512f050c076d7a84b9bc3a88d608e1cd7c851f7de6f06601c4e4a781.patch

From ad5b68be1e66847e8292c9678964bd9773664c80 Mon Sep 17 00:00:00 2001
From: Alain Michaud <alainm@chromium.org>
Date: Wed, 17 Feb 2021 14:25:11 +0000
Subject: [PATCH] FROMLIST: Bluetooth: Tolerate valid pre 4.2 conn params

This patch tolerates connection parameters that were valid before
ESR08_v1.0.0 which was also incoporated into the 4.2 core specification.

In particular, this addresses compatibility issues with the Lenovo Yoga
Mouse that sees its connection parameters rejected by the max_latency
computation in hci_conn_check_params, but was perfectly valid at the
time this mouse was qualified.

Before the patch, the mouse was extremely laggy, after the patch, the
mouse worked as expected.

Signed-off-by: Alain Michaud <alainm@chromium.org>
Reviewed-by: Miao-chen Chou <mcchou@chromium.org>
Tested-by: Harry Cutts <hcutts@chromium.org>
(am from https://patchwork.kernel.org/patch/12091711/)
(also found at https://lore.kernel.org/r/20210217142511.3221605-1-alainm@chromium.org)

BUG=b:179420794
TEST=Validated against the specific Lenovo Yoga Mouse

Change-Id: Id3b6d29418036424ea695561f03751612590a141
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/2706002
Reviewed-by: Sean Paul <seanpaul@chromium.org>
Reviewed-by: Daniel Winkler <danielwinkler@google.com>
Tested-by: Alain Michaud <alainm@chromium.org>
Commit-Queue: Alain Michaud <alainm@chromium.org>
---
 include/net/bluetooth/hci_core.h | 30 ++++++++++++++++++++++++++++++
 net/bluetooth/l2cap_core.c       | 12 ++++++++++++
 2 files changed, 42 insertions(+)

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index c43716edf2056607936181319e527ada210597dc..12c35e6a088291c9c1c0048c1226683dc0dbdc8e 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -2108,6 +2108,36 @@ static inline struct smp_irk *hci_get_irk(struct hci_dev *hdev,
 	return hci_find_irk_by_rpa(hdev, bdaddr);
 }
 
+/* Erratum 5412 which has been fixed in 4.2 changed the validation of
+ * connection parameters.  For backwards compatibility reasons, the old
+ * calculation must be tolerated.
+ * For further details :
+ * https://www.bluetooth.org/errata/errata_view.cfm?errata_id=5419
+ */
+static inline int hci_check_conn_params_legacy(u16 min, u16 max, u16 latency,
+					u16 to_multiplier)
+{
+	u16 max_latency;
+
+	if (min > max || min < 6 || max > 3200)
+		return -EINVAL;
+
+	if (to_multiplier < 10 || to_multiplier > 3200)
+		return -EINVAL;
+
+	if (max >= to_multiplier * 8)
+		return -EINVAL;
+
+	max_latency = (to_multiplier * 8 / max) - 1;
+	if (latency > 499 || latency > max_latency)
+		return -EINVAL;
+
+	return 0;
+}
+
+/* Connection Parameter Validation Helper.
+ * See Vol 6, Part B, section 4.5.1.
+ */
 static inline int hci_check_conn_params(u16 min, u16 max, u16 latency,
 					u16 to_multiplier)
 {
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index aed025734d04798a8e0f6cf040ce57f031e4d35e..1708c6f84724e8728379c8191348bef51b19914c 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -4648,6 +4648,18 @@ static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
 	memset(&rsp, 0, sizeof(rsp));
 
 	err = hci_check_conn_params(min, max, latency, to_multiplier);
+	if (err) {
+		BT_WARN("Invalid conn params min 0x%4.4x max 0x%4.4x latency: 0x%4.4x TO: 0x%4.4x",
+			min, max, latency, to_multiplier);
+
+		err = hci_check_conn_params_legacy(min, max, latency,
+						   to_multiplier);
+		if (!err) {
+			/* latency is invalid, cap it to the max allowed */
+			latency = min(499, (to_multiplier * 4 / max) - 1);
+		}
+	}
+
 	if (err)
 		rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
 	else
-- 
2.45.2.803.g4e1b14247a-goog