SSD40NBT

SMU is the safest way to set it.

# smu_cli set tx-max-bg 6

# smu_cli get tx-max-bg

    Reg Domain:  WW

    BG Antenna Adj: 3 dB

    A  Antenna Adj: 0 dB

Remember the  value is in ½ db increments so you need to use 6 to get 3 dBm. 


Also fw_setenv is able to set it as well.
rfPowerAtten2=6
 

# fw_printenv

...

usbnet_devaddr=de:ad:be:ef:00:01

md5_at91bs=75a5a900d8df5657ebc89796756eed70

md5_u-boot=cc8187cf4471832e51580a284df37f86

md5_kernel-a=300d5b9d93abaec368fb700933a95bdb

md5_rootfs-a=62e98ead848d552ab6199b6ed543dd4d

bootargs=console=ttyS0,115200 loglevel=4 rw noinitrd mem=64M rootfstype=ubifs root=ubi0:rootfs ubi.mtd=6

bootcmd=nand read 0x22000000 0x000e0000 0x00500000; bootm

rfPowerAtten2=6

Ezurio (formerly Laird Connectivity) is actively working with our vendor to patch the kr00k vulnerability on Ezurio products. Unfortunately, at this time a firmware fix has not been provided for the BCM4329 (used in the 40 Series products). Based on an understanding that this vulnerability has a severity level of “low” by NIST, it is recommended that customers use TLS data encryption whenever possible as TLS tunneled data is not at risk for the kr00k vulnerability.

For more information on the vulnerability, please visit:

https://nvd.nist.gov/vuln/detail/CVE-2019-15126
https://www.eset.com/int/kr00k/

 Is there a registry setting to disable the display of Channel 14 in the WIFI Channel Set screen of the LCM? We have set the regulatory domain to ETSI in the registry, and this is correctly reported by the LCM, but we shouldn't be able to enable channel 14 Checking the box for channel 14 in the LCM will have no effect on the radio; the channel will be ignored by the radio since the firmware does not allow ch14 in ETSI.  There is no mechanism to change the list of channels displayed in the UI for the custom channel configuration.   Note that the actual channel set used by the radio is the subset of the list of channels permitted by the regulatory domain and the set of channels configured in the custom channel set.  The channel set screen can?t enable a disallowed channel.

Where can I find the SDK for the Enterprise Wi-Fi Radios? If there is no SDK available for download in the product's Software Downloads section then the SDK will be in the release .zip folder.  

1) The SD host controller driver (their driver, not ours) detects that a device is on the SDIO bus and signals the SD bus driver (a Microsoft driver) 2) The SD bus driver enumerates the card to determine what device it is and what client driver needs to be loaded.  The bus driver does this at a low clock frequency because it doesn?t yet know what bus speed the client device can support.  Note that the host controller driver is the one that actually performs all accesses to the card as it is the one that manages the actual SDIO controller hardware on the host platform.  The bus driver is accessing the card via the host controller driver. 3) The SD bus driver determines that our driver is the ?client driver? registered for the card by reading the vendor/product IDs from the card and looking up that information in the registry.  Our driver is registered for that combination of VID/PID. 4) The bus driver loads the client driver, which in this case is our driver. 5) The client driver continues initialization, which includes accessing the card itself by making calls to the SD bus driver which passes those calls on to the host controller driver which implements the actual card access via the host controller itself in the host CPU.  It?s important to note that the client driver (us) only requests that a card access be made; it is the host controller driver that implements the access via the host controller on the host CPU.   6) Very early in the initialization sequence the client driver (us) makes a call to the bus driver to configure the bus speed, bus width etc.  The speed is the lower of what the card supports and what the host controller supports on that slot.  From that point on, all accesses are occurring at a much higher bus speed. 7) The card continues initialization, which includes downloading the firmware and then enabling interrupts.  From this point on, interrupts have to be working for the card to function properly.

By default, it will show annoSUMMIT as outer ID to protect the ID not showing in public. If really need to show the real ID in outer ID, then need to add semicolon (;) at the end of ID configuration to make it happen.

From 3.5.0.13, the default scan list changed from 64 to 16 and able to adjust by this registry, HKEY_LOCAL_MACHINE\Comm\SDCCF10G1\Parms\Configs\GlobalConfig\MaxBssListSize 

Need to set two registries to come out the scan list information to log. [HKLM\Software\Laird\IB\Logger] Global=dword:3 ; enable error messages for all components [HKEY_LOCAL_MACHINE/Comm/SDCCF10G1/Parms/Configs/GlobalConfig] dbgLevel=dword:B ; enable the scan list output

Auto profile is to roam among multiple profiles you add into the auto profile list. You can add this by LCM or by registry as below. Auto Profile Registry Setting You can enable Auto Profile from the registry. Key autoProfile Path HKLM\Comm\SDCCF10G1\Parms\Configs\GlobalConfig   Note: The HKLM\Comm\SDCCF10G1\Parms\Configs\... path is the same for all radios. Type DWORD Config01 is (by default) the default profile and cannot be used for auto profile. It must be set to 0. For example, if you want to automatically connect to Config02, Config05, and Config10, that would equal 10000100101 Convert that number to decimal which is 1061. The number 1061 would be entered as the value for the autoProfile key. 

Roaming cannot be disabled. You may set the roam trigger to the lowest RSSI value in the list which will cause the client to remain connected without scanning to roam until this very low RSSI is measured. However, beacon lost and some other situations may also trigger roam scan.  On loss of association the client disregards the roam trigger, delta, and period and immediately begins scanning to re-associate as quickly as is possible. Roam Trigger The signal strength (RSSI) (in dBm) at which the radio scans for an access point with a better signal strength. When scanning for a different access point, the radio looks for one with a RSSI at the indicated roam delta dBm level or stronger. Key Roam Trigger Path HKLM\Comm\SDCCF10G1\Parms\Configs\GlobalConfig\RoamTrigger   Note: The HKLM\Comm\SDCCF10G1\Parms\Configs\... path is the same for all radios. Value -50 (0x32) -55 (0x37) -60 (0x3c) -65 (0x41) -70 (0x46) -75 (0x4b) -80 (0x50) -85 (0x55) or Custom Default -70 Type DWORD

WMM APSD stands for Wi-Fi Multimedia (WMM) Automatic Power Save Delivery. It is basically a feature mode that allows your mobile devices to save more battery while connected to your wifi network. So to use APSD, WMEenabled must be set. WMM Use of Wi-Fi Multimedia Extensions, also known as WMM. Key WMM Path HKLM\Comm\SDCCF10G1\Parms\Configs\GlobalConfig\WME   Note: The HKLM\Comm\SDCCF10G1\Parms\Configs\... path is the same for all radios. Value (0) On (1) Off  

Yes, we support certificate valid date checking, but need to enable bit 2 in suppInfo. unsignedlongsuppInfo -  Meaning: Turn on or off other protocols. -  Value: bit 0 is Summit FIPS on/off; bit 1 is reserved; bit 2 is CA cert date-check enable; bit 3  is pre 2014 WPA1 operation 

We will check if the CA cert is out of date. If yes, have error code during the authentication process.

The value that is in the CF10G_STATUS driverVersion field from SDK is not the complete, full driver version.  It contains the A value in the upper 16 bits, the B value in the next 8 bits and the C value in the lowest 8 bits. In addition, there are some flags that are OR?ed in to the lower 16 bits.  Overall, it is nearly useless as a driver version field but due to backwards combability issues so can?t be changed at this point. The driver writes its full version to the registry at boot as below.  This is where the LCM gets the driver version,. [HKLM\Comm\SDCCF10G1\Parms]     ?DriverFullVersion?  

The responsibility for providing the QDID for a host system is with the provider of the stack that is used on that system. If for instance the host system uses a module that requires the Bluetooth stack to run on that system (e.g. Lairds Sterling-LWB in a Linux platform) the QDID must be provided by the stack vendor who's stack is running on that Linux platform. Challenges might occur when an open-source, community based stack is used. If a module with integrated stack us used (e.g. Lairds BL652) the QDID is provided by the module vendor.  

The ECCN for the radios listed, which comprise the "Summit" line of Wi-Fi radios, is 5A002.

All this can be controlled through standard Linux commands/programs like ?iw?, ?hostapd?, ?wpa_supplicant?, ?wpa_cli?, etc.

Ezurio provides 3D files (STEP) files for most but not all of it's modules.  Based on the nature of the information in the files, in most cases Laird requires a login to access these files as well as layout files and software/firmware downloads.  As such, for most modules, the 3D files are found under the Software Downloads tab of the product page.  The page offers a credentials request link for customers who need credentials.  In most cases, the credentials are provided via return email within about 10 minutes. Please contact support if you have any additional questions or have any issues accessing our downloads.

We only recommend reflowing our modules once as it can damage the module and void the warranty.

We highly do not recommend conformal coating the radio module. If you plan on encapsulating the radio module in a potting compound or conformal coating, you must assure that the compound in liquid or solid form does not enter under the shield where there are sensitive RF components. Some of the capacitive and inductance values are as low (pF and nH) and could be sensitive to contacting materials such as potting compounds. There are potting compounds and conformal coatings which have very good dielectric constants and are suitable for 2.4 GHz potting applications, however, when you apply any of these, they were not accounted for in the circuit design and might reduce performance of the device (or all together cause it not to function).  You should run tests on their particular potting compound and evaluate radio's performance and range.  Also, it's worth mentioning that applying any compound, conformal coating or potting directly to the module WILL void the warranty. If your application requires 100% sealing of the radio module, there is a way to do this very successfully without impacting the module performance. Simply place the module on your PCB. Place a plastic cover over the module (like a hat), make the cover large enough to cover the whole module. Apply glue around the bottom perimeter of the cover where it sits on the PCB. This allows the module to function in free air-space while there is a complete seal around it. This information is only for reference and we recommend you should conduct your own testing with your prototype of your end application to find the best suitable fit for your design.  

Ezurio provides layout files PADS and PADS ASCII formats. The ASCII files will import to Altium (and Protel varients) as well as Cadence (Orcad and Allegro) CAD packages. As far as we know, there is no way to import to Eagle CAD. Please be sure to use the .asc file for PCB and the .txt file for the schematic when importing to Altium. Ezurio uses ORCAD for schematics (Gerbers). 

The recommended cleanser is "hydrocarbon cleaning oil", which can be used to clean the RF shield and PCB. We do not recommend the use of alcohol as it doesn't work as well and could leave residue on the boards.  

Both are EOL'd products. The 40L is based on a BCM4319 whereas the 41NBT is based on a BCM4329 chipset. The 41NBT is a derivative from the 40NBT. We took the 40NBT and combined the antenna paths into a single antenna to create the 41NBT.

The radio chipset value is written by the driver when it loads, and indicates which radio is actually installed. LCM uses this value to determine some parameters that vary between radio types. If you want to hard code the Wi-Fi radio before the driver loads, you can do so with this registry: [HKEY_LOCAL_MACHINE/Comm/SDCCF10G1/Parms/Configs/GlobalConfig] "RadioChipSet"=dword:00000006 The values for that registry key are in the sdc_sdk.h as follows: typedef enum _RADIOCHIPSET { RADIOCHIPSET_NONE = 0, RADIOCHIPSET_SDC10 = 1, //BCM4318 RADIOCHIPSET_SDC15 = 2, //BCM4322, RADIOCHIPSET_SDC30 = 3, //AR6002, RADIOCHIPSET_SDC40L = 4, //BCM4319, RADIOCHIPSET_SDC40NBT = 5, //BCM4329, RADIOCHIPSET_SDC45 = 6, //AR6003, RADIOCHIPSET_SDC50 = 7, //AR6004, } RADIOCHIPSET;

For the 30AG, we recommend the 3.5.0.9 cab build or later for both test cases. For the 40NBT, use 3.4.13.36 cab build or later. As for the 45N, cab build from 3.5.1.6 can support both test cases.

You can modify this feature by creating a new registry called ?NotifyAttempts? under ?hklm/software/Laird/ScuTray?, this allows you to disable / enable the pop-up message for WPA / WPA2 authentication and even set the number of attempts before notification. -DWORD: NotifyAttempts -Values: 0 (disabled); NOT 0 (the number of attempts before notification)

The MTBF number for the SSD40NBT at 30 degrees Celsius is 11,700,415 hours.

For the 10, 15, 30, and 40 series, the status of the LCM / SCU can be in one of two states, "non-associated? and ?associated". Once the radio has associated with an AP, it will move from "non-associated? to ?associated". If WPA / WPA2 authenticates failure, the status will switch between "non-associated? and ?associated". If authentication occurs without an IP the radio cannot be identified from the status field -- you will need to check in the IP field. For the 45 and 50 series, the status in LCM / SCU can be in one of three states, "Not Associated", "Associated", and "Connected?. Associated with no IP is a valid state for our radios to attempt to reconnect with an invalid PSK. Once the radio has associated with an AP, it will move from "not associated? to ?associated". Only after the radio authenticates and has an IP will it move to the "Connnected" state. In the case of WPA or WPA2 authenticated failure or authentication without an IP the radios will remain  in an "associated" state.

Setting the following registry to 0 can achieve this: HKLM\Comm\SDCCF10G1\Parms\Configs\GlobalConfig DWORD: trayIcon - 0 = Hide Icon - Non-0 = Show Icon

No, the patch that supports SHA-2 is in the Windows Embedded Compact 7 Monthly Update (April 2016). Prior to that, the OS itself doesn't support it.

Yes, here is an example. 1. The auto profile list contains SSID_1 and SSID_2 2. Device is connected to SSID_1 3. RSSI drops below roam trigger, the radio scans for other APs and finds SSID_2 is a better candidate 4. The radio disconnects from SSID_1 and connects to SSID_2

NDIS5 runs Laird's WEC7 release.

The following three registry keys should be set to show Wi-Fi or BT interface only. [HKLM\SOFTWARE\Summit\SCU] DWORD: Status (= 3 by default) [HKLM\SOFTWARE\Summit\SCU] DWORD: Config (= 3 by default) [HKLM\SOFTWARE\Summit\SCU] DWORD: Diag (= 3 by default) value: 1 - Show Wi-Fi Only 2 - Show Bluetooth Only 3 - Show Both If you want to show Bluetooth only in LCM, you should set all the above three registry keys to 1.

CCKM is supported with all EAP types Laird supports?LEAP, EAP-FAST, PEAP-MSCHAPv2, PEAP-GTC, PEAP-TLS, EAP-TLS and EAP-TTLS. ACS supports all of the EAP types except EAP-TTLS. However, supporting CCKM is not dependent on using ACS as the RADIUS server. Laird can do CCKM with any RADIUS server since CCKM support is in the wireless infrastructure.

Standard: indicates PMK Caching: This means that the 802.1x authentication can be skipped on an access point that a client has already authenticated to once before. Only the 4-way handshake needs to happen. This is useful for a client that needs to reconnect to an access point that it roamed away from previously, due to signal loss etc. However, if a client has not roamed to a particular access point during its current working session, it must then authenticate to that specific access point using 802.1x. PMK Caching is the method defined in the 802.11x (WPA/WPA2) specification. Opportunistic Key Caching: With this method, a client device can skip the 802.1x authentication with an access point after a full authentication,and only needs to perform the 4 way handshake when roaming to access points that are centrally managed by the same WLC in an LWAPP or other controller-based infrastructure. This means that the client doesn't need to authenticate with access points that it wants to roam to, as long as the client has authenticated successfully to at least one of the access points in the same zone as the access point that handled the previous successful authentication. In this case, the PMK identifier has been cached at a central location, like the WLC (or wireless switch.) With OKC, the client must support this method for it to be used, even if the infrastructure has been configured with OKC enabled.

The 40 series loads a Regulatory firmware to allow hardware testing of max Tx Power when the Laird Regulatory Utility (LRU) is used. Tx Power for each channel under each Regulatory Domain supported (ETSI, FCC, KCC, TELEC, WW) is tested with an in-line WLAN monitor for a client connected to an AP at different data rates to ensure compliance.

Q: I was told that the the module is able to receive BT and WLAN packets in the same time and it is able to address the packet in the right way. But I do not understand if it is possible, using the SRU (in test mode), to set the receiving mode for the BT and the WLAN in the same time. Could you help me?

A: Here are considerations you can take.

• 40NBT supports 802.11a/b/g/n dual band radio but not simultaneous dual-band operation.
• 40NBT supports simultaneous BT/WLAN receive with single antenna.
• Aux and Main port can receive a signal at a time (played by a switch) So, only case that can receive signal at the same in the below table is BT 2.4Ghz + WLAN 2.4Ghz on Aux port.

The attached document is the list current channels for the KCC domain as of 2015. In document, red means DFS required.

With EAP-MS-CHAPv2, the data sent in tunnel will be encapsulated as EAP-MESSAGE AVP (attribute-value pair). In the case of MS-CHAPv2, there is no such extra encapsulation it is just the MS-CHAPv2 message.

A list of our radios and supported connector types can be found here: WiFi + Bluetooth Modules

For WM6.5/CE5/CE6/WEC6 users, if you see COM port fails to open in sdc_bt log during initialization, it may be worth trying to delay when sdc_bt tries to open COM port. This is because native Microsoft Bluetooth stack also tries to open COM port at boot and and it sometimes conflict with sdc_bt on opening COM port. To try this, set the following registry key in milliseconds. [HKEY_LOCAL_MACHINE\SOFTWARE\Summit\BT] "PatchDelay"=dword

The following channels require DFS in Korea KCC/KC domain. Channel Frequency MHz 52 5260 56 5280 60 5300 64 5320 100 5500 104 5520 108 5540 112 5560 116 5580 120 5600 124 5620

No. 40 series radios only support the H4 protocol, not BCSP (BlueCore Serial Protocol). If the BCSP driver starts up and occupies COM port after Bluetooth initialization, the 40NBT's Bluetooth may not function properly.

sdcgina.exe vs sdc_gina.exe : sdcgina.exe spawns all of the components we need (e.g. supplicant, scutray). sdc_gina.exe is a UI application that, for example, pops up when the credentials must be input.

Method 1: Radio driver is asked by power manager to go to low power state Suspend/resume without cutting power to radio Method 2: Radio driver is asked by power manager to go to low power state Cut power to radio Suspend/ Resume Reapply power to radio Eject/insert radio Note 1: Method 1 is the simplest way to deal with suspend/resume, but the OEM needs to consider the current consumption of the radio at a low power state. For example, current consumption for the 40NBT is 7.7mA and for the 45N it is 200uA. Note 2 : In general, method 1 is more recommended because method 2 may cause a delay to make the radio reconnect after resume.

There are two reasons to send out null packets with p bit enabled. 1. Its RSSI has crossed over the Roam Trigger and the client radio is supposed to start scanning for a new AP. 2. The client radio is running one of our power-save modes (Fast or Max) and is going to sleep for a brief (e.g. 20 ms) period and is telling the AP so it will buffer traffic for it while it sleeps. After a radio has slept for some period of time (defined as the interval between DTIM periods) it is supposed to wake up and indicate to the AP that it is awake by sending a null packet with the P-bit turned off. The radio should only wake if it has traffic to send or it sees from the DTIM in the AP?s beacons that the AP has traffic to send to it.

For user certs, we support PKCS#12 (.pfx/.p12) or PEM (.pem). In both cases, the cert needs to contain both the user certificate and the user encryption key. For CA certs we support both the PEM (.pem) and DER (.der) format.

EAP-TLS is a tunnel authentication. outer identity: this is the User-Name in the RADIUS packet and visible to all intermediate parties inner identity: this is the actual user identification. It is only visible to the user himself and the Identity Provider The user cert is issued to a user identified by the username, so the username has to be configured so we know which user cert we should be using for the authentication. By default, the username is also used during authentication as the outer identity which gets sent in the identity response packet.

By setting this registry, SleepMode, can put the BT radio to sleep mode in system initialization. By default it?s 0. [HKEY_LOCAL_MACHINE\SOFTWARE\Summit\BT] "SleepMode"=Boolean: 0 = FALSE; 1 = TRUE (default is 0)

mandatory/optional input for EAP type   EAP credentials Mandatory input Optional input LEAP User name, user password   EAP FAST User name, user password PAC file, FAC password PEAP MSCHAP User name, user password CA cert PEAP GTC User name, user password CA cert EAP TLS User name, user cert CA cert EAP TTLS User name, user password CA cert PEAP TLS User name, user cert CA cert   Note 1: this settings should be read in user perspective but not for actual implementation. For example, when a user does not input PAC file, it will use auto PAC provisioning. If a user inputs it, it will do a manual PAC provisioning. Note 2: user password is not used for TLS but only user cert is used instead.    

Current consumption for Wi-Fi radios at low power state(D3) 40NBT : 7.7 mA 45N : 200 uA note : this should be included in HIG (not only this but we should fill in all the TBD in HIG)

Precedence is as follows: WPA2-AES WPA-AES WPA2-TKIP WPA-TKIP 40NBT radio (later than v 3.5.3.8) can connect to mixed mode of encryption combination - i.e. WPA/WPA2 TKIP/AES. When scanning via LCM and connect to AP with WPA/WPA2 TKIP/AES set, WPA2 AES is most favored to connect with. When manually setting a profile in LCM, a user can select all combination of encryption except WPA2 TKIP which is not supported because WiFi Alliance disallow using it in 2015 notice: https://www.wi-fi.org/downloads-public/Wi-Fi_Alliance_Technical_Note_TKIP_v1.0.pdf/17196

There is no mechanism to selectively limit the channels in the 5GHz band for regulatory purposes, other than what is inherently supported in the module already (channel lists are defined by the country code in effect). The mechanism below is for end users to block connectivity on specific channels, but that is different from preventing transmission from a regulatory perspective. The 5GHzChanMask prevents the radio from connecting and scanning on certain channels in the 5GHz band. The setting is a simple bit mask with bit0 corresponding to channel 36, bit 1 is channel 40 and so forth. It gets a bit tricky as there are a few gaps. The below examples should make things clear. A value of 0×00071FF0 would allow the channels indicated below. 0×00071FF0 // {x,x,x,x, 52,56,60,64, 100,104,108,112, 116,x,x,x, 132,136,140,x, x,x,x} A value of 0×0078000F would allow the channels indicated below. 0×0078000F // {36,40,44,48, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,149, 153,157,161}

Q: Do you have any C / C++ examples of how to set up an SPP service and exchange data across it using the Laird BT SDK? For example a simple "Chat" example? What I want to do is set up an SPP connection between the Laird module (running on our system acting as a server) and an Android tablet / phone acting as a client. I want to be able to send / receive data over this SPP link.

A: The Bluetooth SDK does not handle the SPP data directly. The SPP data is piped through a Virtual Serial Port that is installed on the system when the stack starts. Also, by default the stack has an SPP Service running when it starts. Typically when the SPP Service is installed it is running on COM Port #7 (this is the default number that the SPP service uses). You will have to.

1. Have the tablet discover and pair with your Laird module (on your system acting as a server).
2. The tablet should do a search for services and will find the Laird module has an SPP service available.
3. The tablet will then connect on your service. From there, you will have to open a COM port using Microsofts API call of CreateFile(). Something similar to the effect of CreateFile("COM7:", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL ); Here is an example for opening the COM port. You must make sure that your tablet supports SPP as well. If SPP isn't supported then your tablet will not be able to discover your Laird Modules' SPP service.