AnsweredAssumed Answered

Bcm43438 bluetooth don't work on linux

Question asked by Cheng si on May 17, 2018
Latest reply on May 17, 2018 by igorpadykov

Hi everyone, I am trying to use bcm43438 on linux, and the wifi is working well. But when i use Bluez on linux to test the bluetooth, it doesn't work.

Firstly i use command 'hciattach /dev/ttymxc2 bcm43xx 3000000 flow -t 10' to init the device, but it will get time out, then I digged into the process, and I found the command will call function bcm43xx_init:


int bcm43xx_init(int fd, int def_speed, int speed, struct termios *ti,

const char *bdaddr)


char chip_name[20];

char fw_path[PATH_MAX];






if (bcm43xx_reset(fd))

return -1;


printf("reset successfully\n");                                        //whether program can get here


if (bcm43xx_read_local_name(fd, chip_name, sizeof(chip_name)))

return -1;

printf("read local name successfully\n");                        //whether program can get here


if (bcm43xx_locate_patch(FIRMWARE_DIR, chip_name, fw_path)) {

fprintf(stderr, "Patch not found, continue anyway\n");

} else {

if (bcm43xx_set_speed(fd, ti, speed))

return -1;



if (bcm43xx_load_firmware(fd, fw_path))

return -1;



I add two 'printf' to indicate where is wrong, and the result shows it can reset successfully then get time out. So it gets time out in bcm43xx_read_local_name, the code is like this:


static int bcm43xx_read_local_name(int fd, char *name, size_t size)


unsigned char cmd[] = { HCI_COMMAND_PKT, 0x14, 0x0C, 0x00 };

unsigned char *resp;

unsigned int name_len;



resp = malloc(size + CC_MIN_SIZE);

if (!resp)

return -1;



tcflush(fd, TCIOFLUSH);



if (write(fd, cmd, sizeof(cmd)) != sizeof(cmd)) {

fprintf(stderr, "Failed to write read local name command\n");

goto fail;



// it is stucked here

if (read_hci_event(fd, resp, size) < CC_MIN_SIZE) {

fprintf(stderr, "Failed to read local name, invalid HCI event\n");

goto fail;




if (resp[4] != cmd[1] || resp[5] != cmd[2] || resp[6] != CMD_SUCCESS) {

fprintf(stderr, "Failed to read local name, command failure\n");

goto fail;



After I tried many times, I found it is stucked in read_hci_event function, the host can not get response from device. But it can get response in bcm43xx_reset(), so i think it is the problem of hci command, then i changed the hci command many times, it turned out the device only response to the reset hci command. I don't know why is it so.

The Bluez version is 5.37 and the linux kernel is 4.1.38.

Please give me some advice, thanks very much.