[PATCH v2] driver: bluetooth: hci_qca: fix ssr fail when BT_EN is pulled up by hw

[PATCH v2] driver: bluetooth: hci_qca: fix ssr fail when BT_EN is pulled up by hw

[Shuai Zhang]

Q1：
If the SoC always enables the bt_en pin via hardware and the driver
cannot control the bt_en pin of the SoC chip, then during SSR,
the QCA_SSR_TRIGGERED and QCA_IBS_DISABLED bits cannot be cleared.
This leads to a reset command timeout failure.

Fix1：
To address this, clear QCA_SSR_TRIGGERED and QCA_IBS_DISABLED bits
after the coredump collection is complete.
Also, add msleep delay to wait for controller to complete SSR.

Q2:
When the SSR (Sub-System Restart) duration exceeds 2 seconds, it triggers
host tx_idle_timeout, which sets host TX state to sleep. due to the
hardware pulling up bt_en, the firmware is not downloaded after the SSR.
As a result, the controller does not enter sleep mode. Consequently,
when the host sends a command afterward, it sends 0xFD to the controller,
but the controller does not respond, leading to a command timeout.

Fix2:
Reset the tx_idle_timer after SSR (Sub-System Restart).

Changes in v2:
- Modified the format.
- Add changes to fix tx_idle_timeout
- Link to v1: https://lore.kernel.org/all/20250609105553.3756688-1-quic_shuaz@quicinc.com/

Signed-off-by: Shuai Zhang <quic_shuaz@quicinc.com>
---
 drivers/bluetooth/hci_qca.c | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
index 4e56782b0..d415a3f31 100644
--- a/drivers/bluetooth/hci_qca.c
+++ b/drivers/bluetooth/hci_qca.c
@@ -1653,6 +1653,24 @@ static void qca_hw_error(struct hci_dev *hdev, u8 code)
 		skb_queue_purge(&qca->rx_memdump_q);
 	}
 
+	/* If the SoC always enables the bt_en pin via hardware and the driver
+	 * cannot control the bt_en pin of the SoC chip, then during SSR,
+	 * the QCA_SSR_TRIGGERED and QCA_IBS_DISABLED bits cannot be cleared.
+	 * This leads to a reset command timeout failure.
+	 *
+	 * To address this, clear QCA_SSR_TRIGGERED and QCA_IBS_DISABLED bits
+	 * after the coredump collection is complete.
+	 * Also, add msleep delay to wait for controller to complete SSR.
+	 */
+	if (!test_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks)) {
+		clear_bit(QCA_SSR_TRIGGERED, &qca->flags);
+		clear_bit(QCA_IBS_DISABLED, &qca->flags);
+		mod_timer(&qca->tx_idle_timer, jiffies +
+			  msecs_to_jiffies(qca->tx_idle_delay));
+		qca->tx_ibs_state = HCI_IBS_TX_AWAKE;
+		msleep(50);
+	}
+
 	clear_bit(QCA_HW_ERROR_EVENT, &qca->flags);
 }
 
@@ -2478,7 +2496,7 @@ static int qca_serdev_probe(struct serdev_device *serdev)
 			return PTR_ERR(qcadev->susclk);
 		}
 	}
-	
+
 	err = hci_uart_register_device(&qcadev->serdev_hu, &qca_proto);
 	if (err) {
 		BT_ERR("serdev registration failed");
-- 
2.34.1

RE: [v2] driver: bluetooth: hci_qca: fix ssr fail when BT_EN is pulled up by hw

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 2195 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=976474

---Test result---

Test Summary:
CheckPatch                    PENDING   0.33 seconds
GitLint                       PENDING   0.33 seconds
SubjectPrefix                 FAIL      0.32 seconds
BuildKernel                   PASS      25.64 seconds
CheckAllWarning               PASS      28.16 seconds
CheckSparse                   PASS      31.37 seconds
BuildKernel32                 PASS      25.80 seconds
TestRunnerSetup               PASS      478.55 seconds
TestRunner_l2cap-tester       PASS      25.47 seconds
TestRunner_iso-tester         PASS      38.83 seconds
TestRunner_bnep-tester        PASS      5.90 seconds
TestRunner_mgmt-tester        PASS      134.75 seconds
TestRunner_rfcomm-tester      PASS      9.22 seconds
TestRunner_sco-tester         PASS      14.83 seconds
TestRunner_ioctl-tester       PASS      10.07 seconds
TestRunner_mesh-tester        FAIL      11.37 seconds
TestRunner_smp-tester         PASS      8.53 seconds
TestRunner_userchan-tester    PASS      6.08 seconds
IncrementalBuild              PENDING   0.64 seconds

Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:

##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:

##############################
Test: SubjectPrefix - FAIL
Desc: Check subject contains "Bluetooth" prefix
Output:
"Bluetooth: " prefix is not specified in the subject
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner
Output:
Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0

Failed Test Cases
Mesh - Send cancel - 1                               Timed out    2.123 seconds
Mesh - Send cancel - 2                               Timed out    2.000 seconds
##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:



---
Regards,
Linux Bluetooth

Re: [PATCH v2] driver: bluetooth: hci_qca: fix ssr fail when BT_EN is pulled up by hw

[Shuai Zhang]

Dear all

On 2025/6/27 14:17, Shuai Zhang wrote:
> Q1：
> If the SoC always enables the bt_en pin via hardware and the driver
> cannot control the bt_en pin of the SoC chip, then during SSR,
> the QCA_SSR_TRIGGERED and QCA_IBS_DISABLED bits cannot be cleared.
> This leads to a reset command timeout failure.
> 
> Fix1：
> To address this, clear QCA_SSR_TRIGGERED and QCA_IBS_DISABLED bits
> after the coredump collection is complete.
> Also, add msleep delay to wait for controller to complete SSR.
> 
> Q2:
> When the SSR (Sub-System Restart) duration exceeds 2 seconds, it triggers
> host tx_idle_timeout, which sets host TX state to sleep. due to the
> hardware pulling up bt_en, the firmware is not downloaded after the SSR.
> As a result, the controller does not enter sleep mode. Consequently,
> when the host sends a command afterward, it sends 0xFD to the controller,
> but the controller does not respond, leading to a command timeout.
> 
> Fix2:
> Reset the tx_idle_timer after SSR (Sub-System Restart).
> 
> Changes in v2:
> - Modified the format.
> - Add changes to fix tx_idle_timeout
> - Link to v1: https://lore.kernel.org/all/20250609105553.3756688-1-quic_shuaz@quicinc.com/
> 
> Signed-off-by: Shuai Zhang <quic_shuaz@quicinc.com>
> ---
>  drivers/bluetooth/hci_qca.c | 20 +++++++++++++++++++-
>  1 file changed, 19 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
> index 4e56782b0..d415a3f31 100644
> --- a/drivers/bluetooth/hci_qca.c
> +++ b/drivers/bluetooth/hci_qca.c
> @@ -1653,6 +1653,24 @@ static void qca_hw_error(struct hci_dev *hdev, u8 code)
>  		skb_queue_purge(&qca->rx_memdump_q);
>  	}
>  
> +	/* If the SoC always enables the bt_en pin via hardware and the driver
> +	 * cannot control the bt_en pin of the SoC chip, then during SSR,
> +	 * the QCA_SSR_TRIGGERED and QCA_IBS_DISABLED bits cannot be cleared.
> +	 * This leads to a reset command timeout failure.
> +	 *
> +	 * To address this, clear QCA_SSR_TRIGGERED and QCA_IBS_DISABLED bits
> +	 * after the coredump collection is complete.
> +	 * Also, add msleep delay to wait for controller to complete SSR.
> +	 */
> +	if (!test_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks)) {
> +		clear_bit(QCA_SSR_TRIGGERED, &qca->flags);
> +		clear_bit(QCA_IBS_DISABLED, &qca->flags);
> +		mod_timer(&qca->tx_idle_timer, jiffies +
> +			  msecs_to_jiffies(qca->tx_idle_delay));
> +		qca->tx_ibs_state = HCI_IBS_TX_AWAKE;
> +		msleep(50);
> +	}
> +
>  	clear_bit(QCA_HW_ERROR_EVENT, &qca->flags);
>  }
>  
> @@ -2478,7 +2496,7 @@ static int qca_serdev_probe(struct serdev_device *serdev)
>  			return PTR_ERR(qcadev->susclk);
>  		}
>  	}
> -	
> +
>  	err = hci_uart_register_device(&qcadev->serdev_hu, &qca_proto);
>  	if (err) {
>  		BT_ERR("serdev registration failed");

Is there any update?

thanks,
Shuai

Re: [PATCH v2] driver: bluetooth: hci_qca: fix ssr fail when BT_EN is pulled up by hw

[Shuai Zhang]

+++

On 2025/7/7 15:22, Shuai Zhang wrote:
> Dear all
> 
> On 2025/6/27 14:17, Shuai Zhang wrote:
>> Q1：
>> If the SoC always enables the bt_en pin via hardware and the driver
>> cannot control the bt_en pin of the SoC chip, then during SSR,
>> the QCA_SSR_TRIGGERED and QCA_IBS_DISABLED bits cannot be cleared.
>> This leads to a reset command timeout failure.
>>
>> Fix1：
>> To address this, clear QCA_SSR_TRIGGERED and QCA_IBS_DISABLED bits
>> after the coredump collection is complete.
>> Also, add msleep delay to wait for controller to complete SSR.
>>
>> Q2:
>> When the SSR (Sub-System Restart) duration exceeds 2 seconds, it triggers
>> host tx_idle_timeout, which sets host TX state to sleep. due to the
>> hardware pulling up bt_en, the firmware is not downloaded after the SSR.
>> As a result, the controller does not enter sleep mode. Consequently,
>> when the host sends a command afterward, it sends 0xFD to the controller,
>> but the controller does not respond, leading to a command timeout.
>>
>> Fix2:
>> Reset the tx_idle_timer after SSR (Sub-System Restart).
>>
>> Changes in v2:
>> - Modified the format.
>> - Add changes to fix tx_idle_timeout
>> - Link to v1: https://lore.kernel.org/all/20250609105553.3756688-1-quic_shuaz@quicinc.com/
>>
>> Signed-off-by: Shuai Zhang <quic_shuaz@quicinc.com>
>> ---
>>  drivers/bluetooth/hci_qca.c | 20 +++++++++++++++++++-
>>  1 file changed, 19 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
>> index 4e56782b0..d415a3f31 100644
>> --- a/drivers/bluetooth/hci_qca.c
>> +++ b/drivers/bluetooth/hci_qca.c
>> @@ -1653,6 +1653,24 @@ static void qca_hw_error(struct hci_dev *hdev, u8 code)
>>  		skb_queue_purge(&qca->rx_memdump_q);
>>  	}
>>  
>> +	/* If the SoC always enables the bt_en pin via hardware and the driver
>> +	 * cannot control the bt_en pin of the SoC chip, then during SSR,
>> +	 * the QCA_SSR_TRIGGERED and QCA_IBS_DISABLED bits cannot be cleared.
>> +	 * This leads to a reset command timeout failure.
>> +	 *
>> +	 * To address this, clear QCA_SSR_TRIGGERED and QCA_IBS_DISABLED bits
>> +	 * after the coredump collection is complete.
>> +	 * Also, add msleep delay to wait for controller to complete SSR.
>> +	 */
>> +	if (!test_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks)) {
>> +		clear_bit(QCA_SSR_TRIGGERED, &qca->flags);
>> +		clear_bit(QCA_IBS_DISABLED, &qca->flags);
>> +		mod_timer(&qca->tx_idle_timer, jiffies +
>> +			  msecs_to_jiffies(qca->tx_idle_delay));
>> +		qca->tx_ibs_state = HCI_IBS_TX_AWAKE;
>> +		msleep(50);
>> +	}
>> +
>>  	clear_bit(QCA_HW_ERROR_EVENT, &qca->flags);
>>  }
>>  
>> @@ -2478,7 +2496,7 @@ static int qca_serdev_probe(struct serdev_device *serdev)
>>  			return PTR_ERR(qcadev->susclk);
>>  		}
>>  	}
>> -	
>> +
>>  	err = hci_uart_register_device(&qcadev->serdev_hu, &qca_proto);
>>  	if (err) {
>>  		BT_ERR("serdev registration failed");
> 
> Is there any update?
> 
> thanks,
> Shuai

Re: [PATCH v2] driver: bluetooth: hci_qca: fix ssr fail when BT_EN is pulled up by hw

[Luiz Augusto von Dentz]

Hi Shuai,

On Fri, Jun 27, 2025 at 2:17 AM Shuai Zhang <quic_shuaz@quicinc.com> wrote:
>
> Q1：
> If the SoC always enables the bt_en pin via hardware and the driver
> cannot control the bt_en pin of the SoC chip, then during SSR,
> the QCA_SSR_TRIGGERED and QCA_IBS_DISABLED bits cannot be cleared.
> This leads to a reset command timeout failure.
>
> Fix1：
> To address this, clear QCA_SSR_TRIGGERED and QCA_IBS_DISABLED bits
> after the coredump collection is complete.
> Also, add msleep delay to wait for controller to complete SSR.

Not sure why you are sending with Q and Fix tags, never seen this
format being used for kernel patches before, each fix shall be sent
separately.

> Q2:
> When the SSR (Sub-System Restart) duration exceeds 2 seconds, it triggers
> host tx_idle_timeout, which sets host TX state to sleep. due to the
> hardware pulling up bt_en, the firmware is not downloaded after the SSR.
> As a result, the controller does not enter sleep mode. Consequently,
> when the host sends a command afterward, it sends 0xFD to the controller,
> but the controller does not respond, leading to a command timeout.
>
> Fix2:
> Reset the tx_idle_timer after SSR (Sub-System Restart).
>
> Changes in v2:
> - Modified the format.
> - Add changes to fix tx_idle_timeout
> - Link to v1: https://lore.kernel.org/all/20250609105553.3756688-1-quic_shuaz@quicinc.com/

The version history shouldn't be part of patch description, either add
it as comments after the description or add a cover letter to capture
the history.

> Signed-off-by: Shuai Zhang <quic_shuaz@quicinc.com>
> ---
>  drivers/bluetooth/hci_qca.c | 20 +++++++++++++++++++-
>  1 file changed, 19 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
> index 4e56782b0..d415a3f31 100644
> --- a/drivers/bluetooth/hci_qca.c
> +++ b/drivers/bluetooth/hci_qca.c
> @@ -1653,6 +1653,24 @@ static void qca_hw_error(struct hci_dev *hdev, u8 code)
>                 skb_queue_purge(&qca->rx_memdump_q);
>         }
>
> +       /* If the SoC always enables the bt_en pin via hardware and the driver
> +        * cannot control the bt_en pin of the SoC chip, then during SSR,
> +        * the QCA_SSR_TRIGGERED and QCA_IBS_DISABLED bits cannot be cleared.
> +        * This leads to a reset command timeout failure.
> +        *
> +        * To address this, clear QCA_SSR_TRIGGERED and QCA_IBS_DISABLED bits
> +        * after the coredump collection is complete.
> +        * Also, add msleep delay to wait for controller to complete SSR.
> +        */
> +       if (!test_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks)) {
> +               clear_bit(QCA_SSR_TRIGGERED, &qca->flags);
> +               clear_bit(QCA_IBS_DISABLED, &qca->flags);
> +               mod_timer(&qca->tx_idle_timer, jiffies +
> +                         msecs_to_jiffies(qca->tx_idle_delay));
> +               qca->tx_ibs_state = HCI_IBS_TX_AWAKE;
> +               msleep(50);

This is probably racy since it doesn't seem you are able to validate
SSR has been completed after 50 ms.

> +       }
> +
>         clear_bit(QCA_HW_ERROR_EVENT, &qca->flags);
>  }
>
> @@ -2478,7 +2496,7 @@ static int qca_serdev_probe(struct serdev_device *serdev)
>                         return PTR_ERR(qcadev->susclk);
>                 }
>         }
> -
> +
>         err = hci_uart_register_device(&qcadev->serdev_hu, &qca_proto);
>         if (err) {
>                 BT_ERR("serdev registration failed");
> --
> 2.34.1
>
>


-- 
Luiz Augusto von Dentz

Re: [PATCH v2] driver: bluetooth: hci_qca: fix ssr fail when BT_EN is pulled up by hw

[Shuai Zhang]

Hi Luiz

On 2025/7/8 2:39, Luiz Augusto von Dentz wrote:
> Hi Shuai,
> 
> On Fri, Jun 27, 2025 at 2:17 AM Shuai Zhang <quic_shuaz@quicinc.com> wrote:
>>
>> Q1：
>> If the SoC always enables the bt_en pin via hardware and the driver
>> cannot control the bt_en pin of the SoC chip, then during SSR,
>> the QCA_SSR_TRIGGERED and QCA_IBS_DISABLED bits cannot be cleared.
>> This leads to a reset command timeout failure.
>>
>> Fix1：
>> To address this, clear QCA_SSR_TRIGGERED and QCA_IBS_DISABLED bits
>> after the coredump collection is complete.
>> Also, add msleep delay to wait for controller to complete SSR.
> 
> Not sure why you are sending with Q and Fix tags, never seen this
> format being used for kernel patches before, each fix shall be sent
> separately.

I will submit it in two parts.

> 
>> Q2:
>> When the SSR (Sub-System Restart) duration exceeds 2 seconds, it triggers
>> host tx_idle_timeout, which sets host TX state to sleep. due to the
>> hardware pulling up bt_en, the firmware is not downloaded after the SSR.
>> As a result, the controller does not enter sleep mode. Consequently,
>> when the host sends a command afterward, it sends 0xFD to the controller,
>> but the controller does not respond, leading to a command timeout.
>>
>> Fix2:
>> Reset the tx_idle_timer after SSR (Sub-System Restart).
>>
>> Changes in v2:
>> - Modified the format.
>> - Add changes to fix tx_idle_timeout
>> - Link to v1: https://lore.kernel.org/all/20250609105553.3756688-1-quic_shuaz@quicinc.com/
> 
> The version history shouldn't be part of patch description, either add
> it as comments after the description or add a cover letter to capture
> the history.

I will add a cover.

> 
>> Signed-off-by: Shuai Zhang <quic_shuaz@quicinc.com>
>> ---
>>  drivers/bluetooth/hci_qca.c | 20 +++++++++++++++++++-
>>  1 file changed, 19 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
>> index 4e56782b0..d415a3f31 100644
>> --- a/drivers/bluetooth/hci_qca.c
>> +++ b/drivers/bluetooth/hci_qca.c
>> @@ -1653,6 +1653,24 @@ static void qca_hw_error(struct hci_dev *hdev, u8 code)
>>                 skb_queue_purge(&qca->rx_memdump_q);
>>         }
>>
>> +       /* If the SoC always enables the bt_en pin via hardware and the driver
>> +        * cannot control the bt_en pin of the SoC chip, then during SSR,
>> +        * the QCA_SSR_TRIGGERED and QCA_IBS_DISABLED bits cannot be cleared.
>> +        * This leads to a reset command timeout failure.
>> +        *
>> +        * To address this, clear QCA_SSR_TRIGGERED and QCA_IBS_DISABLED bits
>> +        * after the coredump collection is complete.
>> +        * Also, add msleep delay to wait for controller to complete SSR.
>> +        */
>> +       if (!test_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks)) {
>> +               clear_bit(QCA_SSR_TRIGGERED, &qca->flags);
>> +               clear_bit(QCA_IBS_DISABLED, &qca->flags);
>> +               mod_timer(&qca->tx_idle_timer, jiffies +
>> +                         msecs_to_jiffies(qca->tx_idle_delay));
>> +               qca->tx_ibs_state = HCI_IBS_TX_AWAKE;
>> +               msleep(50);
> 
> This is probably racy since it doesn't seem you are able to validate
> SSR has been completed after 50 ms.

This position has already submitted the core dump data. Before sending the command, 
the controller should be allowed to stabilize.

From qca_regulator_init, it can be seen that the controller requires up to 50ms to stabilize
after powering on. Therefore, an additional 50ms delay is added at this position.

qca_regulator_init:

gpiod_set_value_cansleep(qcadev->bt_en, 0);
msleep(50);
gpiod_set_value_cansleep(qcadev->bt_en, 1);
msleep(50);

> 
>> +       }
>> +
>>         clear_bit(QCA_HW_ERROR_EVENT, &qca->flags);
>>  }
>>
>> @@ -2478,7 +2496,7 @@ static int qca_serdev_probe(struct serdev_device *serdev)
>>                         return PTR_ERR(qcadev->susclk);
>>                 }
>>         }
>> -
>> +
>>         err = hci_uart_register_device(&qcadev->serdev_hu, &qca_proto);
>>         if (err) {
>>                 BT_ERR("serdev registration failed");
>> --
>> 2.34.1
>>
>>
> 
> 
thanks,
shuai