[RFC PATCH v3 1/1] Bluetooth: btusb: test reported maximum LE length on TP-Link UB500

[Kyle Pepper <cochcoder@proton.me>]

The tested TP-Link UB500 (2357:0604, RTL8761BU firmware 0xdfc6d922)
reports maximum TX and RX data lengths of 251 octets through LE Read
Maximum Data Length, while LE Read Buffer Size reports 27 octets and
eight packets. The previous RFC demonstrated 167-byte HCI packets
with unchanged LE credits during ASHA playback.

Use the reported maximum TX data length as the next experimental host
LE ACL length instead of an ASHA-specific 167-byte constant. Require
the observed 251-byte maximum and 27/eight buffer reply; preserve LE
credits and BR/EDR fields. The maximum-data-length value describes
Link Layer capability and is an indication to test, not proof of the
physical HCI buffer size or pool layout.

A direct HCI user-channel experiment sends sixteen whole packets at
each HCI payload length of 27, 167 and 251 octets from UB500 to a
MediaTek receiver. All 48 payloads are received byte-for-byte intact
and all 48 HCI packets complete, with zero pending. This establishes
251-byte HCI acceptance separately from the reported Link Layer limit.
Only one packet is outstanding at a time; the experiment neither
installs the revised callback nor streams audio.

Keep this a TEST ONLY RFC. Eight simultaneous large packets, larger
HCI limits, mixed BR/EDR capacity, other firmware and sustained audio
with the revised callback have not been established.

Assisted-by: LLM
Signed-off-by: Kyle Pepper <cochcoder@proton.me>
---
 drivers/bluetooth/btusb_main.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/drivers/bluetooth/btusb_main.c b/drivers/bluetooth/btusb_main.c
index 92a78a7e6..b654cf5be 100644
--- a/drivers/bluetooth/btusb_main.c
+++ b/drivers/bluetooth/btusb_main.c
@@ -2972,6 +2972,19 @@ static int btusb_setup_realtek(struct hci_dev *hdev)
 	return ret;
 }
 
+/* Private diagnostic: test the reported Link Layer maximum as an HCI size. */
+static int btusb_ub500_test_post_init(struct hci_dev *hdev)
+{
+	if (hdev->le_mtu != 27 || hdev->le_pkts != 8 ||
+	    hdev->le_max_tx_len != 251)
+		return -EINVAL;
+
+	bt_dev_info(hdev, "UB500 TEST ONLY: LE ACL MTU 27 -> %u; LE packets %u unchanged",
+		    hdev->le_max_tx_len, hdev->le_pkts);
+	hdev->le_mtu = hdev->le_max_tx_len;
+	return 0;
+}
+
 static int btusb_recv_event_realtek(struct hci_dev *hdev, struct sk_buff *skb)
 {
 	if (skb->len >= HCI_EVENT_HDR_SIZE + 1 &&
@@ -4715,6 +4728,9 @@ static int btusb_probe(struct usb_interface *intf,
 	    (id->driver_info & BTUSB_REALTEK)) {
 		btrtl_set_driver_name(hdev, btusb_driver.name);
 		hdev->setup = btusb_setup_realtek;
+		if (le16_to_cpu(data->udev->descriptor.idVendor) == 0x2357 &&
+		    le16_to_cpu(data->udev->descriptor.idProduct) == 0x0604)
+			hdev->post_init = btusb_ub500_test_post_init;
 		hdev->shutdown = btrtl_shutdown_realtek;
 		hdev->reset = btusb_rtl_reset;
 		hdev->hw_error = btusb_rtl_hw_error;
-- 
2.56.0