Identity
| Part | Broadcom BCM4345C5 (BT die in the AzureWave AP6255 module; Murata Type-1MW build with 37.4 MHz crystal) |
| Role | Bluetooth 5.0 BR/EDR + LE controller |
| Bus / address | HCI over UART2 (/dev/cuau0) at 1500000 baud (boot) / negotiated up to 3000000; hardware flow control |
| GPIO / IRQ | BT_HOST_WAKE = GPIO0_PA4 (4), BT_DEV_WAKE = GPIO2_PD2 (26), BT_REG_ON = GPIO0_PB1 |
| Datasheet | Broadcom BCM4345 (NDA; reference is the Linux hci_bcm driver) |
| Pine64 wiki | PinePhone Pro — Connectivity |
| Schematic | sheet 4 (AP6255 module) |
Status — ● working
Firmware loads, the chip enumerates, SSP with Just Works completes,
AES-CCM is active (Encryption_Change enabled = 0x02), and A2DP
plays end-to-end to a Bluetooth speaker. The crystal is 37.4 MHz on
the Murata 1MW build — the SC-disabled Raspberry Pi BCM4345C0.hcd
will load but rejects Write_Secure_Connections_Host_Support; the
Murata patchram is what we ship.
Driver
- Our tree:
src/sys/netgraph/bluetooth/drivers/h4frame/ng_h4frame.c— from-scratch netgraph H4 framing node bridgingng_ttytong_hci; UART RX-FIFO trigger lowered to one byte for snps UARTs with abrcm,bcm43xxchild. - Userland loader:
overlay/usr/local/sbin/bcm_firmware_load.pl— credit-respecting.hcdpatchram uploader; baud renegotiation; post-load sanity HCI_Reset. - Netgraph patches:
patches/sys/netgraph/bluetooth/—hci,l2cap, andincludefixes that let A2DP traffic flow. - Linux mainline:
drivers/bluetooth/hci_bcm.c— canonical Broadcom HCI-over-UART implementation; reference for VSCs, baud sequencing, and patchram framing.
ng_h4frame is a netgraph node with two hooks (lower for raw bytes
from ng_tty, upper for HCI frames to ng_hci) and a 3-state
machine (H4S_TYPE → H4S_HDR → H4S_PAYLOAD). A sysctl-controlled
“tickler” pokes the chip with a 0x00 byte mid-event to flush partial
events when HOST_WAKE isn’t doing its job. With HOST_WAKE wired as a
real interrupt the tickler is empirically redundant but stays on by
default.
Open work
- Verify it is safe to disable the tickler now that HOST_WAKE is real.
- Replace the sleep-and-grep orchestration around the patchram loader with a proper service.
- Bring up SCO so cellular voice calls can route through a paired headset (depends on the modem voice path landing first).
Related
- Bluetooth attached: BCM4345C5 firmware load —
ng_h4frame, the patchram dance, and the 1-byte UART trigger. - The HOST_WAKE IRQ saga — making BT_HOST_WAKE behave as an IRQ.
- SSP, Secure Connections, and the Murata firmware swap — the patchram blob choice.
- A2DP audio playing — full audio path to a Bluetooth speaker.
- Hardware reference — chip manifest.