[PATCH v5 0/2] Bluetooth: btqca: move WCN7850 WA and add WCN6855 firmware priority selection feature

[PATCH v5 0/2] Bluetooth: btqca: move WCN7850 WA and add WCN6855 firmware priority selection feature

[Shuai Zhang]

patch1: Move WCN7850 workaround to the caller
patch2: Update WCN6855 firmware to use the new FW file and added a fallback mechanism.

Changes v5
- Separate move WCN7850 and add WCN6855 fw name commit.
- remove WCN7850 unuseless condition.
- Link to v4:
  https://lore.kernel.org/all/20251226075621.3223336-1-shuai.zhang@oss.qualcomm.com/

Changed v4:
- move WCN7850 WA to the caller.
  handle cases where the firmware cannot be found.
- Link to v3
  https://lore.kernel.org/all/20251117021645.712753-1-shuai.zhang@oss.qualcomm.com/

changed v3:
- Remove CC satble
- Update commit
- add test steps and log
- Link to v2
  https://lore.kernel.org/all/20251114081751.3940541-2-shuai.zhang@oss.qualcomm.com/

Changes v2:
- Add Fixes tag.
- Add comments in the commit and code to explain the reason for the changes.
- Link to v1
  https://lore.kernel.org/all/20251112074638.1592864-1-quic_shuaz@quicinc.com/

Shuai Zhang (2):
  Bluetooth: btqca: move WCN7850 workaround to the caller
  Bluetooth: btqca: Add WCN6855 firmware priority selection feature

 drivers/bluetooth/btqca.c | 66 ++++++++++++++++++++++++---------------
 1 file changed, 41 insertions(+), 25 deletions(-)

-- 
2.34.1

[PATCH v5 1/2] Bluetooth: btqca: move WCN7850 workaround to the caller

[Shuai Zhang]

To code uniformity, move WCN7850 workaround to the caller.

Signed-off-by: Shuai Zhang <shuai.zhang@oss.qualcomm.com>
---
 drivers/bluetooth/btqca.c | 41 +++++++++++++++++++--------------------
 1 file changed, 20 insertions(+), 21 deletions(-)

diff --git a/drivers/bluetooth/btqca.c b/drivers/bluetooth/btqca.c
index 7c958d606..b4c0a018d 100644
--- a/drivers/bluetooth/btqca.c
+++ b/drivers/bluetooth/btqca.c
@@ -581,28 +581,11 @@ static int qca_download_firmware(struct hci_dev *hdev,
 
 	ret = request_firmware(&fw, config->fwname, &hdev->dev);
 	if (ret) {
-		/* For WCN6750, if mbn file is not present then check for
-		 * tlv file.
-		 */
-		if (soc_type == QCA_WCN6750 && config->type == ELF_TYPE_PATCH) {
-			bt_dev_dbg(hdev, "QCA Failed to request file: %s (%d)",
-				   config->fwname, ret);
-			config->type = TLV_TYPE_PATCH;
-			snprintf(config->fwname, sizeof(config->fwname),
-				 "qca/msbtfw%02x.tlv", rom_ver);
-			bt_dev_info(hdev, "QCA Downloading %s", config->fwname);
-			ret = request_firmware(&fw, config->fwname, &hdev->dev);
-			if (ret) {
-				bt_dev_err(hdev, "QCA Failed to request file: %s (%d)",
-					   config->fwname, ret);
-				return ret;
-			}
-		}
 		/* If the board-specific file is missing, try loading the default
 		 * one, unless that was attempted already.
 		 */
-		else if (config->type == TLV_TYPE_NVM &&
-			 qca_get_alt_nvm_file(config->fwname, sizeof(config->fwname))) {
+		if (config->type == TLV_TYPE_NVM &&
+		    qca_get_alt_nvm_file(config->fwname, sizeof(config->fwname))) {
 			bt_dev_info(hdev, "QCA Downloading %s", config->fwname);
 			ret = request_firmware(&fw, config->fwname, &hdev->dev);
 			if (ret) {
@@ -862,8 +845,24 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,
 
 	err = qca_download_firmware(hdev, &config, soc_type, rom_ver);
 	if (err < 0) {
-		bt_dev_err(hdev, "QCA Failed to download patch (%d)", err);
-		return err;
+		/* For WCN6750, if mbn file is not present then check for
+		 * tlv file.
+		 */
+		if (soc_type == QCA_WCN6750) {
+			bt_dev_dbg(hdev, "QCA Failed to request file: %s (%d)",
+				   config.fwname, err);
+			config.type = TLV_TYPE_PATCH;
+			snprintf(config.fwname, sizeof(config.fwname),
+				 "qca/msbtfw%02x.tlv", rom_ver);
+			bt_dev_info(hdev, "QCA Downloading %s", config.fwname);
+			err = qca_download_firmware(hdev, &config, soc_type, rom_ver);
+		}
+
+		if (err) {
+			bt_dev_err(hdev, "QCA Failed to request file: %s (%d)",
+				   config.fwname, err);
+			return err;
+		}
 	}
 
 	/* Give the controller some time to get ready to receive the NVM */
-- 
2.34.1

Re: [PATCH v5 1/2] Bluetooth: btqca: move WCN7850 workaround to the caller

[Paul Menzel]

Dear Shuai,


Thank you for the patch.

Am 31.12.25 um 13:58 schrieb Shuai Zhang:
> To code uniformity, move WCN7850 workaround to the caller.

Please elaborate, and detail what WCN7850 workaround.

> Signed-off-by: Shuai Zhang <shuai.zhang@oss.qualcomm.com>
> ---
>   drivers/bluetooth/btqca.c | 41 +++++++++++++++++++--------------------
>   1 file changed, 20 insertions(+), 21 deletions(-)
> 
> diff --git a/drivers/bluetooth/btqca.c b/drivers/bluetooth/btqca.c
> index 7c958d606..b4c0a018d 100644
> --- a/drivers/bluetooth/btqca.c
> +++ b/drivers/bluetooth/btqca.c
> @@ -581,28 +581,11 @@ static int qca_download_firmware(struct hci_dev *hdev,
>   
>   	ret = request_firmware(&fw, config->fwname, &hdev->dev);
>   	if (ret) {
> -		/* For WCN6750, if mbn file is not present then check for
> -		 * tlv file.
> -		 */
> -		if (soc_type == QCA_WCN6750 && config->type == ELF_TYPE_PATCH) {

The `config->type == ELF_TYPE_PATCH` wasn’t moved, and it’s not visible 
from the diff, why. Please explain in the commit message.

> -			bt_dev_dbg(hdev, "QCA Failed to request file: %s (%d)",
> -				   config->fwname, ret);
> -			config->type = TLV_TYPE_PATCH;
> -			snprintf(config->fwname, sizeof(config->fwname),
> -				 "qca/msbtfw%02x.tlv", rom_ver);
> -			bt_dev_info(hdev, "QCA Downloading %s", config->fwname);
> -			ret = request_firmware(&fw, config->fwname, &hdev->dev);
> -			if (ret) {
> -				bt_dev_err(hdev, "QCA Failed to request file: %s (%d)",
> -					   config->fwname, ret);
> -				return ret;
> -			}
> -		}
>   		/* If the board-specific file is missing, try loading the default
>   		 * one, unless that was attempted already.
>   		 */
> -		else if (config->type == TLV_TYPE_NVM &&
> -			 qca_get_alt_nvm_file(config->fwname, sizeof(config->fwname))) {
> +		if (config->type == TLV_TYPE_NVM &&
> +		    qca_get_alt_nvm_file(config->fwname, sizeof(config->fwname))) {
>   			bt_dev_info(hdev, "QCA Downloading %s", config->fwname);
>   			ret = request_firmware(&fw, config->fwname, &hdev->dev);
>   			if (ret) {
> @@ -862,8 +845,24 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,
>   
>   	err = qca_download_firmware(hdev, &config, soc_type, rom_ver);
>   	if (err < 0) {
> -		bt_dev_err(hdev, "QCA Failed to download patch (%d)", err);
> -		return err;
> +		/* For WCN6750, if mbn file is not present then check for
> +		 * tlv file.
> +		 */
> +		if (soc_type == QCA_WCN6750) {
> +			bt_dev_dbg(hdev, "QCA Failed to request file: %s (%d)",
> +				   config.fwname, err);
> +			config.type = TLV_TYPE_PATCH;
> +			snprintf(config.fwname, sizeof(config.fwname),
> +				 "qca/msbtfw%02x.tlv", rom_ver);
> +			bt_dev_info(hdev, "QCA Downloading %s", config.fwname);
> +			err = qca_download_firmware(hdev, &config, soc_type, rom_ver);
> +		}
> +
> +		if (err) {
> +			bt_dev_err(hdev, "QCA Failed to request file: %s (%d)",
> +				   config.fwname, err);
> +			return err;
> +		}
>   	}
>   
>   	/* Give the controller some time to get ready to receive the NVM */


Kind regards,

Paul

Re: [PATCH v5 1/2] Bluetooth: btqca: move WCN7850 workaround to the caller

[Shuai Zhang]

Hi Paul

On 12/31/2025 4:38 PM, Paul Menzel wrote:
> Dear Shuai,
>
>
> Thank you for the patch.
>
> Am 31.12.25 um 13:58 schrieb Shuai Zhang:
>> To code uniformity, move WCN7850 workaround to the caller.
>
> Please elaborate, and detail what WCN7850 workaround.
>

I will update.


>> Signed-off-by: Shuai Zhang <shuai.zhang@oss.qualcomm.com>
>> ---
>>   drivers/bluetooth/btqca.c | 41 +++++++++++++++++++--------------------
>>   1 file changed, 20 insertions(+), 21 deletions(-)
>>
>> diff --git a/drivers/bluetooth/btqca.c b/drivers/bluetooth/btqca.c
>> index 7c958d606..b4c0a018d 100644
>> --- a/drivers/bluetooth/btqca.c
>> +++ b/drivers/bluetooth/btqca.c
>> @@ -581,28 +581,11 @@ static int qca_download_firmware(struct hci_dev 
>> *hdev,
>>         ret = request_firmware(&fw, config->fwname, &hdev->dev);
>>       if (ret) {
>> -        /* For WCN6750, if mbn file is not present then check for
>> -         * tlv file.
>> -         */
>> -        if (soc_type == QCA_WCN6750 && config->type == 
>> ELF_TYPE_PATCH) {
>
> The `config->type == ELF_TYPE_PATCH` wasn’t moved, and it’s not 
> visible from the diff, why. Please explain in the commit message.


If it is WCN7850, config.type is already set to ELF_TYPE_PATCH when 
downloading the rampatch file.

Therefore, if (config.type == ELF_TYPE_PATCH) will always evaluate to true.


>
>> -            bt_dev_dbg(hdev, "QCA Failed to request file: %s (%d)",
>> -                   config->fwname, ret);
>> -            config->type = TLV_TYPE_PATCH;
>> -            snprintf(config->fwname, sizeof(config->fwname),
>> -                 "qca/msbtfw%02x.tlv", rom_ver);
>> -            bt_dev_info(hdev, "QCA Downloading %s", config->fwname);
>> -            ret = request_firmware(&fw, config->fwname, &hdev->dev);
>> -            if (ret) {
>> -                bt_dev_err(hdev, "QCA Failed to request file: %s (%d)",
>> -                       config->fwname, ret);
>> -                return ret;
>> -            }
>> -        }
>>           /* If the board-specific file is missing, try loading the 
>> default
>>            * one, unless that was attempted already.
>>            */
>> -        else if (config->type == TLV_TYPE_NVM &&
>> -             qca_get_alt_nvm_file(config->fwname, 
>> sizeof(config->fwname))) {
>> +        if (config->type == TLV_TYPE_NVM &&
>> +            qca_get_alt_nvm_file(config->fwname, 
>> sizeof(config->fwname))) {
>>               bt_dev_info(hdev, "QCA Downloading %s", config->fwname);
>>               ret = request_firmware(&fw, config->fwname, &hdev->dev);
>>               if (ret) {
>> @@ -862,8 +845,24 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t 
>> baudrate,
>>         err = qca_download_firmware(hdev, &config, soc_type, rom_ver);
>>       if (err < 0) {
>> -        bt_dev_err(hdev, "QCA Failed to download patch (%d)", err);
>> -        return err;
>> +        /* For WCN6750, if mbn file is not present then check for
>> +         * tlv file.
>> +         */
>> +        if (soc_type == QCA_WCN6750) {
>> +            bt_dev_dbg(hdev, "QCA Failed to request file: %s (%d)",
>> +                   config.fwname, err);
>> +            config.type = TLV_TYPE_PATCH;
>> +            snprintf(config.fwname, sizeof(config.fwname),
>> +                 "qca/msbtfw%02x.tlv", rom_ver);
>> +            bt_dev_info(hdev, "QCA Downloading %s", config.fwname);
>> +            err = qca_download_firmware(hdev, &config, soc_type, 
>> rom_ver);
>> +        }
>> +
>> +        if (err) {
>> +            bt_dev_err(hdev, "QCA Failed to request file: %s (%d)",
>> +                   config.fwname, err);
>> +            return err;
>> +        }
>>       }
>>         /* Give the controller some time to get ready to receive the 
>> NVM */
>
>
> Kind regards,
>
> Paul

Kind regards,

Shuai

>

Re: [PATCH v5 1/2] Bluetooth: btqca: move WCN7850 workaround to the caller

[Dmitry Baryshkov]

On Wed, Dec 31, 2025 at 03:58:16PM +0800, Shuai Zhang wrote:
> To code uniformity, move WCN7850 workaround to the caller.
> 
> Signed-off-by: Shuai Zhang <shuai.zhang@oss.qualcomm.com>
> ---
>  drivers/bluetooth/btqca.c | 41 +++++++++++++++++++--------------------
>  1 file changed, 20 insertions(+), 21 deletions(-)
> 
> @@ -862,8 +845,24 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,
>  
>  	err = qca_download_firmware(hdev, &config, soc_type, rom_ver);
>  	if (err < 0) {
> -		bt_dev_err(hdev, "QCA Failed to download patch (%d)", err);
> -		return err;
> +		/* For WCN6750, if mbn file is not present then check for
> +		 * tlv file.
> +		 */
> +		if (soc_type == QCA_WCN6750) {

You can move this one level up:

	if (soc_type == QCA_WCN6750 && err) {
		try TLV
	}
	if (err) {
		bt_dev_err();
		return err;
	}


> +			bt_dev_dbg(hdev, "QCA Failed to request file: %s (%d)",
> +				   config.fwname, err);
> +			config.type = TLV_TYPE_PATCH;
> +			snprintf(config.fwname, sizeof(config.fwname),
> +				 "qca/msbtfw%02x.tlv", rom_ver);
> +			bt_dev_info(hdev, "QCA Downloading %s", config.fwname);
> +			err = qca_download_firmware(hdev, &config, soc_type, rom_ver);
> +		}
> +
> +		if (err) {
> +			bt_dev_err(hdev, "QCA Failed to request file: %s (%d)",
> +				   config.fwname, err);
> +			return err;
> +		}
>  	}
>  
>  	/* Give the controller some time to get ready to receive the NVM */
> -- 
> 2.34.1
> 

-- 
With best wishes
Dmitry

[PATCH v5 2/2] Bluetooth: btqca: Add WCN6855 firmware priority selection feature

[Shuai Zhang]

Historically, WCN685x and QCA2066 shared the same firmware files.
Now, changes are planned for the firmware that will make it incompatible
with QCA2066, so a new firmware name is required for WCN685x.

Test Steps:
 - Boot device
 - Check the BTFW loading status via dmesg

Sanity pass and Test Log:
QCA Downloading qca/wcnhpbftfw21.tlv
Direct firmware load for qca/wcnhpbftfw21.tlv failed with error -2
QCA Downloading qca/hpbftfw21.tlv

Signed-off-by: Shuai Zhang <shuai.zhang@oss.qualcomm.com>
---
 drivers/bluetooth/btqca.c | 25 +++++++++++++++++++++----
 1 file changed, 21 insertions(+), 4 deletions(-)

diff --git a/drivers/bluetooth/btqca.c b/drivers/bluetooth/btqca.c
index b4c0a018d..9383c8dde 100644
--- a/drivers/bluetooth/btqca.c
+++ b/drivers/bluetooth/btqca.c
@@ -830,8 +830,12 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,
 				 "qca/msbtfw%02x.mbn", rom_ver);
 			break;
 		case QCA_WCN6855:
+			/* Due to historical reasons, WCN685x chip has been using firmware
+			 * without the "wcn" prefix. The mapping between the chip and its
+			 * corresponding firmware has now been corrected.
+			 */
 			snprintf(config.fwname, sizeof(config.fwname),
-				 "qca/hpbtfw%02x.tlv", rom_ver);
+				 "qca/wcnhpbtfw%02x.tlv", rom_ver);
 			break;
 		case QCA_WCN7850:
 			snprintf(config.fwname, sizeof(config.fwname),
@@ -856,6 +860,10 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,
 				 "qca/msbtfw%02x.tlv", rom_ver);
 			bt_dev_info(hdev, "QCA Downloading %s", config.fwname);
 			err = qca_download_firmware(hdev, &config, soc_type, rom_ver);
+		} else if (!rampatch_name && soc_type == QCA_WCN6855) {
+			snprintf(config.fwname, sizeof(config.fwname),
+				 "qca/hpbtfw%02x.tlv", rom_ver);
+			err = qca_download_firmware(hdev, &config, soc_type, rom_ver);
 		}
 
 		if (err) {
@@ -922,7 +930,7 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,
 		case QCA_WCN6855:
 			qca_read_fw_board_id(hdev, &boardid);
 			qca_get_nvm_name_by_board(config.fwname, sizeof(config.fwname),
-						  "hpnv", soc_type, ver, rom_ver, boardid);
+						  "wcnhpnv", soc_type, ver, rom_ver, boardid);
 			break;
 		case QCA_WCN7850:
 			qca_get_nvm_name_by_board(config.fwname, sizeof(config.fwname),
@@ -936,8 +944,17 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,
 
 	err = qca_download_firmware(hdev, &config, soc_type, rom_ver);
 	if (err < 0) {
-		bt_dev_err(hdev, "QCA Failed to download NVM (%d)", err);
-		return err;
+		if (!firmware_name && soc_type == QCA_WCN6855) {
+			qca_get_nvm_name_by_board(config.fwname, sizeof(config.fwname),
+						  "hpnv", soc_type, ver, rom_ver, boardid);
+			err = qca_download_firmware(hdev, &config, soc_type, rom_ver);
+		}
+
+		if (err) {
+			bt_dev_err(hdev, "QCA Failed to request file: %s (%d)",
+				   config.fwname, err);
+			return err;
+		}
 	}
 
 	switch (soc_type) {
-- 
2.34.1

Re: [PATCH v5 2/2] Bluetooth: btqca: Add WCN6855 firmware priority selection feature

[Dmitry Baryshkov]

On Wed, Dec 31, 2025 at 03:58:17PM +0800, Shuai Zhang wrote:
> Historically, WCN685x and QCA2066 shared the same firmware files.
> Now, changes are planned for the firmware that will make it incompatible
> with QCA2066, so a new firmware name is required for WCN685x.
> 
> Test Steps:
>  - Boot device
>  - Check the BTFW loading status via dmesg
> 
> Sanity pass and Test Log:
> QCA Downloading qca/wcnhpbftfw21.tlv
> Direct firmware load for qca/wcnhpbftfw21.tlv failed with error -2
> QCA Downloading qca/hpbftfw21.tlv
> 
> Signed-off-by: Shuai Zhang <shuai.zhang@oss.qualcomm.com>
> ---
>  drivers/bluetooth/btqca.c | 25 +++++++++++++++++++++----
>  1 file changed, 21 insertions(+), 4 deletions(-)
> @@ -936,8 +944,17 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,
>  
>  	err = qca_download_firmware(hdev, &config, soc_type, rom_ver);
>  	if (err < 0) {
> -		bt_dev_err(hdev, "QCA Failed to download NVM (%d)", err);
> -		return err;
> +		if (!firmware_name && soc_type == QCA_WCN6855) {

Same comment as for the first patch: move this one level up,
incorporating err < 0 check.

> +			qca_get_nvm_name_by_board(config.fwname, sizeof(config.fwname),
> +						  "hpnv", soc_type, ver, rom_ver, boardid);
> +			err = qca_download_firmware(hdev, &config, soc_type, rom_ver);
> +		}
> +
> +		if (err) {
> +			bt_dev_err(hdev, "QCA Failed to request file: %s (%d)",
> +				   config.fwname, err);
> +			return err;
> +		}
>  	}
>  
>  	switch (soc_type) {
> -- 
> 2.34.1
> 

-- 
With best wishes
Dmitry

Re: [PATCH v5 2/2] Bluetooth: btqca: Add WCN6855 firmware priority selection feature

[Shuai Zhang]

Dear

On 1/1/2026 1:23 AM, Dmitry Baryshkov wrote:
> On Wed, Dec 31, 2025 at 03:58:17PM +0800, Shuai Zhang wrote:
>> Historically, WCN685x and QCA2066 shared the same firmware files.
>> Now, changes are planned for the firmware that will make it incompatible
>> with QCA2066, so a new firmware name is required for WCN685x.
>>
>> Test Steps:
>>   - Boot device
>>   - Check the BTFW loading status via dmesg
>>
>> Sanity pass and Test Log:
>> QCA Downloading qca/wcnhpbftfw21.tlv
>> Direct firmware load for qca/wcnhpbftfw21.tlv failed with error -2
>> QCA Downloading qca/hpbftfw21.tlv
>>
>> Signed-off-by: Shuai Zhang <shuai.zhang@oss.qualcomm.com>
>> ---
>>   drivers/bluetooth/btqca.c | 25 +++++++++++++++++++++----
>>   1 file changed, 21 insertions(+), 4 deletions(-)
>> @@ -936,8 +944,17 @@ int qca_uart_setup(struct hci_dev *hdev, uint8_t baudrate,
>>   
>>   	err = qca_download_firmware(hdev, &config, soc_type, rom_ver);
>>   	if (err < 0) {
>> -		bt_dev_err(hdev, "QCA Failed to download NVM (%d)", err);
>> -		return err;
>> +		if (!firmware_name && soc_type == QCA_WCN6855) {
> Same comment as for the first patch: move this one level up,
> incorporating err < 0 check.


Thank you for your suggestion, I will update it.


>
>> +			qca_get_nvm_name_by_board(config.fwname, sizeof(config.fwname),
>> +						  "hpnv", soc_type, ver, rom_ver, boardid);
>> +			err = qca_download_firmware(hdev, &config, soc_type, rom_ver);
>> +		}
>> +
>> +		if (err) {
>> +			bt_dev_err(hdev, "QCA Failed to request file: %s (%d)",
>> +				   config.fwname, err);
>> +			return err;
>> +		}
>>   	}
>>   
>>   	switch (soc_type) {
>> -- 
>> 2.34.1
>>