Bug 220061 - [REGRESSION, BISECTED] Multiple Bluetooth devices cannot be paired under Linux 6.14.4
Summary: [REGRESSION, BISECTED] Multiple Bluetooth devices cannot be paired under Linu...
Status: NEW
Alias: None
Product: Drivers
Classification: Unclassified
Component: Bluetooth (show other bugs)
Hardware: All Linux
: P3 blocking
Assignee: linux-bluetooth@vger.kernel.org
URL: https://bbs.archlinux.org/viewtopic.p...
Keywords:
: 220063 (view as bug list)
Depends on:
Blocks:
 
Reported: 2025-04-28 15:10 UTC by Artem S. Tashkinov
Modified: 2025-05-11 13:26 UTC (History)
11 users (show)

See Also:
Kernel Version: 6.14.4
Subsystem:
Regression: Yes
Bisected commit-id: d4ca2fd218caafbf50e3343ba1260c6a23b5676a


Attachments
Result of btmon -w /tmp/btsnoop.log of two failed DualShock4 connections (7.02 KB, application/octet-stream)
2025-04-29 12:13 UTC, Marc Geerlings
Details
btmon of a failed connection attempt (59.29 KB, text/plain)
2025-05-02 18:29 UTC, Sandro Forster
Details
btmon of a successfull connection attempt (36.10 KB, text/plain)
2025-05-02 18:29 UTC, Sandro Forster
Details

Description Artem S. Tashkinov 2025-04-28 15:10:49 UTC
Bisected to d4ca2fd218caafbf50e3343ba1260c6a23b5676a

All the details are here:

https://bbs.archlinux.org/viewtopic.php?id=305211
Comment 1 alan.loewe 2025-04-28 17:58:40 UTC
*** Bug 220063 has been marked as a duplicate of this bug. ***
Comment 2 frederic.danis 2025-04-29 07:08:00 UTC
Could you please share bluetoothd logs and HCI logs (by running 'btmon -w /tmp/btsnoop.log')?
Comment 3 Marc Geerlings 2025-04-29 12:08:31 UTC
        Num handles: 1
        Handle: 71 Address: 40:1B:5F:B9:B2:8B (WEIFANG GOERTEK ELECTRONICS CO.,LTD)
        Count: 2
        #41: len 310 (620 Kb/s)
        Latency: 4 msec (3-15 msec ~6 msec)
        Channel: 64 [PSM 1 mode Basic (0x00)] {chan 0}
        Channel Latency: 4 msec (4-6 msec ~5 msec)
        #42: len 36 (72 Kb/s)
        Latency: 4 msec (3-15 msec ~5 msec)
> ACL Data RX: Handle 71 flags 0x02 dlen 12                #44 [hci0] 14.452447
      L2CAP: Disconnection Request (0x06) ident 3 len 4
        Destination CID: 64
        Source CID: 64
< ACL Data TX: Handle 71 flags 0x00 dlen 12                #45 [hci0] 14.452457
      L2CAP: Disconnection Response (0x07) ident 3 len 4
        Destination CID: 64
        Source CID: 64
> HCI Event: Number of Completed Packets (0x13) plen 5     #46 [hci0] 14.457375
        Num handles: 1
        Handle: 71 Address: 40:1B:5F:B9:B2:8B (WEIFANG GOERTEK ELECTRONICS CO.,LTD)
        Count: 1
        #45: len 12 (24 Kb/s)
        Latency: 4 msec (3-15 msec ~5 msec)
> HCI Event: Link Key Request (0x17) plen 6                #47 [hci0] 14.574608
        Address: 40:1B:5F:B9:B2:8B (WEIFANG GOERTEK ELECTRONICS CO.,LTD)
< HCI Command: Link Key Request R.. (0x01|0x000b) plen 22  #48 [hci0] 14.574651
        Address: 40:1B:5F:B9:B2:8B (WEIFANG GOERTEK ELECTRONICS CO.,LTD)
        Link key[16]: b4f8956a4b3d885efebf3a63647ab89b
> HCI Event: Command Complete (0x0e) plen 10               #49 [hci0] 14.580396
      Link Key Request Reply (0x01|0x000b) ncmd 1
        Status: Success (0x00)
        Address: 40:1B:5F:B9:B2:8B (WEIFANG GOERTEK ELECTRONICS CO.,LTD)
> HCI Event: Encryption Change (0x08) plen 4               #50 [hci0] 14.630399
        Status: Success (0x00)
        Handle: 71 Address: 40:1B:5F:B9:B2:8B (WEIFANG GOERTEK ELECTRONICS CO.,LTD)
        Encryption: Enabled with E0 (0x01)
< HCI Command: Read Encryption Key.. (0x05|0x0008) plen 2  #51 [hci0] 14.630430
        Handle: 71 Address: 40:1B:5F:B9:B2:8B (WEIFANG GOERTEK ELECTRONICS CO.,LTD)
> ACL Data RX: Handle 71 flags 0x02 dlen 12                #52 [hci0] 14.632472
      L2CAP: Connection Request (0x02) ident 4 len 4
        PSM: 17 (0x0011)
        Source CID: 65
< ACL Data TX: Handle 71 flags 0x00 dlen 16                #53 [hci0] 14.632509
      L2CAP: Connection Response (0x03) ident 4 len 8
        Destination CID: 0
        Source CID: 65
        Result: Connection refused - security block (0x0003)
        Status: No further information available (0x0000)
> HCI Event: Command Complete (0x0e) plen 7                #54 [hci0] 14.635400
      Read Encryption Key Size (0x05|0x0008) ncmd 1
        Status: Success (0x00)
        Handle: 71 Address: 40:1B:5F:B9:B2:8B (WEIFANG GOERTEK ELECTRONICS CO.,LTD)
        Key size: 16
> HCI Event: Number of Completed Packets (0x13) plen 5     #55 [hci0] 14.637400
        Num handles: 1
        Handle: 71 Address: 40:1B:5F:B9:B2:8B (WEIFANG GOERTEK ELECTRONICS CO.,LTD)
        Count: 1
        #53: len 16 (32 Kb/s)
        Latency: 4 msec (3-15 msec ~5 msec)
> HCI Event: Disconnect Complete (0x05) plen 4             #56 [hci0] 14.922671
        Status: Success (0x00)
        Handle: 71 Address: 40:1B:5F:B9:B2:8B (WEIFANG GOERTEK ELECTRONICS CO.,LTD)
        Reason: Remote User Terminated Connection (0x13)
@ MGMT Event: Device Disconnected (0x000c) plen 8     {0x0001} [hci0] 14.922704
        BR/EDR Address: 40:1B:5F:B9:B2:8B (WEIFANG GOERTEK ELECTRONICS CO.,LTD)
        Reason: Connection terminated by remote host (0x03)
Comment 4 Marc Geerlings 2025-04-29 12:13:31 UTC
Created attachment 308054 [details]
Result of btmon -w /tmp/btsnoop.log of two failed DualShock4 connections

Result of btmon -w /tmp/btsnoop.log of two failed DualShock4 connections
Comment 5 frederic.danis 2025-04-29 14:13:28 UTC
BlueZ is replying to L2CAP connection before encryption key size has been returned by the chipset:

< HCI Command: Read Encryption Key.. (0x05|0x0008) plen 2  #51 [hci0] 14.630430
        Handle: 71 Address: 40:1B:5F:B9:B2:8B (WEIFANG GOERTEK ELECTRONICS CO.,>
> ACL Data RX: Handle 71 flags 0x02 dlen 12                #52 [hci0] 14.632472
      L2CAP: Connection Request (0x02) ident 4 len 4
        PSM: 17 (0x0011)
        Source CID: 65
< ACL Data TX: Handle 71 flags 0x00 dlen 16                #53 [hci0] 14.632509
      L2CAP: Connection Response (0x03) ident 4 len 8
        Destination CID: 0
        Source CID: 65
        Result: Connection refused - security block (0x0003)
        Status: No further information available (0x0000)
> HCI Event: Command Complete (0x0e) plen 7                #54 [hci0] 14.635400
      Read Encryption Key Size (0x05|0x0008) ncmd 1
        Status: Success (0x00)
        Handle: 71 Address: 40:1B:5F:B9:B2:8B (WEIFANG GOERTEK ELECTRONICS CO.,>
        Key size: 16

When testing DS4 connection with my setup I got:

< HCI Command: Read Encryption Key Size (0x05|0x0008) plen 2 #37 [hci0] 9.315363
        Handle: 11 Address: 58:10:31:47:09:CF (OUI 58-10-31)
> HCI Event: Command Complete (0x0e) plen 7                  #38 [hci0]
> 9.315883
      Read Encryption Key Size (0x05|0x0008) ncmd 1
        Status: Success (0x00)
        Handle: 11 Address: 58:10:31:47:09:CF (OUI 58-10-31)
        Key size: 16
> ACL Data RX: Handle 11 flags 0x02 dlen 12                  #39 [hci0]
> 9.428060
      L2CAP: Connection Request (0x02) ident 4 len 4
        PSM: 17 (0x0011)
        Source CID: 65
< ACL Data TX: Handle 11 flags 0x00 dlen 16                  #40 [hci0] 9.428106
      L2CAP: Connection Response (0x03) ident 4 len 8
        Destination CID: 64
        Source CID: 65
        Result: Connection successful (0x0000)
        Status: No further information available (0x0000)
Comment 6 Artem S. Tashkinov 2025-04-30 07:51:48 UTC
I have to admit Bluetooth has completely broken for me as well in 6.14.4.

If I don't connect to my BT speakers right on boot, I cannot pair with them at all.
Comment 7 Paul Menzel 2025-05-01 06:06:55 UTC
Please test Luiz’ fix [1]. (At least I think it is.)

[1]: https://lore.kernel.org/linux-bluetooth/20250430192448.2386611-1-luiz.dentz@gmail.com/T/#t.
Comment 9 Sandro Forster 2025-05-02 18:29:21 UTC
Created attachment 308073 [details]
btmon of a failed connection attempt
Comment 10 Sandro Forster 2025-05-02 18:29:50 UTC
Created attachment 308074 [details]
btmon of a successfull connection attempt
Comment 11 Sandro Forster 2025-05-02 18:30:24 UTC
I've tested v2 of the fix with a DualShock 4 v1 and v2 (the firmware is probably the same, but just to be sure). Both had the same behavior. Connecting failed on the first attempt, but every following connection succeeded. When bluetooth is restarted, the first connection fails again. Here is the output of btmon for a unsuccessful and successful connection attempt. I've attached to logs above.
Comment 12 Luiz Von Dentz 2025-05-02 20:30:14 UTC
(In reply to Sandro Forster from comment #11)
> I've tested v2 of the fix with a DualShock 4 v1 and v2 (the firmware is
> probably the same, but just to be sure). Both had the same behavior.
> Connecting failed on the first attempt, but every following connection
> succeeded. When bluetooth is restarted, the first connection fails again.
> Here is the output of btmon for a unsuccessful and successful connection
> attempt. I've attached to logs above.

I think that is because when you restart the daemon the link keys are reloaded and then their key size is lost in the process (for Classic, for LE the key size seem to be stored by the daemon), anyway I just spin a v3 to address this so if we don't know the key encryption size we use hdev->min_enc_key_size to satisfy l2cap_check_enc_key_size:

https://patchwork.kernel.org/project/bluetooth/patch/20250502202052.2802441-1-luiz.dentz@gmail.com/
Comment 13 Sandro Forster 2025-05-02 21:53:23 UTC
With v3 it is working flawlessly now. Thank you very much for working on this!
Comment 14 Peter Weber 2025-05-04 22:25:12 UTC
Question - Is this the same bug?

Since Linux 6.14.4 I cannot connect my ThinkPad X13 Gen3 (QCNFA765 Wireless Network Adapter from Qualcomm/Atheros) to a ThinkPad Bluetooth Laser Mouse.

> bluetoothd[630]: profiles/input/device.c:control_connect_cb() connect to
> xx:yy:xx:yy:xx:yy: Function not implemented (38)

bluetoothctl/gnome-bluetooth-3.0 tries rapidly to connect and disconnect immediatley a few times and prints above message to the system log.

The connection to AirPods (4th Gen ANC) works.


Thanks
Comment 15 Andrei Amuraritei 2025-05-05 16:09:50 UTC
Hi,

I also confirm Bluetooth connections to Dualsense and Dualshock controllers work again after applying the patches from v3.

Tested with two Dualsense controllers and 1 Dualshock controller on the same Intel AX200 adapter.

The v3 patches did not apply on 6.14.5, I had to manually apply them on branch linux-6.14.y.
Comment 16 Artem S. Tashkinov 2025-05-08 13:13:20 UTC
Strangely I don't see anything relevant queued for the stable.(In reply to Luiz Von Dentz from comment #12)
> (In reply to Sandro Forster from comment #11)
> > I've tested v2 of the fix with a DualShock 4 v1 and v2 (the firmware is
> > probably the same, but just to be sure). Both had the same behavior.
> > Connecting failed on the first attempt, but every following connection
> > succeeded. When bluetooth is restarted, the first connection fails again.
> > Here is the output of btmon for a unsuccessful and successful connection
> > attempt. I've attached to logs above.
> 
> I think that is because when you restart the daemon the link keys are
> reloaded and then their key size is lost in the process (for Classic, for LE
> the key size seem to be stored by the daemon), anyway I just spin a v3 to
> address this so if we don't know the key encryption size we use
> hdev->min_enc_key_size to satisfy l2cap_check_enc_key_size:
> 
> https://patchwork.kernel.org/project/bluetooth/patch/20250502202052.2802441-
> 1-luiz.dentz@gmail.com/

Strangely I don't see anything relevant queued for the stable.

Note You need to log in before you can comment on or make changes to this bug.