[TUTORIAL] install Broadcom bluetooth on Lenovo ThinkPad X1 Carbon 1 gen

[0ri0n]

Hello,

This tuto maybe work for other Brodcom devices or another computer.

My spec :

$ uname
Linux XXX 4.9.0-kali4-amd64 #1 SMP Debian 4.9.30-2kali1 (2017-06-22) x86_64 GNU/Linux
$ lsusb | grep -i bluetooth
Bus 003 Device 016: ID 0a5c:21e6 Broadcom Corp. BCM20702 Bluetooth 4.0 [ThinkPad]

Note your USB device id, my is 0a5c:21e6

Bluetooth don't work out of the box on Kali because Kernel need a proprietary firmware. You can check that :

$ dmesg | grep bluetooth
...
[28483.641471] bluetooth hci0: firmware: failed to load brcm/BCM20702A1-0a5c-21e6.hcd (-2)
[28483.641478] bluetooth hci0: Direct firmware load for brcm/BCM20702A1-0a5c-21e6.hcd failed with error -2
[28483.641481] Bluetooth: hci0: BCM: Patch brcm/BCM20702A1-0a5c-21e6.hcd not found
...

Note the file name of missing firmware, mine : BCM20702A1-0a5c-21e6.hcd

So we need a firmware. Go to Lenovo website support to download the bluetooth driver for Windows 7. If you don't know your model of Thinkpad, type :

# dmidecode -t system | grep -i "serial number"

and copy past in the search box.
Go to bluetooth section, and download the .exe for windows 7 x86/x64.

You must extract the .exe, so you need innoextract tool :

# aptitude install innoextract

extract the .exe :

$ innoextract g4wb12ww.exe 
Extracting "version 6.5.1.4500 (G4WB12WW)" - setup data version 5.2.3
 - "app/Autorun.inf" (52 B)
 - "app/btw.ico" (45.2 KiB)
 - "app/license.dat" (176 B)
 - "app/Setup.exe" (8.51 MiB)
 - "app/Custom/CustomAr.ctm" (25.1 KiB)
 - "app/Custom/CustomBG.ctm" (28.8 KiB)
 - "app/Custom/CustomBr.ctm" (24.8 KiB)
...

it create a app/ folder.
open the inf file with your favorite reader : app/Win64/bcbtums-win7x64-brcm.inf
search in the file a part look like :

%BtUSB.DeviceDesc%=RAMUSB3384,              USB\VID_13D3&PID_3384       ; 20702A1 Azurewave
%BRCM20702Thinkpad.DeviceDesc%=RAMUSB21E6,  USB\VID_0A5C&PID_21E6       ; 20702 non-UHE Lenovo Japan
%BRCM20702A1.DeviceDesc%=RAMUSB21F3,        USB\VID_0A5C&PID_21F3       ; Lenovo Edge 43228 + 20702A1 combo
%BRCM20702A1.DeviceDesc%=RAMUSB21F4,        USB\VID_0A5C&PID_21F4       ; Lenovo Edge 4313 + 20702A1 combo 
%BRCM20702Generic.DeviceDesc%=RAMUSBE052,   USB\VID_0489&PID_E052       ; 20702 non-UHE Generic
%HP20702BtAdapter.DeviceDesc%=RAMUSB21F1,   USB\VID_0A5C&PID_21F1       ; 20702A1 Bumblebee 43228 combo

Check you usb device id, mine is 0a5c 21e6, note the device description, mine is RAMUSB21E6.

Search in the inf file your device description :
...

;;;;;;;;;;;;;RAMUSB21E6;;;;;;;;;;;;;;;;;

[RAMUSB21E6.CopyList]
bcbtums.sys
BCM20702A1_001.002.014.0449.0462.hex

[RAMUSB21E6.NTamd64]
Include=bth.inf
Needs=BthUsb.NT
...

Note the .hex file, mine : BCM20702A1_001.002.014.0449.0462.hex, this is the firmware. We need hex2hcd tool to convert the .hex file to .hcd a readable firmware format for Linux kernel :

$ git clone git://github.com/jessesung/hex2hcd.git
$ cd hex2hcd
$ make

copy your firmware into hex2hcd folder and convert, remember the missing filename in dmesg :

$ cp ~/Downloads/app/Win64/BCM20702A1_001.002.014.0449.0462.hex .
$ ./hex2hcd BCM20702A1_001.002.014.0449.0462.hex BCM20702A1-0a5c-21e6.hcd

copy your firmware :

# cp BCM20702A1-0a5c-21e6.hcd /lib/firmware/brcm/

reload bluetooth module :

# rmmod btusb
# modprobe btusb

check if it work in dmesg command :

# dmesg
...
29648.108611] usbcore: deregistering interface driver btusb
[29660.495191] usbcore: registered new interface driver btusb
[29660.508873] Bluetooth: hci0: BCM: chip id 63
[29660.525808] Bluetooth: hci0: Broadcom Bluetooth Device
[29660.526899] Bluetooth: hci0: BCM20702A1 (001.002.014) build 1757
[29660.526977] bluetooth hci0: firmware: direct-loading firmware brcm/BCM20702A1-0a5c-21e6.hcd
[29663.445225] Bluetooth: hci0 command 0x0c03 tx timeout
[29664.962245] usb 3-1.4: USB disconnect, device number 15
[29671.380925] Bluetooth: hci0: BCM: Reset failed (-110)
[29671.612947] usb 3-1.4: new full-speed USB device number 16 using ehci-pci
[29671.725675] usb 3-1.4: New USB device found, idVendor=0a5c, idProduct=21e6
[29671.725681] usb 3-1.4: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[29671.725684] usb 3-1.4: Product: BCM20702A0
[29671.725687] usb 3-1.4: Manufacturer: Broadcom Corp
[29671.725690] usb 3-1.4: SerialNumber: F82FA8E53D85
[29671.731463] Bluetooth: hci0: BCM: chip id 63
[29671.748319] Bluetooth: hci0: BCM20702A
[29671.749309] Bluetooth: hci0: BCM20702A1 (001.002.014) build 0000
[29671.749351] bluetooth hci0: firmware: direct-loading firmware brcm/BCM20702A1-0a5c-21e6.hcd
[29672.442475] Bluetooth: hci0: BCM20702A1 (001.002.014) build 0462
[29672.459323] Bluetooth: hci0: Broadcom Bluetooth Device
[29732.135876] Bluetooth: HIDP (Human Interface Emulation) ver 1.2
[29732.135881] Bluetooth: HIDP socket layer initialized
...

Some failed, but it work's.

EDIT:
by default on Kali Bluetooth service is disable, to start :

# systemctl start bluetooth.service

to start automatically on boot :

# systemctl enable bluetooth.service