[PATCH] Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728

[PATCH] Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728

[Junjie Cao]

Commit 5ead2063611a ("Bluetooth: btrtl: fix RTL8761B/BU broken LE
extended scan") set HCI_QUIRK_BROKEN_EXT_SCAN for every CHIP_ID_8761B
device to cure repeated 0x2042 failures on an 0bda:a728 dongle. The
brokenness is per-dongle, not per-chip: on a TP-Link UB500 (2357:0604,
RTL8761BU, fw 0xdfc6d922) extended scan works, and the legacy scan
path the quirk forces is what is broken -- LE Set Scan Enable (0x200c)
times out with -110 about 30 s after firmware load, btusb resets the
device, and the adapter re-enumerates in an endless loop (382 firmware
reloads in one boot). 7.1.8, which predates the stable backport, runs
clean on this unit; 7.1.9 loops.

Move the quirk from btrtl's chip-wide switch to a btusb device-table
flag on the USB id the original fix was verified against. Other 8761B
dongles return to their earlier long-standing behaviour.

Link: https://bugzilla.redhat.com/show_bug.cgi?id=2521504
Fixes: 5ead2063611a ("Bluetooth: btrtl: fix RTL8761B/BU broken LE extended scan")
Cc: stable@vger.kernel.org
Signed-off-by: Junjie Cao <junjie.cao@intel.com>
---
#regzbot introduced: 5ead2063611a
#regzbot link: https://bugzilla.redhat.com/show_bug.cgi?id=2521504

 drivers/bluetooth/btrtl.c | 13 -------------
 drivers/bluetooth/btusb.c |  8 ++++++++
 2 files changed, 8 insertions(+), 13 deletions(-)

diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
index 7f54d2d2d13a..03fa9409e3ee 100644
--- a/drivers/bluetooth/btrtl.c
+++ b/drivers/bluetooth/btrtl.c
@@ -1343,19 +1343,6 @@ void btrtl_set_quirks(struct hci_dev *hdev, struct btrtl_device_info *btrtl_dev)
 	if (!btrtl_dev->ic_info)
 		return;
 
-	switch (btrtl_dev->project_id) {
-	case CHIP_ID_8761B:
-		/* RTL8761B/BU reports HCI version 5.1 but does not support
-		 * the LE Extended Scan commands (Opcode 0x2042), causing
-		 * repeated -EBUSY failures when BlueZ attempts extended
-		 * scanning while a connection is active.
-		 */
-		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_EXT_SCAN);
-		break;
-	default:
-		break;
-	}
-
 	switch (btrtl_dev->ic_info->lmp_subver) {
 	case RTL_ROM_LMP_8703B:
 		/* 8723CS reports two pages for local ext features,
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 2bae85b0016c..84614e60d142 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -67,6 +67,7 @@ static struct usb_driver btusb_driver;
 #define BTUSB_INTEL_NO_WBS_SUPPORT	BIT(26)
 #define BTUSB_ACTIONS_SEMI		BIT(27)
 #define BTUSB_BARROT			BIT(28)
+#define BTUSB_BROKEN_EXT_SCAN		BIT(29)
 
 static const struct usb_device_id btusb_table[] = {
 	/* Generic Bluetooth USB device */
@@ -619,6 +620,10 @@ static const struct usb_device_id quirks_table[] = {
 	{ USB_DEVICE(0x0489, 0xe130), .driver_info = BTUSB_REALTEK |
 						     BTUSB_WIDEBAND_SPEECH },
 
+	/* Realtek 8761BU Bluetooth devices */
+	{ USB_DEVICE(0x0bda, 0xa728), .driver_info = BTUSB_REALTEK |
+						     BTUSB_BROKEN_EXT_SCAN },
+
 	/* Realtek Bluetooth devices */
 	{ USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01),
 	  .driver_info = BTUSB_REALTEK },
@@ -4403,6 +4408,9 @@ static int btusb_probe(struct usb_interface *intf,
 	if (id->driver_info & BTUSB_INVALID_LE_STATES)
 		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_STATES);
 
+	if (id->driver_info & BTUSB_BROKEN_EXT_SCAN)
+		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_EXT_SCAN);
+
 	if (id->driver_info & BTUSB_DIGIANSWER) {
 		data->cmdreq_type = USB_TYPE_VENDOR;
 		hci_set_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE);
-- 
2.43.0

Re: [PATCH] Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728

[Thorsten Leemhuis]

On 8/24/26 07:32, Junjie Cao wrote:
> Commit 5ead2063611a ("Bluetooth: btrtl: fix RTL8761B/BU broken LE
> extended scan") set HCI_QUIRK_BROKEN_EXT_SCAN for every CHIP_ID_8761B
> device to cure repeated 0x2042 failures on an 0bda:a728 dongle. The
> brokenness is per-dongle, not per-chip: on a TP-Link UB500 (2357:0604,
> RTL8761BU, fw 0xdfc6d922) extended scan works, and the legacy scan
> path the quirk forces is what is broken -- LE Set Scan Enable (0x200c)
> times out with -110 about 30 s after firmware load, btusb resets the
> device, and the adapter re-enumerates in an endless loop (382 firmware
> reloads in one boot). 7.1.8, which predates the stable backport, runs
> clean on this unit; 7.1.9 loops.
> 
> Move the quirk from btrtl's chip-wide switch to a btusb device-table
> flag on the USB id the original fix was verified against. Other 8761B
> dongles return to their earlier long-standing behaviour.
> > Link: https://bugzilla.redhat.com/show_bug.cgi?id=2521504
> Fixes: 5ead2063611a ("Bluetooth: btrtl: fix RTL8761B/BU broken LE extended scan")

Thx. Just to make sure everyone is aware of it: Kamil (now CCed)
reported problems due to the commit yesterday and provided patches, too:
https://lore.kernel.org/all/20260822141115.58815-1-kserwus@gmail.com/

I suggested that a quick revert might be the best approach for now,
which Kamil submitted:
https://lore.kernel.org/all/20260823102959.100368-1-kserwus@gmail.com/

No comment yet from the BT folks yet.

Ciao, Thorsten

> Cc: stable@vger.kernel.org
> Signed-off-by: Junjie Cao <junjie.cao@intel.com>
> ---
> #regzbot introduced: 5ead2063611a
> #regzbot link: https://bugzilla.redhat.com/show_bug.cgi?id=2521504
> 
>  drivers/bluetooth/btrtl.c | 13 -------------
>  drivers/bluetooth/btusb.c |  8 ++++++++
>  2 files changed, 8 insertions(+), 13 deletions(-)
> 
> diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
> index 7f54d2d2d13a..03fa9409e3ee 100644
> --- a/drivers/bluetooth/btrtl.c
> +++ b/drivers/bluetooth/btrtl.c
> @@ -1343,19 +1343,6 @@ void btrtl_set_quirks(struct hci_dev *hdev, struct btrtl_device_info *btrtl_dev)
>  	if (!btrtl_dev->ic_info)
>  		return;
>  
> -	switch (btrtl_dev->project_id) {
> -	case CHIP_ID_8761B:
> -		/* RTL8761B/BU reports HCI version 5.1 but does not support
> -		 * the LE Extended Scan commands (Opcode 0x2042), causing
> -		 * repeated -EBUSY failures when BlueZ attempts extended
> -		 * scanning while a connection is active.
> -		 */
> -		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_EXT_SCAN);
> -		break;
> -	default:
> -		break;
> -	}
> -
>  	switch (btrtl_dev->ic_info->lmp_subver) {
>  	case RTL_ROM_LMP_8703B:
>  		/* 8723CS reports two pages for local ext features,
> diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
> index 2bae85b0016c..84614e60d142 100644
> --- a/drivers/bluetooth/btusb.c
> +++ b/drivers/bluetooth/btusb.c
> @@ -67,6 +67,7 @@ static struct usb_driver btusb_driver;
>  #define BTUSB_INTEL_NO_WBS_SUPPORT	BIT(26)
>  #define BTUSB_ACTIONS_SEMI		BIT(27)
>  #define BTUSB_BARROT			BIT(28)
> +#define BTUSB_BROKEN_EXT_SCAN		BIT(29)
>  
>  static const struct usb_device_id btusb_table[] = {
>  	/* Generic Bluetooth USB device */
> @@ -619,6 +620,10 @@ static const struct usb_device_id quirks_table[] = {
>  	{ USB_DEVICE(0x0489, 0xe130), .driver_info = BTUSB_REALTEK |
>  						     BTUSB_WIDEBAND_SPEECH },
>  
> +	/* Realtek 8761BU Bluetooth devices */
> +	{ USB_DEVICE(0x0bda, 0xa728), .driver_info = BTUSB_REALTEK |
> +						     BTUSB_BROKEN_EXT_SCAN },
> +
>  	/* Realtek Bluetooth devices */
>  	{ USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01),
>  	  .driver_info = BTUSB_REALTEK },
> @@ -4403,6 +4408,9 @@ static int btusb_probe(struct usb_interface *intf,
>  	if (id->driver_info & BTUSB_INVALID_LE_STATES)
>  		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_STATES);
>  
> +	if (id->driver_info & BTUSB_BROKEN_EXT_SCAN)
> +		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_EXT_SCAN);
> +
>  	if (id->driver_info & BTUSB_DIGIANSWER) {
>  		data->cmdreq_type = USB_TYPE_VENDOR;
>  		hci_set_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE);

Re: [PATCH] Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728

[Luiz Augusto von Dentz]

Hi Kamil,

On Mon, Aug 24, 2026 at 2:03 AM Thorsten Leemhuis
<regressions@leemhuis.info> wrote:
>
> On 8/24/26 07:32, Junjie Cao wrote:
> > Commit 5ead2063611a ("Bluetooth: btrtl: fix RTL8761B/BU broken LE
> > extended scan") set HCI_QUIRK_BROKEN_EXT_SCAN for every CHIP_ID_8761B
> > device to cure repeated 0x2042 failures on an 0bda:a728 dongle. The
> > brokenness is per-dongle, not per-chip: on a TP-Link UB500 (2357:0604,
> > RTL8761BU, fw 0xdfc6d922) extended scan works, and the legacy scan
> > path the quirk forces is what is broken -- LE Set Scan Enable (0x200c)
> > times out with -110 about 30 s after firmware load, btusb resets the
> > device, and the adapter re-enumerates in an endless loop (382 firmware
> > reloads in one boot). 7.1.8, which predates the stable backport, runs
> > clean on this unit; 7.1.9 loops.
> >
> > Move the quirk from btrtl's chip-wide switch to a btusb device-table
> > flag on the USB id the original fix was verified against. Other 8761B
> > dongles return to their earlier long-standing behaviour.
> > > Link: https://bugzilla.redhat.com/show_bug.cgi?id=2521504
> > Fixes: 5ead2063611a ("Bluetooth: btrtl: fix RTL8761B/BU broken LE extended scan")
>
> Thx. Just to make sure everyone is aware of it: Kamil (now CCed)
> reported problems due to the commit yesterday and provided patches, too:
> https://lore.kernel.org/all/20260822141115.58815-1-kserwus@gmail.com/
>
> I suggested that a quick revert might be the best approach for now,
> which Kamil submitted:
> https://lore.kernel.org/all/20260823102959.100368-1-kserwus@gmail.com/
>
> No comment yet from the BT folks yet.
>
> Ciao, Thorsten
>
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Junjie Cao <junjie.cao@intel.com>
> > ---
> > #regzbot introduced: 5ead2063611a
> > #regzbot link: https://bugzilla.redhat.com/show_bug.cgi?id=2521504
> >
> >  drivers/bluetooth/btrtl.c | 13 -------------
> >  drivers/bluetooth/btusb.c |  8 ++++++++
> >  2 files changed, 8 insertions(+), 13 deletions(-)
> >
> > diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
> > index 7f54d2d2d13a..03fa9409e3ee 100644
> > --- a/drivers/bluetooth/btrtl.c
> > +++ b/drivers/bluetooth/btrtl.c
> > @@ -1343,19 +1343,6 @@ void btrtl_set_quirks(struct hci_dev *hdev, struct btrtl_device_info *btrtl_dev)
> >       if (!btrtl_dev->ic_info)
> >               return;
> >
> > -     switch (btrtl_dev->project_id) {
> > -     case CHIP_ID_8761B:
> > -             /* RTL8761B/BU reports HCI version 5.1 but does not support
> > -              * the LE Extended Scan commands (Opcode 0x2042), causing
> > -              * repeated -EBUSY failures when BlueZ attempts extended
> > -              * scanning while a connection is active.
> > -              */
> > -             hci_set_quirk(hdev, HCI_QUIRK_BROKEN_EXT_SCAN);
> > -             break;
> > -     default:
> > -             break;
> > -     }
> > -
> >       switch (btrtl_dev->ic_info->lmp_subver) {
> >       case RTL_ROM_LMP_8703B:
> >               /* 8723CS reports two pages for local ext features,
> > diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
> > index 2bae85b0016c..84614e60d142 100644
> > --- a/drivers/bluetooth/btusb.c
> > +++ b/drivers/bluetooth/btusb.c
> > @@ -67,6 +67,7 @@ static struct usb_driver btusb_driver;
> >  #define BTUSB_INTEL_NO_WBS_SUPPORT   BIT(26)
> >  #define BTUSB_ACTIONS_SEMI           BIT(27)
> >  #define BTUSB_BARROT                 BIT(28)
> > +#define BTUSB_BROKEN_EXT_SCAN                BIT(29)
> >
> >  static const struct usb_device_id btusb_table[] = {
> >       /* Generic Bluetooth USB device */
> > @@ -619,6 +620,10 @@ static const struct usb_device_id quirks_table[] = {
> >       { USB_DEVICE(0x0489, 0xe130), .driver_info = BTUSB_REALTEK |
> >                                                    BTUSB_WIDEBAND_SPEECH },
> >
> > +     /* Realtek 8761BU Bluetooth devices */
> > +     { USB_DEVICE(0x0bda, 0xa728), .driver_info = BTUSB_REALTEK |
> > +                                                  BTUSB_BROKEN_EXT_SCAN },
> > +
> >       /* Realtek Bluetooth devices */
> >       { USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01),
> >         .driver_info = BTUSB_REALTEK },
> > @@ -4403,6 +4408,9 @@ static int btusb_probe(struct usb_interface *intf,
> >       if (id->driver_info & BTUSB_INVALID_LE_STATES)
> >               hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_STATES);
> >
> > +     if (id->driver_info & BTUSB_BROKEN_EXT_SCAN)
> > +             hci_set_quirk(hdev, HCI_QUIRK_BROKEN_EXT_SCAN);
> > +
> >       if (id->driver_info & BTUSB_DIGIANSWER) {
> >               data->cmdreq_type = USB_TYPE_VENDOR;
> >               hci_set_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE);

Any chance to test this change? It looks better since it does remove
the original workaround for the specific USB ID while also fixing the
regression.

-- 
Luiz Augusto von Dentz

Re: [PATCH] Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Mon, 24 Aug 2026 13:32:27 +0800 you wrote:
> Commit 5ead2063611a ("Bluetooth: btrtl: fix RTL8761B/BU broken LE
> extended scan") set HCI_QUIRK_BROKEN_EXT_SCAN for every CHIP_ID_8761B
> device to cure repeated 0x2042 failures on an 0bda:a728 dongle. The
> brokenness is per-dongle, not per-chip: on a TP-Link UB500 (2357:0604,
> RTL8761BU, fw 0xdfc6d922) extended scan works, and the legacy scan
> path the quirk forces is what is broken -- LE Set Scan Enable (0x200c)
> times out with -110 about 30 s after firmware load, btusb resets the
> device, and the adapter re-enumerates in an endless loop (382 firmware
> reloads in one boot). 7.1.8, which predates the stable backport, runs
> clean on this unit; 7.1.9 loops.
> 
> [...]

Here is the summary with links:
  - Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728
    https://git.kernel.org/bluetooth/bluetooth-next/c/0c9d2588a514

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html