In this chapter, we first explain how Bluetooth chipsets are connected physically and then provide information about popular Bluetooth chipset and their use with BTstack.

HCI Interface

The communication between a Host (a computer or an MCU) and a Host Controller (the actual Bluetooth chipset) follows the Host Controller Interface (HCI), see below. HCI defines how commands, events, asynchronous and synchronous data packets are exchanged. Asynchronous packets (ACL) are used for data transfer, while synchronous packets (SCO) are used for Voice with the Headset and the Hands-Free Profiles.

Host Controller to Host connection


On desktop-class computers incl. laptops, USB is mainly used as HCI transport layer. For USB Bluetooth chipsets, there is little variation: most USB dongles on the market currently contain a Broadcom BCM20702 or a CSR 851x chipset. It is also called H2.

On embedded systems, UART connections are used instead, although USB could be used as well.

For UART connections, different transport layer variants exist.


The most common one is the official "UART Transport", also called H4. It requires hardware flow control via the CTS/RTS lines and assumes no errors on the UART lines.


The "Three-Wire UART Transport", also called H5, makes use of the SLIP protocol to transmit a packet and can deal with packet loss and bit-errors by retransmission. While it is possible to use H5 really with "three wires" without hardware handshake, we recommend to use a full UART with hardware handshake. If your design lacks the hardware handshake, H5 is your only option.


The predecessor of H5. The main difference to H5 is that Even Parity is used for BCSP. To use BCSP with BTstack, you use the H5 transport and can call hci_transport_h5_enable_bcsp_mode


Finally, Texas Instruments extended H4 to create the "eHCILL transport" layer that allows both sides to enter sleep mode without loosing synchronisation. While it is easier to implement than H5, it it is only supported by TI chipsets and cannot handle packet loss or bit-errors.

HCI Shortcomings

Unfortunately, the HCI standard misses a few relevant details:

  • For UART based connections, the initial baud rate isn't defined but most Bluetooth chipsets use 115200 baud. For better throughput, a higher baud rate is necessary, but there's no standard HCI command to change it. Instead, each vendor had to come up with their own set of vendor-specific commands. Sometimes, additional steps, e.g. doing a warm reset, are necessary to activate the baud rate change as well.

  • Some Bluetooth chipsets don't have a unique MAC address. On start, the MAC address needs to be set, but there's no standard HCI command to set it.

  • SCO data for Voice can either be transmitted via the HCI interface or via an explicit PCM/I2S interface on the chipset. Most chipsets default to the PCM/I2S interface. To use it via USB or for Wide-Band Speech in the Hands-Free Profile, the data needs to be delivered to the host MCU. Newer Bluetooth standards define a HCI command to configure the SCO routing, but it is not implemented in the chipsets we've tested so far. Instead, this is configured in a vendor-specific way as well.

  • In addition, most vendors allow to patch or configure their chipsets at run time by sending custom commands to the chipset. Obviously, this is also vendor dependent.

Documentation and Support

The level of developer documentation and support varies widely between the various Bluetooth chipset providers.

From our experience, only Texas Instruments and EM Microelectronics provide all relevant information directly on their website. Nordic Semiconductor does not officially have Bluetooth chipsets with HCI interface, but their the documentation on their nRF5 series is complete and very informative. TI and Nordic also provide excellent support via their respective web forum.

Broadcom, whose Bluetooth + Wifi division has been acquired by the Cypress Semiconductor Corporation, provides developer documentation only to large customers as far as we know. It's possible to join their Community forum and download the WICED SDK. The WICED SDK is targeted at Wifi + Bluetooth Combo chipsets and contains the necessary chipset patch files.

CSR, which has been acquired by Qualcomm, provides all relevant information on their Support website after signing an NDA.

Chipset Overview

Chipset Type HCI Transport BD_ADDR (1) SCO over HCI (2) LE DLE Multiple LE Roles BTstack folder Comment
Broadcom UART Dual mode H4, H5 Rarely Probably (2) No Maybe (3) bcm Max UART baudrate 2 mbps
Broadcom USB Dongles Dual mode USB Yes Yes No No bcm
CSR UART Dual mode H4, H5, BCSP Rarely No (didn't work) No No csr
CSR USB Dongles Dual mode USB Mostly Yes No No csr
Dialog DA14581 LE H4, SPI No n.a. No No da14581 Official HCI firmware included in BTstack
EM 9301 LE SPI No n.a. No No em9301 Custom HCI SPI implementation
EM 9304 LE SPI, H4 ? n.a. Yes No Waiting for dev kit
Nordic nRF LE H4 Fixed Random n.a. Yes Yes Requires custom HCI firmware
STM STLC2500D Classic H4 No No (didn't try) n.a n.a. stlc2500d Custom deep sleep management not supported
Toshiba TC35661 Dual mode H4 No No (didn't try) No No tc3566 HCI version not tested. See below
TI CC256x, WL183x Dual mode H4, H5, eHCILL Yes Yes No Yes for CC256XC cc256x Also WL185x, WL187x, and WL189x


  1. BD_ADDR: Indciates if Bluetooth chipset compes with its own valid MAC Addess. Better Broadcom and CSR dongles usually come with a MAC address from the dongle manufacturer, but cheaper ones might come with identical addresses.
  2. SCO over HCI: All Bluetooth Classic chipsets support SCO over HCI, for those that are marked with No, we either didn't try or didn't found enough information to configure it correctly.
  3. Multiple LE Roles: Apple uses Broadcom Bluetooth+Wifi in their iOS devices and newer iOS versions support multiple concurrent LE roles, so at least some Broadcom models support multiple concurrent LE roles.


Before the Broadcom Wifi+Bluetooth division was taken over by Cypress Semiconductor, it was not possible to buy Broadcom chipset in low quantities. Nevertheless, module manufacturers like Ampak created modules that contained Broadcom BCM chipsets (Bluetooth as well as Bluetooth+Wifi combos) that might already have been pre-tested for FCC and similar certifications. A popular example is the Ampak AP6212A module that contains an BCM 43438A1 and is used on the Raspberry Pi 3, the RedBear Duo, and the RedBear IoT pHAT for older Raspberry Pi models.

The best source for documentation on vendor specific commands so far has been the source code for blueZ and the Bluedroid Bluetooth stack from Android.

Broadcom USB dongles do not require special configuration, however SCO data is not routed over USB by default.

Init scripts: For UART connected chipsets, an init script has to be uploaded after power on. For Bluetooth chipsets that are used in Broadcom Wifi+Bluetooth combos, this file often can be found as a binary file in Linux distributions with the ending '.hcd' or as part of the WICED SDK as C source file that contains the init script as a data array for use without a file system.

To find the correct file, Broadcom chipsets return their model number when asked for their local name.

BTstack supports uploading of the init script in two variants: using .hcd files looked up by name in the posix-h4 port and by linking against the init script in the WICED port. While the init script is processed, the chipsets RTS line goes high, but only 2 ms after the command complete event for the last command from the init script was sent. BTstack waits for 10 ms after receiving the command complete event for the last command to avoid sending before RTS goes high and the command fails.

BD Addr can be set with a custom command. A fixed address is provided on some modules, e.g. the AP6212A, but not on others.

SCO data can be configured with a custom command found in the bluez sources. It works with USB chipsets. The chipsets don't implement the SCO Flow Control that is used by BTstack for UART connected devices. A forum suggests to send SCO packets as fast as they are received since both directions have the same constant speed.

Baud rate can be set with custom command. The baud rate resets during the warm start after uploading the init script. So, the overall scheme is this: start at default baud rate, get local version info, send custom Broadcom baud rate change command, wait for response, set local UART to high baud rate, and then send init script. After sending the last command from the init script, reset the local UART. Finally, send custom baud rate change command, wait for response, and set local UART to high baud rate.

BTstack integration: The common code for all Broadcom chipsets is provided by btstack_chipset_bcm.c. During the setup, btstack_chipset_bcm_instance function is used to get a btstack_chipset_t instance and passed to hci_init function.

SCO Data can be routed over HCI for both USB dongles and UART connections, however BTstack does not provide any form of flow control for UART connections. HSP and HFP Narrow Band Speech is supported via I2C/PCM pins.


Similar to Broadcom, the best source for documentation is the source code for blueZ.

CSR USB dongles do not require special configuration and SCO data is routed over USB by default.

CSR chipset do not require an actual init script in general, but they allow to configure the chipset via so-called PSKEYs. After setting one or more PSKEYs, a warm reset activates the new setting.

BD Addr can be set via PSKEY. A fixed address can be provided if the chipset has some kind of persistent memory to store it. Most USB Bluetooth dongles have a fixed BD ADDR.

SCO data can be configured via a set of PSKEYs. We haven't been able to route SCO data over HCI for UART connections yet.

Baud rate can be set as part of the initial configuration and gets actived by the warm reset.

BTstack integration: The common code for all Broadcom chipsets is provided by btstack_chipset_csr.c. During the setup, btstack_chipset_csr_instance function is used to get a btstack_chipset_t instance and passed to hci_init function. The baud rate is set during the general configuration.

SCO Data is routed over HCI for USB dongles, but not for UART connections. HSP and HFP Narrow Band Speech is supported via I2C/PCM pins.

Dialog Semiconductor

Dialog Semiconductor offers the DA14581, an LE-only SoC that can be programmed with an HCI firmware. The HCI firmware can be uploaded on boot into SRAM or stored in the OTP (One-time programmable) memory, or in an external SPI.

IT does not implement the Data Length Extension or supports multiple concurrent roles.

BD Addr fixed to 80:EA:CA:00:00:01. No command in HCI firmware to set it differently. Random addresses could be used instead.

Baud rate: The baud rate is fixed at 115200 with the provided firmware. A higher baud rate could be achieved by re-compiling the HCI firmware using Dialog's HCI SDK.

BTstack integration: btstack_chipset_da14581.c contains the code to download the provided HCI firmware into the SRAM of the DA14581. After that, it can be used as any other HCI chipset.

EM Microelectronic Marin

For a long time, the EM9301 has been the only Bluetooth Single-Mode LE chipset with an HCI interface. The EM9301 can be connected via SPI or UART. The UART interface does not support hardware flow control and is not recommended for use with BTstack. The SPI mode uses a proprietary but documented extension to implement flow control and signal if the EM9301 has data to send.

Update: EM has just announced a new EM9304 that also features an HCI mode and supports the Bluetooth 4.2. specification. It seems to support the Data Length Extension but not and multiple concurrent roles.

BD Addr must be set during startup since it does not have a stored fix address.

SCO data is not supported since it is LE only.

Baud rate could be set for UART mode. For SPI, the master controls the speed via the SPI Clock line.

Init scripts are not required although it is possible to upload small firmware patches.

BTstack integration: The common code for the EM9301 is provided by btstack_chipset_em9301.c. During the setup, btstack_chipset_em9301_instance function is used to get a btstack_chipset_t instance and passed to hci_init function. It enables to set the BD Addr during start.

Nordic nRF5 series

The Single-Mode LE chipsets from the Nordic nRF5 series chipsets do not have an HCI interface. Instead, they provide an LE Bluetooth Stack as a binary library, the so-called SoftDevices. Developer can write their Bluetooth application on top of this library usually. Since the chipset can be programmed, it can also be loaded with a firmware that provides a regular HCI H4 interface for a Host.

An interesting feature of the nRF5 chipsets is that they can support multiple LE roles at the same time, e.g. being Central in one connection and a Peripheral in another connection. Also, the nRF52 SoftDevice implementation supports the Bluetooth 4.2 Data Length Extension.

Both nRF5 series, the nRF51 and the nRF52, can be used with an HCI firmware. The HCI firmware does not support the Data Length Extension yet, but this will be supported soon. Also, the nRF51 does not support encrypted connections at the moment (November 18th, 2016) although this might become supported as well.

BD ADDR is not set automatically. However, during production, a 64-bit random number is stored in the each chip. Nordic uses this random number as a random static address in their SoftDevice implementation.

SCO data is not supported since it is LE only.

Baud rate is fixed to 115200 by the patch although the firmware could be extended to support a baud rate change.

Init script is not required.

BTstack integration: No special chipset driver is provided. In order to use the random static address, the provided patch stores this address as the (invalid) public address that is returned by the HCI Read BD Addr command. When BTstack detects that it is a Nordic chipset, it automatically uses this address as random static address - unless the app chooses to use private addresses.

To use these chipsets with BTstack, you need to install an arm-none-eabi gcc toolchain and the nRF5x Command Line Tools incl. the J-Link drivers, checkout the Zephyr project, apply a minimal patch to help with using a random static address, and flash it onto the chipset:

  $ patch -p1 < hci_firmware.patch
  • In samples/bluetooth/hci_uart compile the firmware for nRF52 Dev Kit
  $ make BOARD=nrf52_pca10040
  • Upload the firmware

    $ ./

  • For the nRF51 Dev Kit, use make BOARD=nrf51_pca10028 and ./ with the nRF51 kit.

  • The nRF5 dev kit acts as an LE HCI Controller with H4 interface.


STMicroelectronics offers the Bluetooth V2.1 + EDR chipset STLC2500D that supports SPI and UART H4 connection.

BD Addr can be set with custom command although all chipsets have an official address stored.

SCO data might work. We didn't try.

Baud rate can be set with custom command. The baud rate change of the chipset happens within 0.5 seconds. At least on BTstack, knowning exactly when the command was fully sent over the UART is non-trivial, so BTstack switches to the new baud rate after 100 ms to expect the command response on the new speed.

Init scripts are not required although it is possible to upload firmware patches.

BTstack integration: Support for the STLC2500C is provided by btstack_chipset_stlc.c. During the setup, btstack_chipset_stlc2500d_instance function is used to get a btstack_chipset_t instance and passed to hci_init function. It enables higher UART baud rate and to set the BD Addr during startup.

Texas Instruments CC256x series

The Texas Instruments CC256x series is currently in its fourth iteration and provides a Classic-only (CC2560), a Dual-mode (CC2564), and a Classic + ANT (CC2567) model. A variant of the Dual-mode chipset is also integrated into TI's WiLink 8 Wifi+Bluetooth combo modules of the WL183x, WL185x, WL187x, and WL189x series.

The CC256x chipset is connected via an UART connection and supports the H4, H5 (since third iteration), and eHCILL.

The latest generation CC256xC chipsets support multiple LE roles in parallel.

The different CC256x chipset can be identified by the LMP Subversion returned by the hci_read_local_version_information command. TI also uses a numeric way (AKA) to identify their chipsets. The table shows the LMP Subversion and AKA number for the main CC256x series.

Chipset LMP Subversion AKA
CC2560 0x191f 6.2.31
CC2560A, CC2564 0x1B0F 6.6.15
CC256xB 0x1B90 6.7.16
CC256xC 0x9a1a 6.12.26

SCO data is routed to the I2S/PCM interface but can be configured with the HCI_VS_Write_SCO_Configuration command.

Baud rate can be set with HCI_VS_Update_UART_HCI_Baudrate. The chipset confirms the change with a command complete event after which the local UART is set to the new speed. Oddly enough, the CC256x chipsets ignore the incoming CTS line during this particular command complete response. See next paragraph for a workaround.

BD Addr can be set with HCI_VS_Write_BD_Addr although all chipsets have an official address stored.

Init Scripts. In order to use the CC256x chipset an initialization script must be obtained and converted into a C file for use with BTstack. For newer revisions, TI provides a main.bts and a ble_add_on.bts that need to be combined.

The Makefile at chipset/cc256x/ is able to automatically download and convert the requested file. It does this by:

  • Downloading one or more BTS files for your chipset.
  • Running the Python script:
./ main.bts [ble_add_on.bts] output_file.c

BTstack integration: The common code for all CC256x chipsets is provided by btstack_chipset_cc256x.c. During the setup, btstack_chipset_cc256x_instance function is used to get a btstack_chipset_t instance and passed to hci_init function. btstack_chipset_cc256x_lmp_subversion provides the LMP Subversion for the selected init script.

SCO Data can be routed over HCI, so HFP Wide-Band Speech is supported.

Work around for CTS bug while HCI Command Complete Event of HCI VS Update Baudrate with H4/eHCILL

If you're using a RTOS port (e.g. FreeRTOS) and have implemented the hal_uart_dma.h API directly, chances are, you're getting a UART overrun errors in this situation, and the bootup will get stuck at this point.

BTstack currently cannot deal with this situation since it would need to request a read for the complete HCI Command Complete before sending the HCI VS Baudrate Command.

We recommend to add the following workaround in the hal_uart_dma.h implementation to deal with this bug in the lowest layer.

The idea is to detect the HCI VS Baudrate Command and then to ignore all received data for 100 ms. After that, send the appropriate HCI Command Complete Event to the HCI transport.

Let's assume that your hal_uart_dma.h implementation contains hal_uart_dma_rx_complete() and hal_uart_dma_tx_complete that are called when the corresponding asynchronous request has been completed, and that you've stored the registered callbacks in rx_done_handler and tx_done_handler. Please provide new functions hal_uart_dma_sleep_ms that just blocks (you might have needed a similar to implement the CC256x power cycle before) and hci_uart_dma_rx_flush that clear all errors and flushes all incoming buffers (might not be needed on most platforms).

// types & declaration
static enum {
} cc256x_hack_state;


void hal_uart_dma_send_block(const uint8_t *buffer, uint16_t length){
    // detect CC256x set baudrate command
    const uint8_t baud_rate_command_prefix[] = { 0x01, 0x36, 0xff, 0x04};
    if (memcmp(data, baud_rate_command_prefix, sizeof(baud_rate_command_prefix)) == 0) {
        log_info("CC256x baud rate command detected");
        cc256x_hack_state = CC256X_HACK_W4_SENT;

    // your code to trigger buffer send follow

void hal_uart_dma_receive_block(uint8_t *buffer, uint16_t len){
    switch (cc256x_hack_state){
        case CC256X_HACK_W4_READ_HEADER:
            cc256x_hack_state = CC256X_HACK_W4_READ_PAYLOAD;
            // HCI Command Complete
            *buffer++ = 0x0e;
            *buffer++ = 0x04;
        case CC256X_HACK_W4_READ_PAYLOAD:
            cc256x_hack_state = CC256X_HACK_IDLE;
            // commands 0, opcode 0xff36, status 0
            *buffer++ = 0x01;
            *buffer++ = 0x36;
            *buffer++ = 0xff;
            *buffer++ = 0x00;

    // your code to trigger buffer read follows

  static void hal_uart_dma_rx_complete(void){
      switch (cc256x_hack_state){
          case CC256X_HACK_W4_SENT:
              // ignore until sent & event received;

      // your code to call complete handler, probably looks like

  static void tx_done_handler(void){
      // your code to call complete handler, probably looks like

          // cc256x hack
          switch (cc256x_hack_state){
              case CC256X_HACK_W4_SENT:
                  log_info("cc256x hack: sleep");
                  log_info("cc256x hack: flush");
                  log_info("cc256x hack: simulate command complete");
                  *read_bytes_data++ = 0x04;
                  cc256x_hack_state = CC256X_HACK_W4_READ_HEADER;


The Toshiba TC35661 Dual-Mode chipset is available in three variants: standalone incl. binary Bluetooth stack, as a module with embedded stack or with a regular HCI interface. The HCI variant has the model number TC35661–007.

We've tried their USB Evaluation Stick that contains an USB-to-UART adapter and the PAN1026 module that contains the TC35661 -501. We have been told by our distributor that the -501 variant also supports the HCI interface. However, while our tests have shown that Classic Bluetooth with SPP works fine with this variant, none of the LE commands work.

SCO data might work. We didn't try.

Baud rate can be set with custom command.

BD Addr must be set with custom command. It does not have a stored valid public BD Addr.

Init Script is not required. A patch file might be uploaded.

BTstack integration: Support for the TC35661 series is provided by btstack_chipset_tc3566x.c. During the setup, btstack_chipset_tc3566x_instance function is used to get a btstack_chipset_t instance and passed to hci_init function. It enables higher UART baud rate and sets the BD Addr during startup.