The problem I face is that there is no easy way to access the Bluetooth HCI API as should be found in the Bluez libbluetooth. IE such APIs as hci_get_route(), hci_open_dev(), hci_send_req(), etc.
I CAN do the above from my app on phones that have the "hcitool" binary (such as CM). I can also access the APIs directly from a daemon that my app communicates with.
But my app can't use the HCI apis directly.
But the much BIGGER problem is that most devices with TI or Broadcom BT chips have stock ROMs that do not contain hcitool, and that can't use a copied hcitool, and that don't support the HCI apis anyway.
AFAICT these devices use proprietary BT stacks. Instead of hciattach, Broadcom BT devices use btld and TI devices use btipsd.
Perhaps those proprietary daemons allow direct HCI access through their APIs. I don't know, but even if they do, I don't like using such undocumented APIs. They may be different and broken in different ways on different devices.
One thought I have is some sort of shim/adapter that goes between the daemon and the HCI UART and can inject packets using whatever SLIP or PPP or whatever the protocol is. Yes this is nasty and requires root.
Does anyone know if D-BUS support raw HCI access ?
Any other ideas ?