[PATCH bluetooth] Bluetooth: qca: Fix the WCN3950 NVM baud rate offset

[PATCH bluetooth] Bluetooth: qca: Fix the WCN3950 NVM baud rate offset

[Michael McAllister]

WCN3950 uses the HCI transport tag layout that stores the UART baud rate
at byte 1, like WCN3991. However, QCA_WCN3950 precedes QCA_WCN3991 in
qca_btsoc_type, so qca_tlv_check_data() writes the baud rate to byte 2
instead.

On a Motorola Moto G10 with WCN3950 and cmnv12.bin, configuring a 3 Mbps
UART therefore leaves the NVM baud rate at its default 3.2 Mbps and
overwrites the following byte. Firmware download completes, but the
subsequent HCI_RESET times out and Bluetooth initialization fails.

Include WCN3950 in the byte-1 case so the NVM baud rate matches the host
UART without altering the following transport parameter.

Fixes: d5712c511cb3 ("Bluetooth: qca: add WCN3950 support")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Michael McAllister <me@michaelmcallister.org>
---
Tested on a Motorola Moto G10 (SM4250/WCN3950) with cmnv12.bin and a
3 Mbps UART, using the same change on a local Linux 7.2.9 kernel:

  NVM tag 17 before: 95 11 0e 00 2e 00
  NVM tag 17 after:  95 0e 22 00 2e 00

Before the change, HCI_RESET after the NVM download times out (-110).
After the change, controller setup, discovery and controller power
cycling succeed. Other QCA controller variants were not hardware-tested.

Built drivers/bluetooth/btqca.o for arm64 with W=1 against the base below.
The current maintainer-tree build has not been booted on the phone.

AI assistance: Codex helped analyze the saved UART traces and kernel
source, prepare this change and commit message, and run the build and
style checks. The task was to fix the observed WCN3950 initialization
failure and prepare it for upstream submission.

 drivers/bluetooth/btqca.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btqca.c b/drivers/bluetooth/btqca.c
index 22b08ab05..002307000 100644
--- a/drivers/bluetooth/btqca.c
+++ b/drivers/bluetooth/btqca.c
@@ -426,7 +426,8 @@ static int qca_tlv_check_data(struct hci_dev *hdev,
 				tlv_nvm->data[0] |= 0x80;
 
 				/* UART Baud Rate */
-				if (soc_type >= QCA_WCN3991)
+				if (soc_type == QCA_WCN3950 ||
+				    soc_type >= QCA_WCN3991)
 					tlv_nvm->data[1] = nvm_baud_rate;
 				else
 					tlv_nvm->data[2] = nvm_baud_rate;

base-commit: 9b3b269829faa3a6264588cff6ef28da0ca5cee5
-- 
2.50.1 (Apple Git-155)

RE: Bluetooth: qca: Fix the WCN3950 NVM baud rate offset

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1019 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1190806/

---Test result---

Test Summary:
CheckPatch                    PASS      0.50 seconds
VerifyFixes                   PASS      0.09 seconds
VerifySignedoff               PASS      0.09 seconds
GitLint                       PASS      0.23 seconds
SubjectPrefix                 PASS      0.08 seconds
BuildKernel                   PASS      20.29 seconds
CheckAllWarning               PASS      23.92 seconds
CheckSparse                   PASS      26.61 seconds
BuildKernel32                 PASS      22.23 seconds
CheckKernelLLVM               PASS      23.01 seconds
TestRunnerSetup               PASS      464.33 seconds
IncrementalBuild              PASS      20.55 seconds



https://github.com/bluez/bluetooth-next/pull/975

---
Regards,
Linux Bluetooth

Re: [PATCH bluetooth] Bluetooth: qca: Fix the WCN3950 NVM baud rate offset

[Bartosz Golaszewski]

On Wed, 21 Oct 2026 21:51:12 +0200, Michael McAllister
<me@michaelmcallister.org> said:
> WCN3950 uses the HCI transport tag layout that stores the UART baud rate
> at byte 1, like WCN3991. However, QCA_WCN3950 precedes QCA_WCN3991 in
> qca_btsoc_type, so qca_tlv_check_data() writes the baud rate to byte 2
> instead.
>
> On a Motorola Moto G10 with WCN3950 and cmnv12.bin, configuring a 3 Mbps
> UART therefore leaves the NVM baud rate at its default 3.2 Mbps and
> overwrites the following byte. Firmware download completes, but the
> subsequent HCI_RESET times out and Bluetooth initialization fails.
>
> Include WCN3950 in the byte-1 case so the NVM baud rate matches the host
> UART without altering the following transport parameter.
>
> Fixes: d5712c511cb3 ("Bluetooth: qca: add WCN3950 support")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM

This tag is now gone, you don't have to add it.

> Signed-off-by: Michael McAllister <me@michaelmcallister.org>
> ---

Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

Re: [PATCH bluetooth] Bluetooth: qca: Fix the WCN3950 NVM baud rate offset

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Wed, 21 Oct 2026 20:51:12 +0100 you wrote:
> WCN3950 uses the HCI transport tag layout that stores the UART baud rate
> at byte 1, like WCN3991. However, QCA_WCN3950 precedes QCA_WCN3991 in
> qca_btsoc_type, so qca_tlv_check_data() writes the baud rate to byte 2
> instead.
> 
> On a Motorola Moto G10 with WCN3950 and cmnv12.bin, configuring a 3 Mbps
> UART therefore leaves the NVM baud rate at its default 3.2 Mbps and
> overwrites the following byte. Firmware download completes, but the
> subsequent HCI_RESET times out and Bluetooth initialization fails.
> 
> [...]

Here is the summary with links:
  - Bluetooth: qca: Fix the WCN3950 NVM baud rate offset
    https://git.kernel.org/bluetooth/bluetooth-next/c/24a4c2f1f7ce

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH bluetooth] Bluetooth: qca: Fix the WCN3950 NVM baud rate offset

[Dmitry Baryshkov]

On Wed, Oct 21, 2026 at 08:51:12PM +0100, Michael McAllister wrote:
> WCN3950 uses the HCI transport tag layout that stores the UART baud rate
> at byte 1, like WCN3991. However, QCA_WCN3950 precedes QCA_WCN3991 in
> qca_btsoc_type, so qca_tlv_check_data() writes the baud rate to byte 2
> instead.
> 
> On a Motorola Moto G10 with WCN3950 and cmnv12.bin, configuring a 3 Mbps
> UART therefore leaves the NVM baud rate at its default 3.2 Mbps and
> overwrites the following byte. Firmware download completes, but the
> subsequent HCI_RESET times out and Bluetooth initialization fails.
> 
> Include WCN3950 in the byte-1 case so the NVM baud rate matches the host
> UART without altering the following transport parameter.
> 
> Fixes: d5712c511cb3 ("Bluetooth: qca: add WCN3950 support")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Michael McAllister <me@michaelmcallister.org>

Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>


-- 
With best wishes
Dmitry