Commit 0b00bee9 authored Oct 07, 2025 by Pascal Giard Committed by Luiz Augusto von Dentz Dec 01, 2025

Bluetooth: btusb: Reclassify Qualcomm WCN6855 debug packets



Some Qualcomm Bluetooth controllers, e.g., QCNFA765 with WCN6855
chip, send debug packets as ACL frames with header 0x2EDC.
The kernel misinterprets these as malformed ACL packets, causing
repeated errors:

  Bluetooth: hci0: ACL packet for unknown connection handle 3804

This can occur hundreds of times per minute, greatly cluttering logs.
On my computer, I am observing approximately 7 messages per second
when streaming audio to a speaker.

For Qualcomm controllers exchanging over UART, hci_qca.c already
filters out these debug packets. This patch is for controllers
not going through UART, but USB.

This patch uses the classify_pkt_type callback to reclassify the
packets with handle 0x2EDC as HCI_DIAG_PKT before they reach the
HCI layer. This change is only applied to Qualcomm devices marked
as BTUSB_QCA_WCN6855.

Tested on: Thinkpad T14 gen2 (AMD) with QCNFA765 (0489:E0D0)
Signed-off-by: Pascal Giard <pascal.giard@etsmtl.ca>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

parent 8dbbb542

drivers/bluetooth/btusb.c

+19 −0

Original line number	Diff line number	Diff line
		@@ -1137,6 +1137,24 @@ static void btusb_qca_reset(struct hci_dev *hdev)
		btusb_reset(hdev);
		}

		static u8 btusb_classify_qca_pkt_type(struct hci_dev hdev, struct sk_buff skb)
		{
		/* Some Qualcomm controllers, e.g., QCNFA765 with WCN6855 chip, send debug
		* packets as ACL frames with connection handle 0x2EDC. These are not real
		* ACL packets and should be reclassified as HCI_DIAG_PKT to prevent
		* "ACL packet for unknown connection handle 3804" errors.
		*/
		if (skb->len >= 2) {
		u16 handle = get_unaligned_le16(skb->data);

		if (handle == 0x2EDC)
		return HCI_DIAG_PKT;
		}

		/* Use default packet type for other packets */
		return hci_skb_pkt_type(skb);
		}

		static inline void btusb_free_frags(struct btusb_data *data)
		{
		unsigned long flags;
		@@ -4245,6 +4263,7 @@ static int btusb_probe(struct usb_interface *intf,
		data->recv_acl = btusb_recv_acl_qca;
		hci_devcd_register(hdev, btusb_coredump_qca, btusb_dump_hdr_qca, NULL);
		data->setup_on_usb = btusb_setup_qca;
		hdev->classify_pkt_type = btusb_classify_qca_pkt_type;
		hdev->shutdown = btusb_shutdown_qca;
		hdev->set_bdaddr = btusb_set_bdaddr_wcn6855;
		hdev->reset = btusb_qca_reset;