[Bug 221754] RTL8852BE Bluetooth (0bda:b853) fails to init: Opcode 0xfcf0 failed: -16, hci0 never registers with mgmt (BD Address 00:00:00:00:00:00)

[bugzilla-daemon@kernel.org]

https://bugzilla.kernel.org/show_bug.cgi?id=221754

--- Comment #11 from Martino P. (martino.papero@lcb.to.it) ---
I can confirm the issue is still present on Fedora 44 / kernel 7.2.8

Hardware: Lenovo IdeaPad Slim 3 15IWC11, system product 83RR, BIOS U2CN21WW
(2026-05-13). Bluetooth USB 0bda:b853; Wi-Fi PCI 10ec:b852, driver
rtw89_8852be. Fedora 44 x86_64, kernel 7.2.8-200.fc44.x86_64;
linux-firmware/realtek-firmware 20260916-1.fc44; BlueZ
5.87+1.git8750129efca8-1.fc44.

With the stock Fedora modules:
- HCI version 0x0b, HCI revision 0x000b, LMP version 0x0b, LMP subversion
0x8852.
- rom_version status=0 version=3; key id 0.
- Requests rtl_bt/rtl8852bu_fw.bin and rtl_bt/rtl8852bu_config.bin.
- hci0 DOWN, zero BD_ADDR, no management adapter, no rfkill block.
- A single privileged HCIDEVUP returns ENODATA (errno 61).
- Opcode 0xfcf0 failed: -16 appears, but "didn't find patch for chip id 3" does
not.

The installed rtl8852bu_fw.bin.xz decompresses to an RTBTCore (v2) container
with two patch subsections: eco 1 (67133 bytes), eco 2 (62533 bytes), no eco 4. 

I checked the exact Fedora source RPM kernel-7.2.8-200.fc44.src.rpm. Its
btrtl.c/h and btusb.c are byte-identical to kernel-ark tag kernel-7.2.8-0, and
the Fedora patch does not seem to change these files. Static analysis shows
that the v2 parser selects eco == rom_version + 1 (4 here), finds no matching
content, and returns -ENODATA before firmware download. The exact stock source
has no BTNIC003 parser.

The user-provided Lenovo Windows installer for my laptop model
(7ns3020flz7uw5k0.exe) contains
Realtek_8852BE_18.4032.0.3008/rtl8852bd_mp_chip_new.dat. The INF explicitly
associates USB\VID_0BDA&PID_B853 with 8852BD. INF DriverVer:
10/10/2025,18.4032.0.3008. The .dat is 68176 bytes, magic BTNIC003.

For a temporary test, I ported only the multi-record eco4 download path from
mihaits/rtl8852bd-bt-linux onto the exact Fedora btrtl source, adding
pre-download container validation and a check of the final commit response. The
repack uses that project's extractor. I signed the module with an enrolled
akmods MOK; Secure Boot remained enabled. 

Three records loaded, hci0 UP with a nonzero address, one adapter visible to
btmgmt/BlueZ. Read Local Version returns status 0, HCI/LMP 0x0d, HCI revision
0x3c91, manufacturer 93, LMP subversion 0x950e (combined version 0x3C91950E). A
Bluetooth mouse connects and works.

Regarding comment #10: the installer named above does contain the required
.dat, although its Realtek driver version is also 18.4032.0.3008. I cannot
infer the content of a different Lenovo installer from the driver version
alone, and I can't provide the binary directly. You can try downloading the
same driver for my model, the firmware for the device should be the same.

Regarding comment #8: I found a v8 revision of Hilda Wu's firmware-v3 series
dated 2026-09-23:
https://lore.kernel.org/linux-bluetooth/20260923104521.1706251-1-hildawu@realtek.com/
Mirror: https://patchew.org/linux/20260923104521.1706251-1-hildawu@realtek.com/
The submission uses RTL8922D as its example. Could Realtek confirm whether this
older 8852BD cut / Windows BTNIC003 file is covered, and which official
firmware should be used? I have not applied or tested that series.

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.