Dear NXP support,
one of our customer is running the following commands from pag 149 of UM11490, but cannot see any waveform.
Please kindly check and verify if any additional command / condition is missing.
Thanks
Best Regards
Pier
------------------------------------
# RESET
root@myboard:/home/BTtest# hcitool -i hci0 cmd 0x03 0x0003
< HCI Command: ogf 0x03, ocf 0x0003, plen 0
> HCI Event: 0x0e plen 4
01 03 0C 00
# ENABLE SCAN
root@myboard:/home/BTtest# hcitool -i hci0 cmd 0x03 0x001a 0x3
< HCI Command: ogf 0x03, ocf 0x001a, plen 1
03
> HCI Event: 0x0e plen 4
01 1A 0C 00
# ENABLE EVENT FILTER
root@myboard:/home/BTtest# hcitool -i hci0 cmd 0x03 0x0005 0x02 0x00 0x02
< HCI Command: ogf 0x03, ocf 0x0005, plen 3
02 00 02
> HCI Event: 0x0e plen 4
01 05 0C 00
# ENTER IN TEST MODE
root@myboard:/home/BTtest# hcitool -i hci0 cmd 0x06 0x0003
< HCI Command: ogf 0x06, ocf 0x0003, plen 0
> HCI Event: 0x0e plen 4
01 03 18 00
# START THE TX TRANSMISSION
root@myboard:/home/BTtest# hcitool -i hci0 cmd 0x3F 0x0019 0x80 0x80 0x80 0x80 0x01 0x00 0x01 0x01 0x0D 0x03 0x0F 0x00 0x00 0x00 0x00 0x00 0x00 0x04
< HCI Command: ogf 0x3f, ocf 0x0019, plen 18
80 80 80 80 01 00 01 01 0D 03 0F 00 00 00 00 00 00 04
> HCI Event: 0x0e plen 4
01 19 FC 00
# STOP THE TX TRANSMISSION
root@myboard:/home/BTtest# hcitool -i hci0 cmd 0x3F 0x0019 0x80 0x80 0x80 0x80 0xF
F 0x00 0x01 0x01 0x0D 0x03 0x0F 0x00 0x00 0x00 0x00 0x00 0x00 0x04
< HCI Command: ogf 0x3f, ocf 0x0019, plen 18
80 80 80 80 FF 00 01 01 0D 03 0F 00 00 00 00 00 00 04
> HCI Event: 0xff plen 6
19 01 39 00 00 00
-------------------- STOPPING THE SCAN FOR BLE AND CLASSIC BEFORE THE TX TRANSMISSION ----------------
# RESET
root@myboard:/home/BTtest# hcitool -i hci0 cmd 0x03 0x0003
< HCI Command: ogf 0x03, ocf 0x0003, plen 0
> HCI Event: 0x0e plen 4
01 03 0C 00
# ENABLE SCAN
root@myboard:/home/BTtest# hcitool -i hci0 cmd 0x03 0x001a 0x3
< HCI Command: ogf 0x03, ocf 0x001a, plen 1
03
> HCI Event: 0x0e plen 4
01 1A 0C 00
# ENABLE EVENT FILTER
root@myboard:/home/BTtest# hcitool -i hci0 cmd 0x03 0x0005 0x02 0x00 0x02
< HCI Command: ogf 0x03, ocf 0x0005, plen 3
02 00 02
> HCI Event: 0x0e plen 4
01 05 0C 00
# ENTER IN TEST MODE
root@myboard:/home/BTtest# hcitool -i hci0 cmd 0x06 0x0003
< HCI Command: ogf 0x06, ocf 0x0003, plen 0
> HCI Event: 0x0e plen 4
01 03 18 00
# DISABLE THE BLE SCAN
root@myboard:/home/BTtest# hcitool -i hci0 cmd 0x03 0x001a 0x0
< HCI Command: ogf 0x03, ocf 0x001a, plen 1
00
> HCI Event: 0x0e plen 4
01 1A 0C 00
# DISABLE THE CLASSIC SCAN
root@myboard:/home/BTtest# hcitool -i hci0 cmd 0x08 0x000C 0x00 0x00
< HCI Command: ogf 0x08, ocf 0x000c, plen 2
00 00
> HCI Event: 0x0e plen 4
01 0C 20 00
# START THE TX TRANSMISSION
root@myboard:/home/BTtest# hcitool -i hci0 cmd 0x3F 0x0019 0x80 0x80 0x80 0x80 0x01 0x00 0x01 0x01 0x0D 0x03 0x0F 0x00 0x00 0x00 0x00 0x00 0x00 0x04
< HCI Command: ogf 0x3f, ocf 0x0019, plen 18
80 80 80 80 01 00 01 01 0D 03 0F 00 00 00 00 00 00 04
> HCI Event: 0x0e plen 4
01 19 FC 00
# STOP THE TX TRANSMISSION
root@myboard:/home/BTtest# hcitool -i hci0 cmd 0x3F 0x0019 0x80 0x80 0x80 0x80 0xFF 0x00 0x01 0x01 0x0D 0x03 0x0F 0x00 0x00 0x00 0x00 0x00 0x00 0x04
< HCI Command: ogf 0x3f, ocf 0x0019, plen 18
80 80 80 80 FF 00 01 01 0D 03 0F 00 00 00 00 00 00 04
> HCI Event: 0xff plen 6
19 01 63 07 00 00
** When disabling the scan before entering in the test mode, the stop for TX transmission give us:
root@myboard:/home/BTtest# hcitool -i hci0 cmd 0x3F 0x0019 0x80 0x80 0x80 0x80 0xFF 0x00 0x01 0x01 0x0D 0x03 0x0F 0x00 0x00 0x00 0x00 0x00 0x00 0x04
< HCI Command: ogf 0x3f, ocf 0x0019, plen 18
80 80 80 80 FF 00 01 01 0D 03 0F 00 00 00 00 00 00 04
> HCI Event: 0xff plen 6
19 01 ED 04 00 00
For Wifi 5 GHz
--------------------------------------------------------------------------------
Paramters: Continuous transmit, BW = 40 MHz, 802.11ac, No DFS, CH = 40, MCS0 (13.5), Power = 14 dBm
root@myboard:/home/BTtest# cat /proc/mwlan/adapter0/config
hardware_status=0
netlink_num=31
drv_mode=7
hssetpara=7,0xff,200,400
sdcmd52rw=0 0x0 0x00
rf_test_mode=1
tx_antenna=1
rx_antenna=1
band=1
bw=1
channel=44
radio_mode[0]=3
radio_mode[1]=
total rx pkt count=0
rx multicast/broadcast pkt count=0
rx fcs error pkt count=0
tx_power=14 2 0
tx_continuous=0
tx_frame=1 4352 0xaaa 1024 1 20 4294967295 0 0 4294967295 0 0 0 -1 -1 -1 -1 -1 -1 -1 05:43:3f:c4:51:ff
he_tb_tx=0
trigger_frame=0
otp_mac_add_rd_wr= 00:00:00:00:00:00
Hi @Christine_Li,
sorry for missing the context:
- kernel version: lf-6.6.52-2.2.2 merged with 6.6.y community kernel
- FW version: IW612-18.99.3.p25.7, sepaated BT/WiFi FW, no combo
- product: IW612
- UM11490 version: Rev. 1.8 — 2 June 2025
The following details will come ASAP
- dmesg logs or console logs when you load FW
- screenshot of the spectrum analyzer settings
In the meanwhile, please let us know if you may need anything else.
Thanks
Best Regards
Pier
Hi, @pierluigi_p
Which Wi-Fi/Bluetooth product are you using?
And what is your Linux kernel version? WiFi/Bluetooth driver and FW version?
From the command logs, all HCI commands are completed successfully and the TX start command is accepted by the controller. In addition, the vendor-specific event returned by the TX stop command contains non-zero packet counters, which indicates that the controller believes packets have been transmitted during the test period.
Therefore, the issue does not appear to be caused by a missing HCI command in the test sequence.
I would recommend checking:
The spectrum analyzer center frequency and span settings.
The Bluetooth channel configured by the TX test command.
The RF antenna configuration on the board.
Whether the Bluetooth firmware are loaded correctly.
Could you also share:
The chip being used (IW416/IW612/etc.)?
The exact UM11490 version?
The dmesg logs or console logs when you load FW?
Are you loading a combo FW or BT only FW?
A screenshot of the spectrum analyzer settings?
Best regards,
Christine.
Just adding, it was attempted with different settings for HackRF (gain and graphic adjustments), and we can see the 2.4 GHz (wifi) waveforms. Furthermore, we tested using different firmwares, for different versions in the imx-firmware repository, which includes one firmware for RF-test (sduart_nw61x_rftm_v1.bin.se in https://github.com/nxp-imx/imx-firmware/blob/lf-6.1.1_1.0.0/nxp/FwImage_IW612_SD/IW612_SD_RFTest/sdu...) without success.
Hello Pier and Christine
I'm Helbert, the developer who started the thread in the Veriscite forum.
Here are some attachments about the testing:
Dmesg log (without the power configuration):
Dmesg log (with the power configuration):
Screenshot with the spectrum analyzer and the config file for 5 GHz (own implementation and NXP implementation)
after
Note: it was found that using -1 for power, we use the default value, however different values was experimented too.
NXP script:
Screenshot with the classic Bluetooth test:
As you can see, there is no waveform generated
Screenshot with the BLE test running:
Screenshot after the BLE testing (waveform interrupted):
We can see in the graphic below that the waveform was interrupted when finishing the test
Modinfo log:
Tested HCI cmds:
Hi, @HelbertPaulino
Thanks for providing me the details.
Let me check your info and screenshot, then reply to you.
Please allow me some time.
Best regards,
Christine.