60 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data);
61 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err);
63 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
184 int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)  in l2cap_add_psm()  argument
196 		chan->psm = psm;  in l2cap_add_psm()
197 		chan->sport = psm;  in l2cap_add_psm()
205 				chan->psm   = cpu_to_le16(p);  in l2cap_add_psm()
206 				chan->sport = cpu_to_le16(p);  in l2cap_add_psm()
218 int l2cap_add_scid(struct l2cap_chan *chan,  __u16 scid)  in l2cap_add_scid()  argument
223 	chan->omtu = L2CAP_DEFAULT_MTU;  in l2cap_add_scid()
224 	chan->chan_type = L2CAP_CHAN_FIXED;  in l2cap_add_scid()
226 	chan->scid = scid;  in l2cap_add_scid()
250 static void l2cap_state_change(struct l2cap_chan *chan, int state)  in l2cap_state_change()  argument
252 	BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),  in l2cap_state_change()
255 	chan->state = state;  in l2cap_state_change()
256 	chan->ops->state_change(chan, state, 0);  in l2cap_state_change()
259 static inline void l2cap_state_change_and_error(struct l2cap_chan *chan,  in l2cap_state_change_and_error()  argument
262 	chan->state = state;  in l2cap_state_change_and_error()
263 	chan->ops->state_change(chan, chan->state, err);  in l2cap_state_change_and_error()
266 static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)  in l2cap_chan_set_err()  argument
268 	chan->ops->state_change(chan, chan->state, err);  in l2cap_chan_set_err()
271 static void __set_retrans_timer(struct l2cap_chan *chan)  in __set_retrans_timer()  argument
273 	if (!delayed_work_pending(&chan->monitor_timer) &&  in __set_retrans_timer()
274 	    chan->retrans_timeout) {  in __set_retrans_timer()
275 		l2cap_set_timer(chan, &chan->retrans_timer,  in __set_retrans_timer()
276 				msecs_to_jiffies(chan->retrans_timeout));  in __set_retrans_timer()
280 static void __set_monitor_timer(struct l2cap_chan *chan)  in __set_monitor_timer()  argument
282 	__clear_retrans_timer(chan);  in __set_monitor_timer()
283 	if (chan->monitor_timeout) {  in __set_monitor_timer()
284 		l2cap_set_timer(chan, &chan->monitor_timer,  in __set_monitor_timer()
285 				msecs_to_jiffies(chan->monitor_timeout));  in __set_monitor_timer()
398 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,  in l2cap_chan_timeout()  local
400 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_timeout()
403 	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));  in l2cap_chan_timeout()
406 	l2cap_chan_lock(chan);  in l2cap_chan_timeout()
408 	if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)  in l2cap_chan_timeout()
410 	else if (chan->state == BT_CONNECT &&  in l2cap_chan_timeout()
411 		 chan->sec_level != BT_SECURITY_SDP)  in l2cap_chan_timeout()
416 	l2cap_chan_close(chan, reason);  in l2cap_chan_timeout()
418 	l2cap_chan_unlock(chan);  in l2cap_chan_timeout()
420 	chan->ops->close(chan);  in l2cap_chan_timeout()
423 	l2cap_chan_put(chan);  in l2cap_chan_timeout()
428 	struct l2cap_chan *chan;  in l2cap_chan_create()  local
430 	chan = kzalloc(sizeof(*chan), GFP_ATOMIC);  in l2cap_chan_create()
431 	if (!chan)  in l2cap_chan_create()
434 	mutex_init(&chan->lock);  in l2cap_chan_create()
437 	atomic_set(&chan->nesting, L2CAP_NESTING_NORMAL);  in l2cap_chan_create()
440 	list_add(&chan->global_l, &chan_list);  in l2cap_chan_create()
443 	INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);  in l2cap_chan_create()
445 	chan->state = BT_OPEN;  in l2cap_chan_create()
447 	kref_init(&chan->kref);  in l2cap_chan_create()
450 	set_bit(CONF_NOT_COMPLETE, &chan->conf_state);  in l2cap_chan_create()
452 	BT_DBG("chan %p", chan);  in l2cap_chan_create()
454 	return chan;  in l2cap_chan_create()
460 	struct l2cap_chan *chan = container_of(kref, struct l2cap_chan, kref);  in l2cap_chan_destroy()  local
462 	BT_DBG("chan %p", chan);  in l2cap_chan_destroy()
465 	list_del(&chan->global_l);  in l2cap_chan_destroy()
468 	kfree(chan);  in l2cap_chan_destroy()
486 void l2cap_chan_set_defaults(struct l2cap_chan *chan)  in l2cap_chan_set_defaults()  argument
488 	chan->fcs  = L2CAP_FCS_CRC16;  in l2cap_chan_set_defaults()
489 	chan->max_tx = L2CAP_DEFAULT_MAX_TX;  in l2cap_chan_set_defaults()
490 	chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;  in l2cap_chan_set_defaults()
491 	chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;  in l2cap_chan_set_defaults()
492 	chan->remote_max_tx = chan->max_tx;  in l2cap_chan_set_defaults()
493 	chan->remote_tx_win = chan->tx_win;  in l2cap_chan_set_defaults()
494 	chan->ack_win = L2CAP_DEFAULT_TX_WINDOW;  in l2cap_chan_set_defaults()
495 	chan->sec_level = BT_SECURITY_LOW;  in l2cap_chan_set_defaults()
496 	chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;  in l2cap_chan_set_defaults()
497 	chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;  in l2cap_chan_set_defaults()
498 	chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;  in l2cap_chan_set_defaults()
499 	chan->conf_state = 0;  in l2cap_chan_set_defaults()
501 	set_bit(FLAG_FORCE_ACTIVE, &chan->flags);  in l2cap_chan_set_defaults()
505 static void l2cap_le_flowctl_init(struct l2cap_chan *chan)  in l2cap_le_flowctl_init()  argument
507 	chan->sdu = NULL;  in l2cap_le_flowctl_init()
508 	chan->sdu_last_frag = NULL;  in l2cap_le_flowctl_init()
509 	chan->sdu_len = 0;  in l2cap_le_flowctl_init()
510 	chan->tx_credits = 0;  in l2cap_le_flowctl_init()
511 	chan->rx_credits = le_max_credits;  in l2cap_le_flowctl_init()
512 	chan->mps = min_t(u16, chan->imtu, le_default_mps);  in l2cap_le_flowctl_init()
514 	skb_queue_head_init(&chan->tx_q);  in l2cap_le_flowctl_init()
517 void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)  in __l2cap_chan_add()  argument
520 	       __le16_to_cpu(chan->psm), chan->dcid);  in __l2cap_chan_add()
524 	chan->conn = conn;  in __l2cap_chan_add()
526 	switch (chan->chan_type) {  in __l2cap_chan_add()
529 		chan->scid = l2cap_alloc_cid(conn);  in __l2cap_chan_add()
531 			chan->omtu = L2CAP_DEFAULT_MTU;  in __l2cap_chan_add()
536 		chan->scid = L2CAP_CID_CONN_LESS;  in __l2cap_chan_add()
537 		chan->dcid = L2CAP_CID_CONN_LESS;  in __l2cap_chan_add()
538 		chan->omtu = L2CAP_DEFAULT_MTU;  in __l2cap_chan_add()
547 		chan->scid = L2CAP_CID_SIGNALING;  in __l2cap_chan_add()
548 		chan->dcid = L2CAP_CID_SIGNALING;  in __l2cap_chan_add()
549 		chan->omtu = L2CAP_DEFAULT_MTU;  in __l2cap_chan_add()
552 	chan->local_id		= L2CAP_BESTEFFORT_ID;  in __l2cap_chan_add()
553 	chan->local_stype	= L2CAP_SERV_BESTEFFORT;  in __l2cap_chan_add()
554 	chan->local_msdu	= L2CAP_DEFAULT_MAX_SDU_SIZE;  in __l2cap_chan_add()
555 	chan->local_sdu_itime	= L2CAP_DEFAULT_SDU_ITIME;  in __l2cap_chan_add()
556 	chan->local_acc_lat	= L2CAP_DEFAULT_ACC_LAT;  in __l2cap_chan_add()
557 	chan->local_flush_to	= L2CAP_EFS_DEFAULT_FLUSH_TO;  in __l2cap_chan_add()
559 	l2cap_chan_hold(chan);  in __l2cap_chan_add()
562 	if (chan->chan_type != L2CAP_CHAN_FIXED ||  in __l2cap_chan_add()
563 	    test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))  in __l2cap_chan_add()
566 	list_add(&chan->list, &conn->chan_l);  in __l2cap_chan_add()
569 void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)  in l2cap_chan_add()  argument
572 	__l2cap_chan_add(conn, chan);  in l2cap_chan_add()
576 void l2cap_chan_del(struct l2cap_chan *chan, int err)  in l2cap_chan_del()  argument
578 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_del()
580 	__clear_chan_timer(chan);  in l2cap_chan_del()
582 	BT_DBG("chan %p, conn %p, err %d, state %s", chan, conn, err,  in l2cap_chan_del()
583 	       state_to_string(chan->state));  in l2cap_chan_del()
585 	chan->ops->teardown(chan, err);  in l2cap_chan_del()
590 		list_del(&chan->list);  in l2cap_chan_del()
592 		l2cap_chan_put(chan);  in l2cap_chan_del()
594 		chan->conn = NULL;  in l2cap_chan_del()
600 		if (chan->chan_type != L2CAP_CHAN_FIXED ||  in l2cap_chan_del()
601 		    test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))  in l2cap_chan_del()
604 		if (mgr && mgr->bredr_chan == chan)  in l2cap_chan_del()
608 	if (chan->hs_hchan) {  in l2cap_chan_del()
609 		struct hci_chan *hs_hchan = chan->hs_hchan;  in l2cap_chan_del()
611 		BT_DBG("chan %p disconnect hs_hchan %p", chan, hs_hchan);  in l2cap_chan_del()
615 	if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))  in l2cap_chan_del()
618 	switch(chan->mode) {  in l2cap_chan_del()
623 		skb_queue_purge(&chan->tx_q);  in l2cap_chan_del()
627 		__clear_retrans_timer(chan);  in l2cap_chan_del()
628 		__clear_monitor_timer(chan);  in l2cap_chan_del()
629 		__clear_ack_timer(chan);  in l2cap_chan_del()
631 		skb_queue_purge(&chan->srej_q);  in l2cap_chan_del()
633 		l2cap_seq_list_free(&chan->srej_list);  in l2cap_chan_del()
634 		l2cap_seq_list_free(&chan->retrans_list);  in l2cap_chan_del()
639 		skb_queue_purge(&chan->tx_q);  in l2cap_chan_del()
652 	struct l2cap_chan *chan;  in l2cap_conn_update_id_addr()  local
656 	list_for_each_entry(chan, &conn->chan_l, list) {  in l2cap_conn_update_id_addr()
657 		l2cap_chan_lock(chan);  in l2cap_conn_update_id_addr()
658 		bacpy(&chan->dst, &hcon->dst);  in l2cap_conn_update_id_addr()
659 		chan->dst_type = bdaddr_dst_type(hcon);  in l2cap_conn_update_id_addr()
660 		l2cap_chan_unlock(chan);  in l2cap_conn_update_id_addr()
666 static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan)  in l2cap_chan_le_connect_reject()  argument
668 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_le_connect_reject()
672 	if (test_bit(FLAG_DEFER_SETUP, &chan->flags))  in l2cap_chan_le_connect_reject()
677 	l2cap_state_change(chan, BT_DISCONN);  in l2cap_chan_le_connect_reject()
679 	rsp.dcid    = cpu_to_le16(chan->scid);  in l2cap_chan_le_connect_reject()
680 	rsp.mtu     = cpu_to_le16(chan->imtu);  in l2cap_chan_le_connect_reject()
681 	rsp.mps     = cpu_to_le16(chan->mps);  in l2cap_chan_le_connect_reject()
682 	rsp.credits = cpu_to_le16(chan->rx_credits);  in l2cap_chan_le_connect_reject()
685 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),  in l2cap_chan_le_connect_reject()
689 static void l2cap_chan_connect_reject(struct l2cap_chan *chan)  in l2cap_chan_connect_reject()  argument
691 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_connect_reject()
695 	if (test_bit(FLAG_DEFER_SETUP, &chan->flags))  in l2cap_chan_connect_reject()
700 	l2cap_state_change(chan, BT_DISCONN);  in l2cap_chan_connect_reject()
702 	rsp.scid   = cpu_to_le16(chan->dcid);  in l2cap_chan_connect_reject()
703 	rsp.dcid   = cpu_to_le16(chan->scid);  in l2cap_chan_connect_reject()
707 	l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);  in l2cap_chan_connect_reject()
710 void l2cap_chan_close(struct l2cap_chan *chan, int reason)  in l2cap_chan_close()  argument
712 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_close()
714 	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));  in l2cap_chan_close()
716 	switch (chan->state) {  in l2cap_chan_close()
718 		chan->ops->teardown(chan, 0);  in l2cap_chan_close()
723 		if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {  in l2cap_chan_close()
724 			__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));  in l2cap_chan_close()
725 			l2cap_send_disconn_req(chan, reason);  in l2cap_chan_close()
727 			l2cap_chan_del(chan, reason);  in l2cap_chan_close()
731 		if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {  in l2cap_chan_close()
733 				l2cap_chan_connect_reject(chan);  in l2cap_chan_close()
735 				l2cap_chan_le_connect_reject(chan);  in l2cap_chan_close()
738 		l2cap_chan_del(chan, reason);  in l2cap_chan_close()
743 		l2cap_chan_del(chan, reason);  in l2cap_chan_close()
747 		chan->ops->teardown(chan, 0);  in l2cap_chan_close()
753 static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)  in l2cap_get_auth_type()  argument
755 	switch (chan->chan_type) {  in l2cap_get_auth_type()
757 		switch (chan->sec_level) {  in l2cap_get_auth_type()
768 		if (chan->psm == cpu_to_le16(L2CAP_PSM_3DSP)) {  in l2cap_get_auth_type()
769 			if (chan->sec_level == BT_SECURITY_LOW)  in l2cap_get_auth_type()
770 				chan->sec_level = BT_SECURITY_SDP;  in l2cap_get_auth_type()
772 		if (chan->sec_level == BT_SECURITY_HIGH ||  in l2cap_get_auth_type()
773 		    chan->sec_level == BT_SECURITY_FIPS)  in l2cap_get_auth_type()
779 		if (chan->psm == cpu_to_le16(L2CAP_PSM_SDP)) {  in l2cap_get_auth_type()
780 			if (chan->sec_level == BT_SECURITY_LOW)  in l2cap_get_auth_type()
781 				chan->sec_level = BT_SECURITY_SDP;  in l2cap_get_auth_type()
783 			if (chan->sec_level == BT_SECURITY_HIGH ||  in l2cap_get_auth_type()
784 			    chan->sec_level == BT_SECURITY_FIPS)  in l2cap_get_auth_type()
791 		switch (chan->sec_level) {  in l2cap_get_auth_type()
805 int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator)  in l2cap_chan_check_security()  argument
807 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_check_security()
811 		return smp_conn_security(conn->hcon, chan->sec_level);  in l2cap_chan_check_security()
813 	auth_type = l2cap_get_auth_type(chan);  in l2cap_chan_check_security()
815 	return hci_conn_security(conn->hcon, chan->sec_level, auth_type,  in l2cap_chan_check_security()
866 static bool __chan_is_moving(struct l2cap_chan *chan)  in __chan_is_moving()  argument
868 	return chan->move_state != L2CAP_MOVE_STABLE &&  in __chan_is_moving()
869 	       chan->move_state != L2CAP_MOVE_WAIT_PREPARE;  in __chan_is_moving()
872 static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)  in l2cap_do_send()  argument
874 	struct hci_conn *hcon = chan->conn->hcon;  in l2cap_do_send()
877 	BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,  in l2cap_do_send()
880 	if (chan->hs_hcon && !__chan_is_moving(chan)) {  in l2cap_do_send()
881 		if (chan->hs_hchan)  in l2cap_do_send()
882 			hci_send_acl(chan->hs_hchan, skb, ACL_COMPLETE);  in l2cap_do_send()
894 	    (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&  in l2cap_do_send()
900 	bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);  in l2cap_do_send()
901 	hci_send_acl(chan->conn->hchan, skb, flags);  in l2cap_do_send()
952 static inline void __unpack_control(struct l2cap_chan *chan,  in __unpack_control()  argument
955 	if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {  in __unpack_control()
1004 static inline void __pack_control(struct l2cap_chan *chan,  in __pack_control()  argument
1008 	if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {  in __pack_control()
1017 static inline unsigned int __ertm_hdr_size(struct l2cap_chan *chan)  in __ertm_hdr_size()  argument
1019 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in __ertm_hdr_size()
1025 static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan,  in l2cap_create_sframe_pdu()  argument
1030 	int hlen = __ertm_hdr_size(chan);  in l2cap_create_sframe_pdu()
1032 	if (chan->fcs == L2CAP_FCS_CRC16)  in l2cap_create_sframe_pdu()
1042 	lh->cid = cpu_to_le16(chan->dcid);  in l2cap_create_sframe_pdu()
1044 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_create_sframe_pdu()
1049 	if (chan->fcs == L2CAP_FCS_CRC16) {  in l2cap_create_sframe_pdu()
1058 static void l2cap_send_sframe(struct l2cap_chan *chan,  in l2cap_send_sframe()  argument
1064 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_send_sframe()
1069 	if (__chan_is_moving(chan))  in l2cap_send_sframe()
1072 	if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) &&  in l2cap_send_sframe()
1077 		clear_bit(CONN_RNR_SENT, &chan->conn_state);  in l2cap_send_sframe()
1079 		set_bit(CONN_RNR_SENT, &chan->conn_state);  in l2cap_send_sframe()
1082 		chan->last_acked_seq = control->reqseq;  in l2cap_send_sframe()
1083 		__clear_ack_timer(chan);  in l2cap_send_sframe()
1089 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_send_sframe()
1094 	skb = l2cap_create_sframe_pdu(chan, control_field);  in l2cap_send_sframe()
1096 		l2cap_do_send(chan, skb);  in l2cap_send_sframe()
1099 static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll)  in l2cap_send_rr_or_rnr()  argument
1103 	BT_DBG("chan %p, poll %d", chan, poll);  in l2cap_send_rr_or_rnr()
1109 	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state))  in l2cap_send_rr_or_rnr()
1114 	control.reqseq = chan->buffer_seq;  in l2cap_send_rr_or_rnr()
1115 	l2cap_send_sframe(chan, &control);  in l2cap_send_rr_or_rnr()
1118 static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)  in __l2cap_no_conn_pending()  argument
1120 	if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)  in __l2cap_no_conn_pending()
1123 	return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);  in __l2cap_no_conn_pending()
1126 static bool __amp_capable(struct l2cap_chan *chan)  in __amp_capable()  argument
1128 	struct l2cap_conn *conn = chan->conn;  in __amp_capable()
1148 	if (chan->chan_policy == BT_CHANNEL_POLICY_AMP_PREFERRED)  in __amp_capable()
1154 static bool l2cap_check_efs(struct l2cap_chan *chan)  in l2cap_check_efs()  argument
1160 void l2cap_send_conn_req(struct l2cap_chan *chan)  in l2cap_send_conn_req()  argument
1162 	struct l2cap_conn *conn = chan->conn;  in l2cap_send_conn_req()
1165 	req.scid = cpu_to_le16(chan->scid);  in l2cap_send_conn_req()
1166 	req.psm  = chan->psm;  in l2cap_send_conn_req()
1168 	chan->ident = l2cap_get_ident(conn);  in l2cap_send_conn_req()
1170 	set_bit(CONF_CONNECT_PEND, &chan->conf_state);  in l2cap_send_conn_req()
1172 	l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);  in l2cap_send_conn_req()
1175 static void l2cap_send_create_chan_req(struct l2cap_chan *chan, u8 amp_id)  in l2cap_send_create_chan_req()  argument
1178 	req.scid = cpu_to_le16(chan->scid);  in l2cap_send_create_chan_req()
1179 	req.psm  = chan->psm;  in l2cap_send_create_chan_req()
1182 	chan->ident = l2cap_get_ident(chan->conn);  in l2cap_send_create_chan_req()
1184 	l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_REQ,  in l2cap_send_create_chan_req()
1188 static void l2cap_move_setup(struct l2cap_chan *chan)  in l2cap_move_setup()  argument
1192 	BT_DBG("chan %p", chan);  in l2cap_move_setup()
1194 	if (chan->mode != L2CAP_MODE_ERTM)  in l2cap_move_setup()
1197 	__clear_retrans_timer(chan);  in l2cap_move_setup()
1198 	__clear_monitor_timer(chan);  in l2cap_move_setup()
1199 	__clear_ack_timer(chan);  in l2cap_move_setup()
1201 	chan->retry_count = 0;  in l2cap_move_setup()
1202 	skb_queue_walk(&chan->tx_q, skb) {  in l2cap_move_setup()
1209 	chan->expected_tx_seq = chan->buffer_seq;  in l2cap_move_setup()
1211 	clear_bit(CONN_REJ_ACT, &chan->conn_state);  in l2cap_move_setup()
1212 	clear_bit(CONN_SREJ_ACT, &chan->conn_state);  in l2cap_move_setup()
1213 	l2cap_seq_list_clear(&chan->retrans_list);  in l2cap_move_setup()
1214 	l2cap_seq_list_clear(&chan->srej_list);  in l2cap_move_setup()
1215 	skb_queue_purge(&chan->srej_q);  in l2cap_move_setup()
1217 	chan->tx_state = L2CAP_TX_STATE_XMIT;  in l2cap_move_setup()
1218 	chan->rx_state = L2CAP_RX_STATE_MOVE;  in l2cap_move_setup()
1220 	set_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_move_setup()
1223 static void l2cap_move_done(struct l2cap_chan *chan)  in l2cap_move_done()  argument
1225 	u8 move_role = chan->move_role;  in l2cap_move_done()
1226 	BT_DBG("chan %p", chan);  in l2cap_move_done()
1228 	chan->move_state = L2CAP_MOVE_STABLE;  in l2cap_move_done()
1229 	chan->move_role = L2CAP_MOVE_ROLE_NONE;  in l2cap_move_done()
1231 	if (chan->mode != L2CAP_MODE_ERTM)  in l2cap_move_done()
1236 		l2cap_tx(chan, NULL, NULL, L2CAP_EV_EXPLICIT_POLL);  in l2cap_move_done()
1237 		chan->rx_state = L2CAP_RX_STATE_WAIT_F;  in l2cap_move_done()
1240 		chan->rx_state = L2CAP_RX_STATE_WAIT_P;  in l2cap_move_done()
1245 static void l2cap_chan_ready(struct l2cap_chan *chan)  in l2cap_chan_ready()  argument
1251 	if (chan->state == BT_CONNECTED)  in l2cap_chan_ready()
1255 	chan->conf_state = 0;  in l2cap_chan_ready()
1256 	__clear_chan_timer(chan);  in l2cap_chan_ready()
1258 	if (chan->mode == L2CAP_MODE_LE_FLOWCTL && !chan->tx_credits)  in l2cap_chan_ready()
1259 		chan->ops->suspend(chan);  in l2cap_chan_ready()
1261 	chan->state = BT_CONNECTED;  in l2cap_chan_ready()
1263 	chan->ops->ready(chan);  in l2cap_chan_ready()
1266 static void l2cap_le_connect(struct l2cap_chan *chan)  in l2cap_le_connect()  argument
1268 	struct l2cap_conn *conn = chan->conn;  in l2cap_le_connect()
1271 	if (test_and_set_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags))  in l2cap_le_connect()
1274 	req.psm     = chan->psm;  in l2cap_le_connect()
1275 	req.scid    = cpu_to_le16(chan->scid);  in l2cap_le_connect()
1276 	req.mtu     = cpu_to_le16(chan->imtu);  in l2cap_le_connect()
1277 	req.mps     = cpu_to_le16(chan->mps);  in l2cap_le_connect()
1278 	req.credits = cpu_to_le16(chan->rx_credits);  in l2cap_le_connect()
1280 	chan->ident = l2cap_get_ident(conn);  in l2cap_le_connect()
1282 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_REQ,  in l2cap_le_connect()
1286 static void l2cap_le_start(struct l2cap_chan *chan)  in l2cap_le_start()  argument
1288 	struct l2cap_conn *conn = chan->conn;  in l2cap_le_start()
1290 	if (!smp_conn_security(conn->hcon, chan->sec_level))  in l2cap_le_start()
1293 	if (!chan->psm) {  in l2cap_le_start()
1294 		l2cap_chan_ready(chan);  in l2cap_le_start()
1298 	if (chan->state == BT_CONNECT)  in l2cap_le_start()
1299 		l2cap_le_connect(chan);  in l2cap_le_start()
1302 static void l2cap_start_connection(struct l2cap_chan *chan)  in l2cap_start_connection()  argument
1304 	if (__amp_capable(chan)) {  in l2cap_start_connection()
1305 		BT_DBG("chan %p AMP capable: discover AMPs", chan);  in l2cap_start_connection()
1306 		a2mp_discover_amp(chan);  in l2cap_start_connection()
1307 	} else if (chan->conn->hcon->type == LE_LINK) {  in l2cap_start_connection()
1308 		l2cap_le_start(chan);  in l2cap_start_connection()
1310 		l2cap_send_conn_req(chan);  in l2cap_start_connection()
1332 static void l2cap_do_start(struct l2cap_chan *chan)  in l2cap_do_start()  argument
1334 	struct l2cap_conn *conn = chan->conn;  in l2cap_do_start()
1337 		l2cap_le_start(chan);  in l2cap_do_start()
1349 	if (l2cap_chan_check_security(chan, true) &&  in l2cap_do_start()
1350 	    __l2cap_no_conn_pending(chan))  in l2cap_do_start()
1351 		l2cap_start_connection(chan);  in l2cap_do_start()
1370 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err)  in l2cap_send_disconn_req()  argument
1372 	struct l2cap_conn *conn = chan->conn;  in l2cap_send_disconn_req()
1378 	if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) {  in l2cap_send_disconn_req()
1379 		__clear_retrans_timer(chan);  in l2cap_send_disconn_req()
1380 		__clear_monitor_timer(chan);  in l2cap_send_disconn_req()
1381 		__clear_ack_timer(chan);  in l2cap_send_disconn_req()
1384 	if (chan->scid == L2CAP_CID_A2MP) {  in l2cap_send_disconn_req()
1385 		l2cap_state_change(chan, BT_DISCONN);  in l2cap_send_disconn_req()
1389 	req.dcid = cpu_to_le16(chan->dcid);  in l2cap_send_disconn_req()
1390 	req.scid = cpu_to_le16(chan->scid);  in l2cap_send_disconn_req()
1394 	l2cap_state_change_and_error(chan, BT_DISCONN, err);  in l2cap_send_disconn_req()
1400 	struct l2cap_chan *chan, *tmp;  in l2cap_conn_start()  local
1406 	list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {  in l2cap_conn_start()
1407 		l2cap_chan_lock(chan);  in l2cap_conn_start()
1409 		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {  in l2cap_conn_start()
1410 			l2cap_chan_ready(chan);  in l2cap_conn_start()
1411 			l2cap_chan_unlock(chan);  in l2cap_conn_start()
1415 		if (chan->state == BT_CONNECT) {  in l2cap_conn_start()
1416 			if (!l2cap_chan_check_security(chan, true) ||  in l2cap_conn_start()
1417 			    !__l2cap_no_conn_pending(chan)) {  in l2cap_conn_start()
1418 				l2cap_chan_unlock(chan);  in l2cap_conn_start()
1422 			if (!l2cap_mode_supported(chan->mode, conn->feat_mask)  in l2cap_conn_start()
1424 					&chan->conf_state)) {  in l2cap_conn_start()
1425 				l2cap_chan_close(chan, ECONNRESET);  in l2cap_conn_start()
1426 				l2cap_chan_unlock(chan);  in l2cap_conn_start()
1430 			l2cap_start_connection(chan);  in l2cap_conn_start()
1432 		} else if (chan->state == BT_CONNECT2) {  in l2cap_conn_start()
1435 			rsp.scid = cpu_to_le16(chan->dcid);  in l2cap_conn_start()
1436 			rsp.dcid = cpu_to_le16(chan->scid);  in l2cap_conn_start()
1438 			if (l2cap_chan_check_security(chan, false)) {  in l2cap_conn_start()
1439 				if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {  in l2cap_conn_start()
1442 					chan->ops->defer(chan);  in l2cap_conn_start()
1445 					l2cap_state_change(chan, BT_CONFIG);  in l2cap_conn_start()
1454 			l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,  in l2cap_conn_start()
1457 			if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||  in l2cap_conn_start()
1459 				l2cap_chan_unlock(chan);  in l2cap_conn_start()
1463 			set_bit(CONF_REQ_SENT, &chan->conf_state);  in l2cap_conn_start()
1465 				       l2cap_build_conf_req(chan, buf), buf);  in l2cap_conn_start()
1466 			chan->num_conf_req++;  in l2cap_conn_start()
1469 		l2cap_chan_unlock(chan);  in l2cap_conn_start()
1510 	struct l2cap_chan *chan;  in l2cap_conn_ready()  local
1520 	list_for_each_entry(chan, &conn->chan_l, list) {  in l2cap_conn_ready()
1522 		l2cap_chan_lock(chan);  in l2cap_conn_ready()
1524 		if (chan->scid == L2CAP_CID_A2MP) {  in l2cap_conn_ready()
1525 			l2cap_chan_unlock(chan);  in l2cap_conn_ready()
1530 			l2cap_le_start(chan);  in l2cap_conn_ready()
1531 		} else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {  in l2cap_conn_ready()
1533 				l2cap_chan_ready(chan);  in l2cap_conn_ready()
1534 		} else if (chan->state == BT_CONNECT) {  in l2cap_conn_ready()
1535 			l2cap_do_start(chan);  in l2cap_conn_ready()
1538 		l2cap_chan_unlock(chan);  in l2cap_conn_ready()
1552 	struct l2cap_chan *chan;  in l2cap_conn_unreliable()  local
1558 	list_for_each_entry(chan, &conn->chan_l, list) {  in l2cap_conn_unreliable()
1559 		if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))  in l2cap_conn_unreliable()
1560 			l2cap_chan_set_err(chan, err);  in l2cap_conn_unreliable()
1659 	struct l2cap_chan *chan, *l;  in l2cap_conn_del()  local
1688 	list_for_each_entry_safe(chan, l, &conn->chan_l, list) {  in l2cap_conn_del()
1689 		l2cap_chan_hold(chan);  in l2cap_conn_del()
1690 		l2cap_chan_lock(chan);  in l2cap_conn_del()
1692 		l2cap_chan_del(chan, err);  in l2cap_conn_del()
1694 		l2cap_chan_unlock(chan);  in l2cap_conn_del()
1696 		chan->ops->close(chan);  in l2cap_conn_del()
1697 		l2cap_chan_put(chan);  in l2cap_conn_del()
1789 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,  in l2cap_monitor_timeout()  local
1792 	BT_DBG("chan %p", chan);  in l2cap_monitor_timeout()
1794 	l2cap_chan_lock(chan);  in l2cap_monitor_timeout()
1796 	if (!chan->conn) {  in l2cap_monitor_timeout()
1797 		l2cap_chan_unlock(chan);  in l2cap_monitor_timeout()
1798 		l2cap_chan_put(chan);  in l2cap_monitor_timeout()
1802 	l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO);  in l2cap_monitor_timeout()
1804 	l2cap_chan_unlock(chan);  in l2cap_monitor_timeout()
1805 	l2cap_chan_put(chan);  in l2cap_monitor_timeout()
1810 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,  in l2cap_retrans_timeout()  local
1813 	BT_DBG("chan %p", chan);  in l2cap_retrans_timeout()
1815 	l2cap_chan_lock(chan);  in l2cap_retrans_timeout()
1817 	if (!chan->conn) {  in l2cap_retrans_timeout()
1818 		l2cap_chan_unlock(chan);  in l2cap_retrans_timeout()
1819 		l2cap_chan_put(chan);  in l2cap_retrans_timeout()
1823 	l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO);  in l2cap_retrans_timeout()
1824 	l2cap_chan_unlock(chan);  in l2cap_retrans_timeout()
1825 	l2cap_chan_put(chan);  in l2cap_retrans_timeout()
1828 static void l2cap_streaming_send(struct l2cap_chan *chan,  in l2cap_streaming_send()  argument
1834 	BT_DBG("chan %p, skbs %p", chan, skbs);  in l2cap_streaming_send()
1836 	if (__chan_is_moving(chan))  in l2cap_streaming_send()
1839 	skb_queue_splice_tail_init(skbs, &chan->tx_q);  in l2cap_streaming_send()
1841 	while (!skb_queue_empty(&chan->tx_q)) {  in l2cap_streaming_send()
1843 		skb = skb_dequeue(&chan->tx_q);  in l2cap_streaming_send()
1849 		control->txseq = chan->next_tx_seq;  in l2cap_streaming_send()
1851 		__pack_control(chan, control, skb);  in l2cap_streaming_send()
1853 		if (chan->fcs == L2CAP_FCS_CRC16) {  in l2cap_streaming_send()
1858 		l2cap_do_send(chan, skb);  in l2cap_streaming_send()
1862 		chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);  in l2cap_streaming_send()
1863 		chan->frames_sent++;  in l2cap_streaming_send()
1867 static int l2cap_ertm_send(struct l2cap_chan *chan)  in l2cap_ertm_send()  argument
1873 	BT_DBG("chan %p", chan);  in l2cap_ertm_send()
1875 	if (chan->state != BT_CONNECTED)  in l2cap_ertm_send()
1878 	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))  in l2cap_ertm_send()
1881 	if (__chan_is_moving(chan))  in l2cap_ertm_send()
1884 	while (chan->tx_send_head &&  in l2cap_ertm_send()
1885 	       chan->unacked_frames < chan->remote_tx_win &&  in l2cap_ertm_send()
1886 	       chan->tx_state == L2CAP_TX_STATE_XMIT) {  in l2cap_ertm_send()
1888 		skb = chan->tx_send_head;  in l2cap_ertm_send()
1893 		if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))  in l2cap_ertm_send()
1896 		control->reqseq = chan->buffer_seq;  in l2cap_ertm_send()
1897 		chan->last_acked_seq = chan->buffer_seq;  in l2cap_ertm_send()
1898 		control->txseq = chan->next_tx_seq;  in l2cap_ertm_send()
1900 		__pack_control(chan, control, skb);  in l2cap_ertm_send()
1902 		if (chan->fcs == L2CAP_FCS_CRC16) {  in l2cap_ertm_send()
1915 		__set_retrans_timer(chan);  in l2cap_ertm_send()
1917 		chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);  in l2cap_ertm_send()
1918 		chan->unacked_frames++;  in l2cap_ertm_send()
1919 		chan->frames_sent++;  in l2cap_ertm_send()
1922 		if (skb_queue_is_last(&chan->tx_q, skb))  in l2cap_ertm_send()
1923 			chan->tx_send_head = NULL;  in l2cap_ertm_send()
1925 			chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);  in l2cap_ertm_send()
1927 		l2cap_do_send(chan, tx_skb);  in l2cap_ertm_send()
1932 	       chan->unacked_frames, skb_queue_len(&chan->tx_q));  in l2cap_ertm_send()
1937 static void l2cap_ertm_resend(struct l2cap_chan *chan)  in l2cap_ertm_resend()  argument
1944 	BT_DBG("chan %p", chan);  in l2cap_ertm_resend()
1946 	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))  in l2cap_ertm_resend()
1949 	if (__chan_is_moving(chan))  in l2cap_ertm_resend()
1952 	while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) {  in l2cap_ertm_resend()
1953 		seq = l2cap_seq_list_pop(&chan->retrans_list);  in l2cap_ertm_resend()
1955 		skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq);  in l2cap_ertm_resend()
1965 		if (chan->max_tx != 0 &&  in l2cap_ertm_resend()
1966 		    bt_cb(skb)->l2cap.retries > chan->max_tx) {  in l2cap_ertm_resend()
1967 			BT_DBG("Retry limit exceeded (%d)", chan->max_tx);  in l2cap_ertm_resend()
1968 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_ertm_resend()
1969 			l2cap_seq_list_clear(&chan->retrans_list);  in l2cap_ertm_resend()
1973 		control.reqseq = chan->buffer_seq;  in l2cap_ertm_resend()
1974 		if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))  in l2cap_ertm_resend()
1989 			l2cap_seq_list_clear(&chan->retrans_list);  in l2cap_ertm_resend()
1994 		if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {  in l2cap_ertm_resend()
2003 		if (chan->fcs == L2CAP_FCS_CRC16) {  in l2cap_ertm_resend()
2010 		l2cap_do_send(chan, tx_skb);  in l2cap_ertm_resend()
2014 		chan->last_acked_seq = chan->buffer_seq;  in l2cap_ertm_resend()
2018 static void l2cap_retransmit(struct l2cap_chan *chan,  in l2cap_retransmit()  argument
2021 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_retransmit()
2023 	l2cap_seq_list_append(&chan->retrans_list, control->reqseq);  in l2cap_retransmit()
2024 	l2cap_ertm_resend(chan);  in l2cap_retransmit()
2027 static void l2cap_retransmit_all(struct l2cap_chan *chan,  in l2cap_retransmit_all()  argument
2032 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_retransmit_all()
2035 		set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_retransmit_all()
2037 	l2cap_seq_list_clear(&chan->retrans_list);  in l2cap_retransmit_all()
2039 	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))  in l2cap_retransmit_all()
2042 	if (chan->unacked_frames) {  in l2cap_retransmit_all()
2043 		skb_queue_walk(&chan->tx_q, skb) {  in l2cap_retransmit_all()
2045 			    skb == chan->tx_send_head)  in l2cap_retransmit_all()
2049 		skb_queue_walk_from(&chan->tx_q, skb) {  in l2cap_retransmit_all()
2050 			if (skb == chan->tx_send_head)  in l2cap_retransmit_all()
2053 			l2cap_seq_list_append(&chan->retrans_list,  in l2cap_retransmit_all()
2057 		l2cap_ertm_resend(chan);  in l2cap_retransmit_all()
2061 static void l2cap_send_ack(struct l2cap_chan *chan)  in l2cap_send_ack()  argument
2064 	u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq,  in l2cap_send_ack()
2065 					 chan->last_acked_seq);  in l2cap_send_ack()
2069 	       chan, chan->last_acked_seq, chan->buffer_seq);  in l2cap_send_ack()
2074 	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&  in l2cap_send_ack()
2075 	    chan->rx_state == L2CAP_RX_STATE_RECV) {  in l2cap_send_ack()
2076 		__clear_ack_timer(chan);  in l2cap_send_ack()
2078 		control.reqseq = chan->buffer_seq;  in l2cap_send_ack()
2079 		l2cap_send_sframe(chan, &control);  in l2cap_send_ack()
2081 		if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) {  in l2cap_send_ack()
2082 			l2cap_ertm_send(chan);  in l2cap_send_ack()
2084 			if (chan->buffer_seq == chan->last_acked_seq)  in l2cap_send_ack()
2091 		threshold = chan->ack_win;  in l2cap_send_ack()
2099 			__clear_ack_timer(chan);  in l2cap_send_ack()
2101 			control.reqseq = chan->buffer_seq;  in l2cap_send_ack()
2102 			l2cap_send_sframe(chan, &control);  in l2cap_send_ack()
2107 			__set_ack_timer(chan);  in l2cap_send_ack()
2111 static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,  in l2cap_skbuff_fromiovec()  argument
2115 	struct l2cap_conn *conn = chan->conn;  in l2cap_skbuff_fromiovec()
2132 		tmp = chan->ops->alloc_skb(chan, 0, count,  in l2cap_skbuff_fromiovec()
2155 static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,  in l2cap_create_connless_pdu()  argument
2158 	struct l2cap_conn *conn = chan->conn;  in l2cap_create_connless_pdu()
2163 	BT_DBG("chan %p psm 0x%2.2x len %zu", chan,  in l2cap_create_connless_pdu()
2164 	       __le16_to_cpu(chan->psm), len);  in l2cap_create_connless_pdu()
2168 	skb = chan->ops->alloc_skb(chan, hlen, count,  in l2cap_create_connless_pdu()
2175 	lh->cid = cpu_to_le16(chan->dcid);  in l2cap_create_connless_pdu()
2177 	put_unaligned(chan->psm, (__le16 *) skb_put(skb, L2CAP_PSMLEN_SIZE));  in l2cap_create_connless_pdu()
2179 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);  in l2cap_create_connless_pdu()
2187 static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,  in l2cap_create_basic_pdu()  argument
2190 	struct l2cap_conn *conn = chan->conn;  in l2cap_create_basic_pdu()
2195 	BT_DBG("chan %p len %zu", chan, len);  in l2cap_create_basic_pdu()
2199 	skb = chan->ops->alloc_skb(chan, L2CAP_HDR_SIZE, count,  in l2cap_create_basic_pdu()
2206 	lh->cid = cpu_to_le16(chan->dcid);  in l2cap_create_basic_pdu()
2209 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);  in l2cap_create_basic_pdu()
2217 static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,  in l2cap_create_iframe_pdu()  argument
2221 	struct l2cap_conn *conn = chan->conn;  in l2cap_create_iframe_pdu()
2226 	BT_DBG("chan %p len %zu", chan, len);  in l2cap_create_iframe_pdu()
2231 	hlen = __ertm_hdr_size(chan);  in l2cap_create_iframe_pdu()
2236 	if (chan->fcs == L2CAP_FCS_CRC16)  in l2cap_create_iframe_pdu()
2241 	skb = chan->ops->alloc_skb(chan, hlen, count,  in l2cap_create_iframe_pdu()
2248 	lh->cid = cpu_to_le16(chan->dcid);  in l2cap_create_iframe_pdu()
2252 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_create_iframe_pdu()
2260 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);  in l2cap_create_iframe_pdu()
2266 	bt_cb(skb)->l2cap.fcs = chan->fcs;  in l2cap_create_iframe_pdu()
2271 static int l2cap_segment_sdu(struct l2cap_chan *chan,  in l2cap_segment_sdu()  argument
2280 	BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);  in l2cap_segment_sdu()
2288 	pdu_len = chan->conn->mtu;  in l2cap_segment_sdu()
2291 	if (!chan->hs_hcon)  in l2cap_segment_sdu()
2295 	if (chan->fcs)  in l2cap_segment_sdu()
2298 	pdu_len -= __ertm_hdr_size(chan);  in l2cap_segment_sdu()
2301 	pdu_len = min_t(size_t, pdu_len, chan->remote_mps);  in l2cap_segment_sdu()
2313 		skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len);  in l2cap_segment_sdu()
2338 static struct sk_buff *l2cap_create_le_flowctl_pdu(struct l2cap_chan *chan,  in l2cap_create_le_flowctl_pdu()  argument
2342 	struct l2cap_conn *conn = chan->conn;  in l2cap_create_le_flowctl_pdu()
2347 	BT_DBG("chan %p len %zu", chan, len);  in l2cap_create_le_flowctl_pdu()
2359 	skb = chan->ops->alloc_skb(chan, hlen, count,  in l2cap_create_le_flowctl_pdu()
2366 	lh->cid = cpu_to_le16(chan->dcid);  in l2cap_create_le_flowctl_pdu()
2372 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);  in l2cap_create_le_flowctl_pdu()
2381 static int l2cap_segment_le_sdu(struct l2cap_chan *chan,  in l2cap_segment_le_sdu()  argument
2389 	BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);  in l2cap_segment_le_sdu()
2392 	pdu_len = chan->remote_mps - L2CAP_SDULEN_SIZE;  in l2cap_segment_le_sdu()
2398 		skb = l2cap_create_le_flowctl_pdu(chan, msg, pdu_len, sdu_len);  in l2cap_segment_le_sdu()
2417 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)  in l2cap_chan_send()  argument
2423 	if (!chan->conn)  in l2cap_chan_send()
2427 	if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {  in l2cap_chan_send()
2428 		skb = l2cap_create_connless_pdu(chan, msg, len);  in l2cap_chan_send()
2435 		if (chan->state != BT_CONNECTED) {  in l2cap_chan_send()
2440 		l2cap_do_send(chan, skb);  in l2cap_chan_send()
2444 	switch (chan->mode) {  in l2cap_chan_send()
2447 		if (len > chan->omtu)  in l2cap_chan_send()
2450 		if (!chan->tx_credits)  in l2cap_chan_send()
2455 		err = l2cap_segment_le_sdu(chan, &seg_queue, msg, len);  in l2cap_chan_send()
2457 		if (chan->state != BT_CONNECTED) {  in l2cap_chan_send()
2465 		skb_queue_splice_tail_init(&seg_queue, &chan->tx_q);  in l2cap_chan_send()
2467 		while (chan->tx_credits && !skb_queue_empty(&chan->tx_q)) {  in l2cap_chan_send()
2468 			l2cap_do_send(chan, skb_dequeue(&chan->tx_q));  in l2cap_chan_send()
2469 			chan->tx_credits--;  in l2cap_chan_send()
2472 		if (!chan->tx_credits)  in l2cap_chan_send()
2473 			chan->ops->suspend(chan);  in l2cap_chan_send()
2481 		if (len > chan->omtu)  in l2cap_chan_send()
2485 		skb = l2cap_create_basic_pdu(chan, msg, len);  in l2cap_chan_send()
2492 		if (chan->state != BT_CONNECTED) {  in l2cap_chan_send()
2497 		l2cap_do_send(chan, skb);  in l2cap_chan_send()
2504 		if (len > chan->omtu) {  in l2cap_chan_send()
2515 		err = l2cap_segment_sdu(chan, &seg_queue, msg, len);  in l2cap_chan_send()
2520 		if (chan->state != BT_CONNECTED) {  in l2cap_chan_send()
2528 		if (chan->mode == L2CAP_MODE_ERTM)  in l2cap_chan_send()
2529 			l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST);  in l2cap_chan_send()
2531 			l2cap_streaming_send(chan, &seg_queue);  in l2cap_chan_send()
2542 		BT_DBG("bad state %1.1x", chan->mode);  in l2cap_chan_send()
2550 static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq)  in l2cap_send_srej()  argument
2555 	BT_DBG("chan %p, txseq %u", chan, txseq);  in l2cap_send_srej()
2561 	for (seq = chan->expected_tx_seq; seq != txseq;  in l2cap_send_srej()
2562 	     seq = __next_seq(chan, seq)) {  in l2cap_send_srej()
2563 		if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) {  in l2cap_send_srej()
2565 			l2cap_send_sframe(chan, &control);  in l2cap_send_srej()
2566 			l2cap_seq_list_append(&chan->srej_list, seq);  in l2cap_send_srej()
2570 	chan->expected_tx_seq = __next_seq(chan, txseq);  in l2cap_send_srej()
2573 static void l2cap_send_srej_tail(struct l2cap_chan *chan)  in l2cap_send_srej_tail()  argument
2577 	BT_DBG("chan %p", chan);  in l2cap_send_srej_tail()
2579 	if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR)  in l2cap_send_srej_tail()
2585 	control.reqseq = chan->srej_list.tail;  in l2cap_send_srej_tail()
2586 	l2cap_send_sframe(chan, &control);  in l2cap_send_srej_tail()
2589 static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq)  in l2cap_send_srej_list()  argument
2595 	BT_DBG("chan %p, txseq %u", chan, txseq);  in l2cap_send_srej_list()
2602 	initial_head = chan->srej_list.head;  in l2cap_send_srej_list()
2605 		seq = l2cap_seq_list_pop(&chan->srej_list);  in l2cap_send_srej_list()
2610 		l2cap_send_sframe(chan, &control);  in l2cap_send_srej_list()
2611 		l2cap_seq_list_append(&chan->srej_list, seq);  in l2cap_send_srej_list()
2612 	} while (chan->srej_list.head != initial_head);  in l2cap_send_srej_list()
2615 static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq)  in l2cap_process_reqseq()  argument
2620 	BT_DBG("chan %p, reqseq %u", chan, reqseq);  in l2cap_process_reqseq()
2622 	if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq)  in l2cap_process_reqseq()
2626 	       chan->expected_ack_seq, chan->unacked_frames);  in l2cap_process_reqseq()
2628 	for (ackseq = chan->expected_ack_seq; ackseq != reqseq;  in l2cap_process_reqseq()
2629 	     ackseq = __next_seq(chan, ackseq)) {  in l2cap_process_reqseq()
2631 		acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq);  in l2cap_process_reqseq()
2633 			skb_unlink(acked_skb, &chan->tx_q);  in l2cap_process_reqseq()
2635 			chan->unacked_frames--;  in l2cap_process_reqseq()
2639 	chan->expected_ack_seq = reqseq;  in l2cap_process_reqseq()
2641 	if (chan->unacked_frames == 0)  in l2cap_process_reqseq()
2642 		__clear_retrans_timer(chan);  in l2cap_process_reqseq()
2644 	BT_DBG("unacked_frames %u", chan->unacked_frames);  in l2cap_process_reqseq()
2647 static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan)  in l2cap_abort_rx_srej_sent()  argument
2649 	BT_DBG("chan %p", chan);  in l2cap_abort_rx_srej_sent()
2651 	chan->expected_tx_seq = chan->buffer_seq;  in l2cap_abort_rx_srej_sent()
2652 	l2cap_seq_list_clear(&chan->srej_list);  in l2cap_abort_rx_srej_sent()
2653 	skb_queue_purge(&chan->srej_q);  in l2cap_abort_rx_srej_sent()
2654 	chan->rx_state = L2CAP_RX_STATE_RECV;  in l2cap_abort_rx_srej_sent()
2657 static void l2cap_tx_state_xmit(struct l2cap_chan *chan,  in l2cap_tx_state_xmit()  argument
2661 	BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,  in l2cap_tx_state_xmit()
2666 		if (chan->tx_send_head == NULL)  in l2cap_tx_state_xmit()
2667 			chan->tx_send_head = skb_peek(skbs);  in l2cap_tx_state_xmit()
2669 		skb_queue_splice_tail_init(skbs, &chan->tx_q);  in l2cap_tx_state_xmit()
2670 		l2cap_ertm_send(chan);  in l2cap_tx_state_xmit()
2674 		set_bit(CONN_LOCAL_BUSY, &chan->conn_state);  in l2cap_tx_state_xmit()
2676 		if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {  in l2cap_tx_state_xmit()
2680 			l2cap_abort_rx_srej_sent(chan);  in l2cap_tx_state_xmit()
2683 		l2cap_send_ack(chan);  in l2cap_tx_state_xmit()
2688 		clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);  in l2cap_tx_state_xmit()
2690 		if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {  in l2cap_tx_state_xmit()
2697 			local_control.reqseq = chan->buffer_seq;  in l2cap_tx_state_xmit()
2698 			l2cap_send_sframe(chan, &local_control);  in l2cap_tx_state_xmit()
2700 			chan->retry_count = 1;  in l2cap_tx_state_xmit()
2701 			__set_monitor_timer(chan);  in l2cap_tx_state_xmit()
2702 			chan->tx_state = L2CAP_TX_STATE_WAIT_F;  in l2cap_tx_state_xmit()
2706 		l2cap_process_reqseq(chan, control->reqseq);  in l2cap_tx_state_xmit()
2709 		l2cap_send_rr_or_rnr(chan, 1);  in l2cap_tx_state_xmit()
2710 		chan->retry_count = 1;  in l2cap_tx_state_xmit()
2711 		__set_monitor_timer(chan);  in l2cap_tx_state_xmit()
2712 		__clear_ack_timer(chan);  in l2cap_tx_state_xmit()
2713 		chan->tx_state = L2CAP_TX_STATE_WAIT_F;  in l2cap_tx_state_xmit()
2716 		l2cap_send_rr_or_rnr(chan, 1);  in l2cap_tx_state_xmit()
2717 		chan->retry_count = 1;  in l2cap_tx_state_xmit()
2718 		__set_monitor_timer(chan);  in l2cap_tx_state_xmit()
2719 		chan->tx_state = L2CAP_TX_STATE_WAIT_F;  in l2cap_tx_state_xmit()
2729 static void l2cap_tx_state_wait_f(struct l2cap_chan *chan,  in l2cap_tx_state_wait_f()  argument
2733 	BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,  in l2cap_tx_state_wait_f()
2738 		if (chan->tx_send_head == NULL)  in l2cap_tx_state_wait_f()
2739 			chan->tx_send_head = skb_peek(skbs);  in l2cap_tx_state_wait_f()
2741 		skb_queue_splice_tail_init(skbs, &chan->tx_q);  in l2cap_tx_state_wait_f()
2745 		set_bit(CONN_LOCAL_BUSY, &chan->conn_state);  in l2cap_tx_state_wait_f()
2747 		if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {  in l2cap_tx_state_wait_f()
2751 			l2cap_abort_rx_srej_sent(chan);  in l2cap_tx_state_wait_f()
2754 		l2cap_send_ack(chan);  in l2cap_tx_state_wait_f()
2759 		clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);  in l2cap_tx_state_wait_f()
2761 		if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {  in l2cap_tx_state_wait_f()
2767 			local_control.reqseq = chan->buffer_seq;  in l2cap_tx_state_wait_f()
2768 			l2cap_send_sframe(chan, &local_control);  in l2cap_tx_state_wait_f()
2770 			chan->retry_count = 1;  in l2cap_tx_state_wait_f()
2771 			__set_monitor_timer(chan);  in l2cap_tx_state_wait_f()
2772 			chan->tx_state = L2CAP_TX_STATE_WAIT_F;  in l2cap_tx_state_wait_f()
2776 		l2cap_process_reqseq(chan, control->reqseq);  in l2cap_tx_state_wait_f()
2782 			__clear_monitor_timer(chan);  in l2cap_tx_state_wait_f()
2783 			if (chan->unacked_frames > 0)  in l2cap_tx_state_wait_f()
2784 				__set_retrans_timer(chan);  in l2cap_tx_state_wait_f()
2785 			chan->retry_count = 0;  in l2cap_tx_state_wait_f()
2786 			chan->tx_state = L2CAP_TX_STATE_XMIT;  in l2cap_tx_state_wait_f()
2787 			BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state);  in l2cap_tx_state_wait_f()
2794 		if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) {  in l2cap_tx_state_wait_f()
2795 			l2cap_send_rr_or_rnr(chan, 1);  in l2cap_tx_state_wait_f()
2796 			__set_monitor_timer(chan);  in l2cap_tx_state_wait_f()
2797 			chan->retry_count++;  in l2cap_tx_state_wait_f()
2799 			l2cap_send_disconn_req(chan, ECONNABORTED);  in l2cap_tx_state_wait_f()
2807 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,  in l2cap_tx()  argument
2811 	       chan, control, skbs, event, chan->tx_state);  in l2cap_tx()
2813 	switch (chan->tx_state) {  in l2cap_tx()
2815 		l2cap_tx_state_xmit(chan, control, skbs, event);  in l2cap_tx()
2818 		l2cap_tx_state_wait_f(chan, control, skbs, event);  in l2cap_tx()
2826 static void l2cap_pass_to_tx(struct l2cap_chan *chan,  in l2cap_pass_to_tx()  argument
2829 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_pass_to_tx()
2830 	l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT);  in l2cap_pass_to_tx()
2833 static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan,  in l2cap_pass_to_tx_fbit()  argument
2836 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_pass_to_tx_fbit()
2837 	l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT);  in l2cap_pass_to_tx_fbit()
2844 	struct l2cap_chan *chan;  in l2cap_raw_recv()  local
2850 	list_for_each_entry(chan, &conn->chan_l, list) {  in l2cap_raw_recv()
2851 		if (chan->chan_type != L2CAP_CHAN_RAW)  in l2cap_raw_recv()
2855 		if (bt_cb(skb)->l2cap.chan == chan)  in l2cap_raw_recv()
2861 		if (chan->ops->recv(chan, nskb))  in l2cap_raw_recv()
2999 static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan)  in l2cap_add_opt_efs()  argument
3003 	switch (chan->mode) {  in l2cap_add_opt_efs()
3005 		efs.id		= chan->local_id;  in l2cap_add_opt_efs()
3006 		efs.stype	= chan->local_stype;  in l2cap_add_opt_efs()
3007 		efs.msdu	= cpu_to_le16(chan->local_msdu);  in l2cap_add_opt_efs()
3008 		efs.sdu_itime	= cpu_to_le32(chan->local_sdu_itime);  in l2cap_add_opt_efs()
3016 		efs.msdu	= cpu_to_le16(chan->local_msdu);  in l2cap_add_opt_efs()
3017 		efs.sdu_itime	= cpu_to_le32(chan->local_sdu_itime);  in l2cap_add_opt_efs()
3032 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,  in l2cap_ack_timeout()  local
3036 	BT_DBG("chan %p", chan);  in l2cap_ack_timeout()
3038 	l2cap_chan_lock(chan);  in l2cap_ack_timeout()
3040 	frames_to_ack = __seq_offset(chan, chan->buffer_seq,  in l2cap_ack_timeout()
3041 				     chan->last_acked_seq);  in l2cap_ack_timeout()
3044 		l2cap_send_rr_or_rnr(chan, 0);  in l2cap_ack_timeout()
3046 	l2cap_chan_unlock(chan);  in l2cap_ack_timeout()
3047 	l2cap_chan_put(chan);  in l2cap_ack_timeout()
3050 int l2cap_ertm_init(struct l2cap_chan *chan)  in l2cap_ertm_init()  argument
3054 	chan->next_tx_seq = 0;  in l2cap_ertm_init()
3055 	chan->expected_tx_seq = 0;  in l2cap_ertm_init()
3056 	chan->expected_ack_seq = 0;  in l2cap_ertm_init()
3057 	chan->unacked_frames = 0;  in l2cap_ertm_init()
3058 	chan->buffer_seq = 0;  in l2cap_ertm_init()
3059 	chan->frames_sent = 0;  in l2cap_ertm_init()
3060 	chan->last_acked_seq = 0;  in l2cap_ertm_init()
3061 	chan->sdu = NULL;  in l2cap_ertm_init()
3062 	chan->sdu_last_frag = NULL;  in l2cap_ertm_init()
3063 	chan->sdu_len = 0;  in l2cap_ertm_init()
3065 	skb_queue_head_init(&chan->tx_q);  in l2cap_ertm_init()
3067 	chan->local_amp_id = AMP_ID_BREDR;  in l2cap_ertm_init()
3068 	chan->move_id = AMP_ID_BREDR;  in l2cap_ertm_init()
3069 	chan->move_state = L2CAP_MOVE_STABLE;  in l2cap_ertm_init()
3070 	chan->move_role = L2CAP_MOVE_ROLE_NONE;  in l2cap_ertm_init()
3072 	if (chan->mode != L2CAP_MODE_ERTM)  in l2cap_ertm_init()
3075 	chan->rx_state = L2CAP_RX_STATE_RECV;  in l2cap_ertm_init()
3076 	chan->tx_state = L2CAP_TX_STATE_XMIT;  in l2cap_ertm_init()
3078 	INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);  in l2cap_ertm_init()
3079 	INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);  in l2cap_ertm_init()
3080 	INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);  in l2cap_ertm_init()
3082 	skb_queue_head_init(&chan->srej_q);  in l2cap_ertm_init()
3084 	err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);  in l2cap_ertm_init()
3088 	err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);  in l2cap_ertm_init()
3090 		l2cap_seq_list_free(&chan->srej_list);  in l2cap_ertm_init()
3120 static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan,  in __l2cap_set_ertm_timeouts()  argument
3123 	if (chan->local_amp_id != AMP_ID_BREDR && chan->hs_hcon) {  in __l2cap_set_ertm_timeouts()
3124 		u64 ertm_to = chan->hs_hcon->hdev->amp_be_flush_to;  in __l2cap_set_ertm_timeouts()
3158 static inline void l2cap_txwin_setup(struct l2cap_chan *chan)  in l2cap_txwin_setup()  argument
3160 	if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&  in l2cap_txwin_setup()
3161 	    __l2cap_ews_supported(chan->conn)) {  in l2cap_txwin_setup()
3163 		set_bit(FLAG_EXT_CTRL, &chan->flags);  in l2cap_txwin_setup()
3164 		chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;  in l2cap_txwin_setup()
3166 		chan->tx_win = min_t(u16, chan->tx_win,  in l2cap_txwin_setup()
3168 		chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;  in l2cap_txwin_setup()
3170 	chan->ack_win = chan->tx_win;  in l2cap_txwin_setup()
3173 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data)  in l2cap_build_conf_req()  argument
3176 	struct l2cap_conf_rfc rfc = { .mode = chan->mode };  in l2cap_build_conf_req()
3180 	BT_DBG("chan %p", chan);  in l2cap_build_conf_req()
3182 	if (chan->num_conf_req || chan->num_conf_rsp)  in l2cap_build_conf_req()
3185 	switch (chan->mode) {  in l2cap_build_conf_req()
3188 		if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))  in l2cap_build_conf_req()
3191 		if (__l2cap_efs_supported(chan->conn))  in l2cap_build_conf_req()
3192 			set_bit(FLAG_EFS_ENABLE, &chan->flags);  in l2cap_build_conf_req()
3196 		chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);  in l2cap_build_conf_req()
3201 	if (chan->imtu != L2CAP_DEFAULT_MTU)  in l2cap_build_conf_req()
3202 		l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);  in l2cap_build_conf_req()
3204 	switch (chan->mode) {  in l2cap_build_conf_req()
3209 		if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&  in l2cap_build_conf_req()
3210 		    !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))  in l2cap_build_conf_req()
3226 		rfc.max_transmit    = chan->max_tx;  in l2cap_build_conf_req()
3228 		__l2cap_set_ertm_timeouts(chan, &rfc);  in l2cap_build_conf_req()
3230 		size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -  in l2cap_build_conf_req()
3235 		l2cap_txwin_setup(chan);  in l2cap_build_conf_req()
3237 		rfc.txwin_size = min_t(u16, chan->tx_win,  in l2cap_build_conf_req()
3243 		if (test_bit(FLAG_EFS_ENABLE, &chan->flags))  in l2cap_build_conf_req()
3244 			l2cap_add_opt_efs(&ptr, chan);  in l2cap_build_conf_req()
3246 		if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_build_conf_req()
3248 					   chan->tx_win);  in l2cap_build_conf_req()
3250 		if (chan->conn->feat_mask & L2CAP_FEAT_FCS)  in l2cap_build_conf_req()
3251 			if (chan->fcs == L2CAP_FCS_NONE ||  in l2cap_build_conf_req()
3252 			    test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {  in l2cap_build_conf_req()
3253 				chan->fcs = L2CAP_FCS_NONE;  in l2cap_build_conf_req()
3255 						   chan->fcs);  in l2cap_build_conf_req()
3260 		l2cap_txwin_setup(chan);  in l2cap_build_conf_req()
3267 		size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -  in l2cap_build_conf_req()
3275 		if (test_bit(FLAG_EFS_ENABLE, &chan->flags))  in l2cap_build_conf_req()
3276 			l2cap_add_opt_efs(&ptr, chan);  in l2cap_build_conf_req()
3278 		if (chan->conn->feat_mask & L2CAP_FEAT_FCS)  in l2cap_build_conf_req()
3279 			if (chan->fcs == L2CAP_FCS_NONE ||  in l2cap_build_conf_req()
3280 			    test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {  in l2cap_build_conf_req()
3281 				chan->fcs = L2CAP_FCS_NONE;  in l2cap_build_conf_req()
3283 						   chan->fcs);  in l2cap_build_conf_req()
3288 	req->dcid  = cpu_to_le16(chan->dcid);  in l2cap_build_conf_req()
3294 static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)  in l2cap_parse_conf_req()  argument
3298 	void *req = chan->conf_req;  in l2cap_parse_conf_req()
3299 	int len = chan->conf_len;  in l2cap_parse_conf_req()
3309 	BT_DBG("chan %p", chan);  in l2cap_parse_conf_req()
3323 			chan->flush_to = val;  in l2cap_parse_conf_req()
3336 				set_bit(CONF_RECV_NO_FCS, &chan->conf_state);  in l2cap_parse_conf_req()
3346 			if (!(chan->conn->local_fixed_chan & L2CAP_FC_A2MP))  in l2cap_parse_conf_req()
3349 			set_bit(FLAG_EXT_CTRL, &chan->flags);  in l2cap_parse_conf_req()
3350 			set_bit(CONF_EWS_RECV, &chan->conf_state);  in l2cap_parse_conf_req()
3351 			chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;  in l2cap_parse_conf_req()
3352 			chan->remote_tx_win = val;  in l2cap_parse_conf_req()
3365 	if (chan->num_conf_rsp || chan->num_conf_req > 1)  in l2cap_parse_conf_req()
3368 	switch (chan->mode) {  in l2cap_parse_conf_req()
3371 		if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {  in l2cap_parse_conf_req()
3372 			chan->mode = l2cap_select_mode(rfc.mode,  in l2cap_parse_conf_req()
3373 						       chan->conn->feat_mask);  in l2cap_parse_conf_req()
3378 			if (__l2cap_efs_supported(chan->conn))  in l2cap_parse_conf_req()
3379 				set_bit(FLAG_EFS_ENABLE, &chan->flags);  in l2cap_parse_conf_req()
3384 		if (chan->mode != rfc.mode)  in l2cap_parse_conf_req()
3391 	if (chan->mode != rfc.mode) {  in l2cap_parse_conf_req()
3393 		rfc.mode = chan->mode;  in l2cap_parse_conf_req()
3395 		if (chan->num_conf_rsp == 1)  in l2cap_parse_conf_req()
3409 			chan->omtu = mtu;  in l2cap_parse_conf_req()
3410 			set_bit(CONF_MTU_DONE, &chan->conf_state);  in l2cap_parse_conf_req()
3412 		l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu);  in l2cap_parse_conf_req()
3415 			if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&  in l2cap_parse_conf_req()
3417 			    efs.stype != chan->local_stype) {  in l2cap_parse_conf_req()
3421 				if (chan->num_conf_req >= 1)  in l2cap_parse_conf_req()
3430 				set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);  in l2cap_parse_conf_req()
3436 			chan->fcs = L2CAP_FCS_NONE;  in l2cap_parse_conf_req()
3437 			set_bit(CONF_MODE_DONE, &chan->conf_state);  in l2cap_parse_conf_req()
3441 			if (!test_bit(CONF_EWS_RECV, &chan->conf_state))  in l2cap_parse_conf_req()
3442 				chan->remote_tx_win = rfc.txwin_size;  in l2cap_parse_conf_req()
3446 			chan->remote_max_tx = rfc.max_transmit;  in l2cap_parse_conf_req()
3449 				     chan->conn->mtu - L2CAP_EXT_HDR_SIZE -  in l2cap_parse_conf_req()
3452 			chan->remote_mps = size;  in l2cap_parse_conf_req()
3454 			__l2cap_set_ertm_timeouts(chan, &rfc);  in l2cap_parse_conf_req()
3456 			set_bit(CONF_MODE_DONE, &chan->conf_state);  in l2cap_parse_conf_req()
3461 			if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {  in l2cap_parse_conf_req()
3462 				chan->remote_id = efs.id;  in l2cap_parse_conf_req()
3463 				chan->remote_stype = efs.stype;  in l2cap_parse_conf_req()
3464 				chan->remote_msdu = le16_to_cpu(efs.msdu);  in l2cap_parse_conf_req()
3465 				chan->remote_flush_to =  in l2cap_parse_conf_req()
3467 				chan->remote_acc_lat =  in l2cap_parse_conf_req()
3469 				chan->remote_sdu_itime =  in l2cap_parse_conf_req()
3479 				     chan->conn->mtu - L2CAP_EXT_HDR_SIZE -  in l2cap_parse_conf_req()
3482 			chan->remote_mps = size;  in l2cap_parse_conf_req()
3484 			set_bit(CONF_MODE_DONE, &chan->conf_state);  in l2cap_parse_conf_req()
3495 			rfc.mode = chan->mode;  in l2cap_parse_conf_req()
3499 			set_bit(CONF_OUTPUT_DONE, &chan->conf_state);  in l2cap_parse_conf_req()
3501 	rsp->scid   = cpu_to_le16(chan->dcid);  in l2cap_parse_conf_req()
3508 static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,  in l2cap_parse_conf_rsp()  argument
3518 	BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);  in l2cap_parse_conf_rsp()
3527 				chan->imtu = L2CAP_DEFAULT_MIN_MTU;  in l2cap_parse_conf_rsp()
3529 				chan->imtu = val;  in l2cap_parse_conf_rsp()
3530 			l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);  in l2cap_parse_conf_rsp()
3534 			chan->flush_to = val;  in l2cap_parse_conf_rsp()
3536 					   2, chan->flush_to);  in l2cap_parse_conf_rsp()
3543 			if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&  in l2cap_parse_conf_rsp()
3544 			    rfc.mode != chan->mode)  in l2cap_parse_conf_rsp()
3547 			chan->fcs = 0;  in l2cap_parse_conf_rsp()
3554 			chan->ack_win = min_t(u16, val, chan->ack_win);  in l2cap_parse_conf_rsp()
3556 					   chan->tx_win);  in l2cap_parse_conf_rsp()
3563 			if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&  in l2cap_parse_conf_rsp()
3565 			    efs.stype != chan->local_stype)  in l2cap_parse_conf_rsp()
3576 						&chan->conf_state);  in l2cap_parse_conf_rsp()
3581 	if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)  in l2cap_parse_conf_rsp()
3584 	chan->mode = rfc.mode;  in l2cap_parse_conf_rsp()
3589 			chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);  in l2cap_parse_conf_rsp()
3590 			chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);  in l2cap_parse_conf_rsp()
3591 			chan->mps    = le16_to_cpu(rfc.max_pdu_size);  in l2cap_parse_conf_rsp()
3592 			if (!test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_parse_conf_rsp()
3593 				chan->ack_win = min_t(u16, chan->ack_win,  in l2cap_parse_conf_rsp()
3596 			if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {  in l2cap_parse_conf_rsp()
3597 				chan->local_msdu = le16_to_cpu(efs.msdu);  in l2cap_parse_conf_rsp()
3598 				chan->local_sdu_itime =  in l2cap_parse_conf_rsp()
3600 				chan->local_acc_lat = le32_to_cpu(efs.acc_lat);  in l2cap_parse_conf_rsp()
3601 				chan->local_flush_to =  in l2cap_parse_conf_rsp()
3607 			chan->mps    = le16_to_cpu(rfc.max_pdu_size);  in l2cap_parse_conf_rsp()
3611 	req->dcid   = cpu_to_le16(chan->dcid);  in l2cap_parse_conf_rsp()
3617 static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data,  in l2cap_build_conf_rsp()  argument
3623 	BT_DBG("chan %p", chan);  in l2cap_build_conf_rsp()
3625 	rsp->scid   = cpu_to_le16(chan->dcid);  in l2cap_build_conf_rsp()
3632 void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan)  in __l2cap_le_connect_rsp_defer()  argument
3635 	struct l2cap_conn *conn = chan->conn;  in __l2cap_le_connect_rsp_defer()
3637 	BT_DBG("chan %p", chan);  in __l2cap_le_connect_rsp_defer()
3639 	rsp.dcid    = cpu_to_le16(chan->scid);  in __l2cap_le_connect_rsp_defer()
3640 	rsp.mtu     = cpu_to_le16(chan->imtu);  in __l2cap_le_connect_rsp_defer()
3641 	rsp.mps     = cpu_to_le16(chan->mps);  in __l2cap_le_connect_rsp_defer()
3642 	rsp.credits = cpu_to_le16(chan->rx_credits);  in __l2cap_le_connect_rsp_defer()
3645 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),  in __l2cap_le_connect_rsp_defer()
3649 void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)  in __l2cap_connect_rsp_defer()  argument
3652 	struct l2cap_conn *conn = chan->conn;  in __l2cap_connect_rsp_defer()
3656 	rsp.scid   = cpu_to_le16(chan->dcid);  in __l2cap_connect_rsp_defer()
3657 	rsp.dcid   = cpu_to_le16(chan->scid);  in __l2cap_connect_rsp_defer()
3661 	if (chan->hs_hcon)  in __l2cap_connect_rsp_defer()
3666 	BT_DBG("chan %p rsp_code %u", chan, rsp_code);  in __l2cap_connect_rsp_defer()
3668 	l2cap_send_cmd(conn, chan->ident, rsp_code, sizeof(rsp), &rsp);  in __l2cap_connect_rsp_defer()
3670 	if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))  in __l2cap_connect_rsp_defer()
3674 		       l2cap_build_conf_req(chan, buf), buf);  in __l2cap_connect_rsp_defer()
3675 	chan->num_conf_req++;  in __l2cap_connect_rsp_defer()
3678 static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)  in l2cap_conf_rfc_get()  argument
3685 	u16 txwin_ext = chan->ack_win;  in l2cap_conf_rfc_get()
3687 		.mode = chan->mode,  in l2cap_conf_rfc_get()
3690 		.max_pdu_size = cpu_to_le16(chan->imtu),  in l2cap_conf_rfc_get()
3691 		.txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW),  in l2cap_conf_rfc_get()
3694 	BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);  in l2cap_conf_rfc_get()
3696 	if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))  in l2cap_conf_rfc_get()
3715 		chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);  in l2cap_conf_rfc_get()
3716 		chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);  in l2cap_conf_rfc_get()
3717 		chan->mps = le16_to_cpu(rfc.max_pdu_size);  in l2cap_conf_rfc_get()
3718 		if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_conf_rfc_get()
3719 			chan->ack_win = min_t(u16, chan->ack_win, txwin_ext);  in l2cap_conf_rfc_get()
3721 			chan->ack_win = min_t(u16, chan->ack_win,  in l2cap_conf_rfc_get()
3725 		chan->mps    = le16_to_cpu(rfc.max_pdu_size);  in l2cap_conf_rfc_get()
3760 	struct l2cap_chan *chan = NULL, *pchan;  in l2cap_connect()  local
3793 	chan = pchan->ops->new_connection(pchan);  in l2cap_connect()
3794 	if (!chan)  in l2cap_connect()
3804 	bacpy(&chan->src, &conn->hcon->src);  in l2cap_connect()
3805 	bacpy(&chan->dst, &conn->hcon->dst);  in l2cap_connect()
3806 	chan->src_type = bdaddr_src_type(conn->hcon);  in l2cap_connect()
3807 	chan->dst_type = bdaddr_dst_type(conn->hcon);  in l2cap_connect()
3808 	chan->psm  = psm;  in l2cap_connect()
3809 	chan->dcid = scid;  in l2cap_connect()
3810 	chan->local_amp_id = amp_id;  in l2cap_connect()
3812 	__l2cap_chan_add(conn, chan);  in l2cap_connect()
3814 	dcid = chan->scid;  in l2cap_connect()
3816 	__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));  in l2cap_connect()
3818 	chan->ident = cmd->ident;  in l2cap_connect()
3821 		if (l2cap_chan_check_security(chan, false)) {  in l2cap_connect()
3822 			if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {  in l2cap_connect()
3823 				l2cap_state_change(chan, BT_CONNECT2);  in l2cap_connect()
3826 				chan->ops->defer(chan);  in l2cap_connect()
3833 					l2cap_state_change(chan, BT_CONFIG);  in l2cap_connect()
3836 					l2cap_state_change(chan, BT_CONNECT2);  in l2cap_connect()
3842 			l2cap_state_change(chan, BT_CONNECT2);  in l2cap_connect()
3847 		l2cap_state_change(chan, BT_CONNECT2);  in l2cap_connect()
3877 	if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&  in l2cap_connect()
3880 		set_bit(CONF_REQ_SENT, &chan->conf_state);  in l2cap_connect()
3882 			       l2cap_build_conf_req(chan, buf), buf);  in l2cap_connect()
3883 		chan->num_conf_req++;  in l2cap_connect()
3886 	return chan;  in l2cap_connect()
3914 	struct l2cap_chan *chan;  in l2cap_connect_create_rsp()  local
3932 		chan = __l2cap_get_chan_by_scid(conn, scid);  in l2cap_connect_create_rsp()
3933 		if (!chan) {  in l2cap_connect_create_rsp()
3938 		chan = __l2cap_get_chan_by_ident(conn, cmd->ident);  in l2cap_connect_create_rsp()
3939 		if (!chan) {  in l2cap_connect_create_rsp()
3947 	l2cap_chan_lock(chan);  in l2cap_connect_create_rsp()
3951 		l2cap_state_change(chan, BT_CONFIG);  in l2cap_connect_create_rsp()
3952 		chan->ident = 0;  in l2cap_connect_create_rsp()
3953 		chan->dcid = dcid;  in l2cap_connect_create_rsp()
3954 		clear_bit(CONF_CONNECT_PEND, &chan->conf_state);  in l2cap_connect_create_rsp()
3956 		if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))  in l2cap_connect_create_rsp()
3960 			       l2cap_build_conf_req(chan, req), req);  in l2cap_connect_create_rsp()
3961 		chan->num_conf_req++;  in l2cap_connect_create_rsp()
3965 		set_bit(CONF_CONNECT_PEND, &chan->conf_state);  in l2cap_connect_create_rsp()
3969 		l2cap_chan_del(chan, ECONNREFUSED);  in l2cap_connect_create_rsp()
3973 	l2cap_chan_unlock(chan);  in l2cap_connect_create_rsp()
3981 static inline void set_default_fcs(struct l2cap_chan *chan)  in set_default_fcs()  argument
3986 	if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)  in set_default_fcs()
3987 		chan->fcs = L2CAP_FCS_NONE;  in set_default_fcs()
3988 	else if (!test_bit(CONF_RECV_NO_FCS, &chan->conf_state))  in set_default_fcs()
3989 		chan->fcs = L2CAP_FCS_CRC16;  in set_default_fcs()
3992 static void l2cap_send_efs_conf_rsp(struct l2cap_chan *chan, void *data,  in l2cap_send_efs_conf_rsp()  argument
3995 	struct l2cap_conn *conn = chan->conn;  in l2cap_send_efs_conf_rsp()
3997 	BT_DBG("conn %p chan %p ident %d flags 0x%4.4x", conn, chan, ident,  in l2cap_send_efs_conf_rsp()
4000 	clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);  in l2cap_send_efs_conf_rsp()
4001 	set_bit(CONF_OUTPUT_DONE, &chan->conf_state);  in l2cap_send_efs_conf_rsp()
4004 		       l2cap_build_conf_rsp(chan, data,  in l2cap_send_efs_conf_rsp()
4027 	struct l2cap_chan *chan;  in l2cap_config_req()  local
4038 	chan = l2cap_get_chan_by_scid(conn, dcid);  in l2cap_config_req()
4039 	if (!chan) {  in l2cap_config_req()
4044 	if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) {  in l2cap_config_req()
4045 		cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,  in l2cap_config_req()
4046 				       chan->dcid);  in l2cap_config_req()
4052 	if (chan->conf_len + len > sizeof(chan->conf_req)) {  in l2cap_config_req()
4054 			       l2cap_build_conf_rsp(chan, rsp,  in l2cap_config_req()
4060 	memcpy(chan->conf_req + chan->conf_len, req->data, len);  in l2cap_config_req()
4061 	chan->conf_len += len;  in l2cap_config_req()
4066 			       l2cap_build_conf_rsp(chan, rsp,  in l2cap_config_req()
4072 	len = l2cap_parse_conf_req(chan, rsp);  in l2cap_config_req()
4074 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_config_req()
4078 	chan->ident = cmd->ident;  in l2cap_config_req()
4080 	chan->num_conf_rsp++;  in l2cap_config_req()
4083 	chan->conf_len = 0;  in l2cap_config_req()
4085 	if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))  in l2cap_config_req()
4088 	if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {  in l2cap_config_req()
4089 		set_default_fcs(chan);  in l2cap_config_req()
4091 		if (chan->mode == L2CAP_MODE_ERTM ||  in l2cap_config_req()
4092 		    chan->mode == L2CAP_MODE_STREAMING)  in l2cap_config_req()
4093 			err = l2cap_ertm_init(chan);  in l2cap_config_req()
4096 			l2cap_send_disconn_req(chan, -err);  in l2cap_config_req()
4098 			l2cap_chan_ready(chan);  in l2cap_config_req()
4103 	if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {  in l2cap_config_req()
4106 			       l2cap_build_conf_req(chan, buf), buf);  in l2cap_config_req()
4107 		chan->num_conf_req++;  in l2cap_config_req()
4112 	if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&  in l2cap_config_req()
4113 	    test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {  in l2cap_config_req()
4118 		if (!chan->hs_hcon)  in l2cap_config_req()
4119 			l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags);  in l2cap_config_req()
4121 			chan->ident = cmd->ident;  in l2cap_config_req()
4125 	l2cap_chan_unlock(chan);  in l2cap_config_req()
4135 	struct l2cap_chan *chan;  in l2cap_config_rsp()  local
4149 	chan = l2cap_get_chan_by_scid(conn, scid);  in l2cap_config_rsp()
4150 	if (!chan)  in l2cap_config_rsp()
4155 		l2cap_conf_rfc_get(chan, rsp->data, len);  in l2cap_config_rsp()
4156 		clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);  in l2cap_config_rsp()
4160 		set_bit(CONF_REM_CONF_PEND, &chan->conf_state);  in l2cap_config_rsp()
4162 		if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {  in l2cap_config_rsp()
4165 			len = l2cap_parse_conf_rsp(chan, rsp->data, len,  in l2cap_config_rsp()
4168 				l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_config_rsp()
4172 			if (!chan->hs_hcon) {  in l2cap_config_rsp()
4173 				l2cap_send_efs_conf_rsp(chan, buf, cmd->ident,  in l2cap_config_rsp()
4176 				if (l2cap_check_efs(chan)) {  in l2cap_config_rsp()
4177 					amp_create_logical_link(chan);  in l2cap_config_rsp()
4178 					chan->ident = cmd->ident;  in l2cap_config_rsp()
4185 		if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {  in l2cap_config_rsp()
4189 				l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_config_rsp()
4195 			len = l2cap_parse_conf_rsp(chan, rsp->data, len,  in l2cap_config_rsp()
4198 				l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_config_rsp()
4204 			chan->num_conf_req++;  in l2cap_config_rsp()
4211 		l2cap_chan_set_err(chan, ECONNRESET);  in l2cap_config_rsp()
4213 		__set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);  in l2cap_config_rsp()
4214 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_config_rsp()
4221 	set_bit(CONF_INPUT_DONE, &chan->conf_state);  in l2cap_config_rsp()
4223 	if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {  in l2cap_config_rsp()
4224 		set_default_fcs(chan);  in l2cap_config_rsp()
4226 		if (chan->mode == L2CAP_MODE_ERTM ||  in l2cap_config_rsp()
4227 		    chan->mode == L2CAP_MODE_STREAMING)  in l2cap_config_rsp()
4228 			err = l2cap_ertm_init(chan);  in l2cap_config_rsp()
4231 			l2cap_send_disconn_req(chan, -err);  in l2cap_config_rsp()
4233 			l2cap_chan_ready(chan);  in l2cap_config_rsp()
4237 	l2cap_chan_unlock(chan);  in l2cap_config_rsp()
4248 	struct l2cap_chan *chan;  in l2cap_disconnect_req()  local
4260 	chan = __l2cap_get_chan_by_scid(conn, dcid);  in l2cap_disconnect_req()
4261 	if (!chan) {  in l2cap_disconnect_req()
4267 	l2cap_chan_lock(chan);  in l2cap_disconnect_req()
4269 	rsp.dcid = cpu_to_le16(chan->scid);  in l2cap_disconnect_req()
4270 	rsp.scid = cpu_to_le16(chan->dcid);  in l2cap_disconnect_req()
4273 	chan->ops->set_shutdown(chan);  in l2cap_disconnect_req()
4275 	l2cap_chan_hold(chan);  in l2cap_disconnect_req()
4276 	l2cap_chan_del(chan, ECONNRESET);  in l2cap_disconnect_req()
4278 	l2cap_chan_unlock(chan);  in l2cap_disconnect_req()
4280 	chan->ops->close(chan);  in l2cap_disconnect_req()
4281 	l2cap_chan_put(chan);  in l2cap_disconnect_req()
4294 	struct l2cap_chan *chan;  in l2cap_disconnect_rsp()  local
4306 	chan = __l2cap_get_chan_by_scid(conn, scid);  in l2cap_disconnect_rsp()
4307 	if (!chan) {  in l2cap_disconnect_rsp()
4312 	l2cap_chan_lock(chan);  in l2cap_disconnect_rsp()
4314 	l2cap_chan_hold(chan);  in l2cap_disconnect_rsp()
4315 	l2cap_chan_del(chan, 0);  in l2cap_disconnect_rsp()
4317 	l2cap_chan_unlock(chan);  in l2cap_disconnect_rsp()
4319 	chan->ops->close(chan);  in l2cap_disconnect_rsp()
4320 	l2cap_chan_put(chan);  in l2cap_disconnect_rsp()
4447 	struct l2cap_chan *chan;  in l2cap_create_channel_req()  local
4479 	chan = l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,  in l2cap_create_channel_req()
4481 	if (chan) {  in l2cap_create_channel_req()
4489 			cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,  in l2cap_create_channel_req()
4490 					       chan->dcid);  in l2cap_create_channel_req()
4494 		BT_DBG("mgr %p bredr_chan %p hs_hcon %p", mgr, chan, hs_hcon);  in l2cap_create_channel_req()
4496 		mgr->bredr_chan = chan;  in l2cap_create_channel_req()
4497 		chan->hs_hcon = hs_hcon;  in l2cap_create_channel_req()
4498 		chan->fcs = L2CAP_FCS_NONE;  in l2cap_create_channel_req()
4518 static void l2cap_send_move_chan_req(struct l2cap_chan *chan, u8 dest_amp_id)  in l2cap_send_move_chan_req()  argument
4523 	BT_DBG("chan %p, dest_amp_id %d", chan, dest_amp_id);  in l2cap_send_move_chan_req()
4525 	ident = l2cap_get_ident(chan->conn);  in l2cap_send_move_chan_req()
4526 	chan->ident = ident;  in l2cap_send_move_chan_req()
4528 	req.icid = cpu_to_le16(chan->scid);  in l2cap_send_move_chan_req()
4531 	l2cap_send_cmd(chan->conn, ident, L2CAP_MOVE_CHAN_REQ, sizeof(req),  in l2cap_send_move_chan_req()
4534 	__set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);  in l2cap_send_move_chan_req()
4537 static void l2cap_send_move_chan_rsp(struct l2cap_chan *chan, u16 result)  in l2cap_send_move_chan_rsp()  argument
4541 	BT_DBG("chan %p, result 0x%4.4x", chan, result);  in l2cap_send_move_chan_rsp()
4543 	rsp.icid = cpu_to_le16(chan->dcid);  in l2cap_send_move_chan_rsp()
4546 	l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_RSP,  in l2cap_send_move_chan_rsp()
4550 static void l2cap_send_move_chan_cfm(struct l2cap_chan *chan, u16 result)  in l2cap_send_move_chan_cfm()  argument
4554 	BT_DBG("chan %p, result 0x%4.4x", chan, result);  in l2cap_send_move_chan_cfm()
4556 	chan->ident = l2cap_get_ident(chan->conn);  in l2cap_send_move_chan_cfm()
4558 	cfm.icid = cpu_to_le16(chan->scid);  in l2cap_send_move_chan_cfm()
4561 	l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_CFM,  in l2cap_send_move_chan_cfm()
4564 	__set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);  in l2cap_send_move_chan_cfm()
4591 static void __release_logical_link(struct l2cap_chan *chan)  in __release_logical_link()  argument
4593 	chan->hs_hchan = NULL;  in __release_logical_link()
4594 	chan->hs_hcon = NULL;  in __release_logical_link()
4599 static void l2cap_logical_fail(struct l2cap_chan *chan)  in l2cap_logical_fail()  argument
4602 	if (chan->state != BT_CONNECTED) {  in l2cap_logical_fail()
4604 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_logical_fail()
4608 	switch (chan->move_role) {  in l2cap_logical_fail()
4610 		l2cap_move_done(chan);  in l2cap_logical_fail()
4611 		l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_SUPP);  in l2cap_logical_fail()
4614 		if (chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_COMP ||  in l2cap_logical_fail()
4615 		    chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_CFM) {  in l2cap_logical_fail()
4619 			l2cap_move_done(chan);  in l2cap_logical_fail()
4625 		l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);  in l2cap_logical_fail()
4630 static void l2cap_logical_finish_create(struct l2cap_chan *chan,  in l2cap_logical_finish_create()  argument
4635 	chan->hs_hchan = hchan;  in l2cap_logical_finish_create()
4636 	chan->hs_hcon->l2cap_data = chan->conn;  in l2cap_logical_finish_create()
4638 	l2cap_send_efs_conf_rsp(chan, &rsp, chan->ident, 0);  in l2cap_logical_finish_create()
4640 	if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {  in l2cap_logical_finish_create()
4643 		set_default_fcs(chan);  in l2cap_logical_finish_create()
4645 		err = l2cap_ertm_init(chan);  in l2cap_logical_finish_create()
4647 			l2cap_send_disconn_req(chan, -err);  in l2cap_logical_finish_create()
4649 			l2cap_chan_ready(chan);  in l2cap_logical_finish_create()
4653 static void l2cap_logical_finish_move(struct l2cap_chan *chan,  in l2cap_logical_finish_move()  argument
4656 	chan->hs_hcon = hchan->conn;  in l2cap_logical_finish_move()
4657 	chan->hs_hcon->l2cap_data = chan->conn;  in l2cap_logical_finish_move()
4659 	BT_DBG("move_state %d", chan->move_state);  in l2cap_logical_finish_move()
4661 	switch (chan->move_state) {  in l2cap_logical_finish_move()
4666 		chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;  in l2cap_logical_finish_move()
4669 		if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_logical_finish_move()
4670 			chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;  in l2cap_logical_finish_move()
4671 		} else if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {  in l2cap_logical_finish_move()
4672 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;  in l2cap_logical_finish_move()
4673 			l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);  in l2cap_logical_finish_move()
4674 		} else if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {  in l2cap_logical_finish_move()
4675 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;  in l2cap_logical_finish_move()
4676 			l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);  in l2cap_logical_finish_move()
4681 		__release_logical_link(chan);  in l2cap_logical_finish_move()
4683 		chan->move_state = L2CAP_MOVE_STABLE;  in l2cap_logical_finish_move()
4688 void l2cap_logical_cfm(struct l2cap_chan *chan, struct hci_chan *hchan,  in l2cap_logical_cfm()  argument
4691 	BT_DBG("chan %p, hchan %p, status %d", chan, hchan, status);  in l2cap_logical_cfm()
4694 		l2cap_logical_fail(chan);  in l2cap_logical_cfm()
4695 		__release_logical_link(chan);  in l2cap_logical_cfm()
4699 	if (chan->state != BT_CONNECTED) {  in l2cap_logical_cfm()
4701 		if (chan->local_amp_id != AMP_ID_BREDR)  in l2cap_logical_cfm()
4702 			l2cap_logical_finish_create(chan, hchan);  in l2cap_logical_cfm()
4704 		l2cap_logical_finish_move(chan, hchan);  in l2cap_logical_cfm()
4708 void l2cap_move_start(struct l2cap_chan *chan)  in l2cap_move_start()  argument
4710 	BT_DBG("chan %p", chan);  in l2cap_move_start()
4712 	if (chan->local_amp_id == AMP_ID_BREDR) {  in l2cap_move_start()
4713 		if (chan->chan_policy != BT_CHANNEL_POLICY_AMP_PREFERRED)  in l2cap_move_start()
4715 		chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;  in l2cap_move_start()
4716 		chan->move_state = L2CAP_MOVE_WAIT_PREPARE;  in l2cap_move_start()
4719 		chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;  in l2cap_move_start()
4720 		chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;  in l2cap_move_start()
4721 		chan->move_id = 0;  in l2cap_move_start()
4722 		l2cap_move_setup(chan);  in l2cap_move_start()
4723 		l2cap_send_move_chan_req(chan, 0);  in l2cap_move_start()
4727 static void l2cap_do_create(struct l2cap_chan *chan, int result,  in l2cap_do_create()  argument
4730 	BT_DBG("chan %p state %s %u -> %u", chan, state_to_string(chan->state),  in l2cap_do_create()
4733 	chan->fcs = L2CAP_FCS_NONE;  in l2cap_do_create()
4736 	if (chan->state == BT_CONNECT) {  in l2cap_do_create()
4738 			chan->local_amp_id = local_amp_id;  in l2cap_do_create()
4739 			l2cap_send_create_chan_req(chan, remote_amp_id);  in l2cap_do_create()
4742 			l2cap_send_conn_req(chan);  in l2cap_do_create()
4749 	if (__l2cap_no_conn_pending(chan)) {  in l2cap_do_create()
4752 		rsp.scid = cpu_to_le16(chan->dcid);  in l2cap_do_create()
4753 		rsp.dcid = cpu_to_le16(chan->scid);  in l2cap_do_create()
4765 		l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_RSP,  in l2cap_do_create()
4769 			l2cap_state_change(chan, BT_CONFIG);  in l2cap_do_create()
4770 			set_bit(CONF_REQ_SENT, &chan->conf_state);  in l2cap_do_create()
4771 			l2cap_send_cmd(chan->conn, l2cap_get_ident(chan->conn),  in l2cap_do_create()
4773 				       l2cap_build_conf_req(chan, buf), buf);  in l2cap_do_create()
4774 			chan->num_conf_req++;  in l2cap_do_create()
4779 static void l2cap_do_move_initiate(struct l2cap_chan *chan, u8 local_amp_id,  in l2cap_do_move_initiate()  argument
4782 	l2cap_move_setup(chan);  in l2cap_do_move_initiate()
4783 	chan->move_id = local_amp_id;  in l2cap_do_move_initiate()
4784 	chan->move_state = L2CAP_MOVE_WAIT_RSP;  in l2cap_do_move_initiate()
4786 	l2cap_send_move_chan_req(chan, remote_amp_id);  in l2cap_do_move_initiate()
4789 static void l2cap_do_move_respond(struct l2cap_chan *chan, int result)  in l2cap_do_move_respond()  argument
4798 			chan->hs_hcon = hchan->conn;  in l2cap_do_move_respond()
4799 			chan->hs_hcon->l2cap_data = chan->conn;  in l2cap_do_move_respond()
4800 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;  in l2cap_do_move_respond()
4801 			l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);  in l2cap_do_move_respond()
4803 			l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);  in l2cap_do_move_respond()
4806 			chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;  in l2cap_do_move_respond()
4810 		l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_ALLOWED);  in l2cap_do_move_respond()
4814 static void l2cap_do_move_cancel(struct l2cap_chan *chan, int result)  in l2cap_do_move_cancel()  argument
4816 	if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {  in l2cap_do_move_cancel()
4823 		l2cap_send_move_chan_rsp(chan, rsp_result);  in l2cap_do_move_cancel()
4826 	chan->move_role = L2CAP_MOVE_ROLE_NONE;  in l2cap_do_move_cancel()
4827 	chan->move_state = L2CAP_MOVE_STABLE;  in l2cap_do_move_cancel()
4830 	l2cap_ertm_send(chan);  in l2cap_do_move_cancel()
4834 void __l2cap_physical_cfm(struct l2cap_chan *chan, int result)  in __l2cap_physical_cfm()  argument
4836 	u8 local_amp_id = chan->local_amp_id;  in __l2cap_physical_cfm()
4837 	u8 remote_amp_id = chan->remote_amp_id;  in __l2cap_physical_cfm()
4840 	       chan, result, local_amp_id, remote_amp_id);  in __l2cap_physical_cfm()
4842 	if (chan->state == BT_DISCONN || chan->state == BT_CLOSED) {  in __l2cap_physical_cfm()
4843 		l2cap_chan_unlock(chan);  in __l2cap_physical_cfm()
4847 	if (chan->state != BT_CONNECTED) {  in __l2cap_physical_cfm()
4848 		l2cap_do_create(chan, result, local_amp_id, remote_amp_id);  in __l2cap_physical_cfm()
4850 		l2cap_do_move_cancel(chan, result);  in __l2cap_physical_cfm()
4852 		switch (chan->move_role) {  in __l2cap_physical_cfm()
4854 			l2cap_do_move_initiate(chan, local_amp_id,  in __l2cap_physical_cfm()
4858 			l2cap_do_move_respond(chan, result);  in __l2cap_physical_cfm()
4861 			l2cap_do_move_cancel(chan, result);  in __l2cap_physical_cfm()
4873 	struct l2cap_chan *chan;  in l2cap_move_channel_req()  local
4887 	chan = l2cap_get_chan_by_dcid(conn, icid);  in l2cap_move_channel_req()
4888 	if (!chan) {  in l2cap_move_channel_req()
4896 	chan->ident = cmd->ident;  in l2cap_move_channel_req()
4898 	if (chan->scid < L2CAP_CID_DYN_START ||  in l2cap_move_channel_req()
4899 	    chan->chan_policy == BT_CHANNEL_POLICY_BREDR_ONLY ||  in l2cap_move_channel_req()
4900 	    (chan->mode != L2CAP_MODE_ERTM &&  in l2cap_move_channel_req()
4901 	     chan->mode != L2CAP_MODE_STREAMING)) {  in l2cap_move_channel_req()
4906 	if (chan->local_amp_id == req->dest_amp_id) {  in l2cap_move_channel_req()
4929 	if ((__chan_is_moving(chan) ||  in l2cap_move_channel_req()
4930 	     chan->move_role != L2CAP_MOVE_ROLE_NONE) &&  in l2cap_move_channel_req()
4936 	chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;  in l2cap_move_channel_req()
4937 	l2cap_move_setup(chan);  in l2cap_move_channel_req()
4938 	chan->move_id = req->dest_amp_id;  in l2cap_move_channel_req()
4939 	icid = chan->dcid;  in l2cap_move_channel_req()
4943 		if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_move_channel_req()
4944 			chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;  in l2cap_move_channel_req()
4947 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;  in l2cap_move_channel_req()
4951 		chan->move_state = L2CAP_MOVE_WAIT_PREPARE;  in l2cap_move_channel_req()
4958 	l2cap_send_move_chan_rsp(chan, result);  in l2cap_move_channel_req()
4960 	l2cap_chan_unlock(chan);  in l2cap_move_channel_req()
4967 	struct l2cap_chan *chan;  in l2cap_move_continue()  local
4970 	chan = l2cap_get_chan_by_scid(conn, icid);  in l2cap_move_continue()
4971 	if (!chan) {  in l2cap_move_continue()
4976 	__clear_chan_timer(chan);  in l2cap_move_continue()
4978 		__set_chan_timer(chan, L2CAP_MOVE_ERTX_TIMEOUT);  in l2cap_move_continue()
4980 	switch (chan->move_state) {  in l2cap_move_continue()
4985 		chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;  in l2cap_move_continue()
4991 				    &chan->conn_state)) {  in l2cap_move_continue()
4992 			chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;  in l2cap_move_continue()
4997 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;  in l2cap_move_continue()
4998 			l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);  in l2cap_move_continue()
5007 			chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;  in l2cap_move_continue()
5012 			chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_COMP;  in l2cap_move_continue()
5018 			l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);  in l2cap_move_continue()
5030 		chan->hs_hcon = hchan->conn;  in l2cap_move_continue()
5031 		chan->hs_hcon->l2cap_data = chan->conn;  in l2cap_move_continue()
5035 			l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);  in l2cap_move_continue()
5040 			chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;  in l2cap_move_continue()
5043 		l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);  in l2cap_move_continue()
5047 		chan->move_id = chan->local_amp_id;  in l2cap_move_continue()
5048 		l2cap_move_done(chan);  in l2cap_move_continue()
5049 		l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);  in l2cap_move_continue()
5052 	l2cap_chan_unlock(chan);  in l2cap_move_continue()
5058 	struct l2cap_chan *chan;  in l2cap_move_fail()  local
5060 	chan = l2cap_get_chan_by_ident(conn, ident);  in l2cap_move_fail()
5061 	if (!chan) {  in l2cap_move_fail()
5067 	__clear_chan_timer(chan);  in l2cap_move_fail()
5069 	if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {  in l2cap_move_fail()
5071 			chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;  in l2cap_move_fail()
5074 			chan->move_id = chan->local_amp_id;  in l2cap_move_fail()
5075 			l2cap_move_done(chan);  in l2cap_move_fail()
5079 	l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);  in l2cap_move_fail()
5081 	l2cap_chan_unlock(chan);  in l2cap_move_fail()
5112 	struct l2cap_chan *chan;  in l2cap_move_channel_confirm()  local
5123 	chan = l2cap_get_chan_by_dcid(conn, icid);  in l2cap_move_channel_confirm()
5124 	if (!chan) {  in l2cap_move_channel_confirm()
5130 	if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM) {  in l2cap_move_channel_confirm()
5132 			chan->local_amp_id = chan->move_id;  in l2cap_move_channel_confirm()
5133 			if (chan->local_amp_id == AMP_ID_BREDR)  in l2cap_move_channel_confirm()
5134 				__release_logical_link(chan);  in l2cap_move_channel_confirm()
5136 			chan->move_id = chan->local_amp_id;  in l2cap_move_channel_confirm()
5139 		l2cap_move_done(chan);  in l2cap_move_channel_confirm()
5144 	l2cap_chan_unlock(chan);  in l2cap_move_channel_confirm()
5154 	struct l2cap_chan *chan;  in l2cap_move_channel_confirm_rsp()  local
5164 	chan = l2cap_get_chan_by_scid(conn, icid);  in l2cap_move_channel_confirm_rsp()
5165 	if (!chan)  in l2cap_move_channel_confirm_rsp()
5168 	__clear_chan_timer(chan);  in l2cap_move_channel_confirm_rsp()
5170 	if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM_RSP) {  in l2cap_move_channel_confirm_rsp()
5171 		chan->local_amp_id = chan->move_id;  in l2cap_move_channel_confirm_rsp()
5173 		if (chan->local_amp_id == AMP_ID_BREDR && chan->hs_hchan)  in l2cap_move_channel_confirm_rsp()
5174 			__release_logical_link(chan);  in l2cap_move_channel_confirm_rsp()
5176 		l2cap_move_done(chan);  in l2cap_move_channel_confirm_rsp()
5179 	l2cap_chan_unlock(chan);  in l2cap_move_channel_confirm_rsp()
5241 	struct l2cap_chan *chan;  in l2cap_le_connect_rsp()  local
5263 	chan = __l2cap_get_chan_by_ident(conn, cmd->ident);  in l2cap_le_connect_rsp()
5264 	if (!chan) {  in l2cap_le_connect_rsp()
5271 	l2cap_chan_lock(chan);  in l2cap_le_connect_rsp()
5280 		chan->ident = 0;  in l2cap_le_connect_rsp()
5281 		chan->dcid = dcid;  in l2cap_le_connect_rsp()
5282 		chan->omtu = mtu;  in l2cap_le_connect_rsp()
5283 		chan->remote_mps = mps;  in l2cap_le_connect_rsp()
5284 		chan->tx_credits = credits;  in l2cap_le_connect_rsp()
5285 		l2cap_chan_ready(chan);  in l2cap_le_connect_rsp()
5294 			l2cap_chan_del(chan, ECONNREFUSED);  in l2cap_le_connect_rsp()
5299 		if (chan->sec_level < sec_level)  in l2cap_le_connect_rsp()
5300 			chan->sec_level = sec_level;  in l2cap_le_connect_rsp()
5303 		clear_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags);  in l2cap_le_connect_rsp()
5305 		smp_conn_security(hcon, chan->sec_level);  in l2cap_le_connect_rsp()
5309 		l2cap_chan_del(chan, ECONNREFUSED);  in l2cap_le_connect_rsp()
5313 	l2cap_chan_unlock(chan);  in l2cap_le_connect_rsp()
5407 	struct l2cap_chan *chan, *pchan;  in l2cap_le_connect_req()  local
5433 		chan = NULL;  in l2cap_le_connect_req()
5443 		chan = NULL;  in l2cap_le_connect_req()
5450 		chan = NULL;  in l2cap_le_connect_req()
5457 		chan = NULL;  in l2cap_le_connect_req()
5461 	chan = pchan->ops->new_connection(pchan);  in l2cap_le_connect_req()
5462 	if (!chan) {  in l2cap_le_connect_req()
5467 	l2cap_le_flowctl_init(chan);  in l2cap_le_connect_req()
5469 	bacpy(&chan->src, &conn->hcon->src);  in l2cap_le_connect_req()
5470 	bacpy(&chan->dst, &conn->hcon->dst);  in l2cap_le_connect_req()
5471 	chan->src_type = bdaddr_src_type(conn->hcon);  in l2cap_le_connect_req()
5472 	chan->dst_type = bdaddr_dst_type(conn->hcon);  in l2cap_le_connect_req()
5473 	chan->psm  = psm;  in l2cap_le_connect_req()
5474 	chan->dcid = scid;  in l2cap_le_connect_req()
5475 	chan->omtu = mtu;  in l2cap_le_connect_req()
5476 	chan->remote_mps = mps;  in l2cap_le_connect_req()
5477 	chan->tx_credits = __le16_to_cpu(req->credits);  in l2cap_le_connect_req()
5479 	__l2cap_chan_add(conn, chan);  in l2cap_le_connect_req()
5480 	dcid = chan->scid;  in l2cap_le_connect_req()
5481 	credits = chan->rx_credits;  in l2cap_le_connect_req()
5483 	__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));  in l2cap_le_connect_req()
5485 	chan->ident = cmd->ident;  in l2cap_le_connect_req()
5487 	if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {  in l2cap_le_connect_req()
5488 		l2cap_state_change(chan, BT_CONNECT2);  in l2cap_le_connect_req()
5495 		chan->ops->defer(chan);  in l2cap_le_connect_req()
5497 		l2cap_chan_ready(chan);  in l2cap_le_connect_req()
5510 	if (chan) {  in l2cap_le_connect_req()
5511 		rsp.mtu = cpu_to_le16(chan->imtu);  in l2cap_le_connect_req()
5512 		rsp.mps = cpu_to_le16(chan->mps);  in l2cap_le_connect_req()
5532 	struct l2cap_chan *chan;  in l2cap_le_credits()  local
5544 	chan = l2cap_get_chan_by_dcid(conn, cid);  in l2cap_le_credits()
5545 	if (!chan)  in l2cap_le_credits()
5548 	max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;  in l2cap_le_credits()
5551 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_le_credits()
5552 		l2cap_chan_unlock(chan);  in l2cap_le_credits()
5560 	chan->tx_credits += credits;  in l2cap_le_credits()
5562 	while (chan->tx_credits && !skb_queue_empty(&chan->tx_q)) {  in l2cap_le_credits()
5563 		l2cap_do_send(chan, skb_dequeue(&chan->tx_q));  in l2cap_le_credits()
5564 		chan->tx_credits--;  in l2cap_le_credits()
5567 	if (chan->tx_credits)  in l2cap_le_credits()
5568 		chan->ops->resume(chan);  in l2cap_le_credits()
5570 	l2cap_chan_unlock(chan);  in l2cap_le_credits()
5580 	struct l2cap_chan *chan;  in l2cap_le_command_rej()  local
5587 	chan = __l2cap_get_chan_by_ident(conn, cmd->ident);  in l2cap_le_command_rej()
5588 	if (!chan)  in l2cap_le_command_rej()
5591 	l2cap_chan_lock(chan);  in l2cap_le_command_rej()
5592 	l2cap_chan_del(chan, ECONNREFUSED);  in l2cap_le_command_rej()
5593 	l2cap_chan_unlock(chan);  in l2cap_le_command_rej()
5737 static int l2cap_check_fcs(struct l2cap_chan *chan,  struct sk_buff *skb)  in l2cap_check_fcs()  argument
5742 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_check_fcs()
5747 	if (chan->fcs == L2CAP_FCS_CRC16) {  in l2cap_check_fcs()
5758 static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)  in l2cap_send_i_or_rr_or_rnr()  argument
5762 	BT_DBG("chan %p", chan);  in l2cap_send_i_or_rr_or_rnr()
5767 	control.reqseq = chan->buffer_seq;  in l2cap_send_i_or_rr_or_rnr()
5768 	set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_send_i_or_rr_or_rnr()
5770 	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_send_i_or_rr_or_rnr()
5772 		l2cap_send_sframe(chan, &control);  in l2cap_send_i_or_rr_or_rnr()
5775 	if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&  in l2cap_send_i_or_rr_or_rnr()
5776 	    chan->unacked_frames > 0)  in l2cap_send_i_or_rr_or_rnr()
5777 		__set_retrans_timer(chan);  in l2cap_send_i_or_rr_or_rnr()
5780 	l2cap_ertm_send(chan);  in l2cap_send_i_or_rr_or_rnr()
5782 	if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&  in l2cap_send_i_or_rr_or_rnr()
5783 	    test_bit(CONN_SEND_FBIT, &chan->conn_state)) {  in l2cap_send_i_or_rr_or_rnr()
5788 		l2cap_send_sframe(chan, &control);  in l2cap_send_i_or_rr_or_rnr()
5811 static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,  in l2cap_reassemble_sdu()  argument
5818 		if (chan->sdu)  in l2cap_reassemble_sdu()
5821 		err = chan->ops->recv(chan, skb);  in l2cap_reassemble_sdu()
5825 		if (chan->sdu)  in l2cap_reassemble_sdu()
5828 		chan->sdu_len = get_unaligned_le16(skb->data);  in l2cap_reassemble_sdu()
5831 		if (chan->sdu_len > chan->imtu) {  in l2cap_reassemble_sdu()
5836 		if (skb->len >= chan->sdu_len)  in l2cap_reassemble_sdu()
5839 		chan->sdu = skb;  in l2cap_reassemble_sdu()
5840 		chan->sdu_last_frag = skb;  in l2cap_reassemble_sdu()
5847 		if (!chan->sdu)  in l2cap_reassemble_sdu()
5850 		append_skb_frag(chan->sdu, skb,  in l2cap_reassemble_sdu()
5851 				&chan->sdu_last_frag);  in l2cap_reassemble_sdu()
5854 		if (chan->sdu->len >= chan->sdu_len)  in l2cap_reassemble_sdu()
5861 		if (!chan->sdu)  in l2cap_reassemble_sdu()
5864 		append_skb_frag(chan->sdu, skb,  in l2cap_reassemble_sdu()
5865 				&chan->sdu_last_frag);  in l2cap_reassemble_sdu()
5868 		if (chan->sdu->len != chan->sdu_len)  in l2cap_reassemble_sdu()
5871 		err = chan->ops->recv(chan, chan->sdu);  in l2cap_reassemble_sdu()
5875 			chan->sdu = NULL;  in l2cap_reassemble_sdu()
5876 			chan->sdu_last_frag = NULL;  in l2cap_reassemble_sdu()
5877 			chan->sdu_len = 0;  in l2cap_reassemble_sdu()
5884 		kfree_skb(chan->sdu);  in l2cap_reassemble_sdu()
5885 		chan->sdu = NULL;  in l2cap_reassemble_sdu()
5886 		chan->sdu_last_frag = NULL;  in l2cap_reassemble_sdu()
5887 		chan->sdu_len = 0;  in l2cap_reassemble_sdu()
5893 static int l2cap_resegment(struct l2cap_chan *chan)  in l2cap_resegment()  argument
5899 void l2cap_chan_busy(struct l2cap_chan *chan, int busy)  in l2cap_chan_busy()  argument
5903 	if (chan->mode != L2CAP_MODE_ERTM)  in l2cap_chan_busy()
5907 	l2cap_tx(chan, NULL, NULL, event);  in l2cap_chan_busy()
5910 static int l2cap_rx_queued_iframes(struct l2cap_chan *chan)  in l2cap_rx_queued_iframes()  argument
5917 	BT_DBG("chan %p", chan);  in l2cap_rx_queued_iframes()
5919 	while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_rx_queued_iframes()
5922 		       chan->buffer_seq, skb_queue_len(&chan->srej_q));  in l2cap_rx_queued_iframes()
5924 		skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq);  in l2cap_rx_queued_iframes()
5929 		skb_unlink(skb, &chan->srej_q);  in l2cap_rx_queued_iframes()
5930 		chan->buffer_seq = __next_seq(chan, chan->buffer_seq);  in l2cap_rx_queued_iframes()
5931 		err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->l2cap);  in l2cap_rx_queued_iframes()
5936 	if (skb_queue_empty(&chan->srej_q)) {  in l2cap_rx_queued_iframes()
5937 		chan->rx_state = L2CAP_RX_STATE_RECV;  in l2cap_rx_queued_iframes()
5938 		l2cap_send_ack(chan);  in l2cap_rx_queued_iframes()
5944 static void l2cap_handle_srej(struct l2cap_chan *chan,  in l2cap_handle_srej()  argument
5949 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_handle_srej()
5951 	if (control->reqseq == chan->next_tx_seq) {  in l2cap_handle_srej()
5953 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_handle_srej()
5957 	skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);  in l2cap_handle_srej()
5965 	if (chan->max_tx != 0 && bt_cb(skb)->l2cap.retries >= chan->max_tx) {  in l2cap_handle_srej()
5966 		BT_DBG("Retry limit exceeded (%d)", chan->max_tx);  in l2cap_handle_srej()
5967 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_handle_srej()
5971 	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_handle_srej()
5974 		l2cap_pass_to_tx(chan, control);  in l2cap_handle_srej()
5976 		set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_handle_srej()
5977 		l2cap_retransmit(chan, control);  in l2cap_handle_srej()
5978 		l2cap_ertm_send(chan);  in l2cap_handle_srej()
5980 		if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {  in l2cap_handle_srej()
5981 			set_bit(CONN_SREJ_ACT, &chan->conn_state);  in l2cap_handle_srej()
5982 			chan->srej_save_reqseq = control->reqseq;  in l2cap_handle_srej()
5985 		l2cap_pass_to_tx_fbit(chan, control);  in l2cap_handle_srej()
5988 			if (chan->srej_save_reqseq != control->reqseq ||  in l2cap_handle_srej()
5990 						&chan->conn_state))  in l2cap_handle_srej()
5991 				l2cap_retransmit(chan, control);  in l2cap_handle_srej()
5993 			l2cap_retransmit(chan, control);  in l2cap_handle_srej()
5994 			if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {  in l2cap_handle_srej()
5995 				set_bit(CONN_SREJ_ACT, &chan->conn_state);  in l2cap_handle_srej()
5996 				chan->srej_save_reqseq = control->reqseq;  in l2cap_handle_srej()
6002 static void l2cap_handle_rej(struct l2cap_chan *chan,  in l2cap_handle_rej()  argument
6007 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_handle_rej()
6009 	if (control->reqseq == chan->next_tx_seq) {  in l2cap_handle_rej()
6011 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_handle_rej()
6015 	skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);  in l2cap_handle_rej()
6017 	if (chan->max_tx && skb &&  in l2cap_handle_rej()
6018 	    bt_cb(skb)->l2cap.retries >= chan->max_tx) {  in l2cap_handle_rej()
6019 		BT_DBG("Retry limit exceeded (%d)", chan->max_tx);  in l2cap_handle_rej()
6020 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_handle_rej()
6024 	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_handle_rej()
6026 	l2cap_pass_to_tx(chan, control);  in l2cap_handle_rej()
6029 		if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))  in l2cap_handle_rej()
6030 			l2cap_retransmit_all(chan, control);  in l2cap_handle_rej()
6032 		l2cap_retransmit_all(chan, control);  in l2cap_handle_rej()
6033 		l2cap_ertm_send(chan);  in l2cap_handle_rej()
6034 		if (chan->tx_state == L2CAP_TX_STATE_WAIT_F)  in l2cap_handle_rej()
6035 			set_bit(CONN_REJ_ACT, &chan->conn_state);  in l2cap_handle_rej()
6039 static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq)  in l2cap_classify_txseq()  argument
6041 	BT_DBG("chan %p, txseq %d", chan, txseq);  in l2cap_classify_txseq()
6043 	BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq,  in l2cap_classify_txseq()
6044 	       chan->expected_tx_seq);  in l2cap_classify_txseq()
6046 	if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {  in l2cap_classify_txseq()
6047 		if (__seq_offset(chan, txseq, chan->last_acked_seq) >=  in l2cap_classify_txseq()
6048 		    chan->tx_win) {  in l2cap_classify_txseq()
6052 			if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {  in l2cap_classify_txseq()
6061 		if (chan->srej_list.head == txseq) {  in l2cap_classify_txseq()
6066 		if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) {  in l2cap_classify_txseq()
6071 		if (l2cap_seq_list_contains(&chan->srej_list, txseq)) {  in l2cap_classify_txseq()
6077 	if (chan->expected_tx_seq == txseq) {  in l2cap_classify_txseq()
6078 		if (__seq_offset(chan, txseq, chan->last_acked_seq) >=  in l2cap_classify_txseq()
6079 		    chan->tx_win) {  in l2cap_classify_txseq()
6088 	if (__seq_offset(chan, txseq, chan->last_acked_seq) <  in l2cap_classify_txseq()
6089 	    __seq_offset(chan, chan->expected_tx_seq, chan->last_acked_seq)) {  in l2cap_classify_txseq()
6094 	if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) {  in l2cap_classify_txseq()
6112 		if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {  in l2cap_classify_txseq()
6125 static int l2cap_rx_state_recv(struct l2cap_chan *chan,  in l2cap_rx_state_recv()  argument
6132 	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,  in l2cap_rx_state_recv()
6137 		switch (l2cap_classify_txseq(chan, control->txseq)) {  in l2cap_rx_state_recv()
6139 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
6141 			if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_rx_state_recv()
6147 			chan->expected_tx_seq = __next_seq(chan,  in l2cap_rx_state_recv()
6150 			chan->buffer_seq = chan->expected_tx_seq;  in l2cap_rx_state_recv()
6153 			err = l2cap_reassemble_sdu(chan, skb, control);  in l2cap_rx_state_recv()
6159 							&chan->conn_state)) {  in l2cap_rx_state_recv()
6161 					l2cap_retransmit_all(chan, control);  in l2cap_rx_state_recv()
6162 					l2cap_ertm_send(chan);  in l2cap_rx_state_recv()
6166 			if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state))  in l2cap_rx_state_recv()
6167 				l2cap_send_ack(chan);  in l2cap_rx_state_recv()
6170 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
6176 			if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_rx_state_recv()
6186 			skb_queue_tail(&chan->srej_q, skb);  in l2cap_rx_state_recv()
6189 			       skb_queue_len(&chan->srej_q));  in l2cap_rx_state_recv()
6191 			clear_bit(CONN_SREJ_ACT, &chan->conn_state);  in l2cap_rx_state_recv()
6192 			l2cap_seq_list_clear(&chan->srej_list);  in l2cap_rx_state_recv()
6193 			l2cap_send_srej(chan, control->txseq);  in l2cap_rx_state_recv()
6195 			chan->rx_state = L2CAP_RX_STATE_SREJ_SENT;  in l2cap_rx_state_recv()
6198 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
6204 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_rx_state_recv()
6209 		l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
6211 			clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_rx_state_recv()
6213 			if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state) &&  in l2cap_rx_state_recv()
6214 			    !__chan_is_moving(chan)) {  in l2cap_rx_state_recv()
6216 				l2cap_retransmit_all(chan, control);  in l2cap_rx_state_recv()
6219 			l2cap_ertm_send(chan);  in l2cap_rx_state_recv()
6221 			l2cap_send_i_or_rr_or_rnr(chan);  in l2cap_rx_state_recv()
6224 					       &chan->conn_state) &&  in l2cap_rx_state_recv()
6225 			    chan->unacked_frames)  in l2cap_rx_state_recv()
6226 				__set_retrans_timer(chan);  in l2cap_rx_state_recv()
6228 			l2cap_ertm_send(chan);  in l2cap_rx_state_recv()
6232 		set_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_rx_state_recv()
6233 		l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
6235 			set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_rx_state_recv()
6236 			l2cap_send_rr_or_rnr(chan, 0);  in l2cap_rx_state_recv()
6238 		__clear_retrans_timer(chan);  in l2cap_rx_state_recv()
6239 		l2cap_seq_list_clear(&chan->retrans_list);  in l2cap_rx_state_recv()
6242 		l2cap_handle_rej(chan, control);  in l2cap_rx_state_recv()
6245 		l2cap_handle_srej(chan, control);  in l2cap_rx_state_recv()
6259 static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,  in l2cap_rx_state_srej_sent()  argument
6267 	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,  in l2cap_rx_state_srej_sent()
6272 		switch (l2cap_classify_txseq(chan, txseq)) {  in l2cap_rx_state_srej_sent()
6275 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
6276 			skb_queue_tail(&chan->srej_q, skb);  in l2cap_rx_state_srej_sent()
6279 			       skb_queue_len(&chan->srej_q));  in l2cap_rx_state_srej_sent()
6281 			chan->expected_tx_seq = __next_seq(chan, txseq);  in l2cap_rx_state_srej_sent()
6284 			l2cap_seq_list_pop(&chan->srej_list);  in l2cap_rx_state_srej_sent()
6286 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
6287 			skb_queue_tail(&chan->srej_q, skb);  in l2cap_rx_state_srej_sent()
6290 			       skb_queue_len(&chan->srej_q));  in l2cap_rx_state_srej_sent()
6292 			err = l2cap_rx_queued_iframes(chan);  in l2cap_rx_state_srej_sent()
6302 			skb_queue_tail(&chan->srej_q, skb);  in l2cap_rx_state_srej_sent()
6305 			       skb_queue_len(&chan->srej_q));  in l2cap_rx_state_srej_sent()
6307 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
6308 			l2cap_send_srej(chan, control->txseq);  in l2cap_rx_state_srej_sent()
6316 			skb_queue_tail(&chan->srej_q, skb);  in l2cap_rx_state_srej_sent()
6319 			       skb_queue_len(&chan->srej_q));  in l2cap_rx_state_srej_sent()
6321 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
6322 			l2cap_send_srej_list(chan, control->txseq);  in l2cap_rx_state_srej_sent()
6326 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
6337 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_rx_state_srej_sent()
6342 		l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
6344 			clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_rx_state_srej_sent()
6347 						&chan->conn_state)) {  in l2cap_rx_state_srej_sent()
6349 				l2cap_retransmit_all(chan, control);  in l2cap_rx_state_srej_sent()
6352 			l2cap_ertm_send(chan);  in l2cap_rx_state_srej_sent()
6355 					       &chan->conn_state) &&  in l2cap_rx_state_srej_sent()
6356 			    chan->unacked_frames) {  in l2cap_rx_state_srej_sent()
6357 				__set_retrans_timer(chan);  in l2cap_rx_state_srej_sent()
6360 			set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_rx_state_srej_sent()
6361 			l2cap_send_srej_tail(chan);  in l2cap_rx_state_srej_sent()
6364 					       &chan->conn_state) &&  in l2cap_rx_state_srej_sent()
6365 			    chan->unacked_frames)  in l2cap_rx_state_srej_sent()
6366 				__set_retrans_timer(chan);  in l2cap_rx_state_srej_sent()
6368 			l2cap_send_ack(chan);  in l2cap_rx_state_srej_sent()
6372 		set_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_rx_state_srej_sent()
6373 		l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
6375 			l2cap_send_srej_tail(chan);  in l2cap_rx_state_srej_sent()
6381 			rr_control.reqseq = chan->buffer_seq;  in l2cap_rx_state_srej_sent()
6382 			l2cap_send_sframe(chan, &rr_control);  in l2cap_rx_state_srej_sent()
6387 		l2cap_handle_rej(chan, control);  in l2cap_rx_state_srej_sent()
6390 		l2cap_handle_srej(chan, control);  in l2cap_rx_state_srej_sent()
6402 static int l2cap_finish_move(struct l2cap_chan *chan)  in l2cap_finish_move()  argument
6404 	BT_DBG("chan %p", chan);  in l2cap_finish_move()
6406 	chan->rx_state = L2CAP_RX_STATE_RECV;  in l2cap_finish_move()
6408 	if (chan->hs_hcon)  in l2cap_finish_move()
6409 		chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;  in l2cap_finish_move()
6411 		chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;  in l2cap_finish_move()
6413 	return l2cap_resegment(chan);  in l2cap_finish_move()
6416 static int l2cap_rx_state_wait_p(struct l2cap_chan *chan,  in l2cap_rx_state_wait_p()  argument
6422 	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,  in l2cap_rx_state_wait_p()
6428 	l2cap_process_reqseq(chan, control->reqseq);  in l2cap_rx_state_wait_p()
6430 	if (!skb_queue_empty(&chan->tx_q))  in l2cap_rx_state_wait_p()
6431 		chan->tx_send_head = skb_peek(&chan->tx_q);  in l2cap_rx_state_wait_p()
6433 		chan->tx_send_head = NULL;  in l2cap_rx_state_wait_p()
6438 	chan->next_tx_seq = control->reqseq;  in l2cap_rx_state_wait_p()
6439 	chan->unacked_frames = 0;  in l2cap_rx_state_wait_p()
6441 	err = l2cap_finish_move(chan);  in l2cap_rx_state_wait_p()
6445 	set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_rx_state_wait_p()
6446 	l2cap_send_i_or_rr_or_rnr(chan);  in l2cap_rx_state_wait_p()
6451 	return l2cap_rx_state_recv(chan, control, NULL, event);  in l2cap_rx_state_wait_p()
6454 static int l2cap_rx_state_wait_f(struct l2cap_chan *chan,  in l2cap_rx_state_wait_f()  argument
6463 	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_rx_state_wait_f()
6465 	chan->rx_state = L2CAP_RX_STATE_RECV;  in l2cap_rx_state_wait_f()
6466 	l2cap_process_reqseq(chan, control->reqseq);  in l2cap_rx_state_wait_f()
6468 	if (!skb_queue_empty(&chan->tx_q))  in l2cap_rx_state_wait_f()
6469 		chan->tx_send_head = skb_peek(&chan->tx_q);  in l2cap_rx_state_wait_f()
6471 		chan->tx_send_head = NULL;  in l2cap_rx_state_wait_f()
6476 	chan->next_tx_seq = control->reqseq;  in l2cap_rx_state_wait_f()
6477 	chan->unacked_frames = 0;  in l2cap_rx_state_wait_f()
6479 	if (chan->hs_hcon)  in l2cap_rx_state_wait_f()
6480 		chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;  in l2cap_rx_state_wait_f()
6482 		chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;  in l2cap_rx_state_wait_f()
6484 	err = l2cap_resegment(chan);  in l2cap_rx_state_wait_f()
6487 		err = l2cap_rx_state_recv(chan, control, skb, event);  in l2cap_rx_state_wait_f()
6492 static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq)  in __valid_reqseq()  argument
6497 	unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq);  in __valid_reqseq()
6498 	return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked;  in __valid_reqseq()
6501 static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,  in l2cap_rx()  argument
6506 	BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan,  in l2cap_rx()
6507 	       control, skb, event, chan->rx_state);  in l2cap_rx()
6509 	if (__valid_reqseq(chan, control->reqseq)) {  in l2cap_rx()
6510 		switch (chan->rx_state) {  in l2cap_rx()
6512 			err = l2cap_rx_state_recv(chan, control, skb, event);  in l2cap_rx()
6515 			err = l2cap_rx_state_srej_sent(chan, control, skb,  in l2cap_rx()
6519 			err = l2cap_rx_state_wait_p(chan, control, skb, event);  in l2cap_rx()
6522 			err = l2cap_rx_state_wait_f(chan, control, skb, event);  in l2cap_rx()
6530 		       control->reqseq, chan->next_tx_seq,  in l2cap_rx()
6531 		       chan->expected_ack_seq);  in l2cap_rx()
6532 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_rx()
6538 static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,  in l2cap_stream_rx()  argument
6543 	BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb,  in l2cap_stream_rx()
6544 	       chan->rx_state);  in l2cap_stream_rx()
6546 	if (l2cap_classify_txseq(chan, control->txseq) ==  in l2cap_stream_rx()
6548 		l2cap_pass_to_tx(chan, control);  in l2cap_stream_rx()
6550 		BT_DBG("buffer_seq %d->%d", chan->buffer_seq,  in l2cap_stream_rx()
6551 		       __next_seq(chan, chan->buffer_seq));  in l2cap_stream_rx()
6553 		chan->buffer_seq = __next_seq(chan, chan->buffer_seq);  in l2cap_stream_rx()
6555 		l2cap_reassemble_sdu(chan, skb, control);  in l2cap_stream_rx()
6557 		if (chan->sdu) {  in l2cap_stream_rx()
6558 			kfree_skb(chan->sdu);  in l2cap_stream_rx()
6559 			chan->sdu = NULL;  in l2cap_stream_rx()
6561 		chan->sdu_last_frag = NULL;  in l2cap_stream_rx()
6562 		chan->sdu_len = 0;  in l2cap_stream_rx()
6570 	chan->last_acked_seq = control->txseq;  in l2cap_stream_rx()
6571 	chan->expected_tx_seq = __next_seq(chan, control->txseq);  in l2cap_stream_rx()
6576 static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)  in l2cap_data_rcv()  argument
6582 	__unpack_control(chan, skb);  in l2cap_data_rcv()
6591 	if (l2cap_check_fcs(chan, skb))  in l2cap_data_rcv()
6597 	if (chan->fcs == L2CAP_FCS_CRC16)  in l2cap_data_rcv()
6600 	if (len > chan->mps) {  in l2cap_data_rcv()
6601 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_data_rcv()
6615 		if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F)  in l2cap_data_rcv()
6618 		if (chan->mode != L2CAP_MODE_STREAMING) {  in l2cap_data_rcv()
6620 			err = l2cap_rx(chan, control, skb, event);  in l2cap_data_rcv()
6622 			err = l2cap_stream_rx(chan, control, skb);  in l2cap_data_rcv()
6626 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_data_rcv()
6634 		if (chan->mode == L2CAP_MODE_STREAMING)  in l2cap_data_rcv()
6643 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_data_rcv()
6649 				       chan->tx_state != L2CAP_TX_STATE_WAIT_F))  in l2cap_data_rcv()
6653 		if (l2cap_rx(chan, control, skb, event))  in l2cap_data_rcv()
6654 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_data_rcv()
6664 static void l2cap_chan_le_send_credits(struct l2cap_chan *chan)  in l2cap_chan_le_send_credits()  argument
6666 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_le_send_credits()
6673 	if (chan->rx_credits >= (le_max_credits + 1) / 2)  in l2cap_chan_le_send_credits()
6676 	return_credits = le_max_credits - chan->rx_credits;  in l2cap_chan_le_send_credits()
6678 	BT_DBG("chan %p returning %u credits to sender", chan, return_credits);  in l2cap_chan_le_send_credits()
6680 	chan->rx_credits += return_credits;  in l2cap_chan_le_send_credits()
6682 	pkt.cid     = cpu_to_le16(chan->scid);  in l2cap_chan_le_send_credits()
6685 	chan->ident = l2cap_get_ident(conn);  in l2cap_chan_le_send_credits()
6687 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CREDITS, sizeof(pkt), &pkt);  in l2cap_chan_le_send_credits()
6690 static int l2cap_le_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)  in l2cap_le_data_rcv()  argument
6694 	if (!chan->rx_credits) {  in l2cap_le_data_rcv()
6696 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_le_data_rcv()
6700 	if (chan->imtu < skb->len) {  in l2cap_le_data_rcv()
6705 	chan->rx_credits--;  in l2cap_le_data_rcv()
6706 	BT_DBG("rx_credits %u -> %u", chan->rx_credits + 1, chan->rx_credits);  in l2cap_le_data_rcv()
6708 	l2cap_chan_le_send_credits(chan);  in l2cap_le_data_rcv()
6712 	if (!chan->sdu) {  in l2cap_le_data_rcv()
6719 		       sdu_len, skb->len, chan->imtu);  in l2cap_le_data_rcv()
6721 		if (sdu_len > chan->imtu) {  in l2cap_le_data_rcv()
6734 			return chan->ops->recv(chan, skb);  in l2cap_le_data_rcv()
6736 		chan->sdu = skb;  in l2cap_le_data_rcv()
6737 		chan->sdu_len = sdu_len;  in l2cap_le_data_rcv()
6738 		chan->sdu_last_frag = skb;  in l2cap_le_data_rcv()
6744 	       chan->sdu->len, skb->len, chan->sdu_len);  in l2cap_le_data_rcv()
6746 	if (chan->sdu->len + skb->len > chan->sdu_len) {  in l2cap_le_data_rcv()
6752 	append_skb_frag(chan->sdu, skb, &chan->sdu_last_frag);  in l2cap_le_data_rcv()
6755 	if (chan->sdu->len == chan->sdu_len) {  in l2cap_le_data_rcv()
6756 		err = chan->ops->recv(chan, chan->sdu);  in l2cap_le_data_rcv()
6758 			chan->sdu = NULL;  in l2cap_le_data_rcv()
6759 			chan->sdu_last_frag = NULL;  in l2cap_le_data_rcv()
6760 			chan->sdu_len = 0;  in l2cap_le_data_rcv()
6767 		kfree_skb(chan->sdu);  in l2cap_le_data_rcv()
6768 		chan->sdu = NULL;  in l2cap_le_data_rcv()
6769 		chan->sdu_last_frag = NULL;  in l2cap_le_data_rcv()
6770 		chan->sdu_len = 0;  in l2cap_le_data_rcv()
6783 	struct l2cap_chan *chan;  in l2cap_data_channel()  local
6785 	chan = l2cap_get_chan_by_scid(conn, cid);  in l2cap_data_channel()
6786 	if (!chan) {  in l2cap_data_channel()
6788 			chan = a2mp_channel_create(conn, skb);  in l2cap_data_channel()
6789 			if (!chan) {  in l2cap_data_channel()
6794 			l2cap_chan_lock(chan);  in l2cap_data_channel()
6803 	BT_DBG("chan %p, len %d", chan, skb->len);  in l2cap_data_channel()
6809 	if (chan->chan_type == L2CAP_CHAN_FIXED)  in l2cap_data_channel()
6810 		l2cap_chan_ready(chan);  in l2cap_data_channel()
6812 	if (chan->state != BT_CONNECTED)  in l2cap_data_channel()
6815 	switch (chan->mode) {  in l2cap_data_channel()
6817 		if (l2cap_le_data_rcv(chan, skb) < 0)  in l2cap_data_channel()
6828 		if (chan->imtu < skb->len) {  in l2cap_data_channel()
6833 		if (!chan->ops->recv(chan, skb))  in l2cap_data_channel()
6839 		l2cap_data_rcv(chan, skb);  in l2cap_data_channel()
6843 		BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);  in l2cap_data_channel()
6851 	l2cap_chan_unlock(chan);  in l2cap_data_channel()
6858 	struct l2cap_chan *chan;  in l2cap_conless_channel()  local
6863 	chan = l2cap_global_chan_by_psm(0, psm, &hcon->src, &hcon->dst,  in l2cap_conless_channel()
6865 	if (!chan)  in l2cap_conless_channel()
6868 	BT_DBG("chan %p, len %d", chan, skb->len);  in l2cap_conless_channel()
6870 	if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)  in l2cap_conless_channel()
6873 	if (chan->imtu < skb->len)  in l2cap_conless_channel()
6880 	if (!chan->ops->recv(chan, skb)) {  in l2cap_conless_channel()
6881 		l2cap_chan_put(chan);  in l2cap_conless_channel()
6886 	l2cap_chan_put(chan);  in l2cap_conless_channel()
7036 int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,  in l2cap_chan_connect()  argument
7044 	BT_DBG("%pMR -> %pMR (type %u) psm 0x%2.2x", &chan->src, dst,  in l2cap_chan_connect()
7047 	hdev = hci_get_route(dst, &chan->src);  in l2cap_chan_connect()
7054 	    chan->chan_type != L2CAP_CHAN_RAW) {  in l2cap_chan_connect()
7059 	if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !psm) {  in l2cap_chan_connect()
7064 	if (chan->chan_type == L2CAP_CHAN_FIXED && !cid) {  in l2cap_chan_connect()
7069 	switch (chan->mode) {  in l2cap_chan_connect()
7073 		l2cap_le_flowctl_init(chan);  in l2cap_chan_connect()
7085 	switch (chan->state) {  in l2cap_chan_connect()
7109 	bacpy(&chan->dst, dst);  in l2cap_chan_connect()
7110 	chan->dst_type = dst_type;  in l2cap_chan_connect()
7112 	chan->psm = psm;  in l2cap_chan_connect()
7113 	chan->dcid = cid;  in l2cap_chan_connect()
7131 					   chan->sec_level,  in l2cap_chan_connect()
7135 		u8 auth_type = l2cap_get_auth_type(chan);  in l2cap_chan_connect()
7136 		hcon = hci_connect_acl(hdev, dst, chan->sec_level, auth_type);  in l2cap_chan_connect()
7152 	l2cap_chan_lock(chan);  in l2cap_chan_connect()
7161 	bacpy(&chan->src, &hcon->src);  in l2cap_chan_connect()
7162 	chan->src_type = bdaddr_src_type(hcon);  in l2cap_chan_connect()
7164 	__l2cap_chan_add(conn, chan);  in l2cap_chan_connect()
7169 	l2cap_state_change(chan, BT_CONNECT);  in l2cap_chan_connect()
7170 	__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));  in l2cap_chan_connect()
7176 	chan->sport = 0;  in l2cap_chan_connect()
7180 		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {  in l2cap_chan_connect()
7181 			__clear_chan_timer(chan);  in l2cap_chan_connect()
7182 			if (l2cap_chan_check_security(chan, true))  in l2cap_chan_connect()
7183 				l2cap_state_change(chan, BT_CONNECTED);  in l2cap_chan_connect()
7185 			l2cap_do_start(chan);  in l2cap_chan_connect()
7191 	l2cap_chan_unlock(chan);  in l2cap_chan_connect()
7301 		struct l2cap_chan *chan, *next;  in l2cap_connect_cfm()  local
7308 		chan = pchan->ops->new_connection(pchan);  in l2cap_connect_cfm()
7309 		if (chan) {  in l2cap_connect_cfm()
7310 			bacpy(&chan->src, &hcon->src);  in l2cap_connect_cfm()
7311 			bacpy(&chan->dst, &hcon->dst);  in l2cap_connect_cfm()
7312 			chan->src_type = bdaddr_src_type(hcon);  in l2cap_connect_cfm()
7313 			chan->dst_type = dst_type;  in l2cap_connect_cfm()
7315 			__l2cap_chan_add(conn, chan);  in l2cap_connect_cfm()
7349 static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)  in l2cap_check_encryption()  argument
7351 	if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)  in l2cap_check_encryption()
7355 		if (chan->sec_level == BT_SECURITY_MEDIUM) {  in l2cap_check_encryption()
7356 			__set_chan_timer(chan, L2CAP_ENC_TIMEOUT);  in l2cap_check_encryption()
7357 		} else if (chan->sec_level == BT_SECURITY_HIGH ||  in l2cap_check_encryption()
7358 			   chan->sec_level == BT_SECURITY_FIPS)  in l2cap_check_encryption()
7359 			l2cap_chan_close(chan, ECONNREFUSED);  in l2cap_check_encryption()
7361 		if (chan->sec_level == BT_SECURITY_MEDIUM)  in l2cap_check_encryption()
7362 			__clear_chan_timer(chan);  in l2cap_check_encryption()
7369 	struct l2cap_chan *chan;  in l2cap_security_cfm()  local
7378 	list_for_each_entry(chan, &conn->chan_l, list) {  in l2cap_security_cfm()
7379 		l2cap_chan_lock(chan);  in l2cap_security_cfm()
7381 		BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid,  in l2cap_security_cfm()
7382 		       state_to_string(chan->state));  in l2cap_security_cfm()
7384 		if (chan->scid == L2CAP_CID_A2MP) {  in l2cap_security_cfm()
7385 			l2cap_chan_unlock(chan);  in l2cap_security_cfm()
7390 			chan->sec_level = hcon->sec_level;  in l2cap_security_cfm()
7392 		if (!__l2cap_no_conn_pending(chan)) {  in l2cap_security_cfm()
7393 			l2cap_chan_unlock(chan);  in l2cap_security_cfm()
7397 		if (!status && (chan->state == BT_CONNECTED ||  in l2cap_security_cfm()
7398 				chan->state == BT_CONFIG)) {  in l2cap_security_cfm()
7399 			chan->ops->resume(chan);  in l2cap_security_cfm()
7400 			l2cap_check_encryption(chan, encrypt);  in l2cap_security_cfm()
7401 			l2cap_chan_unlock(chan);  in l2cap_security_cfm()
7405 		if (chan->state == BT_CONNECT) {  in l2cap_security_cfm()
7407 				l2cap_start_connection(chan);  in l2cap_security_cfm()
7409 				__set_chan_timer(chan, L2CAP_DISC_TIMEOUT);  in l2cap_security_cfm()
7410 		} else if (chan->state == BT_CONNECT2 &&  in l2cap_security_cfm()
7411 			   chan->mode != L2CAP_MODE_LE_FLOWCTL) {  in l2cap_security_cfm()
7416 				if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {  in l2cap_security_cfm()
7419 					chan->ops->defer(chan);  in l2cap_security_cfm()
7421 					l2cap_state_change(chan, BT_CONFIG);  in l2cap_security_cfm()
7426 				l2cap_state_change(chan, BT_DISCONN);  in l2cap_security_cfm()
7427 				__set_chan_timer(chan, L2CAP_DISC_TIMEOUT);  in l2cap_security_cfm()
7432 			rsp.scid   = cpu_to_le16(chan->dcid);  in l2cap_security_cfm()
7433 			rsp.dcid   = cpu_to_le16(chan->scid);  in l2cap_security_cfm()
7436 			l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,  in l2cap_security_cfm()
7439 			if (!test_bit(CONF_REQ_SENT, &chan->conf_state) &&  in l2cap_security_cfm()
7442 				set_bit(CONF_REQ_SENT, &chan->conf_state);  in l2cap_security_cfm()
7445 					       l2cap_build_conf_req(chan, buf),  in l2cap_security_cfm()
7447 				chan->num_conf_req++;  in l2cap_security_cfm()
7451 		l2cap_chan_unlock(chan);  in l2cap_security_cfm()