[Hero, G2 Touch General] scholbert:
Hi,

i know there are a lot of threads about all this stuff already and i also know that the hero is not the latest gadget anymore.

Anyway, a few days ago i started investigating on the bluetooth sub-system running on my HTC Hero. I tried to find out how things work out on latest stock ROM 3.32.405.2 compared to some of latest nightly ROM builds based on cyanogen.

I just wanted to post what i found out in the meantime and what might be worth discussing. Here we go :D

The chipset:

Th Hero in fact uses a BRF6350 from Texas Intruments which is a successor of the BRF6300. This chip definitely has FM capabilites, but there's no access to this function per default.

It is yet unknown if the hardware connections would basically support this option, if set up correctly.

Again, there is some basic information at TI's website:

http://focus.ti.com/general/docs/wt...ateId=6123&navigationId=12659&contentId=14646

I also found a very interesting document in the web, that gives a more detailed block diagram of the BRF6350 chipset (see attachment).

The firmware:

In stock ROM there's only a BRF6300 firmware file, though a BRF6350 is used one the mainboard.

On the latest cyanogen nightly builds there's also a BRF6350 firmware file.

See this thread for more: http://xdaforums.com/showthread.php?t=704976

I could not find out what is the origin of this file, maybe it was extracted form a WM-ROM...

Who ever knows more about it please post it here!

Anyway the firmware get's loaded during boot up, using a service call in init.hero.rc. This one is common in stock and AOSP ROM's:

service hciattach /system/bin/hciattach \
-n -s 115200 /dev/ttyHS0 texasalt 4000000 flow
user bluetooth
group bluetooth net_bt_admin
disabled

On stock ROM there's an additonal service started in init.hero.rc:

#btips - 2.22
service btips /system/bin/btipsd --logfile /data/btips/btips_log.txt -no_android_log
socket bluetooth stream 660 bluetooth bluetooth
socket dbus_bluetooth stream 660 bluetooth bluetooth
group bluetooth net_bt_admin misc
disabled # the MCP monitor service is responsible for bringing up the daemon
oneshot

AFAIK, this service is needed to start the TI bluetooth stack and does a more specific setup of the chipset.

Also it might be possible, that on stock ROMs hciattach is obsolete and btipsd in fact loads the BRF6300 firmware to the BRF6350 chipset. Some further investigation is required here...

There'd also been some discussions early this year in the IRC channel about btipsd.

By stepping through the binary, i found out that btipsd also includes some hard coded start-up scripts (*.bts).

These are similar to the scripts located in /etc/firmware.

The scripts:

After the firmware has been transferred to the chipset, a basic setup has to be made. So that's what these scripts are doing.

The firmware uses some binary command mode to communicate at this point.

Also some tweaks might be injected to match the current API.

These are the basic scripts located in /etc/firmware (stock ROM and AOSP):

avpr.bts (Description: BRF6450 AVPR FW Initialization Script, Compatibility: BRF6450 PG1 ROM)

fm_rx_init_1273.2.bts (Description: This script could be used to put the FM IP in RCV mode)

fmc_init_1273.2.bts (Description : FM Firmware Patch - v2.140, Compatibility : BL6450 2.1, BL6450 3.0, WL127x 2.0, NL55xx 2.0 ROM)

tiinit_5.3.53.bts (Description : BRF6350 2.11 ROM Initialization Script, Compatibility: BRF6350 2.11 ROM)

It seems that these scripts are generic and are used on other platforms as well. By extracting the debug messages of these scripts, if found out, that on stock ROM none of them is matching to the given firmware (BRF6300.bin).

In other words they seem to be useless!

By integrating BRF6350.bin into the AOSP ROMs, there's only one that maybe used: tiinit_5.3.53.bts

Some cross referals....

E.g. the Xperia X1 (also uses BRF6350 chipset) got a couple init scripts to match different firmware versions:

TIInit_5_3_53.bts (Description : BRF6350 2.11 ROM Initialization Script, Compatibility: BRF6350 2.11 ROM)

TIInit_5_2_34.bts (Description : BRF6350 2.34 ROM Initialization Script, Compatibility: BRF6350 2.34 ROM)

TIInit_4_2_38.bts (Description : BRF6300 1.31 ROM Initialization Script, Compatibility: BRF6300 1.31 ROM)

Inside Xperia X1 ROMs there are also some scripts to activate FM radio on a BRF6530 chipset

Fm_on_2_0.bts

Fm_on_2_1.bts (Description : BRF6350 2.11 FM Initialization, Compatibility: BRF6350 2.11 ROM)

FMInit_2.bts (Description : BRF6350 2.0 FW 2.34 FM Initialization, Compatibility: BRF6350 2.0 ROM w/ 2.0.34 Firmware)

There's also a package called HTC tools for the WM phones (HTC Diamond, HTC Raphel, etc) including similar scripts for FM.

So maybe it will be possible some day to tweak Hero ROMs and make use of these scripts. This would probably solve this issue: http://xdaforums.com/showthread.php?t=533780

The stack:

HTC Hero stock ROM's use TI proprietary bluetooth stack.

The HCI communication to the chipset is mainly done through btipsd, which is also closed source.

There's also some nice command line interface (btipsd_cli) to gather some low level information.

Some proprietary libraries might be in use for the stack as well...

The firmware file is BRF6300.bin.

On the AOSP ROMs the bluetooth framework is little more open.

AFAIK the BlueZ stack is used on these ROMs.

The HCI communication seems to rely entirely on hci toolset (e.g. hciattach, hciconfig, hcitool...)

The latest cyanogen nightly ROMs make use of BRF6350.bin.

As already stated, i just started to investigate a few days ago...

... still many secrets and still little confusing, but i just wanted to start collecting some information and give it out to the community.

Another nice thread at G1 sub-forum: http://xdaforums.com/showthread.php?t=527027

Please post your knowledge here or correct me, if i pointed out something wrong!

TBC.... :D

Best regards,

scholbert