Subsystems

Bluetooth

The MT6631's Bluetooth over STP: hardware, driver, boot-args, status and known issues.

Hardware

The Bluetooth is the same combo chip as the Wi-Fi, reached through CONNSYS: its packets travel on STP’s channel 0 beside WMT’s, over BTIF (0x1100c000). CONNSYS comes up with the Wi-Fi bring-up, so the two share the power-up, the firmware set and the memory window.

Driver

mtk_bt.c is the part that does not depend on the phone, a skeleton: what iOS’s bluetoothd needs from a kernel to take a controller as its own (the kernel control com.apple.uart.sk.bluetooth, the Skywalk kernel pipe behind it in mtk_btsk.c, the nodes it opens, H4 framing, and the answers of a MediaTek controller that Apple’s stack does not take as they are). MappleBluetooth.cpp registers the bluetooth service. What differs on every phone is a table of operations; the MT6781’s is the Wi-Fi driver’s STP over BTIF (mt6631_bt_* in mt6631_wifi.c). Nothing is made until every operation is present.

Device tree

/arm-io/wlan (shared with Wi-Fi); there is no node of its own.

Boot-arguments

mp_bt_steps in the catalogue: 1 Bluetooth on and the six HCI commands, nothing shown to iOS; 2 the registry service, nodes and bridge, brought up at boot (gives up after 120 s). The spaced line has mp_bt_steps=2; a safe boot sets it to 0. mp_hidres controls the IOHIDResource service a classic keyboard’s keys go through.

User space

iOS’s bluetoothd. The root keeps its launch job because device.conf has bluetooth 1.

Status

device.conf: partial: the MT6631 over STP on BTIF (mp_bt_steps=2): on in Settings, LE scan, pairing; a classic keyboard types (IOHIDResource, mp_hidres=1); no A2DP.

Seen: Bluetooth on and an LE scan in Settings (run 27); a classic keyboard pairing and typing (run 31); A2DP failing (run 28c).

Known issues

• No audio over Bluetooth: headphones and speakers are not supported yet.
• The Bluetooth bridge’s quirks are set through kern.mapple_bt_quirks.

Source files

bsd/dev/mtk_bt.c, mtk_btsk.c, mt6631_wifi.c, iokit/Kernel/arm/MappleBluetooth.cpp, iokit/Kernel/arm/hid/IOHIDResource.cpp of the kernel at 76b737c.