TX_WITH_RX=thread, self-capture vs. independent sniffer separates RX-side from NDP-side failures).

Vendor-parity notes

• No RF mode-table poke on the sounder side: the vendor's hal_txbf_8822b_rf_mode() body is entirely #if 0'd in rtl88x2bu — unlike the 8822C, whose active equivalent became Jaguar-3's txbf_rfmode_sounder. Confirmed unnecessary on-air.
• No pre-InitWrite env constraint for TX+RX (unlike Jaguar-3): Jaguar-2's shared bring-up always enables RX, never closes the RX filters, and has no coex thread on bulk-IN.
• Jaguar-2's RCR already carries AAP (per Jaguar3: RCR AAP bit + 8822E path-B TXAGC ref fix — single-radio self-capture works #160), so report capture needed no RX work.

Hardware validation (Archer T3U 2357:012d, ch100, reproduced twice)

cell	result
beamformee, unarmed	0 reports (negative control)
beamformee, armed	855 / 888 reports, sa=00:e0:4c:88:22:bb Nc=2 Nr=2 — unassociated HW responder
beamformee, MU	920 reports, len=153 — MU Exclusive per-tone SNR decodes clean (20 groups, 20.7–21.7 dB)
sounder + single-radio GS	85k self-captured reports / 33 s (sniffer cross-check 78k)

tools/bf_report_decode.py on the captures confirms the same Realtek compact 10-bit codebook seen on Jaguar-1/-3: stable cross-frame Givens angles (var 0.008), per-stream SNR 33.75/21.75 dB, smooth per-tone |h_B/h_A| structure. Build + ctest green.

🤖 Generated with Claude Code