Re: [RFC PATCH v3 1/1] Bluetooth: btusb: test reported maximum LE length on TP-Link UB500

[cochcoder]

Accidentally left in the last comment to keep it as a test only RFC, I've tested the changes and haven't noticed any regressions. Please ignore that. 



On Wednesday, October 28th, 2026 at 10:32 PM, Kyle Pepper <cochcoder@xxxxxxxxx> wrote:

> The tested TP-Link UB500 (2357:0604, RTL8761BU firmware 0xdfc6d922)
> reports maximum TX and RX data lengths of 251 octets through LE Read
> Maximum Data Length, while LE Read Buffer Size reports 27 octets and
> eight packets. The previous RFC demonstrated 167-byte HCI packets
> with unchanged LE credits during ASHA playback.
> 
> Use the reported maximum TX data length as the next experimental host
> LE ACL length instead of an ASHA-specific 167-byte constant. Require
> the observed 251-byte maximum and 27/eight buffer reply; preserve LE
> credits and BR/EDR fields. The maximum-data-length value describes
> Link Layer capability and is an indication to test, not proof of the
> physical HCI buffer size or pool layout.
> 
> A direct HCI user-channel experiment sends sixteen whole packets at
> each HCI payload length of 27, 167 and 251 octets from UB500 to a
> MediaTek receiver. All 48 payloads are received byte-for-byte intact
> and all 48 HCI packets complete, with zero pending. This establishes
> 251-byte HCI acceptance separately from the reported Link Layer limit.
> Only one packet is outstanding at a time; the experiment neither
> installs the revised callback nor streams audio.
> 
> Keep this a TEST ONLY RFC. Eight simultaneous large packets, larger
> HCI limits, mixed BR/EDR capacity, other firmware and sustained audio
> with the revised callback have not been established.
> 
> Assisted-by: LLM
> Signed-off-by: Kyle Pepper <cochcoder@xxxxxxxxx>
> ---
>  drivers/bluetooth/btusb_main.c | 16 ++++++++++++++++
>  1 file changed, 16 insertions(+)
> 
> diff --git a/drivers/bluetooth/btusb_main.c b/drivers/bluetooth/btusb_main.c
> index 92a78a7e6..b654cf5be 100644
> --- a/drivers/bluetooth/btusb_main.c
> +++ b/drivers/bluetooth/btusb_main.c
> @@ -2972,6 +2972,19 @@ static int btusb_setup_realtek(struct hci_dev *hdev)
>  	return ret;
>  }
>  
> +/* Private diagnostic: test the reported Link Layer maximum as an HCI size. */
> +static int btusb_ub500_test_post_init(struct hci_dev *hdev)
> +{
> +	if (hdev->le_mtu != 27 || hdev->le_pkts != 8 ||
> +	    hdev->le_max_tx_len != 251)
> +		return -EINVAL;
> +
> +	bt_dev_info(hdev, "UB500 TEST ONLY: LE ACL MTU 27 -> %u; LE packets %u unchanged",
> +		    hdev->le_max_tx_len, hdev->le_pkts);
> +	hdev->le_mtu = hdev->le_max_tx_len;
> +	return 0;
> +}
> +
>  static int btusb_recv_event_realtek(struct hci_dev *hdev, struct sk_buff *skb)
>  {
>  	if (skb->len >= HCI_EVENT_HDR_SIZE + 1 &&
> @@ -4715,6 +4728,9 @@ static int btusb_probe(struct usb_interface *intf,
>  	    (id->driver_info & BTUSB_REALTEK)) {
>  		btrtl_set_driver_name(hdev, btusb_driver.name);
>  		hdev->setup = btusb_setup_realtek;
> +		if (le16_to_cpu(data->udev->descriptor.idVendor) == 0x2357 &&
> +		    le16_to_cpu(data->udev->descriptor.idProduct) == 0x0604)
> +			hdev->post_init = btusb_ub500_test_post_init;
>  		hdev->shutdown = btrtl_shutdown_realtek;
>  		hdev->reset = btusb_rtl_reset;
>  		hdev->hw_error = btusb_rtl_hw_error;
> -- 
> 2.56.0
> 
>