You could go though further serial devices and see whether one of these works:
hciattach /dev/ttyS3 any 115200
The vendor images use a brcm_patchram_plus binary blob which seems to be similar to hciattach. I hope this is not required on mainline kernel:
#!/bin/bash
### BEGIN INIT INFO
# Provides: brcm_patchram_plus
# Required-Start: $remote_fs $syslog
# Required-Stop: $remote_fs $syslog
# Default-Start: 2 3 4 5
# Default-Stop:
# Short-Description: brcm_patchram_plus
### END INIT INFO
function reset_bt()
{
BTWAKE=/proc/bluetooth/sleep/btwake
if [ -f ${BTWAKE} ]; then
echo 0 > ${BTWAKE}
fi
index=`rfkill list | grep $1 | cut -f 1 -d":"`
if [[ -n ${index}} ]]; then
rfkill block ${index}
sleep 1
rfkill unblock ${index}
sleep 1
fi
}
rm -rf /var/log/brcm
brcm_try_log=/var/log/brcm/brcm_try.log
brcm_log=/var/log/brcm/brcm.log
brcm_err_log=/var/log/brcm/brcm_err.log
[ -d /var/log/brcm ] || mkdir -p /var/log/brcm
board=`cat /sys/class/sunxi_info/sys_info | grep board_name`
board=${board#*FriendlyElec }
[ -z ${board} ] && board=`cat /etc/hostname`
case ${board} in
NanoPi-Duo2 )
uart_dev=ttyS2
chip=ap6212
;;
NanoPi-H6-with-AP6255 )
uart_dev=ttyS1
chip=ap6255
;;
NanoPi-NEO-Air|NanoPi-M1-Plus|NanoPi-NEO-Plus2|NanoPi-NEO-Plus2-H3|NanoPi-R1 )
chip=ap6212
uart_dev=ttyS3
;;
* )
echo "This board may not have BT module." >${brcm_try_log}
exit 0
;;
esac
case "$1" in
start|"")
index=`rfkill list | grep "sunxi-bt" | cut -f 1 -d":"`
if [ -d /sys/class/rfkill/rfkill${index} ]; then
reset_bt "sunxi-bt"
chmod 0660 /sys/class/rfkill/rfkill${index}/state
chmod 0660 /sys/class/rfkill/rfkill${index}/type
chgrp dialout /sys/class/rfkill/rfkill${index}/state
chgrp dialout /sys/class/rfkill/rfkill${index}/type
# generate MAC address
if [ -f /sys/bus/nvmem/devices/sunxi-sid0/nvmem ]; then
MACADDRESS=`md5sum /sys/bus/nvmem/devices/sunxi-sid0/nvmem | cut -b 1-12 | sed -r ':1;s/(.*[^:])([^:]{2})/\1:\2/;t1'`
else
MACADDRESS=`md5sum /sys/class/sunxi_info/sys_info | cut -b 1-12 | sed -r ':1;s/(.*[^:])([^:]{2})/\1:\2/;t1'` # for all sunxi kernel of FriendlyElec
fi
echo ${MACADDRESS} >/tmp/bt_macaddress
# download firmware
let TIMEOUT=90
while [ ${TIMEOUT} -gt 0 ]; do
killall -9 /bin/brcm_patchram_plus
/bin/brcm_patchram_plus -d --patchram /lib/firmware/${chip}/ --enable_hci --bd_addr ${MACADDRESS} --no2bytes --tosleep 5000 /dev/${uart_dev} >${brcm_log} 2>&1 &
sleep 30
cur_time=`date "+%H-%M-%S"`
if grep "Done setting line discpline" ${brcm_log}; then
echo "${cur_time}: bt firmware download ok($((TIMEOUT/30)))" >> ${brcm_try_log}
if ! grep "fail" ${brcm_try_log}; then
reset_bt "hci0"
hciconfig hci0 up
hciconfig >> ${brcm_try_log}
#reboot
fi
break
else
echo "${cur_time}: bt firmware download fail($((TIMEOUT/30)))" >> ${brcm_try_log}
cp ${brcm_log} ${brcm_err_log}
reset_bt "sunxi-bt"
fi
TIMEOUT=$((TIMEOUT-30))
done
fi
;;
stop)
kill `ps --no-headers -C brcm_patchram_plus -o pid`
;;
*)
echo "Usage: brcm_patchram_plus start|stop" >&2
exit 3
;;
esac
There ttyS3 is used for Allwinner H3 SBCs, but it is not necessarily the same on our mainline kernel. It reveals ap6212 as chip, but it is not a type/ID directly supported by hciattach, hence we can only use any: hciattach(1) — bluez — Debian bookworm — Debian Manpages