Bug 220061

*** Bug 220063 has been marked as a duplicate of this bug. ***

Could you please share bluetoothd logs and HCI logs (by running 'btmon -w /tmp/btsnoop.log')?

        Num handles: 1
        Handle: 71 Address: 40:1B:5F:B9:B2:8B (WEIFANG GOERTEK ELECTRONICS CO.,LTD)
        Count: 2
        #41: len 310 (620 Kb/s)
        Latency: 4 msec (3-15 msec ~6 msec)
        Channel: 64 [PSM 1 mode Basic (0x00)] {chan 0}
        Channel Latency: 4 msec (4-6 msec ~5 msec)
        #42: len 36 (72 Kb/s)
        Latency: 4 msec (3-15 msec ~5 msec)
> ACL Data RX: Handle 71 flags 0x02 dlen 12                #44 [hci0] 14.452447
      L2CAP: Disconnection Request (0x06) ident 3 len 4
        Destination CID: 64
        Source CID: 64
< ACL Data TX: Handle 71 flags 0x00 dlen 12                #45 [hci0] 14.452457
      L2CAP: Disconnection Response (0x07) ident 3 len 4
        Destination CID: 64
        Source CID: 64
> HCI Event: Number of Completed Packets (0x13) plen 5     #46 [hci0] 14.457375
        Num handles: 1
        Handle: 71 Address: 40:1B:5F:B9:B2:8B (WEIFANG GOERTEK ELECTRONICS CO.,LTD)
        Count: 1
        #45: len 12 (24 Kb/s)
        Latency: 4 msec (3-15 msec ~5 msec)
> HCI Event: Link Key Request (0x17) plen 6                #47 [hci0] 14.574608
        Address: 40:1B:5F:B9:B2:8B (WEIFANG GOERTEK ELECTRONICS CO.,LTD)
< HCI Command: Link Key Request R.. (0x01|0x000b) plen 22  #48 [hci0] 14.574651
        Address: 40:1B:5F:B9:B2:8B (WEIFANG GOERTEK ELECTRONICS CO.,LTD)
        Link key[16]: b4f8956a4b3d885efebf3a63647ab89b
> HCI Event: Command Complete (0x0e) plen 10               #49 [hci0] 14.580396
      Link Key Request Reply (0x01|0x000b) ncmd 1
        Status: Success (0x00)
        Address: 40:1B:5F:B9:B2:8B (WEIFANG GOERTEK ELECTRONICS CO.,LTD)
> HCI Event: Encryption Change (0x08) plen 4               #50 [hci0] 14.630399
        Status: Success (0x00)
        Handle: 71 Address: 40:1B:5F:B9:B2:8B (WEIFANG GOERTEK ELECTRONICS CO.,LTD)
        Encryption: Enabled with E0 (0x01)
< HCI Command: Read Encryption Key.. (0x05|0x0008) plen 2  #51 [hci0] 14.630430
        Handle: 71 Address: 40:1B:5F:B9:B2:8B (WEIFANG GOERTEK ELECTRONICS CO.,LTD)
> ACL Data RX: Handle 71 flags 0x02 dlen 12                #52 [hci0] 14.632472
      L2CAP: Connection Request (0x02) ident 4 len 4
        PSM: 17 (0x0011)
        Source CID: 65
< ACL Data TX: Handle 71 flags 0x00 dlen 16                #53 [hci0] 14.632509
      L2CAP: Connection Response (0x03) ident 4 len 8
        Destination CID: 0
        Source CID: 65
        Result: Connection refused - security block (0x0003)
        Status: No further information available (0x0000)
> HCI Event: Command Complete (0x0e) plen 7                #54 [hci0] 14.635400
      Read Encryption Key Size (0x05|0x0008) ncmd 1
        Status: Success (0x00)
        Handle: 71 Address: 40:1B:5F:B9:B2:8B (WEIFANG GOERTEK ELECTRONICS CO.,LTD)
        Key size: 16
> HCI Event: Number of Completed Packets (0x13) plen 5     #55 [hci0] 14.637400
        Num handles: 1
        Handle: 71 Address: 40:1B:5F:B9:B2:8B (WEIFANG GOERTEK ELECTRONICS CO.,LTD)
        Count: 1
        #53: len 16 (32 Kb/s)
        Latency: 4 msec (3-15 msec ~5 msec)
> HCI Event: Disconnect Complete (0x05) plen 4             #56 [hci0] 14.922671
        Status: Success (0x00)
        Handle: 71 Address: 40:1B:5F:B9:B2:8B (WEIFANG GOERTEK ELECTRONICS CO.,LTD)
        Reason: Remote User Terminated Connection (0x13)
@ MGMT Event: Device Disconnected (0x000c) plen 8     {0x0001} [hci0] 14.922704
        BR/EDR Address: 40:1B:5F:B9:B2:8B (WEIFANG GOERTEK ELECTRONICS CO.,LTD)
        Reason: Connection terminated by remote host (0x03)

Created attachment 308054 [details]
Result of btmon -w /tmp/btsnoop.log of two failed DualShock4 connections

Result of btmon -w /tmp/btsnoop.log of two failed DualShock4 connections

BlueZ is replying to L2CAP connection before encryption key size has been returned by the chipset:

< HCI Command: Read Encryption Key.. (0x05|0x0008) plen 2  #51 [hci0] 14.630430
        Handle: 71 Address: 40:1B:5F:B9:B2:8B (WEIFANG GOERTEK ELECTRONICS CO.,>
> ACL Data RX: Handle 71 flags 0x02 dlen 12                #52 [hci0] 14.632472
      L2CAP: Connection Request (0x02) ident 4 len 4
        PSM: 17 (0x0011)
        Source CID: 65
< ACL Data TX: Handle 71 flags 0x00 dlen 16                #53 [hci0] 14.632509
      L2CAP: Connection Response (0x03) ident 4 len 8
        Destination CID: 0
        Source CID: 65
        Result: Connection refused - security block (0x0003)
        Status: No further information available (0x0000)
> HCI Event: Command Complete (0x0e) plen 7                #54 [hci0] 14.635400
      Read Encryption Key Size (0x05|0x0008) ncmd 1
        Status: Success (0x00)
        Handle: 71 Address: 40:1B:5F:B9:B2:8B (WEIFANG GOERTEK ELECTRONICS CO.,>
        Key size: 16

When testing DS4 connection with my setup I got:

< HCI Command: Read Encryption Key Size (0x05|0x0008) plen 2 #37 [hci0] 9.315363
        Handle: 11 Address: 58:10:31:47:09:CF (OUI 58-10-31)
> HCI Event: Command Complete (0x0e) plen 7                  #38 [hci0]
> 9.315883
      Read Encryption Key Size (0x05|0x0008) ncmd 1
        Status: Success (0x00)
        Handle: 11 Address: 58:10:31:47:09:CF (OUI 58-10-31)
        Key size: 16
> ACL Data RX: Handle 11 flags 0x02 dlen 12                  #39 [hci0]
> 9.428060
      L2CAP: Connection Request (0x02) ident 4 len 4
        PSM: 17 (0x0011)
        Source CID: 65
< ACL Data TX: Handle 11 flags 0x00 dlen 16                  #40 [hci0] 9.428106
      L2CAP: Connection Response (0x03) ident 4 len 8
        Destination CID: 64
        Source CID: 65
        Result: Connection successful (0x0000)
        Status: No further information available (0x0000)

I have to admit Bluetooth has completely broken for me as well in 6.14.4.

If I don't connect to my BT speakers right on boot, I cannot pair with them at all.

Please test Luiz’ fix [1]. (At least I think it is.)

[1]: https://lore.kernel.org/linux-bluetooth/20250430192448.2386611-1-luiz.dentz@gmail.com/T/#t.

v2: https://patchwork.kernel.org/project/bluetooth/patch/20250501141222.2498357-1-luiz.dentz@gmail.com/

Created attachment 308073 [details]
btmon of a failed connection attempt

Created attachment 308074 [details]
btmon of a successfull connection attempt

I've tested v2 of the fix with a DualShock 4 v1 and v2 (the firmware is probably the same, but just to be sure). Both had the same behavior. Connecting failed on the first attempt, but every following connection succeeded. When bluetooth is restarted, the first connection fails again. Here is the output of btmon for a unsuccessful and successful connection attempt. I've attached to logs above.

(In reply to Sandro Forster from comment #11)
> I've tested v2 of the fix with a DualShock 4 v1 and v2 (the firmware is
> probably the same, but just to be sure). Both had the same behavior.
> Connecting failed on the first attempt, but every following connection
> succeeded. When bluetooth is restarted, the first connection fails again.
> Here is the output of btmon for a unsuccessful and successful connection
> attempt. I've attached to logs above.

I think that is because when you restart the daemon the link keys are reloaded and then their key size is lost in the process (for Classic, for LE the key size seem to be stored by the daemon), anyway I just spin a v3 to address this so if we don't know the key encryption size we use hdev->min_enc_key_size to satisfy l2cap_check_enc_key_size:

https://patchwork.kernel.org/project/bluetooth/patch/20250502202052.2802441-1-luiz.dentz@gmail.com/

With v3 it is working flawlessly now. Thank you very much for working on this!

Question - Is this the same bug?

Since Linux 6.14.4 I cannot connect my ThinkPad X13 Gen3 (QCNFA765 Wireless Network Adapter from Qualcomm/Atheros) to a ThinkPad Bluetooth Laser Mouse.

> bluetoothd[630]: profiles/input/device.c:control_connect_cb() connect to
> xx:yy:xx:yy:xx:yy: Function not implemented (38)

bluetoothctl/gnome-bluetooth-3.0 tries rapidly to connect and disconnect immediatley a few times and prints above message to the system log.

The connection to AirPods (4th Gen ANC) works.


Thanks

Hi,

I also confirm Bluetooth connections to Dualsense and Dualshock controllers work again after applying the patches from v3.

Tested with two Dualsense controllers and 1 Dualshock controller on the same Intel AX200 adapter.

The v3 patches did not apply on 6.14.5, I had to manually apply them on branch linux-6.14.y.

Strangely I don't see anything relevant queued for the stable.(In reply to Luiz Von Dentz from comment #12)
> (In reply to Sandro Forster from comment #11)
> > I've tested v2 of the fix with a DualShock 4 v1 and v2 (the firmware is
> > probably the same, but just to be sure). Both had the same behavior.
> > Connecting failed on the first attempt, but every following connection
> > succeeded. When bluetooth is restarted, the first connection fails again.
> > Here is the output of btmon for a unsuccessful and successful connection
> > attempt. I've attached to logs above.
> 
> I think that is because when you restart the daemon the link keys are
> reloaded and then their key size is lost in the process (for Classic, for LE
> the key size seem to be stored by the daemon), anyway I just spin a v3 to
> address this so if we don't know the key encryption size we use
> hdev->min_enc_key_size to satisfy l2cap_check_enc_key_size:
> 
> https://patchwork.kernel.org/project/bluetooth/patch/20250502202052.2802441-
> 1-luiz.dentz@gmail.com/

Strangely I don't see anything relevant queued for the stable.