[PATCH] Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728

[PATCH] Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728

[Junjie Cao]

Commit 5ead2063611a ("Bluetooth: btrtl: fix RTL8761B/BU broken LE
extended scan") set HCI_QUIRK_BROKEN_EXT_SCAN for every CHIP_ID_8761B
device to cure repeated 0x2042 failures on an 0bda:a728 dongle. The
brokenness is per-dongle, not per-chip: on a TP-Link UB500 (2357:0604,
RTL8761BU, fw 0xdfc6d922) extended scan works, and the legacy scan
path the quirk forces is what is broken -- LE Set Scan Enable (0x200c)
times out with -110 about 30 s after firmware load, btusb resets the
device, and the adapter re-enumerates in an endless loop (382 firmware
reloads in one boot). 7.1.8, which predates the stable backport, runs
clean on this unit; 7.1.9 loops.

Move the quirk from btrtl's chip-wide switch to a btusb device-table
flag on the USB id the original fix was verified against. Other 8761B
dongles return to their earlier long-standing behaviour.

Link: https://bugzilla.redhat.com/show_bug.cgi?id=2521504
Fixes: 5ead2063611a ("Bluetooth: btrtl: fix RTL8761B/BU broken LE extended scan")
Cc: stable@vger.kernel.org
Signed-off-by: Junjie Cao <junjie.cao@intel.com>
---
#regzbot introduced: 5ead2063611a
#regzbot link: https://bugzilla.redhat.com/show_bug.cgi?id=2521504

 drivers/bluetooth/btrtl.c | 13 -------------
 drivers/bluetooth/btusb.c |  8 ++++++++
 2 files changed, 8 insertions(+), 13 deletions(-)

diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
index 7f54d2d2d13a..03fa9409e3ee 100644
--- a/drivers/bluetooth/btrtl.c
+++ b/drivers/bluetooth/btrtl.c
@@ -1343,19 +1343,6 @@ void btrtl_set_quirks(struct hci_dev *hdev, struct btrtl_device_info *btrtl_dev)
 	if (!btrtl_dev->ic_info)
 		return;
 
-	switch (btrtl_dev->project_id) {
-	case CHIP_ID_8761B:
-		/* RTL8761B/BU reports HCI version 5.1 but does not support
-		 * the LE Extended Scan commands (Opcode 0x2042), causing
-		 * repeated -EBUSY failures when BlueZ attempts extended
-		 * scanning while a connection is active.
-		 */
-		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_EXT_SCAN);
-		break;
-	default:
-		break;
-	}
-
 	switch (btrtl_dev->ic_info->lmp_subver) {
 	case RTL_ROM_LMP_8703B:
 		/* 8723CS reports two pages for local ext features,
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 2bae85b0016c..84614e60d142 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -67,6 +67,7 @@ static struct usb_driver btusb_driver;
 #define BTUSB_INTEL_NO_WBS_SUPPORT	BIT(26)
 #define BTUSB_ACTIONS_SEMI		BIT(27)
 #define BTUSB_BARROT			BIT(28)
+#define BTUSB_BROKEN_EXT_SCAN		BIT(29)
 
 static const struct usb_device_id btusb_table[] = {
 	/* Generic Bluetooth USB device */
@@ -619,6 +620,10 @@ static const struct usb_device_id quirks_table[] = {
 	{ USB_DEVICE(0x0489, 0xe130), .driver_info = BTUSB_REALTEK |
 						     BTUSB_WIDEBAND_SPEECH },
 
+	/* Realtek 8761BU Bluetooth devices */
+	{ USB_DEVICE(0x0bda, 0xa728), .driver_info = BTUSB_REALTEK |
+						     BTUSB_BROKEN_EXT_SCAN },
+
 	/* Realtek Bluetooth devices */
 	{ USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01),
 	  .driver_info = BTUSB_REALTEK },
@@ -4403,6 +4408,9 @@ static int btusb_probe(struct usb_interface *intf,
 	if (id->driver_info & BTUSB_INVALID_LE_STATES)
 		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_STATES);
 
+	if (id->driver_info & BTUSB_BROKEN_EXT_SCAN)
+		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_EXT_SCAN);
+
 	if (id->driver_info & BTUSB_DIGIANSWER) {
 		data->cmdreq_type = USB_TYPE_VENDOR;
 		hci_set_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE);
-- 
2.43.0

Re: [PATCH] Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728

[Thorsten Leemhuis]

On 8/24/26 07:32, Junjie Cao wrote:
> Commit 5ead2063611a ("Bluetooth: btrtl: fix RTL8761B/BU broken LE
> extended scan") set HCI_QUIRK_BROKEN_EXT_SCAN for every CHIP_ID_8761B
> device to cure repeated 0x2042 failures on an 0bda:a728 dongle. The
> brokenness is per-dongle, not per-chip: on a TP-Link UB500 (2357:0604,
> RTL8761BU, fw 0xdfc6d922) extended scan works, and the legacy scan
> path the quirk forces is what is broken -- LE Set Scan Enable (0x200c)
> times out with -110 about 30 s after firmware load, btusb resets the
> device, and the adapter re-enumerates in an endless loop (382 firmware
> reloads in one boot). 7.1.8, which predates the stable backport, runs
> clean on this unit; 7.1.9 loops.
> 
> Move the quirk from btrtl's chip-wide switch to a btusb device-table
> flag on the USB id the original fix was verified against. Other 8761B
> dongles return to their earlier long-standing behaviour.
> > Link: https://bugzilla.redhat.com/show_bug.cgi?id=2521504
> Fixes: 5ead2063611a ("Bluetooth: btrtl: fix RTL8761B/BU broken LE extended scan")

Thx. Just to make sure everyone is aware of it: Kamil (now CCed)
reported problems due to the commit yesterday and provided patches, too:
https://lore.kernel.org/all/20260822141115.58815-1-kserwus@gmail.com/

I suggested that a quick revert might be the best approach for now,
which Kamil submitted:
https://lore.kernel.org/all/20260823102959.100368-1-kserwus@gmail.com/

No comment yet from the BT folks yet.

Ciao, Thorsten

> Cc: stable@vger.kernel.org
> Signed-off-by: Junjie Cao <junjie.cao@intel.com>
> ---
> #regzbot introduced: 5ead2063611a
> #regzbot link: https://bugzilla.redhat.com/show_bug.cgi?id=2521504
> 
>  drivers/bluetooth/btrtl.c | 13 -------------
>  drivers/bluetooth/btusb.c |  8 ++++++++
>  2 files changed, 8 insertions(+), 13 deletions(-)
> 
> diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
> index 7f54d2d2d13a..03fa9409e3ee 100644
> --- a/drivers/bluetooth/btrtl.c
> +++ b/drivers/bluetooth/btrtl.c
> @@ -1343,19 +1343,6 @@ void btrtl_set_quirks(struct hci_dev *hdev, struct btrtl_device_info *btrtl_dev)
>  	if (!btrtl_dev->ic_info)
>  		return;
>  
> -	switch (btrtl_dev->project_id) {
> -	case CHIP_ID_8761B:
> -		/* RTL8761B/BU reports HCI version 5.1 but does not support
> -		 * the LE Extended Scan commands (Opcode 0x2042), causing
> -		 * repeated -EBUSY failures when BlueZ attempts extended
> -		 * scanning while a connection is active.
> -		 */
> -		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_EXT_SCAN);
> -		break;
> -	default:
> -		break;
> -	}
> -
>  	switch (btrtl_dev->ic_info->lmp_subver) {
>  	case RTL_ROM_LMP_8703B:
>  		/* 8723CS reports two pages for local ext features,
> diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
> index 2bae85b0016c..84614e60d142 100644
> --- a/drivers/bluetooth/btusb.c
> +++ b/drivers/bluetooth/btusb.c
> @@ -67,6 +67,7 @@ static struct usb_driver btusb_driver;
>  #define BTUSB_INTEL_NO_WBS_SUPPORT	BIT(26)
>  #define BTUSB_ACTIONS_SEMI		BIT(27)
>  #define BTUSB_BARROT			BIT(28)
> +#define BTUSB_BROKEN_EXT_SCAN		BIT(29)
>  
>  static const struct usb_device_id btusb_table[] = {
>  	/* Generic Bluetooth USB device */
> @@ -619,6 +620,10 @@ static const struct usb_device_id quirks_table[] = {
>  	{ USB_DEVICE(0x0489, 0xe130), .driver_info = BTUSB_REALTEK |
>  						     BTUSB_WIDEBAND_SPEECH },
>  
> +	/* Realtek 8761BU Bluetooth devices */
> +	{ USB_DEVICE(0x0bda, 0xa728), .driver_info = BTUSB_REALTEK |
> +						     BTUSB_BROKEN_EXT_SCAN },
> +
>  	/* Realtek Bluetooth devices */
>  	{ USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01),
>  	  .driver_info = BTUSB_REALTEK },
> @@ -4403,6 +4408,9 @@ static int btusb_probe(struct usb_interface *intf,
>  	if (id->driver_info & BTUSB_INVALID_LE_STATES)
>  		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_STATES);
>  
> +	if (id->driver_info & BTUSB_BROKEN_EXT_SCAN)
> +		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_EXT_SCAN);
> +
>  	if (id->driver_info & BTUSB_DIGIANSWER) {
>  		data->cmdreq_type = USB_TYPE_VENDOR;
>  		hci_set_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE);

RE: Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1181 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1150614

---Test result---

Test Summary:
CheckPatch                    PASS      0.94 seconds
VerifyFixes                   PASS      0.09 seconds
VerifySignedoff               PASS      0.09 seconds
GitLint                       PASS      0.26 seconds
SubjectPrefix                 PASS      0.08 seconds
BuildKernel                   PASS      30.59 seconds
CheckAllWarning               PASS      33.52 seconds
CheckSparse                   PASS      32.10 seconds
BuildKernel32                 PASS      29.20 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      538.56 seconds
IncrementalBuild              PASS      27.75 seconds

Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found


https://github.com/bluez/bluetooth-next/pull/641

---
Regards,
Linux Bluetooth

Re: [PATCH] Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728

[Luiz Augusto von Dentz]

Hi Kamil,

On Mon, Aug 24, 2026 at 2:03 AM Thorsten Leemhuis
<regressions@leemhuis.info> wrote:
>
> On 8/24/26 07:32, Junjie Cao wrote:
> > Commit 5ead2063611a ("Bluetooth: btrtl: fix RTL8761B/BU broken LE
> > extended scan") set HCI_QUIRK_BROKEN_EXT_SCAN for every CHIP_ID_8761B
> > device to cure repeated 0x2042 failures on an 0bda:a728 dongle. The
> > brokenness is per-dongle, not per-chip: on a TP-Link UB500 (2357:0604,
> > RTL8761BU, fw 0xdfc6d922) extended scan works, and the legacy scan
> > path the quirk forces is what is broken -- LE Set Scan Enable (0x200c)
> > times out with -110 about 30 s after firmware load, btusb resets the
> > device, and the adapter re-enumerates in an endless loop (382 firmware
> > reloads in one boot). 7.1.8, which predates the stable backport, runs
> > clean on this unit; 7.1.9 loops.
> >
> > Move the quirk from btrtl's chip-wide switch to a btusb device-table
> > flag on the USB id the original fix was verified against. Other 8761B
> > dongles return to their earlier long-standing behaviour.
> > > Link: https://bugzilla.redhat.com/show_bug.cgi?id=2521504
> > Fixes: 5ead2063611a ("Bluetooth: btrtl: fix RTL8761B/BU broken LE extended scan")
>
> Thx. Just to make sure everyone is aware of it: Kamil (now CCed)
> reported problems due to the commit yesterday and provided patches, too:
> https://lore.kernel.org/all/20260822141115.58815-1-kserwus@gmail.com/
>
> I suggested that a quick revert might be the best approach for now,
> which Kamil submitted:
> https://lore.kernel.org/all/20260823102959.100368-1-kserwus@gmail.com/
>
> No comment yet from the BT folks yet.
>
> Ciao, Thorsten
>
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Junjie Cao <junjie.cao@intel.com>
> > ---
> > #regzbot introduced: 5ead2063611a
> > #regzbot link: https://bugzilla.redhat.com/show_bug.cgi?id=2521504
> >
> >  drivers/bluetooth/btrtl.c | 13 -------------
> >  drivers/bluetooth/btusb.c |  8 ++++++++
> >  2 files changed, 8 insertions(+), 13 deletions(-)
> >
> > diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
> > index 7f54d2d2d13a..03fa9409e3ee 100644
> > --- a/drivers/bluetooth/btrtl.c
> > +++ b/drivers/bluetooth/btrtl.c
> > @@ -1343,19 +1343,6 @@ void btrtl_set_quirks(struct hci_dev *hdev, struct btrtl_device_info *btrtl_dev)
> >       if (!btrtl_dev->ic_info)
> >               return;
> >
> > -     switch (btrtl_dev->project_id) {
> > -     case CHIP_ID_8761B:
> > -             /* RTL8761B/BU reports HCI version 5.1 but does not support
> > -              * the LE Extended Scan commands (Opcode 0x2042), causing
> > -              * repeated -EBUSY failures when BlueZ attempts extended
> > -              * scanning while a connection is active.
> > -              */
> > -             hci_set_quirk(hdev, HCI_QUIRK_BROKEN_EXT_SCAN);
> > -             break;
> > -     default:
> > -             break;
> > -     }
> > -
> >       switch (btrtl_dev->ic_info->lmp_subver) {
> >       case RTL_ROM_LMP_8703B:
> >               /* 8723CS reports two pages for local ext features,
> > diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
> > index 2bae85b0016c..84614e60d142 100644
> > --- a/drivers/bluetooth/btusb.c
> > +++ b/drivers/bluetooth/btusb.c
> > @@ -67,6 +67,7 @@ static struct usb_driver btusb_driver;
> >  #define BTUSB_INTEL_NO_WBS_SUPPORT   BIT(26)
> >  #define BTUSB_ACTIONS_SEMI           BIT(27)
> >  #define BTUSB_BARROT                 BIT(28)
> > +#define BTUSB_BROKEN_EXT_SCAN                BIT(29)
> >
> >  static const struct usb_device_id btusb_table[] = {
> >       /* Generic Bluetooth USB device */
> > @@ -619,6 +620,10 @@ static const struct usb_device_id quirks_table[] = {
> >       { USB_DEVICE(0x0489, 0xe130), .driver_info = BTUSB_REALTEK |
> >                                                    BTUSB_WIDEBAND_SPEECH },
> >
> > +     /* Realtek 8761BU Bluetooth devices */
> > +     { USB_DEVICE(0x0bda, 0xa728), .driver_info = BTUSB_REALTEK |
> > +                                                  BTUSB_BROKEN_EXT_SCAN },
> > +
> >       /* Realtek Bluetooth devices */
> >       { USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01),
> >         .driver_info = BTUSB_REALTEK },
> > @@ -4403,6 +4408,9 @@ static int btusb_probe(struct usb_interface *intf,
> >       if (id->driver_info & BTUSB_INVALID_LE_STATES)
> >               hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_STATES);
> >
> > +     if (id->driver_info & BTUSB_BROKEN_EXT_SCAN)
> > +             hci_set_quirk(hdev, HCI_QUIRK_BROKEN_EXT_SCAN);
> > +
> >       if (id->driver_info & BTUSB_DIGIANSWER) {
> >               data->cmdreq_type = USB_TYPE_VENDOR;
> >               hci_set_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE);

Any chance to test this change? It looks better since it does remove
the original workaround for the specific USB ID while also fixing the
regression.

-- 
Luiz Augusto von Dentz

Re: [PATCH] Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Mon, 24 Aug 2026 13:32:27 +0800 you wrote:
> Commit 5ead2063611a ("Bluetooth: btrtl: fix RTL8761B/BU broken LE
> extended scan") set HCI_QUIRK_BROKEN_EXT_SCAN for every CHIP_ID_8761B
> device to cure repeated 0x2042 failures on an 0bda:a728 dongle. The
> brokenness is per-dongle, not per-chip: on a TP-Link UB500 (2357:0604,
> RTL8761BU, fw 0xdfc6d922) extended scan works, and the legacy scan
> path the quirk forces is what is broken -- LE Set Scan Enable (0x200c)
> times out with -110 about 30 s after firmware load, btusb resets the
> device, and the adapter re-enumerates in an endless loop (382 firmware
> reloads in one boot). 7.1.8, which predates the stable backport, runs
> clean on this unit; 7.1.9 loops.
> 
> [...]

Here is the summary with links:
  - Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728
    https://git.kernel.org/bluetooth/bluetooth-next/c/0c9d2588a514

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH] Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728

[Kamil Serwus]

Dear Luiz,

Yes I use this version 1-2 days. It works for me (with reverted code).
(as the same as before commit 5ead2063611ae56809b1b113ac44cef9547c81d7)

Thanks
Kamil