60 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data);
61 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err);
63 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
184 int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)  in l2cap_add_psm()  argument
196 		chan->psm = psm;  in l2cap_add_psm()
197 		chan->sport = psm;  in l2cap_add_psm()
205 				chan->psm   = cpu_to_le16(p);  in l2cap_add_psm()
206 				chan->sport = cpu_to_le16(p);  in l2cap_add_psm()
218 int l2cap_add_scid(struct l2cap_chan *chan,  __u16 scid)  in l2cap_add_scid()  argument
223 	chan->omtu = L2CAP_DEFAULT_MTU;  in l2cap_add_scid()
224 	chan->chan_type = L2CAP_CHAN_FIXED;  in l2cap_add_scid()
226 	chan->scid = scid;  in l2cap_add_scid()
250 static void l2cap_state_change(struct l2cap_chan *chan, int state)  in l2cap_state_change()  argument
252 	BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),  in l2cap_state_change()
255 	chan->state = state;  in l2cap_state_change()
256 	chan->ops->state_change(chan, state, 0);  in l2cap_state_change()
259 static inline void l2cap_state_change_and_error(struct l2cap_chan *chan,  in l2cap_state_change_and_error()  argument
262 	chan->state = state;  in l2cap_state_change_and_error()
263 	chan->ops->state_change(chan, chan->state, err);  in l2cap_state_change_and_error()
266 static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)  in l2cap_chan_set_err()  argument
268 	chan->ops->state_change(chan, chan->state, err);  in l2cap_chan_set_err()
271 static void __set_retrans_timer(struct l2cap_chan *chan)  in __set_retrans_timer()  argument
273 	if (!delayed_work_pending(&chan->monitor_timer) &&  in __set_retrans_timer()
274 	    chan->retrans_timeout) {  in __set_retrans_timer()
275 		l2cap_set_timer(chan, &chan->retrans_timer,  in __set_retrans_timer()
276 				msecs_to_jiffies(chan->retrans_timeout));  in __set_retrans_timer()
280 static void __set_monitor_timer(struct l2cap_chan *chan)  in __set_monitor_timer()  argument
282 	__clear_retrans_timer(chan);  in __set_monitor_timer()
283 	if (chan->monitor_timeout) {  in __set_monitor_timer()
284 		l2cap_set_timer(chan, &chan->monitor_timer,  in __set_monitor_timer()
285 				msecs_to_jiffies(chan->monitor_timeout));  in __set_monitor_timer()
398 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,  in l2cap_chan_timeout()  local
400 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_timeout()
403 	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));  in l2cap_chan_timeout()
406 	l2cap_chan_lock(chan);  in l2cap_chan_timeout()
408 	if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)  in l2cap_chan_timeout()
410 	else if (chan->state == BT_CONNECT &&  in l2cap_chan_timeout()
411 		 chan->sec_level != BT_SECURITY_SDP)  in l2cap_chan_timeout()
416 	l2cap_chan_close(chan, reason);  in l2cap_chan_timeout()
418 	l2cap_chan_unlock(chan);  in l2cap_chan_timeout()
420 	chan->ops->close(chan);  in l2cap_chan_timeout()
423 	l2cap_chan_put(chan);  in l2cap_chan_timeout()
428 	struct l2cap_chan *chan;  in l2cap_chan_create()  local
430 	chan = kzalloc(sizeof(*chan), GFP_ATOMIC);  in l2cap_chan_create()
431 	if (!chan)  in l2cap_chan_create()
434 	mutex_init(&chan->lock);  in l2cap_chan_create()
437 	atomic_set(&chan->nesting, L2CAP_NESTING_NORMAL);  in l2cap_chan_create()
440 	list_add(&chan->global_l, &chan_list);  in l2cap_chan_create()
443 	INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);  in l2cap_chan_create()
445 	chan->state = BT_OPEN;  in l2cap_chan_create()
447 	kref_init(&chan->kref);  in l2cap_chan_create()
450 	set_bit(CONF_NOT_COMPLETE, &chan->conf_state);  in l2cap_chan_create()
452 	BT_DBG("chan %p", chan);  in l2cap_chan_create()
454 	return chan;  in l2cap_chan_create()
460 	struct l2cap_chan *chan = container_of(kref, struct l2cap_chan, kref);  in l2cap_chan_destroy()  local
462 	BT_DBG("chan %p", chan);  in l2cap_chan_destroy()
465 	list_del(&chan->global_l);  in l2cap_chan_destroy()
468 	kfree(chan);  in l2cap_chan_destroy()
486 void l2cap_chan_set_defaults(struct l2cap_chan *chan)  in l2cap_chan_set_defaults()  argument
488 	chan->fcs  = L2CAP_FCS_CRC16;  in l2cap_chan_set_defaults()
489 	chan->max_tx = L2CAP_DEFAULT_MAX_TX;  in l2cap_chan_set_defaults()
490 	chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;  in l2cap_chan_set_defaults()
491 	chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;  in l2cap_chan_set_defaults()
492 	chan->remote_max_tx = chan->max_tx;  in l2cap_chan_set_defaults()
493 	chan->remote_tx_win = chan->tx_win;  in l2cap_chan_set_defaults()
494 	chan->ack_win = L2CAP_DEFAULT_TX_WINDOW;  in l2cap_chan_set_defaults()
495 	chan->sec_level = BT_SECURITY_LOW;  in l2cap_chan_set_defaults()
496 	chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;  in l2cap_chan_set_defaults()
497 	chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;  in l2cap_chan_set_defaults()
498 	chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;  in l2cap_chan_set_defaults()
499 	chan->conf_state = 0;  in l2cap_chan_set_defaults()
501 	set_bit(FLAG_FORCE_ACTIVE, &chan->flags);  in l2cap_chan_set_defaults()
505 static void l2cap_le_flowctl_init(struct l2cap_chan *chan)  in l2cap_le_flowctl_init()  argument
507 	chan->sdu = NULL;  in l2cap_le_flowctl_init()
508 	chan->sdu_last_frag = NULL;  in l2cap_le_flowctl_init()
509 	chan->sdu_len = 0;  in l2cap_le_flowctl_init()
510 	chan->tx_credits = 0;  in l2cap_le_flowctl_init()
511 	chan->rx_credits = le_max_credits;  in l2cap_le_flowctl_init()
512 	chan->mps = min_t(u16, chan->imtu, le_default_mps);  in l2cap_le_flowctl_init()
514 	skb_queue_head_init(&chan->tx_q);  in l2cap_le_flowctl_init()
517 void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)  in __l2cap_chan_add()  argument
520 	       __le16_to_cpu(chan->psm), chan->dcid);  in __l2cap_chan_add()
524 	chan->conn = conn;  in __l2cap_chan_add()
526 	switch (chan->chan_type) {  in __l2cap_chan_add()
529 		chan->scid = l2cap_alloc_cid(conn);  in __l2cap_chan_add()
531 			chan->omtu = L2CAP_DEFAULT_MTU;  in __l2cap_chan_add()
536 		chan->scid = L2CAP_CID_CONN_LESS;  in __l2cap_chan_add()
537 		chan->dcid = L2CAP_CID_CONN_LESS;  in __l2cap_chan_add()
538 		chan->omtu = L2CAP_DEFAULT_MTU;  in __l2cap_chan_add()
547 		chan->scid = L2CAP_CID_SIGNALING;  in __l2cap_chan_add()
548 		chan->dcid = L2CAP_CID_SIGNALING;  in __l2cap_chan_add()
549 		chan->omtu = L2CAP_DEFAULT_MTU;  in __l2cap_chan_add()
552 	chan->local_id		= L2CAP_BESTEFFORT_ID;  in __l2cap_chan_add()
553 	chan->local_stype	= L2CAP_SERV_BESTEFFORT;  in __l2cap_chan_add()
554 	chan->local_msdu	= L2CAP_DEFAULT_MAX_SDU_SIZE;  in __l2cap_chan_add()
555 	chan->local_sdu_itime	= L2CAP_DEFAULT_SDU_ITIME;  in __l2cap_chan_add()
556 	chan->local_acc_lat	= L2CAP_DEFAULT_ACC_LAT;  in __l2cap_chan_add()
557 	chan->local_flush_to	= L2CAP_EFS_DEFAULT_FLUSH_TO;  in __l2cap_chan_add()
559 	l2cap_chan_hold(chan);  in __l2cap_chan_add()
562 	if (chan->chan_type != L2CAP_CHAN_FIXED ||  in __l2cap_chan_add()
563 	    test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))  in __l2cap_chan_add()
566 	list_add(&chan->list, &conn->chan_l);  in __l2cap_chan_add()
569 void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)  in l2cap_chan_add()  argument
572 	__l2cap_chan_add(conn, chan);  in l2cap_chan_add()
576 void l2cap_chan_del(struct l2cap_chan *chan, int err)  in l2cap_chan_del()  argument
578 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_del()
580 	__clear_chan_timer(chan);  in l2cap_chan_del()
582 	BT_DBG("chan %p, conn %p, err %d, state %s", chan, conn, err,  in l2cap_chan_del()
583 	       state_to_string(chan->state));  in l2cap_chan_del()
585 	chan->ops->teardown(chan, err);  in l2cap_chan_del()
590 		list_del(&chan->list);  in l2cap_chan_del()
592 		l2cap_chan_put(chan);  in l2cap_chan_del()
594 		chan->conn = NULL;  in l2cap_chan_del()
600 		if (chan->chan_type != L2CAP_CHAN_FIXED ||  in l2cap_chan_del()
601 		    test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))  in l2cap_chan_del()
604 		if (mgr && mgr->bredr_chan == chan)  in l2cap_chan_del()
608 	if (chan->hs_hchan) {  in l2cap_chan_del()
609 		struct hci_chan *hs_hchan = chan->hs_hchan;  in l2cap_chan_del()
611 		BT_DBG("chan %p disconnect hs_hchan %p", chan, hs_hchan);  in l2cap_chan_del()
615 	if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))  in l2cap_chan_del()
618 	switch(chan->mode) {  in l2cap_chan_del()
623 		skb_queue_purge(&chan->tx_q);  in l2cap_chan_del()
627 		__clear_retrans_timer(chan);  in l2cap_chan_del()
628 		__clear_monitor_timer(chan);  in l2cap_chan_del()
629 		__clear_ack_timer(chan);  in l2cap_chan_del()
631 		skb_queue_purge(&chan->srej_q);  in l2cap_chan_del()
633 		l2cap_seq_list_free(&chan->srej_list);  in l2cap_chan_del()
634 		l2cap_seq_list_free(&chan->retrans_list);  in l2cap_chan_del()
639 		skb_queue_purge(&chan->tx_q);  in l2cap_chan_del()
652 	struct l2cap_chan *chan;  in l2cap_conn_update_id_addr()  local
656 	list_for_each_entry(chan, &conn->chan_l, list) {  in l2cap_conn_update_id_addr()
657 		l2cap_chan_lock(chan);  in l2cap_conn_update_id_addr()
658 		bacpy(&chan->dst, &hcon->dst);  in l2cap_conn_update_id_addr()
659 		chan->dst_type = bdaddr_dst_type(hcon);  in l2cap_conn_update_id_addr()
660 		l2cap_chan_unlock(chan);  in l2cap_conn_update_id_addr()
666 static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan)  in l2cap_chan_le_connect_reject()  argument
668 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_le_connect_reject()
672 	if (test_bit(FLAG_DEFER_SETUP, &chan->flags))  in l2cap_chan_le_connect_reject()
677 	l2cap_state_change(chan, BT_DISCONN);  in l2cap_chan_le_connect_reject()
679 	rsp.dcid    = cpu_to_le16(chan->scid);  in l2cap_chan_le_connect_reject()
680 	rsp.mtu     = cpu_to_le16(chan->imtu);  in l2cap_chan_le_connect_reject()
681 	rsp.mps     = cpu_to_le16(chan->mps);  in l2cap_chan_le_connect_reject()
682 	rsp.credits = cpu_to_le16(chan->rx_credits);  in l2cap_chan_le_connect_reject()
685 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),  in l2cap_chan_le_connect_reject()
689 static void l2cap_chan_connect_reject(struct l2cap_chan *chan)  in l2cap_chan_connect_reject()  argument
691 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_connect_reject()
695 	if (test_bit(FLAG_DEFER_SETUP, &chan->flags))  in l2cap_chan_connect_reject()
700 	l2cap_state_change(chan, BT_DISCONN);  in l2cap_chan_connect_reject()
702 	rsp.scid   = cpu_to_le16(chan->dcid);  in l2cap_chan_connect_reject()
703 	rsp.dcid   = cpu_to_le16(chan->scid);  in l2cap_chan_connect_reject()
707 	l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);  in l2cap_chan_connect_reject()
710 void l2cap_chan_close(struct l2cap_chan *chan, int reason)  in l2cap_chan_close()  argument
712 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_close()
714 	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));  in l2cap_chan_close()
716 	switch (chan->state) {  in l2cap_chan_close()
718 		chan->ops->teardown(chan, 0);  in l2cap_chan_close()
723 		if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {  in l2cap_chan_close()
724 			__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));  in l2cap_chan_close()
725 			l2cap_send_disconn_req(chan, reason);  in l2cap_chan_close()
727 			l2cap_chan_del(chan, reason);  in l2cap_chan_close()
731 		if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {  in l2cap_chan_close()
733 				l2cap_chan_connect_reject(chan);  in l2cap_chan_close()
735 				l2cap_chan_le_connect_reject(chan);  in l2cap_chan_close()
738 		l2cap_chan_del(chan, reason);  in l2cap_chan_close()
743 		l2cap_chan_del(chan, reason);  in l2cap_chan_close()
747 		chan->ops->teardown(chan, 0);  in l2cap_chan_close()
753 static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)  in l2cap_get_auth_type()  argument
755 	switch (chan->chan_type) {  in l2cap_get_auth_type()
757 		switch (chan->sec_level) {  in l2cap_get_auth_type()
768 		if (chan->psm == cpu_to_le16(L2CAP_PSM_3DSP)) {  in l2cap_get_auth_type()
769 			if (chan->sec_level == BT_SECURITY_LOW)  in l2cap_get_auth_type()
770 				chan->sec_level = BT_SECURITY_SDP;  in l2cap_get_auth_type()
772 		if (chan->sec_level == BT_SECURITY_HIGH ||  in l2cap_get_auth_type()
773 		    chan->sec_level == BT_SECURITY_FIPS)  in l2cap_get_auth_type()
779 		if (chan->psm == cpu_to_le16(L2CAP_PSM_SDP)) {  in l2cap_get_auth_type()
780 			if (chan->sec_level == BT_SECURITY_LOW)  in l2cap_get_auth_type()
781 				chan->sec_level = BT_SECURITY_SDP;  in l2cap_get_auth_type()
783 			if (chan->sec_level == BT_SECURITY_HIGH ||  in l2cap_get_auth_type()
784 			    chan->sec_level == BT_SECURITY_FIPS)  in l2cap_get_auth_type()
791 		switch (chan->sec_level) {  in l2cap_get_auth_type()
805 int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator)  in l2cap_chan_check_security()  argument
807 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_check_security()
811 		return smp_conn_security(conn->hcon, chan->sec_level);  in l2cap_chan_check_security()
813 	auth_type = l2cap_get_auth_type(chan);  in l2cap_chan_check_security()
815 	return hci_conn_security(conn->hcon, chan->sec_level, auth_type,  in l2cap_chan_check_security()
866 static bool __chan_is_moving(struct l2cap_chan *chan)  in __chan_is_moving()  argument
868 	return chan->move_state != L2CAP_MOVE_STABLE &&  in __chan_is_moving()
869 	       chan->move_state != L2CAP_MOVE_WAIT_PREPARE;  in __chan_is_moving()
872 static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)  in l2cap_do_send()  argument
874 	struct hci_conn *hcon = chan->conn->hcon;  in l2cap_do_send()
877 	BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,  in l2cap_do_send()
880 	if (chan->hs_hcon && !__chan_is_moving(chan)) {  in l2cap_do_send()
881 		if (chan->hs_hchan)  in l2cap_do_send()
882 			hci_send_acl(chan->hs_hchan, skb, ACL_COMPLETE);  in l2cap_do_send()
894 	    (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&  in l2cap_do_send()
900 	bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);  in l2cap_do_send()
901 	hci_send_acl(chan->conn->hchan, skb, flags);  in l2cap_do_send()
952 static inline void __unpack_control(struct l2cap_chan *chan,  in __unpack_control()  argument
955 	if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {  in __unpack_control()
1004 static inline void __pack_control(struct l2cap_chan *chan,  in __pack_control()  argument
1008 	if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {  in __pack_control()
1017 static inline unsigned int __ertm_hdr_size(struct l2cap_chan *chan)  in __ertm_hdr_size()  argument
1019 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in __ertm_hdr_size()
1025 static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan,  in l2cap_create_sframe_pdu()  argument
1030 	int hlen = __ertm_hdr_size(chan);  in l2cap_create_sframe_pdu()
1032 	if (chan->fcs == L2CAP_FCS_CRC16)  in l2cap_create_sframe_pdu()
1042 	lh->cid = cpu_to_le16(chan->dcid);  in l2cap_create_sframe_pdu()
1044 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_create_sframe_pdu()
1049 	if (chan->fcs == L2CAP_FCS_CRC16) {  in l2cap_create_sframe_pdu()
1058 static void l2cap_send_sframe(struct l2cap_chan *chan,  in l2cap_send_sframe()  argument
1064 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_send_sframe()
1069 	if (__chan_is_moving(chan))  in l2cap_send_sframe()
1072 	if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) &&  in l2cap_send_sframe()
1077 		clear_bit(CONN_RNR_SENT, &chan->conn_state);  in l2cap_send_sframe()
1079 		set_bit(CONN_RNR_SENT, &chan->conn_state);  in l2cap_send_sframe()
1082 		chan->last_acked_seq = control->reqseq;  in l2cap_send_sframe()
1083 		__clear_ack_timer(chan);  in l2cap_send_sframe()
1089 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_send_sframe()
1094 	skb = l2cap_create_sframe_pdu(chan, control_field);  in l2cap_send_sframe()
1096 		l2cap_do_send(chan, skb);  in l2cap_send_sframe()
1099 static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll)  in l2cap_send_rr_or_rnr()  argument
1103 	BT_DBG("chan %p, poll %d", chan, poll);  in l2cap_send_rr_or_rnr()
1109 	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state))  in l2cap_send_rr_or_rnr()
1114 	control.reqseq = chan->buffer_seq;  in l2cap_send_rr_or_rnr()
1115 	l2cap_send_sframe(chan, &control);  in l2cap_send_rr_or_rnr()
1118 static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)  in __l2cap_no_conn_pending()  argument
1120 	if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)  in __l2cap_no_conn_pending()
1123 	return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);  in __l2cap_no_conn_pending()
1126 static bool __amp_capable(struct l2cap_chan *chan)  in __amp_capable()  argument
1128 	struct l2cap_conn *conn = chan->conn;  in __amp_capable()
1148 	if (chan->chan_policy == BT_CHANNEL_POLICY_AMP_PREFERRED)  in __amp_capable()
1154 static bool l2cap_check_efs(struct l2cap_chan *chan)  in l2cap_check_efs()  argument
1160 void l2cap_send_conn_req(struct l2cap_chan *chan)  in l2cap_send_conn_req()  argument
1162 	struct l2cap_conn *conn = chan->conn;  in l2cap_send_conn_req()
1165 	req.scid = cpu_to_le16(chan->scid);  in l2cap_send_conn_req()
1166 	req.psm  = chan->psm;  in l2cap_send_conn_req()
1168 	chan->ident = l2cap_get_ident(conn);  in l2cap_send_conn_req()
1170 	set_bit(CONF_CONNECT_PEND, &chan->conf_state);  in l2cap_send_conn_req()
1172 	l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);  in l2cap_send_conn_req()
1175 static void l2cap_send_create_chan_req(struct l2cap_chan *chan, u8 amp_id)  in l2cap_send_create_chan_req()  argument
1178 	req.scid = cpu_to_le16(chan->scid);  in l2cap_send_create_chan_req()
1179 	req.psm  = chan->psm;  in l2cap_send_create_chan_req()
1182 	chan->ident = l2cap_get_ident(chan->conn);  in l2cap_send_create_chan_req()
1184 	l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_REQ,  in l2cap_send_create_chan_req()
1188 static void l2cap_move_setup(struct l2cap_chan *chan)  in l2cap_move_setup()  argument
1192 	BT_DBG("chan %p", chan);  in l2cap_move_setup()
1194 	if (chan->mode != L2CAP_MODE_ERTM)  in l2cap_move_setup()
1197 	__clear_retrans_timer(chan);  in l2cap_move_setup()
1198 	__clear_monitor_timer(chan);  in l2cap_move_setup()
1199 	__clear_ack_timer(chan);  in l2cap_move_setup()
1201 	chan->retry_count = 0;  in l2cap_move_setup()
1202 	skb_queue_walk(&chan->tx_q, skb) {  in l2cap_move_setup()
1209 	chan->expected_tx_seq = chan->buffer_seq;  in l2cap_move_setup()
1211 	clear_bit(CONN_REJ_ACT, &chan->conn_state);  in l2cap_move_setup()
1212 	clear_bit(CONN_SREJ_ACT, &chan->conn_state);  in l2cap_move_setup()
1213 	l2cap_seq_list_clear(&chan->retrans_list);  in l2cap_move_setup()
1214 	l2cap_seq_list_clear(&chan->srej_list);  in l2cap_move_setup()
1215 	skb_queue_purge(&chan->srej_q);  in l2cap_move_setup()
1217 	chan->tx_state = L2CAP_TX_STATE_XMIT;  in l2cap_move_setup()
1218 	chan->rx_state = L2CAP_RX_STATE_MOVE;  in l2cap_move_setup()
1220 	set_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_move_setup()
1223 static void l2cap_move_done(struct l2cap_chan *chan)  in l2cap_move_done()  argument
1225 	u8 move_role = chan->move_role;  in l2cap_move_done()
1226 	BT_DBG("chan %p", chan);  in l2cap_move_done()
1228 	chan->move_state = L2CAP_MOVE_STABLE;  in l2cap_move_done()
1229 	chan->move_role = L2CAP_MOVE_ROLE_NONE;  in l2cap_move_done()
1231 	if (chan->mode != L2CAP_MODE_ERTM)  in l2cap_move_done()
1236 		l2cap_tx(chan, NULL, NULL, L2CAP_EV_EXPLICIT_POLL);  in l2cap_move_done()
1237 		chan->rx_state = L2CAP_RX_STATE_WAIT_F;  in l2cap_move_done()
1240 		chan->rx_state = L2CAP_RX_STATE_WAIT_P;  in l2cap_move_done()
1245 static void l2cap_chan_ready(struct l2cap_chan *chan)  in l2cap_chan_ready()  argument
1251 	if (chan->state == BT_CONNECTED)  in l2cap_chan_ready()
1255 	chan->conf_state = 0;  in l2cap_chan_ready()
1256 	__clear_chan_timer(chan);  in l2cap_chan_ready()
1258 	if (chan->mode == L2CAP_MODE_LE_FLOWCTL && !chan->tx_credits)  in l2cap_chan_ready()
1259 		chan->ops->suspend(chan);  in l2cap_chan_ready()
1261 	chan->state = BT_CONNECTED;  in l2cap_chan_ready()
1263 	chan->ops->ready(chan);  in l2cap_chan_ready()
1266 static void l2cap_le_connect(struct l2cap_chan *chan)  in l2cap_le_connect()  argument
1268 	struct l2cap_conn *conn = chan->conn;  in l2cap_le_connect()
1271 	if (test_and_set_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags))  in l2cap_le_connect()
1274 	req.psm     = chan->psm;  in l2cap_le_connect()
1275 	req.scid    = cpu_to_le16(chan->scid);  in l2cap_le_connect()
1276 	req.mtu     = cpu_to_le16(chan->imtu);  in l2cap_le_connect()
1277 	req.mps     = cpu_to_le16(chan->mps);  in l2cap_le_connect()
1278 	req.credits = cpu_to_le16(chan->rx_credits);  in l2cap_le_connect()
1280 	chan->ident = l2cap_get_ident(conn);  in l2cap_le_connect()
1282 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_REQ,  in l2cap_le_connect()
1286 static void l2cap_le_start(struct l2cap_chan *chan)  in l2cap_le_start()  argument
1288 	struct l2cap_conn *conn = chan->conn;  in l2cap_le_start()
1290 	if (!smp_conn_security(conn->hcon, chan->sec_level))  in l2cap_le_start()
1293 	if (!chan->psm) {  in l2cap_le_start()
1294 		l2cap_chan_ready(chan);  in l2cap_le_start()
1298 	if (chan->state == BT_CONNECT)  in l2cap_le_start()
1299 		l2cap_le_connect(chan);  in l2cap_le_start()
1302 static void l2cap_start_connection(struct l2cap_chan *chan)  in l2cap_start_connection()  argument
1304 	if (__amp_capable(chan)) {  in l2cap_start_connection()
1305 		BT_DBG("chan %p AMP capable: discover AMPs", chan);  in l2cap_start_connection()
1306 		a2mp_discover_amp(chan);  in l2cap_start_connection()
1307 	} else if (chan->conn->hcon->type == LE_LINK) {  in l2cap_start_connection()
1308 		l2cap_le_start(chan);  in l2cap_start_connection()
1310 		l2cap_send_conn_req(chan);  in l2cap_start_connection()
1332 static void l2cap_do_start(struct l2cap_chan *chan)  in l2cap_do_start()  argument
1334 	struct l2cap_conn *conn = chan->conn;  in l2cap_do_start()
1337 		l2cap_le_start(chan);  in l2cap_do_start()
1349 	if (l2cap_chan_check_security(chan, true) &&  in l2cap_do_start()
1350 	    __l2cap_no_conn_pending(chan))  in l2cap_do_start()
1351 		l2cap_start_connection(chan);  in l2cap_do_start()
1370 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err)  in l2cap_send_disconn_req()  argument
1372 	struct l2cap_conn *conn = chan->conn;  in l2cap_send_disconn_req()
1378 	if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) {  in l2cap_send_disconn_req()
1379 		__clear_retrans_timer(chan);  in l2cap_send_disconn_req()
1380 		__clear_monitor_timer(chan);  in l2cap_send_disconn_req()
1381 		__clear_ack_timer(chan);  in l2cap_send_disconn_req()
1384 	if (chan->scid == L2CAP_CID_A2MP) {  in l2cap_send_disconn_req()
1385 		l2cap_state_change(chan, BT_DISCONN);  in l2cap_send_disconn_req()
1389 	req.dcid = cpu_to_le16(chan->dcid);  in l2cap_send_disconn_req()
1390 	req.scid = cpu_to_le16(chan->scid);  in l2cap_send_disconn_req()
1394 	l2cap_state_change_and_error(chan, BT_DISCONN, err);  in l2cap_send_disconn_req()
1400 	struct l2cap_chan *chan, *tmp;  in l2cap_conn_start()  local
1406 	list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {  in l2cap_conn_start()
1407 		l2cap_chan_lock(chan);  in l2cap_conn_start()
1409 		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {  in l2cap_conn_start()
1410 			l2cap_chan_ready(chan);  in l2cap_conn_start()
1411 			l2cap_chan_unlock(chan);  in l2cap_conn_start()
1415 		if (chan->state == BT_CONNECT) {  in l2cap_conn_start()
1416 			if (!l2cap_chan_check_security(chan, true) ||  in l2cap_conn_start()
1417 			    !__l2cap_no_conn_pending(chan)) {  in l2cap_conn_start()
1418 				l2cap_chan_unlock(chan);  in l2cap_conn_start()
1422 			if (!l2cap_mode_supported(chan->mode, conn->feat_mask)  in l2cap_conn_start()
1424 					&chan->conf_state)) {  in l2cap_conn_start()
1425 				l2cap_chan_close(chan, ECONNRESET);  in l2cap_conn_start()
1426 				l2cap_chan_unlock(chan);  in l2cap_conn_start()
1430 			l2cap_start_connection(chan);  in l2cap_conn_start()
1432 		} else if (chan->state == BT_CONNECT2) {  in l2cap_conn_start()
1435 			rsp.scid = cpu_to_le16(chan->dcid);  in l2cap_conn_start()
1436 			rsp.dcid = cpu_to_le16(chan->scid);  in l2cap_conn_start()
1438 			if (l2cap_chan_check_security(chan, false)) {  in l2cap_conn_start()
1439 				if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {  in l2cap_conn_start()
1442 					chan->ops->defer(chan);  in l2cap_conn_start()
1445 					l2cap_state_change(chan, BT_CONFIG);  in l2cap_conn_start()
1454 			l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,  in l2cap_conn_start()
1457 			if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||  in l2cap_conn_start()
1459 				l2cap_chan_unlock(chan);  in l2cap_conn_start()
1463 			set_bit(CONF_REQ_SENT, &chan->conf_state);  in l2cap_conn_start()
1465 				       l2cap_build_conf_req(chan, buf), buf);  in l2cap_conn_start()
1466 			chan->num_conf_req++;  in l2cap_conn_start()
1469 		l2cap_chan_unlock(chan);  in l2cap_conn_start()
1510 	struct l2cap_chan *chan;  in l2cap_conn_ready()  local
1520 	list_for_each_entry(chan, &conn->chan_l, list) {  in l2cap_conn_ready()
1522 		l2cap_chan_lock(chan);  in l2cap_conn_ready()
1524 		if (chan->scid == L2CAP_CID_A2MP) {  in l2cap_conn_ready()
1525 			l2cap_chan_unlock(chan);  in l2cap_conn_ready()
1530 			l2cap_le_start(chan);  in l2cap_conn_ready()
1531 		} else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {  in l2cap_conn_ready()
1533 				l2cap_chan_ready(chan);  in l2cap_conn_ready()
1534 		} else if (chan->state == BT_CONNECT) {  in l2cap_conn_ready()
1535 			l2cap_do_start(chan);  in l2cap_conn_ready()
1538 		l2cap_chan_unlock(chan);  in l2cap_conn_ready()
1552 	struct l2cap_chan *chan;  in l2cap_conn_unreliable()  local
1558 	list_for_each_entry(chan, &conn->chan_l, list) {  in l2cap_conn_unreliable()
1559 		if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))  in l2cap_conn_unreliable()
1560 			l2cap_chan_set_err(chan, err);  in l2cap_conn_unreliable()
1663 	struct l2cap_chan *chan, *l;  in l2cap_conn_del()  local
1692 	list_for_each_entry_safe(chan, l, &conn->chan_l, list) {  in l2cap_conn_del()
1693 		l2cap_chan_hold(chan);  in l2cap_conn_del()
1694 		l2cap_chan_lock(chan);  in l2cap_conn_del()
1696 		l2cap_chan_del(chan, err);  in l2cap_conn_del()
1698 		l2cap_chan_unlock(chan);  in l2cap_conn_del()
1700 		chan->ops->close(chan);  in l2cap_conn_del()
1701 		l2cap_chan_put(chan);  in l2cap_conn_del()
1793 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,  in l2cap_monitor_timeout()  local
1796 	BT_DBG("chan %p", chan);  in l2cap_monitor_timeout()
1798 	l2cap_chan_lock(chan);  in l2cap_monitor_timeout()
1800 	if (!chan->conn) {  in l2cap_monitor_timeout()
1801 		l2cap_chan_unlock(chan);  in l2cap_monitor_timeout()
1802 		l2cap_chan_put(chan);  in l2cap_monitor_timeout()
1806 	l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO);  in l2cap_monitor_timeout()
1808 	l2cap_chan_unlock(chan);  in l2cap_monitor_timeout()
1809 	l2cap_chan_put(chan);  in l2cap_monitor_timeout()
1814 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,  in l2cap_retrans_timeout()  local
1817 	BT_DBG("chan %p", chan);  in l2cap_retrans_timeout()
1819 	l2cap_chan_lock(chan);  in l2cap_retrans_timeout()
1821 	if (!chan->conn) {  in l2cap_retrans_timeout()
1822 		l2cap_chan_unlock(chan);  in l2cap_retrans_timeout()
1823 		l2cap_chan_put(chan);  in l2cap_retrans_timeout()
1827 	l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO);  in l2cap_retrans_timeout()
1828 	l2cap_chan_unlock(chan);  in l2cap_retrans_timeout()
1829 	l2cap_chan_put(chan);  in l2cap_retrans_timeout()
1832 static void l2cap_streaming_send(struct l2cap_chan *chan,  in l2cap_streaming_send()  argument
1838 	BT_DBG("chan %p, skbs %p", chan, skbs);  in l2cap_streaming_send()
1840 	if (__chan_is_moving(chan))  in l2cap_streaming_send()
1843 	skb_queue_splice_tail_init(skbs, &chan->tx_q);  in l2cap_streaming_send()
1845 	while (!skb_queue_empty(&chan->tx_q)) {  in l2cap_streaming_send()
1847 		skb = skb_dequeue(&chan->tx_q);  in l2cap_streaming_send()
1853 		control->txseq = chan->next_tx_seq;  in l2cap_streaming_send()
1855 		__pack_control(chan, control, skb);  in l2cap_streaming_send()
1857 		if (chan->fcs == L2CAP_FCS_CRC16) {  in l2cap_streaming_send()
1862 		l2cap_do_send(chan, skb);  in l2cap_streaming_send()
1866 		chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);  in l2cap_streaming_send()
1867 		chan->frames_sent++;  in l2cap_streaming_send()
1871 static int l2cap_ertm_send(struct l2cap_chan *chan)  in l2cap_ertm_send()  argument
1877 	BT_DBG("chan %p", chan);  in l2cap_ertm_send()
1879 	if (chan->state != BT_CONNECTED)  in l2cap_ertm_send()
1882 	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))  in l2cap_ertm_send()
1885 	if (__chan_is_moving(chan))  in l2cap_ertm_send()
1888 	while (chan->tx_send_head &&  in l2cap_ertm_send()
1889 	       chan->unacked_frames < chan->remote_tx_win &&  in l2cap_ertm_send()
1890 	       chan->tx_state == L2CAP_TX_STATE_XMIT) {  in l2cap_ertm_send()
1892 		skb = chan->tx_send_head;  in l2cap_ertm_send()
1897 		if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))  in l2cap_ertm_send()
1900 		control->reqseq = chan->buffer_seq;  in l2cap_ertm_send()
1901 		chan->last_acked_seq = chan->buffer_seq;  in l2cap_ertm_send()
1902 		control->txseq = chan->next_tx_seq;  in l2cap_ertm_send()
1904 		__pack_control(chan, control, skb);  in l2cap_ertm_send()
1906 		if (chan->fcs == L2CAP_FCS_CRC16) {  in l2cap_ertm_send()
1919 		__set_retrans_timer(chan);  in l2cap_ertm_send()
1921 		chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);  in l2cap_ertm_send()
1922 		chan->unacked_frames++;  in l2cap_ertm_send()
1923 		chan->frames_sent++;  in l2cap_ertm_send()
1926 		if (skb_queue_is_last(&chan->tx_q, skb))  in l2cap_ertm_send()
1927 			chan->tx_send_head = NULL;  in l2cap_ertm_send()
1929 			chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);  in l2cap_ertm_send()
1931 		l2cap_do_send(chan, tx_skb);  in l2cap_ertm_send()
1936 	       chan->unacked_frames, skb_queue_len(&chan->tx_q));  in l2cap_ertm_send()
1941 static void l2cap_ertm_resend(struct l2cap_chan *chan)  in l2cap_ertm_resend()  argument
1948 	BT_DBG("chan %p", chan);  in l2cap_ertm_resend()
1950 	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))  in l2cap_ertm_resend()
1953 	if (__chan_is_moving(chan))  in l2cap_ertm_resend()
1956 	while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) {  in l2cap_ertm_resend()
1957 		seq = l2cap_seq_list_pop(&chan->retrans_list);  in l2cap_ertm_resend()
1959 		skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq);  in l2cap_ertm_resend()
1969 		if (chan->max_tx != 0 &&  in l2cap_ertm_resend()
1970 		    bt_cb(skb)->l2cap.retries > chan->max_tx) {  in l2cap_ertm_resend()
1971 			BT_DBG("Retry limit exceeded (%d)", chan->max_tx);  in l2cap_ertm_resend()
1972 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_ertm_resend()
1973 			l2cap_seq_list_clear(&chan->retrans_list);  in l2cap_ertm_resend()
1977 		control.reqseq = chan->buffer_seq;  in l2cap_ertm_resend()
1978 		if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))  in l2cap_ertm_resend()
1993 			l2cap_seq_list_clear(&chan->retrans_list);  in l2cap_ertm_resend()
1998 		if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {  in l2cap_ertm_resend()
2007 		if (chan->fcs == L2CAP_FCS_CRC16) {  in l2cap_ertm_resend()
2014 		l2cap_do_send(chan, tx_skb);  in l2cap_ertm_resend()
2018 		chan->last_acked_seq = chan->buffer_seq;  in l2cap_ertm_resend()
2022 static void l2cap_retransmit(struct l2cap_chan *chan,  in l2cap_retransmit()  argument
2025 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_retransmit()
2027 	l2cap_seq_list_append(&chan->retrans_list, control->reqseq);  in l2cap_retransmit()
2028 	l2cap_ertm_resend(chan);  in l2cap_retransmit()
2031 static void l2cap_retransmit_all(struct l2cap_chan *chan,  in l2cap_retransmit_all()  argument
2036 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_retransmit_all()
2039 		set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_retransmit_all()
2041 	l2cap_seq_list_clear(&chan->retrans_list);  in l2cap_retransmit_all()
2043 	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))  in l2cap_retransmit_all()
2046 	if (chan->unacked_frames) {  in l2cap_retransmit_all()
2047 		skb_queue_walk(&chan->tx_q, skb) {  in l2cap_retransmit_all()
2049 			    skb == chan->tx_send_head)  in l2cap_retransmit_all()
2053 		skb_queue_walk_from(&chan->tx_q, skb) {  in l2cap_retransmit_all()
2054 			if (skb == chan->tx_send_head)  in l2cap_retransmit_all()
2057 			l2cap_seq_list_append(&chan->retrans_list,  in l2cap_retransmit_all()
2061 		l2cap_ertm_resend(chan);  in l2cap_retransmit_all()
2065 static void l2cap_send_ack(struct l2cap_chan *chan)  in l2cap_send_ack()  argument
2068 	u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq,  in l2cap_send_ack()
2069 					 chan->last_acked_seq);  in l2cap_send_ack()
2073 	       chan, chan->last_acked_seq, chan->buffer_seq);  in l2cap_send_ack()
2078 	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&  in l2cap_send_ack()
2079 	    chan->rx_state == L2CAP_RX_STATE_RECV) {  in l2cap_send_ack()
2080 		__clear_ack_timer(chan);  in l2cap_send_ack()
2082 		control.reqseq = chan->buffer_seq;  in l2cap_send_ack()
2083 		l2cap_send_sframe(chan, &control);  in l2cap_send_ack()
2085 		if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) {  in l2cap_send_ack()
2086 			l2cap_ertm_send(chan);  in l2cap_send_ack()
2088 			if (chan->buffer_seq == chan->last_acked_seq)  in l2cap_send_ack()
2095 		threshold = chan->ack_win;  in l2cap_send_ack()
2103 			__clear_ack_timer(chan);  in l2cap_send_ack()
2105 			control.reqseq = chan->buffer_seq;  in l2cap_send_ack()
2106 			l2cap_send_sframe(chan, &control);  in l2cap_send_ack()
2111 			__set_ack_timer(chan);  in l2cap_send_ack()
2115 static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,  in l2cap_skbuff_fromiovec()  argument
2119 	struct l2cap_conn *conn = chan->conn;  in l2cap_skbuff_fromiovec()
2136 		tmp = chan->ops->alloc_skb(chan, 0, count,  in l2cap_skbuff_fromiovec()
2159 static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,  in l2cap_create_connless_pdu()  argument
2162 	struct l2cap_conn *conn = chan->conn;  in l2cap_create_connless_pdu()
2167 	BT_DBG("chan %p psm 0x%2.2x len %zu", chan,  in l2cap_create_connless_pdu()
2168 	       __le16_to_cpu(chan->psm), len);  in l2cap_create_connless_pdu()
2172 	skb = chan->ops->alloc_skb(chan, hlen, count,  in l2cap_create_connless_pdu()
2179 	lh->cid = cpu_to_le16(chan->dcid);  in l2cap_create_connless_pdu()
2181 	put_unaligned(chan->psm, (__le16 *) skb_put(skb, L2CAP_PSMLEN_SIZE));  in l2cap_create_connless_pdu()
2183 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);  in l2cap_create_connless_pdu()
2191 static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,  in l2cap_create_basic_pdu()  argument
2194 	struct l2cap_conn *conn = chan->conn;  in l2cap_create_basic_pdu()
2199 	BT_DBG("chan %p len %zu", chan, len);  in l2cap_create_basic_pdu()
2203 	skb = chan->ops->alloc_skb(chan, L2CAP_HDR_SIZE, count,  in l2cap_create_basic_pdu()
2210 	lh->cid = cpu_to_le16(chan->dcid);  in l2cap_create_basic_pdu()
2213 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);  in l2cap_create_basic_pdu()
2221 static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,  in l2cap_create_iframe_pdu()  argument
2225 	struct l2cap_conn *conn = chan->conn;  in l2cap_create_iframe_pdu()
2230 	BT_DBG("chan %p len %zu", chan, len);  in l2cap_create_iframe_pdu()
2235 	hlen = __ertm_hdr_size(chan);  in l2cap_create_iframe_pdu()
2240 	if (chan->fcs == L2CAP_FCS_CRC16)  in l2cap_create_iframe_pdu()
2245 	skb = chan->ops->alloc_skb(chan, hlen, count,  in l2cap_create_iframe_pdu()
2252 	lh->cid = cpu_to_le16(chan->dcid);  in l2cap_create_iframe_pdu()
2256 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_create_iframe_pdu()
2264 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);  in l2cap_create_iframe_pdu()
2270 	bt_cb(skb)->l2cap.fcs = chan->fcs;  in l2cap_create_iframe_pdu()
2275 static int l2cap_segment_sdu(struct l2cap_chan *chan,  in l2cap_segment_sdu()  argument
2284 	BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);  in l2cap_segment_sdu()
2292 	pdu_len = chan->conn->mtu;  in l2cap_segment_sdu()
2295 	if (!chan->hs_hcon)  in l2cap_segment_sdu()
2299 	if (chan->fcs)  in l2cap_segment_sdu()
2302 	pdu_len -= __ertm_hdr_size(chan);  in l2cap_segment_sdu()
2305 	pdu_len = min_t(size_t, pdu_len, chan->remote_mps);  in l2cap_segment_sdu()
2317 		skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len);  in l2cap_segment_sdu()
2342 static struct sk_buff *l2cap_create_le_flowctl_pdu(struct l2cap_chan *chan,  in l2cap_create_le_flowctl_pdu()  argument
2346 	struct l2cap_conn *conn = chan->conn;  in l2cap_create_le_flowctl_pdu()
2351 	BT_DBG("chan %p len %zu", chan, len);  in l2cap_create_le_flowctl_pdu()
2363 	skb = chan->ops->alloc_skb(chan, hlen, count,  in l2cap_create_le_flowctl_pdu()
2370 	lh->cid = cpu_to_le16(chan->dcid);  in l2cap_create_le_flowctl_pdu()
2376 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);  in l2cap_create_le_flowctl_pdu()
2385 static int l2cap_segment_le_sdu(struct l2cap_chan *chan,  in l2cap_segment_le_sdu()  argument
2393 	BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);  in l2cap_segment_le_sdu()
2396 	pdu_len = chan->remote_mps - L2CAP_SDULEN_SIZE;  in l2cap_segment_le_sdu()
2402 		skb = l2cap_create_le_flowctl_pdu(chan, msg, pdu_len, sdu_len);  in l2cap_segment_le_sdu()
2421 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)  in l2cap_chan_send()  argument
2427 	if (!chan->conn)  in l2cap_chan_send()
2431 	if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {  in l2cap_chan_send()
2432 		skb = l2cap_create_connless_pdu(chan, msg, len);  in l2cap_chan_send()
2439 		if (chan->state != BT_CONNECTED) {  in l2cap_chan_send()
2444 		l2cap_do_send(chan, skb);  in l2cap_chan_send()
2448 	switch (chan->mode) {  in l2cap_chan_send()
2451 		if (len > chan->omtu)  in l2cap_chan_send()
2454 		if (!chan->tx_credits)  in l2cap_chan_send()
2459 		err = l2cap_segment_le_sdu(chan, &seg_queue, msg, len);  in l2cap_chan_send()
2461 		if (chan->state != BT_CONNECTED) {  in l2cap_chan_send()
2469 		skb_queue_splice_tail_init(&seg_queue, &chan->tx_q);  in l2cap_chan_send()
2471 		while (chan->tx_credits && !skb_queue_empty(&chan->tx_q)) {  in l2cap_chan_send()
2472 			l2cap_do_send(chan, skb_dequeue(&chan->tx_q));  in l2cap_chan_send()
2473 			chan->tx_credits--;  in l2cap_chan_send()
2476 		if (!chan->tx_credits)  in l2cap_chan_send()
2477 			chan->ops->suspend(chan);  in l2cap_chan_send()
2485 		if (len > chan->omtu)  in l2cap_chan_send()
2489 		skb = l2cap_create_basic_pdu(chan, msg, len);  in l2cap_chan_send()
2496 		if (chan->state != BT_CONNECTED) {  in l2cap_chan_send()
2501 		l2cap_do_send(chan, skb);  in l2cap_chan_send()
2508 		if (len > chan->omtu) {  in l2cap_chan_send()
2519 		err = l2cap_segment_sdu(chan, &seg_queue, msg, len);  in l2cap_chan_send()
2524 		if (chan->state != BT_CONNECTED) {  in l2cap_chan_send()
2532 		if (chan->mode == L2CAP_MODE_ERTM)  in l2cap_chan_send()
2533 			l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST);  in l2cap_chan_send()
2535 			l2cap_streaming_send(chan, &seg_queue);  in l2cap_chan_send()
2546 		BT_DBG("bad state %1.1x", chan->mode);  in l2cap_chan_send()
2554 static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq)  in l2cap_send_srej()  argument
2559 	BT_DBG("chan %p, txseq %u", chan, txseq);  in l2cap_send_srej()
2565 	for (seq = chan->expected_tx_seq; seq != txseq;  in l2cap_send_srej()
2566 	     seq = __next_seq(chan, seq)) {  in l2cap_send_srej()
2567 		if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) {  in l2cap_send_srej()
2569 			l2cap_send_sframe(chan, &control);  in l2cap_send_srej()
2570 			l2cap_seq_list_append(&chan->srej_list, seq);  in l2cap_send_srej()
2574 	chan->expected_tx_seq = __next_seq(chan, txseq);  in l2cap_send_srej()
2577 static void l2cap_send_srej_tail(struct l2cap_chan *chan)  in l2cap_send_srej_tail()  argument
2581 	BT_DBG("chan %p", chan);  in l2cap_send_srej_tail()
2583 	if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR)  in l2cap_send_srej_tail()
2589 	control.reqseq = chan->srej_list.tail;  in l2cap_send_srej_tail()
2590 	l2cap_send_sframe(chan, &control);  in l2cap_send_srej_tail()
2593 static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq)  in l2cap_send_srej_list()  argument
2599 	BT_DBG("chan %p, txseq %u", chan, txseq);  in l2cap_send_srej_list()
2606 	initial_head = chan->srej_list.head;  in l2cap_send_srej_list()
2609 		seq = l2cap_seq_list_pop(&chan->srej_list);  in l2cap_send_srej_list()
2614 		l2cap_send_sframe(chan, &control);  in l2cap_send_srej_list()
2615 		l2cap_seq_list_append(&chan->srej_list, seq);  in l2cap_send_srej_list()
2616 	} while (chan->srej_list.head != initial_head);  in l2cap_send_srej_list()
2619 static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq)  in l2cap_process_reqseq()  argument
2624 	BT_DBG("chan %p, reqseq %u", chan, reqseq);  in l2cap_process_reqseq()
2626 	if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq)  in l2cap_process_reqseq()
2630 	       chan->expected_ack_seq, chan->unacked_frames);  in l2cap_process_reqseq()
2632 	for (ackseq = chan->expected_ack_seq; ackseq != reqseq;  in l2cap_process_reqseq()
2633 	     ackseq = __next_seq(chan, ackseq)) {  in l2cap_process_reqseq()
2635 		acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq);  in l2cap_process_reqseq()
2637 			skb_unlink(acked_skb, &chan->tx_q);  in l2cap_process_reqseq()
2639 			chan->unacked_frames--;  in l2cap_process_reqseq()
2643 	chan->expected_ack_seq = reqseq;  in l2cap_process_reqseq()
2645 	if (chan->unacked_frames == 0)  in l2cap_process_reqseq()
2646 		__clear_retrans_timer(chan);  in l2cap_process_reqseq()
2648 	BT_DBG("unacked_frames %u", chan->unacked_frames);  in l2cap_process_reqseq()
2651 static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan)  in l2cap_abort_rx_srej_sent()  argument
2653 	BT_DBG("chan %p", chan);  in l2cap_abort_rx_srej_sent()
2655 	chan->expected_tx_seq = chan->buffer_seq;  in l2cap_abort_rx_srej_sent()
2656 	l2cap_seq_list_clear(&chan->srej_list);  in l2cap_abort_rx_srej_sent()
2657 	skb_queue_purge(&chan->srej_q);  in l2cap_abort_rx_srej_sent()
2658 	chan->rx_state = L2CAP_RX_STATE_RECV;  in l2cap_abort_rx_srej_sent()
2661 static void l2cap_tx_state_xmit(struct l2cap_chan *chan,  in l2cap_tx_state_xmit()  argument
2665 	BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,  in l2cap_tx_state_xmit()
2670 		if (chan->tx_send_head == NULL)  in l2cap_tx_state_xmit()
2671 			chan->tx_send_head = skb_peek(skbs);  in l2cap_tx_state_xmit()
2673 		skb_queue_splice_tail_init(skbs, &chan->tx_q);  in l2cap_tx_state_xmit()
2674 		l2cap_ertm_send(chan);  in l2cap_tx_state_xmit()
2678 		set_bit(CONN_LOCAL_BUSY, &chan->conn_state);  in l2cap_tx_state_xmit()
2680 		if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {  in l2cap_tx_state_xmit()
2684 			l2cap_abort_rx_srej_sent(chan);  in l2cap_tx_state_xmit()
2687 		l2cap_send_ack(chan);  in l2cap_tx_state_xmit()
2692 		clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);  in l2cap_tx_state_xmit()
2694 		if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {  in l2cap_tx_state_xmit()
2701 			local_control.reqseq = chan->buffer_seq;  in l2cap_tx_state_xmit()
2702 			l2cap_send_sframe(chan, &local_control);  in l2cap_tx_state_xmit()
2704 			chan->retry_count = 1;  in l2cap_tx_state_xmit()
2705 			__set_monitor_timer(chan);  in l2cap_tx_state_xmit()
2706 			chan->tx_state = L2CAP_TX_STATE_WAIT_F;  in l2cap_tx_state_xmit()
2710 		l2cap_process_reqseq(chan, control->reqseq);  in l2cap_tx_state_xmit()
2713 		l2cap_send_rr_or_rnr(chan, 1);  in l2cap_tx_state_xmit()
2714 		chan->retry_count = 1;  in l2cap_tx_state_xmit()
2715 		__set_monitor_timer(chan);  in l2cap_tx_state_xmit()
2716 		__clear_ack_timer(chan);  in l2cap_tx_state_xmit()
2717 		chan->tx_state = L2CAP_TX_STATE_WAIT_F;  in l2cap_tx_state_xmit()
2720 		l2cap_send_rr_or_rnr(chan, 1);  in l2cap_tx_state_xmit()
2721 		chan->retry_count = 1;  in l2cap_tx_state_xmit()
2722 		__set_monitor_timer(chan);  in l2cap_tx_state_xmit()
2723 		chan->tx_state = L2CAP_TX_STATE_WAIT_F;  in l2cap_tx_state_xmit()
2733 static void l2cap_tx_state_wait_f(struct l2cap_chan *chan,  in l2cap_tx_state_wait_f()  argument
2737 	BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,  in l2cap_tx_state_wait_f()
2742 		if (chan->tx_send_head == NULL)  in l2cap_tx_state_wait_f()
2743 			chan->tx_send_head = skb_peek(skbs);  in l2cap_tx_state_wait_f()
2745 		skb_queue_splice_tail_init(skbs, &chan->tx_q);  in l2cap_tx_state_wait_f()
2749 		set_bit(CONN_LOCAL_BUSY, &chan->conn_state);  in l2cap_tx_state_wait_f()
2751 		if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {  in l2cap_tx_state_wait_f()
2755 			l2cap_abort_rx_srej_sent(chan);  in l2cap_tx_state_wait_f()
2758 		l2cap_send_ack(chan);  in l2cap_tx_state_wait_f()
2763 		clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);  in l2cap_tx_state_wait_f()
2765 		if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {  in l2cap_tx_state_wait_f()
2771 			local_control.reqseq = chan->buffer_seq;  in l2cap_tx_state_wait_f()
2772 			l2cap_send_sframe(chan, &local_control);  in l2cap_tx_state_wait_f()
2774 			chan->retry_count = 1;  in l2cap_tx_state_wait_f()
2775 			__set_monitor_timer(chan);  in l2cap_tx_state_wait_f()
2776 			chan->tx_state = L2CAP_TX_STATE_WAIT_F;  in l2cap_tx_state_wait_f()
2780 		l2cap_process_reqseq(chan, control->reqseq);  in l2cap_tx_state_wait_f()
2786 			__clear_monitor_timer(chan);  in l2cap_tx_state_wait_f()
2787 			if (chan->unacked_frames > 0)  in l2cap_tx_state_wait_f()
2788 				__set_retrans_timer(chan);  in l2cap_tx_state_wait_f()
2789 			chan->retry_count = 0;  in l2cap_tx_state_wait_f()
2790 			chan->tx_state = L2CAP_TX_STATE_XMIT;  in l2cap_tx_state_wait_f()
2791 			BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state);  in l2cap_tx_state_wait_f()
2798 		if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) {  in l2cap_tx_state_wait_f()
2799 			l2cap_send_rr_or_rnr(chan, 1);  in l2cap_tx_state_wait_f()
2800 			__set_monitor_timer(chan);  in l2cap_tx_state_wait_f()
2801 			chan->retry_count++;  in l2cap_tx_state_wait_f()
2803 			l2cap_send_disconn_req(chan, ECONNABORTED);  in l2cap_tx_state_wait_f()
2811 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,  in l2cap_tx()  argument
2815 	       chan, control, skbs, event, chan->tx_state);  in l2cap_tx()
2817 	switch (chan->tx_state) {  in l2cap_tx()
2819 		l2cap_tx_state_xmit(chan, control, skbs, event);  in l2cap_tx()
2822 		l2cap_tx_state_wait_f(chan, control, skbs, event);  in l2cap_tx()
2830 static void l2cap_pass_to_tx(struct l2cap_chan *chan,  in l2cap_pass_to_tx()  argument
2833 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_pass_to_tx()
2834 	l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT);  in l2cap_pass_to_tx()
2837 static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan,  in l2cap_pass_to_tx_fbit()  argument
2840 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_pass_to_tx_fbit()
2841 	l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT);  in l2cap_pass_to_tx_fbit()
2848 	struct l2cap_chan *chan;  in l2cap_raw_recv()  local
2854 	list_for_each_entry(chan, &conn->chan_l, list) {  in l2cap_raw_recv()
2855 		if (chan->chan_type != L2CAP_CHAN_RAW)  in l2cap_raw_recv()
2859 		if (bt_cb(skb)->l2cap.chan == chan)  in l2cap_raw_recv()
2865 		if (chan->ops->recv(chan, nskb))  in l2cap_raw_recv()
3003 static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan)  in l2cap_add_opt_efs()  argument
3007 	switch (chan->mode) {  in l2cap_add_opt_efs()
3009 		efs.id		= chan->local_id;  in l2cap_add_opt_efs()
3010 		efs.stype	= chan->local_stype;  in l2cap_add_opt_efs()
3011 		efs.msdu	= cpu_to_le16(chan->local_msdu);  in l2cap_add_opt_efs()
3012 		efs.sdu_itime	= cpu_to_le32(chan->local_sdu_itime);  in l2cap_add_opt_efs()
3020 		efs.msdu	= cpu_to_le16(chan->local_msdu);  in l2cap_add_opt_efs()
3021 		efs.sdu_itime	= cpu_to_le32(chan->local_sdu_itime);  in l2cap_add_opt_efs()
3036 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,  in l2cap_ack_timeout()  local
3040 	BT_DBG("chan %p", chan);  in l2cap_ack_timeout()
3042 	l2cap_chan_lock(chan);  in l2cap_ack_timeout()
3044 	frames_to_ack = __seq_offset(chan, chan->buffer_seq,  in l2cap_ack_timeout()
3045 				     chan->last_acked_seq);  in l2cap_ack_timeout()
3048 		l2cap_send_rr_or_rnr(chan, 0);  in l2cap_ack_timeout()
3050 	l2cap_chan_unlock(chan);  in l2cap_ack_timeout()
3051 	l2cap_chan_put(chan);  in l2cap_ack_timeout()
3054 int l2cap_ertm_init(struct l2cap_chan *chan)  in l2cap_ertm_init()  argument
3058 	chan->next_tx_seq = 0;  in l2cap_ertm_init()
3059 	chan->expected_tx_seq = 0;  in l2cap_ertm_init()
3060 	chan->expected_ack_seq = 0;  in l2cap_ertm_init()
3061 	chan->unacked_frames = 0;  in l2cap_ertm_init()
3062 	chan->buffer_seq = 0;  in l2cap_ertm_init()
3063 	chan->frames_sent = 0;  in l2cap_ertm_init()
3064 	chan->last_acked_seq = 0;  in l2cap_ertm_init()
3065 	chan->sdu = NULL;  in l2cap_ertm_init()
3066 	chan->sdu_last_frag = NULL;  in l2cap_ertm_init()
3067 	chan->sdu_len = 0;  in l2cap_ertm_init()
3069 	skb_queue_head_init(&chan->tx_q);  in l2cap_ertm_init()
3071 	chan->local_amp_id = AMP_ID_BREDR;  in l2cap_ertm_init()
3072 	chan->move_id = AMP_ID_BREDR;  in l2cap_ertm_init()
3073 	chan->move_state = L2CAP_MOVE_STABLE;  in l2cap_ertm_init()
3074 	chan->move_role = L2CAP_MOVE_ROLE_NONE;  in l2cap_ertm_init()
3076 	if (chan->mode != L2CAP_MODE_ERTM)  in l2cap_ertm_init()
3079 	chan->rx_state = L2CAP_RX_STATE_RECV;  in l2cap_ertm_init()
3080 	chan->tx_state = L2CAP_TX_STATE_XMIT;  in l2cap_ertm_init()
3082 	INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);  in l2cap_ertm_init()
3083 	INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);  in l2cap_ertm_init()
3084 	INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);  in l2cap_ertm_init()
3086 	skb_queue_head_init(&chan->srej_q);  in l2cap_ertm_init()
3088 	err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);  in l2cap_ertm_init()
3092 	err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);  in l2cap_ertm_init()
3094 		l2cap_seq_list_free(&chan->srej_list);  in l2cap_ertm_init()
3124 static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan,  in __l2cap_set_ertm_timeouts()  argument
3127 	if (chan->local_amp_id != AMP_ID_BREDR && chan->hs_hcon) {  in __l2cap_set_ertm_timeouts()
3128 		u64 ertm_to = chan->hs_hcon->hdev->amp_be_flush_to;  in __l2cap_set_ertm_timeouts()
3162 static inline void l2cap_txwin_setup(struct l2cap_chan *chan)  in l2cap_txwin_setup()  argument
3164 	if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&  in l2cap_txwin_setup()
3165 	    __l2cap_ews_supported(chan->conn)) {  in l2cap_txwin_setup()
3167 		set_bit(FLAG_EXT_CTRL, &chan->flags);  in l2cap_txwin_setup()
3168 		chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;  in l2cap_txwin_setup()
3170 		chan->tx_win = min_t(u16, chan->tx_win,  in l2cap_txwin_setup()
3172 		chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;  in l2cap_txwin_setup()
3174 	chan->ack_win = chan->tx_win;  in l2cap_txwin_setup()
3177 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data)  in l2cap_build_conf_req()  argument
3180 	struct l2cap_conf_rfc rfc = { .mode = chan->mode };  in l2cap_build_conf_req()
3184 	BT_DBG("chan %p", chan);  in l2cap_build_conf_req()
3186 	if (chan->num_conf_req || chan->num_conf_rsp)  in l2cap_build_conf_req()
3189 	switch (chan->mode) {  in l2cap_build_conf_req()
3192 		if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))  in l2cap_build_conf_req()
3195 		if (__l2cap_efs_supported(chan->conn))  in l2cap_build_conf_req()
3196 			set_bit(FLAG_EFS_ENABLE, &chan->flags);  in l2cap_build_conf_req()
3200 		chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);  in l2cap_build_conf_req()
3205 	if (chan->imtu != L2CAP_DEFAULT_MTU)  in l2cap_build_conf_req()
3206 		l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);  in l2cap_build_conf_req()
3208 	switch (chan->mode) {  in l2cap_build_conf_req()
3213 		if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&  in l2cap_build_conf_req()
3214 		    !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))  in l2cap_build_conf_req()
3230 		rfc.max_transmit    = chan->max_tx;  in l2cap_build_conf_req()
3232 		__l2cap_set_ertm_timeouts(chan, &rfc);  in l2cap_build_conf_req()
3234 		size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -  in l2cap_build_conf_req()
3239 		l2cap_txwin_setup(chan);  in l2cap_build_conf_req()
3241 		rfc.txwin_size = min_t(u16, chan->tx_win,  in l2cap_build_conf_req()
3247 		if (test_bit(FLAG_EFS_ENABLE, &chan->flags))  in l2cap_build_conf_req()
3248 			l2cap_add_opt_efs(&ptr, chan);  in l2cap_build_conf_req()
3250 		if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_build_conf_req()
3252 					   chan->tx_win);  in l2cap_build_conf_req()
3254 		if (chan->conn->feat_mask & L2CAP_FEAT_FCS)  in l2cap_build_conf_req()
3255 			if (chan->fcs == L2CAP_FCS_NONE ||  in l2cap_build_conf_req()
3256 			    test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {  in l2cap_build_conf_req()
3257 				chan->fcs = L2CAP_FCS_NONE;  in l2cap_build_conf_req()
3259 						   chan->fcs);  in l2cap_build_conf_req()
3264 		l2cap_txwin_setup(chan);  in l2cap_build_conf_req()
3271 		size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -  in l2cap_build_conf_req()
3279 		if (test_bit(FLAG_EFS_ENABLE, &chan->flags))  in l2cap_build_conf_req()
3280 			l2cap_add_opt_efs(&ptr, chan);  in l2cap_build_conf_req()
3282 		if (chan->conn->feat_mask & L2CAP_FEAT_FCS)  in l2cap_build_conf_req()
3283 			if (chan->fcs == L2CAP_FCS_NONE ||  in l2cap_build_conf_req()
3284 			    test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {  in l2cap_build_conf_req()
3285 				chan->fcs = L2CAP_FCS_NONE;  in l2cap_build_conf_req()
3287 						   chan->fcs);  in l2cap_build_conf_req()
3292 	req->dcid  = cpu_to_le16(chan->dcid);  in l2cap_build_conf_req()
3298 static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)  in l2cap_parse_conf_req()  argument
3302 	void *req = chan->conf_req;  in l2cap_parse_conf_req()
3303 	int len = chan->conf_len;  in l2cap_parse_conf_req()
3313 	BT_DBG("chan %p", chan);  in l2cap_parse_conf_req()
3327 			chan->flush_to = val;  in l2cap_parse_conf_req()
3340 				set_bit(CONF_RECV_NO_FCS, &chan->conf_state);  in l2cap_parse_conf_req()
3350 			if (!(chan->conn->local_fixed_chan & L2CAP_FC_A2MP))  in l2cap_parse_conf_req()
3353 			set_bit(FLAG_EXT_CTRL, &chan->flags);  in l2cap_parse_conf_req()
3354 			set_bit(CONF_EWS_RECV, &chan->conf_state);  in l2cap_parse_conf_req()
3355 			chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;  in l2cap_parse_conf_req()
3356 			chan->remote_tx_win = val;  in l2cap_parse_conf_req()
3369 	if (chan->num_conf_rsp || chan->num_conf_req > 1)  in l2cap_parse_conf_req()
3372 	switch (chan->mode) {  in l2cap_parse_conf_req()
3375 		if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {  in l2cap_parse_conf_req()
3376 			chan->mode = l2cap_select_mode(rfc.mode,  in l2cap_parse_conf_req()
3377 						       chan->conn->feat_mask);  in l2cap_parse_conf_req()
3382 			if (__l2cap_efs_supported(chan->conn))  in l2cap_parse_conf_req()
3383 				set_bit(FLAG_EFS_ENABLE, &chan->flags);  in l2cap_parse_conf_req()
3388 		if (chan->mode != rfc.mode)  in l2cap_parse_conf_req()
3395 	if (chan->mode != rfc.mode) {  in l2cap_parse_conf_req()
3397 		rfc.mode = chan->mode;  in l2cap_parse_conf_req()
3399 		if (chan->num_conf_rsp == 1)  in l2cap_parse_conf_req()
3413 			chan->omtu = mtu;  in l2cap_parse_conf_req()
3414 			set_bit(CONF_MTU_DONE, &chan->conf_state);  in l2cap_parse_conf_req()
3416 		l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu);  in l2cap_parse_conf_req()
3419 			if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&  in l2cap_parse_conf_req()
3421 			    efs.stype != chan->local_stype) {  in l2cap_parse_conf_req()
3425 				if (chan->num_conf_req >= 1)  in l2cap_parse_conf_req()
3434 				set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);  in l2cap_parse_conf_req()
3440 			chan->fcs = L2CAP_FCS_NONE;  in l2cap_parse_conf_req()
3441 			set_bit(CONF_MODE_DONE, &chan->conf_state);  in l2cap_parse_conf_req()
3445 			if (!test_bit(CONF_EWS_RECV, &chan->conf_state))  in l2cap_parse_conf_req()
3446 				chan->remote_tx_win = rfc.txwin_size;  in l2cap_parse_conf_req()
3450 			chan->remote_max_tx = rfc.max_transmit;  in l2cap_parse_conf_req()
3453 				     chan->conn->mtu - L2CAP_EXT_HDR_SIZE -  in l2cap_parse_conf_req()
3456 			chan->remote_mps = size;  in l2cap_parse_conf_req()
3458 			__l2cap_set_ertm_timeouts(chan, &rfc);  in l2cap_parse_conf_req()
3460 			set_bit(CONF_MODE_DONE, &chan->conf_state);  in l2cap_parse_conf_req()
3465 			if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {  in l2cap_parse_conf_req()
3466 				chan->remote_id = efs.id;  in l2cap_parse_conf_req()
3467 				chan->remote_stype = efs.stype;  in l2cap_parse_conf_req()
3468 				chan->remote_msdu = le16_to_cpu(efs.msdu);  in l2cap_parse_conf_req()
3469 				chan->remote_flush_to =  in l2cap_parse_conf_req()
3471 				chan->remote_acc_lat =  in l2cap_parse_conf_req()
3473 				chan->remote_sdu_itime =  in l2cap_parse_conf_req()
3483 				     chan->conn->mtu - L2CAP_EXT_HDR_SIZE -  in l2cap_parse_conf_req()
3486 			chan->remote_mps = size;  in l2cap_parse_conf_req()
3488 			set_bit(CONF_MODE_DONE, &chan->conf_state);  in l2cap_parse_conf_req()
3499 			rfc.mode = chan->mode;  in l2cap_parse_conf_req()
3503 			set_bit(CONF_OUTPUT_DONE, &chan->conf_state);  in l2cap_parse_conf_req()
3505 	rsp->scid   = cpu_to_le16(chan->dcid);  in l2cap_parse_conf_req()
3512 static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,  in l2cap_parse_conf_rsp()  argument
3522 	BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);  in l2cap_parse_conf_rsp()
3531 				chan->imtu = L2CAP_DEFAULT_MIN_MTU;  in l2cap_parse_conf_rsp()
3533 				chan->imtu = val;  in l2cap_parse_conf_rsp()
3534 			l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);  in l2cap_parse_conf_rsp()
3538 			chan->flush_to = val;  in l2cap_parse_conf_rsp()
3540 					   2, chan->flush_to);  in l2cap_parse_conf_rsp()
3547 			if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&  in l2cap_parse_conf_rsp()
3548 			    rfc.mode != chan->mode)  in l2cap_parse_conf_rsp()
3551 			chan->fcs = 0;  in l2cap_parse_conf_rsp()
3558 			chan->ack_win = min_t(u16, val, chan->ack_win);  in l2cap_parse_conf_rsp()
3560 					   chan->tx_win);  in l2cap_parse_conf_rsp()
3567 			if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&  in l2cap_parse_conf_rsp()
3569 			    efs.stype != chan->local_stype)  in l2cap_parse_conf_rsp()
3580 						&chan->conf_state);  in l2cap_parse_conf_rsp()
3585 	if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)  in l2cap_parse_conf_rsp()
3588 	chan->mode = rfc.mode;  in l2cap_parse_conf_rsp()
3593 			chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);  in l2cap_parse_conf_rsp()
3594 			chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);  in l2cap_parse_conf_rsp()
3595 			chan->mps    = le16_to_cpu(rfc.max_pdu_size);  in l2cap_parse_conf_rsp()
3596 			if (!test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_parse_conf_rsp()
3597 				chan->ack_win = min_t(u16, chan->ack_win,  in l2cap_parse_conf_rsp()
3600 			if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {  in l2cap_parse_conf_rsp()
3601 				chan->local_msdu = le16_to_cpu(efs.msdu);  in l2cap_parse_conf_rsp()
3602 				chan->local_sdu_itime =  in l2cap_parse_conf_rsp()
3604 				chan->local_acc_lat = le32_to_cpu(efs.acc_lat);  in l2cap_parse_conf_rsp()
3605 				chan->local_flush_to =  in l2cap_parse_conf_rsp()
3611 			chan->mps    = le16_to_cpu(rfc.max_pdu_size);  in l2cap_parse_conf_rsp()
3615 	req->dcid   = cpu_to_le16(chan->dcid);  in l2cap_parse_conf_rsp()
3621 static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data,  in l2cap_build_conf_rsp()  argument
3627 	BT_DBG("chan %p", chan);  in l2cap_build_conf_rsp()
3629 	rsp->scid   = cpu_to_le16(chan->dcid);  in l2cap_build_conf_rsp()
3636 void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan)  in __l2cap_le_connect_rsp_defer()  argument
3639 	struct l2cap_conn *conn = chan->conn;  in __l2cap_le_connect_rsp_defer()
3641 	BT_DBG("chan %p", chan);  in __l2cap_le_connect_rsp_defer()
3643 	rsp.dcid    = cpu_to_le16(chan->scid);  in __l2cap_le_connect_rsp_defer()
3644 	rsp.mtu     = cpu_to_le16(chan->imtu);  in __l2cap_le_connect_rsp_defer()
3645 	rsp.mps     = cpu_to_le16(chan->mps);  in __l2cap_le_connect_rsp_defer()
3646 	rsp.credits = cpu_to_le16(chan->rx_credits);  in __l2cap_le_connect_rsp_defer()
3649 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),  in __l2cap_le_connect_rsp_defer()
3653 void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)  in __l2cap_connect_rsp_defer()  argument
3656 	struct l2cap_conn *conn = chan->conn;  in __l2cap_connect_rsp_defer()
3660 	rsp.scid   = cpu_to_le16(chan->dcid);  in __l2cap_connect_rsp_defer()
3661 	rsp.dcid   = cpu_to_le16(chan->scid);  in __l2cap_connect_rsp_defer()
3665 	if (chan->hs_hcon)  in __l2cap_connect_rsp_defer()
3670 	BT_DBG("chan %p rsp_code %u", chan, rsp_code);  in __l2cap_connect_rsp_defer()
3672 	l2cap_send_cmd(conn, chan->ident, rsp_code, sizeof(rsp), &rsp);  in __l2cap_connect_rsp_defer()
3674 	if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))  in __l2cap_connect_rsp_defer()
3678 		       l2cap_build_conf_req(chan, buf), buf);  in __l2cap_connect_rsp_defer()
3679 	chan->num_conf_req++;  in __l2cap_connect_rsp_defer()
3682 static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)  in l2cap_conf_rfc_get()  argument
3689 	u16 txwin_ext = chan->ack_win;  in l2cap_conf_rfc_get()
3691 		.mode = chan->mode,  in l2cap_conf_rfc_get()
3694 		.max_pdu_size = cpu_to_le16(chan->imtu),  in l2cap_conf_rfc_get()
3695 		.txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW),  in l2cap_conf_rfc_get()
3698 	BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);  in l2cap_conf_rfc_get()
3700 	if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))  in l2cap_conf_rfc_get()
3719 		chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);  in l2cap_conf_rfc_get()
3720 		chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);  in l2cap_conf_rfc_get()
3721 		chan->mps = le16_to_cpu(rfc.max_pdu_size);  in l2cap_conf_rfc_get()
3722 		if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_conf_rfc_get()
3723 			chan->ack_win = min_t(u16, chan->ack_win, txwin_ext);  in l2cap_conf_rfc_get()
3725 			chan->ack_win = min_t(u16, chan->ack_win,  in l2cap_conf_rfc_get()
3729 		chan->mps    = le16_to_cpu(rfc.max_pdu_size);  in l2cap_conf_rfc_get()
3764 	struct l2cap_chan *chan = NULL, *pchan;  in l2cap_connect()  local
3797 	chan = pchan->ops->new_connection(pchan);  in l2cap_connect()
3798 	if (!chan)  in l2cap_connect()
3808 	bacpy(&chan->src, &conn->hcon->src);  in l2cap_connect()
3809 	bacpy(&chan->dst, &conn->hcon->dst);  in l2cap_connect()
3810 	chan->src_type = bdaddr_src_type(conn->hcon);  in l2cap_connect()
3811 	chan->dst_type = bdaddr_dst_type(conn->hcon);  in l2cap_connect()
3812 	chan->psm  = psm;  in l2cap_connect()
3813 	chan->dcid = scid;  in l2cap_connect()
3814 	chan->local_amp_id = amp_id;  in l2cap_connect()
3816 	__l2cap_chan_add(conn, chan);  in l2cap_connect()
3818 	dcid = chan->scid;  in l2cap_connect()
3820 	__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));  in l2cap_connect()
3822 	chan->ident = cmd->ident;  in l2cap_connect()
3825 		if (l2cap_chan_check_security(chan, false)) {  in l2cap_connect()
3826 			if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {  in l2cap_connect()
3827 				l2cap_state_change(chan, BT_CONNECT2);  in l2cap_connect()
3830 				chan->ops->defer(chan);  in l2cap_connect()
3837 					l2cap_state_change(chan, BT_CONFIG);  in l2cap_connect()
3840 					l2cap_state_change(chan, BT_CONNECT2);  in l2cap_connect()
3846 			l2cap_state_change(chan, BT_CONNECT2);  in l2cap_connect()
3851 		l2cap_state_change(chan, BT_CONNECT2);  in l2cap_connect()
3881 	if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&  in l2cap_connect()
3884 		set_bit(CONF_REQ_SENT, &chan->conf_state);  in l2cap_connect()
3886 			       l2cap_build_conf_req(chan, buf), buf);  in l2cap_connect()
3887 		chan->num_conf_req++;  in l2cap_connect()
3890 	return chan;  in l2cap_connect()
3918 	struct l2cap_chan *chan;  in l2cap_connect_create_rsp()  local
3936 		chan = __l2cap_get_chan_by_scid(conn, scid);  in l2cap_connect_create_rsp()
3937 		if (!chan) {  in l2cap_connect_create_rsp()
3942 		chan = __l2cap_get_chan_by_ident(conn, cmd->ident);  in l2cap_connect_create_rsp()
3943 		if (!chan) {  in l2cap_connect_create_rsp()
3951 	l2cap_chan_lock(chan);  in l2cap_connect_create_rsp()
3955 		l2cap_state_change(chan, BT_CONFIG);  in l2cap_connect_create_rsp()
3956 		chan->ident = 0;  in l2cap_connect_create_rsp()
3957 		chan->dcid = dcid;  in l2cap_connect_create_rsp()
3958 		clear_bit(CONF_CONNECT_PEND, &chan->conf_state);  in l2cap_connect_create_rsp()
3960 		if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))  in l2cap_connect_create_rsp()
3964 			       l2cap_build_conf_req(chan, req), req);  in l2cap_connect_create_rsp()
3965 		chan->num_conf_req++;  in l2cap_connect_create_rsp()
3969 		set_bit(CONF_CONNECT_PEND, &chan->conf_state);  in l2cap_connect_create_rsp()
3973 		l2cap_chan_del(chan, ECONNREFUSED);  in l2cap_connect_create_rsp()
3977 	l2cap_chan_unlock(chan);  in l2cap_connect_create_rsp()
3985 static inline void set_default_fcs(struct l2cap_chan *chan)  in set_default_fcs()  argument
3990 	if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)  in set_default_fcs()
3991 		chan->fcs = L2CAP_FCS_NONE;  in set_default_fcs()
3992 	else if (!test_bit(CONF_RECV_NO_FCS, &chan->conf_state))  in set_default_fcs()
3993 		chan->fcs = L2CAP_FCS_CRC16;  in set_default_fcs()
3996 static void l2cap_send_efs_conf_rsp(struct l2cap_chan *chan, void *data,  in l2cap_send_efs_conf_rsp()  argument
3999 	struct l2cap_conn *conn = chan->conn;  in l2cap_send_efs_conf_rsp()
4001 	BT_DBG("conn %p chan %p ident %d flags 0x%4.4x", conn, chan, ident,  in l2cap_send_efs_conf_rsp()
4004 	clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);  in l2cap_send_efs_conf_rsp()
4005 	set_bit(CONF_OUTPUT_DONE, &chan->conf_state);  in l2cap_send_efs_conf_rsp()
4008 		       l2cap_build_conf_rsp(chan, data,  in l2cap_send_efs_conf_rsp()
4031 	struct l2cap_chan *chan;  in l2cap_config_req()  local
4042 	chan = l2cap_get_chan_by_scid(conn, dcid);  in l2cap_config_req()
4043 	if (!chan) {  in l2cap_config_req()
4048 	if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) {  in l2cap_config_req()
4049 		cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,  in l2cap_config_req()
4050 				       chan->dcid);  in l2cap_config_req()
4056 	if (chan->conf_len + len > sizeof(chan->conf_req)) {  in l2cap_config_req()
4058 			       l2cap_build_conf_rsp(chan, rsp,  in l2cap_config_req()
4064 	memcpy(chan->conf_req + chan->conf_len, req->data, len);  in l2cap_config_req()
4065 	chan->conf_len += len;  in l2cap_config_req()
4070 			       l2cap_build_conf_rsp(chan, rsp,  in l2cap_config_req()
4076 	len = l2cap_parse_conf_req(chan, rsp);  in l2cap_config_req()
4078 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_config_req()
4082 	chan->ident = cmd->ident;  in l2cap_config_req()
4084 	chan->num_conf_rsp++;  in l2cap_config_req()
4087 	chan->conf_len = 0;  in l2cap_config_req()
4089 	if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))  in l2cap_config_req()
4092 	if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {  in l2cap_config_req()
4093 		set_default_fcs(chan);  in l2cap_config_req()
4095 		if (chan->mode == L2CAP_MODE_ERTM ||  in l2cap_config_req()
4096 		    chan->mode == L2CAP_MODE_STREAMING)  in l2cap_config_req()
4097 			err = l2cap_ertm_init(chan);  in l2cap_config_req()
4100 			l2cap_send_disconn_req(chan, -err);  in l2cap_config_req()
4102 			l2cap_chan_ready(chan);  in l2cap_config_req()
4107 	if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {  in l2cap_config_req()
4110 			       l2cap_build_conf_req(chan, buf), buf);  in l2cap_config_req()
4111 		chan->num_conf_req++;  in l2cap_config_req()
4116 	if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&  in l2cap_config_req()
4117 	    test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {  in l2cap_config_req()
4122 		if (!chan->hs_hcon)  in l2cap_config_req()
4123 			l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags);  in l2cap_config_req()
4125 			chan->ident = cmd->ident;  in l2cap_config_req()
4129 	l2cap_chan_unlock(chan);  in l2cap_config_req()
4139 	struct l2cap_chan *chan;  in l2cap_config_rsp()  local
4153 	chan = l2cap_get_chan_by_scid(conn, scid);  in l2cap_config_rsp()
4154 	if (!chan)  in l2cap_config_rsp()
4159 		l2cap_conf_rfc_get(chan, rsp->data, len);  in l2cap_config_rsp()
4160 		clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);  in l2cap_config_rsp()
4164 		set_bit(CONF_REM_CONF_PEND, &chan->conf_state);  in l2cap_config_rsp()
4166 		if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {  in l2cap_config_rsp()
4169 			len = l2cap_parse_conf_rsp(chan, rsp->data, len,  in l2cap_config_rsp()
4172 				l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_config_rsp()
4176 			if (!chan->hs_hcon) {  in l2cap_config_rsp()
4177 				l2cap_send_efs_conf_rsp(chan, buf, cmd->ident,  in l2cap_config_rsp()
4180 				if (l2cap_check_efs(chan)) {  in l2cap_config_rsp()
4181 					amp_create_logical_link(chan);  in l2cap_config_rsp()
4182 					chan->ident = cmd->ident;  in l2cap_config_rsp()
4189 		if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {  in l2cap_config_rsp()
4193 				l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_config_rsp()
4199 			len = l2cap_parse_conf_rsp(chan, rsp->data, len,  in l2cap_config_rsp()
4202 				l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_config_rsp()
4208 			chan->num_conf_req++;  in l2cap_config_rsp()
4215 		l2cap_chan_set_err(chan, ECONNRESET);  in l2cap_config_rsp()
4217 		__set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);  in l2cap_config_rsp()
4218 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_config_rsp()
4225 	set_bit(CONF_INPUT_DONE, &chan->conf_state);  in l2cap_config_rsp()
4227 	if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {  in l2cap_config_rsp()
4228 		set_default_fcs(chan);  in l2cap_config_rsp()
4230 		if (chan->mode == L2CAP_MODE_ERTM ||  in l2cap_config_rsp()
4231 		    chan->mode == L2CAP_MODE_STREAMING)  in l2cap_config_rsp()
4232 			err = l2cap_ertm_init(chan);  in l2cap_config_rsp()
4235 			l2cap_send_disconn_req(chan, -err);  in l2cap_config_rsp()
4237 			l2cap_chan_ready(chan);  in l2cap_config_rsp()
4241 	l2cap_chan_unlock(chan);  in l2cap_config_rsp()
4252 	struct l2cap_chan *chan;  in l2cap_disconnect_req()  local
4264 	chan = __l2cap_get_chan_by_scid(conn, dcid);  in l2cap_disconnect_req()
4265 	if (!chan) {  in l2cap_disconnect_req()
4271 	l2cap_chan_lock(chan);  in l2cap_disconnect_req()
4273 	rsp.dcid = cpu_to_le16(chan->scid);  in l2cap_disconnect_req()
4274 	rsp.scid = cpu_to_le16(chan->dcid);  in l2cap_disconnect_req()
4277 	chan->ops->set_shutdown(chan);  in l2cap_disconnect_req()
4279 	l2cap_chan_hold(chan);  in l2cap_disconnect_req()
4280 	l2cap_chan_del(chan, ECONNRESET);  in l2cap_disconnect_req()
4282 	l2cap_chan_unlock(chan);  in l2cap_disconnect_req()
4284 	chan->ops->close(chan);  in l2cap_disconnect_req()
4285 	l2cap_chan_put(chan);  in l2cap_disconnect_req()
4298 	struct l2cap_chan *chan;  in l2cap_disconnect_rsp()  local
4310 	chan = __l2cap_get_chan_by_scid(conn, scid);  in l2cap_disconnect_rsp()
4311 	if (!chan) {  in l2cap_disconnect_rsp()
4316 	l2cap_chan_lock(chan);  in l2cap_disconnect_rsp()
4318 	l2cap_chan_hold(chan);  in l2cap_disconnect_rsp()
4319 	l2cap_chan_del(chan, 0);  in l2cap_disconnect_rsp()
4321 	l2cap_chan_unlock(chan);  in l2cap_disconnect_rsp()
4323 	chan->ops->close(chan);  in l2cap_disconnect_rsp()
4324 	l2cap_chan_put(chan);  in l2cap_disconnect_rsp()
4451 	struct l2cap_chan *chan;  in l2cap_create_channel_req()  local
4483 	chan = l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,  in l2cap_create_channel_req()
4485 	if (chan) {  in l2cap_create_channel_req()
4493 			cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,  in l2cap_create_channel_req()
4494 					       chan->dcid);  in l2cap_create_channel_req()
4498 		BT_DBG("mgr %p bredr_chan %p hs_hcon %p", mgr, chan, hs_hcon);  in l2cap_create_channel_req()
4500 		mgr->bredr_chan = chan;  in l2cap_create_channel_req()
4501 		chan->hs_hcon = hs_hcon;  in l2cap_create_channel_req()
4502 		chan->fcs = L2CAP_FCS_NONE;  in l2cap_create_channel_req()
4522 static void l2cap_send_move_chan_req(struct l2cap_chan *chan, u8 dest_amp_id)  in l2cap_send_move_chan_req()  argument
4527 	BT_DBG("chan %p, dest_amp_id %d", chan, dest_amp_id);  in l2cap_send_move_chan_req()
4529 	ident = l2cap_get_ident(chan->conn);  in l2cap_send_move_chan_req()
4530 	chan->ident = ident;  in l2cap_send_move_chan_req()
4532 	req.icid = cpu_to_le16(chan->scid);  in l2cap_send_move_chan_req()
4535 	l2cap_send_cmd(chan->conn, ident, L2CAP_MOVE_CHAN_REQ, sizeof(req),  in l2cap_send_move_chan_req()
4538 	__set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);  in l2cap_send_move_chan_req()
4541 static void l2cap_send_move_chan_rsp(struct l2cap_chan *chan, u16 result)  in l2cap_send_move_chan_rsp()  argument
4545 	BT_DBG("chan %p, result 0x%4.4x", chan, result);  in l2cap_send_move_chan_rsp()
4547 	rsp.icid = cpu_to_le16(chan->dcid);  in l2cap_send_move_chan_rsp()
4550 	l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_RSP,  in l2cap_send_move_chan_rsp()
4554 static void l2cap_send_move_chan_cfm(struct l2cap_chan *chan, u16 result)  in l2cap_send_move_chan_cfm()  argument
4558 	BT_DBG("chan %p, result 0x%4.4x", chan, result);  in l2cap_send_move_chan_cfm()
4560 	chan->ident = l2cap_get_ident(chan->conn);  in l2cap_send_move_chan_cfm()
4562 	cfm.icid = cpu_to_le16(chan->scid);  in l2cap_send_move_chan_cfm()
4565 	l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_CFM,  in l2cap_send_move_chan_cfm()
4568 	__set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);  in l2cap_send_move_chan_cfm()
4595 static void __release_logical_link(struct l2cap_chan *chan)  in __release_logical_link()  argument
4597 	chan->hs_hchan = NULL;  in __release_logical_link()
4598 	chan->hs_hcon = NULL;  in __release_logical_link()
4603 static void l2cap_logical_fail(struct l2cap_chan *chan)  in l2cap_logical_fail()  argument
4606 	if (chan->state != BT_CONNECTED) {  in l2cap_logical_fail()
4608 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_logical_fail()
4612 	switch (chan->move_role) {  in l2cap_logical_fail()
4614 		l2cap_move_done(chan);  in l2cap_logical_fail()
4615 		l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_SUPP);  in l2cap_logical_fail()
4618 		if (chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_COMP ||  in l2cap_logical_fail()
4619 		    chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_CFM) {  in l2cap_logical_fail()
4623 			l2cap_move_done(chan);  in l2cap_logical_fail()
4629 		l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);  in l2cap_logical_fail()
4634 static void l2cap_logical_finish_create(struct l2cap_chan *chan,  in l2cap_logical_finish_create()  argument
4639 	chan->hs_hchan = hchan;  in l2cap_logical_finish_create()
4640 	chan->hs_hcon->l2cap_data = chan->conn;  in l2cap_logical_finish_create()
4642 	l2cap_send_efs_conf_rsp(chan, &rsp, chan->ident, 0);  in l2cap_logical_finish_create()
4644 	if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {  in l2cap_logical_finish_create()
4647 		set_default_fcs(chan);  in l2cap_logical_finish_create()
4649 		err = l2cap_ertm_init(chan);  in l2cap_logical_finish_create()
4651 			l2cap_send_disconn_req(chan, -err);  in l2cap_logical_finish_create()
4653 			l2cap_chan_ready(chan);  in l2cap_logical_finish_create()
4657 static void l2cap_logical_finish_move(struct l2cap_chan *chan,  in l2cap_logical_finish_move()  argument
4660 	chan->hs_hcon = hchan->conn;  in l2cap_logical_finish_move()
4661 	chan->hs_hcon->l2cap_data = chan->conn;  in l2cap_logical_finish_move()
4663 	BT_DBG("move_state %d", chan->move_state);  in l2cap_logical_finish_move()
4665 	switch (chan->move_state) {  in l2cap_logical_finish_move()
4670 		chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;  in l2cap_logical_finish_move()
4673 		if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_logical_finish_move()
4674 			chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;  in l2cap_logical_finish_move()
4675 		} else if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {  in l2cap_logical_finish_move()
4676 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;  in l2cap_logical_finish_move()
4677 			l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);  in l2cap_logical_finish_move()
4678 		} else if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {  in l2cap_logical_finish_move()
4679 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;  in l2cap_logical_finish_move()
4680 			l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);  in l2cap_logical_finish_move()
4685 		__release_logical_link(chan);  in l2cap_logical_finish_move()
4687 		chan->move_state = L2CAP_MOVE_STABLE;  in l2cap_logical_finish_move()
4692 void l2cap_logical_cfm(struct l2cap_chan *chan, struct hci_chan *hchan,  in l2cap_logical_cfm()  argument
4695 	BT_DBG("chan %p, hchan %p, status %d", chan, hchan, status);  in l2cap_logical_cfm()
4698 		l2cap_logical_fail(chan);  in l2cap_logical_cfm()
4699 		__release_logical_link(chan);  in l2cap_logical_cfm()
4703 	if (chan->state != BT_CONNECTED) {  in l2cap_logical_cfm()
4705 		if (chan->local_amp_id != AMP_ID_BREDR)  in l2cap_logical_cfm()
4706 			l2cap_logical_finish_create(chan, hchan);  in l2cap_logical_cfm()
4708 		l2cap_logical_finish_move(chan, hchan);  in l2cap_logical_cfm()
4712 void l2cap_move_start(struct l2cap_chan *chan)  in l2cap_move_start()  argument
4714 	BT_DBG("chan %p", chan);  in l2cap_move_start()
4716 	if (chan->local_amp_id == AMP_ID_BREDR) {  in l2cap_move_start()
4717 		if (chan->chan_policy != BT_CHANNEL_POLICY_AMP_PREFERRED)  in l2cap_move_start()
4719 		chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;  in l2cap_move_start()
4720 		chan->move_state = L2CAP_MOVE_WAIT_PREPARE;  in l2cap_move_start()
4723 		chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;  in l2cap_move_start()
4724 		chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;  in l2cap_move_start()
4725 		chan->move_id = 0;  in l2cap_move_start()
4726 		l2cap_move_setup(chan);  in l2cap_move_start()
4727 		l2cap_send_move_chan_req(chan, 0);  in l2cap_move_start()
4731 static void l2cap_do_create(struct l2cap_chan *chan, int result,  in l2cap_do_create()  argument
4734 	BT_DBG("chan %p state %s %u -> %u", chan, state_to_string(chan->state),  in l2cap_do_create()
4737 	chan->fcs = L2CAP_FCS_NONE;  in l2cap_do_create()
4740 	if (chan->state == BT_CONNECT) {  in l2cap_do_create()
4742 			chan->local_amp_id = local_amp_id;  in l2cap_do_create()
4743 			l2cap_send_create_chan_req(chan, remote_amp_id);  in l2cap_do_create()
4746 			l2cap_send_conn_req(chan);  in l2cap_do_create()
4753 	if (__l2cap_no_conn_pending(chan)) {  in l2cap_do_create()
4756 		rsp.scid = cpu_to_le16(chan->dcid);  in l2cap_do_create()
4757 		rsp.dcid = cpu_to_le16(chan->scid);  in l2cap_do_create()
4769 		l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_RSP,  in l2cap_do_create()
4773 			l2cap_state_change(chan, BT_CONFIG);  in l2cap_do_create()
4774 			set_bit(CONF_REQ_SENT, &chan->conf_state);  in l2cap_do_create()
4775 			l2cap_send_cmd(chan->conn, l2cap_get_ident(chan->conn),  in l2cap_do_create()
4777 				       l2cap_build_conf_req(chan, buf), buf);  in l2cap_do_create()
4778 			chan->num_conf_req++;  in l2cap_do_create()
4783 static void l2cap_do_move_initiate(struct l2cap_chan *chan, u8 local_amp_id,  in l2cap_do_move_initiate()  argument
4786 	l2cap_move_setup(chan);  in l2cap_do_move_initiate()
4787 	chan->move_id = local_amp_id;  in l2cap_do_move_initiate()
4788 	chan->move_state = L2CAP_MOVE_WAIT_RSP;  in l2cap_do_move_initiate()
4790 	l2cap_send_move_chan_req(chan, remote_amp_id);  in l2cap_do_move_initiate()
4793 static void l2cap_do_move_respond(struct l2cap_chan *chan, int result)  in l2cap_do_move_respond()  argument
4802 			chan->hs_hcon = hchan->conn;  in l2cap_do_move_respond()
4803 			chan->hs_hcon->l2cap_data = chan->conn;  in l2cap_do_move_respond()
4804 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;  in l2cap_do_move_respond()
4805 			l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);  in l2cap_do_move_respond()
4807 			l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);  in l2cap_do_move_respond()
4810 			chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;  in l2cap_do_move_respond()
4814 		l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_ALLOWED);  in l2cap_do_move_respond()
4818 static void l2cap_do_move_cancel(struct l2cap_chan *chan, int result)  in l2cap_do_move_cancel()  argument
4820 	if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {  in l2cap_do_move_cancel()
4827 		l2cap_send_move_chan_rsp(chan, rsp_result);  in l2cap_do_move_cancel()
4830 	chan->move_role = L2CAP_MOVE_ROLE_NONE;  in l2cap_do_move_cancel()
4831 	chan->move_state = L2CAP_MOVE_STABLE;  in l2cap_do_move_cancel()
4834 	l2cap_ertm_send(chan);  in l2cap_do_move_cancel()
4838 void __l2cap_physical_cfm(struct l2cap_chan *chan, int result)  in __l2cap_physical_cfm()  argument
4840 	u8 local_amp_id = chan->local_amp_id;  in __l2cap_physical_cfm()
4841 	u8 remote_amp_id = chan->remote_amp_id;  in __l2cap_physical_cfm()
4844 	       chan, result, local_amp_id, remote_amp_id);  in __l2cap_physical_cfm()
4846 	if (chan->state == BT_DISCONN || chan->state == BT_CLOSED) {  in __l2cap_physical_cfm()
4847 		l2cap_chan_unlock(chan);  in __l2cap_physical_cfm()
4851 	if (chan->state != BT_CONNECTED) {  in __l2cap_physical_cfm()
4852 		l2cap_do_create(chan, result, local_amp_id, remote_amp_id);  in __l2cap_physical_cfm()
4854 		l2cap_do_move_cancel(chan, result);  in __l2cap_physical_cfm()
4856 		switch (chan->move_role) {  in __l2cap_physical_cfm()
4858 			l2cap_do_move_initiate(chan, local_amp_id,  in __l2cap_physical_cfm()
4862 			l2cap_do_move_respond(chan, result);  in __l2cap_physical_cfm()
4865 			l2cap_do_move_cancel(chan, result);  in __l2cap_physical_cfm()
4877 	struct l2cap_chan *chan;  in l2cap_move_channel_req()  local
4891 	chan = l2cap_get_chan_by_dcid(conn, icid);  in l2cap_move_channel_req()
4892 	if (!chan) {  in l2cap_move_channel_req()
4900 	chan->ident = cmd->ident;  in l2cap_move_channel_req()
4902 	if (chan->scid < L2CAP_CID_DYN_START ||  in l2cap_move_channel_req()
4903 	    chan->chan_policy == BT_CHANNEL_POLICY_BREDR_ONLY ||  in l2cap_move_channel_req()
4904 	    (chan->mode != L2CAP_MODE_ERTM &&  in l2cap_move_channel_req()
4905 	     chan->mode != L2CAP_MODE_STREAMING)) {  in l2cap_move_channel_req()
4910 	if (chan->local_amp_id == req->dest_amp_id) {  in l2cap_move_channel_req()
4933 	if ((__chan_is_moving(chan) ||  in l2cap_move_channel_req()
4934 	     chan->move_role != L2CAP_MOVE_ROLE_NONE) &&  in l2cap_move_channel_req()
4940 	chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;  in l2cap_move_channel_req()
4941 	l2cap_move_setup(chan);  in l2cap_move_channel_req()
4942 	chan->move_id = req->dest_amp_id;  in l2cap_move_channel_req()
4943 	icid = chan->dcid;  in l2cap_move_channel_req()
4947 		if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_move_channel_req()
4948 			chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;  in l2cap_move_channel_req()
4951 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;  in l2cap_move_channel_req()
4955 		chan->move_state = L2CAP_MOVE_WAIT_PREPARE;  in l2cap_move_channel_req()
4962 	l2cap_send_move_chan_rsp(chan, result);  in l2cap_move_channel_req()
4964 	l2cap_chan_unlock(chan);  in l2cap_move_channel_req()
4971 	struct l2cap_chan *chan;  in l2cap_move_continue()  local
4974 	chan = l2cap_get_chan_by_scid(conn, icid);  in l2cap_move_continue()
4975 	if (!chan) {  in l2cap_move_continue()
4980 	__clear_chan_timer(chan);  in l2cap_move_continue()
4982 		__set_chan_timer(chan, L2CAP_MOVE_ERTX_TIMEOUT);  in l2cap_move_continue()
4984 	switch (chan->move_state) {  in l2cap_move_continue()
4989 		chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;  in l2cap_move_continue()
4995 				    &chan->conn_state)) {  in l2cap_move_continue()
4996 			chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;  in l2cap_move_continue()
5001 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;  in l2cap_move_continue()
5002 			l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);  in l2cap_move_continue()
5011 			chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;  in l2cap_move_continue()
5016 			chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_COMP;  in l2cap_move_continue()
5022 			l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);  in l2cap_move_continue()
5034 		chan->hs_hcon = hchan->conn;  in l2cap_move_continue()
5035 		chan->hs_hcon->l2cap_data = chan->conn;  in l2cap_move_continue()
5039 			l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);  in l2cap_move_continue()
5044 			chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;  in l2cap_move_continue()
5047 		l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);  in l2cap_move_continue()
5051 		chan->move_id = chan->local_amp_id;  in l2cap_move_continue()
5052 		l2cap_move_done(chan);  in l2cap_move_continue()
5053 		l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);  in l2cap_move_continue()
5056 	l2cap_chan_unlock(chan);  in l2cap_move_continue()
5062 	struct l2cap_chan *chan;  in l2cap_move_fail()  local
5064 	chan = l2cap_get_chan_by_ident(conn, ident);  in l2cap_move_fail()
5065 	if (!chan) {  in l2cap_move_fail()
5071 	__clear_chan_timer(chan);  in l2cap_move_fail()
5073 	if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {  in l2cap_move_fail()
5075 			chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;  in l2cap_move_fail()
5078 			chan->move_id = chan->local_amp_id;  in l2cap_move_fail()
5079 			l2cap_move_done(chan);  in l2cap_move_fail()
5083 	l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);  in l2cap_move_fail()
5085 	l2cap_chan_unlock(chan);  in l2cap_move_fail()
5116 	struct l2cap_chan *chan;  in l2cap_move_channel_confirm()  local
5127 	chan = l2cap_get_chan_by_dcid(conn, icid);  in l2cap_move_channel_confirm()
5128 	if (!chan) {  in l2cap_move_channel_confirm()
5134 	if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM) {  in l2cap_move_channel_confirm()
5136 			chan->local_amp_id = chan->move_id;  in l2cap_move_channel_confirm()
5137 			if (chan->local_amp_id == AMP_ID_BREDR)  in l2cap_move_channel_confirm()
5138 				__release_logical_link(chan);  in l2cap_move_channel_confirm()
5140 			chan->move_id = chan->local_amp_id;  in l2cap_move_channel_confirm()
5143 		l2cap_move_done(chan);  in l2cap_move_channel_confirm()
5148 	l2cap_chan_unlock(chan);  in l2cap_move_channel_confirm()
5158 	struct l2cap_chan *chan;  in l2cap_move_channel_confirm_rsp()  local
5168 	chan = l2cap_get_chan_by_scid(conn, icid);  in l2cap_move_channel_confirm_rsp()
5169 	if (!chan)  in l2cap_move_channel_confirm_rsp()
5172 	__clear_chan_timer(chan);  in l2cap_move_channel_confirm_rsp()
5174 	if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM_RSP) {  in l2cap_move_channel_confirm_rsp()
5175 		chan->local_amp_id = chan->move_id;  in l2cap_move_channel_confirm_rsp()
5177 		if (chan->local_amp_id == AMP_ID_BREDR && chan->hs_hchan)  in l2cap_move_channel_confirm_rsp()
5178 			__release_logical_link(chan);  in l2cap_move_channel_confirm_rsp()
5180 		l2cap_move_done(chan);  in l2cap_move_channel_confirm_rsp()
5183 	l2cap_chan_unlock(chan);  in l2cap_move_channel_confirm_rsp()
5245 	struct l2cap_chan *chan;  in l2cap_le_connect_rsp()  local
5265 	chan = __l2cap_get_chan_by_ident(conn, cmd->ident);  in l2cap_le_connect_rsp()
5266 	if (!chan) {  in l2cap_le_connect_rsp()
5273 	l2cap_chan_lock(chan);  in l2cap_le_connect_rsp()
5277 		chan->ident = 0;  in l2cap_le_connect_rsp()
5278 		chan->dcid = dcid;  in l2cap_le_connect_rsp()
5279 		chan->omtu = mtu;  in l2cap_le_connect_rsp()
5280 		chan->remote_mps = mps;  in l2cap_le_connect_rsp()
5281 		chan->tx_credits = credits;  in l2cap_le_connect_rsp()
5282 		l2cap_chan_ready(chan);  in l2cap_le_connect_rsp()
5291 			l2cap_chan_del(chan, ECONNREFUSED);  in l2cap_le_connect_rsp()
5296 		if (chan->sec_level < sec_level)  in l2cap_le_connect_rsp()
5297 			chan->sec_level = sec_level;  in l2cap_le_connect_rsp()
5300 		clear_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags);  in l2cap_le_connect_rsp()
5302 		smp_conn_security(hcon, chan->sec_level);  in l2cap_le_connect_rsp()
5306 		l2cap_chan_del(chan, ECONNREFUSED);  in l2cap_le_connect_rsp()
5310 	l2cap_chan_unlock(chan);  in l2cap_le_connect_rsp()
5404 	struct l2cap_chan *chan, *pchan;  in l2cap_le_connect_req()  local
5430 		chan = NULL;  in l2cap_le_connect_req()
5440 		chan = NULL;  in l2cap_le_connect_req()
5447 		chan = NULL;  in l2cap_le_connect_req()
5451 	chan = pchan->ops->new_connection(pchan);  in l2cap_le_connect_req()
5452 	if (!chan) {  in l2cap_le_connect_req()
5457 	l2cap_le_flowctl_init(chan);  in l2cap_le_connect_req()
5459 	bacpy(&chan->src, &conn->hcon->src);  in l2cap_le_connect_req()
5460 	bacpy(&chan->dst, &conn->hcon->dst);  in l2cap_le_connect_req()
5461 	chan->src_type = bdaddr_src_type(conn->hcon);  in l2cap_le_connect_req()
5462 	chan->dst_type = bdaddr_dst_type(conn->hcon);  in l2cap_le_connect_req()
5463 	chan->psm  = psm;  in l2cap_le_connect_req()
5464 	chan->dcid = scid;  in l2cap_le_connect_req()
5465 	chan->omtu = mtu;  in l2cap_le_connect_req()
5466 	chan->remote_mps = mps;  in l2cap_le_connect_req()
5467 	chan->tx_credits = __le16_to_cpu(req->credits);  in l2cap_le_connect_req()
5469 	__l2cap_chan_add(conn, chan);  in l2cap_le_connect_req()
5470 	dcid = chan->scid;  in l2cap_le_connect_req()
5471 	credits = chan->rx_credits;  in l2cap_le_connect_req()
5473 	__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));  in l2cap_le_connect_req()
5475 	chan->ident = cmd->ident;  in l2cap_le_connect_req()
5477 	if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {  in l2cap_le_connect_req()
5478 		l2cap_state_change(chan, BT_CONNECT2);  in l2cap_le_connect_req()
5485 		chan->ops->defer(chan);  in l2cap_le_connect_req()
5487 		l2cap_chan_ready(chan);  in l2cap_le_connect_req()
5500 	if (chan) {  in l2cap_le_connect_req()
5501 		rsp.mtu = cpu_to_le16(chan->imtu);  in l2cap_le_connect_req()
5502 		rsp.mps = cpu_to_le16(chan->mps);  in l2cap_le_connect_req()
5522 	struct l2cap_chan *chan;  in l2cap_le_credits()  local
5534 	chan = l2cap_get_chan_by_dcid(conn, cid);  in l2cap_le_credits()
5535 	if (!chan)  in l2cap_le_credits()
5538 	max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;  in l2cap_le_credits()
5541 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_le_credits()
5542 		l2cap_chan_unlock(chan);  in l2cap_le_credits()
5550 	chan->tx_credits += credits;  in l2cap_le_credits()
5552 	while (chan->tx_credits && !skb_queue_empty(&chan->tx_q)) {  in l2cap_le_credits()
5553 		l2cap_do_send(chan, skb_dequeue(&chan->tx_q));  in l2cap_le_credits()
5554 		chan->tx_credits--;  in l2cap_le_credits()
5557 	if (chan->tx_credits)  in l2cap_le_credits()
5558 		chan->ops->resume(chan);  in l2cap_le_credits()
5560 	l2cap_chan_unlock(chan);  in l2cap_le_credits()
5570 	struct l2cap_chan *chan;  in l2cap_le_command_rej()  local
5577 	chan = __l2cap_get_chan_by_ident(conn, cmd->ident);  in l2cap_le_command_rej()
5578 	if (!chan)  in l2cap_le_command_rej()
5581 	l2cap_chan_lock(chan);  in l2cap_le_command_rej()
5582 	l2cap_chan_del(chan, ECONNREFUSED);  in l2cap_le_command_rej()
5583 	l2cap_chan_unlock(chan);  in l2cap_le_command_rej()
5727 static int l2cap_check_fcs(struct l2cap_chan *chan,  struct sk_buff *skb)  in l2cap_check_fcs()  argument
5732 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_check_fcs()
5737 	if (chan->fcs == L2CAP_FCS_CRC16) {  in l2cap_check_fcs()
5748 static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)  in l2cap_send_i_or_rr_or_rnr()  argument
5752 	BT_DBG("chan %p", chan);  in l2cap_send_i_or_rr_or_rnr()
5757 	control.reqseq = chan->buffer_seq;  in l2cap_send_i_or_rr_or_rnr()
5758 	set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_send_i_or_rr_or_rnr()
5760 	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_send_i_or_rr_or_rnr()
5762 		l2cap_send_sframe(chan, &control);  in l2cap_send_i_or_rr_or_rnr()
5765 	if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&  in l2cap_send_i_or_rr_or_rnr()
5766 	    chan->unacked_frames > 0)  in l2cap_send_i_or_rr_or_rnr()
5767 		__set_retrans_timer(chan);  in l2cap_send_i_or_rr_or_rnr()
5770 	l2cap_ertm_send(chan);  in l2cap_send_i_or_rr_or_rnr()
5772 	if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&  in l2cap_send_i_or_rr_or_rnr()
5773 	    test_bit(CONN_SEND_FBIT, &chan->conn_state)) {  in l2cap_send_i_or_rr_or_rnr()
5778 		l2cap_send_sframe(chan, &control);  in l2cap_send_i_or_rr_or_rnr()
5801 static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,  in l2cap_reassemble_sdu()  argument
5808 		if (chan->sdu)  in l2cap_reassemble_sdu()
5811 		err = chan->ops->recv(chan, skb);  in l2cap_reassemble_sdu()
5815 		if (chan->sdu)  in l2cap_reassemble_sdu()
5818 		chan->sdu_len = get_unaligned_le16(skb->data);  in l2cap_reassemble_sdu()
5821 		if (chan->sdu_len > chan->imtu) {  in l2cap_reassemble_sdu()
5826 		if (skb->len >= chan->sdu_len)  in l2cap_reassemble_sdu()
5829 		chan->sdu = skb;  in l2cap_reassemble_sdu()
5830 		chan->sdu_last_frag = skb;  in l2cap_reassemble_sdu()
5837 		if (!chan->sdu)  in l2cap_reassemble_sdu()
5840 		append_skb_frag(chan->sdu, skb,  in l2cap_reassemble_sdu()
5841 				&chan->sdu_last_frag);  in l2cap_reassemble_sdu()
5844 		if (chan->sdu->len >= chan->sdu_len)  in l2cap_reassemble_sdu()
5851 		if (!chan->sdu)  in l2cap_reassemble_sdu()
5854 		append_skb_frag(chan->sdu, skb,  in l2cap_reassemble_sdu()
5855 				&chan->sdu_last_frag);  in l2cap_reassemble_sdu()
5858 		if (chan->sdu->len != chan->sdu_len)  in l2cap_reassemble_sdu()
5861 		err = chan->ops->recv(chan, chan->sdu);  in l2cap_reassemble_sdu()
5865 			chan->sdu = NULL;  in l2cap_reassemble_sdu()
5866 			chan->sdu_last_frag = NULL;  in l2cap_reassemble_sdu()
5867 			chan->sdu_len = 0;  in l2cap_reassemble_sdu()
5874 		kfree_skb(chan->sdu);  in l2cap_reassemble_sdu()
5875 		chan->sdu = NULL;  in l2cap_reassemble_sdu()
5876 		chan->sdu_last_frag = NULL;  in l2cap_reassemble_sdu()
5877 		chan->sdu_len = 0;  in l2cap_reassemble_sdu()
5883 static int l2cap_resegment(struct l2cap_chan *chan)  in l2cap_resegment()  argument
5889 void l2cap_chan_busy(struct l2cap_chan *chan, int busy)  in l2cap_chan_busy()  argument
5893 	if (chan->mode != L2CAP_MODE_ERTM)  in l2cap_chan_busy()
5897 	l2cap_tx(chan, NULL, NULL, event);  in l2cap_chan_busy()
5900 static int l2cap_rx_queued_iframes(struct l2cap_chan *chan)  in l2cap_rx_queued_iframes()  argument
5907 	BT_DBG("chan %p", chan);  in l2cap_rx_queued_iframes()
5909 	while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_rx_queued_iframes()
5912 		       chan->buffer_seq, skb_queue_len(&chan->srej_q));  in l2cap_rx_queued_iframes()
5914 		skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq);  in l2cap_rx_queued_iframes()
5919 		skb_unlink(skb, &chan->srej_q);  in l2cap_rx_queued_iframes()
5920 		chan->buffer_seq = __next_seq(chan, chan->buffer_seq);  in l2cap_rx_queued_iframes()
5921 		err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->l2cap);  in l2cap_rx_queued_iframes()
5926 	if (skb_queue_empty(&chan->srej_q)) {  in l2cap_rx_queued_iframes()
5927 		chan->rx_state = L2CAP_RX_STATE_RECV;  in l2cap_rx_queued_iframes()
5928 		l2cap_send_ack(chan);  in l2cap_rx_queued_iframes()
5934 static void l2cap_handle_srej(struct l2cap_chan *chan,  in l2cap_handle_srej()  argument
5939 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_handle_srej()
5941 	if (control->reqseq == chan->next_tx_seq) {  in l2cap_handle_srej()
5943 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_handle_srej()
5947 	skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);  in l2cap_handle_srej()
5955 	if (chan->max_tx != 0 && bt_cb(skb)->l2cap.retries >= chan->max_tx) {  in l2cap_handle_srej()
5956 		BT_DBG("Retry limit exceeded (%d)", chan->max_tx);  in l2cap_handle_srej()
5957 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_handle_srej()
5961 	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_handle_srej()
5964 		l2cap_pass_to_tx(chan, control);  in l2cap_handle_srej()
5966 		set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_handle_srej()
5967 		l2cap_retransmit(chan, control);  in l2cap_handle_srej()
5968 		l2cap_ertm_send(chan);  in l2cap_handle_srej()
5970 		if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {  in l2cap_handle_srej()
5971 			set_bit(CONN_SREJ_ACT, &chan->conn_state);  in l2cap_handle_srej()
5972 			chan->srej_save_reqseq = control->reqseq;  in l2cap_handle_srej()
5975 		l2cap_pass_to_tx_fbit(chan, control);  in l2cap_handle_srej()
5978 			if (chan->srej_save_reqseq != control->reqseq ||  in l2cap_handle_srej()
5980 						&chan->conn_state))  in l2cap_handle_srej()
5981 				l2cap_retransmit(chan, control);  in l2cap_handle_srej()
5983 			l2cap_retransmit(chan, control);  in l2cap_handle_srej()
5984 			if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {  in l2cap_handle_srej()
5985 				set_bit(CONN_SREJ_ACT, &chan->conn_state);  in l2cap_handle_srej()
5986 				chan->srej_save_reqseq = control->reqseq;  in l2cap_handle_srej()
5992 static void l2cap_handle_rej(struct l2cap_chan *chan,  in l2cap_handle_rej()  argument
5997 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_handle_rej()
5999 	if (control->reqseq == chan->next_tx_seq) {  in l2cap_handle_rej()
6001 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_handle_rej()
6005 	skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);  in l2cap_handle_rej()
6007 	if (chan->max_tx && skb &&  in l2cap_handle_rej()
6008 	    bt_cb(skb)->l2cap.retries >= chan->max_tx) {  in l2cap_handle_rej()
6009 		BT_DBG("Retry limit exceeded (%d)", chan->max_tx);  in l2cap_handle_rej()
6010 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_handle_rej()
6014 	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_handle_rej()
6016 	l2cap_pass_to_tx(chan, control);  in l2cap_handle_rej()
6019 		if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))  in l2cap_handle_rej()
6020 			l2cap_retransmit_all(chan, control);  in l2cap_handle_rej()
6022 		l2cap_retransmit_all(chan, control);  in l2cap_handle_rej()
6023 		l2cap_ertm_send(chan);  in l2cap_handle_rej()
6024 		if (chan->tx_state == L2CAP_TX_STATE_WAIT_F)  in l2cap_handle_rej()
6025 			set_bit(CONN_REJ_ACT, &chan->conn_state);  in l2cap_handle_rej()
6029 static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq)  in l2cap_classify_txseq()  argument
6031 	BT_DBG("chan %p, txseq %d", chan, txseq);  in l2cap_classify_txseq()
6033 	BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq,  in l2cap_classify_txseq()
6034 	       chan->expected_tx_seq);  in l2cap_classify_txseq()
6036 	if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {  in l2cap_classify_txseq()
6037 		if (__seq_offset(chan, txseq, chan->last_acked_seq) >=  in l2cap_classify_txseq()
6038 		    chan->tx_win) {  in l2cap_classify_txseq()
6042 			if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {  in l2cap_classify_txseq()
6051 		if (chan->srej_list.head == txseq) {  in l2cap_classify_txseq()
6056 		if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) {  in l2cap_classify_txseq()
6061 		if (l2cap_seq_list_contains(&chan->srej_list, txseq)) {  in l2cap_classify_txseq()
6067 	if (chan->expected_tx_seq == txseq) {  in l2cap_classify_txseq()
6068 		if (__seq_offset(chan, txseq, chan->last_acked_seq) >=  in l2cap_classify_txseq()
6069 		    chan->tx_win) {  in l2cap_classify_txseq()
6078 	if (__seq_offset(chan, txseq, chan->last_acked_seq) <  in l2cap_classify_txseq()
6079 	    __seq_offset(chan, chan->expected_tx_seq, chan->last_acked_seq)) {  in l2cap_classify_txseq()
6084 	if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) {  in l2cap_classify_txseq()
6102 		if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {  in l2cap_classify_txseq()
6115 static int l2cap_rx_state_recv(struct l2cap_chan *chan,  in l2cap_rx_state_recv()  argument
6122 	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,  in l2cap_rx_state_recv()
6127 		switch (l2cap_classify_txseq(chan, control->txseq)) {  in l2cap_rx_state_recv()
6129 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
6131 			if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_rx_state_recv()
6137 			chan->expected_tx_seq = __next_seq(chan,  in l2cap_rx_state_recv()
6140 			chan->buffer_seq = chan->expected_tx_seq;  in l2cap_rx_state_recv()
6143 			err = l2cap_reassemble_sdu(chan, skb, control);  in l2cap_rx_state_recv()
6149 							&chan->conn_state)) {  in l2cap_rx_state_recv()
6151 					l2cap_retransmit_all(chan, control);  in l2cap_rx_state_recv()
6152 					l2cap_ertm_send(chan);  in l2cap_rx_state_recv()
6156 			if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state))  in l2cap_rx_state_recv()
6157 				l2cap_send_ack(chan);  in l2cap_rx_state_recv()
6160 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
6166 			if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_rx_state_recv()
6176 			skb_queue_tail(&chan->srej_q, skb);  in l2cap_rx_state_recv()
6179 			       skb_queue_len(&chan->srej_q));  in l2cap_rx_state_recv()
6181 			clear_bit(CONN_SREJ_ACT, &chan->conn_state);  in l2cap_rx_state_recv()
6182 			l2cap_seq_list_clear(&chan->srej_list);  in l2cap_rx_state_recv()
6183 			l2cap_send_srej(chan, control->txseq);  in l2cap_rx_state_recv()
6185 			chan->rx_state = L2CAP_RX_STATE_SREJ_SENT;  in l2cap_rx_state_recv()
6188 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
6194 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_rx_state_recv()
6199 		l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
6201 			clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_rx_state_recv()
6203 			if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state) &&  in l2cap_rx_state_recv()
6204 			    !__chan_is_moving(chan)) {  in l2cap_rx_state_recv()
6206 				l2cap_retransmit_all(chan, control);  in l2cap_rx_state_recv()
6209 			l2cap_ertm_send(chan);  in l2cap_rx_state_recv()
6211 			l2cap_send_i_or_rr_or_rnr(chan);  in l2cap_rx_state_recv()
6214 					       &chan->conn_state) &&  in l2cap_rx_state_recv()
6215 			    chan->unacked_frames)  in l2cap_rx_state_recv()
6216 				__set_retrans_timer(chan);  in l2cap_rx_state_recv()
6218 			l2cap_ertm_send(chan);  in l2cap_rx_state_recv()
6222 		set_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_rx_state_recv()
6223 		l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
6225 			set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_rx_state_recv()
6226 			l2cap_send_rr_or_rnr(chan, 0);  in l2cap_rx_state_recv()
6228 		__clear_retrans_timer(chan);  in l2cap_rx_state_recv()
6229 		l2cap_seq_list_clear(&chan->retrans_list);  in l2cap_rx_state_recv()
6232 		l2cap_handle_rej(chan, control);  in l2cap_rx_state_recv()
6235 		l2cap_handle_srej(chan, control);  in l2cap_rx_state_recv()
6249 static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,  in l2cap_rx_state_srej_sent()  argument
6257 	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,  in l2cap_rx_state_srej_sent()
6262 		switch (l2cap_classify_txseq(chan, txseq)) {  in l2cap_rx_state_srej_sent()
6265 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
6266 			skb_queue_tail(&chan->srej_q, skb);  in l2cap_rx_state_srej_sent()
6269 			       skb_queue_len(&chan->srej_q));  in l2cap_rx_state_srej_sent()
6271 			chan->expected_tx_seq = __next_seq(chan, txseq);  in l2cap_rx_state_srej_sent()
6274 			l2cap_seq_list_pop(&chan->srej_list);  in l2cap_rx_state_srej_sent()
6276 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
6277 			skb_queue_tail(&chan->srej_q, skb);  in l2cap_rx_state_srej_sent()
6280 			       skb_queue_len(&chan->srej_q));  in l2cap_rx_state_srej_sent()
6282 			err = l2cap_rx_queued_iframes(chan);  in l2cap_rx_state_srej_sent()
6292 			skb_queue_tail(&chan->srej_q, skb);  in l2cap_rx_state_srej_sent()
6295 			       skb_queue_len(&chan->srej_q));  in l2cap_rx_state_srej_sent()
6297 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
6298 			l2cap_send_srej(chan, control->txseq);  in l2cap_rx_state_srej_sent()
6306 			skb_queue_tail(&chan->srej_q, skb);  in l2cap_rx_state_srej_sent()
6309 			       skb_queue_len(&chan->srej_q));  in l2cap_rx_state_srej_sent()
6311 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
6312 			l2cap_send_srej_list(chan, control->txseq);  in l2cap_rx_state_srej_sent()
6316 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
6327 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_rx_state_srej_sent()
6332 		l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
6334 			clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_rx_state_srej_sent()
6337 						&chan->conn_state)) {  in l2cap_rx_state_srej_sent()
6339 				l2cap_retransmit_all(chan, control);  in l2cap_rx_state_srej_sent()
6342 			l2cap_ertm_send(chan);  in l2cap_rx_state_srej_sent()
6345 					       &chan->conn_state) &&  in l2cap_rx_state_srej_sent()
6346 			    chan->unacked_frames) {  in l2cap_rx_state_srej_sent()
6347 				__set_retrans_timer(chan);  in l2cap_rx_state_srej_sent()
6350 			set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_rx_state_srej_sent()
6351 			l2cap_send_srej_tail(chan);  in l2cap_rx_state_srej_sent()
6354 					       &chan->conn_state) &&  in l2cap_rx_state_srej_sent()
6355 			    chan->unacked_frames)  in l2cap_rx_state_srej_sent()
6356 				__set_retrans_timer(chan);  in l2cap_rx_state_srej_sent()
6358 			l2cap_send_ack(chan);  in l2cap_rx_state_srej_sent()
6362 		set_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_rx_state_srej_sent()
6363 		l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
6365 			l2cap_send_srej_tail(chan);  in l2cap_rx_state_srej_sent()
6371 			rr_control.reqseq = chan->buffer_seq;  in l2cap_rx_state_srej_sent()
6372 			l2cap_send_sframe(chan, &rr_control);  in l2cap_rx_state_srej_sent()
6377 		l2cap_handle_rej(chan, control);  in l2cap_rx_state_srej_sent()
6380 		l2cap_handle_srej(chan, control);  in l2cap_rx_state_srej_sent()
6392 static int l2cap_finish_move(struct l2cap_chan *chan)  in l2cap_finish_move()  argument
6394 	BT_DBG("chan %p", chan);  in l2cap_finish_move()
6396 	chan->rx_state = L2CAP_RX_STATE_RECV;  in l2cap_finish_move()
6398 	if (chan->hs_hcon)  in l2cap_finish_move()
6399 		chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;  in l2cap_finish_move()
6401 		chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;  in l2cap_finish_move()
6403 	return l2cap_resegment(chan);  in l2cap_finish_move()
6406 static int l2cap_rx_state_wait_p(struct l2cap_chan *chan,  in l2cap_rx_state_wait_p()  argument
6412 	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,  in l2cap_rx_state_wait_p()
6418 	l2cap_process_reqseq(chan, control->reqseq);  in l2cap_rx_state_wait_p()
6420 	if (!skb_queue_empty(&chan->tx_q))  in l2cap_rx_state_wait_p()
6421 		chan->tx_send_head = skb_peek(&chan->tx_q);  in l2cap_rx_state_wait_p()
6423 		chan->tx_send_head = NULL;  in l2cap_rx_state_wait_p()
6428 	chan->next_tx_seq = control->reqseq;  in l2cap_rx_state_wait_p()
6429 	chan->unacked_frames = 0;  in l2cap_rx_state_wait_p()
6431 	err = l2cap_finish_move(chan);  in l2cap_rx_state_wait_p()
6435 	set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_rx_state_wait_p()
6436 	l2cap_send_i_or_rr_or_rnr(chan);  in l2cap_rx_state_wait_p()
6441 	return l2cap_rx_state_recv(chan, control, NULL, event);  in l2cap_rx_state_wait_p()
6444 static int l2cap_rx_state_wait_f(struct l2cap_chan *chan,  in l2cap_rx_state_wait_f()  argument
6453 	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_rx_state_wait_f()
6455 	chan->rx_state = L2CAP_RX_STATE_RECV;  in l2cap_rx_state_wait_f()
6456 	l2cap_process_reqseq(chan, control->reqseq);  in l2cap_rx_state_wait_f()
6458 	if (!skb_queue_empty(&chan->tx_q))  in l2cap_rx_state_wait_f()
6459 		chan->tx_send_head = skb_peek(&chan->tx_q);  in l2cap_rx_state_wait_f()
6461 		chan->tx_send_head = NULL;  in l2cap_rx_state_wait_f()
6466 	chan->next_tx_seq = control->reqseq;  in l2cap_rx_state_wait_f()
6467 	chan->unacked_frames = 0;  in l2cap_rx_state_wait_f()
6469 	if (chan->hs_hcon)  in l2cap_rx_state_wait_f()
6470 		chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;  in l2cap_rx_state_wait_f()
6472 		chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;  in l2cap_rx_state_wait_f()
6474 	err = l2cap_resegment(chan);  in l2cap_rx_state_wait_f()
6477 		err = l2cap_rx_state_recv(chan, control, skb, event);  in l2cap_rx_state_wait_f()
6482 static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq)  in __valid_reqseq()  argument
6487 	unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq);  in __valid_reqseq()
6488 	return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked;  in __valid_reqseq()
6491 static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,  in l2cap_rx()  argument
6496 	BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan,  in l2cap_rx()
6497 	       control, skb, event, chan->rx_state);  in l2cap_rx()
6499 	if (__valid_reqseq(chan, control->reqseq)) {  in l2cap_rx()
6500 		switch (chan->rx_state) {  in l2cap_rx()
6502 			err = l2cap_rx_state_recv(chan, control, skb, event);  in l2cap_rx()
6505 			err = l2cap_rx_state_srej_sent(chan, control, skb,  in l2cap_rx()
6509 			err = l2cap_rx_state_wait_p(chan, control, skb, event);  in l2cap_rx()
6512 			err = l2cap_rx_state_wait_f(chan, control, skb, event);  in l2cap_rx()
6520 		       control->reqseq, chan->next_tx_seq,  in l2cap_rx()
6521 		       chan->expected_ack_seq);  in l2cap_rx()
6522 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_rx()
6528 static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,  in l2cap_stream_rx()  argument
6533 	BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb,  in l2cap_stream_rx()
6534 	       chan->rx_state);  in l2cap_stream_rx()
6536 	if (l2cap_classify_txseq(chan, control->txseq) ==  in l2cap_stream_rx()
6538 		l2cap_pass_to_tx(chan, control);  in l2cap_stream_rx()
6540 		BT_DBG("buffer_seq %d->%d", chan->buffer_seq,  in l2cap_stream_rx()
6541 		       __next_seq(chan, chan->buffer_seq));  in l2cap_stream_rx()
6543 		chan->buffer_seq = __next_seq(chan, chan->buffer_seq);  in l2cap_stream_rx()
6545 		l2cap_reassemble_sdu(chan, skb, control);  in l2cap_stream_rx()
6547 		if (chan->sdu) {  in l2cap_stream_rx()
6548 			kfree_skb(chan->sdu);  in l2cap_stream_rx()
6549 			chan->sdu = NULL;  in l2cap_stream_rx()
6551 		chan->sdu_last_frag = NULL;  in l2cap_stream_rx()
6552 		chan->sdu_len = 0;  in l2cap_stream_rx()
6560 	chan->last_acked_seq = control->txseq;  in l2cap_stream_rx()
6561 	chan->expected_tx_seq = __next_seq(chan, control->txseq);  in l2cap_stream_rx()
6566 static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)  in l2cap_data_rcv()  argument
6572 	__unpack_control(chan, skb);  in l2cap_data_rcv()
6581 	if (l2cap_check_fcs(chan, skb))  in l2cap_data_rcv()
6587 	if (chan->fcs == L2CAP_FCS_CRC16)  in l2cap_data_rcv()
6590 	if (len > chan->mps) {  in l2cap_data_rcv()
6591 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_data_rcv()
6605 		if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F)  in l2cap_data_rcv()
6608 		if (chan->mode != L2CAP_MODE_STREAMING) {  in l2cap_data_rcv()
6610 			err = l2cap_rx(chan, control, skb, event);  in l2cap_data_rcv()
6612 			err = l2cap_stream_rx(chan, control, skb);  in l2cap_data_rcv()
6616 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_data_rcv()
6624 		if (chan->mode == L2CAP_MODE_STREAMING)  in l2cap_data_rcv()
6633 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_data_rcv()
6639 				       chan->tx_state != L2CAP_TX_STATE_WAIT_F))  in l2cap_data_rcv()
6643 		if (l2cap_rx(chan, control, skb, event))  in l2cap_data_rcv()
6644 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_data_rcv()
6654 static void l2cap_chan_le_send_credits(struct l2cap_chan *chan)  in l2cap_chan_le_send_credits()  argument
6656 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_le_send_credits()
6663 	if (chan->rx_credits >= (le_max_credits + 1) / 2)  in l2cap_chan_le_send_credits()
6666 	return_credits = le_max_credits - chan->rx_credits;  in l2cap_chan_le_send_credits()
6668 	BT_DBG("chan %p returning %u credits to sender", chan, return_credits);  in l2cap_chan_le_send_credits()
6670 	chan->rx_credits += return_credits;  in l2cap_chan_le_send_credits()
6672 	pkt.cid     = cpu_to_le16(chan->scid);  in l2cap_chan_le_send_credits()
6675 	chan->ident = l2cap_get_ident(conn);  in l2cap_chan_le_send_credits()
6677 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CREDITS, sizeof(pkt), &pkt);  in l2cap_chan_le_send_credits()
6680 static int l2cap_le_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)  in l2cap_le_data_rcv()  argument
6684 	if (!chan->rx_credits) {  in l2cap_le_data_rcv()
6686 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_le_data_rcv()
6690 	if (chan->imtu < skb->len) {  in l2cap_le_data_rcv()
6695 	chan->rx_credits--;  in l2cap_le_data_rcv()
6696 	BT_DBG("rx_credits %u -> %u", chan->rx_credits + 1, chan->rx_credits);  in l2cap_le_data_rcv()
6698 	l2cap_chan_le_send_credits(chan);  in l2cap_le_data_rcv()
6702 	if (!chan->sdu) {  in l2cap_le_data_rcv()
6709 		       sdu_len, skb->len, chan->imtu);  in l2cap_le_data_rcv()
6711 		if (sdu_len > chan->imtu) {  in l2cap_le_data_rcv()
6724 			return chan->ops->recv(chan, skb);  in l2cap_le_data_rcv()
6726 		chan->sdu = skb;  in l2cap_le_data_rcv()
6727 		chan->sdu_len = sdu_len;  in l2cap_le_data_rcv()
6728 		chan->sdu_last_frag = skb;  in l2cap_le_data_rcv()
6734 	       chan->sdu->len, skb->len, chan->sdu_len);  in l2cap_le_data_rcv()
6736 	if (chan->sdu->len + skb->len > chan->sdu_len) {  in l2cap_le_data_rcv()
6742 	append_skb_frag(chan->sdu, skb, &chan->sdu_last_frag);  in l2cap_le_data_rcv()
6745 	if (chan->sdu->len == chan->sdu_len) {  in l2cap_le_data_rcv()
6746 		err = chan->ops->recv(chan, chan->sdu);  in l2cap_le_data_rcv()
6748 			chan->sdu = NULL;  in l2cap_le_data_rcv()
6749 			chan->sdu_last_frag = NULL;  in l2cap_le_data_rcv()
6750 			chan->sdu_len = 0;  in l2cap_le_data_rcv()
6757 		kfree_skb(chan->sdu);  in l2cap_le_data_rcv()
6758 		chan->sdu = NULL;  in l2cap_le_data_rcv()
6759 		chan->sdu_last_frag = NULL;  in l2cap_le_data_rcv()
6760 		chan->sdu_len = 0;  in l2cap_le_data_rcv()
6773 	struct l2cap_chan *chan;  in l2cap_data_channel()  local
6775 	chan = l2cap_get_chan_by_scid(conn, cid);  in l2cap_data_channel()
6776 	if (!chan) {  in l2cap_data_channel()
6778 			chan = a2mp_channel_create(conn, skb);  in l2cap_data_channel()
6779 			if (!chan) {  in l2cap_data_channel()
6784 			l2cap_chan_lock(chan);  in l2cap_data_channel()
6793 	BT_DBG("chan %p, len %d", chan, skb->len);  in l2cap_data_channel()
6799 	if (chan->chan_type == L2CAP_CHAN_FIXED)  in l2cap_data_channel()
6800 		l2cap_chan_ready(chan);  in l2cap_data_channel()
6802 	if (chan->state != BT_CONNECTED)  in l2cap_data_channel()
6805 	switch (chan->mode) {  in l2cap_data_channel()
6807 		if (l2cap_le_data_rcv(chan, skb) < 0)  in l2cap_data_channel()
6818 		if (chan->imtu < skb->len) {  in l2cap_data_channel()
6823 		if (!chan->ops->recv(chan, skb))  in l2cap_data_channel()
6829 		l2cap_data_rcv(chan, skb);  in l2cap_data_channel()
6833 		BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);  in l2cap_data_channel()
6841 	l2cap_chan_unlock(chan);  in l2cap_data_channel()
6848 	struct l2cap_chan *chan;  in l2cap_conless_channel()  local
6853 	chan = l2cap_global_chan_by_psm(0, psm, &hcon->src, &hcon->dst,  in l2cap_conless_channel()
6855 	if (!chan)  in l2cap_conless_channel()
6858 	BT_DBG("chan %p, len %d", chan, skb->len);  in l2cap_conless_channel()
6860 	if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)  in l2cap_conless_channel()
6863 	if (chan->imtu < skb->len)  in l2cap_conless_channel()
6870 	if (!chan->ops->recv(chan, skb)) {  in l2cap_conless_channel()
6871 		l2cap_chan_put(chan);  in l2cap_conless_channel()
6876 	l2cap_chan_put(chan);  in l2cap_conless_channel()
7026 int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,  in l2cap_chan_connect()  argument
7034 	BT_DBG("%pMR -> %pMR (type %u) psm 0x%2.2x", &chan->src, dst,  in l2cap_chan_connect()
7037 	hdev = hci_get_route(dst, &chan->src);  in l2cap_chan_connect()
7044 	    chan->chan_type != L2CAP_CHAN_RAW) {  in l2cap_chan_connect()
7049 	if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !psm) {  in l2cap_chan_connect()
7054 	if (chan->chan_type == L2CAP_CHAN_FIXED && !cid) {  in l2cap_chan_connect()
7059 	switch (chan->mode) {  in l2cap_chan_connect()
7063 		l2cap_le_flowctl_init(chan);  in l2cap_chan_connect()
7075 	switch (chan->state) {  in l2cap_chan_connect()
7099 	bacpy(&chan->dst, dst);  in l2cap_chan_connect()
7100 	chan->dst_type = dst_type;  in l2cap_chan_connect()
7102 	chan->psm = psm;  in l2cap_chan_connect()
7103 	chan->dcid = cid;  in l2cap_chan_connect()
7120 		hcon = hci_connect_le(hdev, dst, dst_type, chan->sec_level,  in l2cap_chan_connect()
7123 		u8 auth_type = l2cap_get_auth_type(chan);  in l2cap_chan_connect()
7124 		hcon = hci_connect_acl(hdev, dst, chan->sec_level, auth_type);  in l2cap_chan_connect()
7140 	l2cap_chan_lock(chan);  in l2cap_chan_connect()
7149 	bacpy(&chan->src, &hcon->src);  in l2cap_chan_connect()
7150 	chan->src_type = bdaddr_src_type(hcon);  in l2cap_chan_connect()
7152 	__l2cap_chan_add(conn, chan);  in l2cap_chan_connect()
7157 	l2cap_state_change(chan, BT_CONNECT);  in l2cap_chan_connect()
7158 	__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));  in l2cap_chan_connect()
7164 	chan->sport = 0;  in l2cap_chan_connect()
7168 		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {  in l2cap_chan_connect()
7169 			__clear_chan_timer(chan);  in l2cap_chan_connect()
7170 			if (l2cap_chan_check_security(chan, true))  in l2cap_chan_connect()
7171 				l2cap_state_change(chan, BT_CONNECTED);  in l2cap_chan_connect()
7173 			l2cap_do_start(chan);  in l2cap_chan_connect()
7179 	l2cap_chan_unlock(chan);  in l2cap_chan_connect()
7289 		struct l2cap_chan *chan, *next;  in l2cap_connect_cfm()  local
7296 		chan = pchan->ops->new_connection(pchan);  in l2cap_connect_cfm()
7297 		if (chan) {  in l2cap_connect_cfm()
7298 			bacpy(&chan->src, &hcon->src);  in l2cap_connect_cfm()
7299 			bacpy(&chan->dst, &hcon->dst);  in l2cap_connect_cfm()
7300 			chan->src_type = bdaddr_src_type(hcon);  in l2cap_connect_cfm()
7301 			chan->dst_type = dst_type;  in l2cap_connect_cfm()
7303 			__l2cap_chan_add(conn, chan);  in l2cap_connect_cfm()
7337 static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)  in l2cap_check_encryption()  argument
7339 	if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)  in l2cap_check_encryption()
7343 		if (chan->sec_level == BT_SECURITY_MEDIUM) {  in l2cap_check_encryption()
7344 			__set_chan_timer(chan, L2CAP_ENC_TIMEOUT);  in l2cap_check_encryption()
7345 		} else if (chan->sec_level == BT_SECURITY_HIGH ||  in l2cap_check_encryption()
7346 			   chan->sec_level == BT_SECURITY_FIPS)  in l2cap_check_encryption()
7347 			l2cap_chan_close(chan, ECONNREFUSED);  in l2cap_check_encryption()
7349 		if (chan->sec_level == BT_SECURITY_MEDIUM)  in l2cap_check_encryption()
7350 			__clear_chan_timer(chan);  in l2cap_check_encryption()
7357 	struct l2cap_chan *chan;  in l2cap_security_cfm()  local
7366 	list_for_each_entry(chan, &conn->chan_l, list) {  in l2cap_security_cfm()
7367 		l2cap_chan_lock(chan);  in l2cap_security_cfm()
7369 		BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid,  in l2cap_security_cfm()
7370 		       state_to_string(chan->state));  in l2cap_security_cfm()
7372 		if (chan->scid == L2CAP_CID_A2MP) {  in l2cap_security_cfm()
7373 			l2cap_chan_unlock(chan);  in l2cap_security_cfm()
7378 			chan->sec_level = hcon->sec_level;  in l2cap_security_cfm()
7380 		if (!__l2cap_no_conn_pending(chan)) {  in l2cap_security_cfm()
7381 			l2cap_chan_unlock(chan);  in l2cap_security_cfm()
7385 		if (!status && (chan->state == BT_CONNECTED ||  in l2cap_security_cfm()
7386 				chan->state == BT_CONFIG)) {  in l2cap_security_cfm()
7387 			chan->ops->resume(chan);  in l2cap_security_cfm()
7388 			l2cap_check_encryption(chan, encrypt);  in l2cap_security_cfm()
7389 			l2cap_chan_unlock(chan);  in l2cap_security_cfm()
7393 		if (chan->state == BT_CONNECT) {  in l2cap_security_cfm()
7395 				l2cap_start_connection(chan);  in l2cap_security_cfm()
7397 				__set_chan_timer(chan, L2CAP_DISC_TIMEOUT);  in l2cap_security_cfm()
7398 		} else if (chan->state == BT_CONNECT2 &&  in l2cap_security_cfm()
7399 			   chan->mode != L2CAP_MODE_LE_FLOWCTL) {  in l2cap_security_cfm()
7404 				if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {  in l2cap_security_cfm()
7407 					chan->ops->defer(chan);  in l2cap_security_cfm()
7409 					l2cap_state_change(chan, BT_CONFIG);  in l2cap_security_cfm()
7414 				l2cap_state_change(chan, BT_DISCONN);  in l2cap_security_cfm()
7415 				__set_chan_timer(chan, L2CAP_DISC_TIMEOUT);  in l2cap_security_cfm()
7420 			rsp.scid   = cpu_to_le16(chan->dcid);  in l2cap_security_cfm()
7421 			rsp.dcid   = cpu_to_le16(chan->scid);  in l2cap_security_cfm()
7424 			l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,  in l2cap_security_cfm()
7427 			if (!test_bit(CONF_REQ_SENT, &chan->conf_state) &&  in l2cap_security_cfm()
7430 				set_bit(CONF_REQ_SENT, &chan->conf_state);  in l2cap_security_cfm()
7433 					       l2cap_build_conf_req(chan, buf),  in l2cap_security_cfm()
7435 				chan->num_conf_req++;  in l2cap_security_cfm()
7439 		l2cap_chan_unlock(chan);  in l2cap_security_cfm()