FAILED: patch "[PATCH] Bluetooth: btusb: drop BROKEN_EXT_SCAN quirk for 0bda:a728" failed to apply to 7.3-stable tree
Subsystems (2)
Sasha Levin
maintainerThe patch below does not apply to the 7.3-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-7.3.y
git checkout FETCH_HEAD
git cherry-pick -x df5e35f1663abc2702cf9f9e7eba024129ac5df1
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '[email protected]' --subject-prefix 'PATCH 7.3.y' 'HEAD^..'
Thanks,
Sasha
------------------ original commit in Linus's tree ------------------
From df5e35f1663abc2702cf9f9e7eba024129ac5df1 Mon Sep 17 00:00:00 2001
From: Junjie Cao <[email protected]>
Date: Sun, 20 Sep 2026 10:02:27 +0800
Subject: [PATCH] Bluetooth: btusb: drop BROKEN_EXT_SCAN quirk for 0bda:a728
Commit 5ead2063611a ("Bluetooth: btrtl: fix RTL8761B/BU broken LE extended scan") set HCI_QUIRK_BROKEN_EXT_SCAN on every RTL8761B, and commit ca0583c24661 ("Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728") kept it on 0bda:a728 on the assumption that the USB id separates dongles with broken extended scan from those with a broken legacy scan path. It does not. An 0bda:a728 unit (RTL8761BUV, fw 0xdfc6d922) on 6.18.51 fails the same way the UB500 and 0bda:8771
did: LE Set Scan Enable (0x200c) times out with -110 and btusb resets the device. With the flag removed from the table entry, scanning works on that unit.
Two dongles with the same USB id need opposite settings, so the device table cannot key the quirk either. The costs are not symmetric. Without the quirk, the unit it was written for gets -EBUSY on LE Set Extended Scan Enable (0x2042) while a connection is up. With it, 0x200c times out and btusb resets the device on three reported units, two of them in a re-enumeration loop.
Remove the flag and the table entry. 0bda:a728 matches the generic Realtek entry again and runs without the quirk, as before v7.2.
--- drivers/bluetooth/btusb_main.c | 8 -------- 1 file changed, 8 deletions(-)
drivers/bluetooth/btusb_main.c +0 -8
@@ -70,7 +70,6 @@ static struct usb_driver btusb_driver;#define BTUSB_INTEL_NO_WBS_SUPPORT BIT(26)#define BTUSB_ACTIONS_SEMI BIT(27)#define BTUSB_BARROT BIT(28) -#define BTUSB_BROKEN_EXT_SCAN BIT(29)#define BTUSB_QUALCOMM BIT(30)static const struct usb_device_id btusb_table[] = {
@@ -650,10 +649,6 @@ static const struct usb_device_id quirks_table[] = { { USB_DEVICE(0x0489, 0xe130), .driver_info = BTUSB_REALTEK | BTUSB_WIDEBAND_SPEECH }, - /* Realtek 8761BU Bluetooth devices */ - { USB_DEVICE(0x0bda, 0xa728), .driver_info = BTUSB_REALTEK | - BTUSB_BROKEN_EXT_SCAN }, - /* Realtek Bluetooth devices */ { USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01), .driver_info = BTUSB_REALTEK },
@@ -4754,9 +4749,6 @@ static int btusb_probe(struct usb_interface *intf,if (id->driver_info &BTUSB_INVALID_LE_STATES )hci_set_quirk (hdev,HCI_QUIRK_BROKEN_LE_STATES ); -if (id->driver_info &BTUSB_BROKEN_EXT_SCAN ) -hci_set_quirk (hdev,HCI_QUIRK_BROKEN_EXT_SCAN ); -if (id->driver_info &BTUSB_DIGIANSWER ) { data->cmdreq_type =USB_TYPE_VENDOR ;hci_set_quirk (hdev,HCI_QUIRK_RESET_ON_CLOSE );
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 1/3 Bluetooth: Move H:4 reassembly into the Bluetooth core
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 5299db91df03894253e8fa08627cfb9ec1429e89 ]
h4_recv_buf() is currently implemented in hci_h4.c which is only built as part of the hci_uart module, and only when CONFIG_BT_HCIUART_H4 is enabled. That makes the H:4 reassembly logic unusable by drivers which do not depend on hci_uart, e.g. btusb which needs it to implement Bulk Serialization Mode.
Move the transport agnostic part into the Bluetooth core as h4_recv_skb(), which takes a struct hci_dev instead of a struct hci_uart, along with struct h4_recv_pkt and the H4_RECV_* helpers, and keep h4_recv_buf() as a thin wrapper for the hci_uart protocols.
Since every Bluetooth driver already depends on the bluetooth module this introduces no new module dependency and no new Kconfig symbol.
Stable-dep-of: df5e35f1663a ("Bluetooth: btusb: drop BROKEN_EXT_SCAN quirk for 0bda:a728")
--- drivers/bluetooth/hci_h4.c | 123 ++----------------------- drivers/bluetooth/hci_uart.h | 39 +------- include/net/bluetooth/hci_h4.h | 60 +++++++++++++ net/bluetooth/Makefile | 2 +- net/bluetooth/hci_h4.c | 160 +++++++++++++++++++++++++++++++++ 5 files changed, 229 insertions(+), 155 deletions(-) create mode 100644 include/net/bluetooth/hci_h4.h create mode 100644 net/bluetooth/hci_h4.c
drivers/bluetooth/hci_h4.c +6 -117
@@ -29,6 +29,7 @@#include <net/bluetooth/bluetooth.h> #include <net/bluetooth/hci_core.h> +#include <net/bluetooth/hci_h4.h> #include "hci_uart.h"
@@ -112,8 +113,9 @@ static int h4_recv(struct hci_uart *hu, const void *data, int count)if (!h4)return -ENODEV ; - h4->rx_skb =h4_recv_buf (hu, h4->rx_skb, data, count, - h4_recv_pkts,ARRAY_SIZE (h4_recv_pkts)); + h4->rx_skb =h4_recv_skb (hu->hdev, &hu->alignment, &hu->padding, + h4->rx_skb, data, count, h4_recv_pkts, +ARRAY_SIZE (h4_recv_pkts));if (IS_ERR (h4->rx_skb)) {int err =PTR_ERR (h4->rx_skb);bt_dev_err (hu->hdev,"Frame reassembly failed (%d)" , err);
@@ -155,120 +157,7 @@ struct sk_buff *h4_recv_buf(struct hci_uart *hu, struct sk_buff *skb, const unsigned char *buffer, int count, const struct h4_recv_pkt *pkts, int pkts_count) { - u8 alignment = hu->alignment ? hu->alignment : 1; -struct hci_dev *hdev = hu->hdev; - -/* Check for error from previous call */ -if (IS_ERR (skb)) - skb =NULL ; - -while (count) { -int i, len; - -/* remove padding bytes from buffer */ -for (; hu->padding && count >0 ; hu->padding--) { - count--; - buffer++; - } -if (!count) -break ; - -if (!skb) { -for (i =0 ; i < pkts_count; i++) { -if (buffer[0 ] != (&pkts[i])->type) -continue ; - - skb =bt_skb_alloc ((&pkts[i])->maxlen, -GFP_ATOMIC ); -if (!skb) -return ERR_PTR (-ENOMEM ); - -hci_skb_pkt_type (skb) = (&pkts[i])->type; -hci_skb_expect (skb) = (&pkts[i])->hlen; -break ; - } - -/* Check for invalid packet type */ -if (!skb) -return ERR_PTR (-EILSEQ ); - - count -=1 ; - buffer +=1 ; - } - - len =min_t (uint,hci_skb_expect (skb) - skb->len, count); -skb_put_data (skb, buffer, len); - - count -= len; - buffer += len; - -/* Check for partial packet */ -if (skb->len <hci_skb_expect (skb)) -continue ; - -for (i =0 ; i < pkts_count; i++) { -if (hci_skb_pkt_type (skb) == (&pkts[i])->type) -break ; - } - -if (i >= pkts_count) { -kfree_skb (skb); -return ERR_PTR (-EILSEQ ); - } - -if (skb->len == (&pkts[i])->hlen) { -u16 dlen; - -switch ((&pkts[i])->lsize) { -case 0 : -/* No variable data length */ - dlen =0 ; -break ; -case 1 : -/* Single octet variable length */ - dlen = skb->data[(&pkts[i])->loff]; -hci_skb_expect (skb) += dlen; - -if (skb_tailroom (skb) < dlen) { -kfree_skb (skb); -return ERR_PTR (-EMSGSIZE ); - } -break ; -case 2 : -/* Double octet variable length */ - dlen =get_unaligned_le16 (skb->data + - (&pkts[i])->loff); -hci_skb_expect (skb) += dlen; - -if (skb_tailroom (skb) < dlen) { -kfree_skb (skb); -return ERR_PTR (-EMSGSIZE ); - } -break ; -default : -/* Unsupported variable length */ -kfree_skb (skb); -return ERR_PTR (-EILSEQ ); - } - -if (!dlen) { - hu->padding = (skb->len +1 ) % alignment; - hu->padding = (alignment - hu->padding) % alignment; - -/* No more data, complete frame */ - (&pkts[i])->recv (hdev, skb); - skb =NULL ; - } - }else { - hu->padding = (skb->len +1 ) % alignment; - hu->padding = (alignment - hu->padding) % alignment; - -/* Complete frame */ - (&pkts[i])->recv (hdev, skb); - skb =NULL ; - } - } - -return skb; + return h4_recv_skb(hu->hdev, &hu->alignment, &hu->padding, skb, buffer, +count ,pkts ,pkts_count ); }EXPORT_SYMBOL_GPL (h4_recv_buf);
drivers/bluetooth/hci_uart.h +2 -37
@@ -8,6 +8,8 @@* Copyright (C) 2004-2005 Marcel Holtmann <[email protected]> */ +#include <net/bluetooth/hci_h4.h> +#ifndef N_HCI #define N_HCI 15#endif
@@ -121,43 +123,6 @@ void hci_uart_set_flow_control(struct hci_uart *hu, bool enable);void hci_uart_set_speeds (struct hci_uart *hu,unsigned int init_speed,unsigned int oper_speed); -struct h4_recv_pkt { -u8 type;/* Packet type */ -u8 hlen;/* Header length */ -u8 loff;/* Data length offset in header */ -u8 lsize;/* Data length field size */ -u16 maxlen;/* Max overall packet length */ -int (*recv)(struct hci_dev *hdev,struct sk_buff *skb); -}; - -#define H4_RECV_ACL \ - .type = HCI_ACLDATA_PKT, \ - .hlen = HCI_ACL_HDR_SIZE, \ - .loff = 2, \ - .lsize = 2, \ - .maxlen = HCI_MAX_FRAME_SIZE \ - -#define H4_RECV_SCO \ - .type = HCI_SCODATA_PKT, \ - .hlen = HCI_SCO_HDR_SIZE, \ - .loff = 2, \ - .lsize = 1, \ - .maxlen = HCI_MAX_SCO_SIZE - -#define H4_RECV_EVENT \ - .type = HCI_EVENT_PKT, \ - .hlen = HCI_EVENT_HDR_SIZE, \ - .loff = 1, \ - .lsize = 1, \ - .maxlen = HCI_MAX_EVENT_SIZE - -#define H4_RECV_ISO \ - .type = HCI_ISODATA_PKT, \ - .hlen = HCI_ISO_HDR_SIZE, \ - .loff = 2, \ - .lsize = 2, \ - .maxlen = HCI_MAX_FRAME_SIZE \ -#ifdef CONFIG_BT_HCIUART_H4 int h4_init (void );int h4_deinit (void );
include/net/bluetooth/hci_h4.h new file +60 -0
60 lines not on this page · raw message
net/bluetooth/Makefile +1 -1
@@ -14,7 +14,7 @@ bluetooth_6lowpan-y := 6lowpan.o bluetooth-y := af_bluetooth.o hci_core.o hci_conn.o hci_event.o mgmt.o \ hci_sock.o hci_sysfs.o l2cap_core.o l2cap_sock.o smp.o lib.o \ ecdh_helper.o mgmt_util.o mgmt_config.o hci_codec.o eir.o hci_sync.o \ - hci_drv.o + hci_drv.o hci_h4.o bluetooth-$(CONFIG_DEV_COREDUMP) += coredump.o
net/bluetooth/hci_h4.c new file +160 -0
160 lines not on this page · raw message
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 2/3 Bluetooth: btusb: Build the driver from multiple source files
From: Zijun Hu <[email protected]>
[ Upstream commit be58267a34ae562a4a6932f68f1487bceb0345d7 ]
Allow the driver to include vendor USB-transport-specific source files by:
- renaming btusb.c to btusb_main.c
- making btusb.o a composite object
Used by Qualcomm QCC2072 support.
Stable-dep-of: df5e35f1663a ("Bluetooth: btusb: drop BROKEN_EXT_SCAN quirk for 0bda:a728")
---
drivers/bluetooth/Makefile | 2 ++
drivers/bluetooth/{btusb.c => btusb_main.c} | 0
2 files changed, 2 insertions(+)
rename drivers/bluetooth/{btusb.c => btusb_main.c} (100%)drivers/bluetooth/Makefile +2 -0
@@ -51,4 +51,6 @@ hci_uart-$(CONFIG_BT_HCIUART_MRVL) += hci_mrvl.o hci_uart-$(CONFIG_BT_HCIUART_AML) += hci_aml.o hci_uart-objs := $(hci_uart-y) +btusb-y := btusb_main.o + CONTEXT_ANALYSIS := y
drivers/bluetooth/btusb_main.c renamed from drivers/bluetooth/btusb.c +0 -0
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 3/3 Bluetooth: btusb: drop BROKEN_EXT_SCAN quirk for 0bda:a728
In reply to Sasha LevinFrom: Junjie Cao <[email protected]>
[ Upstream commit df5e35f1663abc2702cf9f9e7eba024129ac5df1 ]
Commit 5ead2063611a ("Bluetooth: btrtl: fix RTL8761B/BU broken LE extended scan") set HCI_QUIRK_BROKEN_EXT_SCAN on every RTL8761B, and commit ca0583c24661 ("Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728") kept it on 0bda:a728 on the assumption that the USB id separates dongles with broken extended scan from those with a broken legacy scan path. It does not. An 0bda:a728 unit (RTL8761BUV, fw 0xdfc6d922) on 6.18.51 fails the same way the UB500 and 0bda:8771
did: LE Set Scan Enable (0x200c) times out with -110 and btusb resets the device. With the flag removed from the table entry, scanning works on that unit.
Two dongles with the same USB id need opposite settings, so the device table cannot key the quirk either. The costs are not symmetric. Without the quirk, the unit it was written for gets -EBUSY on LE Set Extended Scan Enable (0x2042) while a connection is up. With it, 0x200c times out and btusb resets the device on three reported units, two of them in a re-enumeration loop.
Remove the flag and the table entry. 0bda:a728 matches the generic Realtek entry again and runs without the quirk, as before v7.2.
--- drivers/bluetooth/btusb_main.c | 8 -------- 1 file changed, 8 deletions(-)
drivers/bluetooth/btusb_main.c +0 -8
@@ -68,7 +68,6 @@ static struct usb_driver btusb_driver;#define BTUSB_INTEL_NO_WBS_SUPPORT BIT(26)#define BTUSB_ACTIONS_SEMI BIT(27)#define BTUSB_BARROT BIT(28) -#define BTUSB_BROKEN_EXT_SCAN BIT(29)static const struct usb_device_id btusb_table[] = {/*
@@ -636,10 +635,6 @@ static const struct usb_device_id quirks_table[] = { { USB_DEVICE(0x0489, 0xe130), .driver_info = BTUSB_REALTEK | BTUSB_WIDEBAND_SPEECH }, - /* Realtek 8761BU Bluetooth devices */ - { USB_DEVICE(0x0bda, 0xa728), .driver_info = BTUSB_REALTEK | - BTUSB_BROKEN_EXT_SCAN }, - /* Realtek Bluetooth devices */ { USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01), .driver_info = BTUSB_REALTEK },
@@ -4495,9 +4490,6 @@ static int btusb_probe(struct usb_interface *intf,if (id->driver_info &BTUSB_INVALID_LE_STATES )hci_set_quirk (hdev,HCI_QUIRK_BROKEN_LE_STATES ); -if (id->driver_info &BTUSB_BROKEN_EXT_SCAN ) -hci_set_quirk (hdev,HCI_QUIRK_BROKEN_EXT_SCAN ); -if (id->driver_info &BTUSB_DIGIANSWER ) { data->cmdreq_type =USB_TYPE_VENDOR ;hci_set_quirk (hdev,HCI_QUIRK_RESET_ON_CLOSE );
Signature · 1 line
2.53.0