[PATCH bluetooth] Bluetooth: qca: Fix the WCN3950 NVM baud rate offset

[Michael McAllister <me@michaelmcallister.org>]

WCN3950 uses the HCI transport tag layout that stores the UART baud rate
at byte 1, like WCN3991. However, QCA_WCN3950 precedes QCA_WCN3991 in
qca_btsoc_type, so qca_tlv_check_data() writes the baud rate to byte 2
instead.

On a Motorola Moto G10 with WCN3950 and cmnv12.bin, configuring a 3 Mbps
UART therefore leaves the NVM baud rate at its default 3.2 Mbps and
overwrites the following byte. Firmware download completes, but the
subsequent HCI_RESET times out and Bluetooth initialization fails.

Include WCN3950 in the byte-1 case so the NVM baud rate matches the host
UART without altering the following transport parameter.

Fixes: d5712c511cb3 ("Bluetooth: qca: add WCN3950 support")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Michael McAllister <me@michaelmcallister.org>
---
Tested on a Motorola Moto G10 (SM4250/WCN3950) with cmnv12.bin and a
3 Mbps UART, using the same change on a local Linux 7.2.9 kernel:

  NVM tag 17 before: 95 11 0e 00 2e 00
  NVM tag 17 after:  95 0e 22 00 2e 00

Before the change, HCI_RESET after the NVM download times out (-110).
After the change, controller setup, discovery and controller power
cycling succeed. Other QCA controller variants were not hardware-tested.

Built drivers/bluetooth/btqca.o for arm64 with W=1 against the base below.
The current maintainer-tree build has not been booted on the phone.

AI assistance: Codex helped analyze the saved UART traces and kernel
source, prepare this change and commit message, and run the build and
style checks. The task was to fix the observed WCN3950 initialization
failure and prepare it for upstream submission.

 drivers/bluetooth/btqca.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btqca.c b/drivers/bluetooth/btqca.c
index 22b08ab05..002307000 100644
--- a/drivers/bluetooth/btqca.c
+++ b/drivers/bluetooth/btqca.c
@@ -426,7 +426,8 @@ static int qca_tlv_check_data(struct hci_dev *hdev,
 				tlv_nvm->data[0] |= 0x80;
 
 				/* UART Baud Rate */
-				if (soc_type >= QCA_WCN3991)
+				if (soc_type == QCA_WCN3950 ||
+				    soc_type >= QCA_WCN3991)
 					tlv_nvm->data[1] = nvm_baud_rate;
 				else
 					tlv_nvm->data[2] = nvm_baud_rate;

base-commit: 9b3b269829faa3a6264588cff6ef28da0ca5cee5
-- 
2.50.1 (Apple Git-155)