Re: [RFC PATCH v2 1/1] Bluetooth: btusb: test larger LE packets on TP-Link UB500

[Luiz Augusto von Dentz]

Hi Kyle,

On Wed, Oct 28, 2026 at 8:14 PM Kyle Pepper <cochcoder@xxxxxxxxx> wrote:
>
> The tested TP-Link UB500 (2357:0604, RTL8761BU firmware 0xdfc6d922)
> reports an LE ACL length of 27 bytes and eight packets. It accepts
> 167-byte LE HCI ACL packets during ASHA playback. A size-only test
> streams clearly with the eight reported LE credits retained, so the
> previous shared-buffer workaround does not establish shared pools.
>
> Use post_init to test a host LE ACL length of 167 for this USB ID,
> without changing LE packet/credit counts or BR/EDR fields. Refuse
> unexpected initialization values rather than applying this diagnostic
> to a different reported buffer configuration.
>
> This is an experimental RFC: 167 is a demonstrated working length,
> not a measured maximum. The appropriate general limit and firmware
> scope still need confirmation. Mixed BR/EDR and LE capacity and
> exceptional-congestion behavior have not been established.
>
> The ASHA 7.2.9 trial completes all 3269 HCI packets, including 3243
> whole audio SDUs, with a maximum of three outstanding packets. The
> human listening verdict is CLEAR. PipeWire and its actual 4608-byte
> socket send buffer are unchanged. Increasing only that socket buffer
> to 8192 with HCI length 27 previously crackled and underfed the stream.
>
> Prepared with AI assistance for source, evidence analysis and text;
> hardware playback and listening were performed by the submitter.
>
> Assisted-by: LLM
> Signed-off-by: Kyle Pepper <cochcoder@xxxxxxxxx>
> ---
>  drivers/bluetooth/btusb_main.c | 15 +++++++++++++++
>  1 file changed, 15 insertions(+)
>
> diff --git a/drivers/bluetooth/btusb_main.c b/drivers/bluetooth/btusb_main.c
> index 92a78a7e6..2b955ed4b 100644
> --- a/drivers/bluetooth/btusb_main.c
> +++ b/drivers/bluetooth/btusb_main.c
> @@ -2972,6 +2972,18 @@ static int btusb_setup_realtek(struct hci_dev *hdev)
>         return ret;
>  }
>
> +/* Private diagnostic: test a known accepted packet size, not a pool claim. */
> +static int btusb_ub500_test_post_init(struct hci_dev *hdev)
> +{
> +       if (hdev->le_mtu != 27 || hdev->le_pkts != 8)
> +               return -EINVAL;
> +
> +       bt_dev_info(hdev, "UB500 TEST ONLY: LE ACL MTU 27 -> 167; LE packets %u unchanged",
> +                   hdev->le_pkts);
> +       hdev->le_mtu = 167;

Try checking what is the maximun data length it supports, since that
is a strong indication of what the buffer size should be.

> +       return 0;
> +}
> +
>  static int btusb_recv_event_realtek(struct hci_dev *hdev, struct sk_buff *skb)
>  {
>         if (skb->len >= HCI_EVENT_HDR_SIZE + 1 &&
> @@ -4715,6 +4727,9 @@ static int btusb_probe(struct usb_interface *intf,
>             (id->driver_info & BTUSB_REALTEK)) {
>                 btrtl_set_driver_name(hdev, btusb_driver.name);
>                 hdev->setup = btusb_setup_realtek;
> +               if (le16_to_cpu(data->udev->descriptor.idVendor) == 0x2357 &&
> +                   le16_to_cpu(data->udev->descriptor.idProduct) == 0x0604)
> +                       hdev->post_init = btusb_ub500_test_post_init;
>                 hdev->shutdown = btrtl_shutdown_realtek;
>                 hdev->reset = btusb_rtl_reset;
>                 hdev->hw_error = btusb_rtl_hw_error;
> --
> 2.56.0
>
>


-- 
Luiz Augusto von Dentz