Public bug reported: [btintel_pcie] Intel BT [8086:a876] second-stage firmware download stalls ~10x on every cold boot, leading to reset timeout, retry, and eventual "Unsupported cnvi 0x00000000" failure
## Related bug This may be a regression against, or an unresolved edge case of: LP #2085485 — "Bluetooth[8086:a876] crash with hci0: Failed to read MSFT supported features (-110)" https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2085485 That bug's fix (btintel_pcie: Add recovery mechanism / Add handshake between driver and firmware) is present and confirmed working on my kernel — the retry-recovery path does trigger. However, the underlying stall it's recovering from still happens on every single cold boot, and the retry attempt hits the identical stall and ultimately fails outright. This report documents that residual issue with a narrowed-down root cause. ## System information - **Hardware**: Dell 14 Plus (new Panther Lake/Lunar-Lake-class platform) - **Distribution**: Ubuntu 26.04 - **Kernel**: `7.0.0-27-generic` - **Bluetooth device**: `00:14.7 Bluetooth [0d11]: Intel Corporation Device [8086:a876] (rev 10)` - Subsystem: `Intel Corporation Device [8086:000e]` - Kernel driver: `btintel_pcie` - **bluetoothd**: 5.85 ## Summary On every cold boot, the second Bluetooth firmware image (`ibt-0190-0291-pci.sfi`) takes roughly **10x longer to load** than normal — approximately 650,000–750,000 microseconds (650–750 ms), compared to a consistent ~60,000 microseconds (60 ms) on a successful load. This stall causes the subsequent Intel Reset command to time out, triggering the driver's firmware-download retry mechanism (from LP #2085485). The retry reloads firmware successfully but hits the identical multi-hundred-millisecond stall a second time, at which point the controller enters an unrecoverable error state (`Unsupported cnvi 0x00000000`) and Bluetooth fails to come up at all on that boot. A manual `modprobe -r btintel_pcie && modprobe btintel_pcie` after boot reliably recovers the adapter into a working state (visible as a fresh `hci1` instance with a clean, fast firmware load and successful `Fseq status: Success (0x00)`). So the hardware and firmware are functional — the failure is specific to the cold-boot bring-up path. ## Reproduction 1. Cold boot the system (not a warm reboot — the timing is most consistent on full power-on). 2. Observe `journalctl -k -b | grep -iE "bluetooth|btintel|cnvi"`. 3. The first firmware image (`ibt-0190-0291-iml.sfi`, the bootloader-stage image) loads normally (~60,000 usecs). 4. The second firmware image (`ibt-0190-0291-pci.sfi`, the operational image) stalls to 600,000–750,000 usecs. 5. `Controller in error state` → `Timeout (3000 ms) on alive interrupt` → `Intel Soft Reset failed (-62)` → `Firmware download retry count: 1`. 6. The retry reloads firmware (again ~60,000 usecs for the first image), but the second image stalls again by the same order of magnitude. 7. This time, the retry additionally produces `Unsupported cnvi 0x00000000` and the controller does not recover; Bluetooth is nonfunctional until manual driver reload. This is 100% reproducible across multiple cold boots (tested 3 times identically). ## Relevant kernel log (representative example) ``` Bluetooth: hci0: Found device firmware: intel/ibt-0190-0291-pci.sfi Bluetooth: hci0: Boot Address: 0x10000800 Bluetooth: hci0: Firmware Version: 107-8.26 Bluetooth: hci0: Waiting for firmware download to complete Bluetooth: hci0: Firmware loaded in 703313 usecs <-- ~10x normal Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Controller in error state Bluetooth: hci0: Timeout (3000 ms) on alive interrupt, alive context: intel_reset1 Bluetooth: hci0: Failed to send frame (-62) Bluetooth: hci0: sending frame failed (-62) Bluetooth: hci0: Failed to send Intel Reset command Bluetooth: hci0: Intel Soft Reset failed (-62) Bluetooth: hci0: Firmware download retry count: 1 Bluetooth: hci0: Device revision is 0 ... Bluetooth: hci0: Found device firmware: intel/ibt-0190-0291-pci.sfi Bluetooth: hci0: Firmware loaded in 642304 usecs <-- stalls again on retry Bluetooth: hci0: Controller in error state Bluetooth: hci0: Timeout (3000 ms) on alive interrupt, alive context: intel_reset1 Bluetooth: hci0: Failed to send frame (-62) Bluetooth: hci0: Intel Soft Reset failed (-62) Bluetooth: hci0: Received hw exception interrupt Bluetooth: hci0: Unsupported cnvi 0x00000000 Bluetooth: hci0: Controller in error state Bluetooth: hci0: Timeout (500 ms) on tx completion Bluetooth: hci0: Failed to send frame (-62) Bluetooth: hci0: Failed to read MSFT supported features (-62) ``` Compare to a successful load (captured after manual `modprobe -r`/`modprobe` recovery): ``` Bluetooth: hci1: Found device firmware: intel/ibt-0190-0291-pci.sfi Bluetooth: hci1: Boot Address: 0x10000800 Bluetooth: hci1: Firmware Version: 107-8.26 Bluetooth: hci1: Waiting for firmware download to complete Bluetooth: hci1: Firmware loaded in 721548 usecs Bluetooth: hci1: Received gp1 mailbox interrupt Bluetooth: hci1: Waiting for device to boot Bluetooth: hci1: Device booted in 35667 usecs Bluetooth: hci1: Waiting for device transition to d0 Bluetooth: hci1: Device moved to D0 in 164 usecs Bluetooth: hci1: Found Intel DDC parameters: intel/ibt-0190-0291-pci.ddc Bluetooth: hci1: Applying Intel DDC parameters completed Bluetooth: hci1: Fseq status: Success (0x00) Bluetooth: hci1: Fseq executed: 00.00.04.202 Bluetooth: MGMT ver 1.23 ``` Note: even in this successful recovery case the firmware load itself still took 721548 usecs (slow), but critically the subsequent reset/boot sequence succeeded this time rather than timing out — suggesting the stall is not always fatal on its own, and something about state left over from the failed cold-boot attempts affects whether the reset that follows succeeds. ## What I've ruled out - **Not a boot-timing/probe-order race.** Delayed the `btintel_pcie` module load by blacklisting it and loading it manually via a systemd `oneshot` service with a 5-second `ExecStartPre=/bin/sleep 5`. The stall occurred identically regardless of when in boot the driver probed. - **Not PCIe ASPM.** `lspci -vvv -s 00:14.7` shows this device is a **Root Complex Integrated Endpoint** with no conventional PCIe link (no `LnkCtl`/`LnkSta` capability present at all), so there is no ASPM L0s/L1 state to negotiate or disable. - **Not PCIe completion timeout.** The device advertises Completion Timeout Range B (16–55 ms) with `TimeoutDis-`, but the stall (600–750 ms) is far beyond that window without any corresponding AER/completion-timeout kernel message, suggesting the delay occurs below the PCIe transaction layer — inside the firmware/co-processor bring-up sequence itself, not the host-side bus. - **Not device power/runtime-PM policy** (tested via udev rule forcing `power/control=on` on this device — no change, consistent with the Root Complex Integrated Endpoint topology making conventional runtime PM largely moot here). ## Full `lspci -vvv` output for the device ``` 00:14.7 Bluetooth: Intel Corporation Device a876 (rev 10) Subsystem: Intel Corporation Device 000e Control: I/O- Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+ Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Interrupt: pin D routed to IRQ 19 IOMMU group: 11 Region 0: Memory at 2813328000 (64-bit, non-prefetchable) [size=16K] Capabilities: [c8] Power Management version 3 Flags: PMEClk- DSI+ D1- D2- AuxCurrent=0mA PME(D0+,D1-,D2-,D3hot+,D3cold+) Status: D0 NoSoftRst+ PME-Enable- DSel=0 DScale=0 PME- Capabilities: [d0] MSI: Enable- Count=1/1 Maskable- 64bit+ Address: 0000000000000000 Data: 0000 Capabilities: [40] Express (v2) Root Complex Integrated Endpoint, IntMsgNum 0 DevCap: MaxPayload 128 bytes, PhantFunc 0 ExtTag+ RBE- FLReset+ TEE-IO- DevCtl: CorrErr- NonFatalErr- FatalErr- UnsupReq- RlxdOrd+ ExtTag+ PhantFunc- AuxPwr+ NoSnoop+ FLReset- MaxPayload 128 bytes, MaxReadReq 128 bytes DevSta: CorrErr- NonFatalErr- FatalErr- UnsupReq- AuxPwr+ TransPend- DevCap2: Completion Timeout: Range B, TimeoutDis+ NROPrPrP- LTR+ 10BitTagComp- 10BitTagReq- OBFF Via WAKE#, ExtFmt- EETLPPrefix- EmergencyPowerReduction Not Supported, EmergencyPowerReductionInit- FRS- AtomicOpsCap: 32bit- 64bit- 128bitCAS- DevCtl2: Completion Timeout: 16ms to 55ms, TimeoutDis- AtomicOpsCtl: ReqEn- IDOReq- IDOCompl- LTR+ EmergencyPowerReductionReq- 10BitTagReq- OBFF Disabled, EETLPPrefixBlk- Capabilities: [80] MSI-X: Enable+ Count=32 Masked- Vector table: BAR=0 offset=00002000 PBA: BAR=0 offset=00003000 Capabilities: [100 v1] Latency Tolerance Reporting Max snoop latency: 0ns Max no snoop latency: 0ns Kernel driver in use: btintel_pcie Kernel modules: btintel_pcie ``` ## Impact Bluetooth is nonfunctional after every cold boot without manual intervention. Workaround requires a manual `sudo modprobe -r btintel_pcie && sudo modprobe btintel_pcie` (or a full reboot, which sometimes but not reliably succeeds on the "warm" retry) after every cold power-on. This is not viable for typical end users. ## Workaround (for other affected users, not a fix) ```bash sudo modprobe -r btintel_pcie sudo modprobe btintel_pcie sudo systemctl restart bluetooth ``` ## Complete kernel log for the boot in question (`journalctl -k -b`, filtered to bluetooth/btintel/cnvi lines) ``` Bluetooth: Core ver 2.22 NET: Registered PF_BLUETOOTH protocol family Bluetooth: HCI device and connection manager initialized Bluetooth: HCI socket layer initialized Bluetooth: L2CAP socket layer initialized Bluetooth: SCO socket layer initialized btintel_pcie 0000:00:14.7: enabling device (0000 -> 0002) Bluetooth: hci0: Device revision is 0 Bluetooth: hci0: Secure boot is enabled Bluetooth: hci0: OTP lock is disabled Bluetooth: hci0: API lock is enabled Bluetooth: hci0: Debug lock is disabled Bluetooth: hci0: Minimum firmware build 1 week 10 2014 Bluetooth: hci0: Bootloader timestamp 2023.33 buildtype 1 build 45995 Bluetooth: hci0: Found device firmware: intel/ibt-0190-0291-iml.sfi Bluetooth: hci0: Boot Address: 0x30098800 Bluetooth: hci0: Firmware Version: 107-8.26 Bluetooth: hci0: Waiting for firmware download to complete Bluetooth: hci0: Firmware loaded in 65065 usecs Bluetooth: hci0: Waiting for device to boot Bluetooth: hci0: Device booted in 2245 usecs Bluetooth: hci0: Waiting for device transition to d0 Bluetooth: hci0: Device moved to D0 in 1 usecs Bluetooth: hci0: dsbr: enable: 0x01 value: 0x0f Bluetooth: hci0: Found device firmware: intel/ibt-0190-0291-pci.sfi Bluetooth: hci0: Boot Address: 0x10000800 Bluetooth: hci0: Firmware Version: 107-8.26 Bluetooth: BNEP (Ethernet Emulation) ver 1.3 Bluetooth: BNEP filters: protocol multicast Bluetooth: BNEP socket layer initialized Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Waiting for firmware download to complete Bluetooth: hci0: Firmware loaded in 752732 usecs Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Controller in error state Bluetooth: hci0: Timeout (3000 ms) on alive interrupt, alive context: intel_reset1 Bluetooth: hci0: Failed to send frame (-62) Bluetooth: hci0: sending frame failed (-62) Bluetooth: hci0: Failed to send Intel Reset command Bluetooth: hci0: Intel Soft Reset failed (-62) Bluetooth: hci0: Firmware download retry count: 1 Bluetooth: hci0: Device revision is 0 Bluetooth: hci0: Secure boot is enabled Bluetooth: hci0: OTP lock is disabled Bluetooth: hci0: API lock is enabled Bluetooth: hci0: Debug lock is disabled Bluetooth: hci0: Minimum firmware build 1 week 10 2014 Bluetooth: hci0: Bootloader timestamp 2023.33 buildtype 1 build 45995 Bluetooth: hci0: Found device firmware: intel/ibt-0190-0291-iml.sfi Bluetooth: hci0: Boot Address: 0x30098800 Bluetooth: hci0: Firmware Version: 107-8.26 Bluetooth: hci0: Waiting for firmware download to complete Bluetooth: hci0: Firmware loaded in 57029 usecs Bluetooth: hci0: Waiting for device to boot Bluetooth: hci0: Device booted in 2233 usecs Bluetooth: hci0: Waiting for device transition to d0 Bluetooth: hci0: Device moved to D0 in 1 usecs Bluetooth: hci0: dsbr: enable: 0x01 value: 0x0f Bluetooth: hci0: Found device firmware: intel/ibt-0190-0291-pci.sfi Bluetooth: hci0: Boot Address: 0x10000800 Bluetooth: hci0: Firmware Version: 107-8.26 Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Waiting for firmware download to complete Bluetooth: hci0: Firmware loaded in 679988 usecs Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Controller in error state Bluetooth: hci0: Timeout (3000 ms) on alive interrupt, alive context: intel_reset1 Bluetooth: hci0: Failed to send frame (-62) Bluetooth: hci0: sending frame failed (-62) Bluetooth: hci0: Failed to send Intel Reset command Bluetooth: hci0: Intel Soft Reset failed (-62) Bluetooth: hci0: Received hw exception interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Received gp1 mailbox interrupt Bluetooth: hci0: Controller in error state Bluetooth: hci0: Unsupported cnvi 0x00000000 Bluetooth: hci0: Timeout (500 ms) on tx completion Bluetooth: hci0: Failed to send frame (-62) Bluetooth: hci0: sending frame failed (-62) Bluetooth: hci0: Failed to read MSFT supported features (-62) ``` ** Affects: linux (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2161900 Title: Bluetooth Failure on boot for Dell Plus 14 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2161900/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
