[PATCH 0/3] Bluetooth: Fix LE on Barrot 33fa:0010 controllers

[Ernesto Salvetti via B4 Relay]

The UGREEN Bluetooth 5.4 USB dongle (33fa:0010, Barrot chip, bound to
btusb via BTUSB_BARROT) works for BR/EDR, but LE is unusable: as soon as
a scan is started the controller hangs on LE Set Extended Scan
Parameters and btusb resets it in a loop. Once that is avoided, two more
problems show up before an LE device can be used. This series fixes
them one at a time:

1/3 Setting HCI_QUIRK_BROKEN_EXT_SCAN alone is not enough on a
    controller that enforces the spec rule that legacy and extended
    LE commands must not be mixed: the stack still uses extended
    advertising (LE Read Number of Supported Advertising Sets is sent
    during init), after which the legacy scan commands are rejected
    with Command Disallowed. Don't use extended advertising when
    extended scanning is marked broken. This also affects the other
    users of the quirk (hci_bcm4377, Actions ATS2851 and Realtek
    0bda:a728 in btusb), which will fall back to legacy advertising;
    I could not test those.

2/3 The controller answers LE Read Remote Used Features with
    Controller Busy right after connecting, and the stack drops the
    link. Continue without the remote features instead.

3/3 Set HCI_QUIRK_BROKEN_EXT_SCAN and HCI_QUIRK_BROKEN_EXT_CREATE_CONN
    for BTUSB_BARROT devices.

Testing: on bluetooth-next each patch builds (clang, W=1) without new
warnings. The runtime tests were done on v7.2.11 (PikaOS kernel) with
the series backported; patch 2 needed a context adjustment there, since
hci_cs_le_read_remote_features() in v7.2.11 lacks the
HCI_ERROR_UNSUPPORTED_REMOTE_FEATURE handling. With a 33fa:0010
(bcdDevice 88.91) and an Xbox Wireless Controller, checked with btmon:

 - without patch 1: Command Disallowed on every LE Set Scan Parameters
 - with the full series: scanning works, LE Secure Connections pairing
   from scratch succeeds, reconnecting with the stored LTK works, and
   the controller shows up as HID gamepad (hid-microsoft).

Before that I used an earlier btusb-only workaround with the same
effect for an afternoon of gaming without problems.

33fa:0012 shares the BTUSB_BARROT flag but I don't have one to test.

Tool use: the investigation and the patches were done with the help of
an AI coding assistant (Claude, Anthropic) in an interactive session.
It analysed the btmon/dmesg logs, read the relevant core code, proposed
and wrote the changes and the changelogs, and ran checkpatch. I ran all
hardware tests, reviewed the changes and take responsibility for them.
The patches carry an Assisted-by tag accordingly.

---
Ernesto Salvetti (3):
      Bluetooth: hci_core: Don't use extended advertising with broken ext scan
      Bluetooth: hci_event: Don't drop LE link on busy remote features read
      Bluetooth: btusb: Disable broken LE extended scan on Barrot controllers

 drivers/bluetooth/btusb_main.c   |  6 ++++++
 include/net/bluetooth/hci.h      |  5 ++++-
 include/net/bluetooth/hci_core.h | 11 +++++++++--
 net/bluetooth/hci_event.c        | 11 +++++++++++
 4 files changed, 30 insertions(+), 3 deletions(-)
---
base-commit: 42b8c2d729268a65a2d98064e8dc59ff53646b14
change-id: 20261031-barrot-le-fixes-v1-95624ffd0a43

Best regards,
--  
Ernesto Salvetti <ernesto.salvetti@xxxxxxxxxxxxx>