1 files changed, 53 insertions, 39 deletions

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index faff6247ac8f..b9517bd17190 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -36,19 +36,25 @@
 struct sco_param {
         u16 pkt_type;
         u16 max_latency;
+        u8  retrans_effort;
+};
+
+static const struct sco_param esco_param_cvsd[] = {
+        { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a,   0x01 }, /* S3 */
+        { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007,   0x01 }, /* S2 */
+        { EDR_ESCO_MASK | ESCO_EV3,   0x0007,   0x01 }, /* S1 */
+        { EDR_ESCO_MASK | ESCO_HV3,   0xffff,   0x01 }, /* D1 */
+        { EDR_ESCO_MASK | ESCO_HV1,   0xffff,   0x01 }, /* D0 */
 };
 
 static const struct sco_param sco_param_cvsd[] = {
-        { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000a }, /* S3 */
-        { EDR_ESCO_MASK & ~ESCO_2EV3, 0x0007 }, /* S2 */
-        { EDR_ESCO_MASK | ESCO_EV3,   0x0007 }, /* S1 */
-        { EDR_ESCO_MASK | ESCO_HV3,   0xffff }, /* D1 */
-        { EDR_ESCO_MASK | ESCO_HV1,   0xffff }, /* D0 */
+        { EDR_ESCO_MASK | ESCO_HV3,   0xffff,   0xff }, /* D1 */
+        { EDR_ESCO_MASK | ESCO_HV1,   0xffff,   0xff }, /* D0 */
 };
 
-static const struct sco_param sco_param_wideband[] = {
-        { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d }, /* T2 */
-        { EDR_ESCO_MASK | ESCO_EV3,   0x0008 }, /* T1 */
+static const struct sco_param esco_param_msbc[] = {
+        { EDR_ESCO_MASK & ~ESCO_2EV3, 0x000d,   0x02 }, /* T2 */
+        { EDR_ESCO_MASK | ESCO_EV3,   0x0008,   0x02 }, /* T1 */
 };
 
 static void hci_le_create_connection_cancel(struct hci_conn *conn)
@@ -116,23 +122,36 @@ static void hci_reject_sco(struct hci_conn *conn)
 {
         struct hci_cp_reject_sync_conn_req cp;
 
-        cp.reason = HCI_ERROR_REMOTE_USER_TERM;
+        cp.reason = HCI_ERROR_REJ_LIMITED_RESOURCES;
         bacpy(&cp.bdaddr, &conn->dst);
 
         hci_send_cmd(conn->hdev, HCI_OP_REJECT_SYNC_CONN_REQ, sizeof(cp), &cp);
 }
 
-void hci_disconnect(struct hci_conn *conn, __u8 reason)
+int hci_disconnect(struct hci_conn *conn, __u8 reason)
 {
         struct hci_cp_disconnect cp;
 
         BT_DBG("hcon %p", conn);
 
+        /* When we are master of an established connection and it enters
+         * the disconnect timeout, then go ahead and try to read the
+         * current clock offset.  Processing of the result is done
+         * within the event handling and hci_clock_offset_evt function.
+         */
+        if (conn->type == ACL_LINK && conn->role == HCI_ROLE_MASTER) {
+                struct hci_dev *hdev = conn->hdev;
+                struct hci_cp_read_clock_offset cp;
+
+                cp.handle = cpu_to_le16(conn->handle);
+                hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET, sizeof(cp), &cp);
+        }
+
         conn->state = BT_DISCONN;
 
         cp.handle = cpu_to_le16(conn->handle);
         cp.reason = reason;
-        hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
+        return hci_send_cmd(conn->hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp);
 }
 
 static void hci_amp_disconn(struct hci_conn *conn)
@@ -188,21 +207,26 @@ bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
 
         switch (conn->setting & SCO_AIRMODE_MASK) {
         case SCO_AIRMODE_TRANSP:
-                if (conn->attempt > ARRAY_SIZE(sco_param_wideband))
+                if (conn->attempt > ARRAY_SIZE(esco_param_msbc))
                         return false;
-                cp.retrans_effort = 0x02;
-                param = &sco_param_wideband[conn->attempt - 1];
+                param = &esco_param_msbc[conn->attempt - 1];
                 break;
         case SCO_AIRMODE_CVSD:
-                if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
-                        return false;
-                cp.retrans_effort = 0x01;
-                param = &sco_param_cvsd[conn->attempt - 1];
+                if (lmp_esco_capable(conn->link)) {
+                        if (conn->attempt > ARRAY_SIZE(esco_param_cvsd))
+                                return false;
+                        param = &esco_param_cvsd[conn->attempt - 1];
+                } else {
+                        if (conn->attempt > ARRAY_SIZE(sco_param_cvsd))
+                                return false;
+                        param = &sco_param_cvsd[conn->attempt - 1];
+                }
                 break;
         default:
                 return false;
         }
 
+        cp.retrans_effort = param->retrans_effort;
         cp.pkt_type = __cpu_to_le16(param->pkt_type);
         cp.max_latency = __cpu_to_le16(param->max_latency);
 
@@ -325,25 +349,6 @@ static void hci_conn_timeout(struct work_struct *work)
                         hci_amp_disconn(conn);
                 } else {
                         __u8 reason = hci_proto_disconn_ind(conn);
-
-                        /* When we are master of an established connection
-                         * and it enters the disconnect timeout, then go
-                         * ahead and try to read the current clock offset.
-                         *
-                         * Processing of the result is done within the
-                         * event handling and hci_clock_offset_evt function.
-                         */
-                        if (conn->type == ACL_LINK &&
-                            conn->role == HCI_ROLE_MASTER) {
-                                struct hci_dev *hdev = conn->hdev;
-                                struct hci_cp_read_clock_offset cp;
-
-                                cp.handle = cpu_to_le16(conn->handle);
-
-                                hci_send_cmd(hdev, HCI_OP_READ_CLOCK_OFFSET,
-                                             sizeof(cp), &cp);
-                        }
-
                         hci_disconnect(conn, reason);
                 }
                 break;
@@ -595,6 +600,7 @@ void hci_le_conn_failed(struct hci_conn *conn, u8 status)
                                            conn->dst_type);
         if (params && params->conn) {
                 hci_conn_drop(params->conn);
+                hci_conn_put(params->conn);
                 params->conn = NULL;
         }
 
@@ -1290,11 +1296,16 @@ struct hci_chan *hci_chan_create(struct hci_conn *conn)
 
         BT_DBG("%s hcon %p", hdev->name, conn);
 
+        if (test_bit(HCI_CONN_DROP, &conn->flags)) {
+                BT_DBG("Refusing to create new hci_chan");
+                return NULL;
+        }
+
         chan = kzalloc(sizeof(*chan), GFP_KERNEL);
         if (!chan)
                 return NULL;
 
-        chan->conn = conn;
+        chan->conn = hci_conn_get(conn);
         skb_queue_head_init(&chan->data_q);
         chan->state = BT_CONNECTED;
 
@@ -1314,7 +1325,10 @@ void hci_chan_del(struct hci_chan *chan)
 
         synchronize_rcu();
 
-        hci_conn_drop(conn);
+        /* Prevent new hci_chan's to be created for this hci_conn */
+        set_bit(HCI_CONN_DROP, &conn->flags);
+
+        hci_conn_put(conn);
 
         skb_queue_purge(&chan->data_q);
         kfree(chan);