Database Users

Some words about bluetooth....

Hi,
i know there are a lot of threads about all this stuff already and i also know that the hero is not the latest gadget anymore.
Anyway, a few days ago i started investigating on the bluetooth sub-system running on my HTC Hero. I tried to find out how things work out on latest stock ROM 3.32.405.2 compared to some of latest nightly ROM builds based on cyanogen.
I just wanted to post what i found out in the meantime and what might be worth discussing. Here we go
The chipset:
Th Hero in fact uses a BRF6350 from Texas Intruments which is a successor of the BRF6300. This chip definitely has FM capabilites, but there's no access to this function per default.
It is yet unknown if the hardware connections would basically support this option, if set up correctly.
Again, there is some basic information at TI's website:
http://focus.ti.com/general/docs/wt...ateId=6123&navigationId=12659&contentId=14646
I also found a very interesting document in the web, that gives a more detailed block diagram of the BRF6350 chipset (see attachment).
The firmware:
In stock ROM there's only a BRF6300 firmware file, though a BRF6350 is used one the mainboard.
On the latest cyanogen nightly builds there's also a BRF6350 firmware file.
See this thread for more: http://forum.xda-developers.com/showthread.php?t=704976
I could not find out what is the origin of this file, maybe it was extracted form a WM-ROM...
Who ever knows more about it please post it here!
Anyway the firmware get's loaded during boot up, using a service call in init.hero.rc. This one is common in stock and AOSP ROM's:
Code:
service hciattach /system/bin/hciattach \
-n -s 115200 /dev/ttyHS0 texasalt 4000000 flow
user bluetooth
group bluetooth net_bt_admin
disabled
On stock ROM there's an additonal service started in init.hero.rc:
Code:
#btips - 2.22
service btips /system/bin/btipsd --logfile /data/btips/btips_log.txt -no_android_log
socket bluetooth stream 660 bluetooth bluetooth
socket dbus_bluetooth stream 660 bluetooth bluetooth
group bluetooth net_bt_admin misc
disabled # the MCP monitor service is responsible for bringing up the daemon
oneshot
AFAIK, this service is needed to start the TI bluetooth stack and does a more specific setup of the chipset.
Also it might be possible, that on stock ROMs hciattach is obsolete and btipsd in fact loads the BRF6300 firmware to the BRF6350 chipset. Some further investigation is required here...
There'd also been some discussions early this year in the IRC channel about btipsd.
By stepping through the binary, i found out that btipsd also includes some hard coded start-up scripts (*.bts).
These are similar to the scripts located in /etc/firmware.
The scripts:
After the firmware has been transferred to the chipset, a basic setup has to be made. So that's what these scripts are doing.
The firmware uses some binary command mode to communicate at this point.
Also some tweaks might be injected to match the current API.
These are the basic scripts located in /etc/firmware (stock ROM and AOSP):
avpr.bts (Description: BRF6450 AVPR FW Initialization Script, Compatibility: BRF6450 PG1 ROM)
fm_rx_init_1273.2.bts (Description: This script could be used to put the FM IP in RCV mode)
fmc_init_1273.2.bts (Description : FM Firmware Patch - v2.140, Compatibility : BL6450 2.1, BL6450 3.0, WL127x 2.0, NL55xx 2.0 ROM)
tiinit_5.3.53.bts (Description : BRF6350 2.11 ROM Initialization Script, Compatibility: BRF6350 2.11 ROM)
It seems that these scripts are generic and are used on other platforms as well. By extracting the debug messages of these scripts, if found out, that on stock ROM none of them is matching to the given firmware (BRF6300.bin).
In other words they seem to be useless!
By integrating BRF6350.bin into the AOSP ROMs, there's only one that maybe used: tiinit_5.3.53.bts
Some cross referals....
E.g. the Xperia X1 (also uses BRF6350 chipset) got a couple init scripts to match different firmware versions:
TIInit_5_3_53.bts (Description : BRF6350 2.11 ROM Initialization Script, Compatibility: BRF6350 2.11 ROM)
TIInit_5_2_34.bts (Description : BRF6350 2.34 ROM Initialization Script, Compatibility: BRF6350 2.34 ROM)
TIInit_4_2_38.bts (Description : BRF6300 1.31 ROM Initialization Script, Compatibility: BRF6300 1.31 ROM)
Inside Xperia X1 ROMs there are also some scripts to activate FM radio on a BRF6530 chipset
Fm_on_2_0.bts
Fm_on_2_1.bts (Description : BRF6350 2.11 FM Initialization, Compatibility: BRF6350 2.11 ROM)
FMInit_2.bts (Description : BRF6350 2.0 FW 2.34 FM Initialization, Compatibility: BRF6350 2.0 ROM w/ 2.0.34 Firmware)
There's also a package called HTC tools for the WM phones (HTC Diamond, HTC Raphel, etc) including similar scripts for FM.
So maybe it will be possible some day to tweak Hero ROMs and make use of these scripts. This would probably solve this issue: http://forum.xda-developers.com/showthread.php?t=533780
The stack:
HTC Hero stock ROM's use TI proprietary bluetooth stack.
The HCI communication to the chipset is mainly done through btipsd, which is also closed source.
There's also some nice command line interface (btipsd_cli) to gather some low level information.
Some proprietary libraries might be in use for the stack as well...
The firmware file is BRF6300.bin.
On the AOSP ROMs the bluetooth framework is little more open.
AFAIK the BlueZ stack is used on these ROMs.
The HCI communication seems to rely entirely on hci toolset (e.g. hciattach, hciconfig, hcitool...)
The latest cyanogen nightly ROMs make use of BRF6350.bin.
As already stated, i just started to investigate a few days ago...
... still many secrets and still little confusing, but i just wanted to start collecting some information and give it out to the community.
Another nice thread at G1 sub-forum: http://forum.xda-developers.com/showthread.php?t=527027
Please post your knowledge here or correct me, if i pointed out something wrong!
TBC....
Best regards,
scholbert

extended info about *.bts files
Init files from HTC Hero...
Debug strings in fm_rx_init_1273.2.bts:
Code:
0x24 0x4F # +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
0x78 0x1B # RCV Power On - v0.8
0x9E 0x4A # Description: This script could be used to put the FM IP in RCV mode
0xED 0x19 # Author: Manav
0x010B 0x17 # Date: Dec 29, 2007
0x0127 0x14 # Changes:
0x0147 0x20 # 0] Dec'29 2007 - Initial Edits
0x016C 0x43 # 1] Jan'31 2008 - Clean up - Moved register settings to code patch
0x01B4 0x1C # 2] Mar'15 2008 - No Change
0x01DB 0x2E # Notes: Use this script after running FM Init
0x020E 0x50 # ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
0x026D 0x22 # Putting the Synth in Closed Loop
0x02BD 0x57 # Select if RDS is needed (Make fm_rcv_mode =3 for RDS and FM and =1 for only FM Audio)
0x0319 0x10 #fm_rcv_mode = 3
0x033C 0x52 # RCV POWER ON API (Arg = 3 for both FM Audio and RDS / Arg = 1 for only FM Audio)
0x03B8 0x0E #Audio Enable.
0x03CB 0x31 #Send_HCI_VS_I2C_Write_to_FM 0xFD35, 0x1D, 0x0002
0x0401 0x4C #Wait_HCI_Command_Complete_VS_I2C_Write_to_FM_Event 5000, 0x00, 0xfd35, 0x00
Debug Strings in fmc_init_1273.2.bts:
Code:
0x29 0x53 #--------------------------------------------------------------------------------
0x81 0x2D # Description : FM Firmware Patch - v2.140
0xBA 0x21 # Author : Sumeer Bhatara
0xE8 0x46 # Compatibility : BL6450 2.1, BL6450 3.0, WL127x 2.0, NL55xx 2.0 ROM
0x013B 0x1D # Last Updated : 02/06/2009
0x0165 0x3C # Notes : Please refer to the SP2.22 RN for details
0x01A6 0x53 #--------------------------------------------------------------------------------
0x020D 0x39 # FM ON Command - This would activate the I2C co-relator
0x0250 0x29 #Send_HCI_VS_I2C_FM_POWER_MODE 0xFD37, 1
0x027E 0x60 #Wait_HCI_Command_Complete_VS_I2C_FM_POWER_MODE_Event 5000, any, HCI_VS_I2C_FM_POWER_MODE, 0x00
0x02E8 0x1F #time needed for APLL to lock
0x030C 0x0A #sleep 30
0x0345 0x0D #Data patch
0x035C 0x1B # PA VOLTAGE TABLE CHANGE
0x08A1 0x35 #Program the g_tCapAdjTable[5] = {-2, -1 ,0 ,2 ,4 }
0x08DB 0x32 # g_tCapAdjTable[1] = -1 , g_tCapAdjTable[0] = -2
0x093B 0x30 # g_tCapAdjTable[3] =2 , g_tCapAdjTable[2] = 0
0x0999 0x28 # g_tgLow[0] =2 , g_tCapAdjTable[4] =4
0x09EF 0x1F # g_tCapValTable TABLE CHANGE
0x0A13 0x20 # Program the g_tCapValTable[0]
0x0A61 0x20 # Program the g_tCapValTable[1]
0x0AAF 0x20 # Program the g_tCapValTable[2]
0x0AFD 0x20 # Program the g_tCapValTable[3]
0x0B4B 0x20 # Program the g_tCapValTable[4]
0x0B99 0x20 # Program the g_tCapValTable[5]
0x0BE7 0x20 # Program the g_tCapValTable[6]
0x0C35 0x20 # Program the g_tCapValTable[7]
0x0C8D 0x0C #Code Patch
0x4BD7 0x4F # +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
0x4C2B 0x1B # RCV Power On - v0.8
0x4C51 0x4A # Description: This script could be used to put the FM IP in RCV mode
0x4CA0 0x19 # Author: Manav
0x4CBE 0x17 # Date: Dec 29, 2007
0x4CDA 0x14 # Changes:
0x4CFA 0x20 # 0] Dec'29 2007 - Initial Edits
0x4D1F 0x43 # 1] Jan'31 2008 - Clean up - Moved register settings to code patch
0x4D67 0x1C # 2] Mar'15 2008 - No Change
0x4D8E 0x2E # Notes: Use this script after running FM Init
0x4DC1 0x50 # ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
0x4E20 0x22 # Putting the Synth in Closed Loop
0x4E70 0x57 # Select if RDS is needed (Make fm_rcv_mode =3 for RDS and FM and =1 for only FM Audio)
0x4ECC 0x10 #fm_rcv_mode = 3
0x4EEF 0x52 # RCV POWER ON API (Arg = 3 for both FM Audio and RDS / Arg = 1 for only FM Audio)
0x4F6B 0x0E #Audio Enable.
0x4F7E 0x31 #Send_HCI_VS_I2C_Write_to_FM 0xFD35, 0x1D, 0x0002
0x4FB4 0x4C #Wait_HCI_Command_Complete_VS_I2C_Write_to_FM_Event 5000, 0x00, 0xfd35, 0x00
In fact these inits are for WiLink 6.0 mobile platform WL1271/WL1273 (WLAN 802.11 a/b/g/, Bluetooth v2.1 + EDR, FM)
Debug strings in tiinit_5.3.53.bts:
Code:
0x24 0x52 #--------------------------------------------------------------------------------
0x7B 0x37 # Description : BRF6350 2.11 ROM Initialization Script
0xBE 0x22 # Compatibility: BRF6350 2.11 ROM
0xEC 0x29 # Last Updated: 14-Dec-2009 15:39:50.51
0x0121 0x1D # Version : TI_P2_11.158
0x014A 0x4D # Notes : Use this script on BRF6350 2.11 ROM device only (FW v3.0.53)
0x019C 0x52 #--------------------------------------------------------------------------------
0x36C6 0x65 #####################################################################################################
0x3730 0x65 ############## BEGIN POWER TABLE SECTION ##########################################################
0x379A 0x65 #####################################################################################################
0x3D07 0x65 #####################################################################################################
0x3D71 0x65 ############## END POWER TABLE SECTION ############################################################
0x3DDB 0x65 #####################################################################################################
0x3F63 0x3E ##############################################################
0x3FA6 0x3E #### This portion of the Init Script is for custom use. #####
0x3FE9 0x3E #### Enable/Disable as required for the actual platform. #####
0x402C 0x3E ##############################################################
0x4074 0x5C ############ Fast Clock Configuration - Disable Crystal ##############################
0x40DB 0x35 # When Crystal in use - please remove this command.
0x4115 0x4C # Please refer to BT-SW-0030 Vendor Specific document for more information.
0x419A 0x42 #-----------------------------------------------------------------
0x41EB 0x18 # Enable Protocol Viewer
0x4208 0x42 #-----------------------------------------------------------------
0x4270 0x42 #-----------------------------------------------------------------
0x42C1 0x1B # Initialize voice settings
0x42E1 0x42 #-----------------------------------------------------------------
0x436A 0x51 #Send_HCI_VS_Write_CODEC_Configuration 0xFF08, 0x01, 0x00, 0x19, 0x19, 0x19, 0x01
0x43C0 0x56 #Wait_HCI_Command_Complete_VS_Write_CODEC_Configuration_Event 5000, 0x00, 0xff08, 0x00
0x4420 0x4D # Set inactivity timer to 320 frames - 400 msec (recommended for most hosts)
0x4472 0x6A # value may be reduced in accordance to host limitations for power saving (default: 80 frames - 100msec).
0x4506 0x2D # Accept PA_SD signaling from WLAN during TX
0x456F 0x15 # Enable co-existence
0x4589 0x42 #-----------------------------------------------------------------
0x45D0 0xAB #Send_HCI_VS_Write_Wlan_Configuration 0xFD1D, 0x04, 0x01, 0x05e9, 0x0000, 0x00, 0x00, "FF:FF:FF:FF:FF:FF:FF:FF:FF:FF", 0x04, 0x01, 0x00, 0x01, 0x02, 0x01, 0x00, 0xff, 0x00
0x4680 0x55 #Wait_HCI_Command_Complete_VS_Write_Wlan_Configuration_Event 5000, 0x00, 0xfd1d, 0x00
0x46DA 0x26 #set IO17 to be the BT RF-Activity pin
0x473B 0x22 # 0x5e8 - remove SCO from Priority
0x4762 0xAB #Send_HCI_VS_Write_Wlan_Configuration 0xFD1D, 0x04, 0x01, 0x05e8, 0x0000, 0x00, 0x00, "FF:FF:FF:FF:FF:FF:FF:FF:FF:FF", 0x05, 0x01, 0x00, 0x01, 0x02, 0x01, 0x00, 0xff, 0x00
0x4812 0x55 #Wait_HCI_Command_Complete_VS_Write_Wlan_Configuration_Event 5000, 0x00, 0xfd1d, 0x00
0x4876 0x18 # HCI_VS_Set_DDIP_Params
0x48BE 0x18 # Enable deep sleep mode
It seems this init could be used after brf6350.bin has been loaded on HTC Hero.
Debug Strings in avpr.bts:
Code:
0x24 0x52 #--------------------------------------------------------------------------------
0x7B 0x37 # Description: BRF6450 AVPR FW Initialization Script
0xBE 0x21 # Compatibility: BRF6450 PG1 ROM
0xEB 0x2A # Last Updated: 30-Jun-2008 19:06:31.35
0x0121 0x15 # Version: 1.1
0x0142 0x52 #--------------------------------------------------------------------------------
0x019E 0x11 #Mask All domains
0x01DA 0x39 #Issue Switch On command (all domains - including wibree)
0x023E 0x29 #turn on COREX clock (should read 0xnnn9)
0x0292 0x31 # Cortex Reset (hold in reset while loading IMEM)
0x8FB4 0x15 #release Cortex Reset
This init is used for newer chipset BRF6450.
HTC Tools for WM (capable HTC Diamond, HTC Raphael, etc. to test FM radio) includes some FM init scripts.
Debug Strings in FMInit_2.bts:
Code:
0x24 0x52 #--------------------------------------------------------------------------------
0x7B 0x35 # Description : BRF6350 2.0 FW 2.34 FM Initialization
0xBC 0x33 # Compatibility: BRF6350 2.0 ROM w/ 2.0.34 Firmware
0xFB 0x1C # Last Updated: 14-Feb-2007
0x0123 0x13 # Version : 2.2
0x0142 0x43 # Notes : Required after runnung BRF6350 Bluetooth Initscript
0x018A 0x52 #--------------------------------------------------------------------------------
0x01E6 0x07 # FM ON
Debug Strings in FM_on_2_0.bts:
Code:
0x24 0x1C #log "FM_ON" (default 32KHz)
0x66 0x1C #log "FM_ON" (Optional FREF)
0x87 0x28 #Send_HCI_VS_I2C_FM_POWER_MODE 0xFD37, 1
0xB4 0x5F #Wait_HCI_Command_Complete_VS_I2C_FM_POWER_MODE_Event 5000, any, HCI_VS_I2C_FM_POWER_MODE, 0x00
0x0122 0x09 #SW patch
0x0130 0x20 # No FW patch defined for D2_11
0x015F 0x2D # Changes recommended by the AFE team - V0.1
0x01DF 0x0D #ADC settings
0x0297 0x15 #power on: FM and RDS
Debug Strings in FM_on_2_1.bts:
Code:
0x24 0x52 #--------------------------------------------------------------------------------
0x7B 0x2E # Description : BRF6350 2.11 FM Initialization
0xB5 0x21 # Compatibility: BRF6350 2.11 ROM
0xE2 0x1C # Last Updated: Oct 10, 2007
0x010A 0x13 # Version : 3.7
0x0129 0x15 # Author : Manav
0x0149 0x45 # Notes : Required after runnung BRF6350 Bluetooth Initscript.
0x0193 0x2F # Includes FM Register Patch v0.5
0x01C7 0x52 #--------------------------------------------------------------------------------
0x0223 0x44 # ------------------------------------------------------------------
0x026C 0x07 # FM ON
0x0278 0x44 # ------------------------------------------------------------------
0x02E7 0x44 # ------------------------------------------------------------------
0x0330 0x3A # Note: Delay of 20ms is required in after FM Power ON API
0x036F 0x40 # Checksum command has been used to create required delay.
0x03B4 0x44 # ------------------------------------------------------------------
0x03FD 0x09 #sleep 20
0x3839 0x06 x *yx
0x3F61 0x44 # ------------------------------------------------------------------
0x3FAA 0x39 # Note: Delay of ~4ms is required in after RESET command.
0x3FE8 0x40 # Checksum command has been used to create required delay.
0x402D 0x44 # ------------------------------------------------------------------
0x4076 0x09 #sleep 40
0x4586 0x44 # ------------------------------------------------------------------
0x45CF 0x42 # Un-mark SWITCH2FREF command below when working with FREF for FM
0x4616 0x2E # Default : FM on 32K (command below remarked)
0x4649 0x44 # ------------------------------------------------------------------
0x4692 0x2B # Send_HCI_VS_I2C_Write_to_FM 0xFD35, 36, 1
0x46C2 0x5C # Wait_HCI_Command_Complete_VS_I2C_Write_to_FM_Event 5000, any, HCI_VS_I2C_Write_to_FM, 0x00
0x4728 0x44 # ------------------------------------------------------------------
0x4771 0x18 # FM Register Patch v0.5
0x478E 0x44 # ------------------------------------------------------------------
0x4872 0x44 # ------------------------------------------------------------------
0x48BB 0x1E # FM Register Patch v0.5 (End)
0x48DE 0x44 # ------------------------------------------------------------------
0x4954 0x15 # Power on FM and RDS
0x4993 0x44 # ------------------------------------------------------------------
0x49DC 0x42 # Note: Delay of 30ms is required in after FM POWER ON RCV command
0x4A23 0x40 # Checksum command has been used to create required delay.
0x4A68 0x44 # ------------------------------------------------------------------
0x4AB1 0x0A # sleep 30
0x4AE2 0x20 # Enable Dynamic LNA mode switch
Stolen from Xperia X1 ROM this init is basically the same as on HTC Hero (tiinit_5.3.53.bts).
Debug strings in TIInit_5_3_53.bts (Xperia X1):
Code:
0x24 0x52 #--------------------------------------------------------------------------------
0x7B 0x37 # Description : BRF6350 2.11 ROM Initialization Script
0xBE 0x22 # Compatibility: BRF6350 2.11 ROM
0xEC 0x29 # Last Updated: 04-Mar-2008 1:32:43.58
0x0121 0x1C # Version : TI_P2_11.34
0x0149 0x4D # Notes : Use this script on BRF6350 2.11 ROM device only (FW v3.0.53)
0x019B 0x52 #--------------------------------------------------------------------------------
0x01F7 0x51 #--------------------------------------------------------------------------------
0x0257 0x24 # Update the Baudrate to 4000000 bps
0x0280 0x51 #--------------------------------------------------------------------------------
0x0301 0x51 #--------------------------------------------------------------------------------
0x2A99 0x65 #####################################################################################################
0x2B03 0x65 ############## BEGIN POWER TABLE SECTION ##########################################################
0x2B6D 0x65 #####################################################################################################
0x3191 0x65 #####################################################################################################
0x31FB 0x65 ############## END POWER TABLE SECTION ############################################################
0x3265 0x65 #####################################################################################################
0x335E 0x5A # SW bypass for spikes on IOs - Leave HCI TX, RX, CTS, RTS and BT_Wakeup during deep sleep
0x3408 0x3E ##############################################################
0x344B 0x3E #### This portion of the Init Script is for custom use. #####
0x348E 0x3E #### Enable/Disable as required for the actual platform. #####
0x34D1 0x3E ##############################################################
0x3519 0x57 ############ Enable Protocol Viewer ###############################################
0x3596 0x54 ############ Change baudrate example ###############################################
0x35F5 0x3D # Example below changes baudrate to 921k (16mHz system clock)
0x3637 0x58 # For other baudrates and system frequencies please contact your support representative.
0x3694 0x49 # Please note that the VS_Set_Uart_HCI_Baudrate_Island3 has replaced the
0x36E2 0x3A # HCI_VS_Update_Uart_HCI_Baudrate vendor specific command.
0x372C 0x3E #Send_HCI_VS_Set_Uart_HCI_Baudrate_Island3 0xFD38, 2, 17, 0, 7
0x376F 0x77 #Wait_HCI_Command_Complete_VS_Set_Uart_HCI_Baudrate_Island3_Event 5000, any, HCI_VS_Set_Uart_HCI_Baudrate_Island3, 0x00
0x37F0 0x42 #-----------------------------------------------------------------
0x3841 0x1B # Initialize voice settings
0x3861 0x42 #-----------------------------------------------------------------
0x38EA 0x42 #-----------------------------------------------------------------
0x393B 0x15 # Enable co-existence
0x3955 0x42 #-----------------------------------------------------------------
0x39D7 0x56 ############ Sleep Mode Setup ##################################################
0x3A32 0x4D # Set inactivity timer to 320 frames - 400 msec (recommended for most hosts)
0x3A84 0x6A # value may be reduced in accordance to host limitations for power saving (default: 80 frames - 100msec).
0x3AF3 0x3A #Send_HCI_VS_hcill_parameters 0xFD2B, 0x0640, 0xffff, 0xff
0x3B32 0x4D #Wait_HCI_Command_Complete_VS_hcill_parameters_Event 5000, 0x00, 0xfd2b, 0x00
0x3B89 0x0F #deep sleep: 2s
0x3BC7 0x63 # Default Settling time of 15ms may be reduced in accordance to design requirments for power saving
0x3C2F 0x2C #Send_HCI_VS_Set_Settling_Time 0xFF79, 15000
0x3C60 0x5F #Wait_HCI_Command_Complete_VS_Set_Settling_Time_Event 5000, any, HCI_VS_Set_Settling_Time, 0x00
0x3CC9 0x2B # Enable deep sleep with default parameters
Debug strings in TIInit_5_2_34.bts (Xperia X1):
Code:
0x24 0x52 #--------------------------------------------------------------------------------
0x7B 0x37 # Description : BRF6350 2.34 ROM Initialization Script
0xBE 0x22 # Compatibility: BRF6350 2.34 ROM
0xEC 0x29 # Last Updated: 08-Mar-2007 20:15:32.73
0x0121 0x17 # Version : P11.11
0x0144 0x2F # RAM consumption : 2892B used, 328B available
0x017F 0x25 # Patch entries : used 14 out of 24
0x01B0 0x4D # Notes : Use this script on BRF6350 2.34 ROM device only (FW v2.0.34)
0x0202 0x52 #--------------------------------------------------------------------------------
0x025E 0x51 #--------------------------------------------------------------------------------
0x02BE 0x24 # Update the Baudrate to 4000000 bps
0x02E7 0x51 #--------------------------------------------------------------------------------
0x0368 0x51 #--------------------------------------------------------------------------------
0x3511 0x57 ############ Enable Protocol Viewer ###############################################
0x356D 0x30 #Send_HCI_VS_Enable_Protocol_Viewer 0xFF68, 0x01
0x35A2 0x53 #Wait_HCI_Command_Complete_VS_Enable_Protocol_Viewer_Event 5000, 0x01, 0xff68, 0x00
0x35FF 0x42 #-----------------------------------------------------------------
0x3650 0x1B # Initialize voice settings
0x3670 0x42 #-----------------------------------------------------------------
0x36F9 0x42 #-----------------------------------------------------------------
0x374A 0x15 # Enable co-existence
0x3764 0x42 #-----------------------------------------------------------------
0x37E6 0x56 ############ Sleep Mode Setup ##################################################
0x3841 0x42 #-----------------------------------------------------------------
0x3892 0x18 # Enable Deep Sleep Mode
0x38AF 0x4D # Set inactivity timer to 320 frames - 400 msec (recommended for most hosts)
0x3901 0x6A # value may be reduced in accordance to host limitations for power saving (default: 80 frames - 100msec).
0x3970 0x42 #-----------------------------------------------------------------
0x39B7 0x3A #Send_HCI_VS_hcill_parameters 0xFD2B, 0x0140, 0xffff, 0xff
This is also included in Xperia stock ROM but used with a firmware for BRF6300 chipset. This chipset got no FM support.
Debug strings in TIInit_4_2_38.bts (Xperia X1):
Code:
0x24 0x52 #--------------------------------------------------------------------------------
0x7B 0x37 # Description : BRF6300 1.31 ROM Initialization Script
0xBE 0x22 # Compatibility: BRF6300 1.31 ROM
0xEC 0x29 # Last Updated: 30-Sep-2007 18:14:28.93
0x0121 0x21 # Version : DVM_BOOST_P13.48
0x014E 0x4D # Notes : Use this script on BRF6300 1.31 ROM device only (FW v2.0.38)
0x01A0 0x52 #--------------------------------------------------------------------------------
0x01FC 0x51 #--------------------------------------------------------------------------------
0x025C 0x24 # Update the Baudrate to 4000000 bps
0x0285 0x51 #--------------------------------------------------------------------------------
0x2921 0x5C ############# DEVM output power threshold. Please see release note for further information.
0x2A19 0x08 €€€€€€€€
0x2A4B 0x08 €€€€€€€€
0x2A7D 0x08 €€€€€€€€
0x2AAF 0x08 €€€€€€€€
0x2B0E 0x09 €€€€€€€€€
0x4745 0x65 #####################################################################################################
0x47AF 0x65 ############## BEGIN POWER TABLE SECTION ##########################################################
0x4819 0x65 #####################################################################################################
0x50C4 0x65 #####################################################################################################
0x512E 0x65 ############## END POWER TABLE SECTION ############################################################
0x5198 0x65 #####################################################################################################
0x532C 0x3E ##############################################################
0x536F 0x3E #### This portion of the Init Script is for custom use. #####
0x53B2 0x3E #### Enable/Disable as required for the actual platform. #####
0x53F5 0x3E ##############################################################
0x543D 0x5C ############ Fast Clock Configuration - Disable Crystal ##############################
0x54A4 0x35 # When Crystal in use - please remove this command.
0x54DE 0x4C # Please refer to BT-SW-0030 Vendor Specific document for more information.
0x5563 0x57 ############ Enable Protocol Viewer ###############################################
0x55E0 0x54 ############ Change baudrate example ###############################################
0x563F 0x3D # Example below changes baudrate to 921k (16mHz system clock)
0x5681 0x41 # For other baudrates and system frequencies please use the UART
0x56C7 0x51 # Baudrate Calculator tool. Please note that the VS_Set_Uart_HCI_Baudrate_Island3
0x571D 0x4B # has replaced the HCI_VS_Update_Uart_HCI_Baudrate vendor specific command.
0x5778 0x3E #Send_HCI_VS_Set_Uart_HCI_Baudrate_Island3 0xFD38, 2, 17, 0, 7
0x57BB 0x77 #Wait_HCI_Command_Complete_VS_Set_Uart_HCI_Baudrate_Island3_Event 5000, any, HCI_VS_Set_Uart_HCI_Baudrate_Island3, 0x00
0x583C 0x56 ############ Sleep Mode Setup ##################################################
0x589C 0x4D # Set inactivity timer to 320 frames - 400 msec (recommended for most hosts)
0x58EE 0x6A # value may be reduced in accordance to host limitations for power saving (default: 80 frames - 100msec).
0x595D 0x3A #Send_HCI_VS_hcill_parameters 0xFD2B, 0x0140, 0xffff, 0xff
0x599C 0x4D #Wait_HCI_Command_Complete_VS_hcill_parameters_Event 5000, 0x00, 0xfd2b, 0x00
0x59F3 0x63 # Default Settling time of 15ms may be reduced in accordance to design requirments for power saving
0x5A5B 0x2C #Send_HCI_VS_Set_Settling_Time 0xFF79, 15000
0x5A8C 0x5F #Wait_HCI_Command_Complete_VS_Set_Settling_Time_Event 5000, any, HCI_VS_Set_Settling_Time, 0x00
0x5AF5 0x2B # Enable deep sleep with default parameters
0x5B25 0x53 #Send_HCI_VS_Sleep_Mode_Configurations 0xFD0C, 1, 1, 0xFF, 0xFF, 0xFF, 0xFF, 0, 100
0x5B7D 0x6F #Wait_HCI_Command_Complete_VS_Sleep_Mode_Configurations_Event 5000, any, HCI_VS_Sleep_Mode_Configurations, 0x00
0x5BF6 0x42 #-----------------------------------------------------------------
0x5C47 0x28 # Initialize voice settings for 7500 PCM
0x5C74 0x42 #-----------------------------------------------------------------
0x5CFD 0x42 #-----------------------------------------------------------------
0x5D4E 0x15 # Enable co-existence
0x5D68 0x42 #-----------------------------------------------------------------
0x5E68 0x42 #-----------------------------------------------------------------
0x5EB9 0x18 # Enable Deep Sleep Mode
0x5ED6 0x4D # Set inactivity timer to 320 frames - 400 msec (recommended for most hosts)
0x5F28 0x6A # value may be reduced in accordance to host limitations for power saving (default: 80 frames - 100msec).
0x5F97 0x42 #-----------------------------------------------------------------
0x5FDE 0x3A #Send_HCI_VS_hcill_parameters 0xFD2B, 0x0140, 0xffff, 0xff
0x601D 0x3A #Send_HCI_VS_hcill_parameters 0xFD2B, 0x1f40, 0xffff, 0xff
0x605C 0x4D #Wait_HCI_Command_Complete_VS_hcill_parameters_Event 5000, 0x00, 0xfd2b, 0x00
Sorry for this extensive post, but i wanted to put it down here for completeness
Regards,
scholbert

[Q] Ad-hoc on ZTE Blade

Hi
I've got a question. How to connect blade (on 2.2 froyo) to ad-hoc wirless?
Probably must change a "wpa_supplicant" file (and probably other's simmilar), but i don't know how
This is my "wpa_supplicant" (viewed by normal notepad) :
Code:
# Note: All file paths in this configuration file should use full (absolute,
# not relative to working directory) path in order to allow working directory
# to be changed. This can happen if wpa_supplicant is run in the background.
# Whether to allow wpa_supplicant to update (overwrite) configuration
#
# This option can be used to allow wpa_supplicant to overwrite configuration
# file whenever configuration is changed (e.g., new network block is added with
# wpa_cli or wpa_gui, or a password is changed). This is required for
# wpa_cli/wpa_gui to be able to store the configuration changes permanently.
# Please note that overwriting configuration file will remove the comments from
# it.
update_config=1
# global configuration (shared by all network blocks)
#
# Parameters for the control interface. If this is specified, wpa_supplicant
# will open a control interface that is available for external programs to
# manage wpa_supplicant. The meaning of this string depends on which control
# interface mechanism is used. For all cases, the existance of this parameter
# in configuration is used to determine whether the control interface is
# enabled.
#
# For UNIX domain sockets (default on Linux and BSD): This is a directory that
# will be created for UNIX domain sockets for listening to requests from
# external programs (CLI/GUI, etc.) for status information and configuration.
# The socket file will be named based on the interface name, so multiple
# wpa_supplicant processes can be run at the same time if more than one
# interface is used.
# /var/run/wpa_supplicant is the recommended directory for sockets and by
# default, wpa_cli will use it when trying to connect with wpa_supplicant.
#
# Access control for the control interface can be configured by setting the
# directory to allow only members of a group to use sockets. This way, it is
# possible to run wpa_supplicant as root (since it needs to change network
# configuration and open raw sockets) and still allow GUI/CLI components to be
# run as non-root users. However, since the control interface can be used to
# change the network configuration, this access needs to be protected in many
# cases. By default, wpa_supplicant is configured to use gid 0 (root). If you
# want to allow non-root users to use the control interface, add a new group
# and change this value to match with that group. Add users that should have
# control interface access to this group. If this variable is commented out or
# not included in the configuration file, group will not be changed from the
# value it got by default when the directory or socket was created.
#
# When configuring both the directory and group, use following format:
# DIR=/var/run/wpa_supplicant GROUP=wheel
# DIR=/var/run/wpa_supplicant GROUP=0
# (group can be either group name or gid)
#
ctrl_interface=DIR=/data/misc/wifi/wpa_supplicant GROUP=wifi
# IEEE 802.1X/EAPOL version
# wpa_supplicant is implemented based on IEEE Std 802.1X-2004 which defines
# EAPOL version 2. However, there are many APs that do not handle the new
# version number correctly (they seem to drop the frames completely). In order
# to make wpa_supplicant interoperate with these APs, the version number is set
# to 1 by default. This configuration value can be used to set it to the new
# version (2).
# eapol_version=1
# AP scanning/selection
# By default, wpa_supplicant requests driver to perform AP scanning and then
# uses the scan results to select a suitable AP. Another alternative is to
# allow the driver to take care of AP scanning and selection and use
# wpa_supplicant just to process EAPOL frames based on IEEE 802.11 association
# information from the driver.
# 1: wpa_supplicant initiates scanning and AP selection
# 0: driver takes care of scanning, AP selection, and IEEE 802.11 association
# parameters (e.g., WPA IE generation); this mode can also be used with
# non-WPA drivers when using IEEE 802.1X mode; do not try to associate with
# APs (i.e., external program needs to control association). This mode must
# also be used when using wired Ethernet drivers.
# 2: like 0, but associate with APs using security policy and SSID (but not
# BSSID); this can be used, e.g., with ndiswrapper and NDIS drivers to
# enable operation with hidden SSIDs and optimized roaming; in this mode,
# the network blocks in the configuration file are tried one by one until
# the driver reports successful association; each network block should have
# explicit security policy (i.e., only one option in the lists) for
# key_mgmt, pairwise, group, proto variables
# ap_scan=1
# EAP fast re-authentication
# By default, fast re-authentication is enabled for all EAP methods that
# support it. This variable can be used to disable fast re-authentication.
# Normally, there is no need to disable this.
# fast_reauth=1
# Driver interface parameters
# This field can be used to configure arbitrary driver interace parameters. The
# format is specific to the selected driver interface. This field is not used
# in most cases.
#driver_param="field=value"
# Maximum lifetime for PMKSA in seconds; default 43200
#dot11RSNAConfigPMKLifetime=43200
# Threshold for reauthentication (percentage of PMK lifetime); default 70
#dot11RSNAConfigPMKReauthThreshold=70
# Timeout for security association negotiation in seconds; default 60
#dot11RSNAConfigSATimeout=60
Sorry for my bad english.
I very needed internet in ad-hoc mode. So, anybody help me ?

wifi ad hoc is not supported by zte blade official rom even by changing wpa_supplicant this will crash your wifi.............
maybe the modded supplicant is not compatible with stock rom..........
change your rom to any cm7 and than change its wpa_supplicant to /system/bin than only the wifi adhoc will work

EVO Shift buil.prop

I'm on a EVO 3D, and trying to do a.coulpe things that needs EVO shift build.prop. I'm testing to see if I can get Order & Chaos to work on EVO 3d by making it think its a shift, and hoping this way I will not have to use chainfire, thank you in advance. I will hit your thank button.

ro.config.ringtone=Windchimer.mp3
ro.config.notification_sound=Little.mp3
ro.com.google.clientidbase=android-sprint-us
ro.com.google.clientidbase.yt=android-sprint-us
ro.com.google.clientidbase.am=android-sprint-us
ro.com.google.clientidbase.vs=android-sprint-us
ro.com.google.clientidbase.gmm=android-sprint-us
ro.com.google.clientidbase.ms=android-sprint-us
ro.phone.min_match=7
ro.cdma.home.operator.alpha=sprint
gsm.sim.operator.alpha=sprint
gsm.operator.alpha=sprint
ro.cdma.home.operator.numeric=310120
gsm.sim.operator.numeric=310120
gsm.operator.numeric=310120
gsm.sim.operator.iso-country=us
gsm.operator.iso-country=us
# begin build properties
# autogenerated by buildinfo.sh
ro.aa.taskid=196686
ro.aa.project=Speedy_S
ro.aa.romver=2.76.651.4
ro.aa.maincid=SPCS_001
ro.aa.modelid=PG0610000
ro.aa.skulist=651
ro.aa.rid=48
ro.aa.customizationid=178653
ro.aa.cidlist=SPCS_001
ro.build.display.id=2.76.651.4
ro.product.brand=sprint
ro.aa.mainsku=651
BUILD_DISPLAY_ID=2.76.651.4
ro.com.google.clientidbase=android-sprint-us
ro.aa.taskid=196686
ro.aa.project=Speedy_S
ro.aa.romver=2.76.651.4
ro.aa.maincid=SPCS_001
ro.aa.modelid=PG0610000
ro.aa.skulist=651
ro.aa.rid=48
ro.aa.customizationid=178653
ro.aa.cidlist=SPCS_001
ro.build.display.id=2.76.651.4
ro.product.brand=sprint
ro.aa.mainsku=651
BUILD_DISPLAY_ID=2.76.651.4
ro.com.google.clientidbase=android-sprint-us
ro.build.id=GRI40
ro.build.display.id=GRI40
ro.build.version.incremental=74499
ro.build.version.sdk=10
ro.build.version.codename=REL
ro.build.version.release=2.3.3
ro.build.date=六 6月 4 17:03:33 CST 2011
ro.build.date.utc=1307178213
ro.build.type=user
ro.build.user=root
ro.build.host=AA125
ro.build.tags=release-keys
ro.product.model=PG06100
ro.product.brand=sprint
ro.product.name=htc_speedy
ro.product.device=speedy
ro.product.board=speedy
ro.product.cpu.abi=armeabi-v7a
ro.product.cpu.abi2=armeabi
ro.product.manufacturer=HTC
ro.product.locale.language=hdpi
ro.product.locale.region=
ro.wifi.channels=
ro.board.platform=msm7x30
# ro.build.product is obsolete; use ro.product.device
ro.build.product=speedy
# Do not try to parse ro.build.description or .fingerprint
ro.build.description=S.S ROMS
ro.build.changelist=74499
ro.product.ua=
ro.build.fingerprint=sprint/htc_speedy/speedy:2.3.3/GRI40/74499:user/release-keys
ro.build.project=196686
ro.product.version=2.76.651.4
keyguard.no_require_sim=1
# end build properties
#
# system.prop for mahimahi
#
ro.sf.lcd_density=240
debug.fb.rgb565 = 0
rild.libpath=/system/lib/libhtc_ril.so
# Default network type.
# 4 => CDMA mode preferred.
ro.telephony.default_network=4
wifi.interface=eth0
wifi.supplicant_scan_interval=15
# The OpenGL ES API level that is natively supported by this device.
# This is a 16.16 fixed point number
ro.opengles.version = 131072
# This is a high density device with more memory, so larger vm heaps for it.
# Change to 32m, due to 2.3.3 GB already change to 32m
dalvik.vm.heapsize=48m
# For the default value of agps
ro.ril.def.agps.mode = 2
# For emmc phone storage
ro.phone_storage = 0
# For FOTA setting (leave empty value to use default)
ro.htc.checkin.url = http://andchin.htc.com/android/checkin
ro.htc.checkin.crashurl = http://andchin.htc.com/android/crash
ro.htc.checkin.url_CN = http://andchin.htccomm.com.cn/android/checkin
ro.htc.checkin.crashurl_CN = http://andchin.htccomm.com.cn/android/crash
ro.htc.checkin.exmsg.url = http://fotamsg.htc.com/android/extra/
ro.htc.checkin.exmsg.url_CN = http://fotamsg.htccomm.com.cn/android/extra/
ro.htc.appupdate.url = http://apu-chin.htc.com/check-in/rws/and-app/update
ro.htc.appupdate.url_CN = http://apu-chin.htccomm.com.cn/check-in/rws/and-app/update
ro.htc.appupdate.exmsg.url = http://apu-msg.htc.com/extra-msg/rws/and-app/msg
ro.htc.appupdate.exmsg.url_CN = http://apu-msg.htccomm.com.cn/extra-msg/rws/and-app/msg
# release Bluetooth HW/SW information
ro.bt.chipset = Broadcom BCM4329-B1
ro.bt.stack = Broadcom BTL-A
ro.bt.stack.version = 2.0.50.032
#0x10000010010100101000011 represent bt profile list
ro.bt.profiles = 4270403
# Properties of BTLA stack
service.brcm.bt.activation = 0
service.brcm.bt.srv_active = 0
service.brcm.bt.hcid_active = 0
service.brcm.bt.btld = 0
service.brcm.bt.btld_pid = 0
service.brcm.bt.avrcp_pass_thru = 0
service.brcm.bt.avrcp_toggle = 1
#Welly_Fang_01/05/2010
ro.cdma.home.operator.alpha = sprint
ro.cdma.home.operator.numeric = 310120
#Welly_Fang_08/31/2010
gsm.sim.operator.alpha = sprint
gsm.sim.operator.numeric = 310120
gsm.sim.operator.iso-country = us
gsm.operator.alpha = sprint
gsm.operator.numeric = 310120
gsm.operator.iso-country = us
#Welly_Fang_12/30/2010
ro.com.google.clientidbase.yt = android-sprint-us
ro.com.google.clientidbase.am = android-sprint-us
ro.com.google.clientidbase.vs = android-sprint-us
ro.com.google.clientidbase.gmm = android-sprint-us
#Modify MTU from 1500 to 1472 on 3G network
ro.ril.set.mtu1472 = 1
# Properties of Scalado Denoise param.
postprocess.iso_midband = 400
postprocess.denoise_level = 5
# Following property will be reference by Settings.
ro.product.processor = 800 MHz
ro.product.ram = 512 MB
ro.product.display_resolution = 3.6 inch WVGA resolution
ro.product.main_camera = 5M
ro.product.front_camera = NA
ro.product.bluetooth = 2.1 + EDR
ro.product.wifi = 802.11 b/g/n
# For opensense sdk
ro.htc.common.version = 2.1.0.0
#
# ADDITIONAL_BUILD_PROPERTIES
#
ro.url.legal=http://www.google.com/intl/%s/mobile/android/basic/phone-legal.html
ro.url.legal.android_privacy=http://www.google.com/intl/%s/mobile/android/basic/privacy.html
ro.com.google.networklocation=1
ro.setupwizard.mode=DISABLED
ro.setupwizard.mode=OPTIONAL
ro.config.ringtone=QuietlyBrilliant.mp3
ro.config.notification_sound=Zeta.mp3
ro.config.alarm_alert=NewDay.mp3
ro.config.cal_notification=Epsilon.mp3
ro.config.msg_notification=Gamma.mp3
ro.setupwizard.mode=DISABLED
ro.com.google.gmsversion=2.3_r3
media.a1026.nsForVoiceRec=0
htc.audio.alt.enable=1
htc.audio.hac.enable=1
ro.setupwizard.enterprise_mode=1
dalvik.vm.dexopt-flags=m=y
net.bt.name=Android
dalvik.vm.stack-trace-file=/data/anr/traces.txt
windowsmgr.max_events_per_sec=100
ro.HOME_APP_ADJ=0
ro.FOREGROUND_APP_MEM 2048
ro.HOME_APP_MEM=3072
ro.VISIBLE_APP_MEM 3072
ro.PERCEPTIBLE_APP_MEM 4096
ro.HEAVY_WEIGHT_APP_MEM 4096
ro.SECONDARY_SERVER_MEM 6144
ro.BACKUP_APP_MEM 6144
ro.HIDDEN_APP_MEM 6144
ro.EMPTY_APP_MEM 8192
Sent from my EVO Shift Supreme

mrjaydee82 said:
I'm on a EVO 3D, and trying to do a.coulpe things that needs EVO shift build.prop. I'm testing to see if I can get Order & Chaos to work on EVO 3d by making it think its a shift, and hoping this way I will not have to use chainfire, thank you in advance. I will hit your thank button.[/QUOT
here ya go :
Dam Strapped you type fast: I know copy and paste! LOL
Click to expand...
Click to collapse

ro.product.brand=
ro.product.model=
ro.product.name=
ro.product.device=
ro.product.board=
Ahh sweet you did it already thanks

Not to highjack the thread, but how did you add the txt file fdx? I just pasted my whole biuld.prop lol its early i did it the easy way!
Sent from my EVO Shift Supreme

strapped365 said:
Not to highjack the thread, but how did you add the txt file fdx? I just pasted my whole biuld.prop lol its early i did it the easy way!
Sent from my EVO Shift Supreme
Click to expand...
Click to collapse
I just went into one of my rom .zips opened it up and copied the buid.prop to a folder the zipped it up with 7zip that what you mean?

Yeah i went into root explorer and copied it then pasted lmao lazy way
Sent from my Supreme Hybrid HTC Evo Shift

[Q] [Wanted] Softbank 201M specific build.prop

The Softbank 201M is a OEM'ed version of the Motorola RAZR M. I need the build.prop from this device. Can anyone provide me with that file?

Jainoxi said:
The Softbank 201M is a OEM'ed version of the Motorola RAZR M. I need the build.prop from this device. Can anyone provide me with that file?
Click to expand...
Click to collapse
Here is for you.
Code:
# begin build properties
# autogenerated by buildinfo.sh
ro.build.id=7.7.1Q-164_SMJ-165
ro.build.display.id=7.7.1Q-164_SMJ-165
ro.build.version.incremental=143
ro.build.version.sdk=15
ro.build.version.codename=REL
ro.build.version.release=4.0.4
ro.build.date=Wed Nov 14 13:46:47 CST 2012
ro.build.date.utc=1352922407
ro.build.type=user
ro.build.user=hudsoncm
ro.build.host=il93lnxdroid84
ro.build.tags=release-keys
ro.product.model=201M
ro.product.brand=motorola
ro.product.name=XT902_jp_sbm
ro.product.device=scorpion_mini_t
ro.product.board=MSM8960
ro.product.cpu.abi=armeabi-v7a
ro.product.cpu.abi2=armeabi
ro.product.manufacturer=motorola
ro.product.locale.language=ja
ro.product.locale.region=JP
ro.wifi.channels=
ro.board.platform=msm8960
# ro.build.product is obsolete; use ro.product.device
ro.build.product=XT902_jp_sbm
# Do not try to parse ro.build.description or .fingerprint
ro.build.description=scorpion_mini_t-user 4.0.4 7.7.1Q-164_SMJ-165 143 release-keys
ro.build.fingerprint=motorola/XT902_jp_sbm/scorpion_mini_t:4.0.4/7.7.1Q-164_SMJ-165/143:user/release-keys
ro.build.characteristics=default
# end build properties
#
# system.prop for surf
#
rild.libpath=/system/lib/libril-qc-qmi-1.so
rild.libargs=-d /dev/smd0
persist.rild.nitz_plmn=
persist.rild.nitz_long_ons_0=
persist.rild.nitz_long_ons_1=
persist.rild.nitz_long_ons_2=
persist.rild.nitz_long_ons_3=
persist.rild.nitz_short_ons_0=
persist.rild.nitz_short_ons_1=
persist.rild.nitz_short_ons_2=
persist.rild.nitz_short_ons_3=
ril.subscription.types=NV,RUIM
DEVICE_PROVISIONED=1
debug.sf.hw=1
debug.egl.hw=1
debug.composition.type=dyn
ro.sf.compbypass.enable=1
ro.sf.lcd_density=240
dalvik.vm.heapsize=128m
dalvik.vm.heapstartsize=8m
dalvik.vm.heapgrowthlimit=64m
dev.pm.dyn_samplingrate=1
#
# system props for the cne module
#
# IKHSS7-31817 Disable AP CNE
persist.cne.UseCne=none
persist.cne.UseSwim=false
persist.cne.bat.range.low.med=30
persist.cne.bat.range.med.high=60
persist.cne.loc.policy.op=/system/etc/OperatorPolicy.xml
persist.cne.loc.policy.user=/system/etc/UserPolicy.xml
persist.cne.bwbased.rat.sel=false
persist.cne.snsr.based.rat.mgt=false
persist.cne.bat.based.rat.mgt=false
persist.cne.rat.acq.time.out=30000
persist.cne.rat.acq.retry.tout=0
persist.cne.nsrm.mode=false
ro.hdmi.enable=false
lpa.decode=false
lpa.use-stagefright=true
#system props for the MM modules
media.stagefright.enable-player=true
media.stagefright.enable-http=true
media.stagefright.enable-aac=true
media.stagefright.enable-qcp=true
media.stagefright.enable-fma2dp=true
media.stagefright.enable-scan=true
#
# system props for the data modules
#
ro.use_data_netmgrd=true
#system props for time-services
persist.timed.enable=true
# System props for audio
persist.audio.fluence.mode=endfire
persist.audio.vr.enable=false
persist.audio.handset.mic=digital
ro.config.vc_call_vol_steps=7
#
# system prop for opengles version
#
# 131072 is decimal for 0x20000 to report version 2
ro.opengles.version=131072
#
# system prop for Bluetooth Dialup Networking
# Enabled it by TG4, After that it should be disabled
#
ro.qualcomm.bluetooth.dun=false
# system prop for Bluetooth FTP profile
ro.qualcomm.bluetooth.ftp=true
#
# system property for Bluetooth Handsfree Profile Wide Band Speech
#
ro.qualcomm.bluetooth.hfp.wbs=true
#
#system prop for Bluetooth hci transport
ro.qualcomm.bt.hci_transport=smd
#
# system prop for requesting Master role in incoming Bluetooth connection.
#
ro.bluetooth.request.master=true
#
# system prop for Bluetooth Auto connect for remote initated connections
#
ro.bluetooth.remote.autoconnect=true
# system property for Bluetooth discoverability time out in seconds
# 0: Always discoverable
#debug.bt.discoverable_time=0
#system prop for switching gps driver to qmi
persist.gps.qmienabled=true
# system property for thermald
persist.thermal.monitor=true
#
# System prop for sending transmit power request to RIL during WiFi hotspot on/off
#
ro.ril.transmitpower=true
#For TCMD bringup
persist.tcmd.log.limit=0
#
#Simulate sdcard on /data/media
#
persist.fuse_sdcard=true
# System Prop for sending synchronus sms
persist.radio.sms_sync_sending=1
ro.mot.ril.danlist=611,*611,#611
# BEGIN Motorola, w21125, 2012/7/25, IKSCORPIONMINISBM-1192
#ro.telephony.default_network=9
ro.telephony.default_network=12
# END IKSCORPIONMINISBM-1192
# Motorola, IKHALFMWK-3, w001091
# Feature 32711, deep sleep mode support
ro.mot.deep.sleep.supported=true
#need tested MT call ring tone
#ro.telephony.call_ring.multiple=false
# ro.cdma.data_retry_config:
# This configration is set to align with CDMA BP data throttling algorithm. The purpose of this
# configuration is to trigger CDMA BP to fall into HRPD if three continuous data retries happen
# while CDMA BP throttling timer is running in eHRPD.
# This configuration was tuned up by CDMA BP team. Please do not change unless you totally understand
# the impact.
# Configure the retry timers slightly longer than BP throttling timers to ensure
# the retry goes through. See RetryManager.java for syntax.
#
# ro.gsm.data_retry_config:
# LTE BP throttling timers are:
# the first retry timer: 0,
# the second retry timer: 0,
# the third retry timer: 1min + random(0-15)sec,
# the forth retry timer: 2min,
# the fifth retry timer: 8min,
# the sixth retry timer: 15min.
# all subsequent retry timers: the last timer, i.e, 15min.
# BEGIN Motorola, tvcw63, 2012/7/31, IKSCORPIONMINISBM-1174
#ro.gsm.data_retry_config=default_randomization=2000,max_retries=infinite,0,0,80000,125000,485000,905000
# END IKSCORPIONMINISBM-1174
# Configure retry timers for APNs other than default and IMS
ro.gsm.2nd_data_retry_config=max_retries=1,15000
# BEGIN IKLOCSEN-774 Enable SmartGPS
# Gps Smart Battery Savings
# (depends on sensor hub)
# 0 disable
# 1 enable
persist.mot.gps.smart_battery=1
# END IKLOCSEN-774
# Enable HAC mode
ro.mot.hw.HAC=1
# Disable Bluetooth tethering
ro.mot.btpan.disable = true
windowsmgr.max_events_per_sec=90
# BEGIN IKSCORPIONMINISBM-1403
# In order to hide the market name from the public during user trials,
# set the ro.property.model.exif in system.prop to a non-descriptive string, such as MODEL A.
# This string will be populated in the "model" EXIF field of camera captured image JPEG files.
# When the product team is ready for the market name to be available to the public (e.g., in a TA build),
# then the ro.property.model.exif in system.prop MUST be changed to match the PRODUCT_MODEL string.
ro.product.model.exif=201M
# END IKSCORPIONMINISBM-1403
# BEGIN IKSCORPIONMINISBM-1162 Domain restriction status report.
persist.radio.report_rstate=1
# END IKSCORPIONMINISBM-1162
# BEGIN IKSCORPIONMINISBM-1485
# SBM:ALM:AP:00220:1b-1 :
# Connectivity_Action process is performed in the case of returning to coverage area
# after transferring to out-of-coverage area under the condition that RRC_CONNECTED state with AXGP cell.
persist.telephony.oosisdc=false
# END IKSCORPIONMINISBM-1485
# BEGIN IKHSS7-48951 IKSCORPIONMINISBM-2005
ro.camera.storage.default = external
# END IKHSS7-48951 IKSCORPIONMINISBM-2005
#
# ADDITIONAL_BUILD_PROPERTIES
#
drm.service.enabled=true
persist.radio.vrte_logic=2
ro.com.android.dataroaming=false
ro.config.ringtone=Droplet.ogg
ro.config.notification_sound=Light.ogg
ro.config.alarm_alert=Cesium.ogg
persist.telephony.mpdn=false
ro.usb.mtp_usbnet=0x2e50
ro.usb.mtp_usbnet_adb=0x2e51
ro.usb.ms=0x2e54
ro.usb.ms_adb=0x2e55
ro.usb.ptp=0x2e52
ro.usb.ptp_adb=0x2e53
ro.usb.cdrom=0x710f
keyguard.no_require_sim=true
ro.com.android.dateformat=MM-dd-yyyy
ro.vendor.extension_library=/system/lib/libqc-opt.so
ro.com.google.gmsversion=4.0_r1
persist.radio.apm_sim_not_pwdn=1
persist.radio.call_type=1
persist.sys.qc.sub.rstrtlvl=3
persist.sys.qc.sub.rdump.max=20
ro.qualcomm.cabl=0
ro.bug2go.uid.type=TELEPHONY_DEVICE_ID
ro.com.google.clientidbase=android-motorola
ro.com.google.clientidbase.ms=android-motorola
ro.com.google.clientidbase.am=android-softbank-jp
ro.com.google.clientidbase.gmm=android-motorola
ro.com.google.clientidbase.yt=android-motorola
ro.setupwizard.mode=DISABLED
net.bt.name=Android
dalvik.vm.stack-trace-file=/data/anr/traces.txt
ro.mot.dpmext=true
ro.com.google.clientid=android-motorola
ro.url.legal=http://www.google.com/intl/%s/mobile/android/basic/phone-legal.html
ro.url.legal.android_privacy=http://www.google.com/intl/%s/mobile/android/basic/privacy.html
ro.mot.build.customerid=SBM
ro.build.version.full=Blur_Version.7.3.165.201M.SBM.en.JP
ro.mot.hidden_keyboards=evfwd
ro.mot.build.version.sdk_int=7
ro.mot.product.modelno=201M
ro.com.google.locationfeatures=1
ro.tether.denied=false

Gps bug (oneplus one)

Ohkay so this gps bug is annoying... It always searching for gps..
I tried sultan rom as well.. But the problem persist there as well..
Anyone know any fix...
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Fly 2080->nokia 5800->galaxy s3->oneplus one

If gps is still not functioning correctly after a clean flash of sultan's rom, it may be a firmware issue, since sultan's rom does not contain firmware.
You can try flash one of the firmwares from http://forum.xda-developers.com/oneplus-one/general/firmware-modem-oneplus-one-lollipop-t3300907 if the issue is indeed firmware.

Bladehawkz said:
If gps is still not functioning correctly after a clean flash of sultan's rom, it may be a firmware issue, since sultan's rom does not contain firmware.
You can try flash one of the firmwares from http://forum.xda-developers.com/oneplus-one/general/firmware-modem-oneplus-one-lollipop-t3300907 if the issue is indeed firmware.
Click to expand...
Click to collapse
Ohh i forgot to mention... I tried oxygen, . 4.11 the latest firmware and the custom firware available from the page..
All of them... But the problem still persist... It can just dont want to connect to any gps..!!
On sultans rom.. I was on 4. 011 firmware.. And problem was still there.
What should i do?
Fly 2080->nokia 5800->galaxy s3->oneplus one

download fastergps from playstore - https://play.google.com/store/apps/details?id=org.fastergps&hl=en
open app and choose your continent and region (must grant su permission)
close out and open GPS Test app, go to settings and clear then update agps
then see if it connects, might take a few minutes

kenboyles72 said:
download fastergps from playstore - https://play.google.com/store/apps/details?id=org.fastergps&hl=en
open app and choose your continent and region (must grant su permission)
close out and open GPS Test app, go to settings and clear then update agps
then see if it connects, might take a few minutes
Click to expand...
Click to collapse
Result after using fast gps.. Waited for 5 minutes.
Still no luck..!!!
Fly 2080->nokia 5800->galaxy s3->oneplus one

Try installing stock, get lock and powering off with locations turned on flash the new rom, its a common bug of cyanogen, it cant get first gps lock if gps modem cache wasnt locked in stock, dunno why
Sent from my fridge running CM13

santi1993 said:
Try installing stock, get lock and powering off with locations turned on flash the new rom, its a common bug of cyanogen, it cant get first gps lock if gps modem cache wasnt locked in stock, dunno why
Sent from my fridge running CM13
Click to expand...
Click to collapse
Really...
I heard fastbooting oxygen os takes care of this issue....
Is this true?
Fly 2080->nokia 5800->galaxy s3->oneplus one

No need to flash any firmware etc.
Modify the blue contents of the file /system/etc/gps.conf, by removing the # indicated in red color.
(Remove the # of whichever place/area is nearer to you e.g. mine is Asia)
Code:
#Uncommenting these urls would only enable
#the power up auto injection and force injection(test case).
#XTRA_SERVER_1=http://xtra1.gpsonextra.net/xtra.bin
#XTRA_SERVER_2=http://xtra2.gpsonextra.net/xtra.bin
#XTRA_SERVER_3=http://xtra3.gpsonextra.net/xtra.bin
#
XTRA_SERVER_1=http://xtra1.gpsonextra.net/xtra2.bin
XTRA_SERVER_2=http://xtra2.gpsonextra.net/xtra2.bin
XTRA_SERVER_3=http://xtra3.gpsonextra.net/xtra2.bin
# Error Estimate
# _SET = 1
# _CLEAR = 0
ERR_ESTIMATE=0
[COLOR="Blue"]#Test
NTP_SERVER=time.gpsonextra.net
#Asia
[COLOR="Red"]# [/COLOR]NTP_SERVER=asia.pool.ntp.org
#Europe
# NTP_SERVER=europe.pool.ntp.org
#North America
# NTP_SERVER=north-america.pool.ntp.org[/COLOR]
# DEBUG LEVELS: 0 - none, 1 - Error, 2 - Warning, 3 - Info
# 4 - Debug, 5 - Verbose
# If DEBUG_LEVEL is commented, Android's logging levels will be used
DEBUG_LEVEL = 2
# Intermediate position report, 1=enable, 0=disable
INTERMEDIATE_POS=0
# supl version 1.0
SUPL_VER=0x10000
# Emergency SUPL, 1=enable, 0=disable
SUPL_ES=1
# GPS Capabilities bit mask
# SCHEDULING = 0x01
# MSB = 0x02
# MSA = 0x04
# ON_DEMAND_TIME = 0x10
# GEOFENCE = 0x20
# default = ON_DEMAND_TIME | MSA | MSB | SCHEDULING | GEOFENCE
CAPABILITIES=0x37
# Accuracy threshold for intermediate positions
# less accurate positions are ignored, 0 for passing all positions
# ACCURACY_THRES=5000
################################
##### AGPS server settings #####
################################
# FOR SUPL SUPPORT, set the following
# SUPL_HOST=supl.host.com or IP
# SUPL_PORT=1234
# FOR C2K PDE SUPPORT, set the following
# C2K_HOST=c2k.pde.com or IP
# C2K_PORT=1234
####################################
# LTE Positioning Profile Settings
####################################
# 0: Enable RRLP on LTE(Default)
# 1: Enable LPP_User_Plane on LTE
# 2: Enable LPP_Control_Plane
# 3: Enable both LPP_User_Plane and LPP_Control_Plane
LPP_PROFILE = 0
################################
# EXTRA SETTINGS
################################
# NMEA provider (1=Modem Processor, 0=Application Processor)
NMEA_PROVIDER=0
# Mark if it is a SGLTE target (1=SGLTE, 0=nonSGLTE)
SGLTE_TARGET=0
##################################################
# Select Positioning Protocol on A-GLONASS system
##################################################
# 0x1: RRC CPlane
# 0x2: RRLP UPlane
# 0x4: LLP Uplane
A_GLONASS_POS_PROTOCOL_SELECT = 0
then restart your phone and try the gps again

khan.orak said:
No need to flash any firmware etc.
Modify the blue contents of the file /system/etc/gps.conf, by removing the # indicated in red color.
(Remove the # of whichever place/area is nearer to you e.g. mine is Asia)
Code:
#Uncommenting these urls would only enable
#the power up auto injection and force injection(test case).
#XTRA_SERVER_1=http://xtra1.gpsonextra.net/xtra.bin
#XTRA_SERVER_2=http://xtra2.gpsonextra.net/xtra.bin
#XTRA_SERVER_3=http://xtra3.gpsonextra.net/xtra.bin
#
XTRA_SERVER_1=http://xtra1.gpsonextra.net/xtra2.bin
XTRA_SERVER_2=http://xtra2.gpsonextra.net/xtra2.bin
XTRA_SERVER_3=http://xtra3.gpsonextra.net/xtra2.bin
# Error Estimate
# _SET = 1
# _CLEAR = 0
ERR_ESTIMATE=0
[COLOR="Blue"]#Test
NTP_SERVER=time.gpsonextra.net
#Asia
[COLOR="Red"]# [/COLOR]NTP_SERVER=asia.pool.ntp.org
#Europe
# NTP_SERVER=europe.pool.ntp.org
#North America
# NTP_SERVER=north-america.pool.ntp.org[/COLOR]
# DEBUG LEVELS: 0 - none, 1 - Error, 2 - Warning, 3 - Info
# 4 - Debug, 5 - Verbose
# If DEBUG_LEVEL is commented, Android's logging levels will be used
DEBUG_LEVEL = 2
# Intermediate position report, 1=enable, 0=disable
INTERMEDIATE_POS=0
# supl version 1.0
SUPL_VER=0x10000
# Emergency SUPL, 1=enable, 0=disable
SUPL_ES=1
# GPS Capabilities bit mask
# SCHEDULING = 0x01
# MSB = 0x02
# MSA = 0x04
# ON_DEMAND_TIME = 0x10
# GEOFENCE = 0x20
# default = ON_DEMAND_TIME | MSA | MSB | SCHEDULING | GEOFENCE
CAPABILITIES=0x37
# Accuracy threshold for intermediate positions
# less accurate positions are ignored, 0 for passing all positions
# ACCURACY_THRES=5000
################################
##### AGPS server settings #####
################################
# FOR SUPL SUPPORT, set the following
# SUPL_HOST=supl.host.com or IP
# SUPL_PORT=1234
# FOR C2K PDE SUPPORT, set the following
# C2K_HOST=c2k.pde.com or IP
# C2K_PORT=1234
####################################
# LTE Positioning Profile Settings
####################################
# 0: Enable RRLP on LTE(Default)
# 1: Enable LPP_User_Plane on LTE
# 2: Enable LPP_Control_Plane
# 3: Enable both LPP_User_Plane and LPP_Control_Plane
LPP_PROFILE = 0
################################
# EXTRA SETTINGS
################################
# NMEA provider (1=Modem Processor, 0=Application Processor)
NMEA_PROVIDER=0
# Mark if it is a SGLTE target (1=SGLTE, 0=nonSGLTE)
SGLTE_TARGET=0
##################################################
# Select Positioning Protocol on A-GLONASS system
##################################################
# 0x1: RRC CPlane
# 0x2: RRLP UPlane
# 0x4: LLP Uplane
A_GLONASS_POS_PROTOCOL_SELECT = 0
then restart your phone and try the gps again
Click to expand...
Click to collapse
Well my gps. Conf
Dont really have that line... I really cant find that # asia line... :/
Here take a look
Fly 2080->nokia 5800->galaxy s3->oneplus one

kevinpunk said:
Well my gps. Conf
Dont really have that line... I really cant find that # asia line... :/
Here take a look
Fly 2080->nokia 5800->galaxy s3->oneplus one
Click to expand...
Click to collapse
Backup your original GPS file. Copy and paste my file's contents and save it. Then reboot. Hope it works.
If you live in Europe then remove hash from Europe's line.

If all else fails, fastboot flash COS 13.1. I had a GPS issue, along with people not being able to hear me in calls nor me hear them.
Fastboot flash COS 13.1
Fastboot flash twrp 2.8.7.0
Wipes
Flash custom ROM, kernel, mods, etc
Worked like a charm for me!
There's a thread somewhere in the general section that has all the COS 13.1 files with a simple .bat file that'll flash it all automatically.

Neroga said:
If all else fails, fastboot flash COS 13.1. I had a GPS issue, along with people not being able to hear me in calls nor me hear them.
Fastboot flash COS 13.1
Fastboot flash twrp 2.8.7.0
Wipes
Flash custom ROM, kernel, mods, etc
Worked like a charm for me!
There's a thread somewhere in the general section that has all the COS 13.1 files with a simple .bat file that'll flash it all automatically.
Click to expand...
Click to collapse
yeah i think i am going to fastboot cos13.1 this time ..and see what happens .. if that doesnt work ..
i am gna fastboot oxygen os .. !!!
as my gps always has 24 gps available it just dont get any fix .. so i dont think its a hardware issue ..
still it nothing work .. have to go through the worse .. service centre procedure ..

Neroga said:
If all else fails, fastboot flash COS 13.1. I had a GPS issue, along with people not being able to hear me in calls nor me hear them.
Fastboot flash COS 13.1
Fastboot flash twrp 2.8.7.0
Wipes
Flash custom ROM, kernel, mods, etc
Worked like a charm for me!
There's a thread somewhere in the general section that has all the COS 13.1 files with a simple .bat file that'll flash it all automatically.
Click to expand...
Click to collapse
so i just fastbooted cos13.1 latest version and its still not getting any gps fix... what should i do now ?

khan.orak said:
Backup your original GPS file. Copy and paste my file's contents and save it. Then reboot. Hope it works.
If you live in Europe then remove hash from Europe's line.
Click to expand...
Click to collapse
after using your gps.conf file
i use to get less satellites ... like 4 and 4 of them use to connect ...
but i dont know why .. it never got a lock ..
like it use to show it is connecting with the satellite but never got a lock ... :/

What version of your firmwire ?
What type of your Gapps ?
I was using sultan last build & mini opengapps 20160718 & mod gps.conf there is no problem.

Khai Droid said:
What version of your firmwire ?
What type of your Gapps ?
I was using sultan last build & mini opengapps 20160718 & mod gps.conf there is no problem.
Click to expand...
Click to collapse
i am using the same Gapps .. and i am on latest sultans build .. and i tried 3.0, 4.11 and latest oxygen firmware as well.. but whenever i use any navigation its always searching for gps ... i dont know wht else i can do .. i have done everything..

Try update Google Play Service version 9.4.52 (438-1277739847)
Use App 'Disable Service'
Try to checked
FusedLocationService
GcmService
GeocodeService
GeofenceProviderService
GoogleLocationService
GoogleLocationManagerService
Setting > location , Mode : High Accuracy
Reboot OPO
Use app 'GPS Test'
Clear AGPS
Update AGPS.
Good Luck.

http://forum.xda-developers.com/oneplus-one/general/fix-weak-gps-signal-t2973228 here is my guide.

Lukiqq said:
http://forum.xda-developers.com/oneplus-one/general/fix-weak-gps-signal-t2973228 here is my guide.
Click to expand...
Click to collapse
So after using your gps file... I am only getting 2 gps And no fix.. No mattet how Long i wait.. I get no fix..
Any idea why?
Sent from my A0001 using XDA-Developers mobile app

kevinpunk said:
So after using your gps file... I am only getting 2 gps And no fix.. No mattet how Long i wait.. I get no fix..
Any idea why?
Sent from my A0001 using XDA-Developers mobile app
Click to expand...
Click to collapse
So I really don't know how to help you... [emoji52]
Wysłane z mojego A0001 przy użyciu Tapatalka