[PATCH 0/3] Bluetooth: Fix LE on Barrot 33fa:0010 controllers

[PATCH 0/3] Bluetooth: Fix LE on Barrot 33fa:0010 controllers

[Ernesto Salvetti]

The UGREEN Bluetooth 5.4 USB dongle (33fa:0010, Barrot chip, bound to
btusb via BTUSB_BARROT) works for BR/EDR, but LE is unusable: as soon as
a scan is started the controller hangs on LE Set Extended Scan
Parameters and btusb resets it in a loop. Once that is avoided, two more
problems show up before an LE device can be used. This series fixes
them one at a time:

1/3 Setting HCI_QUIRK_BROKEN_EXT_SCAN alone is not enough on a
    controller that enforces the spec rule that legacy and extended
    LE commands must not be mixed: the stack still uses extended
    advertising (LE Read Number of Supported Advertising Sets is sent
    during init), after which the legacy scan commands are rejected
    with Command Disallowed. Don't use extended advertising when
    extended scanning is marked broken. This also affects the other
    users of the quirk (hci_bcm4377, Actions ATS2851 and Realtek
    0bda:a728 in btusb), which will fall back to legacy advertising;
    I could not test those.

2/3 The controller answers LE Read Remote Used Features with
    Controller Busy right after connecting, and the stack drops the
    link. Continue without the remote features instead.

3/3 Set HCI_QUIRK_BROKEN_EXT_SCAN and HCI_QUIRK_BROKEN_EXT_CREATE_CONN
    for BTUSB_BARROT devices.

Testing: on bluetooth-next each patch builds (clang, W=1) without new
warnings. The runtime tests were done on v7.2.11 (PikaOS kernel) with
the series backported; patch 2 needed a context adjustment there, since
hci_cs_le_read_remote_features() in v7.2.11 lacks the
HCI_ERROR_UNSUPPORTED_REMOTE_FEATURE handling. With a 33fa:0010
(bcdDevice 88.91) and an Xbox Wireless Controller, checked with btmon:

 - without patch 1: Command Disallowed on every LE Set Scan Parameters
 - with the full series: scanning works, LE Secure Connections pairing
   from scratch succeeds, reconnecting with the stored LTK works, and
   the controller shows up as HID gamepad (hid-microsoft).

Before that I used an earlier btusb-only workaround with the same
effect for an afternoon of gaming without problems.

33fa:0012 shares the BTUSB_BARROT flag but I don't have one to test.

Tool use: the investigation and the patches were done with the help of
an AI coding assistant (Claude, Anthropic) in an interactive session.
It analysed the btmon/dmesg logs, read the relevant core code, proposed
and wrote the changes and the changelogs, and ran checkpatch. I ran all
hardware tests, reviewed the changes and take responsibility for them.
The patches carry an Assisted-by tag accordingly.

---
Ernesto Salvetti (3):
      Bluetooth: hci_core: Don't use extended advertising with broken ext scan
      Bluetooth: hci_event: Don't drop LE link on busy remote features read
      Bluetooth: btusb: Disable broken LE extended scan on Barrot controllers

 drivers/bluetooth/btusb_main.c   |  6 ++++++
 include/net/bluetooth/hci.h      |  5 ++++-
 include/net/bluetooth/hci_core.h | 11 +++++++++--
 net/bluetooth/hci_event.c        | 11 +++++++++++
 4 files changed, 30 insertions(+), 3 deletions(-)
---
base-commit: 42b8c2d729268a65a2d98064e8dc59ff53646b14
change-id: 20261031-barrot-le-fixes-v1-95624ffd0a43

Best regards,
--  
Ernesto Salvetti <ernesto.salvetti@tambosi.tn.it>

[PATCH 0/3] Bluetooth: Fix LE on Barrot 33fa:0010 controllers

[Ernesto Salvetti via B4 Relay]

The UGREEN Bluetooth 5.4 USB dongle (33fa:0010, Barrot chip, bound to
btusb via BTUSB_BARROT) works for BR/EDR, but LE is unusable: as soon as
a scan is started the controller hangs on LE Set Extended Scan
Parameters and btusb resets it in a loop. Once that is avoided, two more
problems show up before an LE device can be used. This series fixes
them one at a time:

1/3 Setting HCI_QUIRK_BROKEN_EXT_SCAN alone is not enough on a
    controller that enforces the spec rule that legacy and extended
    LE commands must not be mixed: the stack still uses extended
    advertising (LE Read Number of Supported Advertising Sets is sent
    during init), after which the legacy scan commands are rejected
    with Command Disallowed. Don't use extended advertising when
    extended scanning is marked broken. This also affects the other
    users of the quirk (hci_bcm4377, Actions ATS2851 and Realtek
    0bda:a728 in btusb), which will fall back to legacy advertising;
    I could not test those.

2/3 The controller answers LE Read Remote Used Features with
    Controller Busy right after connecting, and the stack drops the
    link. Continue without the remote features instead.

3/3 Set HCI_QUIRK_BROKEN_EXT_SCAN and HCI_QUIRK_BROKEN_EXT_CREATE_CONN
    for BTUSB_BARROT devices.

Testing: on bluetooth-next each patch builds (clang, W=1) without new
warnings. The runtime tests were done on v7.2.11 (PikaOS kernel) with
the series backported; patch 2 needed a context adjustment there, since
hci_cs_le_read_remote_features() in v7.2.11 lacks the
HCI_ERROR_UNSUPPORTED_REMOTE_FEATURE handling. With a 33fa:0010
(bcdDevice 88.91) and an Xbox Wireless Controller, checked with btmon:

 - without patch 1: Command Disallowed on every LE Set Scan Parameters
 - with the full series: scanning works, LE Secure Connections pairing
   from scratch succeeds, reconnecting with the stored LTK works, and
   the controller shows up as HID gamepad (hid-microsoft).

Before that I used an earlier btusb-only workaround with the same
effect for an afternoon of gaming without problems.

33fa:0012 shares the BTUSB_BARROT flag but I don't have one to test.

Tool use: the investigation and the patches were done with the help of
an AI coding assistant (Claude, Anthropic) in an interactive session.
It analysed the btmon/dmesg logs, read the relevant core code, proposed
and wrote the changes and the changelogs, and ran checkpatch. I ran all
hardware tests, reviewed the changes and take responsibility for them.
The patches carry an Assisted-by tag accordingly.

---
Ernesto Salvetti (3):
      Bluetooth: hci_core: Don't use extended advertising with broken ext scan
      Bluetooth: hci_event: Don't drop LE link on busy remote features read
      Bluetooth: btusb: Disable broken LE extended scan on Barrot controllers

 drivers/bluetooth/btusb_main.c   |  6 ++++++
 include/net/bluetooth/hci.h      |  5 ++++-
 include/net/bluetooth/hci_core.h | 11 +++++++++--
 net/bluetooth/hci_event.c        | 11 +++++++++++
 4 files changed, 30 insertions(+), 3 deletions(-)
---
base-commit: 42b8c2d729268a65a2d98064e8dc59ff53646b14
change-id: 20261031-barrot-le-fixes-v1-95624ffd0a43

Best regards,
--  
Ernesto Salvetti <ernesto.salvetti@tambosi.tn.it>

[PATCH 1/3] Bluetooth: hci_core: Don't use extended advertising with broken ext scan

[Ernesto Salvetti]

When HCI_QUIRK_BROKEN_EXT_SCAN is set the stack falls back to the legacy
LE Set Scan Parameters/Enable commands, but it keeps using extended
advertising if the controller reports the LE Extended Advertising
feature. Already during init it then sends LE Read Number of Supported
Advertising Sets, which is an extended advertising command.

Core Spec 5.3, Vol 4, Part E, 3.1.1 does not allow mixing the two
command sets: once the Host has issued an extended advertising command,
the Controller shall reject the legacy advertising, scanning and
initiating commands with Command Disallowed until the next reset.

A controller that enforces this, such as the Barrot one in the UGREEN
Bluetooth 5.4 dongle (33fa:0010), then can't scan at all once the quirk
is set:

  < HCI Command: LE Read Number of Su.. (0x08|0x003b) plen 0
  > HCI Event: Command Complete (0x0e) plen 5
        LE Read Number of Supported Advertising Sets (0x08|0x003b) ncmd 1
          Status: Success (0x00)
          Num supported adv sets: 4
  ...
  < HCI Command: LE Set Scan Parameters (0x08|0x000b) plen 7
  > HCI Event: Command Complete (0x0e) plen 4
        LE Set Scan Parameters (0x08|0x000b) ncmd 1
          Status: Command Disallowed (0x0c)

  Bluetooth: hci0: Opcode 0x200b failed: -16

Treat the controller as not capable of extended advertising whenever
extended scanning is marked broken, so that only legacy commands are
used.

Fixes: 392fca352c7a ("Bluetooth: Add quirk to disable extended scanning")
Assisted-by: LLM
Signed-off-by: Ernesto Salvetti <ernesto.salvetti@tambosi.tn.it>
---
 include/net/bluetooth/hci.h      |  4 +++-
 include/net/bluetooth/hci_core.h | 11 +++++++++--
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 1c992e87534d..74b96941ad11 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -274,7 +274,9 @@ enum {
 	/*
 	 * When this quirk is set, the HCI_OP_LE_SET_EXT_SCAN_ENABLE command is
 	 * disabled. This is required for some Broadcom controllers which
-	 * erroneously claim to support extended scanning.
+	 * erroneously claim to support extended scanning. Extended
+	 * advertising is disabled as well, since legacy and extended
+	 * commands can't be mixed.
 	 *
 	 * This quirk can be set before hci_register_dev is called or
 	 * during the hdev->setup vendor callback.
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 9d5d3ab4a075..d622cab32ca9 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -2095,8 +2095,15 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
 /* Use ext create connection if command is supported */
 #define use_ext_conn(dev) (((dev)->commands[37] & 0x80) && \
 	!hci_test_quirk((dev), HCI_QUIRK_BROKEN_EXT_CREATE_CONN))
-/* Extended advertising support */
-#define ext_adv_capable(dev) (((dev)->le_features[1] & HCI_LE_EXT_ADV))
+/* Extended advertising support
+ *
+ * Controllers shall reject legacy advertising, scanning and initiating
+ * commands with Command Disallowed once an extended advertising command
+ * has been issued (Core Spec 5.3, Vol 4, Part E, 3.1.1), so extended
+ * advertising can't be used when extended scanning is broken.
+ */
+#define ext_adv_capable(dev) (((dev)->le_features[1] & HCI_LE_EXT_ADV) && \
+			      !hci_test_quirk((dev), HCI_QUIRK_BROKEN_EXT_SCAN))
 
 /* Maximum advertising length */
 #define max_adv_len(dev) \

-- 
2.53.0.697.g625c4fb2daa

[PATCH 1/3] Bluetooth: hci_core: Don't use extended advertising with broken ext scan

[Ernesto Salvetti via B4 Relay]

From: Ernesto Salvetti <ernesto.salvetti@tambosi.tn.it>

When HCI_QUIRK_BROKEN_EXT_SCAN is set the stack falls back to the legacy
LE Set Scan Parameters/Enable commands, but it keeps using extended
advertising if the controller reports the LE Extended Advertising
feature. Already during init it then sends LE Read Number of Supported
Advertising Sets, which is an extended advertising command.

Core Spec 5.3, Vol 4, Part E, 3.1.1 does not allow mixing the two
command sets: once the Host has issued an extended advertising command,
the Controller shall reject the legacy advertising, scanning and
initiating commands with Command Disallowed until the next reset.

A controller that enforces this, such as the Barrot one in the UGREEN
Bluetooth 5.4 dongle (33fa:0010), then can't scan at all once the quirk
is set:

  < HCI Command: LE Read Number of Su.. (0x08|0x003b) plen 0
  > HCI Event: Command Complete (0x0e) plen 5
        LE Read Number of Supported Advertising Sets (0x08|0x003b) ncmd 1
          Status: Success (0x00)
          Num supported adv sets: 4
  ...
  < HCI Command: LE Set Scan Parameters (0x08|0x000b) plen 7
  > HCI Event: Command Complete (0x0e) plen 4
        LE Set Scan Parameters (0x08|0x000b) ncmd 1
          Status: Command Disallowed (0x0c)

  Bluetooth: hci0: Opcode 0x200b failed: -16

Treat the controller as not capable of extended advertising whenever
extended scanning is marked broken, so that only legacy commands are
used.

Fixes: 392fca352c7a ("Bluetooth: Add quirk to disable extended scanning")
Assisted-by: LLM
Signed-off-by: Ernesto Salvetti <ernesto.salvetti@tambosi.tn.it>
---
 include/net/bluetooth/hci.h      |  4 +++-
 include/net/bluetooth/hci_core.h | 11 +++++++++--
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 1c992e87534d..74b96941ad11 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -274,7 +274,9 @@ enum {
 	/*
 	 * When this quirk is set, the HCI_OP_LE_SET_EXT_SCAN_ENABLE command is
 	 * disabled. This is required for some Broadcom controllers which
-	 * erroneously claim to support extended scanning.
+	 * erroneously claim to support extended scanning. Extended
+	 * advertising is disabled as well, since legacy and extended
+	 * commands can't be mixed.
 	 *
 	 * This quirk can be set before hci_register_dev is called or
 	 * during the hdev->setup vendor callback.
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 9d5d3ab4a075..d622cab32ca9 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -2095,8 +2095,15 @@ void hci_conn_del_sysfs(struct hci_conn *conn);
 /* Use ext create connection if command is supported */
 #define use_ext_conn(dev) (((dev)->commands[37] & 0x80) && \
 	!hci_test_quirk((dev), HCI_QUIRK_BROKEN_EXT_CREATE_CONN))
-/* Extended advertising support */
-#define ext_adv_capable(dev) (((dev)->le_features[1] & HCI_LE_EXT_ADV))
+/* Extended advertising support
+ *
+ * Controllers shall reject legacy advertising, scanning and initiating
+ * commands with Command Disallowed once an extended advertising command
+ * has been issued (Core Spec 5.3, Vol 4, Part E, 3.1.1), so extended
+ * advertising can't be used when extended scanning is broken.
+ */
+#define ext_adv_capable(dev) (((dev)->le_features[1] & HCI_LE_EXT_ADV) && \
+			      !hci_test_quirk((dev), HCI_QUIRK_BROKEN_EXT_SCAN))
 
 /* Maximum advertising length */
 #define max_adv_len(dev) \

-- 
2.53.0.697.g625c4fb2daa

[PATCH 2/3] Bluetooth: hci_event: Don't drop LE link on busy remote features read

[Ernesto Salvetti]

Right after an outgoing LE connection is established, the Barrot
controller in the UGREEN Bluetooth 5.4 dongle (33fa:0010) rejects
LE Read Remote Used Features with Controller Busy. The error is passed
to hci_connect_cfm(), the pairing attempt fails and the link is torn
down right away, so no LE device can be paired or connected:

  > HCI Event: LE Meta Event (0x3e) plen 19
        LE Connection Complete (0x01)
          Status: Success (0x00)
          Handle: 65
          Role: Central (0x00)
  < HCI Command: LE Read Remote Used Features (0x08|0x0016) plen 2
          Handle: 65
  > HCI Event: Command Status (0x0f) plen 4
        LE Read Remote Used Features (0x08|0x0016) ncmd 1
          Status: Controller Busy (0x3a)
  @ MGMT Event: Command Complete (0x0001) plen 10
        Pair Device (0x0019) plen 7
          Status: Busy (0x0a)
  < HCI Command: Disconnect (0x01|0x0006) plen 3
          Reason: Remote User Terminated Connection (0x13)

The controller does not send an LE Read Remote Features Complete event
later on either.

The remote features are not needed to use the connection; the stack
already continues without them when a peripheral gets Unsupported
Remote Feature. Do the same for Controller Busy and move the connection
to the connected state.

With this an Xbox Wireless Controller pairs over LE Secure Connections
and works as HID device.

Assisted-by: LLM
Signed-off-by: Ernesto Salvetti <ernesto.salvetti@tambosi.tn.it>
---
 include/net/bluetooth/hci.h |  1 +
 net/bluetooth/hci_event.c   | 11 +++++++++++
 2 files changed, 12 insertions(+)

diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 74b96941ad11..7da40b84c198 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -726,6 +726,7 @@ enum {
 #define HCI_ERROR_UNSUPPORTED_REMOTE_FEATURE	0x1a
 #define HCI_ERROR_INVALID_LL_PARAMS	0x1e
 #define HCI_ERROR_UNSPECIFIED		0x1f
+#define HCI_ERROR_CONTROLLER_BUSY	0x3a
 #define HCI_ERROR_ADVERTISING_TIMEOUT	0x3c
 #define HCI_ERROR_CANCELLED_BY_HOST	0x44
 
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index d05934fef4d9..fcbd1807e2f3 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3026,6 +3026,17 @@ static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
 			status = 0x00;
 		}
 
+		/* Some controllers reject the command with Controller Busy
+		 * right after the connection has been established. The
+		 * remote features are not required to use the connection,
+		 * so continue without them instead of dropping it.
+		 */
+		if (status == HCI_ERROR_CONTROLLER_BUSY) {
+			bt_dev_warn(hdev, "Remote features busy, continuing without them");
+			conn->state = BT_CONNECTED;
+			status = 0x00;
+		}
+
 		hci_connect_cfm(conn, status);
 	}
 

-- 
2.53.0.697.g625c4fb2daa

[PATCH 2/3] Bluetooth: hci_event: Don't drop LE link on busy remote features read

[Ernesto Salvetti via B4 Relay]

From: Ernesto Salvetti <ernesto.salvetti@tambosi.tn.it>

Right after an outgoing LE connection is established, the Barrot
controller in the UGREEN Bluetooth 5.4 dongle (33fa:0010) rejects
LE Read Remote Used Features with Controller Busy. The error is passed
to hci_connect_cfm(), the pairing attempt fails and the link is torn
down right away, so no LE device can be paired or connected:

  > HCI Event: LE Meta Event (0x3e) plen 19
        LE Connection Complete (0x01)
          Status: Success (0x00)
          Handle: 65
          Role: Central (0x00)
  < HCI Command: LE Read Remote Used Features (0x08|0x0016) plen 2
          Handle: 65
  > HCI Event: Command Status (0x0f) plen 4
        LE Read Remote Used Features (0x08|0x0016) ncmd 1
          Status: Controller Busy (0x3a)
  @ MGMT Event: Command Complete (0x0001) plen 10
        Pair Device (0x0019) plen 7
          Status: Busy (0x0a)
  < HCI Command: Disconnect (0x01|0x0006) plen 3
          Reason: Remote User Terminated Connection (0x13)

The controller does not send an LE Read Remote Features Complete event
later on either.

The remote features are not needed to use the connection; the stack
already continues without them when a peripheral gets Unsupported
Remote Feature. Do the same for Controller Busy and move the connection
to the connected state.

With this an Xbox Wireless Controller pairs over LE Secure Connections
and works as HID device.

Assisted-by: LLM
Signed-off-by: Ernesto Salvetti <ernesto.salvetti@tambosi.tn.it>
---
 include/net/bluetooth/hci.h |  1 +
 net/bluetooth/hci_event.c   | 11 +++++++++++
 2 files changed, 12 insertions(+)

diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 74b96941ad11..7da40b84c198 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -726,6 +726,7 @@ enum {
 #define HCI_ERROR_UNSUPPORTED_REMOTE_FEATURE	0x1a
 #define HCI_ERROR_INVALID_LL_PARAMS	0x1e
 #define HCI_ERROR_UNSPECIFIED		0x1f
+#define HCI_ERROR_CONTROLLER_BUSY	0x3a
 #define HCI_ERROR_ADVERTISING_TIMEOUT	0x3c
 #define HCI_ERROR_CANCELLED_BY_HOST	0x44
 
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index d05934fef4d9..fcbd1807e2f3 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3026,6 +3026,17 @@ static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
 			status = 0x00;
 		}
 
+		/* Some controllers reject the command with Controller Busy
+		 * right after the connection has been established. The
+		 * remote features are not required to use the connection,
+		 * so continue without them instead of dropping it.
+		 */
+		if (status == HCI_ERROR_CONTROLLER_BUSY) {
+			bt_dev_warn(hdev, "Remote features busy, continuing without them");
+			conn->state = BT_CONNECTED;
+			status = 0x00;
+		}
+
 		hci_connect_cfm(conn, status);
 	}
 

-- 
2.53.0.697.g625c4fb2daa

[PATCH 3/3] Bluetooth: btusb: Disable broken LE extended scan on Barrot controllers

[Ernesto Salvetti]

The Barrot controller in the UGREEN Bluetooth 5.4 dongle (33fa:0010)
reports support for LE Set Extended Scan Parameters/Enable and LE
Extended Create Connection, but stops answering commands as soon as
extended scanning is used. btusb then resets the device, it
re-enumerates and the same thing happens again, in a loop every ~4
seconds whenever a scan is started (e.g. to connect to an LE device):

  Bluetooth: hci0: Opcode 0x2041 failed: -110
  Bluetooth: hci0: command 0x2041 tx timeout
  usb 9-7: USB disconnect, device number 13
  usb 9-7: new full-speed USB device number 14 using xhci_hcd

Set HCI_QUIRK_BROKEN_EXT_SCAN and HCI_QUIRK_BROKEN_EXT_CREATE_CONN so
that only the legacy LE commands are used. Extended create connection
has to go as well, since legacy and extended commands can't be mixed.

This depends on the previous two patches: without them scanning fails
with Command Disallowed and LE connections are dropped right after
they are established.

Tested with 33fa:0010 (bcdDevice 88.91) and an Xbox Wireless
Controller: scanning, LE Secure Connections pairing and HID input work.
33fa:0012 shares the BTUSB_BARROT flag but was not tested.

Assisted-by: LLM
Signed-off-by: Ernesto Salvetti <ernesto.salvetti@tambosi.tn.it>
---
 drivers/bluetooth/btusb_main.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/bluetooth/btusb_main.c b/drivers/bluetooth/btusb_main.c
index 92a78a7e6039..d5f18134ee3a 100644
--- a/drivers/bluetooth/btusb_main.c
+++ b/drivers/bluetooth/btusb_main.c
@@ -4735,6 +4735,12 @@ static int btusb_probe(struct usb_interface *intf,
 		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_WRITE_AUTH_PAYLOAD_TIMEOUT);
 	}
 
+	if (id->driver_info & BTUSB_BARROT) {
+		/* Support is advertised, but the controller hangs on it */
+		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_EXT_SCAN);
+		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_EXT_CREATE_CONN);
+	}
+
 	if (!reset)
 		hci_set_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE);
 

-- 
2.53.0.697.g625c4fb2daa

[PATCH 3/3] Bluetooth: btusb: Disable broken LE extended scan on Barrot controllers

[Ernesto Salvetti via B4 Relay]

From: Ernesto Salvetti <ernesto.salvetti@tambosi.tn.it>

The Barrot controller in the UGREEN Bluetooth 5.4 dongle (33fa:0010)
reports support for LE Set Extended Scan Parameters/Enable and LE
Extended Create Connection, but stops answering commands as soon as
extended scanning is used. btusb then resets the device, it
re-enumerates and the same thing happens again, in a loop every ~4
seconds whenever a scan is started (e.g. to connect to an LE device):

  Bluetooth: hci0: Opcode 0x2041 failed: -110
  Bluetooth: hci0: command 0x2041 tx timeout
  usb 9-7: USB disconnect, device number 13
  usb 9-7: new full-speed USB device number 14 using xhci_hcd

Set HCI_QUIRK_BROKEN_EXT_SCAN and HCI_QUIRK_BROKEN_EXT_CREATE_CONN so
that only the legacy LE commands are used. Extended create connection
has to go as well, since legacy and extended commands can't be mixed.

This depends on the previous two patches: without them scanning fails
with Command Disallowed and LE connections are dropped right after
they are established.

Tested with 33fa:0010 (bcdDevice 88.91) and an Xbox Wireless
Controller: scanning, LE Secure Connections pairing and HID input work.
33fa:0012 shares the BTUSB_BARROT flag but was not tested.

Assisted-by: LLM
Signed-off-by: Ernesto Salvetti <ernesto.salvetti@tambosi.tn.it>
---
 drivers/bluetooth/btusb_main.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/bluetooth/btusb_main.c b/drivers/bluetooth/btusb_main.c
index 92a78a7e6039..d5f18134ee3a 100644
--- a/drivers/bluetooth/btusb_main.c
+++ b/drivers/bluetooth/btusb_main.c
@@ -4735,6 +4735,12 @@ static int btusb_probe(struct usb_interface *intf,
 		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_WRITE_AUTH_PAYLOAD_TIMEOUT);
 	}
 
+	if (id->driver_info & BTUSB_BARROT) {
+		/* Support is advertised, but the controller hangs on it */
+		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_EXT_SCAN);
+		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_EXT_CREATE_CONN);
+	}
+
 	if (!reset)
 		hci_set_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE);
 

-- 
2.53.0.697.g625c4fb2daa

RE: Bluetooth: Fix LE on Barrot 33fa:0010 controllers

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 3452 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1197748/

---Test result---

Test Summary:
CheckPatch                    PASS      2.73 seconds
VerifyFixes                   PASS      0.13 seconds
VerifySignedoff               PASS      0.13 seconds
GitLint                       PASS      1.09 seconds
SubjectPrefix                 PASS      0.37 seconds
BuildKernel                   PASS      32.02 seconds
CheckAllWarning               PASS      39.69 seconds
CheckSparse                   WARNING   39.28 seconds
BuildKernel32                 PASS      31.88 seconds
CheckKernelLLVM               PASS      36.79 seconds
TestRunnerSetup               PASS      747.97 seconds
TestRunner_l2cap-tester       FAIL      12.26 seconds
TestRunner_iso-tester         PASS      15.38 seconds
TestRunner_bnep-tester        PASS      3.17 seconds
TestRunner_mgmt-tester        PASS      88.29 seconds
TestRunner_rfcomm-tester      PASS      4.53 seconds
TestRunner_sco-tester         PASS      5.67 seconds
TestRunner_ioctl-tester       PASS      4.72 seconds
TestRunner_mesh-tester        PASS      5.57 seconds
TestRunner_smp-tester         PASS      4.39 seconds
TestRunner_userchan-tester    PASS      3.25 seconds
TestRunner_6lowpan-tester     PASS      4.45 seconds
IncrementalBuild              PASS      53.50 seconds

Details
##############################
Test: CheckSparse - WARNING
Desc: Run sparse tool with linux kernel
Output:
net/bluetooth/hci_event.c: note: in included file (through include/net/bluetooth/hci_core.h):
##############################
Test: TestRunner_l2cap-tester - FAIL
Desc: Run l2cap-tester with test-runner
Output:
Sanitizer errors:
==36==ERROR: AddressSanitizer: heap-use-after-free on address 0x7b4fc86e33d0 at pc 0x564063e1be8e bp 0x7ffebf4101f0 sp 0x7ffebf4101e0
READ of size 4 at 0x7b4fc86e33d0 thread T0
    #0 0x564063e1be8d in timeout_callback src/shared/timeout-mainloop.c:33
    #1 0x564063e1cb75 in timeout_callback src/shared/mainloop.c:270
    #2 0x564063e1daa6 in mainloop_run src/shared/mainloop.c:124
    #3 0x564063e203fa in mainloop_run_with_signal src/shared/mainloop-notify.c:196
    #4 0x564063e2564b in tester_run src/shared/tester.c:1223
    #5 0x564063d4f17d in main tools/l2cap-tester.c:3918
    #6 0x7f0fc9685600 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:59
    #7 0x7f0fc9685717 in __libc_start_main_impl ../csu/libc-start.c:360
    #8 0x564063d55c84 in _start (/home/runner/work/bluetooth-next/bluetooth-next/src/bluez/tools/l2cap-tester+0x16cc84) (BuildId: 91c9d49e9766c394468e27ffa29b05e7d348169f)

0x7b4fc86e33d0 is located 0 bytes inside of 40-byte region [0x7b4fc86e33d0,0x7b4fc86e33f8)
freed by thread T0 here:
    #0 0x7f0fc9fc33ff in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:51
    #1 0x564063e1c36a in timeout_destroy src/shared/mainloop.c:251

previously allocated by thread T0 here:
    #0 0x7f0fc9fc460f in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:67
    #1 0x564063e062d5 in util_malloc src/shared/util.c:46

SUMMARY: AddressSanitizer: heap-use-after-free src/shared/timeout-mainloop.c:33 in timeout_callback
No test result found


https://github.com/bluez/bluetooth-next/pull/1035

---
Regards,
Linux Bluetooth