[Bug 221878] New: MT7902 Bluetooth USB 0e8d:1ede firmware crashes during use; reset fails and controller becomes unresponsive

[Bug 221878] New: MT7902 Bluetooth USB 0e8d:1ede firmware crashes during use; reset fails and controller becomes unresponsive

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221878

            Bug ID: 221878
           Summary: MT7902 Bluetooth USB 0e8d:1ede firmware crashes during
                    use; reset fails and controller becomes unresponsive
           Product: Drivers
           Version: 2.5
          Hardware: Intel
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P3
         Component: Bluetooth
          Assignee: linux-bluetooth@vger.kernel.org
          Reporter: maksheev777@mail.ru
        Regression: No

Created attachment 310636
  --> https://bugzilla.kernel.org/attachment.cgi?id=310636&action=edit
Complete MT7902 reproduction report and logs

## Summary

The MediaTek MT7902 Bluetooth adapter (`0e8d:1ede`) initializes and works, but
its firmware crashes during normal use. The subsequent subsystem reset fails,
`hci0` disappears, and USB descriptor requests time out. Recovery requires a
full laptop EC/power reset.

## Hardware

* Laptop: HP Laptop 15-fd0xxx
* BIOS: AMI F.14, 2024-12-05
* Wi-Fi PCI ID: `14c3:7902` (MediaTek MT7902 / Filogic 310)
* Bluetooth USB ID: `0e8d:1ede`
* Bluetooth drivers: `btusb`, `btmtk`

## Software

* Distribution: Arch Linux
* Kernel: `7.1.8-arch1-3`
* BlueZ: `5.87-2`
* linux-firmware: `20260810-1`
* linux-firmware-mediatek: `20260810-1`

The same failure was previously reproduced on Linux 7.1.6 and with
linux-firmware 20260622.

## Steps to reproduce

1. Shut down the laptop, disconnect AC, and hold the power button for 40–60
seconds to recover the controller.
2. Boot Linux and verify that `hci0` initializes.
3. Connect and use Bluetooth normally.
4. Wait several minutes for the controller failure.

## Latest reproduction timeline

* 15:32:23 — USB device `0e8d:1ede` enumerated.
* 15:32:27 — `hci0` setup completed.
* 15:33:08 — Sony WH-1000XM5 connected.
* 15:41:54 — MediaTek coredump completed.
* 15:42:04 — MediaTek subsystem reset failed.
* After 15:42 — USB descriptor requests failed with `-110`, followed by address
failures with `-62` and USB disconnect.

## Key kernel messages

```
Bluetooth: hci0: Mediatek coredump end
Bluetooth: hci0: Can't get device id, subsys reset fail.
usb 1-10: device descriptor read/64, error -110
usb 1-10: device not accepting address 3, error -62
usb 1-10: USB disconnect, device number 3
```

## State after failure

`bluetoothctl show` reports:

```
No default controller available
```

BlueZ remains running, but `hci0` is gone. Reloading `btusb` cannot recover the
hardware because it no longer responds. An ordinary reboot may preserve the
failed state; a full EC/power reset is required.

## Additional observations

* The failure has occurred with Sony WH-1000XM5 connected.
* It has also occurred on another boot without the XM5, while a Bluetooth
keyboard was used.
* Restricting WirePlumber to A2DP and excluding HSP/HFP did not prevent
failure.
* Updating both the kernel and MediaTek firmware did not prevent failure.
* A devcoredump entry existed immediately after this reproduction. Its data
file was deliberately not read/consumed pending maintainer instructions.

## Expected result

The controller remains operational, or successfully recovers after the driver
initiates a subsystem/USB reset.

## Actual result

The firmware crashes, reset fails, the USB device becomes unresponsive, and
physical power recovery is required.

## Related reports

* https://bugzilla.kernel.org/show_bug.cgi?id=221380 — same MT7902 USB ID. That
report concerns unsupported hardware; my controller initializes and works
before crashing at runtime, so this does not appear to be a duplicate.
* https://bugzilla.kernel.org/show_bug.cgi?id=220986 — related MT7902
initialization report for a different USB product ID.

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.