inkpad 3 pro bluetooth hacked

[x3oo]

i have the pb740-2 inkpad 3 pro
a regional variant without bluetooth but it looks like you can activate it:
Device: embedded Linux / Allwinner sunxi, kernel 3.10.65+, shell at /mnt/secure.

Goal: bring up Bluetooth.

Kernel config:
- Bluetooth core enabled.
- UART HCI enabled:
CONFIG_BT_HCIUART=y
CONFIG_BT_HCIUART_H4=y
CONFIG_BT_HCIUART_RTKH5=y
CONFIG_RTL_BT_LPM=y
- USB Bluetooth disabled:
# CONFIG_BT_HCIBTUSB is not set
- SDIO Bluetooth disabled:
# CONFIG_BT_HCIBTSDIO is not set

Conclusion: Bluetooth is not USB or SDIO. It is UART-attached Realtek Bluetooth.

Serial ports:
- /dev/ttyS0 exists and is the active kernel console.
/proc/consoles shows ttyS0 -W-
Do not use ttyS0 for Bluetooth.
- /dev/ttyS2 exists and is the Bluetooth UART.

Firmware:
- Firmware directory exists:
/lib/firmware/rtlbt
- Present files:
/lib/firmware/rtlbt/rtl8761a_config
/lib/firmware/rtlbt/rtl8761a_fw
- /sbin/rtk_hciattach expects /lib/firmware/rtlbt and recognizes rtl8761a firmware names.

Tools:
- /sbin/hciattach exists
- /usr/bin/hciconfig exists
- /sbin/rtk_hciattach exists
- bluetoothd is not in PATH, but vendor script uses:
/usr/libexec/bluetooth/bluetoothd
/usr/libexec/bluetooth/bluealsa

Important vendor script:
- /lib/modules/bt_ctrl.sh

Contents/behavior:
- Requires argument: on/off/start/stop.
- on:
echo 1 >/sys/devices/soc/bt.6/enable
rtk_hciattach -s 115200 ttyS2 rtk_h5
hciconfig hci0 noscan
echo 1 >/proc/bluetooth/sleep/lpm
- off:
echo 0 >/proc/bluetooth/sleep/lpm
killall rtk_hciattach
echo 0 >/sys/devices/soc/bt.6/enable
- start:
starts bluetoothd, bluealsa, bluetooth_agent_app, avrcp_dbus_manager
- stop:
kills those services.

Critical finding:
Direct rtk_hciattach attempts failed before enabling BT power/reset:
- rtk_h5 produced “3-wire sync pattern resend” and “H5 sync timed out”.
- rtk_h4 produced “init timed out, read local ver fails”.
- generic any created a dummy hci0 but with BD Address 00:00:00:00:00:00, zero MTU/features, RX bytes 0, and HCI command tx timeouts.
Reason: BT power rail/reset was not enabled.

After enabling power via the vendor path, dmesg showed success:
- [AXP] enable axp22_aldo1
- sunxi-bt bt.6: check bluetooth bt_power voltage: 3000000
- Bluetooth: h5_open
- Bluetooth: hci_uart_register_dev
- rtk_btcoex: BTCOEX hci_rev 0x1e7b
- rtk_btcoex: BTCOEX lmp_subver 0x7c2a
- BT_LPM hostwake line change

Current working state observed:
hciconfig -a showed:
- hci0 Type: Primary Bus: UART
- BD Address: 00:E0:4C:23:99:87
- ACL MTU: 1021:8
- SCO MTU: 255:16
- UP RUNNING
- RX/TX bytes nonzero
- Features nonzero
- rtk_hciattach process running:
rtk_hciattach -s 115200 ttyS2 rtk_h5

Caveat:
Running “sh /lib/modules/bt_ctrl.sh on” again while rtk_hciattach is already running may print:
Enable BT power ... OK
Load BT firmware ... fail
because UART/HCI is already claimed. Check ps/hciconfig first.

Clean startup from off:
sh /lib/modules/bt_ctrl.sh off
sleep 2
sh /lib/modules/bt_ctrl.sh on
sh /lib/modules/bt_ctrl.sh start

Clean shutdown:
sh /lib/modules/bt_ctrl.sh stop
sh /lib/modules/bt_ctrl.sh off

Useful checks:
hciconfig -a
ps | grep -E 'rtk_hciattach|hciattach'
dmesg | tail -80

Potential remaining issue:
hciconfig -a once showed:
Can't read local name on hci0: Connection timed out
despite hci0 being UP RUNNING with a real BD_ADDR and nonzero RX/TX. Suggested next commands:
echo 0 >/proc/bluetooth/sleep/lpm 2>/dev/null
hciconfig hci0 reset
sleep 1
hciconfig hci0 up
hciconfig hci0 name
hciconfig -a

Main conclusion:
Bluetooth works as Realtek UART H5 on ttyS2, but only after enabling board-specific BT power via /sys/devices/soc/bt.6/enable, best done through /lib/modules/bt_ctrl.sh.