Re: [PATCH 0/3] Bluetooth: Fix LE on Barrot 33fa:0010 controllers

[Luiz Augusto von Dentz]

Hi Ernesto,

On Sat, Oct 31, 2026 at 8:16 AM Ernesto Salvetti via B4 Relay
<devnull+ernesto.salvetti.tambosi.tn.it@xxxxxxxxxx> wrote:
>
> The UGREEN Bluetooth 5.4 USB dongle (33fa:0010, Barrot chip, bound to
> btusb via BTUSB_BARROT) works for BR/EDR, but LE is unusable: as soon as
> a scan is started the controller hangs on LE Set Extended Scan
> Parameters and btusb resets it in a loop. Once that is avoided, two more
> problems show up before an LE device can be used. This series fixes
> them one at a time:
>
> 1/3 Setting HCI_QUIRK_BROKEN_EXT_SCAN alone is not enough on a
>     controller that enforces the spec rule that legacy and extended
>     LE commands must not be mixed: the stack still uses extended
>     advertising (LE Read Number of Supported Advertising Sets is sent
>     during init), after which the legacy scan commands are rejected
>     with Command Disallowed. Don't use extended advertising when
>     extended scanning is marked broken. This also affects the other
>     users of the quirk (hci_bcm4377, Actions ATS2851 and Realtek
>     0bda:a728 in btusb), which will fall back to legacy advertising;
>     I could not test those.
>
> 2/3 The controller answers LE Read Remote Used Features with
>     Controller Busy right after connecting, and the stack drops the
>     link. Continue without the remote features instead.
>
> 3/3 Set HCI_QUIRK_BROKEN_EXT_SCAN and HCI_QUIRK_BROKEN_EXT_CREATE_CONN
>     for BTUSB_BARROT devices.
>
> Testing: on bluetooth-next each patch builds (clang, W=1) without new
> warnings. The runtime tests were done on v7.2.11 (PikaOS kernel) with
> the series backported; patch 2 needed a context adjustment there, since
> hci_cs_le_read_remote_features() in v7.2.11 lacks the
> HCI_ERROR_UNSUPPORTED_REMOTE_FEATURE handling. With a 33fa:0010
> (bcdDevice 88.91) and an Xbox Wireless Controller, checked with btmon:
>
>  - without patch 1: Command Disallowed on every LE Set Scan Parameters
>  - with the full series: scanning works, LE Secure Connections pairing
>    from scratch succeeds, reconnecting with the stored LTK works, and
>    the controller shows up as HID gamepad (hid-microsoft).
>
> Before that I used an earlier btusb-only workaround with the same
> effect for an afternoon of gaming without problems.
>
> 33fa:0012 shares the BTUSB_BARROT flag but I don't have one to test.
>
> Tool use: the investigation and the patches were done with the help of
> an AI coding assistant (Claude, Anthropic) in an interactive session.
> It analysed the btmon/dmesg logs, read the relevant core code, proposed
> and wrote the changes and the changelogs, and ran checkpatch. I ran all
> hardware tests, reviewed the changes and take responsibility for them.
> The patches carry an Assisted-by tag accordingly.
>
> ---
> Ernesto Salvetti (3):
>       Bluetooth: hci_core: Don't use extended advertising with broken ext scan
>       Bluetooth: hci_event: Don't drop LE link on busy remote features read
>       Bluetooth: btusb: Disable broken LE extended scan on Barrot controllers
>
>  drivers/bluetooth/btusb_main.c   |  6 ++++++
>  include/net/bluetooth/hci.h      |  5 ++++-
>  include/net/bluetooth/hci_core.h | 11 +++++++++--
>  net/bluetooth/hci_event.c        | 11 +++++++++++
>  4 files changed, 30 insertions(+), 3 deletions(-)
> ---
> base-commit: 42b8c2d729268a65a2d98064e8dc59ff53646b14
> change-id: 20261031-barrot-le-fixes-v1-95624ffd0a43
>
> Best regards,
> --
> Ernesto Salvetti <ernesto.salvetti@xxxxxxxxxxxxx>

netdev sashiko found a couple of problems:
https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261031-barrot-le-fixes-v1-v1-0-30e2089882bf%40tambosi.tn.it


-- 
Luiz Augusto von Dentz