[PATCH v2 1/1] Bluetooth: btusb: Reclassify Qualcomm WCN6855 debug packets

[PATCH v2 1/1] Bluetooth: btusb: Reclassify Qualcomm WCN6855 debug packets

[Pascal Giard]

Some Qualcomm Bluetooth controllers, e.g., QCNFA765 with WCN6855
chip, send debug packets as ACL frames with header 0x2EDC.
The kernel misinterprets these as malformed ACL packets, causing
repeated errors:

  Bluetooth: hci0: ACL packet for unknown connection handle 3804

This can occur hundreds of times per minute, greatly cluttering logs.
On my computer, I am observing approximately 7 messages per second
when streaming audio to a speaker.

For Qualcomm controllers exchanging over UART, hci_qca.c already
filters out these debug packets. This patch is for controllers
not going through UART, but USB.

This patch uses the classify_pkt_type callback to reclassify the
packets with handle 0x2EDC as HCI_DIAG_PKT before they reach the
HCI layer. This change is only applied to Qualcomm devices marked
as BTUSB_QCA_WCN6855.

Tested on: Thinkpad T14 gen2 (AMD) with QCNFA765 (0489:E0D0)
Signed-off-by: Pascal Giard <pascal.giard@etsmtl.ca>
---
Changes in v2:
- Address reviewer feedback about 0x2EDC being a valid HCI handle
- Use classify_pkt_type callback instead of filtering in recv_acl
- Only apply to devices with BTUSB_QCA_WCN6855 quirk
---
 drivers/bluetooth/btusb.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 5e9ebf0c5312..256179ace853 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -1131,6 +1131,24 @@ static void btusb_qca_reset(struct hci_dev *hdev)
 	btusb_reset(hdev);
 }
 
+static u8 btusb_classify_qca_pkt_type(struct hci_dev *hdev, struct sk_buff *skb)
+{
+	/* Some Qualcomm controllers, e.g., QCNFA765 with WCN6855 chip, send debug
+	 * packets as ACL frames with connection handle 0x2EDC. These are not real
+	 * ACL packets and should be reclassified as HCI_DIAG_PKT to prevent
+	 * "ACL packet for unknown connection handle 3804" errors.
+	 */
+	if (skb->len >= 2) {
+		u16 handle = get_unaligned_le16(skb->data);
+
+		if (handle == 0x2EDC)
+			return HCI_DIAG_PKT;
+	}
+
+	/* Use default packet type for other packets */
+	return hci_skb_pkt_type(skb);
+}
+
 static inline void btusb_free_frags(struct btusb_data *data)
 {
 	unsigned long flags;
@@ -4201,6 +4219,7 @@ static int btusb_probe(struct usb_interface *intf,
 		data->recv_acl = btusb_recv_acl_qca;
 		hci_devcd_register(hdev, btusb_coredump_qca, btusb_dump_hdr_qca, NULL);
 		data->setup_on_usb = btusb_setup_qca;
+		hdev->classify_pkt_type = btusb_classify_qca_pkt_type;
 		hdev->shutdown = btusb_shutdown_qca;
 		hdev->set_bdaddr = btusb_set_bdaddr_wcn6855;
 		hdev->reset = btusb_qca_reset;
-- 
2.51.0

RE: [v2,1/1] Bluetooth: btusb: Reclassify Qualcomm WCN6855 debug packets

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 2377 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1009076

---Test result---

Test Summary:
CheckPatch                    PENDING   0.34 seconds
GitLint                       PENDING   0.54 seconds
SubjectPrefix                 PASS      0.12 seconds
BuildKernel                   PASS      24.35 seconds
CheckAllWarning               PASS      27.09 seconds
CheckSparse                   PASS      30.44 seconds
BuildKernel32                 PASS      24.45 seconds
TestRunnerSetup               PASS      490.10 seconds
TestRunner_l2cap-tester       PASS      24.39 seconds
TestRunner_iso-tester         PASS      70.08 seconds
TestRunner_bnep-tester        PASS      6.23 seconds
TestRunner_mgmt-tester        FAIL      118.04 seconds
TestRunner_rfcomm-tester      PASS      9.45 seconds
TestRunner_sco-tester         PASS      14.63 seconds
TestRunner_ioctl-tester       PASS      10.13 seconds
TestRunner_mesh-tester        FAIL      11.38 seconds
TestRunner_smp-tester         PASS      8.60 seconds
TestRunner_userchan-tester    PASS      6.50 seconds
IncrementalBuild              PENDING   0.60 seconds

Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:

##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:

##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 490, Passed: 484 (98.8%), Failed: 2, Not Run: 4

Failed Test Cases
Read Exp Feature - Success                           Failed       0.109 seconds
LL Privacy - Add Device 2 (2 Devices to AL)          Failed       0.177 seconds
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner
Output:
Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0

Failed Test Cases
Mesh - Send cancel - 1                               Timed out    1.785 seconds
Mesh - Send cancel - 2                               Timed out    1.994 seconds
##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:



---
Regards,
Linux Bluetooth

Re: [PATCH v2 1/1] Bluetooth: btusb: Reclassify Qualcomm WCN6855 debug packets

[Paul Menzel]

Dear Pascal,


Thank you for your patch.

Am 07.10.25 um 17:33 schrieb Pascal Giard:
> Some Qualcomm Bluetooth controllers, e.g., QCNFA765 with WCN6855
> chip, send debug packets as ACL frames with header 0x2EDC.
> The kernel misinterprets these as malformed ACL packets, causing
> repeated errors:
> 
>    Bluetooth: hci0: ACL packet for unknown connection handle 3804
> 
> This can occur hundreds of times per minute, greatly cluttering logs.
> On my computer, I am observing approximately 7 messages per second
> when streaming audio to a speaker.
> 
> For Qualcomm controllers exchanging over UART, hci_qca.c already
> filters out these debug packets. This patch is for controllers
> not going through UART, but USB.
> 
> This patch uses the classify_pkt_type callback to reclassify the
> packets with handle 0x2EDC as HCI_DIAG_PKT before they reach the
> HCI layer. This change is only applied to Qualcomm devices marked
> as BTUSB_QCA_WCN6855.
> 
> Tested on: Thinkpad T14 gen2 (AMD) with QCNFA765 (0489:E0D0)
> Signed-off-by: Pascal Giard <pascal.giard@etsmtl.ca>
> ---
> Changes in v2:
> - Address reviewer feedback about 0x2EDC being a valid HCI handle
> - Use classify_pkt_type callback instead of filtering in recv_acl
> - Only apply to devices with BTUSB_QCA_WCN6855 quirk

Outstanding commit message!

> ---
>   drivers/bluetooth/btusb.c | 19 +++++++++++++++++++
>   1 file changed, 19 insertions(+)
> 
> diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
> index 5e9ebf0c5312..256179ace853 100644
> --- a/drivers/bluetooth/btusb.c
> +++ b/drivers/bluetooth/btusb.c
> @@ -1131,6 +1131,24 @@ static void btusb_qca_reset(struct hci_dev *hdev)
>   	btusb_reset(hdev);
>   }
>   
> +static u8 btusb_classify_qca_pkt_type(struct hci_dev *hdev, struct sk_buff *skb)
> +{
> +	/* Some Qualcomm controllers, e.g., QCNFA765 with WCN6855 chip, send debug
> +	 * packets as ACL frames with connection handle 0x2EDC. These are not real
> +	 * ACL packets and should be reclassified as HCI_DIAG_PKT to prevent
> +	 * "ACL packet for unknown connection handle 3804" errors.
> +	 */
> +	if (skb->len >= 2) {
> +		u16 handle = get_unaligned_le16(skb->data);
> +
> +		if (handle == 0x2EDC)
> +			return HCI_DIAG_PKT;
> +	}
> +
> +	/* Use default packet type for other packets */
> +	return hci_skb_pkt_type(skb);
> +}
> +
>   static inline void btusb_free_frags(struct btusb_data *data)
>   {
>   	unsigned long flags;
> @@ -4201,6 +4219,7 @@ static int btusb_probe(struct usb_interface *intf,
>   		data->recv_acl = btusb_recv_acl_qca;
>   		hci_devcd_register(hdev, btusb_coredump_qca, btusb_dump_hdr_qca, NULL);
>   		data->setup_on_usb = btusb_setup_qca;
> +		hdev->classify_pkt_type = btusb_classify_qca_pkt_type;
>   		hdev->shutdown = btusb_shutdown_qca;
>   		hdev->set_bdaddr = btusb_set_bdaddr_wcn6855;
>   		hdev->reset = btusb_qca_reset;

Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>


Kind regards,

Paul

Re: [PATCH v2 1/1] Bluetooth: btusb: Reclassify Qualcomm WCN6855 debug packets

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Tue,  7 Oct 2025 11:33:15 -0400 you wrote:
> Some Qualcomm Bluetooth controllers, e.g., QCNFA765 with WCN6855
> chip, send debug packets as ACL frames with header 0x2EDC.
> The kernel misinterprets these as malformed ACL packets, causing
> repeated errors:
> 
>   Bluetooth: hci0: ACL packet for unknown connection handle 3804
> 
> [...]

Here is the summary with links:
  - [v2,1/1] Bluetooth: btusb: Reclassify Qualcomm WCN6855 debug packets
    https://git.kernel.org/bluetooth/bluetooth-next/c/dc74e6550388

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html