From: bugzilla-daemon@kernel.org
To: linux-bluetooth@vger.kernel.org
Subject: [Bug 220990] New: hci_uart_bcm: BCM43341 on Intel Atom (serdev) fails init (MTU 0:0, DOWN RAW)
Date: Sun, 18 Jan 2026 10:11:42 +0000 [thread overview]
Message-ID: <bug-220990-62941@https.bugzilla.kernel.org/> (raw)
https://bugzilla.kernel.org/show_bug.cgi?id=220990
Bug ID: 220990
Summary: hci_uart_bcm: BCM43341 on Intel Atom (serdev) fails
init (MTU 0:0, DOWN RAW)
Product: Drivers
Version: 2.5
Hardware: Intel
OS: Linux
Status: NEW
Severity: normal
Priority: P3
Component: Bluetooth
Assignee: linux-bluetooth@vger.kernel.org
Reporter: bugzilla@emircanerkul.com
Regression: No
Created attachment 309211
--> https://bugzilla.kernel.org/attachment.cgi?id=309211&action=edit
fix for llm models
I applied solution in https://bugzilla.kernel.org/show_bug.cgi?id=100461
But now it do not detect my devices.
❯ bluetoothctl
hci0 new_settings: powered bondable ssp br/edr le secure-conn
Agent registered
[CHG] Controller CD:74:2E:6E:CD:FA Pairable: yes
[bluetoothctl]> power on
Changing power on succeeded
[bluetoothctl]> discover on
Invalid command in menu main: discover
Use "help" for a list of available commands in a menu.
Use "menu <submenu>" if you want to enter any submenu.
Use "back" if you want to return to menu main.
[bluetoothctl]> he
[bluetoothctl]> scan on
SetDiscoveryFilter success
hci0 type 7 discovering on
Discovery started
[CHG] Controller CD:74:2E:6E:CD:FA Discovering: yes
hci0 type 7 discovering off
hci0 type 7 discovering on
hci0 type 7 discovering off
hci0 type 7 discovering on
hci0 type 7 discovering off
--- ISSUE SOVED WITH 100461 ---
1. Hardware Description
Device: Intel StickPC (Atom x5-Z8300 "Cherry Trail" / "Bay Trail" platform)
Bluetooth/WiFi Chip: Broadcom BCM43341B0 (Combo Chip)
ACPI ID: BCM2E95
Interface: Intel HS-UART connected via serdev (serial0-0)
Connection: UART (not USB)
2. System Information
OS: Debian 13 (Trixie)
Kernel: 6.12.63+deb13-amd64 (Upstream 6.12 series)
BlueZ Version: 5.82
Firmware: BCM43341B0.hcd (Size: 41,333 bytes).
Verified identical to working Windows 10 driver firmware.
3. Issue Description
The Bluetooth controller is detected, and the hci_uart_bcm driver successfully
loads the specific firmware patch (build 0176). However, immediately after
firmware loading, the device remains in a DOWN RAW state with MTU 0:0.
Attempting to bring the device up fails with "Operation not supported". The
device never registers with the BlueZ management layer (btmgmt info is empty).
It appears the HCI_QUIRK_RAW_DEVICE flag (set by hci_serdev.c during setup) is
never cleared, or the bcm_setup function completes but the driver fails to
transition the device to a fully operational state.
4. Steps to Reproduce
Boot minimal Debian 13 with Kernel 6.12 on Intel Atom Z8300 device with
BCM43341.
Ensure correct firmware BCM43341B0.hcd is in /lib/firmware/brcm/.
Check hciconfig -a.
5. Logs & Output
hciconfig -a
hci0: Type: Primary Bus: UART
BD Address: 43:34:1B:00:1F:AC ACL MTU: 0:0 SCO MTU: 0:0
DOWN RAW
RX bytes:2220 acl:0 sco:0 events:238 errors:0
TX bytes:41654 acl:0 sco:0 commands:238 errors:0
Features: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
Packet type: DM1 DH1 HV1
Link policy:
Link mode: PERIPHERAL ACCEPT
(Note: Address is the default Broadcom address, indicating configuration didn't
finish)
dmesg (Filtered)
[ 10.438792] hci_uart_bcm serial0-0: supply vbat not found, using dummy
regulator
[ 10.438896] hci_uart_bcm serial0-0: supply vddio not found, using dummy
regulator
...
[ 10.888224] Bluetooth: hci0: BCM: chip id 82
[ 10.902831] Bluetooth: hci0: BCM43341B0
[ 10.902851] Bluetooth: hci0: BCM43341B0 (002.001.014) build 0000
[ 10.929324] Bluetooth: hci0: BCM43341B0 'brcm/BCM43341B0.hcd' Patch
...
[ 11.551231] Bluetooth: hci0: BCM43341B0 37.4 MHz Class 1 WLBGA iTR
[ 11.551245] Bluetooth: hci0: BCM43341B0 (002.001.014) build 0176
[ 11.552167] Bluetooth: hci0: BCM: Using default device address
(43:34:1b:00:1f:ac)
(Note: Firmware loads successfully - build number changes from 0000 to 0176.
But then it stops.)
btmgmt info
Index list with 0 items
Attempting to bring up
# hciconfig hci0 up
Can't init device hci0: Operation not supported (95)
6. What Was Tried (Workarounds)
Windows Firmware: Replaced Linux firmware with verified working Windows 10
driver (BCM43341B0_002.001.014.0122.0176.hcd). Result: Identical behavior.
Firmware load OK, Init fail.
Kernel Parameters: Added intel_idle.max_cstate=1 to prevent BayTrail deep sleep
issues. Result: No change.
btattach: Attempted manual btattach but failed because serdev framework claims
the UART (serial0-0) and does not expose a /dev/ttyS* node to userspace even
after unbinding the driver.
7. Suspected Root Cause
Regression in drivers/bluetooth/hci_bcm.c or hci_serdev.c on Kernel 6.12
regarding the handling of HCI_QUIRK_RAW_DEVICE for ACPI-enumerated BCM devices.
The setup phase (firmware load) works, but the transition to operational mode
is missing.
--
You may reply to this email to add a comment.
You are receiving this mail because:
You are the assignee for the bug.
next reply other threads:[~2026-01-18 10:11 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-18 10:11 bugzilla-daemon [this message]
2026-01-19 14:36 ` [Bug 220990] hci_uart_bcm: BCM43341 on Intel Atom (serdev) fails init (MTU 0:0, DOWN RAW) bugzilla-daemon
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bug-220990-62941@https.bugzilla.kernel.org/ \
--to=bugzilla-daemon@kernel.org \
--cc=linux-bluetooth@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.