From 5b7d0386a4e75c85479da0fbd9fd66a3e9201375 Mon Sep 17 00:00:00 2001 From: Michael McAllister Date: Wed, 21 Oct 2026 20:51:12 +0100 Subject: [PATCH] Bluetooth: qca: Fix the WCN3950 NVM baud rate offset WCN3950 uses the HCI transport tag layout that stores the UART baud rate at byte 1, like WCN3991. However, QCA_WCN3950 precedes QCA_WCN3991 in qca_btsoc_type, so qca_tlv_check_data() writes the baud rate to byte 2 instead. On a Motorola Moto G10 with WCN3950 and cmnv12.bin, configuring a 3 Mbps UART therefore leaves the NVM baud rate at its default 3.2 Mbps and overwrites the following byte. Firmware download completes, but the subsequent HCI_RESET times out and Bluetooth initialization fails. Include WCN3950 in the byte-1 case so the NVM baud rate matches the host UART without altering the following transport parameter. Fixes: d5712c511cb3 ("Bluetooth: qca: add WCN3950 support") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Michael McAllister Reviewed-by: Bartosz Golaszewski Signed-off-by: Luiz Augusto von Dentz --- drivers/bluetooth/btqca.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/bluetooth/btqca.c b/drivers/bluetooth/btqca.c index 22b08ab05b82..002307000d3c 100644 --- a/drivers/bluetooth/btqca.c +++ b/drivers/bluetooth/btqca.c @@ -426,7 +426,8 @@ static int qca_tlv_check_data(struct hci_dev *hdev, tlv_nvm->data[0] |= 0x80; /* UART Baud Rate */ - if (soc_type >= QCA_WCN3991) + if (soc_type == QCA_WCN3950 || + soc_type >= QCA_WCN3991) tlv_nvm->data[1] = nvm_baud_rate; else tlv_nvm->data[2] = nvm_baud_rate;