WL18xx Bluedroid Bluetooth RF Testing

Introduction

The Connection-less RF tests are connection-less RF spectrum tests which uses a spectrum analyzer for verification.

The BT SIG RF Testmode is meant for connecting with a Bluetooth tester where the Wilink device is controlled over the LMP (Link Management Protocol)

These tests are used at the production line after designing the board with the Wilink device. This is to sanity check the board works properly and detects any major design issues and manufacturing defects.

Connection-less RF tests

The Connection-less RF tests are connection-less RF spectrum tests which uses a spectrum analyzer for verification.

Note: The Wilink_X device must be power cycled when switched between different FCC modes.

Continuous TX

This is a non-packet continuous transmission with either GFSK (BR), π/4-DQPSK (2-EDR) or 8DPSK (3-EDR).

Steps and the HCI commands to put the device in the constant TX mode are:

Step 1:

run init script.

Step 2:

#set TxMode:  0x0 = un-modulated Single carrier, 0x1 = GFSK, 0x2 = EDR2, 0x3 = EDR3, 0x4 = BLE, 0x5 = ANT
TxMode = 1

Step 3:

Send_HCI_VS_DRPb_Enable_RF_Calibration_Enhanced 0xFDFB, 0x1, 0xFF, 0x00000000, 0x01
Wait_HCI_Command_Complete_VS_DRPb_Enable_RF_Calibration_Enhanced_Event 5000, any,HCI_VS_DRPb_Enable_RF_Calibration_Enhanced, 0x00

Step 4:

Send_HCI_VS_DRPb_Tester_Con_TX 0xFDCA, 2402, TxMode, 0, 7, 0x00000000, 0x00000000 // For TxMode relevant value please see step2
Wait_HCI_Command_Complete_VS_DRPb_Tester_Con_TX_Event 5000, any, HCI_VS_DRPb_Tester_Con_TX, 0x00

 

The parameters for the HCI_VS_DRPb_Tester_Con_TX are:

1. Opcode

• 0xFDCA

Typical test setup for Continuous TX mode

2. Frequency

• f=2402 ~ 2479

3. Modulation scheme

• 0=CW
• 1=GFSK (BR)
• 2=π/4-DQPSK (2-EDR)
• 3=8DPSK (3-EDR)

4. Test pattern

• 0=PN9
• 1=PN15
• 2=Z0Z0
• 3=all 1
• 4=all 0
• 5=F0F0
• 6=FF00

5. Power level index

• 0-7 where 0 is the lowest and 7 is the highest

6. Internal setting

• 0x00000000

7. Internal setting

• 0x00000000

To exit Continuous TX

The HCI commands for Stopping continuous Tx mode are:

TX Stop :

Send_HCI_VS_Write_Hardware_Register 0xFF01, 0x20014044, 0x0010
Wait_HCI_Command_Complete_VS_Write_Hardware_Register_Event 5000, any, HCI_VS_Write_Hardware_Register, 0x00

Stop PN Generator:

Send_HCI_VS_Write_Hardware_Register 0xFF01, 0x2001900C, 0x0000
Wait_HCI_Command_Complete_VS_Write_Hardware_Register_Event 5000, any, HCI_VS_Write_Hardware_Register, 0x00

Continuous RX

Step 1:

run init script.

Step 2:

Send_HCI_VS_DRPb_Enable_RF_Calibration_Enhanced 0xFDFB, 0x1, 0xFF, 0x00000000, 0x01
Wait_HCI_Command_Complete_VS_DRPb_Enable_RF_Calibration_Enhanced_Event 5000, any, HCI_VS_DRPb_Enable_RF_Calibration_Enhanced, 0x00

Step 3: To turn on the receiver portion of the chip the following command needs to be sent

#0x2 = Open Loop , 0x1 = Close Loop
Send_HCI_VS_DRPb_Tester_Con_RX 0xFDCB, 2402, 0x01, 0x01
Wait_HCI_Command_Complete_VS_DRPb_Tester_Con_RX_Event 5000, any, HCI_VS_DRPb_Tester_Con_RX, 0x00

The parameters for the HCI_VS_DRPb_Tester_Con_RX are:

1. Opcode

• 0xFDCB

2. Frequency

• f=2402 ~ 2480

3. Internal Setting (Rx Mode)

• 0- Connection mode
• 1- ADPLL Closed loop
• 2 – ADPLL Open loop
• 3 – Scan mode

4. Modulation Type

• 0=CW
• 1=GFSK (BR)
• 2=π/4-DQPSK (2-EDR)
• 3=8DPSK (3-EDR)

The setup would be the same as for Continuous TX.

BT SIG RF Testmode

The BT SIG RF Testmode is meant for connecting with a Bluetooth tester where the Wilink_X is controlled over the LMP (Link Management Protocol). The procedure for enabling the Wilink_X for BT SIG mode is:

1. Proper device power-up
2. Load the correct service pack
   

   Wilink_X Bluetooth RF SIG mode test setup
3. Load the DUT script (three HCI commands)

Once the device (DUT) is in test mode, the BT tester will, through the RF connection (LMP), take control of the DUT.

The HCI commands to put the device in test RF SIG mode are:

HCI_Enable_Device_Under_Test_Mode
HCI_Set_Event_Filter 0x02, 0x00, 0x03
HCI_Write_Scan_Enable 0x03

This script will make the device visible and connectable (HCI_Write_Scan_Enable ), auto-accept all connections (HCI_Set_Event_Filter ) and put the DUT in test mode (HCI_Enable_Device_Under_Test_Mode).

Once the proper sequence has been completed (first loading the BT service pack and then the DUT script), then the BT tester will take control of the device through the RF link (LMP).

Production Line Test (PLT)

The connection-less PLT is a bit error rate (BER) test of the DUT. It is primarily for testing of BT sensitivity (- 70dBm per BT standard).

Note: Observe maximum RF input power during PLT test (-5dBm for BR and -10dBm for EDR)

The VS HCI commands for the PLT test mode are:

Note: In order to conduct the PLT test the user need to have a special waveform to be sent(from the IQ) with an embedded BD address in it.
And that is the BD address that need to be written in the BER meter command mentioned below.

HCI_VS_DRPb_BER_Meter_Start 0xFD8B, 0, 0, 0x341278563412, 1, 0x1, 27, 1000, 0x1FF, 0x1

Delay 5000 (ms)

HCI_VS_DRP_Read_BER_Meter_Result 0xFD13

The procedure is to send the first VS HCI command (HCI_VS_DRPb_BER_Meter_Start) which starts the BER function in the Wilink_X device. A delay equal to or longer than the time it takes to read the number of packets specified is needed before the second VS HCI command (HCI_VS_DRP_Read_BER_Meter_Result is sent to read back (event) the BER test result.

The parameters of the first command (HCI_VS_DRPb_BER_Meter_Start) are:

1. Op code

• 0xFD8B

2. Frequency Channel

• 0-39: f=2402+(2*i)MHz
• 40-78: f=2403+2(i-40)MHz
  

  Wilink_X Bluetooth PLT mode test setup
  
  

3. Reserved (0x00) 4. BD Address

• Is expressed as Little Endian
• Must match the MAC (BD) address as specified by the transmitter

BT RF test: Commands for Wilink devices NDA- TI Confidential

• Actual MAC address of 12:34:56:78:12:34 would be 34:12:78:56:34:12

5. LT Address (0x01) 6. ACL TX packet type

• 0=DM1
• 1=DH1
• 2=DM3
• 3=DH3
• 4=DM5
• 5=DH5
• 6=2-DH1
• 7=2-DH3
• 8=2-DH5
• 9=3-DH1
• A=3-DH3
• B=3-DH5

7. Packet length

• DM1: 0-17
• DH1: 0-27
• DM3: 0-121
• DH3: 0-183
• DM5: 0-224
• DH5: 0-339

8. Number of packets to be used for the BER test (0x0000-0xFFFF)

9. PRBS initialize (0x1FF)

10. Poll period

• Poll period of 5 means that every fifth packet received is used in the BER calculation (longer test time)
• Poll period of 1 means every packet received is used in the BER calculation (shortest test time)

The frequency channel, BD address, packet type and #bytes/packet must match that of the transmitter.

If another Wilink_X unit is used for the BT transmitter in the PLT BER test, then the following two commands needs to be sent after the successful loading of the BT service pack:

HCI_VS_Write_BD_ADDR 0xFC06, "123456781234"
HCI_VS_DRPb_Tester_Packet_TX_RX 0xFDCC, 1, 3, 2402, 0xFFFF, 0x5, 0, 27, 7, 1, 0x01FF

where the first VS HCI command sets the BD address of the TX device, as the DUT device needs to know the specific BD address of the transmitter.

The second VS HCI command HCI_VS_DRPb_Tester_Packet_TX_RX sets the transmitter characteristics.

BLE testing

Below are the HCI commands from the Spec to place the device in BT LE test mode :

Transmitter Test

Send_HCI_BLE_Transmitter_Test 0x201e, 0x00, 0x00, 0
Wait_HCI_Command_Complete_BLE_Transmitter_Test_Event 5000, any, HCI_BLE_Transmitter_Test, 0x00

Send_HCI_BLE_Test_End 0x201f
Wait_HCI_Command_Complete_BLE_Test_End_Event 5000, any, HCI_BLE_Test_End, 0x00, 0

Receiver Test

Send_HCI_BLE_Receiver_Test 0x201d, 0x00
Wait_HCI_Command_Complete_BLE_Receiver_Test_Event 5000, any, HCI_BLE_Receiver_Test, 0x00

Send_HCI_BLE_Test_End 0x201f
Wait_HCI_Command_Complete_BLE_Test_End_Event 5000, any, HCI_BLE_Test_End, 0x00, 0

To disable RF Calibration

Send_HCI_VS_DRPb_Enable_RF_Calibration_Enhanced 0xFDFB, 0x1, 0xFF, 0x80000000, 0x00
Wait_HCI_Command_Complete_VS_DRPb_Enable_RF_Calibration_Enhanced_Event 5000, any,HCI_VS_DRPb_Enable_RF_Calibration_Enhanced, 0x00

Conversion of HCI cmds to Bluedroid Tool format

Bluedroid tool(dut_mode_send)is a tools used to send HCI commands to WiLink8.

For a focus on hci command that are not readily available. Here is the format to use.

Send_HCI_VS_DRPb_Tester_Con_TX 0xFDCA, 2402, 0, 0, 7, 0x00000000, 0x00000000
dut_mode_send <ogf> <ocf> [Parameters]

<ogf> and <ocf>, along with parameters are all hexadecimal values.

Every HCI commands have an opcode; this opcode is a combination of the <ogf> and <ocf>.

The same format applies to all HCI_VS commands. See the snapshot below.

For instance, given this command: # Enable Page and inquiry scan:

Send_HCI_Write_Scan_Enable 0x03

This command has an opcode of 0x0c1a

0x0c1a                         -> 0000 1100 0001 1010
OCF (10 bit opcode cmd field)  ->        00 0001 1010 -> 0x01a
OGF (6 bit opcode group field) -> 0000 11 -> 0x03

Thus: Dut_mode_send 0x03 0x01a 0x03 -> Enable page and inquiry scan

FDCA -> 1111 11 01 1100 1010
      0011 1111 -> 3f
               0001 1100 1010 -> 1CA
dut_mode_send 0x3f 0x1ca

NOTE: "dut_mode_send" command, only works for vendor specific commands.

Examples of Enhanced Bluedroid Test Format conversion

Apply the below patch for supporting dut_mode_send command

diff --git a/external/bluetooth/bluedroid/btif/src/btif_core.c b/external/bluetooth/bluedroid/btif/src/btif_core.c
index 62339a9..65d06b7 100755
--- a/external/bluetooth/bluedroid/btif/src/btif_core.c
+++ b/external/bluetooth/bluedroid/btif/src/btif_core.c
@@ -779,7 +779,8 @@ static bt_status_t btif_disassociate_evt(void)
 *******************************************************************************/
 static void btif_dut_mode_cback( tBTM_VSC_CMPL *p )
 {
-    /* For now nothing to be done. */
+    BTIF_TRACE_DEBUG1("%s", __FUNCTION__);
+    HAL_CBACK(bt_hal_cbacks, dut_mode_recv_cb, p->opcode, p->p_param_buf, p->param_len);
 }
 
 /*******************************************************************************
@@ -823,10 +824,10 @@ bt_status_t btif_dut_mode_send(uint16_t opcode, uint8_t *buf, uint8_t len)
 {
     /* TODO: Check that opcode is a vendor command group */
     BTIF_TRACE_DEBUG1("%s", __FUNCTION__);
-    if (!btif_is_dut_mode()) {
+    /*if (!btif_is_dut_mode()) {
          BTIF_TRACE_ERROR0("Bluedroid HAL needs to be init with test_mode set to 1.");
          return BT_STATUS_FAIL;
-    }
+    }*/
     BTM_VendorSpecificCommand(opcode, len, buf, btif_dut_mode_cback);
     return BT_STATUS_SUCCESS;
 }
diff --git a/external/bluetooth/bluedroid/test/bluedroidtest/bluedroidtest.c b/external/bluetooth/bluedroid/test/bluedroidtest/bluedroidtest.c
index 130bc60..e9adfa2 100644
--- a/external/bluetooth/bluedroid/test/bluedroidtest/bluedroidtest.c
+++ b/external/bluetooth/bluedroid/test/bluedroidtest/bluedroidtest.c
@@ -471,7 +471,13 @@ static void adapter_state_changed(bt_state_t state)
 
 static void dut_mode_recv(uint16_t opcode, uint8_t *buf, uint8_t len)
 {
-    bdt_log("DUT MODE RECV : NOT IMPLEMENTED");
+    uint8_t evt_param_index;
+
+    printf("DUT MODE RECV: [Opcode = 0x%4X] [Param_len = %d] [Param = ", opcode, len);
+
+    for(evt_param_index=0; evt_param_index<len; evt_param_index++)
+	printf(" 0x%02X", buf[evt_param_index]);
+    printf("]\n");
 }
 
 static bt_callbacks_t bt_callbacks = {
@@ -538,6 +544,66 @@ void bdt_dut_mode_configure(char *p)
     check_return_status(status);
 }
 
+void bdt_dut_mode_send(char *p)
+{
+    uint16_t ogf = 0;
+    uint16_t ocf = 0;
+    char *tok_str;
+    uint16_t opcode;
+    uint8_t param[1024];
+    uint16_t opcode_field_count;
+    uint16_t param_index , param_len;
+
+    bdt_log("BT DUT MODE SEND");
+
+    param_len = 0;
+    param_index = 0;
+    opcode_field_count = 2;
+
+    if (!bt_enabled) {
+        bdt_log("Bluetooth must be enabled for test_mode to work.");
+        return;
+    }
+
+    tok_str = strtok (p," ");
+    while (tok_str != NULL) {
+        switch(opcode_field_count)
+        {
+            case 2:
+            ogf = strtol(tok_str, NULL, 16);
+            break;
+
+            case 1:
+            ocf = strtol(tok_str, NULL, 16);
+            break;
+
+            default:
+            param[param_index++] =  strtol(tok_str, NULL, 16);
+            break;
+        }
+        opcode_field_count--;
+        tok_str = strtok (NULL, " ");
+    }
+
+    param_len = param_index;
+    bdt_log("ogf = 0x%02X", ogf);
+    bdt_log("ocf = 0x%02X", ocf);
+
+    opcode = (ocf & 0x03ff)|(ogf << 10);
+
+    bdt_log("opcode = 0x%02X", opcode);
+    bdt_log("param_len = %d", param_len);
+
+    printf("params: ");
+    for(param_index=0; param_index<param_len; param_index++)
+        printf("0x%02X ", param[param_index]);
+    printf("\n");
+
+    status = sBtInterface->dut_mode_send(opcode, param, param_len);
+
+    check_return_status(status);
+}
+
 void bdt_cleanup(void)
 {
     bdt_log("CLEANUP");
@@ -595,6 +661,11 @@ void do_dut_mode_configure(char *p)
     bdt_dut_mode_configure(p);
 }
 
+void do_dut_mode_send(char *p)
+{
+    bdt_dut_mode_send(p);
+}
+
 void do_cleanup(char *p)
 {
     bdt_cleanup();
@@ -623,6 +694,7 @@ const t_cmd console_cmd_list[] =
     { "enable", do_enable, ":: enables bluetooth", 0 },
     { "disable", do_disable, ":: disables bluetooth", 0 },
     { "dut_mode_configure", do_dut_mode_configure, ":: DUT mode - 1 to enter,0 to exit", 0 },
+    { "dut_mode_send", do_dut_mode_send, ":: <ogf> <ocf> <parameters>", 0 },
 
     /* add here */
 
@@ -636,7 +708,7 @@ const t_cmd console_cmd_list[] =
 
 static void process_cmd(char *p, unsigned char is_job)
 {
-    char cmd[64];
+    char cmd[1024];
     int i = 0;
     char *p_saved = p;
 
@@ -664,7 +736,7 @@ static void process_cmd(char *p, unsigned char is_job)
 int main (int argc, char * argv[])
 {
     int opt;
-    char cmd[128];
+    char cmd[1024];
     int args_processed = 0;
     int pid = -1;
 
@@ -685,13 +757,13 @@ int main (int argc, char * argv[])
 
     while(!main_done)
     {
-        char line[128];
+        char line[1024];
 
         /* command prompt */
         printf( ">" );
         fflush(stdout);
 
-        fgets (line, 128, stdin);
+        fgets (line, 1024, stdin);
 
         if (line[0]!= '\0')
         {
@@ -699,7 +771,7 @@ int main (int argc, char * argv[])
             line[strlen(line)-1] = 0;
 
             process_cmd(line, 0);
-            memset(line, '\0', 128);
+            memset(line, '\0', 1024);
         }
     }

• First start by running the 'bdt'(system/bin/bdt) executable.

Disabling the sleep protocol

HCI Tester command format

Send_HCI_VS_Sleep_Mode_Configurations 0xFD0C, 0, 0, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 100

Bluedroid 'bdt' Tool format

dut_mode_send 0x3f 0x10c 0x00 0x00 0x0ff 0xff 0xff 0xff 0xff 0x64

Connection-less RF tests

The Connection-less RF tests are connection-less RF spectrum tests which uses a spectrum analyzer for verification.

Test that the commands are being sent to the device.

HCI Tester command format

Send_HCI_Inquiry "9E8B33", 0x04, 0x00

Bluedroid 'bdt' Tool format

dut_mode_send 0x01 0x001 0x33 0x8b 0xe9 0x04 0x00

Continuous TX

This is a non-packet continuous transmission with either GFSK (BR), π/4-DQPSK (2-EDR) or 8DPSK (3-EDR).

The HCI commands to put the device in the Continuous TX mode (after service pack has been loaded) are:

HCI Tester command format

Send_HCI_VS_DRPb_Enable_RF_Calibration_Enhanced 0xFDFB, 1, 0xFF, 0x00000000, 0x01
Send_HCI_VS_DRPb_Tester_Con_TX 0xFD84, 2402, 0x1, 0, 7, 0x00000000, 0x00000000

Bluedroid 'bdt' Tool format

dut_mode_send  0x3f 0x01fb 0x01 0xff 0x00 0x00 0x00 0x00 0x01
dut_mode_send  0x3f 0x01ca 0x62 0x09 0x01 0x00 0x07 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00

HCI Tester command format

Send_HCI_VS_Write_Hardware_Register 0xFF01, 0x20014044, 0x0010 //TX Stop
Send_HCI_VS_Write_Hardware_Register 0xFF00, 0x2001900C, 0x0000 //Stop PN Generator

Bluedroid 'bdt' Tool format

dut_mode_send  0x3f 0x0301 0x44 0x40 0x01 0x20 0x10 0x00 //TX Stop
dut_mode_send  0x3f 0x0301 0x0c 0x90 0x01 0x20 0x00 0x00 //Stop PN Generator

Packet TX/RX

To enable the continuous packet transmission/receive the following commands need to be sent after the loading of the service pack:

HCI Tester command format

Send_HCI_VS_DRPb_Tester_Packet_TX_RX 0xFDCC, 0x00, 0x03, 0x0962, 0xffff, 0x05, 0x00, 0x001b, 0x07, 0x01, 0x01ff

Bluedroid 'bdt' Tool format

dut_mode_send 0x3f 0x1cc 0x00 0x03 0x62 0x09 0xff 0xff 0x05 0x00 0x1b 0x00 0x07 0x01 0xff 0x01

Continuous RX

To turn on the receiver portion of the chip the following command needs to be sent after the loading of the service pack:

HCI Tester command format

Send_HCI_VS_DRPb_Enable_RF_Calibration_Enhanced 0xFDFB, 0x1, 0xFF, 0x00000000, 0x01
Send_HCI_VS_DRPb_Tester_Con_RX 0xFDCB, 2402, 0x01, 0x01

Bluedroid 'bdt' Tool format

dut_mode_send 0x3f 0x01fb 0x01 0xff 0x00 0x00 0x00 0x00 0x01
dut_mode_send 0x3f 0x01cb 0x62 0x09 0x01 0x01

BT SIG RF Testmode

The BT SIG RF Testmode is meant for connecting with a Bluetooth tester where the Wilink_X is controlled over the LMP (Link Management Protocol).

The procedure for enabling the Wilink_X for BT SIG mode is:

1. Proper device power-up
2. Load the correct service pack
3. Load the DUT script (three HCI commands)

Once the device (DUT) is in test mode, the BT tester will, through the RF connection (LMP), take control of the DUT.

The HCI commands to put the device in test RF SIG mode are:

HCI Tester command format

HCI_Enable_Device_Under_Test_Mode
HCI_Set_Event_Filter 0x02, 0x00, 0x03
HCI_Write_Scan_Enable 0x03

Bluedroid 'bdt' Tool format

dut_mode_send 0x06 0x03
dut_mode_send 0x03 0x05 0x02 0x00 0x03
dut_mode_send 0x03 0x1a 0x03

Production Line Test (PLT)

The connection-less PLT is a bit error rate (BER) test of the DUT. It is primarily for testing of BT sensitivity (- 70dBm per BT standard).

HCI Tester command format

Send_HCI_VS_DRPb_BER_Meter_Start 0xFD8B, 0x00, 0x00, 0x341278563412, 0x01, 0x01, 0x001b, 0x03e8, 0x01ff, 0x01

Bluedroid 'bdt' Tool format

dut_mode_send 0x3f 0x18b 0x00 0x00 0x12 0x34 0x56 0x78 0x12 0x34 0x01 0x01 0x1b 0x00 0xe8 0x03 0xff 0x01 0x01

Delay 5000 (ms)

HCI Tester command format

Send_HCI_VS_DRP_Read_BER_Meter_Result 0xFD13

Bluedroid 'bdt' Tool format

dut_mode_send 0x3f 0x113

The procedure is to send the first VS HCI command (HCI_VS_DRPb_BER_Meter_Start) which starts the BER function in the Wilink_X device.

A delay equal to or longer than the time it takes to read the number of packets specified is needed before the second VS HCI command (HCI_VS_DRP_Read_BER_Meter_Result is sent to read back (event) the BER test result.

The frequency channel, BD address, packet type and #bytes/packet must match that of the transmitter.

If another Wilink_X unit is used for the BT transmitter in the PLT BER test, then the following two commands needs to be sent after the successful loading of the BT service pack:

HCI Tester command format

Send_HCI_VS_Write_BD_ADDR 0xFC06, "123456781234"
Send_HCI_VS_DRPb_Tester_Packet_TX_RX 0xFDCC, 0x01, 0x03, 0x0962, 0xffff, 0x05, 0x00, 0x001b, 0x07, 0x01, 0x01ff

Bluedroid 'bdt' Tool format

dut_mode_send 0x3f 0x006 0x34 0x12 0x78 0x56 0x34 0x12
dut_mode_send 0x3f 0x1CC 0x01 0x03 0x62 0x09 0xff 0xff 0x05 0x00 0x1b 0x00 0x07 0x01 0xff 0x01

Where the first VS HCI command sets the BD address of the TX device, as the DUT device needs to know the specific BD address of the transmitter. This command HCI_VS_DRPb_Tester_Packet_TX_RX sets the transmitter characteristics.

BLE testing

Transmitter Test

HCI Tester command format

Send_HCI_VS_DRPb_Enable_RF_Calibration_Enhanced 0xFDFB, 0x1, 0xFF, 0x80000000, 0x00 //disable RF Calibration
Send_HCI_BLE_Transmitter_Test 0x201e, 0x00, 0x00, 0
Send_HCI_BLE_Test_End 0x201f

BlueZ HCI tool format:

dut_mode_send 0x3f 0x01fb 0x01 0xff 0x00 0x00 0x00 0x80 0x00 //disable RF Calibration
dut_mode_send 0x08 0x001e 0x00 0x00 0x00
dut_mode_send 0x08 0x001f

Receiver Test

HCI Tester command format

Send_HCI_VS_DRPb_Enable_RF_Calibration_Enhanced 0xFDFB, 0x1, 0xFF, 0x80000000, 0x00 //disable RF Calibration
Send_HCI_BLE_Receiver_Test 0x201d, 0x00
Send_HCI_BLE_Test_End 0x201f

BlueZ HCI tool format:

dut_mode_send 0x3f 0x01fb 0x01 0xff 0x00 0x00 0x00 0x80 0x00 //disable RF Calibration
dut_mode_send 0x08 0x001d 0x00
dut_mode_send 0x08 0x001f