search

Grapsus / cc254x_sdcc

an attempt to write an open-source BlueTooth Low Energy stack for TI cc2540 and cc2541 RF MCUs
16 stars 10 forks source link

Starting point #1

Open onegray opened 7 years ago

onegray commented 7 years ago

It seems the radio hardware is well documented in their User's Guide: http://www.ti.com/lit/ug/swru191f/swru191f.pdf

Also there is an example how to use proprietary mode radio: http://www.ti.com/lit/sw/swrc251b/swrc251b.zip

Grapsus commented 7 years ago

Hi @onegray ! Thanks for your interest in my project.

I know swru191 pretty well, it's what I used to get to this point. Currently I'm writing code to receive BLE advertising frames in proprietary radio mode. So far it seems possible: preamble detection, access codeword, whitening and CRC all are compatible with BLE.

What puzzles me is that the Link Layer Engine has two separate modes: proprietary and BLE which is undocumented. So why would they have a separate mode for BLE if it can be implemented in proprietary mode ?

Also if you download Ti's BLE stack 1.4, there's a lot of info leaking about the BLE mode in ll.h, ll_image.h and phy.h. In phy.h we learn that cc254x have a radio co-processor called nanoRisc and that the Ti BLE stack actually replaces the co-processor firmware when it runs. I really don't understand why they would go through all those troubles if BLE was doable with proprietary radio mode as described in swru191...

Anyways I'll post my BLE scanning code soon, stay tuned :)

onegray commented 7 years ago

cc2540 does not have the proprietary mode, it was added later for cc2541.

Grapsus commented 7 years ago

@onegray you're absolutely right, I didn't notice this difference between cc2540 and cc2541. It's even more mysterious since the TI Bluetooth Sniffer tool has firmwares for cc2540 which use the radio hardware in a "raw" mode. So it might be worth decompiling and see how they access radio hardware on cc2540. I wonder if it resembles the proprietary mode of cc2541 or if it's a totally different API.

Anyway, first I'm trying to receive BLE frames in proprietary mode on a cc2541 by following the datasheet without any hacking.

onegray commented 7 years ago

Some helpful information from TI support team: https://e2e.ti.com/support/wireless_connectivity/bluetooth_low_energy/f/538/t/189825 https://e2e.ti.com/support/wireless_connectivity/bluetooth_low_energy/f/538/t/218032