[Bug 221754] New: RTL8852BE Bluetooth (0bda:b853) fails to init: Opcode 0xfcf0 failed: -16, hci0 never registers with mgmt (BD Address 00:00:00:00:00:00)

[Bug 221754] New: RTL8852BE Bluetooth (0bda:b853) fails to init: Opcode 0xfcf0 failed: -16, hci0 never registers with mgmt (BD Address 00:00:00:00:00:00)

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221754

            Bug ID: 221754
           Summary: RTL8852BE Bluetooth (0bda:b853) fails to init: Opcode
                    0xfcf0 failed: -16, hci0 never registers with mgmt (BD
                    Address 00:00:00:00:00:00)
           Product: Drivers
           Version: 2.5
          Hardware: AMD
                OS: Linux
            Status: NEW
          Severity: blocking
          Priority: P3
         Component: Bluetooth
          Assignee: linux-bluetooth@vger.kernel.org
          Reporter: serge.brun@gmail.com
        Regression: No

Full bug report for Realtek RTL8852BE internal Bluetooth failing to initialize
on
Lenovo IdeaPad Pro 5 14AGP11 (Ubuntu 26.04, kernel 7.0.0-27-generic). Includes
dmesg output, hciconfig/btmgmt/rfkill output, and a list of all troubleshooting
steps already attempted (driver reload, USB rebind, firmware replacement, DKMS
rebuild, manual BD address assignment) — all reproducing the identical
Opcode 0xfcf0 / -EBUSY failure.

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221754] RTL8852BE Bluetooth (0bda:b853) fails to init: Opcode 0xfcf0 failed: -16, hci0 never registers with mgmt (BD Address 00:00:00:00:00:00)

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221754

--- Comment #1 from serge.brun@gmail.com ---
Created attachment 310453
  --> https://bugzilla.kernel.org/attachment.cgi?id=310453&action=edit
rtl8852be-bluetooth-bug-report.md

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221754] RTL8852BE Bluetooth (0bda:b853) fails to init: Opcode 0xfcf0 failed: -16, hci0 never registers with mgmt (BD Address 00:00:00:00:00:00)

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221754

Adam (dohojda.adam@gmail.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dohojda.adam@gmail.com

--- Comment #2 from Adam (dohojda.adam@gmail.com) ---
I have very same problem on Lenovo IdeaPad Slim 5 14AHP11

Disribution & kernel: Ubuntu 26.04 LTS, kernel 7.0.0-27-generic
lsusb: 0bda:b853 Realtek Semiconductor Corp. Bluetooth Radio

My filtered dmseg trace:
```
[    3.426562] systemd[1]: systemd-hibernate-clear.service - Clear Stale
Hibernate Storage Info skipped, unmet condition check
ConditionPathExists=/sys/firmware/efi/efivars/HibernateLocation-8cf2644b-4b0b-428f-9387-6d876050dc67
[    4.034621] amdxdna 0000:05:00.1: [drm] Load firmware
amdnpu/1502_00/npu_7.sbin
[    4.058678] kvm_amd: [Firmware Bug]: Cannot enable x2AVIC, AVIC is
unsupported
[    4.081452] rtw89_8852be 0000:02:00.0: loaded firmware
rtw89/rtw8852b_fw-1.bin
[    4.089206] rtw89_8852be 0000:02:00.0: Firmware version 0.29.29.15
(6fb3ec41), cmd version 0, type 5
[    4.089213] rtw89_8852be 0000:02:00.0: Firmware version 0.29.29.15
(6fb3ec41), cmd version 0, type 3
[    5.716983] amdgpu 0000:04:00.0: [drm] Loading DMUB firmware via PSP:
version=0x08005700
[    5.717220] amdgpu 0000:04:00.0: [VCN instance 0] Found VCN firmware Version
ENC: 1.24 DEC: 9 VEP: 0 Revision: 16
[    5.750181] Bluetooth: hci0: RTL: examining hci_ver=0b hci_rev=000b
lmp_ver=0b lmp_subver=8852
[    5.753172] Bluetooth: hci0: RTL: rom_version status=0 version=3
[    5.756172] Bluetooth: hci0: RTL: btrtl_initialize: key id 0
[    5.756176] Bluetooth: hci0: RTL: loading rtl_bt/rtl8852bu_fw.bin
[    5.757225] Bluetooth: hci0: RTL: loading rtl_bt/rtl8852bu_config.bin
[    5.766164] Bluetooth: hci0: AOSP extensions version v0.96
[    5.766168] Bluetooth: hci0: AOSP quality report is not supported
[  131.458300] Bluetooth: hci0: RTL: examining hci_ver=0b hci_rev=000b
lmp_ver=0b lmp_subver=8852
[  131.461055] Bluetooth: hci0: RTL: rom_version status=0 version=3
[  131.464314] Bluetooth: hci0: RTL: btrtl_initialize: key id 0
[  131.464331] Bluetooth: hci0: RTL: loading rtl_bt/rtl8852bu_fw.bin
[  131.465152] Bluetooth: hci0: RTL: loading rtl_bt/rtl8852bu_config.bin
[  131.470914] Bluetooth: hci0: Opcode 0xfcf0 failed: -16
[  131.475291] Bluetooth: hci0: AOSP extensions version v0.96
[  131.475307] Bluetooth: hci0: AOSP quality report is not supported

```

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221754] RTL8852BE Bluetooth (0bda:b853) fails to init: Opcode 0xfcf0 failed: -16, hci0 never registers with mgmt (BD Address 00:00:00:00:00:00)

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221754

jeremy (jeremy53561@gmail.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jeremy53561@gmail.com

--- Comment #3 from jeremy (jeremy53561@gmail.com) ---
(In reply to serge.brun from comment #1)
> Created attachment 310453 [details]
> rtl8852be-bluetooth-bug-report.md

My Bluetooth-7.0 repo only recently included the ID of your bluetooth device,
you may want to try it again

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221754] RTL8852BE Bluetooth (0bda:b853) fails to init: Opcode 0xfcf0 failed: -16, hci0 never registers with mgmt (BD Address 00:00:00:00:00:00)

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221754

--- Comment #4 from serge.brun@gmail.com ---
(In reply to jeremy from comment #3)
> (In reply to serge.brun from comment #1)
> > Created attachment 310453 [details]
> > rtl8852be-bluetooth-bug-report.md
> 
> My Bluetooth-7.0 repo only recently included the ID of your bluetooth
> device, you may want to try it again


Thanks for getting back. I saw the newer commit (61e58e8) adds an explicit
id_table entry for 0x0bda:0xb853 with BTUSB_WIDEBAND_SPEECH. 
Pulled it, rebuilt via DKMS, confirmed the rebuilt module loaded (checked via
modinfo), and reloaded.

Result:

$ sudo dmesg | grep -i hci0 | tail -15
[    4.309610] Bluetooth: hci0: RTL: rom_version status=0 version=3
[    4.311125] Bluetooth: hci0: RTL: btrtl_initialize: key id 0
[    4.311129] Bluetooth: hci0: RTL: loading rtl_bt/rtl8852bu_fw.bin
[    4.311965] Bluetooth: hci0: RTL: loading rtl_bt/rtl8852bu_config.bin
[    4.315931] Bluetooth: hci0: Opcode 0xfcf0 failed: -16
[    4.317327] Bluetooth: hci0: AOSP extensions version v0.96
[    4.317331] Bluetooth: hci0: AOSP quality report is not supported
[ 1524.160747] Bluetooth: hci0: RTL: examining hci_ver=0b hci_rev=000b
lmp_ver=0b lmp_subver=8852
[ 1524.162741] Bluetooth: hci0: RTL: rom_version status=0 version=3
[ 1524.164738] Bluetooth: hci0: RTL: btrtl_initialize: key id 0
[ 1524.164744] Bluetooth: hci0: RTL: loading rtl_bt/rtl8852bu_fw.bin
[ 1524.165315] Bluetooth: hci0: RTL: loading rtl_bt/rtl8852bu_config.bin
[ 1524.168747] Bluetooth: hci0: Opcode 0xfcf0 failed: -16
[ 1524.170741] Bluetooth: hci0: AOSP extensions version v0.96
[ 1524.170745] Bluetooth: hci0: AOSP quality report is not supported

$ sudo btmgmt info
Index list with 0 items

In case it's useful: my device was already binding to the stock in-kernel btusb
driver before testing any of your patches (the original bug report shows the
same RTL: examining/loading sequence without this repo installed at all), so
0x0bda:0xb853 seems to already be present in mainline's id_table. 
That would mean BTUSB_WIDEBAND_SPEECH is the main functional change here, and
since that quirk affects SCO/audio codec negotiation rather than the initial
power-on handshake, it may not be positioned to affect the Opcode 0xfcf0
failure specifically. Could be wrong about that though. 
Let me know if you want me to check anything else (e.g. instrument btrtl.c
around the vendor command send/response for opcode 0xfcf0, or test a specific
rom_version=3 code path).

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221754] RTL8852BE Bluetooth (0bda:b853) fails to init: Opcode 0xfcf0 failed: -16, hci0 never registers with mgmt (BD Address 00:00:00:00:00:00)

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221754

--- Comment #5 from jeremy (jeremy53561@gmail.com) ---
Might want to try
https://github.com/mihaits/rtl8852bd-bt-linux/blob/main/README.md

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221754] RTL8852BE Bluetooth (0bda:b853) fails to init: Opcode 0xfcf0 failed: -16, hci0 never registers with mgmt (BD Address 00:00:00:00:00:00)

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221754

serge.brun@gmail.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |ANSWERED

--- Comment #6 from serge.brun@gmail.com ---
Update: this is fixed, and Adam's case is very likely the same root cause.

mihaits' repo (https://github.com/mihaits/rtl8852bd-bt-linux) nailed it. The
actual problem was never the Opcode 0xfcf0 failure we were all chasing — that
turned out to be a red herring. The real issue: this specific silicon cut
(rom_version=3, aka "RTL8852BD") needs a firmware patch at "eco 4", and
linux-firmware's rtl8852bu_fw.bin only ships eco 1/2 for this chip. It's a
missing-firmware-content problem, not a driver bug — no amount of driver
reloading, address reassignment, or rebuilding btusb was ever going to fix it,
since the firmware needed was never there to load in the first place.

The fix extracts the eco-4 firmware from the Windows Bluetooth driver package
(proprietary Realtek code, not redistributable, so each user has to pull it
from their own vendor's driver download) and feeds it to a patched btrtl that
knows how to apply it correctly — apparently the tricky part is that a specific
memory pointer (0x801200cc) has to be set before streaming the firmware
fragments, or they silently land in the wrong place and the patch never
launches even though every command still reports success.

What I did:

  $ git clone https://github.com/mihaits/rtl8852bd-bt-linux
  $ cd rtl8852bd-bt-linux
  $ sudo ./install.sh ~/Downloads/<lenovo-bluetooth-driver>.exe

(Bluetooth driver .exe pulled from Lenovo's support site for my exact model —
support.lenovo.com > IdeaPad Pro 5 14AGP11 > Drivers & Software > Bluetooth
[https://support.lenovo.com/ca/en/downloads/DS579027])

Result:

  $ hciconfig hci0
  hci0:  Type: Primary  Bus: USB
         BD Address: 14:B5:CD:7D:92:86  ACL MTU: 1021:6  SCO MTU: 255:12
         UP RUNNING

  $ sudo hcitool -i hci0 cmd 0x04 0x01
  ... fw 0x3C91950E (patched), HCI 5.4

Bluetooth is fully working now — paired and streaming audio to headphones
without issue, survives a reboot.

Jeremy — really appreciate you staying engaged on this even once it became
clear the fix wasn't going to be a Makefile/id_table change. Given this turned
out to be a firmware-content gap rather than something fixable in btusb.c, it
might be worth linking mihaits' repo from bluetooth-7.0's README for anyone
who lands there first with a rom_version=3 8852BE — could save the next person
a lot of the loop we all just went through.

Adam (comment #2) — worth checking `dmesg | grep -i "RTL: rom_version"` on
your machine; if I read your comment correctly it also reports version=3, so
this should fix yours too.

Thanks all & Claude — closing this out as resolved on my end.

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221754] RTL8852BE Bluetooth (0bda:b853) fails to init: Opcode 0xfcf0 failed: -16, hci0 never registers with mgmt (BD Address 00:00:00:00:00:00)

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221754

--- Comment #7 from Adam (dohojda.adam@gmail.com) ---
(In reply to jeremy from comment #5)
> Might want to try
> https://github.com/mihaits/rtl8852bd-bt-linux/blob/main/README.md

Thank you very much. It resolved my problem.
I had to additionally  enroll DKMS key into firmware's Machine Owner Key as I
use Secure Boot via
```
sudo mokutil --import /var/lib/shim-signed/mok/MOK.der
```

Thanks again to both of you.

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.

[Bug 221754] RTL8852BE Bluetooth (0bda:b853) fails to init: Opcode 0xfcf0 failed: -16, hci0 never registers with mgmt (BD Address 00:00:00:00:00:00)

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=221754

q234rty (q23456yuiop@gmail.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |q23456yuiop@gmail.com

--- Comment #8 from q234rty (q23456yuiop@gmail.com) ---
Please do not close this bug as resolved until a fix lands in the mainline
kernel :)

In fact, support for the new firmware format has already been submitted to the
kernel:
https://lore.kernel.org/linux-bluetooth/20260624053334.3151885-1-hildawu@realtek.com/

One can verify this by pulling in the patch and simply replacing
rtl8852bu_fw.bin with the rtl8852bd_mp_chip_new.dat file extracted from the
windows driver .exe, without doing any additional processing to the .dat file.

I assume realtek intends to submit the new firmware to linux-fimware.git after
the support code has been merged into the kernel.

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are the assignee for the bug.