[Bug 222151] New: MT7925 (0489:e111): BT firmware 20260813113236 (linux-firmware 50e034a2) breaks HFP calls and fails WMT init; 20260605184935 works

[bugzilla-daemon@kernel.org]

https://bugzilla.kernel.org/show_bug.cgi?id=222151

            Bug ID: 222151
           Summary: MT7925 (0489:e111): BT firmware 20260813113236
                    (linux-firmware 50e034a2) breaks HFP calls and fails
                    WMT init; 20260605184935 works
           Product: Drivers
           Version: 2.5
          Hardware: All
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P3
         Component: Bluetooth
          Assignee: linux-bluetooth@vger.kernel.org
          Reporter: purpleritza@gmail.com
        Regression: No

Hardware / software
  Laptop:    Lenovo Legion 5 Pro 16AFR10
  Bluetooth: MediaTek MT7925, USB 0489:e111 (btusb/btmtk)
  Headset:   Bose NC 700 HP (HFP/A2DP)
  Distro:    Arch Linux, bluez 5.87, wireplumber 0.5.15, pipewire 1.6.8
  Kernels:   7.1.8, 7.2.9, 7.2.10 (Arch)

Firmware
  Bad:  linux-firmware commit 50e034a2 ("mediatek MT7925: update bluetooth
        firmware to 20260813113236"),
        file mediatek/mt7925/BT_RAM_CODE_MT7925_1_1_hdr.bin, build
20260813113236
  Good: commit 2d705393, build 20260605184935

  Arch package versions: linux-firmware-mediatek 20260916-1 (bad) vs 20260810-2
  (good). Between them the MT7925 WiFi blob also changed (commit 3c11e660,
  "update firmware for MT7925 WiFi device", same day). WiFi worked normally on
  both; only Bluetooth broke.

Calls regression (good / bad / good / bad)

  Period                          BT build        Kernel             Calls
  ------------------------------  --------------  ----------------- 
---------------------------------
  until 2026-09-27 (first chip    20260605184935  7.1.x / 7.2.2      worked
    init with the new blob)
  2026-09-27 onward               20260813113236  7.2.2 - 7.2.8      headset
audio drops mid-call,
                                                                       mic lost
  2026-10-07 - 10-15              20260605184935  7.1.8, then 7.2.9  worked
    (daily calls for a week)
  2026-10-17 onward               20260813113236  7.2.10             headset
audio drops mid-call

  Userspace (wireplumber 0.5.15, pipewire 1.6.8) was the same in the last two
  rows. One data point not covered by the table: on 2026-10-07 the first calls
  after downgrading the firmware still failed, while that boot ran kernel 7.2.8
  with wireplumber 0.5.18 / pipewire 1.6.9. Calls worked once those were rolled
  back too.

  Failure on the bad build (2026-10-19, kernel 7.2.10): the HFP transport dies
  mid-call, both headset nodes fail at once, and the call app falls back to the
  laptop microphone, so the remote side still hears me while I hear nothing:

12:02:56 wireplumber: pw.node: (bluez_input.78_2B_64_D2_1D_66.0-74) running ->
error (Received error event)
12:02:56 wireplumber: pw.node: (bluez_output.78_2B_64_D2_1D_66.1-73) running ->
error (Received error event)
12:02:56 wireplumber: spa.bluez5: Failure in Bluetooth audio transport
/org/bluez/hci1/dev_78_2B_64_D2_1D_66/fd46
12:02:57 bluetoothd: src/profile.c:ext_io_disconnected() Unable to get io data
for Hands-Free Voice gateway: getpeername: Transport endpoint is not connected
(107)

  bluetoothd reconnects A2DP signaling 8 s later (12:03:04), and A2DP streaming
  is back after 74 s (12:04:10); the call audio over the headset is gone.

WMT init failure (only ever seen on the bad build)

  Counted per firmware load across 30 boots of the journal:

  BT build        Loads  WMT init failures
  --------------  -----  --------------------------
  20260605184935     71  0
  20260813113236     16  2 (2026-09-27, 2026-10-17)

Oct 17 19:53:29 kernel: Bluetooth: hci0: HW/SW Version: 0x00000000, Build Time:
20260813113236
Oct 17 19:53:40 kernel: Bluetooth: hci0: Execution of wmt command timed out
Oct 17 19:53:40 kernel: Bluetooth: hci0: Failed to send wmt func ctrl (-110)
Oct 17 19:53:40 kernel: Bluetooth: hci1: HW/SW Version: 0x00000000, Build Time:
20260813113236
Oct 17 19:53:42 kernel: Bluetooth: hci1: Device setup in 1751211 usecs

  The controller recovers by re-enumerating as hci1. I know WMT timeouts are
  reported on other MT7925 machines with older builds (bug 220237, Ubuntu LP
  2163428); on this machine they only occur with 20260813113236.

Related
  - Bug 221722: blanket HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN breaks mSBC
mic
    on MT7925 (0489:e111). The quirk is active on both builds here, so it does
    not explain the difference between them.
  - Bug 220237: MT7925 BT firmware load timeout (-110).
  - Bug 220682 (same USB ID, libmtp/mtp-probe probing the adapter): not
    applicable here. libmtp and libgphoto2 are not installed, mtp-probe never
    ran, and udev sets no media-device tags on the adapter.
  - bluetooth-next a6491451f8b8 "Bluetooth: mt7925: trigger reset on WMT
timeout".
  - "ACL/SCO packet for unknown connection handle 3837/3584" appears on both
    builds and doesn't correlate with the failures.

Workaround
  Pinning linux-firmware-mediatek 20260810-2 (BT build 20260605184935).

Happy to test a new firmware build or capture btmon traces of a failing call on
request.

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.