Jaguar-1 MP single-tone (CW carrier) emit: `DEVOURER_CW_TONE` — SDR-validate first (slice of T4)

[josephnef]

Summary

Add a minimal single-tone / CW-carrier emit mode for Jaguar-1 (RTL8812AU / RTL8821AU) — the chip radiates a bare RF local-oscillator carrier at the channel-center frequency, no packets, no modulation. This is the smallest useful slice of T4 (MP-mode subcommand) in TODO.md (mp-ctx … single tone), and it doubles as a controllable narrowband interferer for RF experiments (e.g. the per-tone/beamforming-sounding work in docs/beamforming-self-sounding.md, where we need a ≤1 MHz on-channel tone that a wideband Wi-Fi AP can't provide).

Ask: implement, then validate the emitted signal against an SDR / spectrum analyser before we rely on it as an instrument. The register writes are known; what needs ground-truth confirmation is that a clean carrier actually comes out at the right frequency and power.

Mechanism

MP single-tone puts the RF LO into TX as a bare carrier: disable the baseband modulators, force the RF path to TX at a chosen gain, flip the LO-enable bit, set the RFE pinmux. Ported from the vendor hal_mpt_SetSingleToneTx() (reference/rtl8812au/hal/hal_mp.c, the IS_HARDWARE_TYPE_JAGUAR branch).

Implementation recipe (Jaguar-1, path A)

After a normal InitWrite() channel set (so the LO is already tuned to the target channel center — e.g. ch6 → 2437 MHz), do 6 register writes. All addresses/#defines already exist in hal/, and phy_set_rf_reg (src/jaguar1/RadioManagementModule.cpp) + phy_set_bb_reg (src/RtlUsbAdapter.cpp) are already available:

phy_set_bb_reg(rOFDMCCKEN_Jaguar /*0x808*/, BIT28|BIT29, 0x0);  // disable OFDM+CCK
phy_set_rf_reg(RF_PATH_A, RF_AC_Jaguar /*0x00*/, 0xF0000, 0x2);  // RF path A -> TX mode
phy_set_rf_reg(RF_PATH_A, RF_AC_Jaguar /*0x00*/, 0x1F,    0x0);  // RF gain index (0=lowest; raise for tone power)
phy_set_rf_reg(RF_PATH_A, lna_low_gain_3 /*0x58*/, BIT1,  0x1);  // RF LO enable  <-- the CW carrier
phy_set_bb_reg(rA_RFE_Pinmux_Jaguar /*0xCB0*/, 0xFF00F0, 0x77007);
phy_set_bb_reg(rB_RFE_Pinmux_Jaguar /*0xEB0*/, 0xFF00F0, 0x77007);

External-PA parts additionally set 0xCB4/0xEB4 [23:16] (0x11 for ext-PA-2G, 0x12 for ext-PA-5G) — gate on the EFUSE ExternalPA_2G/5G flags; parts with no external PA (e.g. the Archer T2U Plus, ExternalPA_2G=0) skip those.

Stop / restore: save RF 0x58, 0xCB0, 0xEB0 before start; on stop restore them and re-enable 0x808 [29:28], returning the chip to normal.

Proposed interface

DEVOURER_CW_TONE=1 (with existing DEVOURER_CHANNEL=N selecting the tone frequency, and an optional DEVOURER_CW_TONE_GAIN=0..31 for RF 0x00[4:0]), applied at the end of RtlJaguarDevice::InitWrite() — then idle-hold. ~30 LOC in the Jaguar-1 HAL. (Or a small mp-tone demo; either is fine.)

SDR validation checklist (the point of this issue)

On an adapter emitting the tone, capture with an SDR/analyser and confirm:

• A single CW carrier at the channel-center frequency (ch6 → 2437.0 MHz; also test a 5 GHz channel, e.g. ch36 → 5180 MHz).
• Spectral purity — is it a clean tone, or are there significant spurs / images / residual modulation? Quantify carrier-to-spur.
• Power is tunable and monotonic via RF 0x00[4:0] (the gain index) — sweep a few values, record dBm.
• Clean stop — carrier disappears on stop and the adapter returns to normal TX/RX (a subsequent beacon TX or RX still works).
• Frequency accuracy / drift over ~60 s (cert-style hold).

Scope

• This issue: RTL8812AU + RTL8821AU (the shared JAGUAR branch, 2T2R and 1T1R). The 1T1R 8821AU is a fine tone source (no NDP/sounding needed — see Jaguar1 RX: unify onto the async URB queue — fixes the radxa sounding TX wedge #164 for its sounding limitation, irrelevant here).
• RTL8814AU uses a separate mpt_SetSingleTone_8814A() path — follow-up.
• Jaguar-2/3 (8822B/C/E) single-tone lives in their own MP trees — follow-up.

References

• Vendor: reference/rtl8812au/hal/hal_mp.c → hal_mpt_SetSingleToneTx(), JAGUAR branch.
• TODO.md → T4 (full MP-mode subcommand; this is the single-tone slice).

🤖 Generated with Claude Code

[josephnef]

Done — the DEVOURER_CW_TONE MP single-tone landed for the requested Jaguar-1 parts and was extended to every USB generation, each SDR-validated on a USRP B210.

• Jaguar1 + Jaguar2 CW single-tone (DEVOURER_CW_TONE) — SDR-validated #167 (merged): Jaguar-1 8812AU / 8821AU (the original ask) + 8814AU, and Jaguar-2 8822BU. Also fixes an 8812AU cold-init EFUSE crash found along the way. Adds tests/cw_tone_probe.py + tests/cw_tone_sdr.sh.
• Jaguar3 CW single-tone (DEVOURER_CW_TONE) + 8812EU DACK crash fix #170: Jaguar-3 8822CU (strong, clean: +38 dBFS / 62 dB carrier-to-spur at 2.4 GHz) and 8812EU/8822EU, plus an 8812EU DACK USB-read crash fix.

Interface as proposed: DEVOURER_CW_TONE=1 (+ DEVOURER_CW_TONE_GAIN=0..31), armed at the end of InitWrite and idle-held until SIGINT. Per-chip recipes ported from the vendor MP source; the SDR checklist (single carrier at center, spectral purity, tunable power, clean stop, drift) was run per chip.

Closing as delivered.