RTL8723BU Hardware Crash on HFP/HSP Profile Switch (mSBC Codec)

[jesusizq]

Bug: RTL8723BU Hardware Crash on HFP/HSP Profile Switch (mSBC Codec)

---

1. Environment & Hardware

• Laptop: HP OMEN 16-ap0032ns
• Bluetooth Adapter: Realtek RTL8723BU
• USB ID: 0bda:b86a
• Headset: Bose 700 Noise Cancelling
• Operating System: Ubuntu 24.04 LTS (Clean Install, kernel 6.8)
• Audio/Bluetooth Stack: PipeWire + BlueZ
• Driver: lwfinger/rtl8723bu (manually compiled and installed from the main branch).

---

2. Problem Description

The driver works flawlessly for high-quality audio playback. The issue is triggered specifically when activating the headset's microphone, which requires a switch to the HFP/HSP profile.

Sequence of Events:

1. The Bose 700 headset connects successfully to the system.
2. The audio profile defaults to A2DP Sink, and stereo audio playback works perfectly.
3. An action that requires the microphone is initiated (e.g., starting a video call, opening audio settings and switching the profile manually to HFP/HSP).
4. The audio stack (PipeWire/BlueZ) attempts to switch to the HFP profile and negotiate the mSBC wideband speech codec.
5. The instant the mSBC audio stream is requested, the RTL8723BU adapter hangs catastrophically.

---

3. Expected vs. Actual Behavior

• Expected Behavior: The headset should switch to the HFP/HSP profile, establish a stable bidirectional audio link using the mSBC codec, and allow the microphone to be used.
• Actual Behavior: The Bluetooth adapter crashes. The hci0 host controller disappears from the system. bluetoothctl reports No default controller available. The only way to recover the adapter is to perform a full power cycle of the laptop (complete shutdown and unplug).

---

4. Log Analysis & Technical Diagnosis

The kernel log (dmesg) provides clear evidence of a hardware-level timeout. The following errors are spammed repeatedly after the crash:

command tx timeout
Read reg16 failed (-110)

Analysis:

• command tx timeout: The kernel sent a command to the Realtek chip, but the chip failed to respond within the timeout period.
• Read reg16 failed (-110): This is the critical error. The driver attempted to read a memory register from the chip, but the operation failed with the kernel error code -110, which corresponds to ETIMEDOUT.

This confirms the hardware is in a frozen, non-responsive state. The issue appears to be a low-level bug in the RTL8723BU firmware that is triggered when the driver instructs it to handle an mSBC audio stream on modern audio stacks like PipeWire.

---

5. Confirmed Workarounds

Two workarounds have been identified:

1. Force Fallback to CVSD Codec: By creating a PipeWire config file (~/.config/pipewire/media-session.d/bluez-monitor.conf) with the following property, the system is prevented from attempting to use mSBC. It falls back to the older CVSD codec. The HFP profile is stable with CVSD, but microphone audio quality is extremely poor, as expected.

   properties = {
       bluez5.enable-msbc = false
   }
   

2. Use Separate Audio Devices: Using the laptop's internal microphone for audio input while keeping the Bose 700 headset on the high-quality A2DP Sink profile for output. This completely avoids activating the buggy HFP profile on the headset.