=======================================================
Bluetooth / FM controller firmware (WCN3990 "Cherokee")
=======================================================

``bluetooth_a`` is **not** an MBN/ELF firmware image like the coprocessor
partitions — it is a **FAT filesystem** holding the patch and NVM (non-volatile
config) files for the on-package **Bluetooth + FM controller**. Unlike the PIL
images (TZ, HYP, ADSP, …) which XBL loads and authenticates at boot, these files
are pushed into the controller **by the kernel's Bluetooth driver** after the OS
is up — but the firmware itself is below the Android userspace, so it is in scope
here.

The device tree names the part exactly (``artifacts/boot_a/board.dts``)::

   bt_wcn3990 { compatible = "qca,wcn3990"; };
   wcn3990   { compatible = "qcom,btfmslim_slave";
               qcom,btfm-slim-ifd = "btfmslim_slave_ifd";
               qcom,btfm-slim-ifd-elemental-addr = [00 00 20 02 17 02]; };

so the connectivity part is the **Qualcomm QCA WCN3990** — an integrated
WLAN + Bluetooth + FM combo. Its **WLAN** side is the *Helium* firmware
(``WLAN.HL.3.3.1-01884`` in ``core_nhlos_a``, loaded via ``qcom,icnss`` into
``wlan_fw_region@0x8b500000`` — MSA phandle ``0xb9`` in :doc:`/boot/base-dtb`);
its **Bluetooth/FM** side is the *Cherokee* firmware in this partition. The two
are the two subsystems of the same WCN3990 die. (NFC is a separate device;
cellular MPSS is dormant, :doc:`/audio/dsp-firmware`.)

Container
=========

FAT (``MSDOS5.0`` BPB, volume label "NO NAME"), partition size 1 MiB. The BPB
uses **4096-byte sectors** (matching the UFS logical block size,
:doc:`/partition-map`), 4 sectors/cluster, 2 FATs. Files use VFAT long
names; the payload is the standard QCA Cherokee set — ``crbtfwNN.tlv`` (BT patch,
TLV-framed) paired with ``crnvNN.bin`` (BT NVM/calibration defaults), one pair per
controller ROM revision:

.. list-table:: Firmware files (by size / type)
   :header-rows: 1
   :widths: 22 16 62

   * - Type
     - Size(s)
     - Role
   * - ``*.tlv`` (BT patch)
     - 230,260 (×2), 125,120, 56,180, 56,052, 29,368
     - ``crbtfwNN.tlv`` — TLV-framed controller patch RAM images, one per ROM rev
   * - ``*.bin`` (BT NVM)
     - 5,516 (×2), 4,875, 4,710, 3,936, 2,798, 1,243
     - ``crnvNN.bin`` — NVM / calibration and BD-address defaults per ROM rev

Version inventory
=================

Embedded ``QC_IMAGE``-style tags identify the Cherokee firmware revisions carried
— selected at runtime by the driver based on the reported ``rom_version``/
``build_version`` (see `Load mechanism`_ below); that these five tags
correspond to distinct silicon-stepping variants, specifically, is inferred
from the naming/count, not confirmed from any Qualcomm document:

- ``BTFM.CHE.1.1.0-00027-QCACHROM-1``
- ``BTFM.CHE.2.0.0-00082-QCACHROMZ-1``
- ``BTFM.CHE.2.1.5-00291-QCACHROMZ-1``
- ``BTFM.CHE.3.2.1-00273-QCACHROMZ-2``
- ``CI_BTFM.CHE.2.0.0-00076.1-QCACHROM-16`` (a CI build)

``BTFM.CHE`` = **B**\ luetooth + **FM**, **CHE**\ rokee (the WCN3990 BT/FM core);
``QCACHROMZ`` is the build variant. Multiple revisions (1.1 → 3.2) are shipped
together, consistent with covering more than one WCN3990 stepping variant —
the same inference as above, not confirmed from any Qualcomm document.

Load mechanism
==============

The controller reports its own ROM identity, logged with the legacy
patch-download format string retained from the earlier "Rome" combo::

   Rome Patch... rom_version(0x%04x), build_version(0x%04x)

The host driver reads ``rom_version`` / ``build_version`` from the WCN3990 BT
core, selects the matching ``crbtfwNN.tlv`` + ``crnvNN.bin``, and downloads the
TLV patch and NVM over the BT transport before the controller is brought up.
(The "Rome Patch" wording is the historical name for this TLV patch mechanism; the
silicon here is Cherokee/WCN3990, per the device tree, not Rome.)

Controller features (from firmware strings)
===========================================

- **Coexistence** with the on-die WLAN and with LTE: ``MCI_LOG BT WAIT CAL TO``,
  ``MCI_LOG WLAN GRANT BT CAL`` (MCI = the WLAN↔BT message/coexistence
  interface), plus ``_COEX_MWS_``, ``LTE STATE_IND`` / ``E_IND`` and
  ``SEND BT CAL`` / ``BT CAL DONE`` — the MWS (Mobile Wireless Standards) coex and
  BT calibration hand-shakes.
- **BLE Audio-over-LE (AoLE)**: ``AOLE: Voice``, ``AOLE: SM``, ``B_LE_AoL``,
  ``SDB_LE_Ao`` — LE audio / voice streaming state machine.
- **BLE multi-advertising** (``MultiAdvInf``) and **temperature calibration**
  (``TempCal`` / ``Write_TempCal``) — RF drift compensation.
- **FM radio** shares the die; BT/FM **audio** is routed over **SLIMbus**
  (``btfmslim_slave``, elemental address ``00 00 20 02 17 02`` above) to the audio
  codec, distinct from the HCI control transport.

Relationship to the rest of the platform
========================================

This partition is one of the connectivity firmwares; the picture across the WCN3990
combo is:

.. list-table::
   :header-rows: 1
   :widths: 20 34 46

   * - Subsystem
     - Firmware
     - Loaded by / into
   * - WLAN
     - Helium ``WLAN.HL.3.3.1-01884`` (``core_nhlos_a``)
     - ``qcom,icnss`` → ``wlan_fw_region@0x8b500000`` (:doc:`/boot/base-dtb`)
   * - Bluetooth / FM
     - Cherokee ``BTFM.CHE.*`` (**this partition**)
     - host BT driver → WCN3990 BT core; audio via SLIMbus

Unlike the boot-critical PIL images, ``bluetooth_a`` is not part of the
authenticated boot chain — it is plain FAT content read at runtime — so a
bootloader replacement neither loads it nor is constrained by it. It is documented
here to complete the connectivity firmware census alongside the WLAN image.

Provenance
==========

:Source: ``_READONLY/lun4/bluetooth_a.bin`` (read-only); part identity from
   ``artifacts/boot_a/board.dts`` (``qca,wcn3990`` / ``btfmslim_slave`` nodes).
:Method: BPB/FAT header read; VFAT long-name and 8.3 directory-entry enumeration
   (file names/sizes); ``strings`` census for the ``BTFM.CHE`` version tags, the
   patch-download log format, and the coex / AoLE / TempCal feature tokens. No
   code executed; no files extracted.
:Cross-refs: :doc:`/audio/dsp-firmware` (WLAN Helium firmware, MPSS),
   :doc:`/boot/base-dtb` (ICNSS WLAN MSA region, connectivity DT nodes),
   :doc:`/partition-map` (FAT partition, UFS block size),
   :doc:`/trustzone/secure-world` (contrast: PIL-authenticated coprocessors).