[PATCH bluetooth] Bluetooth: qca: Fix the WCN3950 NVM baud rate offset

[PATCH bluetooth] Bluetooth: qca: Fix the WCN3950 NVM baud rate offset

[Michael McAllister]

WCN3950 uses the HCI transport tag layout that stores the UART baud rate
at byte 1, like WCN3991. However, QCA_WCN3950 precedes QCA_WCN3991 in
qca_btsoc_type, so qca_tlv_check_data() writes the baud rate to byte 2
instead.

On a Motorola Moto G10 with WCN3950 and cmnv12.bin, configuring a 3 Mbps
UART therefore leaves the NVM baud rate at its default 3.2 Mbps and
overwrites the following byte. Firmware download completes, but the
subsequent HCI_RESET times out and Bluetooth initialization fails.

Include WCN3950 in the byte-1 case so the NVM baud rate matches the host
UART without altering the following transport parameter.

Fixes: d5712c511cb3 ("Bluetooth: qca: add WCN3950 support")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Michael McAllister <me@michaelmcallister.org>
---
Tested on a Motorola Moto G10 (SM4250/WCN3950) with cmnv12.bin and a
3 Mbps UART, using the same change on a local Linux 7.2.9 kernel:

  NVM tag 17 before: 95 11 0e 00 2e 00
  NVM tag 17 after:  95 0e 22 00 2e 00

Before the change, HCI_RESET after the NVM download times out (-110).
After the change, controller setup, discovery and controller power
cycling succeed. Other QCA controller variants were not hardware-tested.

Built drivers/bluetooth/btqca.o for arm64 with W=1 against the base below.
The current maintainer-tree build has not been booted on the phone.

AI assistance: Codex helped analyze the saved UART traces and kernel
source, prepare this change and commit message, and run the build and
style checks. The task was to fix the observed WCN3950 initialization
failure and prepare it for upstream submission.

 drivers/bluetooth/btqca.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btqca.c b/drivers/bluetooth/btqca.c
index 22b08ab05..002307000 100644
--- a/drivers/bluetooth/btqca.c
+++ b/drivers/bluetooth/btqca.c
@@ -426,7 +426,8 @@ static int qca_tlv_check_data(struct hci_dev *hdev,
 				tlv_nvm->data[0] |= 0x80;
 
 				/* UART Baud Rate */
-				if (soc_type >= QCA_WCN3991)
+				if (soc_type == QCA_WCN3950 ||
+				    soc_type >= QCA_WCN3991)
 					tlv_nvm->data[1] = nvm_baud_rate;
 				else
 					tlv_nvm->data[2] = nvm_baud_rate;

base-commit: 9b3b269829faa3a6264588cff6ef28da0ca5cee5
-- 
2.50.1 (Apple Git-155)

Re: [PATCH bluetooth] Bluetooth: qca: Fix the WCN3950 NVM baud rate offset

[Bartosz Golaszewski]

On Wed, 21 Oct 2026 21:51:12 +0200, Michael McAllister
<me@michaelmcallister.org> said:
> WCN3950 uses the HCI transport tag layout that stores the UART baud rate
> at byte 1, like WCN3991. However, QCA_WCN3950 precedes QCA_WCN3991 in
> qca_btsoc_type, so qca_tlv_check_data() writes the baud rate to byte 2
> instead.
>
> On a Motorola Moto G10 with WCN3950 and cmnv12.bin, configuring a 3 Mbps
> UART therefore leaves the NVM baud rate at its default 3.2 Mbps and
> overwrites the following byte. Firmware download completes, but the
> subsequent HCI_RESET times out and Bluetooth initialization fails.
>
> Include WCN3950 in the byte-1 case so the NVM baud rate matches the host
> UART without altering the following transport parameter.
>
> Fixes: d5712c511cb3 ("Bluetooth: qca: add WCN3950 support")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM

This tag is now gone, you don't have to add it.

> Signed-off-by: Michael McAllister <me@michaelmcallister.org>
> ---

Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

Re: [PATCH bluetooth] Bluetooth: qca: Fix the WCN3950 NVM baud rate offset

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Wed, 21 Oct 2026 20:51:12 +0100 you wrote:
> WCN3950 uses the HCI transport tag layout that stores the UART baud rate
> at byte 1, like WCN3991. However, QCA_WCN3950 precedes QCA_WCN3991 in
> qca_btsoc_type, so qca_tlv_check_data() writes the baud rate to byte 2
> instead.
> 
> On a Motorola Moto G10 with WCN3950 and cmnv12.bin, configuring a 3 Mbps
> UART therefore leaves the NVM baud rate at its default 3.2 Mbps and
> overwrites the following byte. Firmware download completes, but the
> subsequent HCI_RESET times out and Bluetooth initialization fails.
> 
> [...]

Here is the summary with links:
  - Bluetooth: qca: Fix the WCN3950 NVM baud rate offset
    https://git.kernel.org/bluetooth/bluetooth-next/c/24a4c2f1f7ce

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH bluetooth] Bluetooth: qca: Fix the WCN3950 NVM baud rate offset

[Dmitry Baryshkov]

On Wed, Oct 21, 2026 at 08:51:12PM +0100, Michael McAllister wrote:
> WCN3950 uses the HCI transport tag layout that stores the UART baud rate
> at byte 1, like WCN3991. However, QCA_WCN3950 precedes QCA_WCN3991 in
> qca_btsoc_type, so qca_tlv_check_data() writes the baud rate to byte 2
> instead.
> 
> On a Motorola Moto G10 with WCN3950 and cmnv12.bin, configuring a 3 Mbps
> UART therefore leaves the NVM baud rate at its default 3.2 Mbps and
> overwrites the following byte. Firmware download completes, but the
> subsequent HCI_RESET times out and Bluetooth initialization fails.
> 
> Include WCN3950 in the byte-1 case so the NVM baud rate matches the host
> UART without altering the following transport parameter.
> 
> Fixes: d5712c511cb3 ("Bluetooth: qca: add WCN3950 support")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Michael McAllister <me@michaelmcallister.org>

Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>


-- 
With best wishes
Dmitry