[RFC PATCH 0/1] Bluetooth: qca: Clear 5th byte in TLV tag 27 for WCN3950

[RFC PATCH 0/1] Bluetooth: qca: Clear 5th byte in TLV tag 27 for WCN3950

[Stanislavs Nilovs]

Hi,

Recently at work I was making a proof-of-concept for swithing our
WCN3950 setup from hciattach tool to hci_qca driver. With the NVM blobs
that we got from our vendor, the QCA drivers weren't working out of the
box. There were 2 symptoms observed:

1) The QCA pre-shutdown command (0xfc08) was always failing with
timeout:
Bluetooth: hci0: command 0xfc08 tx timeout

2) After few power cycles QCA driver was entering into "SoC crashed"
loop and wasn't able to recover. It could be that SoC stopped answering
to any commands.
[   76.546600][ T2315] Bluetooth: hci0: command 0x2008 tx timeout
[   76.559398][ T2315] Bluetooth: hci0: crash the soc to collect controller dump
[   84.706487][ T2315] Bluetooth: hci0: Injecting HCI hardware error event
[   84.713363][   T80] Bluetooth: hci0: mem_dump_status: 3
[   84.718645][   T80] Bluetooth: hci0: clearing allocated memory due to memdump timeout
[   84.792374][   T80] Bluetooth: hci0: setting up wcn399x
[   85.004363][   T80] Bluetooth: hci0: QCA Product ID   :0x0000000f
[   85.014503][   T80] Bluetooth: hci0: QCA SOC Version  :0x40070130
[   85.020682][   T80] Bluetooth: hci0: QCA ROM Version  :0x00000103
[   85.026816][   T80] Bluetooth: hci0: QCA Patch Version:0x00000001
[   85.053183][   T80] Bluetooth: hci0: QCA controller version 0x01300103
[   85.059987][   T80] Bluetooth: hci0: QCA Downloading bt/image/cmbtfw13.tlv
[   85.358930][   T80] Bluetooth: hci0: QCA Downloading bt/image/cmnv13.bin
[   85.436495][   T80] Bluetooth: hci0: QCA setup on UART is completed
[   87.458917][   T91] Bluetooth: hci0: command 0xfc14 tx timeout
[   87.464830][   T91] Bluetooth: hci0: crash the soc to collect controller dump
[   87.827568][  T106] Bluetooth: hci0: QCA collecting dump of size:196608
[   89.382355][    T8] Bluetooth: hci0: QCA memdump Done, received 196608, total 196608
[   95.458459][   T80] Bluetooth: hci0: QCA Change address cmd failed (-110)
[   95.470949][   T80] Bluetooth: hci0: mem_dump_status: 2
[   95.485343][   T80] Bluetooth: hci0: setting up wcn399x
[   95.678116][   T80] Bluetooth: hci0: QCA Product ID   :0x0000000f
[   95.688217][   T80] Bluetooth: hci0: QCA SOC Version  :0x40070130
[   95.694377][   T80] Bluetooth: hci0: QCA ROM Version  :0x00000103
[   95.700521][   T80] Bluetooth: hci0: QCA Patch Version:0x00000001
[   95.726263][   T80] Bluetooth: hci0: QCA controller version 0x01300103
[   95.732834][   T80] Bluetooth: hci0: QCA Downloading bt/image/cmbtfw13.tlv
[   96.022441][   T80] Bluetooth: hci0: QCA Downloading bt/image/cmnv13.bin
[   96.099833][   T80] Bluetooth: hci0: QCA setup on UART is completed
[   98.114243][  T779] Bluetooth: hci0: command 0xfc14 tx timeout
[   98.120160][  T779] Bluetooth: hci0: crash the soc to collect controller dump
[   98.485913][  T106] Bluetooth: hci0: QCA collecting dump of size:196608
[   99.964863][ T2268] Bluetooth: hci0: QCA memdump Done, received 196608, total 196608
[  106.210456][   T80] Bluetooth: hci0: QCA Change address cmd failed (-110)
[  106.222796][   T80] Bluetooth: hci0: mem_dump_status: 2
[  106.237541][   T80] Bluetooth: hci0: setting up wcn399x
[  106.445797][   T80] Bluetooth: hci0: QCA Product ID   :0x0000000f
[  106.455937][   T80] Bluetooth: hci0: QCA SOC Version  :0x40070130
[  106.462069][   T80] Bluetooth: hci0: QCA ROM Version  :0x00000103
[  106.468214][   T80] Bluetooth: hci0: QCA Patch Version:0x00000001
[  106.492522][   T80] Bluetooth: hci0: QCA controller version 0x01300103
[  106.499099][   T80] Bluetooth: hci0: QCA Downloading bt/image/cmbtfw13.tlv
[  106.774412][   T80] Bluetooth: hci0: QCA Downloading bt/image/cmnv13.bin
[  106.852931][   T80] Bluetooth: hci0: QCA setup on UART is completed
[  108.866237][   T91] Bluetooth: hci0: command 0xfc14 tx timeout
[  108.872172][   T91] Bluetooth: hci0: crash the soc to collect controller dump
[  109.238079][ T2268] Bluetooth: hci0: QCA collecting dump of size:196608
[  110.784410][  T106] Bluetooth: hci0: QCA memdump Done, received 196608, total 196608
(... and so on ...)

Note: These are traces from Linux 5.15, but the hci_qca and btqca
drivers were ported from master, however there are no BlueZ's hcid_*
APIs for dumps. Not sure if those produce different logs

We also had a different device (produced by different vendor) that has
the same WCN3950 Bluetooth controller. Out of curiosity, I have
exchanged NVMs and to my surprise - the other vendor worked like a
charm! No more pre-shutdown timeout and several loops of automated BT
tests haven't produced any errors.

When I started to compare the configs, there were only 2 differences
- one new tag number and a 5th byte in tag 27. And the answer was the
second one. In original ("bad") config the 5th byte was set to 0x04, but
a "good" blob had it to 0x00. When I have applied the fix to clear this
byte in btqca - the issues have disappeared even on original NVM. Still,
I don't know what this byte does and what the value 0x04 mean. We have
asked both our vendor and Qualcomm support, but no answer yet. Not sure
if anyone from Qualcomm's OSS maintainers knows what this field is
responsible for.

Also, since I can test only with one board and one Qualcomm's BT SoC I
am not sure if this is an issue somewhere on our board's config
(previously all was working fine when using hciattach, although it
didn't have IBS enabled) or, if not, is applicable to other controllers
too. That's why leaving this as an RFC.

Claude Opus 5 (Anthropic) was used to create scripts for dumping the TLV tag
values.

Stanislavs Nilovs (1):
  Bluetooth: qca: Clear 5th byte in TLV tag 27 for WCN3950

 drivers/bluetooth/btqca.c | 9 +++++++++
 1 file changed, 9 insertions(+)


base-commit: b118b617cd2c37f41cc4675f5f2cb219e22b6ed4
-- 
2.53.0

[RFC PATCH 1/1] Bluetooth: qca: Clear 5th byte in TLV tag 27 for WCN3950

[Stanislavs Nilovs]

This fixes an incompatibility issue of TLV with 5th byte set to some
value in Tag 27 (Deep Sleep) and the QCA driver for WCN3950 SoC. If the
value is set in TLV, then 2 symptoms are observed:

1) The QCA pre-shutdown command (0xfc08) always fails with timeout.

2) SoC becomes unstable. During power cycling test it could stop
    answering to any commands and QCA driver enters into the "SoC crashed"
    loop and can never recover.

Setting the 5th byte to 0 resolves both issues - pre-shutdown never
times out (so, is always replied) and no crash loops observed.

The Claude Opus 5 (Anthropic) was used to create scripts for dumping the
tag values from TLV files and compare the differences. The fix itself
was written by me and verified on real hardware.

Signed-off-by: Stanislavs Nilovs <valorcool@gmail.com>
---
 drivers/bluetooth/btqca.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/bluetooth/btqca.c b/drivers/bluetooth/btqca.c
index 60735b70d89a..a7302a3f9774 100644
--- a/drivers/bluetooth/btqca.c
+++ b/drivers/bluetooth/btqca.c
@@ -443,6 +443,15 @@ static int qca_tlv_check_data(struct hci_dev *hdev,
 				 */
 				tlv_nvm->data[0] |= 0x01;
 
+				/* The byte 5 in tag 27 (Deep Sleep) doesn't work with QCA driver.
+				 * If a value is set to anything other than 0, then module can
+				 * enter is some "endless" sleep and stops responding to our
+				 * commands, and the QCA driver enters into endless "SoC crash"
+				 * loop. Setting this byte to 0 resolves all problems.
+				 */
+				if (tag_len >= 5 && soc_type == QCA_WCN3950)
+					tlv_nvm->data[4] = 0x00;
+
 				break;
 			}
 
-- 
2.53.0