Message-ID: <af4f9118-a189-e353-8cf6-65cabceff3e0@kali.org>
Date:   Tue, 14 Mar 2023 09:23:05 +0700
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.8.0
Content-Language: en-US
To:     linux-bluetooth@vger.kernel.org
Cc:     hildawu@realtek.com, steev@kali.org
From:   Arnaud Rebillout <arnaudr@kali.org>
Subject: RTL8761B BT USB has been broken for a while (mismatched firmware?)
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Precedence: bulk

Hello,

let me forward an issue that was reported on the Kali Linux bugtracker a 
short
while ago. It's about a USB bluetooth 5.0 dongle which uses Realtek RTL8761B
chip. When the dongle is plugged in, everything looks good in the kernel 
logs,
however the dongle is not functional at all.

Several users reported the issue on various bug trackers:
- 2021-09: https://bugzilla.kernel.org/show_bug.cgi?id=214287
- 2022-04: 
https://bugs.launchpad.net/ubuntu/+source/linux-firmware/+bug/1968604
- 2023-03: https://bugs.kali.org/view.php?id=8216

All of them confirm that the wrong firmware is loaded. Let me explain.

So there are two firmware for this chip: rtl8761b and rtl8761bu. They were
added to linux-firmware back in 2021-06-09, as can be seen with:

   cd linux-firmware
   gitk -- 'rtl_bt/rtl8761b*' &

However at the time, only the firmware rtl8761b was in use. But it worked.
Then on 2021-06-26, a change made it so that the firmware rtl8761b is 
used only
for UART, and rtl8761bu is used for USB. Cf:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9fd2e294

And since then, we have the bug reports above. Users all agree that it 
doesn't
work, but there is a workaround: if they use the firmware rtl8761b 
(instead of
rtl8761bu), it works.

So I wonder if the two firmware are just reversed. After all, the suffix 'u'
was maybe meant for 'UART' and not 'USB', there's room for confusion.

I'm CC-ing Hilda Wu as they are the last person who updated those 
firmware, and
given their email address ('@realtek.com'), they probably are in a good
position to give it a quick check.

For completeness, here are the kernel logs that show up when the dongle is
plugged in (taken from the Kali Linux bug report):

   [81435.017653] usb 2-5: new full-speed USB device number 14 using 
ohci-pci
   [81435.257246] usb 2-5: New USB device found, idVendor=0bda, 
idProduct=8771, bcdDevice= 2.00
   [81435.257264] usb 2-5: New USB device strings: Mfr=1, Product=2, 
SerialNumber=3
   [81435.257272] usb 2-5: Product: Bluetooth Radio
   [81435.257278] usb 2-5: Manufacturer: Realtek
   [81435.257283] usb 2-5: SerialNumber: 00E04C239987
   [81435.267263] Bluetooth: hci0: RTL: examining hci_ver=0a 
hci_rev=000b lmp_ver=0a lmp_subver=8761
   [81435.270241] Bluetooth: hci0: RTL: rom_version status=0 version=1
   [81435.270253] Bluetooth: hci0: RTL: loading rtl_bt/rtl8761bu_fw.bin
   [81435.270391] bluetooth hci0: firmware: direct-loading firmware 
rtl_bt/rtl8761bu_fw.bin
   [81435.270459] Bluetooth: hci0: RTL: loading rtl_bt/rtl8761bu_config.bin
   [81435.270509] bluetooth hci0: firmware: direct-loading firmware 
rtl_bt/rtl8761bu_config.bin
   [81435.270567] Bluetooth: hci0: RTL: cfg_sz 25, total sz 29949
   [81435.656295] Bluetooth: hci0: RTL: fw version 0x0ca98a6b
   [81435.795713] Bluetooth: MGMT ver 1.22

Thanks for your attention, please CC me as I'm not subscribed to this list.


-- 
Arnaud Rebillout / Offensive Security / Kali Linux Developer