61 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size);
62 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err);
64 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
185 int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)  in l2cap_add_psm()  argument
197 		chan->psm = psm;  in l2cap_add_psm()
198 		chan->sport = psm;  in l2cap_add_psm()
203 		if (chan->src_type == BDADDR_BREDR) {  in l2cap_add_psm()
216 				chan->psm   = cpu_to_le16(p);  in l2cap_add_psm()
217 				chan->sport = cpu_to_le16(p);  in l2cap_add_psm()
229 int l2cap_add_scid(struct l2cap_chan *chan,  __u16 scid)  in l2cap_add_scid()  argument
234 	chan->omtu = L2CAP_DEFAULT_MTU;  in l2cap_add_scid()
235 	chan->chan_type = L2CAP_CHAN_FIXED;  in l2cap_add_scid()
237 	chan->scid = scid;  in l2cap_add_scid()
261 static void l2cap_state_change(struct l2cap_chan *chan, int state)  in l2cap_state_change()  argument
263 	BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),  in l2cap_state_change()
266 	chan->state = state;  in l2cap_state_change()
267 	chan->ops->state_change(chan, state, 0);  in l2cap_state_change()
270 static inline void l2cap_state_change_and_error(struct l2cap_chan *chan,  in l2cap_state_change_and_error()  argument
273 	chan->state = state;  in l2cap_state_change_and_error()
274 	chan->ops->state_change(chan, chan->state, err);  in l2cap_state_change_and_error()
277 static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)  in l2cap_chan_set_err()  argument
279 	chan->ops->state_change(chan, chan->state, err);  in l2cap_chan_set_err()
282 static void __set_retrans_timer(struct l2cap_chan *chan)  in __set_retrans_timer()  argument
284 	if (!delayed_work_pending(&chan->monitor_timer) &&  in __set_retrans_timer()
285 	    chan->retrans_timeout) {  in __set_retrans_timer()
286 		l2cap_set_timer(chan, &chan->retrans_timer,  in __set_retrans_timer()
287 				msecs_to_jiffies(chan->retrans_timeout));  in __set_retrans_timer()
291 static void __set_monitor_timer(struct l2cap_chan *chan)  in __set_monitor_timer()  argument
293 	__clear_retrans_timer(chan);  in __set_monitor_timer()
294 	if (chan->monitor_timeout) {  in __set_monitor_timer()
295 		l2cap_set_timer(chan, &chan->monitor_timer,  in __set_monitor_timer()
296 				msecs_to_jiffies(chan->monitor_timeout));  in __set_monitor_timer()
409 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,  in l2cap_chan_timeout()  local
411 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_timeout()
414 	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));  in l2cap_chan_timeout()
417 	l2cap_chan_lock(chan);  in l2cap_chan_timeout()
419 	if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)  in l2cap_chan_timeout()
421 	else if (chan->state == BT_CONNECT &&  in l2cap_chan_timeout()
422 		 chan->sec_level != BT_SECURITY_SDP)  in l2cap_chan_timeout()
427 	l2cap_chan_close(chan, reason);  in l2cap_chan_timeout()
429 	l2cap_chan_unlock(chan);  in l2cap_chan_timeout()
431 	chan->ops->close(chan);  in l2cap_chan_timeout()
434 	l2cap_chan_put(chan);  in l2cap_chan_timeout()
439 	struct l2cap_chan *chan;  in l2cap_chan_create()  local
441 	chan = kzalloc(sizeof(*chan), GFP_ATOMIC);  in l2cap_chan_create()
442 	if (!chan)  in l2cap_chan_create()
445 	mutex_init(&chan->lock);  in l2cap_chan_create()
448 	atomic_set(&chan->nesting, L2CAP_NESTING_NORMAL);  in l2cap_chan_create()
451 	list_add(&chan->global_l, &chan_list);  in l2cap_chan_create()
454 	INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);  in l2cap_chan_create()
456 	chan->state = BT_OPEN;  in l2cap_chan_create()
458 	kref_init(&chan->kref);  in l2cap_chan_create()
461 	set_bit(CONF_NOT_COMPLETE, &chan->conf_state);  in l2cap_chan_create()
463 	BT_DBG("chan %p", chan);  in l2cap_chan_create()
465 	return chan;  in l2cap_chan_create()
471 	struct l2cap_chan *chan = container_of(kref, struct l2cap_chan, kref);  in l2cap_chan_destroy()  local
473 	BT_DBG("chan %p", chan);  in l2cap_chan_destroy()
476 	list_del(&chan->global_l);  in l2cap_chan_destroy()
479 	kfree(chan);  in l2cap_chan_destroy()
497 void l2cap_chan_set_defaults(struct l2cap_chan *chan)  in l2cap_chan_set_defaults()  argument
499 	chan->fcs  = L2CAP_FCS_CRC16;  in l2cap_chan_set_defaults()
500 	chan->max_tx = L2CAP_DEFAULT_MAX_TX;  in l2cap_chan_set_defaults()
501 	chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;  in l2cap_chan_set_defaults()
502 	chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;  in l2cap_chan_set_defaults()
503 	chan->remote_max_tx = chan->max_tx;  in l2cap_chan_set_defaults()
504 	chan->remote_tx_win = chan->tx_win;  in l2cap_chan_set_defaults()
505 	chan->ack_win = L2CAP_DEFAULT_TX_WINDOW;  in l2cap_chan_set_defaults()
506 	chan->sec_level = BT_SECURITY_LOW;  in l2cap_chan_set_defaults()
507 	chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;  in l2cap_chan_set_defaults()
508 	chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;  in l2cap_chan_set_defaults()
509 	chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;  in l2cap_chan_set_defaults()
510 	chan->conf_state = 0;  in l2cap_chan_set_defaults()
512 	set_bit(FLAG_FORCE_ACTIVE, &chan->flags);  in l2cap_chan_set_defaults()
516 static void l2cap_le_flowctl_init(struct l2cap_chan *chan)  in l2cap_le_flowctl_init()  argument
518 	chan->sdu = NULL;  in l2cap_le_flowctl_init()
519 	chan->sdu_last_frag = NULL;  in l2cap_le_flowctl_init()
520 	chan->sdu_len = 0;  in l2cap_le_flowctl_init()
521 	chan->tx_credits = 0;  in l2cap_le_flowctl_init()
522 	chan->rx_credits = le_max_credits;  in l2cap_le_flowctl_init()
523 	chan->mps = min_t(u16, chan->imtu, le_default_mps);  in l2cap_le_flowctl_init()
525 	skb_queue_head_init(&chan->tx_q);  in l2cap_le_flowctl_init()
528 void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)  in __l2cap_chan_add()  argument
531 	       __le16_to_cpu(chan->psm), chan->dcid);  in __l2cap_chan_add()
535 	chan->conn = conn;  in __l2cap_chan_add()
537 	switch (chan->chan_type) {  in __l2cap_chan_add()
540 		chan->scid = l2cap_alloc_cid(conn);  in __l2cap_chan_add()
542 			chan->omtu = L2CAP_DEFAULT_MTU;  in __l2cap_chan_add()
547 		chan->scid = L2CAP_CID_CONN_LESS;  in __l2cap_chan_add()
548 		chan->dcid = L2CAP_CID_CONN_LESS;  in __l2cap_chan_add()
549 		chan->omtu = L2CAP_DEFAULT_MTU;  in __l2cap_chan_add()
558 		chan->scid = L2CAP_CID_SIGNALING;  in __l2cap_chan_add()
559 		chan->dcid = L2CAP_CID_SIGNALING;  in __l2cap_chan_add()
560 		chan->omtu = L2CAP_DEFAULT_MTU;  in __l2cap_chan_add()
563 	chan->local_id		= L2CAP_BESTEFFORT_ID;  in __l2cap_chan_add()
564 	chan->local_stype	= L2CAP_SERV_BESTEFFORT;  in __l2cap_chan_add()
565 	chan->local_msdu	= L2CAP_DEFAULT_MAX_SDU_SIZE;  in __l2cap_chan_add()
566 	chan->local_sdu_itime	= L2CAP_DEFAULT_SDU_ITIME;  in __l2cap_chan_add()
567 	chan->local_acc_lat	= L2CAP_DEFAULT_ACC_LAT;  in __l2cap_chan_add()
568 	chan->local_flush_to	= L2CAP_EFS_DEFAULT_FLUSH_TO;  in __l2cap_chan_add()
570 	l2cap_chan_hold(chan);  in __l2cap_chan_add()
573 	if (chan->chan_type != L2CAP_CHAN_FIXED ||  in __l2cap_chan_add()
574 	    test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))  in __l2cap_chan_add()
577 	list_add(&chan->list, &conn->chan_l);  in __l2cap_chan_add()
580 void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)  in l2cap_chan_add()  argument
583 	__l2cap_chan_add(conn, chan);  in l2cap_chan_add()
587 void l2cap_chan_del(struct l2cap_chan *chan, int err)  in l2cap_chan_del()  argument
589 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_del()
591 	__clear_chan_timer(chan);  in l2cap_chan_del()
593 	BT_DBG("chan %p, conn %p, err %d, state %s", chan, conn, err,  in l2cap_chan_del()
594 	       state_to_string(chan->state));  in l2cap_chan_del()
596 	chan->ops->teardown(chan, err);  in l2cap_chan_del()
601 		list_del(&chan->list);  in l2cap_chan_del()
603 		l2cap_chan_put(chan);  in l2cap_chan_del()
605 		chan->conn = NULL;  in l2cap_chan_del()
611 		if (chan->chan_type != L2CAP_CHAN_FIXED ||  in l2cap_chan_del()
612 		    test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))  in l2cap_chan_del()
615 		if (mgr && mgr->bredr_chan == chan)  in l2cap_chan_del()
619 	if (chan->hs_hchan) {  in l2cap_chan_del()
620 		struct hci_chan *hs_hchan = chan->hs_hchan;  in l2cap_chan_del()
622 		BT_DBG("chan %p disconnect hs_hchan %p", chan, hs_hchan);  in l2cap_chan_del()
626 	if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))  in l2cap_chan_del()
629 	switch(chan->mode) {  in l2cap_chan_del()
634 		skb_queue_purge(&chan->tx_q);  in l2cap_chan_del()
638 		__clear_retrans_timer(chan);  in l2cap_chan_del()
639 		__clear_monitor_timer(chan);  in l2cap_chan_del()
640 		__clear_ack_timer(chan);  in l2cap_chan_del()
642 		skb_queue_purge(&chan->srej_q);  in l2cap_chan_del()
644 		l2cap_seq_list_free(&chan->srej_list);  in l2cap_chan_del()
645 		l2cap_seq_list_free(&chan->retrans_list);  in l2cap_chan_del()
650 		skb_queue_purge(&chan->tx_q);  in l2cap_chan_del()
663 	struct l2cap_chan *chan;  in l2cap_conn_update_id_addr()  local
667 	list_for_each_entry(chan, &conn->chan_l, list) {  in l2cap_conn_update_id_addr()
668 		l2cap_chan_lock(chan);  in l2cap_conn_update_id_addr()
669 		bacpy(&chan->dst, &hcon->dst);  in l2cap_conn_update_id_addr()
670 		chan->dst_type = bdaddr_dst_type(hcon);  in l2cap_conn_update_id_addr()
671 		l2cap_chan_unlock(chan);  in l2cap_conn_update_id_addr()
677 static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan)  in l2cap_chan_le_connect_reject()  argument
679 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_le_connect_reject()
683 	if (test_bit(FLAG_DEFER_SETUP, &chan->flags))  in l2cap_chan_le_connect_reject()
688 	l2cap_state_change(chan, BT_DISCONN);  in l2cap_chan_le_connect_reject()
690 	rsp.dcid    = cpu_to_le16(chan->scid);  in l2cap_chan_le_connect_reject()
691 	rsp.mtu     = cpu_to_le16(chan->imtu);  in l2cap_chan_le_connect_reject()
692 	rsp.mps     = cpu_to_le16(chan->mps);  in l2cap_chan_le_connect_reject()
693 	rsp.credits = cpu_to_le16(chan->rx_credits);  in l2cap_chan_le_connect_reject()
696 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),  in l2cap_chan_le_connect_reject()
700 static void l2cap_chan_connect_reject(struct l2cap_chan *chan)  in l2cap_chan_connect_reject()  argument
702 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_connect_reject()
706 	if (test_bit(FLAG_DEFER_SETUP, &chan->flags))  in l2cap_chan_connect_reject()
711 	l2cap_state_change(chan, BT_DISCONN);  in l2cap_chan_connect_reject()
713 	rsp.scid   = cpu_to_le16(chan->dcid);  in l2cap_chan_connect_reject()
714 	rsp.dcid   = cpu_to_le16(chan->scid);  in l2cap_chan_connect_reject()
718 	l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);  in l2cap_chan_connect_reject()
721 void l2cap_chan_close(struct l2cap_chan *chan, int reason)  in l2cap_chan_close()  argument
723 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_close()
725 	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));  in l2cap_chan_close()
727 	switch (chan->state) {  in l2cap_chan_close()
729 		chan->ops->teardown(chan, 0);  in l2cap_chan_close()
734 		if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {  in l2cap_chan_close()
735 			__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));  in l2cap_chan_close()
736 			l2cap_send_disconn_req(chan, reason);  in l2cap_chan_close()
738 			l2cap_chan_del(chan, reason);  in l2cap_chan_close()
742 		if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {  in l2cap_chan_close()
744 				l2cap_chan_connect_reject(chan);  in l2cap_chan_close()
746 				l2cap_chan_le_connect_reject(chan);  in l2cap_chan_close()
749 		l2cap_chan_del(chan, reason);  in l2cap_chan_close()
754 		l2cap_chan_del(chan, reason);  in l2cap_chan_close()
758 		chan->ops->teardown(chan, 0);  in l2cap_chan_close()
764 static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)  in l2cap_get_auth_type()  argument
766 	switch (chan->chan_type) {  in l2cap_get_auth_type()
768 		switch (chan->sec_level) {  in l2cap_get_auth_type()
779 		if (chan->psm == cpu_to_le16(L2CAP_PSM_3DSP)) {  in l2cap_get_auth_type()
780 			if (chan->sec_level == BT_SECURITY_LOW)  in l2cap_get_auth_type()
781 				chan->sec_level = BT_SECURITY_SDP;  in l2cap_get_auth_type()
783 		if (chan->sec_level == BT_SECURITY_HIGH ||  in l2cap_get_auth_type()
784 		    chan->sec_level == BT_SECURITY_FIPS)  in l2cap_get_auth_type()
790 		if (chan->psm == cpu_to_le16(L2CAP_PSM_SDP)) {  in l2cap_get_auth_type()
791 			if (chan->sec_level == BT_SECURITY_LOW)  in l2cap_get_auth_type()
792 				chan->sec_level = BT_SECURITY_SDP;  in l2cap_get_auth_type()
794 			if (chan->sec_level == BT_SECURITY_HIGH ||  in l2cap_get_auth_type()
795 			    chan->sec_level == BT_SECURITY_FIPS)  in l2cap_get_auth_type()
802 		switch (chan->sec_level) {  in l2cap_get_auth_type()
816 int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator)  in l2cap_chan_check_security()  argument
818 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_check_security()
822 		return smp_conn_security(conn->hcon, chan->sec_level);  in l2cap_chan_check_security()
824 	auth_type = l2cap_get_auth_type(chan);  in l2cap_chan_check_security()
826 	return hci_conn_security(conn->hcon, chan->sec_level, auth_type,  in l2cap_chan_check_security()
877 static bool __chan_is_moving(struct l2cap_chan *chan)  in __chan_is_moving()  argument
879 	return chan->move_state != L2CAP_MOVE_STABLE &&  in __chan_is_moving()
880 	       chan->move_state != L2CAP_MOVE_WAIT_PREPARE;  in __chan_is_moving()
883 static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)  in l2cap_do_send()  argument
885 	struct hci_conn *hcon = chan->conn->hcon;  in l2cap_do_send()
888 	BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,  in l2cap_do_send()
891 	if (chan->hs_hcon && !__chan_is_moving(chan)) {  in l2cap_do_send()
892 		if (chan->hs_hchan)  in l2cap_do_send()
893 			hci_send_acl(chan->hs_hchan, skb, ACL_COMPLETE);  in l2cap_do_send()
905 	    (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&  in l2cap_do_send()
911 	bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);  in l2cap_do_send()
912 	hci_send_acl(chan->conn->hchan, skb, flags);  in l2cap_do_send()
963 static inline void __unpack_control(struct l2cap_chan *chan,  in __unpack_control()  argument
966 	if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {  in __unpack_control()
1015 static inline void __pack_control(struct l2cap_chan *chan,  in __pack_control()  argument
1019 	if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {  in __pack_control()
1028 static inline unsigned int __ertm_hdr_size(struct l2cap_chan *chan)  in __ertm_hdr_size()  argument
1030 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in __ertm_hdr_size()
1036 static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan,  in l2cap_create_sframe_pdu()  argument
1041 	int hlen = __ertm_hdr_size(chan);  in l2cap_create_sframe_pdu()
1043 	if (chan->fcs == L2CAP_FCS_CRC16)  in l2cap_create_sframe_pdu()
1053 	lh->cid = cpu_to_le16(chan->dcid);  in l2cap_create_sframe_pdu()
1055 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_create_sframe_pdu()
1060 	if (chan->fcs == L2CAP_FCS_CRC16) {  in l2cap_create_sframe_pdu()
1069 static void l2cap_send_sframe(struct l2cap_chan *chan,  in l2cap_send_sframe()  argument
1075 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_send_sframe()
1080 	if (__chan_is_moving(chan))  in l2cap_send_sframe()
1083 	if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) &&  in l2cap_send_sframe()
1088 		clear_bit(CONN_RNR_SENT, &chan->conn_state);  in l2cap_send_sframe()
1090 		set_bit(CONN_RNR_SENT, &chan->conn_state);  in l2cap_send_sframe()
1093 		chan->last_acked_seq = control->reqseq;  in l2cap_send_sframe()
1094 		__clear_ack_timer(chan);  in l2cap_send_sframe()
1100 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_send_sframe()
1105 	skb = l2cap_create_sframe_pdu(chan, control_field);  in l2cap_send_sframe()
1107 		l2cap_do_send(chan, skb);  in l2cap_send_sframe()
1110 static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll)  in l2cap_send_rr_or_rnr()  argument
1114 	BT_DBG("chan %p, poll %d", chan, poll);  in l2cap_send_rr_or_rnr()
1120 	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state))  in l2cap_send_rr_or_rnr()
1125 	control.reqseq = chan->buffer_seq;  in l2cap_send_rr_or_rnr()
1126 	l2cap_send_sframe(chan, &control);  in l2cap_send_rr_or_rnr()
1129 static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)  in __l2cap_no_conn_pending()  argument
1131 	if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)  in __l2cap_no_conn_pending()
1134 	return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);  in __l2cap_no_conn_pending()
1137 static bool __amp_capable(struct l2cap_chan *chan)  in __amp_capable()  argument
1139 	struct l2cap_conn *conn = chan->conn;  in __amp_capable()
1159 	if (chan->chan_policy == BT_CHANNEL_POLICY_AMP_PREFERRED)  in __amp_capable()
1165 static bool l2cap_check_efs(struct l2cap_chan *chan)  in l2cap_check_efs()  argument
1171 void l2cap_send_conn_req(struct l2cap_chan *chan)  in l2cap_send_conn_req()  argument
1173 	struct l2cap_conn *conn = chan->conn;  in l2cap_send_conn_req()
1176 	req.scid = cpu_to_le16(chan->scid);  in l2cap_send_conn_req()
1177 	req.psm  = chan->psm;  in l2cap_send_conn_req()
1179 	chan->ident = l2cap_get_ident(conn);  in l2cap_send_conn_req()
1181 	set_bit(CONF_CONNECT_PEND, &chan->conf_state);  in l2cap_send_conn_req()
1183 	l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);  in l2cap_send_conn_req()
1186 static void l2cap_send_create_chan_req(struct l2cap_chan *chan, u8 amp_id)  in l2cap_send_create_chan_req()  argument
1189 	req.scid = cpu_to_le16(chan->scid);  in l2cap_send_create_chan_req()
1190 	req.psm  = chan->psm;  in l2cap_send_create_chan_req()
1193 	chan->ident = l2cap_get_ident(chan->conn);  in l2cap_send_create_chan_req()
1195 	l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_REQ,  in l2cap_send_create_chan_req()
1199 static void l2cap_move_setup(struct l2cap_chan *chan)  in l2cap_move_setup()  argument
1203 	BT_DBG("chan %p", chan);  in l2cap_move_setup()
1205 	if (chan->mode != L2CAP_MODE_ERTM)  in l2cap_move_setup()
1208 	__clear_retrans_timer(chan);  in l2cap_move_setup()
1209 	__clear_monitor_timer(chan);  in l2cap_move_setup()
1210 	__clear_ack_timer(chan);  in l2cap_move_setup()
1212 	chan->retry_count = 0;  in l2cap_move_setup()
1213 	skb_queue_walk(&chan->tx_q, skb) {  in l2cap_move_setup()
1220 	chan->expected_tx_seq = chan->buffer_seq;  in l2cap_move_setup()
1222 	clear_bit(CONN_REJ_ACT, &chan->conn_state);  in l2cap_move_setup()
1223 	clear_bit(CONN_SREJ_ACT, &chan->conn_state);  in l2cap_move_setup()
1224 	l2cap_seq_list_clear(&chan->retrans_list);  in l2cap_move_setup()
1225 	l2cap_seq_list_clear(&chan->srej_list);  in l2cap_move_setup()
1226 	skb_queue_purge(&chan->srej_q);  in l2cap_move_setup()
1228 	chan->tx_state = L2CAP_TX_STATE_XMIT;  in l2cap_move_setup()
1229 	chan->rx_state = L2CAP_RX_STATE_MOVE;  in l2cap_move_setup()
1231 	set_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_move_setup()
1234 static void l2cap_move_done(struct l2cap_chan *chan)  in l2cap_move_done()  argument
1236 	u8 move_role = chan->move_role;  in l2cap_move_done()
1237 	BT_DBG("chan %p", chan);  in l2cap_move_done()
1239 	chan->move_state = L2CAP_MOVE_STABLE;  in l2cap_move_done()
1240 	chan->move_role = L2CAP_MOVE_ROLE_NONE;  in l2cap_move_done()
1242 	if (chan->mode != L2CAP_MODE_ERTM)  in l2cap_move_done()
1247 		l2cap_tx(chan, NULL, NULL, L2CAP_EV_EXPLICIT_POLL);  in l2cap_move_done()
1248 		chan->rx_state = L2CAP_RX_STATE_WAIT_F;  in l2cap_move_done()
1251 		chan->rx_state = L2CAP_RX_STATE_WAIT_P;  in l2cap_move_done()
1256 static void l2cap_chan_ready(struct l2cap_chan *chan)  in l2cap_chan_ready()  argument
1262 	if (chan->state == BT_CONNECTED)  in l2cap_chan_ready()
1266 	chan->conf_state = 0;  in l2cap_chan_ready()
1267 	__clear_chan_timer(chan);  in l2cap_chan_ready()
1269 	if (chan->mode == L2CAP_MODE_LE_FLOWCTL && !chan->tx_credits)  in l2cap_chan_ready()
1270 		chan->ops->suspend(chan);  in l2cap_chan_ready()
1272 	chan->state = BT_CONNECTED;  in l2cap_chan_ready()
1274 	chan->ops->ready(chan);  in l2cap_chan_ready()
1277 static void l2cap_le_connect(struct l2cap_chan *chan)  in l2cap_le_connect()  argument
1279 	struct l2cap_conn *conn = chan->conn;  in l2cap_le_connect()
1282 	if (test_and_set_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags))  in l2cap_le_connect()
1285 	req.psm     = chan->psm;  in l2cap_le_connect()
1286 	req.scid    = cpu_to_le16(chan->scid);  in l2cap_le_connect()
1287 	req.mtu     = cpu_to_le16(chan->imtu);  in l2cap_le_connect()
1288 	req.mps     = cpu_to_le16(chan->mps);  in l2cap_le_connect()
1289 	req.credits = cpu_to_le16(chan->rx_credits);  in l2cap_le_connect()
1291 	chan->ident = l2cap_get_ident(conn);  in l2cap_le_connect()
1293 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_REQ,  in l2cap_le_connect()
1297 static void l2cap_le_start(struct l2cap_chan *chan)  in l2cap_le_start()  argument
1299 	struct l2cap_conn *conn = chan->conn;  in l2cap_le_start()
1301 	if (!smp_conn_security(conn->hcon, chan->sec_level))  in l2cap_le_start()
1304 	if (!chan->psm) {  in l2cap_le_start()
1305 		l2cap_chan_ready(chan);  in l2cap_le_start()
1309 	if (chan->state == BT_CONNECT)  in l2cap_le_start()
1310 		l2cap_le_connect(chan);  in l2cap_le_start()
1313 static void l2cap_start_connection(struct l2cap_chan *chan)  in l2cap_start_connection()  argument
1315 	if (__amp_capable(chan)) {  in l2cap_start_connection()
1316 		BT_DBG("chan %p AMP capable: discover AMPs", chan);  in l2cap_start_connection()
1317 		a2mp_discover_amp(chan);  in l2cap_start_connection()
1318 	} else if (chan->conn->hcon->type == LE_LINK) {  in l2cap_start_connection()
1319 		l2cap_le_start(chan);  in l2cap_start_connection()
1321 		l2cap_send_conn_req(chan);  in l2cap_start_connection()
1343 static void l2cap_do_start(struct l2cap_chan *chan)  in l2cap_do_start()  argument
1345 	struct l2cap_conn *conn = chan->conn;  in l2cap_do_start()
1348 		l2cap_le_start(chan);  in l2cap_do_start()
1360 	if (l2cap_chan_check_security(chan, true) &&  in l2cap_do_start()
1361 	    __l2cap_no_conn_pending(chan))  in l2cap_do_start()
1362 		l2cap_start_connection(chan);  in l2cap_do_start()
1381 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err)  in l2cap_send_disconn_req()  argument
1383 	struct l2cap_conn *conn = chan->conn;  in l2cap_send_disconn_req()
1389 	if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) {  in l2cap_send_disconn_req()
1390 		__clear_retrans_timer(chan);  in l2cap_send_disconn_req()
1391 		__clear_monitor_timer(chan);  in l2cap_send_disconn_req()
1392 		__clear_ack_timer(chan);  in l2cap_send_disconn_req()
1395 	if (chan->scid == L2CAP_CID_A2MP) {  in l2cap_send_disconn_req()
1396 		l2cap_state_change(chan, BT_DISCONN);  in l2cap_send_disconn_req()
1400 	req.dcid = cpu_to_le16(chan->dcid);  in l2cap_send_disconn_req()
1401 	req.scid = cpu_to_le16(chan->scid);  in l2cap_send_disconn_req()
1405 	l2cap_state_change_and_error(chan, BT_DISCONN, err);  in l2cap_send_disconn_req()
1411 	struct l2cap_chan *chan, *tmp;  in l2cap_conn_start()  local
1417 	list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {  in l2cap_conn_start()
1418 		l2cap_chan_lock(chan);  in l2cap_conn_start()
1420 		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {  in l2cap_conn_start()
1421 			l2cap_chan_ready(chan);  in l2cap_conn_start()
1422 			l2cap_chan_unlock(chan);  in l2cap_conn_start()
1426 		if (chan->state == BT_CONNECT) {  in l2cap_conn_start()
1427 			if (!l2cap_chan_check_security(chan, true) ||  in l2cap_conn_start()
1428 			    !__l2cap_no_conn_pending(chan)) {  in l2cap_conn_start()
1429 				l2cap_chan_unlock(chan);  in l2cap_conn_start()
1433 			if (!l2cap_mode_supported(chan->mode, conn->feat_mask)  in l2cap_conn_start()
1435 					&chan->conf_state)) {  in l2cap_conn_start()
1436 				l2cap_chan_close(chan, ECONNRESET);  in l2cap_conn_start()
1437 				l2cap_chan_unlock(chan);  in l2cap_conn_start()
1441 			l2cap_start_connection(chan);  in l2cap_conn_start()
1443 		} else if (chan->state == BT_CONNECT2) {  in l2cap_conn_start()
1446 			rsp.scid = cpu_to_le16(chan->dcid);  in l2cap_conn_start()
1447 			rsp.dcid = cpu_to_le16(chan->scid);  in l2cap_conn_start()
1449 			if (l2cap_chan_check_security(chan, false)) {  in l2cap_conn_start()
1450 				if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {  in l2cap_conn_start()
1453 					chan->ops->defer(chan);  in l2cap_conn_start()
1456 					l2cap_state_change(chan, BT_CONFIG);  in l2cap_conn_start()
1465 			l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,  in l2cap_conn_start()
1468 			if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||  in l2cap_conn_start()
1470 				l2cap_chan_unlock(chan);  in l2cap_conn_start()
1474 			set_bit(CONF_REQ_SENT, &chan->conf_state);  in l2cap_conn_start()
1476 				       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);  in l2cap_conn_start()
1477 			chan->num_conf_req++;  in l2cap_conn_start()
1480 		l2cap_chan_unlock(chan);  in l2cap_conn_start()
1521 	struct l2cap_chan *chan;  in l2cap_conn_ready()  local
1531 	list_for_each_entry(chan, &conn->chan_l, list) {  in l2cap_conn_ready()
1533 		l2cap_chan_lock(chan);  in l2cap_conn_ready()
1535 		if (chan->scid == L2CAP_CID_A2MP) {  in l2cap_conn_ready()
1536 			l2cap_chan_unlock(chan);  in l2cap_conn_ready()
1541 			l2cap_le_start(chan);  in l2cap_conn_ready()
1542 		} else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {  in l2cap_conn_ready()
1544 				l2cap_chan_ready(chan);  in l2cap_conn_ready()
1545 		} else if (chan->state == BT_CONNECT) {  in l2cap_conn_ready()
1546 			l2cap_do_start(chan);  in l2cap_conn_ready()
1549 		l2cap_chan_unlock(chan);  in l2cap_conn_ready()
1563 	struct l2cap_chan *chan;  in l2cap_conn_unreliable()  local
1569 	list_for_each_entry(chan, &conn->chan_l, list) {  in l2cap_conn_unreliable()
1570 		if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))  in l2cap_conn_unreliable()
1571 			l2cap_chan_set_err(chan, err);  in l2cap_conn_unreliable()
1670 	struct l2cap_chan *chan, *l;  in l2cap_conn_del()  local
1699 	list_for_each_entry_safe(chan, l, &conn->chan_l, list) {  in l2cap_conn_del()
1700 		l2cap_chan_hold(chan);  in l2cap_conn_del()
1701 		l2cap_chan_lock(chan);  in l2cap_conn_del()
1703 		l2cap_chan_del(chan, err);  in l2cap_conn_del()
1705 		l2cap_chan_unlock(chan);  in l2cap_conn_del()
1707 		chan->ops->close(chan);  in l2cap_conn_del()
1708 		l2cap_chan_put(chan);  in l2cap_conn_del()
1800 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,  in l2cap_monitor_timeout()  local
1803 	BT_DBG("chan %p", chan);  in l2cap_monitor_timeout()
1805 	l2cap_chan_lock(chan);  in l2cap_monitor_timeout()
1807 	if (!chan->conn) {  in l2cap_monitor_timeout()
1808 		l2cap_chan_unlock(chan);  in l2cap_monitor_timeout()
1809 		l2cap_chan_put(chan);  in l2cap_monitor_timeout()
1813 	l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO);  in l2cap_monitor_timeout()
1815 	l2cap_chan_unlock(chan);  in l2cap_monitor_timeout()
1816 	l2cap_chan_put(chan);  in l2cap_monitor_timeout()
1821 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,  in l2cap_retrans_timeout()  local
1824 	BT_DBG("chan %p", chan);  in l2cap_retrans_timeout()
1826 	l2cap_chan_lock(chan);  in l2cap_retrans_timeout()
1828 	if (!chan->conn) {  in l2cap_retrans_timeout()
1829 		l2cap_chan_unlock(chan);  in l2cap_retrans_timeout()
1830 		l2cap_chan_put(chan);  in l2cap_retrans_timeout()
1834 	l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO);  in l2cap_retrans_timeout()
1835 	l2cap_chan_unlock(chan);  in l2cap_retrans_timeout()
1836 	l2cap_chan_put(chan);  in l2cap_retrans_timeout()
1839 static void l2cap_streaming_send(struct l2cap_chan *chan,  in l2cap_streaming_send()  argument
1845 	BT_DBG("chan %p, skbs %p", chan, skbs);  in l2cap_streaming_send()
1847 	if (__chan_is_moving(chan))  in l2cap_streaming_send()
1850 	skb_queue_splice_tail_init(skbs, &chan->tx_q);  in l2cap_streaming_send()
1852 	while (!skb_queue_empty(&chan->tx_q)) {  in l2cap_streaming_send()
1854 		skb = skb_dequeue(&chan->tx_q);  in l2cap_streaming_send()
1860 		control->txseq = chan->next_tx_seq;  in l2cap_streaming_send()
1862 		__pack_control(chan, control, skb);  in l2cap_streaming_send()
1864 		if (chan->fcs == L2CAP_FCS_CRC16) {  in l2cap_streaming_send()
1869 		l2cap_do_send(chan, skb);  in l2cap_streaming_send()
1873 		chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);  in l2cap_streaming_send()
1874 		chan->frames_sent++;  in l2cap_streaming_send()
1878 static int l2cap_ertm_send(struct l2cap_chan *chan)  in l2cap_ertm_send()  argument
1884 	BT_DBG("chan %p", chan);  in l2cap_ertm_send()
1886 	if (chan->state != BT_CONNECTED)  in l2cap_ertm_send()
1889 	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))  in l2cap_ertm_send()
1892 	if (__chan_is_moving(chan))  in l2cap_ertm_send()
1895 	while (chan->tx_send_head &&  in l2cap_ertm_send()
1896 	       chan->unacked_frames < chan->remote_tx_win &&  in l2cap_ertm_send()
1897 	       chan->tx_state == L2CAP_TX_STATE_XMIT) {  in l2cap_ertm_send()
1899 		skb = chan->tx_send_head;  in l2cap_ertm_send()
1904 		if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))  in l2cap_ertm_send()
1907 		control->reqseq = chan->buffer_seq;  in l2cap_ertm_send()
1908 		chan->last_acked_seq = chan->buffer_seq;  in l2cap_ertm_send()
1909 		control->txseq = chan->next_tx_seq;  in l2cap_ertm_send()
1911 		__pack_control(chan, control, skb);  in l2cap_ertm_send()
1913 		if (chan->fcs == L2CAP_FCS_CRC16) {  in l2cap_ertm_send()
1926 		__set_retrans_timer(chan);  in l2cap_ertm_send()
1928 		chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);  in l2cap_ertm_send()
1929 		chan->unacked_frames++;  in l2cap_ertm_send()
1930 		chan->frames_sent++;  in l2cap_ertm_send()
1933 		if (skb_queue_is_last(&chan->tx_q, skb))  in l2cap_ertm_send()
1934 			chan->tx_send_head = NULL;  in l2cap_ertm_send()
1936 			chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);  in l2cap_ertm_send()
1938 		l2cap_do_send(chan, tx_skb);  in l2cap_ertm_send()
1943 	       chan->unacked_frames, skb_queue_len(&chan->tx_q));  in l2cap_ertm_send()
1948 static void l2cap_ertm_resend(struct l2cap_chan *chan)  in l2cap_ertm_resend()  argument
1955 	BT_DBG("chan %p", chan);  in l2cap_ertm_resend()
1957 	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))  in l2cap_ertm_resend()
1960 	if (__chan_is_moving(chan))  in l2cap_ertm_resend()
1963 	while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) {  in l2cap_ertm_resend()
1964 		seq = l2cap_seq_list_pop(&chan->retrans_list);  in l2cap_ertm_resend()
1966 		skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq);  in l2cap_ertm_resend()
1976 		if (chan->max_tx != 0 &&  in l2cap_ertm_resend()
1977 		    bt_cb(skb)->l2cap.retries > chan->max_tx) {  in l2cap_ertm_resend()
1978 			BT_DBG("Retry limit exceeded (%d)", chan->max_tx);  in l2cap_ertm_resend()
1979 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_ertm_resend()
1980 			l2cap_seq_list_clear(&chan->retrans_list);  in l2cap_ertm_resend()
1984 		control.reqseq = chan->buffer_seq;  in l2cap_ertm_resend()
1985 		if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))  in l2cap_ertm_resend()
2000 			l2cap_seq_list_clear(&chan->retrans_list);  in l2cap_ertm_resend()
2005 		if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {  in l2cap_ertm_resend()
2014 		if (chan->fcs == L2CAP_FCS_CRC16) {  in l2cap_ertm_resend()
2021 		l2cap_do_send(chan, tx_skb);  in l2cap_ertm_resend()
2025 		chan->last_acked_seq = chan->buffer_seq;  in l2cap_ertm_resend()
2029 static void l2cap_retransmit(struct l2cap_chan *chan,  in l2cap_retransmit()  argument
2032 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_retransmit()
2034 	l2cap_seq_list_append(&chan->retrans_list, control->reqseq);  in l2cap_retransmit()
2035 	l2cap_ertm_resend(chan);  in l2cap_retransmit()
2038 static void l2cap_retransmit_all(struct l2cap_chan *chan,  in l2cap_retransmit_all()  argument
2043 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_retransmit_all()
2046 		set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_retransmit_all()
2048 	l2cap_seq_list_clear(&chan->retrans_list);  in l2cap_retransmit_all()
2050 	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))  in l2cap_retransmit_all()
2053 	if (chan->unacked_frames) {  in l2cap_retransmit_all()
2054 		skb_queue_walk(&chan->tx_q, skb) {  in l2cap_retransmit_all()
2056 			    skb == chan->tx_send_head)  in l2cap_retransmit_all()
2060 		skb_queue_walk_from(&chan->tx_q, skb) {  in l2cap_retransmit_all()
2061 			if (skb == chan->tx_send_head)  in l2cap_retransmit_all()
2064 			l2cap_seq_list_append(&chan->retrans_list,  in l2cap_retransmit_all()
2068 		l2cap_ertm_resend(chan);  in l2cap_retransmit_all()
2072 static void l2cap_send_ack(struct l2cap_chan *chan)  in l2cap_send_ack()  argument
2075 	u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq,  in l2cap_send_ack()
2076 					 chan->last_acked_seq);  in l2cap_send_ack()
2080 	       chan, chan->last_acked_seq, chan->buffer_seq);  in l2cap_send_ack()
2085 	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&  in l2cap_send_ack()
2086 	    chan->rx_state == L2CAP_RX_STATE_RECV) {  in l2cap_send_ack()
2087 		__clear_ack_timer(chan);  in l2cap_send_ack()
2089 		control.reqseq = chan->buffer_seq;  in l2cap_send_ack()
2090 		l2cap_send_sframe(chan, &control);  in l2cap_send_ack()
2092 		if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) {  in l2cap_send_ack()
2093 			l2cap_ertm_send(chan);  in l2cap_send_ack()
2095 			if (chan->buffer_seq == chan->last_acked_seq)  in l2cap_send_ack()
2102 		threshold = chan->ack_win;  in l2cap_send_ack()
2110 			__clear_ack_timer(chan);  in l2cap_send_ack()
2112 			control.reqseq = chan->buffer_seq;  in l2cap_send_ack()
2113 			l2cap_send_sframe(chan, &control);  in l2cap_send_ack()
2118 			__set_ack_timer(chan);  in l2cap_send_ack()
2122 static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,  in l2cap_skbuff_fromiovec()  argument
2126 	struct l2cap_conn *conn = chan->conn;  in l2cap_skbuff_fromiovec()
2143 		tmp = chan->ops->alloc_skb(chan, 0, count,  in l2cap_skbuff_fromiovec()
2166 static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,  in l2cap_create_connless_pdu()  argument
2169 	struct l2cap_conn *conn = chan->conn;  in l2cap_create_connless_pdu()
2174 	BT_DBG("chan %p psm 0x%2.2x len %zu", chan,  in l2cap_create_connless_pdu()
2175 	       __le16_to_cpu(chan->psm), len);  in l2cap_create_connless_pdu()
2179 	skb = chan->ops->alloc_skb(chan, hlen, count,  in l2cap_create_connless_pdu()
2186 	lh->cid = cpu_to_le16(chan->dcid);  in l2cap_create_connless_pdu()
2188 	put_unaligned(chan->psm, (__le16 *) skb_put(skb, L2CAP_PSMLEN_SIZE));  in l2cap_create_connless_pdu()
2190 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);  in l2cap_create_connless_pdu()
2198 static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,  in l2cap_create_basic_pdu()  argument
2201 	struct l2cap_conn *conn = chan->conn;  in l2cap_create_basic_pdu()
2206 	BT_DBG("chan %p len %zu", chan, len);  in l2cap_create_basic_pdu()
2210 	skb = chan->ops->alloc_skb(chan, L2CAP_HDR_SIZE, count,  in l2cap_create_basic_pdu()
2217 	lh->cid = cpu_to_le16(chan->dcid);  in l2cap_create_basic_pdu()
2220 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);  in l2cap_create_basic_pdu()
2228 static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,  in l2cap_create_iframe_pdu()  argument
2232 	struct l2cap_conn *conn = chan->conn;  in l2cap_create_iframe_pdu()
2237 	BT_DBG("chan %p len %zu", chan, len);  in l2cap_create_iframe_pdu()
2242 	hlen = __ertm_hdr_size(chan);  in l2cap_create_iframe_pdu()
2247 	if (chan->fcs == L2CAP_FCS_CRC16)  in l2cap_create_iframe_pdu()
2252 	skb = chan->ops->alloc_skb(chan, hlen, count,  in l2cap_create_iframe_pdu()
2259 	lh->cid = cpu_to_le16(chan->dcid);  in l2cap_create_iframe_pdu()
2263 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_create_iframe_pdu()
2271 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);  in l2cap_create_iframe_pdu()
2277 	bt_cb(skb)->l2cap.fcs = chan->fcs;  in l2cap_create_iframe_pdu()
2282 static int l2cap_segment_sdu(struct l2cap_chan *chan,  in l2cap_segment_sdu()  argument
2291 	BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);  in l2cap_segment_sdu()
2299 	pdu_len = chan->conn->mtu;  in l2cap_segment_sdu()
2302 	if (!chan->hs_hcon)  in l2cap_segment_sdu()
2306 	if (chan->fcs)  in l2cap_segment_sdu()
2309 	pdu_len -= __ertm_hdr_size(chan);  in l2cap_segment_sdu()
2312 	pdu_len = min_t(size_t, pdu_len, chan->remote_mps);  in l2cap_segment_sdu()
2324 		skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len);  in l2cap_segment_sdu()
2349 static struct sk_buff *l2cap_create_le_flowctl_pdu(struct l2cap_chan *chan,  in l2cap_create_le_flowctl_pdu()  argument
2353 	struct l2cap_conn *conn = chan->conn;  in l2cap_create_le_flowctl_pdu()
2358 	BT_DBG("chan %p len %zu", chan, len);  in l2cap_create_le_flowctl_pdu()
2370 	skb = chan->ops->alloc_skb(chan, hlen, count,  in l2cap_create_le_flowctl_pdu()
2377 	lh->cid = cpu_to_le16(chan->dcid);  in l2cap_create_le_flowctl_pdu()
2383 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);  in l2cap_create_le_flowctl_pdu()
2392 static int l2cap_segment_le_sdu(struct l2cap_chan *chan,  in l2cap_segment_le_sdu()  argument
2400 	BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);  in l2cap_segment_le_sdu()
2403 	pdu_len = chan->remote_mps - L2CAP_SDULEN_SIZE;  in l2cap_segment_le_sdu()
2409 		skb = l2cap_create_le_flowctl_pdu(chan, msg, pdu_len, sdu_len);  in l2cap_segment_le_sdu()
2428 static void l2cap_le_flowctl_send(struct l2cap_chan *chan)  in l2cap_le_flowctl_send()  argument
2432 	BT_DBG("chan %p", chan);  in l2cap_le_flowctl_send()
2434 	while (chan->tx_credits && !skb_queue_empty(&chan->tx_q)) {  in l2cap_le_flowctl_send()
2435 		l2cap_do_send(chan, skb_dequeue(&chan->tx_q));  in l2cap_le_flowctl_send()
2436 		chan->tx_credits--;  in l2cap_le_flowctl_send()
2440 	BT_DBG("Sent %d credits %u queued %u", sent, chan->tx_credits,  in l2cap_le_flowctl_send()
2441 	       skb_queue_len(&chan->tx_q));  in l2cap_le_flowctl_send()
2444 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)  in l2cap_chan_send()  argument
2450 	if (!chan->conn)  in l2cap_chan_send()
2454 	if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {  in l2cap_chan_send()
2455 		skb = l2cap_create_connless_pdu(chan, msg, len);  in l2cap_chan_send()
2462 		if (chan->state != BT_CONNECTED) {  in l2cap_chan_send()
2467 		l2cap_do_send(chan, skb);  in l2cap_chan_send()
2471 	switch (chan->mode) {  in l2cap_chan_send()
2474 		if (len > chan->omtu)  in l2cap_chan_send()
2479 		err = l2cap_segment_le_sdu(chan, &seg_queue, msg, len);  in l2cap_chan_send()
2481 		if (chan->state != BT_CONNECTED) {  in l2cap_chan_send()
2489 		skb_queue_splice_tail_init(&seg_queue, &chan->tx_q);  in l2cap_chan_send()
2491 		l2cap_le_flowctl_send(chan);  in l2cap_chan_send()
2493 		if (!chan->tx_credits)  in l2cap_chan_send()
2494 			chan->ops->suspend(chan);  in l2cap_chan_send()
2502 		if (len > chan->omtu)  in l2cap_chan_send()
2506 		skb = l2cap_create_basic_pdu(chan, msg, len);  in l2cap_chan_send()
2513 		if (chan->state != BT_CONNECTED) {  in l2cap_chan_send()
2518 		l2cap_do_send(chan, skb);  in l2cap_chan_send()
2525 		if (len > chan->omtu) {  in l2cap_chan_send()
2536 		err = l2cap_segment_sdu(chan, &seg_queue, msg, len);  in l2cap_chan_send()
2541 		if (chan->state != BT_CONNECTED) {  in l2cap_chan_send()
2549 		if (chan->mode == L2CAP_MODE_ERTM)  in l2cap_chan_send()
2550 			l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST);  in l2cap_chan_send()
2552 			l2cap_streaming_send(chan, &seg_queue);  in l2cap_chan_send()
2563 		BT_DBG("bad state %1.1x", chan->mode);  in l2cap_chan_send()
2571 static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq)  in l2cap_send_srej()  argument
2576 	BT_DBG("chan %p, txseq %u", chan, txseq);  in l2cap_send_srej()
2582 	for (seq = chan->expected_tx_seq; seq != txseq;  in l2cap_send_srej()
2583 	     seq = __next_seq(chan, seq)) {  in l2cap_send_srej()
2584 		if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) {  in l2cap_send_srej()
2586 			l2cap_send_sframe(chan, &control);  in l2cap_send_srej()
2587 			l2cap_seq_list_append(&chan->srej_list, seq);  in l2cap_send_srej()
2591 	chan->expected_tx_seq = __next_seq(chan, txseq);  in l2cap_send_srej()
2594 static void l2cap_send_srej_tail(struct l2cap_chan *chan)  in l2cap_send_srej_tail()  argument
2598 	BT_DBG("chan %p", chan);  in l2cap_send_srej_tail()
2600 	if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR)  in l2cap_send_srej_tail()
2606 	control.reqseq = chan->srej_list.tail;  in l2cap_send_srej_tail()
2607 	l2cap_send_sframe(chan, &control);  in l2cap_send_srej_tail()
2610 static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq)  in l2cap_send_srej_list()  argument
2616 	BT_DBG("chan %p, txseq %u", chan, txseq);  in l2cap_send_srej_list()
2623 	initial_head = chan->srej_list.head;  in l2cap_send_srej_list()
2626 		seq = l2cap_seq_list_pop(&chan->srej_list);  in l2cap_send_srej_list()
2631 		l2cap_send_sframe(chan, &control);  in l2cap_send_srej_list()
2632 		l2cap_seq_list_append(&chan->srej_list, seq);  in l2cap_send_srej_list()
2633 	} while (chan->srej_list.head != initial_head);  in l2cap_send_srej_list()
2636 static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq)  in l2cap_process_reqseq()  argument
2641 	BT_DBG("chan %p, reqseq %u", chan, reqseq);  in l2cap_process_reqseq()
2643 	if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq)  in l2cap_process_reqseq()
2647 	       chan->expected_ack_seq, chan->unacked_frames);  in l2cap_process_reqseq()
2649 	for (ackseq = chan->expected_ack_seq; ackseq != reqseq;  in l2cap_process_reqseq()
2650 	     ackseq = __next_seq(chan, ackseq)) {  in l2cap_process_reqseq()
2652 		acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq);  in l2cap_process_reqseq()
2654 			skb_unlink(acked_skb, &chan->tx_q);  in l2cap_process_reqseq()
2656 			chan->unacked_frames--;  in l2cap_process_reqseq()
2660 	chan->expected_ack_seq = reqseq;  in l2cap_process_reqseq()
2662 	if (chan->unacked_frames == 0)  in l2cap_process_reqseq()
2663 		__clear_retrans_timer(chan);  in l2cap_process_reqseq()
2665 	BT_DBG("unacked_frames %u", chan->unacked_frames);  in l2cap_process_reqseq()
2668 static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan)  in l2cap_abort_rx_srej_sent()  argument
2670 	BT_DBG("chan %p", chan);  in l2cap_abort_rx_srej_sent()
2672 	chan->expected_tx_seq = chan->buffer_seq;  in l2cap_abort_rx_srej_sent()
2673 	l2cap_seq_list_clear(&chan->srej_list);  in l2cap_abort_rx_srej_sent()
2674 	skb_queue_purge(&chan->srej_q);  in l2cap_abort_rx_srej_sent()
2675 	chan->rx_state = L2CAP_RX_STATE_RECV;  in l2cap_abort_rx_srej_sent()
2678 static void l2cap_tx_state_xmit(struct l2cap_chan *chan,  in l2cap_tx_state_xmit()  argument
2682 	BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,  in l2cap_tx_state_xmit()
2687 		if (chan->tx_send_head == NULL)  in l2cap_tx_state_xmit()
2688 			chan->tx_send_head = skb_peek(skbs);  in l2cap_tx_state_xmit()
2690 		skb_queue_splice_tail_init(skbs, &chan->tx_q);  in l2cap_tx_state_xmit()
2691 		l2cap_ertm_send(chan);  in l2cap_tx_state_xmit()
2695 		set_bit(CONN_LOCAL_BUSY, &chan->conn_state);  in l2cap_tx_state_xmit()
2697 		if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {  in l2cap_tx_state_xmit()
2701 			l2cap_abort_rx_srej_sent(chan);  in l2cap_tx_state_xmit()
2704 		l2cap_send_ack(chan);  in l2cap_tx_state_xmit()
2709 		clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);  in l2cap_tx_state_xmit()
2711 		if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {  in l2cap_tx_state_xmit()
2718 			local_control.reqseq = chan->buffer_seq;  in l2cap_tx_state_xmit()
2719 			l2cap_send_sframe(chan, &local_control);  in l2cap_tx_state_xmit()
2721 			chan->retry_count = 1;  in l2cap_tx_state_xmit()
2722 			__set_monitor_timer(chan);  in l2cap_tx_state_xmit()
2723 			chan->tx_state = L2CAP_TX_STATE_WAIT_F;  in l2cap_tx_state_xmit()
2727 		l2cap_process_reqseq(chan, control->reqseq);  in l2cap_tx_state_xmit()
2730 		l2cap_send_rr_or_rnr(chan, 1);  in l2cap_tx_state_xmit()
2731 		chan->retry_count = 1;  in l2cap_tx_state_xmit()
2732 		__set_monitor_timer(chan);  in l2cap_tx_state_xmit()
2733 		__clear_ack_timer(chan);  in l2cap_tx_state_xmit()
2734 		chan->tx_state = L2CAP_TX_STATE_WAIT_F;  in l2cap_tx_state_xmit()
2737 		l2cap_send_rr_or_rnr(chan, 1);  in l2cap_tx_state_xmit()
2738 		chan->retry_count = 1;  in l2cap_tx_state_xmit()
2739 		__set_monitor_timer(chan);  in l2cap_tx_state_xmit()
2740 		chan->tx_state = L2CAP_TX_STATE_WAIT_F;  in l2cap_tx_state_xmit()
2750 static void l2cap_tx_state_wait_f(struct l2cap_chan *chan,  in l2cap_tx_state_wait_f()  argument
2754 	BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,  in l2cap_tx_state_wait_f()
2759 		if (chan->tx_send_head == NULL)  in l2cap_tx_state_wait_f()
2760 			chan->tx_send_head = skb_peek(skbs);  in l2cap_tx_state_wait_f()
2762 		skb_queue_splice_tail_init(skbs, &chan->tx_q);  in l2cap_tx_state_wait_f()
2766 		set_bit(CONN_LOCAL_BUSY, &chan->conn_state);  in l2cap_tx_state_wait_f()
2768 		if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {  in l2cap_tx_state_wait_f()
2772 			l2cap_abort_rx_srej_sent(chan);  in l2cap_tx_state_wait_f()
2775 		l2cap_send_ack(chan);  in l2cap_tx_state_wait_f()
2780 		clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);  in l2cap_tx_state_wait_f()
2782 		if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {  in l2cap_tx_state_wait_f()
2788 			local_control.reqseq = chan->buffer_seq;  in l2cap_tx_state_wait_f()
2789 			l2cap_send_sframe(chan, &local_control);  in l2cap_tx_state_wait_f()
2791 			chan->retry_count = 1;  in l2cap_tx_state_wait_f()
2792 			__set_monitor_timer(chan);  in l2cap_tx_state_wait_f()
2793 			chan->tx_state = L2CAP_TX_STATE_WAIT_F;  in l2cap_tx_state_wait_f()
2797 		l2cap_process_reqseq(chan, control->reqseq);  in l2cap_tx_state_wait_f()
2803 			__clear_monitor_timer(chan);  in l2cap_tx_state_wait_f()
2804 			if (chan->unacked_frames > 0)  in l2cap_tx_state_wait_f()
2805 				__set_retrans_timer(chan);  in l2cap_tx_state_wait_f()
2806 			chan->retry_count = 0;  in l2cap_tx_state_wait_f()
2807 			chan->tx_state = L2CAP_TX_STATE_XMIT;  in l2cap_tx_state_wait_f()
2808 			BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state);  in l2cap_tx_state_wait_f()
2815 		if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) {  in l2cap_tx_state_wait_f()
2816 			l2cap_send_rr_or_rnr(chan, 1);  in l2cap_tx_state_wait_f()
2817 			__set_monitor_timer(chan);  in l2cap_tx_state_wait_f()
2818 			chan->retry_count++;  in l2cap_tx_state_wait_f()
2820 			l2cap_send_disconn_req(chan, ECONNABORTED);  in l2cap_tx_state_wait_f()
2828 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,  in l2cap_tx()  argument
2832 	       chan, control, skbs, event, chan->tx_state);  in l2cap_tx()
2834 	switch (chan->tx_state) {  in l2cap_tx()
2836 		l2cap_tx_state_xmit(chan, control, skbs, event);  in l2cap_tx()
2839 		l2cap_tx_state_wait_f(chan, control, skbs, event);  in l2cap_tx()
2847 static void l2cap_pass_to_tx(struct l2cap_chan *chan,  in l2cap_pass_to_tx()  argument
2850 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_pass_to_tx()
2851 	l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT);  in l2cap_pass_to_tx()
2854 static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan,  in l2cap_pass_to_tx_fbit()  argument
2857 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_pass_to_tx_fbit()
2858 	l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT);  in l2cap_pass_to_tx_fbit()
2865 	struct l2cap_chan *chan;  in l2cap_raw_recv()  local
2871 	list_for_each_entry(chan, &conn->chan_l, list) {  in l2cap_raw_recv()
2872 		if (chan->chan_type != L2CAP_CHAN_RAW)  in l2cap_raw_recv()
2876 		if (bt_cb(skb)->l2cap.chan == chan)  in l2cap_raw_recv()
2882 		if (chan->ops->recv(chan, nskb))  in l2cap_raw_recv()
3023 static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan, size_t size)  in l2cap_add_opt_efs()  argument
3027 	switch (chan->mode) {  in l2cap_add_opt_efs()
3029 		efs.id		= chan->local_id;  in l2cap_add_opt_efs()
3030 		efs.stype	= chan->local_stype;  in l2cap_add_opt_efs()
3031 		efs.msdu	= cpu_to_le16(chan->local_msdu);  in l2cap_add_opt_efs()
3032 		efs.sdu_itime	= cpu_to_le32(chan->local_sdu_itime);  in l2cap_add_opt_efs()
3040 		efs.msdu	= cpu_to_le16(chan->local_msdu);  in l2cap_add_opt_efs()
3041 		efs.sdu_itime	= cpu_to_le32(chan->local_sdu_itime);  in l2cap_add_opt_efs()
3056 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,  in l2cap_ack_timeout()  local
3060 	BT_DBG("chan %p", chan);  in l2cap_ack_timeout()
3062 	l2cap_chan_lock(chan);  in l2cap_ack_timeout()
3064 	frames_to_ack = __seq_offset(chan, chan->buffer_seq,  in l2cap_ack_timeout()
3065 				     chan->last_acked_seq);  in l2cap_ack_timeout()
3068 		l2cap_send_rr_or_rnr(chan, 0);  in l2cap_ack_timeout()
3070 	l2cap_chan_unlock(chan);  in l2cap_ack_timeout()
3071 	l2cap_chan_put(chan);  in l2cap_ack_timeout()
3074 int l2cap_ertm_init(struct l2cap_chan *chan)  in l2cap_ertm_init()  argument
3078 	chan->next_tx_seq = 0;  in l2cap_ertm_init()
3079 	chan->expected_tx_seq = 0;  in l2cap_ertm_init()
3080 	chan->expected_ack_seq = 0;  in l2cap_ertm_init()
3081 	chan->unacked_frames = 0;  in l2cap_ertm_init()
3082 	chan->buffer_seq = 0;  in l2cap_ertm_init()
3083 	chan->frames_sent = 0;  in l2cap_ertm_init()
3084 	chan->last_acked_seq = 0;  in l2cap_ertm_init()
3085 	chan->sdu = NULL;  in l2cap_ertm_init()
3086 	chan->sdu_last_frag = NULL;  in l2cap_ertm_init()
3087 	chan->sdu_len = 0;  in l2cap_ertm_init()
3089 	skb_queue_head_init(&chan->tx_q);  in l2cap_ertm_init()
3091 	chan->local_amp_id = AMP_ID_BREDR;  in l2cap_ertm_init()
3092 	chan->move_id = AMP_ID_BREDR;  in l2cap_ertm_init()
3093 	chan->move_state = L2CAP_MOVE_STABLE;  in l2cap_ertm_init()
3094 	chan->move_role = L2CAP_MOVE_ROLE_NONE;  in l2cap_ertm_init()
3096 	if (chan->mode != L2CAP_MODE_ERTM)  in l2cap_ertm_init()
3099 	chan->rx_state = L2CAP_RX_STATE_RECV;  in l2cap_ertm_init()
3100 	chan->tx_state = L2CAP_TX_STATE_XMIT;  in l2cap_ertm_init()
3102 	INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);  in l2cap_ertm_init()
3103 	INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);  in l2cap_ertm_init()
3104 	INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);  in l2cap_ertm_init()
3106 	skb_queue_head_init(&chan->srej_q);  in l2cap_ertm_init()
3108 	err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);  in l2cap_ertm_init()
3112 	err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);  in l2cap_ertm_init()
3114 		l2cap_seq_list_free(&chan->srej_list);  in l2cap_ertm_init()
3144 static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan,  in __l2cap_set_ertm_timeouts()  argument
3147 	if (chan->local_amp_id != AMP_ID_BREDR && chan->hs_hcon) {  in __l2cap_set_ertm_timeouts()
3148 		u64 ertm_to = chan->hs_hcon->hdev->amp_be_flush_to;  in __l2cap_set_ertm_timeouts()
3182 static inline void l2cap_txwin_setup(struct l2cap_chan *chan)  in l2cap_txwin_setup()  argument
3184 	if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&  in l2cap_txwin_setup()
3185 	    __l2cap_ews_supported(chan->conn)) {  in l2cap_txwin_setup()
3187 		set_bit(FLAG_EXT_CTRL, &chan->flags);  in l2cap_txwin_setup()
3188 		chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;  in l2cap_txwin_setup()
3190 		chan->tx_win = min_t(u16, chan->tx_win,  in l2cap_txwin_setup()
3192 		chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;  in l2cap_txwin_setup()
3194 	chan->ack_win = chan->tx_win;  in l2cap_txwin_setup()
3197 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)  in l2cap_build_conf_req()  argument
3200 	struct l2cap_conf_rfc rfc = { .mode = chan->mode };  in l2cap_build_conf_req()
3205 	BT_DBG("chan %p", chan);  in l2cap_build_conf_req()
3207 	if (chan->num_conf_req || chan->num_conf_rsp)  in l2cap_build_conf_req()
3210 	switch (chan->mode) {  in l2cap_build_conf_req()
3213 		if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))  in l2cap_build_conf_req()
3216 		if (__l2cap_efs_supported(chan->conn))  in l2cap_build_conf_req()
3217 			set_bit(FLAG_EFS_ENABLE, &chan->flags);  in l2cap_build_conf_req()
3221 		chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);  in l2cap_build_conf_req()
3226 	if (chan->imtu != L2CAP_DEFAULT_MTU)  in l2cap_build_conf_req()
3227 		l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, endptr - ptr);  in l2cap_build_conf_req()
3229 	switch (chan->mode) {  in l2cap_build_conf_req()
3234 		if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&  in l2cap_build_conf_req()
3235 		    !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))  in l2cap_build_conf_req()
3251 		rfc.max_transmit    = chan->max_tx;  in l2cap_build_conf_req()
3253 		__l2cap_set_ertm_timeouts(chan, &rfc);  in l2cap_build_conf_req()
3255 		size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -  in l2cap_build_conf_req()
3260 		l2cap_txwin_setup(chan);  in l2cap_build_conf_req()
3262 		rfc.txwin_size = min_t(u16, chan->tx_win,  in l2cap_build_conf_req()
3268 		if (test_bit(FLAG_EFS_ENABLE, &chan->flags))  in l2cap_build_conf_req()
3269 			l2cap_add_opt_efs(&ptr, chan, endptr - ptr);  in l2cap_build_conf_req()
3271 		if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_build_conf_req()
3273 					   chan->tx_win, endptr - ptr);  in l2cap_build_conf_req()
3275 		if (chan->conn->feat_mask & L2CAP_FEAT_FCS)  in l2cap_build_conf_req()
3276 			if (chan->fcs == L2CAP_FCS_NONE ||  in l2cap_build_conf_req()
3277 			    test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {  in l2cap_build_conf_req()
3278 				chan->fcs = L2CAP_FCS_NONE;  in l2cap_build_conf_req()
3280 						   chan->fcs, endptr - ptr);  in l2cap_build_conf_req()
3285 		l2cap_txwin_setup(chan);  in l2cap_build_conf_req()
3292 		size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -  in l2cap_build_conf_req()
3300 		if (test_bit(FLAG_EFS_ENABLE, &chan->flags))  in l2cap_build_conf_req()
3301 			l2cap_add_opt_efs(&ptr, chan, endptr - ptr);  in l2cap_build_conf_req()
3303 		if (chan->conn->feat_mask & L2CAP_FEAT_FCS)  in l2cap_build_conf_req()
3304 			if (chan->fcs == L2CAP_FCS_NONE ||  in l2cap_build_conf_req()
3305 			    test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {  in l2cap_build_conf_req()
3306 				chan->fcs = L2CAP_FCS_NONE;  in l2cap_build_conf_req()
3308 						   chan->fcs, endptr - ptr);  in l2cap_build_conf_req()
3313 	req->dcid  = cpu_to_le16(chan->dcid);  in l2cap_build_conf_req()
3319 static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)  in l2cap_parse_conf_req()  argument
3324 	void *req = chan->conf_req;  in l2cap_parse_conf_req()
3325 	int len = chan->conf_len;  in l2cap_parse_conf_req()
3335 	BT_DBG("chan %p", chan);  in l2cap_parse_conf_req()
3349 			chan->flush_to = val;  in l2cap_parse_conf_req()
3362 				set_bit(CONF_RECV_NO_FCS, &chan->conf_state);  in l2cap_parse_conf_req()
3373 			if (!(chan->conn->local_fixed_chan & L2CAP_FC_A2MP))  in l2cap_parse_conf_req()
3376 			set_bit(FLAG_EXT_CTRL, &chan->flags);  in l2cap_parse_conf_req()
3377 			set_bit(CONF_EWS_RECV, &chan->conf_state);  in l2cap_parse_conf_req()
3378 			chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;  in l2cap_parse_conf_req()
3379 			chan->remote_tx_win = val;  in l2cap_parse_conf_req()
3392 	if (chan->num_conf_rsp || chan->num_conf_req > 1)  in l2cap_parse_conf_req()
3395 	switch (chan->mode) {  in l2cap_parse_conf_req()
3398 		if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {  in l2cap_parse_conf_req()
3399 			chan->mode = l2cap_select_mode(rfc.mode,  in l2cap_parse_conf_req()
3400 						       chan->conn->feat_mask);  in l2cap_parse_conf_req()
3405 			if (__l2cap_efs_supported(chan->conn))  in l2cap_parse_conf_req()
3406 				set_bit(FLAG_EFS_ENABLE, &chan->flags);  in l2cap_parse_conf_req()
3411 		if (chan->mode != rfc.mode)  in l2cap_parse_conf_req()
3418 	if (chan->mode != rfc.mode) {  in l2cap_parse_conf_req()
3420 		rfc.mode = chan->mode;  in l2cap_parse_conf_req()
3422 		if (chan->num_conf_rsp == 1)  in l2cap_parse_conf_req()
3436 			chan->omtu = mtu;  in l2cap_parse_conf_req()
3437 			set_bit(CONF_MTU_DONE, &chan->conf_state);  in l2cap_parse_conf_req()
3439 		l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu, endptr - ptr);  in l2cap_parse_conf_req()
3442 			if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&  in l2cap_parse_conf_req()
3444 			    efs.stype != chan->local_stype) {  in l2cap_parse_conf_req()
3448 				if (chan->num_conf_req >= 1)  in l2cap_parse_conf_req()
3457 				set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);  in l2cap_parse_conf_req()
3463 			chan->fcs = L2CAP_FCS_NONE;  in l2cap_parse_conf_req()
3464 			set_bit(CONF_MODE_DONE, &chan->conf_state);  in l2cap_parse_conf_req()
3468 			if (!test_bit(CONF_EWS_RECV, &chan->conf_state))  in l2cap_parse_conf_req()
3469 				chan->remote_tx_win = rfc.txwin_size;  in l2cap_parse_conf_req()
3473 			chan->remote_max_tx = rfc.max_transmit;  in l2cap_parse_conf_req()
3476 				     chan->conn->mtu - L2CAP_EXT_HDR_SIZE -  in l2cap_parse_conf_req()
3479 			chan->remote_mps = size;  in l2cap_parse_conf_req()
3481 			__l2cap_set_ertm_timeouts(chan, &rfc);  in l2cap_parse_conf_req()
3483 			set_bit(CONF_MODE_DONE, &chan->conf_state);  in l2cap_parse_conf_req()
3488 			if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {  in l2cap_parse_conf_req()
3489 				chan->remote_id = efs.id;  in l2cap_parse_conf_req()
3490 				chan->remote_stype = efs.stype;  in l2cap_parse_conf_req()
3491 				chan->remote_msdu = le16_to_cpu(efs.msdu);  in l2cap_parse_conf_req()
3492 				chan->remote_flush_to =  in l2cap_parse_conf_req()
3494 				chan->remote_acc_lat =  in l2cap_parse_conf_req()
3496 				chan->remote_sdu_itime =  in l2cap_parse_conf_req()
3506 				     chan->conn->mtu - L2CAP_EXT_HDR_SIZE -  in l2cap_parse_conf_req()
3509 			chan->remote_mps = size;  in l2cap_parse_conf_req()
3511 			set_bit(CONF_MODE_DONE, &chan->conf_state);  in l2cap_parse_conf_req()
3522 			rfc.mode = chan->mode;  in l2cap_parse_conf_req()
3526 			set_bit(CONF_OUTPUT_DONE, &chan->conf_state);  in l2cap_parse_conf_req()
3528 	rsp->scid   = cpu_to_le16(chan->dcid);  in l2cap_parse_conf_req()
3535 static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,  in l2cap_parse_conf_rsp()  argument
3546 	BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);  in l2cap_parse_conf_rsp()
3555 				chan->imtu = L2CAP_DEFAULT_MIN_MTU;  in l2cap_parse_conf_rsp()
3557 				chan->imtu = val;  in l2cap_parse_conf_rsp()
3558 			l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, endptr - ptr);  in l2cap_parse_conf_rsp()
3562 			chan->flush_to = val;  in l2cap_parse_conf_rsp()
3564 					   2, chan->flush_to, endptr - ptr);  in l2cap_parse_conf_rsp()
3571 			if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&  in l2cap_parse_conf_rsp()
3572 			    rfc.mode != chan->mode)  in l2cap_parse_conf_rsp()
3575 			chan->fcs = 0;  in l2cap_parse_conf_rsp()
3582 			chan->ack_win = min_t(u16, val, chan->ack_win);  in l2cap_parse_conf_rsp()
3584 					   chan->tx_win, endptr - ptr);  in l2cap_parse_conf_rsp()
3591 				if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&  in l2cap_parse_conf_rsp()
3593 				    efs.stype != chan->local_stype)  in l2cap_parse_conf_rsp()
3605 						&chan->conf_state);  in l2cap_parse_conf_rsp()
3610 	if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)  in l2cap_parse_conf_rsp()
3613 	chan->mode = rfc.mode;  in l2cap_parse_conf_rsp()
3618 			chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);  in l2cap_parse_conf_rsp()
3619 			chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);  in l2cap_parse_conf_rsp()
3620 			chan->mps    = le16_to_cpu(rfc.max_pdu_size);  in l2cap_parse_conf_rsp()
3621 			if (!test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_parse_conf_rsp()
3622 				chan->ack_win = min_t(u16, chan->ack_win,  in l2cap_parse_conf_rsp()
3625 			if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {  in l2cap_parse_conf_rsp()
3626 				chan->local_msdu = le16_to_cpu(efs.msdu);  in l2cap_parse_conf_rsp()
3627 				chan->local_sdu_itime =  in l2cap_parse_conf_rsp()
3629 				chan->local_acc_lat = le32_to_cpu(efs.acc_lat);  in l2cap_parse_conf_rsp()
3630 				chan->local_flush_to =  in l2cap_parse_conf_rsp()
3636 			chan->mps    = le16_to_cpu(rfc.max_pdu_size);  in l2cap_parse_conf_rsp()
3640 	req->dcid   = cpu_to_le16(chan->dcid);  in l2cap_parse_conf_rsp()
3646 static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data,  in l2cap_build_conf_rsp()  argument
3652 	BT_DBG("chan %p", chan);  in l2cap_build_conf_rsp()
3654 	rsp->scid   = cpu_to_le16(chan->dcid);  in l2cap_build_conf_rsp()
3661 void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan)  in __l2cap_le_connect_rsp_defer()  argument
3664 	struct l2cap_conn *conn = chan->conn;  in __l2cap_le_connect_rsp_defer()
3666 	BT_DBG("chan %p", chan);  in __l2cap_le_connect_rsp_defer()
3668 	rsp.dcid    = cpu_to_le16(chan->scid);  in __l2cap_le_connect_rsp_defer()
3669 	rsp.mtu     = cpu_to_le16(chan->imtu);  in __l2cap_le_connect_rsp_defer()
3670 	rsp.mps     = cpu_to_le16(chan->mps);  in __l2cap_le_connect_rsp_defer()
3671 	rsp.credits = cpu_to_le16(chan->rx_credits);  in __l2cap_le_connect_rsp_defer()
3674 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),  in __l2cap_le_connect_rsp_defer()
3678 void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)  in __l2cap_connect_rsp_defer()  argument
3681 	struct l2cap_conn *conn = chan->conn;  in __l2cap_connect_rsp_defer()
3685 	rsp.scid   = cpu_to_le16(chan->dcid);  in __l2cap_connect_rsp_defer()
3686 	rsp.dcid   = cpu_to_le16(chan->scid);  in __l2cap_connect_rsp_defer()
3690 	if (chan->hs_hcon)  in __l2cap_connect_rsp_defer()
3695 	BT_DBG("chan %p rsp_code %u", chan, rsp_code);  in __l2cap_connect_rsp_defer()
3697 	l2cap_send_cmd(conn, chan->ident, rsp_code, sizeof(rsp), &rsp);  in __l2cap_connect_rsp_defer()
3699 	if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))  in __l2cap_connect_rsp_defer()
3703 		       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);  in __l2cap_connect_rsp_defer()
3704 	chan->num_conf_req++;  in __l2cap_connect_rsp_defer()
3707 static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)  in l2cap_conf_rfc_get()  argument
3714 	u16 txwin_ext = chan->ack_win;  in l2cap_conf_rfc_get()
3716 		.mode = chan->mode,  in l2cap_conf_rfc_get()
3719 		.max_pdu_size = cpu_to_le16(chan->imtu),  in l2cap_conf_rfc_get()
3720 		.txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW),  in l2cap_conf_rfc_get()
3723 	BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);  in l2cap_conf_rfc_get()
3725 	if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))  in l2cap_conf_rfc_get()
3744 		chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);  in l2cap_conf_rfc_get()
3745 		chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);  in l2cap_conf_rfc_get()
3746 		chan->mps = le16_to_cpu(rfc.max_pdu_size);  in l2cap_conf_rfc_get()
3747 		if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_conf_rfc_get()
3748 			chan->ack_win = min_t(u16, chan->ack_win, txwin_ext);  in l2cap_conf_rfc_get()
3750 			chan->ack_win = min_t(u16, chan->ack_win,  in l2cap_conf_rfc_get()
3754 		chan->mps    = le16_to_cpu(rfc.max_pdu_size);  in l2cap_conf_rfc_get()
3789 	struct l2cap_chan *chan = NULL, *pchan;  in l2cap_connect()  local
3822 	chan = pchan->ops->new_connection(pchan);  in l2cap_connect()
3823 	if (!chan)  in l2cap_connect()
3833 	bacpy(&chan->src, &conn->hcon->src);  in l2cap_connect()
3834 	bacpy(&chan->dst, &conn->hcon->dst);  in l2cap_connect()
3835 	chan->src_type = bdaddr_src_type(conn->hcon);  in l2cap_connect()
3836 	chan->dst_type = bdaddr_dst_type(conn->hcon);  in l2cap_connect()
3837 	chan->psm  = psm;  in l2cap_connect()
3838 	chan->dcid = scid;  in l2cap_connect()
3839 	chan->local_amp_id = amp_id;  in l2cap_connect()
3841 	__l2cap_chan_add(conn, chan);  in l2cap_connect()
3843 	dcid = chan->scid;  in l2cap_connect()
3845 	__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));  in l2cap_connect()
3847 	chan->ident = cmd->ident;  in l2cap_connect()
3850 		if (l2cap_chan_check_security(chan, false)) {  in l2cap_connect()
3851 			if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {  in l2cap_connect()
3852 				l2cap_state_change(chan, BT_CONNECT2);  in l2cap_connect()
3855 				chan->ops->defer(chan);  in l2cap_connect()
3862 					l2cap_state_change(chan, BT_CONFIG);  in l2cap_connect()
3865 					l2cap_state_change(chan, BT_CONNECT2);  in l2cap_connect()
3871 			l2cap_state_change(chan, BT_CONNECT2);  in l2cap_connect()
3876 		l2cap_state_change(chan, BT_CONNECT2);  in l2cap_connect()
3906 	if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&  in l2cap_connect()
3909 		set_bit(CONF_REQ_SENT, &chan->conf_state);  in l2cap_connect()
3911 			       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);  in l2cap_connect()
3912 		chan->num_conf_req++;  in l2cap_connect()
3915 	return chan;  in l2cap_connect()
3943 	struct l2cap_chan *chan;  in l2cap_connect_create_rsp()  local
3961 		chan = __l2cap_get_chan_by_scid(conn, scid);  in l2cap_connect_create_rsp()
3962 		if (!chan) {  in l2cap_connect_create_rsp()
3967 		chan = __l2cap_get_chan_by_ident(conn, cmd->ident);  in l2cap_connect_create_rsp()
3968 		if (!chan) {  in l2cap_connect_create_rsp()
3976 	l2cap_chan_lock(chan);  in l2cap_connect_create_rsp()
3980 		l2cap_state_change(chan, BT_CONFIG);  in l2cap_connect_create_rsp()
3981 		chan->ident = 0;  in l2cap_connect_create_rsp()
3982 		chan->dcid = dcid;  in l2cap_connect_create_rsp()
3983 		clear_bit(CONF_CONNECT_PEND, &chan->conf_state);  in l2cap_connect_create_rsp()
3985 		if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))  in l2cap_connect_create_rsp()
3989 			       l2cap_build_conf_req(chan, req, sizeof(req)), req);  in l2cap_connect_create_rsp()
3990 		chan->num_conf_req++;  in l2cap_connect_create_rsp()
3994 		set_bit(CONF_CONNECT_PEND, &chan->conf_state);  in l2cap_connect_create_rsp()
3998 		l2cap_chan_del(chan, ECONNREFUSED);  in l2cap_connect_create_rsp()
4002 	l2cap_chan_unlock(chan);  in l2cap_connect_create_rsp()
4010 static inline void set_default_fcs(struct l2cap_chan *chan)  in set_default_fcs()  argument
4015 	if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)  in set_default_fcs()
4016 		chan->fcs = L2CAP_FCS_NONE;  in set_default_fcs()
4017 	else if (!test_bit(CONF_RECV_NO_FCS, &chan->conf_state))  in set_default_fcs()
4018 		chan->fcs = L2CAP_FCS_CRC16;  in set_default_fcs()
4021 static void l2cap_send_efs_conf_rsp(struct l2cap_chan *chan, void *data,  in l2cap_send_efs_conf_rsp()  argument
4024 	struct l2cap_conn *conn = chan->conn;  in l2cap_send_efs_conf_rsp()
4026 	BT_DBG("conn %p chan %p ident %d flags 0x%4.4x", conn, chan, ident,  in l2cap_send_efs_conf_rsp()
4029 	clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);  in l2cap_send_efs_conf_rsp()
4030 	set_bit(CONF_OUTPUT_DONE, &chan->conf_state);  in l2cap_send_efs_conf_rsp()
4033 		       l2cap_build_conf_rsp(chan, data,  in l2cap_send_efs_conf_rsp()
4056 	struct l2cap_chan *chan;  in l2cap_config_req()  local
4067 	chan = l2cap_get_chan_by_scid(conn, dcid);  in l2cap_config_req()
4068 	if (!chan) {  in l2cap_config_req()
4073 	if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) {  in l2cap_config_req()
4074 		cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,  in l2cap_config_req()
4075 				       chan->dcid);  in l2cap_config_req()
4081 	if (chan->conf_len + len > sizeof(chan->conf_req)) {  in l2cap_config_req()
4083 			       l2cap_build_conf_rsp(chan, rsp,  in l2cap_config_req()
4089 	memcpy(chan->conf_req + chan->conf_len, req->data, len);  in l2cap_config_req()
4090 	chan->conf_len += len;  in l2cap_config_req()
4095 			       l2cap_build_conf_rsp(chan, rsp,  in l2cap_config_req()
4101 	len = l2cap_parse_conf_req(chan, rsp, sizeof(rsp));  in l2cap_config_req()
4103 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_config_req()
4107 	chan->ident = cmd->ident;  in l2cap_config_req()
4109 	chan->num_conf_rsp++;  in l2cap_config_req()
4112 	chan->conf_len = 0;  in l2cap_config_req()
4114 	if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))  in l2cap_config_req()
4117 	if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {  in l2cap_config_req()
4118 		set_default_fcs(chan);  in l2cap_config_req()
4120 		if (chan->mode == L2CAP_MODE_ERTM ||  in l2cap_config_req()
4121 		    chan->mode == L2CAP_MODE_STREAMING)  in l2cap_config_req()
4122 			err = l2cap_ertm_init(chan);  in l2cap_config_req()
4125 			l2cap_send_disconn_req(chan, -err);  in l2cap_config_req()
4127 			l2cap_chan_ready(chan);  in l2cap_config_req()
4132 	if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {  in l2cap_config_req()
4135 			       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);  in l2cap_config_req()
4136 		chan->num_conf_req++;  in l2cap_config_req()
4141 	if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&  in l2cap_config_req()
4142 	    test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {  in l2cap_config_req()
4147 		if (!chan->hs_hcon)  in l2cap_config_req()
4148 			l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags);  in l2cap_config_req()
4150 			chan->ident = cmd->ident;  in l2cap_config_req()
4154 	l2cap_chan_unlock(chan);  in l2cap_config_req()
4164 	struct l2cap_chan *chan;  in l2cap_config_rsp()  local
4178 	chan = l2cap_get_chan_by_scid(conn, scid);  in l2cap_config_rsp()
4179 	if (!chan)  in l2cap_config_rsp()
4184 		l2cap_conf_rfc_get(chan, rsp->data, len);  in l2cap_config_rsp()
4185 		clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);  in l2cap_config_rsp()
4189 		set_bit(CONF_REM_CONF_PEND, &chan->conf_state);  in l2cap_config_rsp()
4191 		if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {  in l2cap_config_rsp()
4194 			len = l2cap_parse_conf_rsp(chan, rsp->data, len,  in l2cap_config_rsp()
4197 				l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_config_rsp()
4201 			if (!chan->hs_hcon) {  in l2cap_config_rsp()
4202 				l2cap_send_efs_conf_rsp(chan, buf, cmd->ident,  in l2cap_config_rsp()
4205 				if (l2cap_check_efs(chan)) {  in l2cap_config_rsp()
4206 					amp_create_logical_link(chan);  in l2cap_config_rsp()
4207 					chan->ident = cmd->ident;  in l2cap_config_rsp()
4214 		if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {  in l2cap_config_rsp()
4218 				l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_config_rsp()
4224 			len = l2cap_parse_conf_rsp(chan, rsp->data, len,  in l2cap_config_rsp()
4227 				l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_config_rsp()
4233 			chan->num_conf_req++;  in l2cap_config_rsp()
4240 		l2cap_chan_set_err(chan, ECONNRESET);  in l2cap_config_rsp()
4242 		__set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);  in l2cap_config_rsp()
4243 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_config_rsp()
4250 	set_bit(CONF_INPUT_DONE, &chan->conf_state);  in l2cap_config_rsp()
4252 	if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {  in l2cap_config_rsp()
4253 		set_default_fcs(chan);  in l2cap_config_rsp()
4255 		if (chan->mode == L2CAP_MODE_ERTM ||  in l2cap_config_rsp()
4256 		    chan->mode == L2CAP_MODE_STREAMING)  in l2cap_config_rsp()
4257 			err = l2cap_ertm_init(chan);  in l2cap_config_rsp()
4260 			l2cap_send_disconn_req(chan, -err);  in l2cap_config_rsp()
4262 			l2cap_chan_ready(chan);  in l2cap_config_rsp()
4266 	l2cap_chan_unlock(chan);  in l2cap_config_rsp()
4277 	struct l2cap_chan *chan;  in l2cap_disconnect_req()  local
4289 	chan = __l2cap_get_chan_by_scid(conn, dcid);  in l2cap_disconnect_req()
4290 	if (!chan) {  in l2cap_disconnect_req()
4296 	l2cap_chan_lock(chan);  in l2cap_disconnect_req()
4298 	rsp.dcid = cpu_to_le16(chan->scid);  in l2cap_disconnect_req()
4299 	rsp.scid = cpu_to_le16(chan->dcid);  in l2cap_disconnect_req()
4302 	chan->ops->set_shutdown(chan);  in l2cap_disconnect_req()
4304 	l2cap_chan_hold(chan);  in l2cap_disconnect_req()
4305 	l2cap_chan_del(chan, ECONNRESET);  in l2cap_disconnect_req()
4307 	l2cap_chan_unlock(chan);  in l2cap_disconnect_req()
4309 	chan->ops->close(chan);  in l2cap_disconnect_req()
4310 	l2cap_chan_put(chan);  in l2cap_disconnect_req()
4323 	struct l2cap_chan *chan;  in l2cap_disconnect_rsp()  local
4335 	chan = __l2cap_get_chan_by_scid(conn, scid);  in l2cap_disconnect_rsp()
4336 	if (!chan) {  in l2cap_disconnect_rsp()
4341 	l2cap_chan_lock(chan);  in l2cap_disconnect_rsp()
4343 	l2cap_chan_hold(chan);  in l2cap_disconnect_rsp()
4344 	l2cap_chan_del(chan, 0);  in l2cap_disconnect_rsp()
4346 	l2cap_chan_unlock(chan);  in l2cap_disconnect_rsp()
4348 	chan->ops->close(chan);  in l2cap_disconnect_rsp()
4349 	l2cap_chan_put(chan);  in l2cap_disconnect_rsp()
4476 	struct l2cap_chan *chan;  in l2cap_create_channel_req()  local
4508 	chan = l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,  in l2cap_create_channel_req()
4510 	if (chan) {  in l2cap_create_channel_req()
4518 			cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,  in l2cap_create_channel_req()
4519 					       chan->dcid);  in l2cap_create_channel_req()
4523 		BT_DBG("mgr %p bredr_chan %p hs_hcon %p", mgr, chan, hs_hcon);  in l2cap_create_channel_req()
4525 		mgr->bredr_chan = chan;  in l2cap_create_channel_req()
4526 		chan->hs_hcon = hs_hcon;  in l2cap_create_channel_req()
4527 		chan->fcs = L2CAP_FCS_NONE;  in l2cap_create_channel_req()
4547 static void l2cap_send_move_chan_req(struct l2cap_chan *chan, u8 dest_amp_id)  in l2cap_send_move_chan_req()  argument
4552 	BT_DBG("chan %p, dest_amp_id %d", chan, dest_amp_id);  in l2cap_send_move_chan_req()
4554 	ident = l2cap_get_ident(chan->conn);  in l2cap_send_move_chan_req()
4555 	chan->ident = ident;  in l2cap_send_move_chan_req()
4557 	req.icid = cpu_to_le16(chan->scid);  in l2cap_send_move_chan_req()
4560 	l2cap_send_cmd(chan->conn, ident, L2CAP_MOVE_CHAN_REQ, sizeof(req),  in l2cap_send_move_chan_req()
4563 	__set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);  in l2cap_send_move_chan_req()
4566 static void l2cap_send_move_chan_rsp(struct l2cap_chan *chan, u16 result)  in l2cap_send_move_chan_rsp()  argument
4570 	BT_DBG("chan %p, result 0x%4.4x", chan, result);  in l2cap_send_move_chan_rsp()
4572 	rsp.icid = cpu_to_le16(chan->dcid);  in l2cap_send_move_chan_rsp()
4575 	l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_RSP,  in l2cap_send_move_chan_rsp()
4579 static void l2cap_send_move_chan_cfm(struct l2cap_chan *chan, u16 result)  in l2cap_send_move_chan_cfm()  argument
4583 	BT_DBG("chan %p, result 0x%4.4x", chan, result);  in l2cap_send_move_chan_cfm()
4585 	chan->ident = l2cap_get_ident(chan->conn);  in l2cap_send_move_chan_cfm()
4587 	cfm.icid = cpu_to_le16(chan->scid);  in l2cap_send_move_chan_cfm()
4590 	l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_CFM,  in l2cap_send_move_chan_cfm()
4593 	__set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);  in l2cap_send_move_chan_cfm()
4620 static void __release_logical_link(struct l2cap_chan *chan)  in __release_logical_link()  argument
4622 	chan->hs_hchan = NULL;  in __release_logical_link()
4623 	chan->hs_hcon = NULL;  in __release_logical_link()
4628 static void l2cap_logical_fail(struct l2cap_chan *chan)  in l2cap_logical_fail()  argument
4631 	if (chan->state != BT_CONNECTED) {  in l2cap_logical_fail()
4633 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_logical_fail()
4637 	switch (chan->move_role) {  in l2cap_logical_fail()
4639 		l2cap_move_done(chan);  in l2cap_logical_fail()
4640 		l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_SUPP);  in l2cap_logical_fail()
4643 		if (chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_COMP ||  in l2cap_logical_fail()
4644 		    chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_CFM) {  in l2cap_logical_fail()
4648 			l2cap_move_done(chan);  in l2cap_logical_fail()
4654 		l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);  in l2cap_logical_fail()
4659 static void l2cap_logical_finish_create(struct l2cap_chan *chan,  in l2cap_logical_finish_create()  argument
4664 	chan->hs_hchan = hchan;  in l2cap_logical_finish_create()
4665 	chan->hs_hcon->l2cap_data = chan->conn;  in l2cap_logical_finish_create()
4667 	l2cap_send_efs_conf_rsp(chan, &rsp, chan->ident, 0);  in l2cap_logical_finish_create()
4669 	if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {  in l2cap_logical_finish_create()
4672 		set_default_fcs(chan);  in l2cap_logical_finish_create()
4674 		err = l2cap_ertm_init(chan);  in l2cap_logical_finish_create()
4676 			l2cap_send_disconn_req(chan, -err);  in l2cap_logical_finish_create()
4678 			l2cap_chan_ready(chan);  in l2cap_logical_finish_create()
4682 static void l2cap_logical_finish_move(struct l2cap_chan *chan,  in l2cap_logical_finish_move()  argument
4685 	chan->hs_hcon = hchan->conn;  in l2cap_logical_finish_move()
4686 	chan->hs_hcon->l2cap_data = chan->conn;  in l2cap_logical_finish_move()
4688 	BT_DBG("move_state %d", chan->move_state);  in l2cap_logical_finish_move()
4690 	switch (chan->move_state) {  in l2cap_logical_finish_move()
4695 		chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;  in l2cap_logical_finish_move()
4698 		if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_logical_finish_move()
4699 			chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;  in l2cap_logical_finish_move()
4700 		} else if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {  in l2cap_logical_finish_move()
4701 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;  in l2cap_logical_finish_move()
4702 			l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);  in l2cap_logical_finish_move()
4703 		} else if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {  in l2cap_logical_finish_move()
4704 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;  in l2cap_logical_finish_move()
4705 			l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);  in l2cap_logical_finish_move()
4710 		__release_logical_link(chan);  in l2cap_logical_finish_move()
4712 		chan->move_state = L2CAP_MOVE_STABLE;  in l2cap_logical_finish_move()
4717 void l2cap_logical_cfm(struct l2cap_chan *chan, struct hci_chan *hchan,  in l2cap_logical_cfm()  argument
4720 	BT_DBG("chan %p, hchan %p, status %d", chan, hchan, status);  in l2cap_logical_cfm()
4723 		l2cap_logical_fail(chan);  in l2cap_logical_cfm()
4724 		__release_logical_link(chan);  in l2cap_logical_cfm()
4728 	if (chan->state != BT_CONNECTED) {  in l2cap_logical_cfm()
4730 		if (chan->local_amp_id != AMP_ID_BREDR)  in l2cap_logical_cfm()
4731 			l2cap_logical_finish_create(chan, hchan);  in l2cap_logical_cfm()
4733 		l2cap_logical_finish_move(chan, hchan);  in l2cap_logical_cfm()
4737 void l2cap_move_start(struct l2cap_chan *chan)  in l2cap_move_start()  argument
4739 	BT_DBG("chan %p", chan);  in l2cap_move_start()
4741 	if (chan->local_amp_id == AMP_ID_BREDR) {  in l2cap_move_start()
4742 		if (chan->chan_policy != BT_CHANNEL_POLICY_AMP_PREFERRED)  in l2cap_move_start()
4744 		chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;  in l2cap_move_start()
4745 		chan->move_state = L2CAP_MOVE_WAIT_PREPARE;  in l2cap_move_start()
4748 		chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;  in l2cap_move_start()
4749 		chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;  in l2cap_move_start()
4750 		chan->move_id = 0;  in l2cap_move_start()
4751 		l2cap_move_setup(chan);  in l2cap_move_start()
4752 		l2cap_send_move_chan_req(chan, 0);  in l2cap_move_start()
4756 static void l2cap_do_create(struct l2cap_chan *chan, int result,  in l2cap_do_create()  argument
4759 	BT_DBG("chan %p state %s %u -> %u", chan, state_to_string(chan->state),  in l2cap_do_create()
4762 	chan->fcs = L2CAP_FCS_NONE;  in l2cap_do_create()
4765 	if (chan->state == BT_CONNECT) {  in l2cap_do_create()
4767 			chan->local_amp_id = local_amp_id;  in l2cap_do_create()
4768 			l2cap_send_create_chan_req(chan, remote_amp_id);  in l2cap_do_create()
4771 			l2cap_send_conn_req(chan);  in l2cap_do_create()
4778 	if (__l2cap_no_conn_pending(chan)) {  in l2cap_do_create()
4781 		rsp.scid = cpu_to_le16(chan->dcid);  in l2cap_do_create()
4782 		rsp.dcid = cpu_to_le16(chan->scid);  in l2cap_do_create()
4794 		l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_RSP,  in l2cap_do_create()
4798 			l2cap_state_change(chan, BT_CONFIG);  in l2cap_do_create()
4799 			set_bit(CONF_REQ_SENT, &chan->conf_state);  in l2cap_do_create()
4800 			l2cap_send_cmd(chan->conn, l2cap_get_ident(chan->conn),  in l2cap_do_create()
4802 				       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);  in l2cap_do_create()
4803 			chan->num_conf_req++;  in l2cap_do_create()
4808 static void l2cap_do_move_initiate(struct l2cap_chan *chan, u8 local_amp_id,  in l2cap_do_move_initiate()  argument
4811 	l2cap_move_setup(chan);  in l2cap_do_move_initiate()
4812 	chan->move_id = local_amp_id;  in l2cap_do_move_initiate()
4813 	chan->move_state = L2CAP_MOVE_WAIT_RSP;  in l2cap_do_move_initiate()
4815 	l2cap_send_move_chan_req(chan, remote_amp_id);  in l2cap_do_move_initiate()
4818 static void l2cap_do_move_respond(struct l2cap_chan *chan, int result)  in l2cap_do_move_respond()  argument
4827 			chan->hs_hcon = hchan->conn;  in l2cap_do_move_respond()
4828 			chan->hs_hcon->l2cap_data = chan->conn;  in l2cap_do_move_respond()
4829 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;  in l2cap_do_move_respond()
4830 			l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);  in l2cap_do_move_respond()
4832 			l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);  in l2cap_do_move_respond()
4835 			chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;  in l2cap_do_move_respond()
4839 		l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_ALLOWED);  in l2cap_do_move_respond()
4843 static void l2cap_do_move_cancel(struct l2cap_chan *chan, int result)  in l2cap_do_move_cancel()  argument
4845 	if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {  in l2cap_do_move_cancel()
4852 		l2cap_send_move_chan_rsp(chan, rsp_result);  in l2cap_do_move_cancel()
4855 	chan->move_role = L2CAP_MOVE_ROLE_NONE;  in l2cap_do_move_cancel()
4856 	chan->move_state = L2CAP_MOVE_STABLE;  in l2cap_do_move_cancel()
4859 	l2cap_ertm_send(chan);  in l2cap_do_move_cancel()
4863 void __l2cap_physical_cfm(struct l2cap_chan *chan, int result)  in __l2cap_physical_cfm()  argument
4865 	u8 local_amp_id = chan->local_amp_id;  in __l2cap_physical_cfm()
4866 	u8 remote_amp_id = chan->remote_amp_id;  in __l2cap_physical_cfm()
4869 	       chan, result, local_amp_id, remote_amp_id);  in __l2cap_physical_cfm()
4871 	if (chan->state == BT_DISCONN || chan->state == BT_CLOSED) {  in __l2cap_physical_cfm()
4872 		l2cap_chan_unlock(chan);  in __l2cap_physical_cfm()
4876 	if (chan->state != BT_CONNECTED) {  in __l2cap_physical_cfm()
4877 		l2cap_do_create(chan, result, local_amp_id, remote_amp_id);  in __l2cap_physical_cfm()
4879 		l2cap_do_move_cancel(chan, result);  in __l2cap_physical_cfm()
4881 		switch (chan->move_role) {  in __l2cap_physical_cfm()
4883 			l2cap_do_move_initiate(chan, local_amp_id,  in __l2cap_physical_cfm()
4887 			l2cap_do_move_respond(chan, result);  in __l2cap_physical_cfm()
4890 			l2cap_do_move_cancel(chan, result);  in __l2cap_physical_cfm()
4902 	struct l2cap_chan *chan;  in l2cap_move_channel_req()  local
4916 	chan = l2cap_get_chan_by_dcid(conn, icid);  in l2cap_move_channel_req()
4917 	if (!chan) {  in l2cap_move_channel_req()
4925 	chan->ident = cmd->ident;  in l2cap_move_channel_req()
4927 	if (chan->scid < L2CAP_CID_DYN_START ||  in l2cap_move_channel_req()
4928 	    chan->chan_policy == BT_CHANNEL_POLICY_BREDR_ONLY ||  in l2cap_move_channel_req()
4929 	    (chan->mode != L2CAP_MODE_ERTM &&  in l2cap_move_channel_req()
4930 	     chan->mode != L2CAP_MODE_STREAMING)) {  in l2cap_move_channel_req()
4935 	if (chan->local_amp_id == req->dest_amp_id) {  in l2cap_move_channel_req()
4958 	if ((__chan_is_moving(chan) ||  in l2cap_move_channel_req()
4959 	     chan->move_role != L2CAP_MOVE_ROLE_NONE) &&  in l2cap_move_channel_req()
4965 	chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;  in l2cap_move_channel_req()
4966 	l2cap_move_setup(chan);  in l2cap_move_channel_req()
4967 	chan->move_id = req->dest_amp_id;  in l2cap_move_channel_req()
4968 	icid = chan->dcid;  in l2cap_move_channel_req()
4972 		if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_move_channel_req()
4973 			chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;  in l2cap_move_channel_req()
4976 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;  in l2cap_move_channel_req()
4980 		chan->move_state = L2CAP_MOVE_WAIT_PREPARE;  in l2cap_move_channel_req()
4987 	l2cap_send_move_chan_rsp(chan, result);  in l2cap_move_channel_req()
4989 	l2cap_chan_unlock(chan);  in l2cap_move_channel_req()
4996 	struct l2cap_chan *chan;  in l2cap_move_continue()  local
4999 	chan = l2cap_get_chan_by_scid(conn, icid);  in l2cap_move_continue()
5000 	if (!chan) {  in l2cap_move_continue()
5005 	__clear_chan_timer(chan);  in l2cap_move_continue()
5007 		__set_chan_timer(chan, L2CAP_MOVE_ERTX_TIMEOUT);  in l2cap_move_continue()
5009 	switch (chan->move_state) {  in l2cap_move_continue()
5014 		chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;  in l2cap_move_continue()
5020 				    &chan->conn_state)) {  in l2cap_move_continue()
5021 			chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;  in l2cap_move_continue()
5026 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;  in l2cap_move_continue()
5027 			l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);  in l2cap_move_continue()
5036 			chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;  in l2cap_move_continue()
5041 			chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_COMP;  in l2cap_move_continue()
5047 			l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);  in l2cap_move_continue()
5059 		chan->hs_hcon = hchan->conn;  in l2cap_move_continue()
5060 		chan->hs_hcon->l2cap_data = chan->conn;  in l2cap_move_continue()
5064 			l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);  in l2cap_move_continue()
5069 			chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;  in l2cap_move_continue()
5072 		l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);  in l2cap_move_continue()
5076 		chan->move_id = chan->local_amp_id;  in l2cap_move_continue()
5077 		l2cap_move_done(chan);  in l2cap_move_continue()
5078 		l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);  in l2cap_move_continue()
5081 	l2cap_chan_unlock(chan);  in l2cap_move_continue()
5087 	struct l2cap_chan *chan;  in l2cap_move_fail()  local
5089 	chan = l2cap_get_chan_by_ident(conn, ident);  in l2cap_move_fail()
5090 	if (!chan) {  in l2cap_move_fail()
5096 	__clear_chan_timer(chan);  in l2cap_move_fail()
5098 	if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {  in l2cap_move_fail()
5100 			chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;  in l2cap_move_fail()
5103 			chan->move_id = chan->local_amp_id;  in l2cap_move_fail()
5104 			l2cap_move_done(chan);  in l2cap_move_fail()
5108 	l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);  in l2cap_move_fail()
5110 	l2cap_chan_unlock(chan);  in l2cap_move_fail()
5141 	struct l2cap_chan *chan;  in l2cap_move_channel_confirm()  local
5152 	chan = l2cap_get_chan_by_dcid(conn, icid);  in l2cap_move_channel_confirm()
5153 	if (!chan) {  in l2cap_move_channel_confirm()
5159 	if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM) {  in l2cap_move_channel_confirm()
5161 			chan->local_amp_id = chan->move_id;  in l2cap_move_channel_confirm()
5162 			if (chan->local_amp_id == AMP_ID_BREDR)  in l2cap_move_channel_confirm()
5163 				__release_logical_link(chan);  in l2cap_move_channel_confirm()
5165 			chan->move_id = chan->local_amp_id;  in l2cap_move_channel_confirm()
5168 		l2cap_move_done(chan);  in l2cap_move_channel_confirm()
5173 	l2cap_chan_unlock(chan);  in l2cap_move_channel_confirm()
5183 	struct l2cap_chan *chan;  in l2cap_move_channel_confirm_rsp()  local
5193 	chan = l2cap_get_chan_by_scid(conn, icid);  in l2cap_move_channel_confirm_rsp()
5194 	if (!chan)  in l2cap_move_channel_confirm_rsp()
5197 	__clear_chan_timer(chan);  in l2cap_move_channel_confirm_rsp()
5199 	if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM_RSP) {  in l2cap_move_channel_confirm_rsp()
5200 		chan->local_amp_id = chan->move_id;  in l2cap_move_channel_confirm_rsp()
5202 		if (chan->local_amp_id == AMP_ID_BREDR && chan->hs_hchan)  in l2cap_move_channel_confirm_rsp()
5203 			__release_logical_link(chan);  in l2cap_move_channel_confirm_rsp()
5205 		l2cap_move_done(chan);  in l2cap_move_channel_confirm_rsp()
5208 	l2cap_chan_unlock(chan);  in l2cap_move_channel_confirm_rsp()
5270 	struct l2cap_chan *chan;  in l2cap_le_connect_rsp()  local
5292 	chan = __l2cap_get_chan_by_ident(conn, cmd->ident);  in l2cap_le_connect_rsp()
5293 	if (!chan) {  in l2cap_le_connect_rsp()
5300 	l2cap_chan_lock(chan);  in l2cap_le_connect_rsp()
5309 		chan->ident = 0;  in l2cap_le_connect_rsp()
5310 		chan->dcid = dcid;  in l2cap_le_connect_rsp()
5311 		chan->omtu = mtu;  in l2cap_le_connect_rsp()
5312 		chan->remote_mps = mps;  in l2cap_le_connect_rsp()
5313 		chan->tx_credits = credits;  in l2cap_le_connect_rsp()
5314 		l2cap_chan_ready(chan);  in l2cap_le_connect_rsp()
5323 			l2cap_chan_del(chan, ECONNREFUSED);  in l2cap_le_connect_rsp()
5328 		if (chan->sec_level < sec_level)  in l2cap_le_connect_rsp()
5329 			chan->sec_level = sec_level;  in l2cap_le_connect_rsp()
5332 		clear_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags);  in l2cap_le_connect_rsp()
5334 		smp_conn_security(hcon, chan->sec_level);  in l2cap_le_connect_rsp()
5338 		l2cap_chan_del(chan, ECONNREFUSED);  in l2cap_le_connect_rsp()
5342 	l2cap_chan_unlock(chan);  in l2cap_le_connect_rsp()
5436 	struct l2cap_chan *chan, *pchan;  in l2cap_le_connect_req()  local
5462 		chan = NULL;  in l2cap_le_connect_req()
5472 		chan = NULL;  in l2cap_le_connect_req()
5479 		chan = NULL;  in l2cap_le_connect_req()
5486 		chan = NULL;  in l2cap_le_connect_req()
5490 	chan = pchan->ops->new_connection(pchan);  in l2cap_le_connect_req()
5491 	if (!chan) {  in l2cap_le_connect_req()
5496 	l2cap_le_flowctl_init(chan);  in l2cap_le_connect_req()
5498 	bacpy(&chan->src, &conn->hcon->src);  in l2cap_le_connect_req()
5499 	bacpy(&chan->dst, &conn->hcon->dst);  in l2cap_le_connect_req()
5500 	chan->src_type = bdaddr_src_type(conn->hcon);  in l2cap_le_connect_req()
5501 	chan->dst_type = bdaddr_dst_type(conn->hcon);  in l2cap_le_connect_req()
5502 	chan->psm  = psm;  in l2cap_le_connect_req()
5503 	chan->dcid = scid;  in l2cap_le_connect_req()
5504 	chan->omtu = mtu;  in l2cap_le_connect_req()
5505 	chan->remote_mps = mps;  in l2cap_le_connect_req()
5506 	chan->tx_credits = __le16_to_cpu(req->credits);  in l2cap_le_connect_req()
5508 	__l2cap_chan_add(conn, chan);  in l2cap_le_connect_req()
5509 	dcid = chan->scid;  in l2cap_le_connect_req()
5510 	credits = chan->rx_credits;  in l2cap_le_connect_req()
5512 	__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));  in l2cap_le_connect_req()
5514 	chan->ident = cmd->ident;  in l2cap_le_connect_req()
5516 	if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {  in l2cap_le_connect_req()
5517 		l2cap_state_change(chan, BT_CONNECT2);  in l2cap_le_connect_req()
5524 		chan->ops->defer(chan);  in l2cap_le_connect_req()
5526 		l2cap_chan_ready(chan);  in l2cap_le_connect_req()
5539 	if (chan) {  in l2cap_le_connect_req()
5540 		rsp.mtu = cpu_to_le16(chan->imtu);  in l2cap_le_connect_req()
5541 		rsp.mps = cpu_to_le16(chan->mps);  in l2cap_le_connect_req()
5561 	struct l2cap_chan *chan;  in l2cap_le_credits()  local
5573 	chan = l2cap_get_chan_by_dcid(conn, cid);  in l2cap_le_credits()
5574 	if (!chan)  in l2cap_le_credits()
5577 	max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;  in l2cap_le_credits()
5580 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_le_credits()
5581 		l2cap_chan_unlock(chan);  in l2cap_le_credits()
5589 	chan->tx_credits += credits;  in l2cap_le_credits()
5592 	l2cap_le_flowctl_send(chan);  in l2cap_le_credits()
5594 	if (chan->tx_credits)  in l2cap_le_credits()
5595 		chan->ops->resume(chan);  in l2cap_le_credits()
5597 	l2cap_chan_unlock(chan);  in l2cap_le_credits()
5607 	struct l2cap_chan *chan;  in l2cap_le_command_rej()  local
5614 	chan = __l2cap_get_chan_by_ident(conn, cmd->ident);  in l2cap_le_command_rej()
5615 	if (!chan)  in l2cap_le_command_rej()
5618 	l2cap_chan_lock(chan);  in l2cap_le_command_rej()
5619 	l2cap_chan_del(chan, ECONNREFUSED);  in l2cap_le_command_rej()
5620 	l2cap_chan_unlock(chan);  in l2cap_le_command_rej()
5764 static int l2cap_check_fcs(struct l2cap_chan *chan,  struct sk_buff *skb)  in l2cap_check_fcs()  argument
5769 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_check_fcs()
5774 	if (chan->fcs == L2CAP_FCS_CRC16) {  in l2cap_check_fcs()
5785 static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)  in l2cap_send_i_or_rr_or_rnr()  argument
5789 	BT_DBG("chan %p", chan);  in l2cap_send_i_or_rr_or_rnr()
5794 	control.reqseq = chan->buffer_seq;  in l2cap_send_i_or_rr_or_rnr()
5795 	set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_send_i_or_rr_or_rnr()
5797 	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_send_i_or_rr_or_rnr()
5799 		l2cap_send_sframe(chan, &control);  in l2cap_send_i_or_rr_or_rnr()
5802 	if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&  in l2cap_send_i_or_rr_or_rnr()
5803 	    chan->unacked_frames > 0)  in l2cap_send_i_or_rr_or_rnr()
5804 		__set_retrans_timer(chan);  in l2cap_send_i_or_rr_or_rnr()
5807 	l2cap_ertm_send(chan);  in l2cap_send_i_or_rr_or_rnr()
5809 	if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&  in l2cap_send_i_or_rr_or_rnr()
5810 	    test_bit(CONN_SEND_FBIT, &chan->conn_state)) {  in l2cap_send_i_or_rr_or_rnr()
5815 		l2cap_send_sframe(chan, &control);  in l2cap_send_i_or_rr_or_rnr()
5838 static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,  in l2cap_reassemble_sdu()  argument
5845 		if (chan->sdu)  in l2cap_reassemble_sdu()
5848 		err = chan->ops->recv(chan, skb);  in l2cap_reassemble_sdu()
5852 		if (chan->sdu)  in l2cap_reassemble_sdu()
5858 		chan->sdu_len = get_unaligned_le16(skb->data);  in l2cap_reassemble_sdu()
5861 		if (chan->sdu_len > chan->imtu) {  in l2cap_reassemble_sdu()
5866 		if (skb->len >= chan->sdu_len)  in l2cap_reassemble_sdu()
5869 		chan->sdu = skb;  in l2cap_reassemble_sdu()
5870 		chan->sdu_last_frag = skb;  in l2cap_reassemble_sdu()
5877 		if (!chan->sdu)  in l2cap_reassemble_sdu()
5880 		append_skb_frag(chan->sdu, skb,  in l2cap_reassemble_sdu()
5881 				&chan->sdu_last_frag);  in l2cap_reassemble_sdu()
5884 		if (chan->sdu->len >= chan->sdu_len)  in l2cap_reassemble_sdu()
5891 		if (!chan->sdu)  in l2cap_reassemble_sdu()
5894 		append_skb_frag(chan->sdu, skb,  in l2cap_reassemble_sdu()
5895 				&chan->sdu_last_frag);  in l2cap_reassemble_sdu()
5898 		if (chan->sdu->len != chan->sdu_len)  in l2cap_reassemble_sdu()
5901 		err = chan->ops->recv(chan, chan->sdu);  in l2cap_reassemble_sdu()
5905 			chan->sdu = NULL;  in l2cap_reassemble_sdu()
5906 			chan->sdu_last_frag = NULL;  in l2cap_reassemble_sdu()
5907 			chan->sdu_len = 0;  in l2cap_reassemble_sdu()
5914 		kfree_skb(chan->sdu);  in l2cap_reassemble_sdu()
5915 		chan->sdu = NULL;  in l2cap_reassemble_sdu()
5916 		chan->sdu_last_frag = NULL;  in l2cap_reassemble_sdu()
5917 		chan->sdu_len = 0;  in l2cap_reassemble_sdu()
5923 static int l2cap_resegment(struct l2cap_chan *chan)  in l2cap_resegment()  argument
5929 void l2cap_chan_busy(struct l2cap_chan *chan, int busy)  in l2cap_chan_busy()  argument
5933 	if (chan->mode != L2CAP_MODE_ERTM)  in l2cap_chan_busy()
5937 	l2cap_tx(chan, NULL, NULL, event);  in l2cap_chan_busy()
5940 static int l2cap_rx_queued_iframes(struct l2cap_chan *chan)  in l2cap_rx_queued_iframes()  argument
5947 	BT_DBG("chan %p", chan);  in l2cap_rx_queued_iframes()
5949 	while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_rx_queued_iframes()
5952 		       chan->buffer_seq, skb_queue_len(&chan->srej_q));  in l2cap_rx_queued_iframes()
5954 		skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq);  in l2cap_rx_queued_iframes()
5959 		skb_unlink(skb, &chan->srej_q);  in l2cap_rx_queued_iframes()
5960 		chan->buffer_seq = __next_seq(chan, chan->buffer_seq);  in l2cap_rx_queued_iframes()
5961 		err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->l2cap);  in l2cap_rx_queued_iframes()
5966 	if (skb_queue_empty(&chan->srej_q)) {  in l2cap_rx_queued_iframes()
5967 		chan->rx_state = L2CAP_RX_STATE_RECV;  in l2cap_rx_queued_iframes()
5968 		l2cap_send_ack(chan);  in l2cap_rx_queued_iframes()
5974 static void l2cap_handle_srej(struct l2cap_chan *chan,  in l2cap_handle_srej()  argument
5979 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_handle_srej()
5981 	if (control->reqseq == chan->next_tx_seq) {  in l2cap_handle_srej()
5983 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_handle_srej()
5987 	skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);  in l2cap_handle_srej()
5995 	if (chan->max_tx != 0 && bt_cb(skb)->l2cap.retries >= chan->max_tx) {  in l2cap_handle_srej()
5996 		BT_DBG("Retry limit exceeded (%d)", chan->max_tx);  in l2cap_handle_srej()
5997 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_handle_srej()
6001 	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_handle_srej()
6004 		l2cap_pass_to_tx(chan, control);  in l2cap_handle_srej()
6006 		set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_handle_srej()
6007 		l2cap_retransmit(chan, control);  in l2cap_handle_srej()
6008 		l2cap_ertm_send(chan);  in l2cap_handle_srej()
6010 		if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {  in l2cap_handle_srej()
6011 			set_bit(CONN_SREJ_ACT, &chan->conn_state);  in l2cap_handle_srej()
6012 			chan->srej_save_reqseq = control->reqseq;  in l2cap_handle_srej()
6015 		l2cap_pass_to_tx_fbit(chan, control);  in l2cap_handle_srej()
6018 			if (chan->srej_save_reqseq != control->reqseq ||  in l2cap_handle_srej()
6020 						&chan->conn_state))  in l2cap_handle_srej()
6021 				l2cap_retransmit(chan, control);  in l2cap_handle_srej()
6023 			l2cap_retransmit(chan, control);  in l2cap_handle_srej()
6024 			if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {  in l2cap_handle_srej()
6025 				set_bit(CONN_SREJ_ACT, &chan->conn_state);  in l2cap_handle_srej()
6026 				chan->srej_save_reqseq = control->reqseq;  in l2cap_handle_srej()
6032 static void l2cap_handle_rej(struct l2cap_chan *chan,  in l2cap_handle_rej()  argument
6037 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_handle_rej()
6039 	if (control->reqseq == chan->next_tx_seq) {  in l2cap_handle_rej()
6041 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_handle_rej()
6045 	skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);  in l2cap_handle_rej()
6047 	if (chan->max_tx && skb &&  in l2cap_handle_rej()
6048 	    bt_cb(skb)->l2cap.retries >= chan->max_tx) {  in l2cap_handle_rej()
6049 		BT_DBG("Retry limit exceeded (%d)", chan->max_tx);  in l2cap_handle_rej()
6050 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_handle_rej()
6054 	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_handle_rej()
6056 	l2cap_pass_to_tx(chan, control);  in l2cap_handle_rej()
6059 		if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))  in l2cap_handle_rej()
6060 			l2cap_retransmit_all(chan, control);  in l2cap_handle_rej()
6062 		l2cap_retransmit_all(chan, control);  in l2cap_handle_rej()
6063 		l2cap_ertm_send(chan);  in l2cap_handle_rej()
6064 		if (chan->tx_state == L2CAP_TX_STATE_WAIT_F)  in l2cap_handle_rej()
6065 			set_bit(CONN_REJ_ACT, &chan->conn_state);  in l2cap_handle_rej()
6069 static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq)  in l2cap_classify_txseq()  argument
6071 	BT_DBG("chan %p, txseq %d", chan, txseq);  in l2cap_classify_txseq()
6073 	BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq,  in l2cap_classify_txseq()
6074 	       chan->expected_tx_seq);  in l2cap_classify_txseq()
6076 	if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {  in l2cap_classify_txseq()
6077 		if (__seq_offset(chan, txseq, chan->last_acked_seq) >=  in l2cap_classify_txseq()
6078 		    chan->tx_win) {  in l2cap_classify_txseq()
6082 			if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {  in l2cap_classify_txseq()
6091 		if (chan->srej_list.head == txseq) {  in l2cap_classify_txseq()
6096 		if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) {  in l2cap_classify_txseq()
6101 		if (l2cap_seq_list_contains(&chan->srej_list, txseq)) {  in l2cap_classify_txseq()
6107 	if (chan->expected_tx_seq == txseq) {  in l2cap_classify_txseq()
6108 		if (__seq_offset(chan, txseq, chan->last_acked_seq) >=  in l2cap_classify_txseq()
6109 		    chan->tx_win) {  in l2cap_classify_txseq()
6118 	if (__seq_offset(chan, txseq, chan->last_acked_seq) <  in l2cap_classify_txseq()
6119 	    __seq_offset(chan, chan->expected_tx_seq, chan->last_acked_seq)) {  in l2cap_classify_txseq()
6124 	if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) {  in l2cap_classify_txseq()
6142 		if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {  in l2cap_classify_txseq()
6155 static int l2cap_rx_state_recv(struct l2cap_chan *chan,  in l2cap_rx_state_recv()  argument
6162 	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,  in l2cap_rx_state_recv()
6167 		switch (l2cap_classify_txseq(chan, control->txseq)) {  in l2cap_rx_state_recv()
6169 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
6171 			if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_rx_state_recv()
6177 			chan->expected_tx_seq = __next_seq(chan,  in l2cap_rx_state_recv()
6180 			chan->buffer_seq = chan->expected_tx_seq;  in l2cap_rx_state_recv()
6183 			err = l2cap_reassemble_sdu(chan, skb, control);  in l2cap_rx_state_recv()
6189 							&chan->conn_state)) {  in l2cap_rx_state_recv()
6191 					l2cap_retransmit_all(chan, control);  in l2cap_rx_state_recv()
6192 					l2cap_ertm_send(chan);  in l2cap_rx_state_recv()
6196 			if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state))  in l2cap_rx_state_recv()
6197 				l2cap_send_ack(chan);  in l2cap_rx_state_recv()
6200 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
6206 			if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_rx_state_recv()
6216 			skb_queue_tail(&chan->srej_q, skb);  in l2cap_rx_state_recv()
6219 			       skb_queue_len(&chan->srej_q));  in l2cap_rx_state_recv()
6221 			clear_bit(CONN_SREJ_ACT, &chan->conn_state);  in l2cap_rx_state_recv()
6222 			l2cap_seq_list_clear(&chan->srej_list);  in l2cap_rx_state_recv()
6223 			l2cap_send_srej(chan, control->txseq);  in l2cap_rx_state_recv()
6225 			chan->rx_state = L2CAP_RX_STATE_SREJ_SENT;  in l2cap_rx_state_recv()
6228 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
6234 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_rx_state_recv()
6239 		l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
6241 			clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_rx_state_recv()
6243 			if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state) &&  in l2cap_rx_state_recv()
6244 			    !__chan_is_moving(chan)) {  in l2cap_rx_state_recv()
6246 				l2cap_retransmit_all(chan, control);  in l2cap_rx_state_recv()
6249 			l2cap_ertm_send(chan);  in l2cap_rx_state_recv()
6251 			l2cap_send_i_or_rr_or_rnr(chan);  in l2cap_rx_state_recv()
6254 					       &chan->conn_state) &&  in l2cap_rx_state_recv()
6255 			    chan->unacked_frames)  in l2cap_rx_state_recv()
6256 				__set_retrans_timer(chan);  in l2cap_rx_state_recv()
6258 			l2cap_ertm_send(chan);  in l2cap_rx_state_recv()
6262 		set_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_rx_state_recv()
6263 		l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
6265 			set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_rx_state_recv()
6266 			l2cap_send_rr_or_rnr(chan, 0);  in l2cap_rx_state_recv()
6268 		__clear_retrans_timer(chan);  in l2cap_rx_state_recv()
6269 		l2cap_seq_list_clear(&chan->retrans_list);  in l2cap_rx_state_recv()
6272 		l2cap_handle_rej(chan, control);  in l2cap_rx_state_recv()
6275 		l2cap_handle_srej(chan, control);  in l2cap_rx_state_recv()
6289 static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,  in l2cap_rx_state_srej_sent()  argument
6297 	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,  in l2cap_rx_state_srej_sent()
6302 		switch (l2cap_classify_txseq(chan, txseq)) {  in l2cap_rx_state_srej_sent()
6305 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
6306 			skb_queue_tail(&chan->srej_q, skb);  in l2cap_rx_state_srej_sent()
6309 			       skb_queue_len(&chan->srej_q));  in l2cap_rx_state_srej_sent()
6311 			chan->expected_tx_seq = __next_seq(chan, txseq);  in l2cap_rx_state_srej_sent()
6314 			l2cap_seq_list_pop(&chan->srej_list);  in l2cap_rx_state_srej_sent()
6316 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
6317 			skb_queue_tail(&chan->srej_q, skb);  in l2cap_rx_state_srej_sent()
6320 			       skb_queue_len(&chan->srej_q));  in l2cap_rx_state_srej_sent()
6322 			err = l2cap_rx_queued_iframes(chan);  in l2cap_rx_state_srej_sent()
6332 			skb_queue_tail(&chan->srej_q, skb);  in l2cap_rx_state_srej_sent()
6335 			       skb_queue_len(&chan->srej_q));  in l2cap_rx_state_srej_sent()
6337 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
6338 			l2cap_send_srej(chan, control->txseq);  in l2cap_rx_state_srej_sent()
6346 			skb_queue_tail(&chan->srej_q, skb);  in l2cap_rx_state_srej_sent()
6349 			       skb_queue_len(&chan->srej_q));  in l2cap_rx_state_srej_sent()
6351 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
6352 			l2cap_send_srej_list(chan, control->txseq);  in l2cap_rx_state_srej_sent()
6356 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
6367 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_rx_state_srej_sent()
6372 		l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
6374 			clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_rx_state_srej_sent()
6377 						&chan->conn_state)) {  in l2cap_rx_state_srej_sent()
6379 				l2cap_retransmit_all(chan, control);  in l2cap_rx_state_srej_sent()
6382 			l2cap_ertm_send(chan);  in l2cap_rx_state_srej_sent()
6385 					       &chan->conn_state) &&  in l2cap_rx_state_srej_sent()
6386 			    chan->unacked_frames) {  in l2cap_rx_state_srej_sent()
6387 				__set_retrans_timer(chan);  in l2cap_rx_state_srej_sent()
6390 			set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_rx_state_srej_sent()
6391 			l2cap_send_srej_tail(chan);  in l2cap_rx_state_srej_sent()
6394 					       &chan->conn_state) &&  in l2cap_rx_state_srej_sent()
6395 			    chan->unacked_frames)  in l2cap_rx_state_srej_sent()
6396 				__set_retrans_timer(chan);  in l2cap_rx_state_srej_sent()
6398 			l2cap_send_ack(chan);  in l2cap_rx_state_srej_sent()
6402 		set_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_rx_state_srej_sent()
6403 		l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
6405 			l2cap_send_srej_tail(chan);  in l2cap_rx_state_srej_sent()
6411 			rr_control.reqseq = chan->buffer_seq;  in l2cap_rx_state_srej_sent()
6412 			l2cap_send_sframe(chan, &rr_control);  in l2cap_rx_state_srej_sent()
6417 		l2cap_handle_rej(chan, control);  in l2cap_rx_state_srej_sent()
6420 		l2cap_handle_srej(chan, control);  in l2cap_rx_state_srej_sent()
6432 static int l2cap_finish_move(struct l2cap_chan *chan)  in l2cap_finish_move()  argument
6434 	BT_DBG("chan %p", chan);  in l2cap_finish_move()
6436 	chan->rx_state = L2CAP_RX_STATE_RECV;  in l2cap_finish_move()
6438 	if (chan->hs_hcon)  in l2cap_finish_move()
6439 		chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;  in l2cap_finish_move()
6441 		chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;  in l2cap_finish_move()
6443 	return l2cap_resegment(chan);  in l2cap_finish_move()
6446 static int l2cap_rx_state_wait_p(struct l2cap_chan *chan,  in l2cap_rx_state_wait_p()  argument
6452 	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,  in l2cap_rx_state_wait_p()
6458 	l2cap_process_reqseq(chan, control->reqseq);  in l2cap_rx_state_wait_p()
6460 	if (!skb_queue_empty(&chan->tx_q))  in l2cap_rx_state_wait_p()
6461 		chan->tx_send_head = skb_peek(&chan->tx_q);  in l2cap_rx_state_wait_p()
6463 		chan->tx_send_head = NULL;  in l2cap_rx_state_wait_p()
6468 	chan->next_tx_seq = control->reqseq;  in l2cap_rx_state_wait_p()
6469 	chan->unacked_frames = 0;  in l2cap_rx_state_wait_p()
6471 	err = l2cap_finish_move(chan);  in l2cap_rx_state_wait_p()
6475 	set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_rx_state_wait_p()
6476 	l2cap_send_i_or_rr_or_rnr(chan);  in l2cap_rx_state_wait_p()
6481 	return l2cap_rx_state_recv(chan, control, NULL, event);  in l2cap_rx_state_wait_p()
6484 static int l2cap_rx_state_wait_f(struct l2cap_chan *chan,  in l2cap_rx_state_wait_f()  argument
6493 	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_rx_state_wait_f()
6495 	chan->rx_state = L2CAP_RX_STATE_RECV;  in l2cap_rx_state_wait_f()
6496 	l2cap_process_reqseq(chan, control->reqseq);  in l2cap_rx_state_wait_f()
6498 	if (!skb_queue_empty(&chan->tx_q))  in l2cap_rx_state_wait_f()
6499 		chan->tx_send_head = skb_peek(&chan->tx_q);  in l2cap_rx_state_wait_f()
6501 		chan->tx_send_head = NULL;  in l2cap_rx_state_wait_f()
6506 	chan->next_tx_seq = control->reqseq;  in l2cap_rx_state_wait_f()
6507 	chan->unacked_frames = 0;  in l2cap_rx_state_wait_f()
6509 	if (chan->hs_hcon)  in l2cap_rx_state_wait_f()
6510 		chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;  in l2cap_rx_state_wait_f()
6512 		chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;  in l2cap_rx_state_wait_f()
6514 	err = l2cap_resegment(chan);  in l2cap_rx_state_wait_f()
6517 		err = l2cap_rx_state_recv(chan, control, skb, event);  in l2cap_rx_state_wait_f()
6522 static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq)  in __valid_reqseq()  argument
6527 	unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq);  in __valid_reqseq()
6528 	return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked;  in __valid_reqseq()
6531 static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,  in l2cap_rx()  argument
6536 	BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan,  in l2cap_rx()
6537 	       control, skb, event, chan->rx_state);  in l2cap_rx()
6539 	if (__valid_reqseq(chan, control->reqseq)) {  in l2cap_rx()
6540 		switch (chan->rx_state) {  in l2cap_rx()
6542 			err = l2cap_rx_state_recv(chan, control, skb, event);  in l2cap_rx()
6545 			err = l2cap_rx_state_srej_sent(chan, control, skb,  in l2cap_rx()
6549 			err = l2cap_rx_state_wait_p(chan, control, skb, event);  in l2cap_rx()
6552 			err = l2cap_rx_state_wait_f(chan, control, skb, event);  in l2cap_rx()
6560 		       control->reqseq, chan->next_tx_seq,  in l2cap_rx()
6561 		       chan->expected_ack_seq);  in l2cap_rx()
6562 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_rx()
6568 static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,  in l2cap_stream_rx()  argument
6571 	BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb,  in l2cap_stream_rx()
6572 	       chan->rx_state);  in l2cap_stream_rx()
6574 	if (l2cap_classify_txseq(chan, control->txseq) ==  in l2cap_stream_rx()
6576 		l2cap_pass_to_tx(chan, control);  in l2cap_stream_rx()
6578 		BT_DBG("buffer_seq %d->%d", chan->buffer_seq,  in l2cap_stream_rx()
6579 		       __next_seq(chan, chan->buffer_seq));  in l2cap_stream_rx()
6581 		chan->buffer_seq = __next_seq(chan, chan->buffer_seq);  in l2cap_stream_rx()
6583 		l2cap_reassemble_sdu(chan, skb, control);  in l2cap_stream_rx()
6585 		if (chan->sdu) {  in l2cap_stream_rx()
6586 			kfree_skb(chan->sdu);  in l2cap_stream_rx()
6587 			chan->sdu = NULL;  in l2cap_stream_rx()
6589 		chan->sdu_last_frag = NULL;  in l2cap_stream_rx()
6590 		chan->sdu_len = 0;  in l2cap_stream_rx()
6598 	chan->last_acked_seq = control->txseq;  in l2cap_stream_rx()
6599 	chan->expected_tx_seq = __next_seq(chan, control->txseq);  in l2cap_stream_rx()
6604 static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)  in l2cap_data_rcv()  argument
6610 	__unpack_control(chan, skb);  in l2cap_data_rcv()
6619 	if (l2cap_check_fcs(chan, skb))  in l2cap_data_rcv()
6625 	if (chan->fcs == L2CAP_FCS_CRC16)  in l2cap_data_rcv()
6628 	if (len > chan->mps) {  in l2cap_data_rcv()
6629 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_data_rcv()
6633 	if ((chan->mode == L2CAP_MODE_ERTM ||  in l2cap_data_rcv()
6634 	     chan->mode == L2CAP_MODE_STREAMING) && sk_filter(chan->data, skb))  in l2cap_data_rcv()
6647 		if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F)  in l2cap_data_rcv()
6650 		if (chan->mode != L2CAP_MODE_STREAMING) {  in l2cap_data_rcv()
6652 			err = l2cap_rx(chan, control, skb, event);  in l2cap_data_rcv()
6654 			err = l2cap_stream_rx(chan, control, skb);  in l2cap_data_rcv()
6658 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_data_rcv()
6666 		if (chan->mode == L2CAP_MODE_STREAMING)  in l2cap_data_rcv()
6675 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_data_rcv()
6681 				       chan->tx_state != L2CAP_TX_STATE_WAIT_F))  in l2cap_data_rcv()
6685 		if (l2cap_rx(chan, control, skb, event))  in l2cap_data_rcv()
6686 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_data_rcv()
6696 static void l2cap_chan_le_send_credits(struct l2cap_chan *chan)  in l2cap_chan_le_send_credits()  argument
6698 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_le_send_credits()
6705 	if (chan->rx_credits >= (le_max_credits + 1) / 2)  in l2cap_chan_le_send_credits()
6708 	return_credits = le_max_credits - chan->rx_credits;  in l2cap_chan_le_send_credits()
6710 	BT_DBG("chan %p returning %u credits to sender", chan, return_credits);  in l2cap_chan_le_send_credits()
6712 	chan->rx_credits += return_credits;  in l2cap_chan_le_send_credits()
6714 	pkt.cid     = cpu_to_le16(chan->scid);  in l2cap_chan_le_send_credits()
6717 	chan->ident = l2cap_get_ident(conn);  in l2cap_chan_le_send_credits()
6719 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CREDITS, sizeof(pkt), &pkt);  in l2cap_chan_le_send_credits()
6722 static int l2cap_le_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)  in l2cap_le_data_rcv()  argument
6726 	if (!chan->rx_credits) {  in l2cap_le_data_rcv()
6728 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_le_data_rcv()
6732 	if (chan->imtu < skb->len) {  in l2cap_le_data_rcv()
6737 	chan->rx_credits--;  in l2cap_le_data_rcv()
6738 	BT_DBG("rx_credits %u -> %u", chan->rx_credits + 1, chan->rx_credits);  in l2cap_le_data_rcv()
6740 	l2cap_chan_le_send_credits(chan);  in l2cap_le_data_rcv()
6744 	if (!chan->sdu) {  in l2cap_le_data_rcv()
6751 		       sdu_len, skb->len, chan->imtu);  in l2cap_le_data_rcv()
6753 		if (sdu_len > chan->imtu) {  in l2cap_le_data_rcv()
6766 			return chan->ops->recv(chan, skb);  in l2cap_le_data_rcv()
6768 		chan->sdu = skb;  in l2cap_le_data_rcv()
6769 		chan->sdu_len = sdu_len;  in l2cap_le_data_rcv()
6770 		chan->sdu_last_frag = skb;  in l2cap_le_data_rcv()
6776 	       chan->sdu->len, skb->len, chan->sdu_len);  in l2cap_le_data_rcv()
6778 	if (chan->sdu->len + skb->len > chan->sdu_len) {  in l2cap_le_data_rcv()
6784 	append_skb_frag(chan->sdu, skb, &chan->sdu_last_frag);  in l2cap_le_data_rcv()
6787 	if (chan->sdu->len == chan->sdu_len) {  in l2cap_le_data_rcv()
6788 		err = chan->ops->recv(chan, chan->sdu);  in l2cap_le_data_rcv()
6790 			chan->sdu = NULL;  in l2cap_le_data_rcv()
6791 			chan->sdu_last_frag = NULL;  in l2cap_le_data_rcv()
6792 			chan->sdu_len = 0;  in l2cap_le_data_rcv()
6799 		kfree_skb(chan->sdu);  in l2cap_le_data_rcv()
6800 		chan->sdu = NULL;  in l2cap_le_data_rcv()
6801 		chan->sdu_last_frag = NULL;  in l2cap_le_data_rcv()
6802 		chan->sdu_len = 0;  in l2cap_le_data_rcv()
6815 	struct l2cap_chan *chan;  in l2cap_data_channel()  local
6817 	chan = l2cap_get_chan_by_scid(conn, cid);  in l2cap_data_channel()
6818 	if (!chan) {  in l2cap_data_channel()
6820 			chan = a2mp_channel_create(conn, skb);  in l2cap_data_channel()
6821 			if (!chan) {  in l2cap_data_channel()
6826 			l2cap_chan_lock(chan);  in l2cap_data_channel()
6835 	BT_DBG("chan %p, len %d", chan, skb->len);  in l2cap_data_channel()
6841 	if (chan->chan_type == L2CAP_CHAN_FIXED)  in l2cap_data_channel()
6842 		l2cap_chan_ready(chan);  in l2cap_data_channel()
6844 	if (chan->state != BT_CONNECTED)  in l2cap_data_channel()
6847 	switch (chan->mode) {  in l2cap_data_channel()
6849 		if (l2cap_le_data_rcv(chan, skb) < 0)  in l2cap_data_channel()
6860 		if (chan->imtu < skb->len) {  in l2cap_data_channel()
6865 		if (!chan->ops->recv(chan, skb))  in l2cap_data_channel()
6871 		l2cap_data_rcv(chan, skb);  in l2cap_data_channel()
6875 		BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);  in l2cap_data_channel()
6883 	l2cap_chan_unlock(chan);  in l2cap_data_channel()
6890 	struct l2cap_chan *chan;  in l2cap_conless_channel()  local
6895 	chan = l2cap_global_chan_by_psm(0, psm, &hcon->src, &hcon->dst,  in l2cap_conless_channel()
6897 	if (!chan)  in l2cap_conless_channel()
6900 	BT_DBG("chan %p, len %d", chan, skb->len);  in l2cap_conless_channel()
6902 	if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)  in l2cap_conless_channel()
6905 	if (chan->imtu < skb->len)  in l2cap_conless_channel()
6912 	if (!chan->ops->recv(chan, skb)) {  in l2cap_conless_channel()
6913 		l2cap_chan_put(chan);  in l2cap_conless_channel()
6918 	l2cap_chan_put(chan);  in l2cap_conless_channel()
7068 int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,  in l2cap_chan_connect()  argument
7076 	BT_DBG("%pMR -> %pMR (type %u) psm 0x%2.2x", &chan->src, dst,  in l2cap_chan_connect()
7079 	hdev = hci_get_route(dst, &chan->src, chan->src_type);  in l2cap_chan_connect()
7086 	    chan->chan_type != L2CAP_CHAN_RAW) {  in l2cap_chan_connect()
7091 	if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !psm) {  in l2cap_chan_connect()
7096 	if (chan->chan_type == L2CAP_CHAN_FIXED && !cid) {  in l2cap_chan_connect()
7101 	switch (chan->mode) {  in l2cap_chan_connect()
7105 		l2cap_le_flowctl_init(chan);  in l2cap_chan_connect()
7117 	switch (chan->state) {  in l2cap_chan_connect()
7141 	bacpy(&chan->dst, dst);  in l2cap_chan_connect()
7142 	chan->dst_type = dst_type;  in l2cap_chan_connect()
7144 	chan->psm = psm;  in l2cap_chan_connect()
7145 	chan->dcid = cid;  in l2cap_chan_connect()
7157 					      chan->sec_level,  in l2cap_chan_connect()
7162 						   chan->sec_level,  in l2cap_chan_connect()
7166 		u8 auth_type = l2cap_get_auth_type(chan);  in l2cap_chan_connect()
7167 		hcon = hci_connect_acl(hdev, dst, chan->sec_level, auth_type);  in l2cap_chan_connect()
7183 	l2cap_chan_lock(chan);  in l2cap_chan_connect()
7192 	bacpy(&chan->src, &hcon->src);  in l2cap_chan_connect()
7193 	chan->src_type = bdaddr_src_type(hcon);  in l2cap_chan_connect()
7195 	__l2cap_chan_add(conn, chan);  in l2cap_chan_connect()
7200 	l2cap_state_change(chan, BT_CONNECT);  in l2cap_chan_connect()
7201 	__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));  in l2cap_chan_connect()
7207 	chan->sport = 0;  in l2cap_chan_connect()
7211 		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {  in l2cap_chan_connect()
7212 			__clear_chan_timer(chan);  in l2cap_chan_connect()
7213 			if (l2cap_chan_check_security(chan, true))  in l2cap_chan_connect()
7214 				l2cap_state_change(chan, BT_CONNECTED);  in l2cap_chan_connect()
7216 			l2cap_do_start(chan);  in l2cap_chan_connect()
7222 	l2cap_chan_unlock(chan);  in l2cap_chan_connect()
7332 		struct l2cap_chan *chan, *next;  in l2cap_connect_cfm()  local
7339 		chan = pchan->ops->new_connection(pchan);  in l2cap_connect_cfm()
7340 		if (chan) {  in l2cap_connect_cfm()
7341 			bacpy(&chan->src, &hcon->src);  in l2cap_connect_cfm()
7342 			bacpy(&chan->dst, &hcon->dst);  in l2cap_connect_cfm()
7343 			chan->src_type = bdaddr_src_type(hcon);  in l2cap_connect_cfm()
7344 			chan->dst_type = dst_type;  in l2cap_connect_cfm()
7346 			__l2cap_chan_add(conn, chan);  in l2cap_connect_cfm()
7380 static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)  in l2cap_check_encryption()  argument
7382 	if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)  in l2cap_check_encryption()
7386 		if (chan->sec_level == BT_SECURITY_MEDIUM) {  in l2cap_check_encryption()
7387 			__set_chan_timer(chan, L2CAP_ENC_TIMEOUT);  in l2cap_check_encryption()
7388 		} else if (chan->sec_level == BT_SECURITY_HIGH ||  in l2cap_check_encryption()
7389 			   chan->sec_level == BT_SECURITY_FIPS)  in l2cap_check_encryption()
7390 			l2cap_chan_close(chan, ECONNREFUSED);  in l2cap_check_encryption()
7392 		if (chan->sec_level == BT_SECURITY_MEDIUM)  in l2cap_check_encryption()
7393 			__clear_chan_timer(chan);  in l2cap_check_encryption()
7400 	struct l2cap_chan *chan;  in l2cap_security_cfm()  local
7409 	list_for_each_entry(chan, &conn->chan_l, list) {  in l2cap_security_cfm()
7410 		l2cap_chan_lock(chan);  in l2cap_security_cfm()
7412 		BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid,  in l2cap_security_cfm()
7413 		       state_to_string(chan->state));  in l2cap_security_cfm()
7415 		if (chan->scid == L2CAP_CID_A2MP) {  in l2cap_security_cfm()
7416 			l2cap_chan_unlock(chan);  in l2cap_security_cfm()
7421 			chan->sec_level = hcon->sec_level;  in l2cap_security_cfm()
7423 		if (!__l2cap_no_conn_pending(chan)) {  in l2cap_security_cfm()
7424 			l2cap_chan_unlock(chan);  in l2cap_security_cfm()
7428 		if (!status && (chan->state == BT_CONNECTED ||  in l2cap_security_cfm()
7429 				chan->state == BT_CONFIG)) {  in l2cap_security_cfm()
7430 			chan->ops->resume(chan);  in l2cap_security_cfm()
7431 			l2cap_check_encryption(chan, encrypt);  in l2cap_security_cfm()
7432 			l2cap_chan_unlock(chan);  in l2cap_security_cfm()
7436 		if (chan->state == BT_CONNECT) {  in l2cap_security_cfm()
7438 				l2cap_start_connection(chan);  in l2cap_security_cfm()
7440 				__set_chan_timer(chan, L2CAP_DISC_TIMEOUT);  in l2cap_security_cfm()
7441 		} else if (chan->state == BT_CONNECT2 &&  in l2cap_security_cfm()
7442 			   chan->mode != L2CAP_MODE_LE_FLOWCTL) {  in l2cap_security_cfm()
7447 				if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {  in l2cap_security_cfm()
7450 					chan->ops->defer(chan);  in l2cap_security_cfm()
7452 					l2cap_state_change(chan, BT_CONFIG);  in l2cap_security_cfm()
7457 				l2cap_state_change(chan, BT_DISCONN);  in l2cap_security_cfm()
7458 				__set_chan_timer(chan, L2CAP_DISC_TIMEOUT);  in l2cap_security_cfm()
7463 			rsp.scid   = cpu_to_le16(chan->dcid);  in l2cap_security_cfm()
7464 			rsp.dcid   = cpu_to_le16(chan->scid);  in l2cap_security_cfm()
7467 			l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,  in l2cap_security_cfm()
7470 			if (!test_bit(CONF_REQ_SENT, &chan->conf_state) &&  in l2cap_security_cfm()
7473 				set_bit(CONF_REQ_SENT, &chan->conf_state);  in l2cap_security_cfm()
7476 					       l2cap_build_conf_req(chan, buf, sizeof(buf)),  in l2cap_security_cfm()
7478 				chan->num_conf_req++;  in l2cap_security_cfm()
7482 		l2cap_chan_unlock(chan);  in l2cap_security_cfm()