rtw89: BT connect state differs between scoreboard and bt_info on RTL8851B

rtw89: BT connect state differs between scoreboard and bt_info on RTL8851B

[Maxim Skokov]

On RTL8851B with an A2DP sink connected and playing, btc_info shows
bt->link_info.status.map.connect flipping between Y and N, while the
scoreboard value stays the same:

  reason                connect   action     BT0->WL
  NTFY_RADIO_STATE      N         WL_OFF     0x40000013
  UPDATE_BT_INFO        Y         FREERUN    0x40000013
  UPDATE_BT_INFO        Y         FREERUN    0x40000013
  NTFY_RADIO_STATE      N         WL_OFF     0x40000013

BTC_BSCB_BT_CONNECT, BIT(16), is never set in BT0->WL, while the bt_info
mailbox reports the device as connected:

  [bt_info] : raw_data[49 00 d0 00 04 00]
              raw_info[2] = 0x49: connect=1, acl_busy=1, a2dp=1
              raw_info[6] = 0x04: a2dp_active=1

The field is written from both paths, _update_bt_info() and the
scoreboard read in _update_bt_scbd(), so it ends up holding whichever
event arrived last.

Is the scoreboard connect bit expected to be set by BT firmware here, or
is the mailbox the authoritative source and the scoreboard write
intentional?

WL_FW 0.29.41.3, BT_FW 0xf8ad230(patch), Coex 9.24.1, kernel 7.3.0-rc1.

Re: rtw89: BT connect state differs between scoreboard and bt_info on RTL8851B

[Maxim Skokov]

Same on WL_FW 0.29.41.5, the newest in linux-firmware, with the sink
connected and playing:

  [status]     : enable:Y, btg:N, connect:N, mailbox_avl:Y
  [profile]    : profile: , A2DP_active:Y, PAN_active:N
  [bt_info]    : raw_data[49 00 d0 00 04 00] (type:auto/cnt:82/same:3)
  [scoreboard] : BT0->WL:0x40000003(total:0, bt_update:26)

BTC_BSCB_BT_CONNECT is not set here either.

Two further notes.

BTC_BSCB_A2DP_ACT was set before I reloaded the driver (BT0->WL was
0x40000013) and is not set after, with the sink connected and streaming
throughout. bt_update does not advance, so BT firmware appears to send a
scoreboard update only on change, and the state the driver lost on
rmmod/insmod is never restored.

The cycle reports are unavailable on this firmware, which is why I have no
slot statistics to go with this: fcxcysta[0/5], fcxslots[0/1],
fcxstep[0/3], fcxnullsta[0/2].

RE: rtw89: BT connect state differs between scoreboard and bt_info on RTL8851B

[Ping-Ke Shih]

[-- Attachment #1: Type: text/plain, Size: 559 bytes --]

Maxim Skokov <skokovmaksimevg@gmail.com> wrote:
> Same on WL_FW 0.29.41.5, the newest in linux-firmware, with the sink
> connected and playing:
> 
>   [status]     : enable:Y, btg:N, connect:N, mailbox_avl:Y
>   [profile]    : profile: , A2DP_active:Y, PAN_active:N
>   [bt_info]    : raw_data[49 00 d0 00 04 00] (type:auto/cnt:82/same:3)
>   [scoreboard] : BT0->WL:0x40000003(total:0, bt_update:26)
> 
> BTC_BSCB_BT_CONNECT is not set here either.

We found the problem recently, and ongoing to send out the patch. 
Please try the attachment.


[-- Attachment #2: 20260916_00_patch_for_scoreboard.patch --]
[-- Type: application/octet-stream, Size: 2817 bytes --]

diff --git a/drivers/net/wireless/realtek/rtw89/coex.c b/drivers/net/wireless/realtek/rtw89/coex.c
index 5a9dc4d8a00b..df49f62f566b 100644
--- a/drivers/net/wireless/realtek/rtw89/coex.c
+++ b/drivers/net/wireless/realtek/rtw89/coex.c
@@ -1000,7 +1000,7 @@ static void _run_coex(struct rtw89_dev *rtwdev,
 		      enum btc_reason_and_action reason);
 static void _write_scbd(struct rtw89_dev *rtwdev, u8 bid, u32 val, bool state);
 static u8 _sned_h2c_w2bscbd(struct rtw89_dev *rtwdev, bool force_exec, u8 bid);
-static void _update_bt_scbd(struct rtw89_dev *rtwdev, u8 bid);
+static void _update_bt_scbd(struct rtw89_dev *rtwdev, u8 bid, bool is_c2h);
 static const char *id_to_h2c(u32 id);
 
 static void _reset_h2c_macro(struct rtw89_btc *btc)
@@ -3602,7 +3602,7 @@ void btc_fw_event(struct rtw89_dev *rtwdev, u8 evt_id, void *data, u32 len)
 				    "[BTC], %s() bt%d:c2h->0x%08x, rb->0x%08x\n",
 				    __func__, i, bt->scbd_c2h, bt->scbd_rb);
 			bt->scbd_c2h = bt->scbd_rb;
-			_update_bt_scbd(rtwdev, i);
+			_update_bt_scbd(rtwdev, i, true);
 			btc->dm.scbd_b2w_update = false;
 		}
 	}
@@ -7805,7 +7805,21 @@ static void _update_bt_ctrl_lps(struct rtw89_dev *rtwdev)
 	}
 }
 
-static void _update_bt_scbd(struct rtw89_dev *rtwdev, u8 bid)
+static u32 _read_scbd(struct rtw89_dev *rtwdev, u8 id)
+{
+	const struct rtw89_chip_info *chip = rtwdev->chip;
+	u32 val;
+
+	if (!chip->scbd)
+		return 0;
+
+	val = rtw89_read32(rtwdev, chip->btc_sb.n[id].get);
+	rtw89_debug(rtwdev, RTW89_DBG_BTC,
+		    "[BTC], read scbd bt%d: 0x%08x\n", id, val);
+	return val;
+}
+
+static void _update_bt_scbd(struct rtw89_dev *rtwdev, u8 bid, bool is_c2h)
 {
 	struct rtw89_btc_bt_link_info *bt_2g, *bt_56g;
 	struct rtw89_btc *btc = &rtwdev->btc;
@@ -7838,7 +7852,7 @@ static void _update_bt_scbd(struct rtw89_dev *rtwdev, u8 bid)
 		if (!(rtwdev->chip->para_ver & BTC_FEAT_DUAL_BT) && id == BTC_BT_2ND)
 			break;
 
-		val = bt->scbd_c2h;
+		val = is_c2h ? bt->scbd_c2h : _read_scbd(rtwdev, id);
 
 		if (val == 0xffffffff) {
 			rtw89_debug(rtwdev, RTW89_DBG_BTC,
@@ -8473,8 +8487,8 @@ void _run_coex(struct rtw89_dev *rtwdev, enum btc_reason_and_action reason)
 
 	_update_run_ctrl_info(rtwdev);
 
-	if (reason == BTC_RSN_NTFY_INIT || reason == BTC_RSN_NTFY_RADIO_STATE)
-		_update_bt_scbd(rtwdev, false);
+	if (reason == BTC_RSN_NTFY_RADIO_STATE)
+		_update_bt_scbd(rtwdev, BTC_ALL_BT, false);
 
 	dm->freerun = false;
 	dm->cnt_dm[BTC_DCNT_RUN]++;
@@ -9814,7 +9828,7 @@ void rtw89_btc_c2h_handle(struct rtw89_dev *rtwdev, struct sk_buff *skb,
 		rtw89_debug(rtwdev, RTW89_DBG_BTC,
 			    "[BTC], handle C2H BT%d SCBD with data 0x%08x\n",
 			    bid, bt->scbd_c2h);
-		_update_bt_scbd(rtwdev, bid);
+		_update_bt_scbd(rtwdev, bid, true);
 		_run_coex(rtwdev, BTC_RSN_UPDATE_BT_SCBD);
 		break;
 	case BTF_EVNT_BT_PSD:

Re: rtw89: BT connect state differs between scoreboard and bt_info on RTL8851B

[Maxim Skokov]

> We found the problem recently, and ongoing to send out the patch.
> Please try the attachment.

Applied on 7.3.0-rc1, rebuilt the rtw89 modules only. RTL8851BE,
WL_FW 0.29.41.5.

The hardware read works. With RTW89_DBG_BTC on, during a radio state
change:

  [BTC], read scbd bt0: 0x40000013
  [BTC], read scbd bt0: 0xc0000013

BTC_BSCB_BT_CONNECT, BIT(16), is not set in either value, so the register
holds what the C2H path was already reporting.

status.map.connect still alternates. 90 samples of btc_info, one per
second, with the mechanism reason and the WL link mode beside it:

  16  connect:Y  reason:UPDATE_BT_INFO   link_mode:STA
   1  connect:Y  reason:NTFY_SWBAND      link_mode:STA
  70  connect:N  reason:NTFY_POWEROFF    link_mode:STA
   2  connect:N  reason:UPDATE_BT_SCBD   link_mode:STA
   1  connect:N  reason:NTFY_SCAN_START  link_mode:STA

The same sampling on the unpatched module, 30 samples two seconds apart,
gave 28 N and 2 Y, so this part is unchanged.

The mailbox reports the device as connected throughout:
raw_data[49 01 c9 00 04 00], so raw_info[2] = 0x49 and lb2.connect = 1,
with A2DP_active:Y. The sink was connected and playing for all of the
above, and WL stayed in STA mode, retrying association without completing
it.

Is BTC_BSCB_BT_CONNECT expected to be set by BT firmware on this chip? If
not, status.map.connect will keep being overwritten from the scoreboard
after _update_bt_info() has written it from the mailbox.