58 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size);
59 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err);
61 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
189 int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)  in l2cap_add_psm()  argument
195 	if (psm && __l2cap_global_chan_by_addr(psm, src, chan->src_type)) {  in l2cap_add_psm()
201 		chan->psm = psm;  in l2cap_add_psm()
202 		chan->sport = psm;  in l2cap_add_psm()
207 		if (chan->src_type == BDADDR_BREDR) {  in l2cap_add_psm()
220 							 chan->src_type)) {  in l2cap_add_psm()
221 				chan->psm   = cpu_to_le16(p);  in l2cap_add_psm()
222 				chan->sport = cpu_to_le16(p);  in l2cap_add_psm()
234 int l2cap_add_scid(struct l2cap_chan *chan,  __u16 scid)  in l2cap_add_scid()  argument
239 	chan->omtu = L2CAP_DEFAULT_MTU;  in l2cap_add_scid()
240 	chan->chan_type = L2CAP_CHAN_FIXED;  in l2cap_add_scid()
242 	chan->scid = scid;  in l2cap_add_scid()
266 static void l2cap_state_change(struct l2cap_chan *chan, int state)  in l2cap_state_change()  argument
268 	BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),  in l2cap_state_change()
271 	chan->state = state;  in l2cap_state_change()
272 	chan->ops->state_change(chan, state, 0);  in l2cap_state_change()
275 static inline void l2cap_state_change_and_error(struct l2cap_chan *chan,  in l2cap_state_change_and_error()  argument
278 	chan->state = state;  in l2cap_state_change_and_error()
279 	chan->ops->state_change(chan, chan->state, err);  in l2cap_state_change_and_error()
282 static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)  in l2cap_chan_set_err()  argument
284 	chan->ops->state_change(chan, chan->state, err);  in l2cap_chan_set_err()
287 static void __set_retrans_timer(struct l2cap_chan *chan)  in __set_retrans_timer()  argument
289 	if (!delayed_work_pending(&chan->monitor_timer) &&  in __set_retrans_timer()
290 	    chan->retrans_timeout) {  in __set_retrans_timer()
291 		l2cap_set_timer(chan, &chan->retrans_timer,  in __set_retrans_timer()
292 				msecs_to_jiffies(chan->retrans_timeout));  in __set_retrans_timer()
296 static void __set_monitor_timer(struct l2cap_chan *chan)  in __set_monitor_timer()  argument
298 	__clear_retrans_timer(chan);  in __set_monitor_timer()
299 	if (chan->monitor_timeout) {  in __set_monitor_timer()
300 		l2cap_set_timer(chan, &chan->monitor_timer,  in __set_monitor_timer()
301 				msecs_to_jiffies(chan->monitor_timeout));  in __set_monitor_timer()
414 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,  in l2cap_chan_timeout()  local
416 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_timeout()
419 	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));  in l2cap_chan_timeout()
422 	l2cap_chan_lock(chan);  in l2cap_chan_timeout()
424 	if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)  in l2cap_chan_timeout()
426 	else if (chan->state == BT_CONNECT &&  in l2cap_chan_timeout()
427 		 chan->sec_level != BT_SECURITY_SDP)  in l2cap_chan_timeout()
432 	l2cap_chan_close(chan, reason);  in l2cap_chan_timeout()
434 	l2cap_chan_unlock(chan);  in l2cap_chan_timeout()
436 	chan->ops->close(chan);  in l2cap_chan_timeout()
439 	l2cap_chan_put(chan);  in l2cap_chan_timeout()
444 	struct l2cap_chan *chan;  in l2cap_chan_create()  local
446 	chan = kzalloc(sizeof(*chan), GFP_ATOMIC);  in l2cap_chan_create()
447 	if (!chan)  in l2cap_chan_create()
450 	mutex_init(&chan->lock);  in l2cap_chan_create()
453 	atomic_set(&chan->nesting, L2CAP_NESTING_NORMAL);  in l2cap_chan_create()
456 	list_add(&chan->global_l, &chan_list);  in l2cap_chan_create()
459 	INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);  in l2cap_chan_create()
461 	chan->state = BT_OPEN;  in l2cap_chan_create()
463 	kref_init(&chan->kref);  in l2cap_chan_create()
466 	set_bit(CONF_NOT_COMPLETE, &chan->conf_state);  in l2cap_chan_create()
468 	BT_DBG("chan %p", chan);  in l2cap_chan_create()
470 	return chan;  in l2cap_chan_create()
476 	struct l2cap_chan *chan = container_of(kref, struct l2cap_chan, kref);  in l2cap_chan_destroy()  local
478 	BT_DBG("chan %p", chan);  in l2cap_chan_destroy()
481 	list_del(&chan->global_l);  in l2cap_chan_destroy()
484 	kfree(chan);  in l2cap_chan_destroy()
502 void l2cap_chan_set_defaults(struct l2cap_chan *chan)  in l2cap_chan_set_defaults()  argument
504 	chan->fcs  = L2CAP_FCS_CRC16;  in l2cap_chan_set_defaults()
505 	chan->max_tx = L2CAP_DEFAULT_MAX_TX;  in l2cap_chan_set_defaults()
506 	chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;  in l2cap_chan_set_defaults()
507 	chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;  in l2cap_chan_set_defaults()
508 	chan->remote_max_tx = chan->max_tx;  in l2cap_chan_set_defaults()
509 	chan->remote_tx_win = chan->tx_win;  in l2cap_chan_set_defaults()
510 	chan->ack_win = L2CAP_DEFAULT_TX_WINDOW;  in l2cap_chan_set_defaults()
511 	chan->sec_level = BT_SECURITY_LOW;  in l2cap_chan_set_defaults()
512 	chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;  in l2cap_chan_set_defaults()
513 	chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;  in l2cap_chan_set_defaults()
514 	chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;  in l2cap_chan_set_defaults()
515 	chan->conf_state = 0;  in l2cap_chan_set_defaults()
517 	set_bit(FLAG_FORCE_ACTIVE, &chan->flags);  in l2cap_chan_set_defaults()
521 static void l2cap_le_flowctl_init(struct l2cap_chan *chan, u16 tx_credits)  in l2cap_le_flowctl_init()  argument
523 	chan->sdu = NULL;  in l2cap_le_flowctl_init()
524 	chan->sdu_last_frag = NULL;  in l2cap_le_flowctl_init()
525 	chan->sdu_len = 0;  in l2cap_le_flowctl_init()
526 	chan->tx_credits = tx_credits;  in l2cap_le_flowctl_init()
528 	chan->mps = min_t(u16, chan->imtu, chan->conn->mtu - L2CAP_HDR_SIZE);  in l2cap_le_flowctl_init()
530 	chan->rx_credits = (chan->imtu / chan->mps) + 1;  in l2cap_le_flowctl_init()
532 	skb_queue_head_init(&chan->tx_q);  in l2cap_le_flowctl_init()
535 void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)  in __l2cap_chan_add()  argument
538 	       __le16_to_cpu(chan->psm), chan->dcid);  in __l2cap_chan_add()
542 	chan->conn = conn;  in __l2cap_chan_add()
544 	switch (chan->chan_type) {  in __l2cap_chan_add()
547 		chan->scid = l2cap_alloc_cid(conn);  in __l2cap_chan_add()
549 			chan->omtu = L2CAP_DEFAULT_MTU;  in __l2cap_chan_add()
554 		chan->scid = L2CAP_CID_CONN_LESS;  in __l2cap_chan_add()
555 		chan->dcid = L2CAP_CID_CONN_LESS;  in __l2cap_chan_add()
556 		chan->omtu = L2CAP_DEFAULT_MTU;  in __l2cap_chan_add()
565 		chan->scid = L2CAP_CID_SIGNALING;  in __l2cap_chan_add()
566 		chan->dcid = L2CAP_CID_SIGNALING;  in __l2cap_chan_add()
567 		chan->omtu = L2CAP_DEFAULT_MTU;  in __l2cap_chan_add()
570 	chan->local_id		= L2CAP_BESTEFFORT_ID;  in __l2cap_chan_add()
571 	chan->local_stype	= L2CAP_SERV_BESTEFFORT;  in __l2cap_chan_add()
572 	chan->local_msdu	= L2CAP_DEFAULT_MAX_SDU_SIZE;  in __l2cap_chan_add()
573 	chan->local_sdu_itime	= L2CAP_DEFAULT_SDU_ITIME;  in __l2cap_chan_add()
574 	chan->local_acc_lat	= L2CAP_DEFAULT_ACC_LAT;  in __l2cap_chan_add()
575 	chan->local_flush_to	= L2CAP_EFS_DEFAULT_FLUSH_TO;  in __l2cap_chan_add()
577 	l2cap_chan_hold(chan);  in __l2cap_chan_add()
580 	if (chan->chan_type != L2CAP_CHAN_FIXED ||  in __l2cap_chan_add()
581 	    test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))  in __l2cap_chan_add()
584 	list_add(&chan->list, &conn->chan_l);  in __l2cap_chan_add()
587 void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)  in l2cap_chan_add()  argument
590 	__l2cap_chan_add(conn, chan);  in l2cap_chan_add()
594 void l2cap_chan_del(struct l2cap_chan *chan, int err)  in l2cap_chan_del()  argument
596 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_del()
598 	__clear_chan_timer(chan);  in l2cap_chan_del()
600 	BT_DBG("chan %p, conn %p, err %d, state %s", chan, conn, err,  in l2cap_chan_del()
601 	       state_to_string(chan->state));  in l2cap_chan_del()
603 	chan->ops->teardown(chan, err);  in l2cap_chan_del()
608 		list_del(&chan->list);  in l2cap_chan_del()
610 		l2cap_chan_put(chan);  in l2cap_chan_del()
612 		chan->conn = NULL;  in l2cap_chan_del()
618 		if (chan->chan_type != L2CAP_CHAN_FIXED ||  in l2cap_chan_del()
619 		    test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))  in l2cap_chan_del()
622 		if (mgr && mgr->bredr_chan == chan)  in l2cap_chan_del()
626 	if (chan->hs_hchan) {  in l2cap_chan_del()
627 		struct hci_chan *hs_hchan = chan->hs_hchan;  in l2cap_chan_del()
629 		BT_DBG("chan %p disconnect hs_hchan %p", chan, hs_hchan);  in l2cap_chan_del()
633 	if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))  in l2cap_chan_del()
636 	switch(chan->mode) {  in l2cap_chan_del()
641 		skb_queue_purge(&chan->tx_q);  in l2cap_chan_del()
645 		__clear_retrans_timer(chan);  in l2cap_chan_del()
646 		__clear_monitor_timer(chan);  in l2cap_chan_del()
647 		__clear_ack_timer(chan);  in l2cap_chan_del()
649 		skb_queue_purge(&chan->srej_q);  in l2cap_chan_del()
651 		l2cap_seq_list_free(&chan->srej_list);  in l2cap_chan_del()
652 		l2cap_seq_list_free(&chan->retrans_list);  in l2cap_chan_del()
657 		skb_queue_purge(&chan->tx_q);  in l2cap_chan_del()
670 	struct l2cap_chan *chan;  in l2cap_conn_update_id_addr()  local
674 	list_for_each_entry(chan, &conn->chan_l, list) {  in l2cap_conn_update_id_addr()
675 		l2cap_chan_lock(chan);  in l2cap_conn_update_id_addr()
676 		bacpy(&chan->dst, &hcon->dst);  in l2cap_conn_update_id_addr()
677 		chan->dst_type = bdaddr_dst_type(hcon);  in l2cap_conn_update_id_addr()
678 		l2cap_chan_unlock(chan);  in l2cap_conn_update_id_addr()
684 static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan)  in l2cap_chan_le_connect_reject()  argument
686 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_le_connect_reject()
690 	if (test_bit(FLAG_DEFER_SETUP, &chan->flags))  in l2cap_chan_le_connect_reject()
695 	l2cap_state_change(chan, BT_DISCONN);  in l2cap_chan_le_connect_reject()
697 	rsp.dcid    = cpu_to_le16(chan->scid);  in l2cap_chan_le_connect_reject()
698 	rsp.mtu     = cpu_to_le16(chan->imtu);  in l2cap_chan_le_connect_reject()
699 	rsp.mps     = cpu_to_le16(chan->mps);  in l2cap_chan_le_connect_reject()
700 	rsp.credits = cpu_to_le16(chan->rx_credits);  in l2cap_chan_le_connect_reject()
703 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),  in l2cap_chan_le_connect_reject()
707 static void l2cap_chan_connect_reject(struct l2cap_chan *chan)  in l2cap_chan_connect_reject()  argument
709 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_connect_reject()
713 	if (test_bit(FLAG_DEFER_SETUP, &chan->flags))  in l2cap_chan_connect_reject()
718 	l2cap_state_change(chan, BT_DISCONN);  in l2cap_chan_connect_reject()
720 	rsp.scid   = cpu_to_le16(chan->dcid);  in l2cap_chan_connect_reject()
721 	rsp.dcid   = cpu_to_le16(chan->scid);  in l2cap_chan_connect_reject()
725 	l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);  in l2cap_chan_connect_reject()
728 void l2cap_chan_close(struct l2cap_chan *chan, int reason)  in l2cap_chan_close()  argument
730 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_close()
732 	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));  in l2cap_chan_close()
734 	switch (chan->state) {  in l2cap_chan_close()
736 		chan->ops->teardown(chan, 0);  in l2cap_chan_close()
741 		if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {  in l2cap_chan_close()
742 			__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));  in l2cap_chan_close()
743 			l2cap_send_disconn_req(chan, reason);  in l2cap_chan_close()
745 			l2cap_chan_del(chan, reason);  in l2cap_chan_close()
749 		if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {  in l2cap_chan_close()
751 				l2cap_chan_connect_reject(chan);  in l2cap_chan_close()
753 				l2cap_chan_le_connect_reject(chan);  in l2cap_chan_close()
756 		l2cap_chan_del(chan, reason);  in l2cap_chan_close()
761 		l2cap_chan_del(chan, reason);  in l2cap_chan_close()
765 		chan->ops->teardown(chan, 0);  in l2cap_chan_close()
771 static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)  in l2cap_get_auth_type()  argument
773 	switch (chan->chan_type) {  in l2cap_get_auth_type()
775 		switch (chan->sec_level) {  in l2cap_get_auth_type()
786 		if (chan->psm == cpu_to_le16(L2CAP_PSM_3DSP)) {  in l2cap_get_auth_type()
787 			if (chan->sec_level == BT_SECURITY_LOW)  in l2cap_get_auth_type()
788 				chan->sec_level = BT_SECURITY_SDP;  in l2cap_get_auth_type()
790 		if (chan->sec_level == BT_SECURITY_HIGH ||  in l2cap_get_auth_type()
791 		    chan->sec_level == BT_SECURITY_FIPS)  in l2cap_get_auth_type()
797 		if (chan->psm == cpu_to_le16(L2CAP_PSM_SDP)) {  in l2cap_get_auth_type()
798 			if (chan->sec_level == BT_SECURITY_LOW)  in l2cap_get_auth_type()
799 				chan->sec_level = BT_SECURITY_SDP;  in l2cap_get_auth_type()
801 			if (chan->sec_level == BT_SECURITY_HIGH ||  in l2cap_get_auth_type()
802 			    chan->sec_level == BT_SECURITY_FIPS)  in l2cap_get_auth_type()
809 		switch (chan->sec_level) {  in l2cap_get_auth_type()
823 int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator)  in l2cap_chan_check_security()  argument
825 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_check_security()
829 		return smp_conn_security(conn->hcon, chan->sec_level);  in l2cap_chan_check_security()
831 	auth_type = l2cap_get_auth_type(chan);  in l2cap_chan_check_security()
833 	return hci_conn_security(conn->hcon, chan->sec_level, auth_type,  in l2cap_chan_check_security()
884 static bool __chan_is_moving(struct l2cap_chan *chan)  in __chan_is_moving()  argument
886 	return chan->move_state != L2CAP_MOVE_STABLE &&  in __chan_is_moving()
887 	       chan->move_state != L2CAP_MOVE_WAIT_PREPARE;  in __chan_is_moving()
890 static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)  in l2cap_do_send()  argument
892 	struct hci_conn *hcon = chan->conn->hcon;  in l2cap_do_send()
895 	BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,  in l2cap_do_send()
898 	if (chan->hs_hcon && !__chan_is_moving(chan)) {  in l2cap_do_send()
899 		if (chan->hs_hchan)  in l2cap_do_send()
900 			hci_send_acl(chan->hs_hchan, skb, ACL_COMPLETE);  in l2cap_do_send()
912 	    (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&  in l2cap_do_send()
918 	bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);  in l2cap_do_send()
919 	hci_send_acl(chan->conn->hchan, skb, flags);  in l2cap_do_send()
970 static inline void __unpack_control(struct l2cap_chan *chan,  in __unpack_control()  argument
973 	if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {  in __unpack_control()
1022 static inline void __pack_control(struct l2cap_chan *chan,  in __pack_control()  argument
1026 	if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {  in __pack_control()
1035 static inline unsigned int __ertm_hdr_size(struct l2cap_chan *chan)  in __ertm_hdr_size()  argument
1037 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in __ertm_hdr_size()
1043 static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan,  in l2cap_create_sframe_pdu()  argument
1048 	int hlen = __ertm_hdr_size(chan);  in l2cap_create_sframe_pdu()
1050 	if (chan->fcs == L2CAP_FCS_CRC16)  in l2cap_create_sframe_pdu()
1060 	lh->cid = cpu_to_le16(chan->dcid);  in l2cap_create_sframe_pdu()
1062 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_create_sframe_pdu()
1067 	if (chan->fcs == L2CAP_FCS_CRC16) {  in l2cap_create_sframe_pdu()
1076 static void l2cap_send_sframe(struct l2cap_chan *chan,  in l2cap_send_sframe()  argument
1082 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_send_sframe()
1087 	if (__chan_is_moving(chan))  in l2cap_send_sframe()
1090 	if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) &&  in l2cap_send_sframe()
1095 		clear_bit(CONN_RNR_SENT, &chan->conn_state);  in l2cap_send_sframe()
1097 		set_bit(CONN_RNR_SENT, &chan->conn_state);  in l2cap_send_sframe()
1100 		chan->last_acked_seq = control->reqseq;  in l2cap_send_sframe()
1101 		__clear_ack_timer(chan);  in l2cap_send_sframe()
1107 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_send_sframe()
1112 	skb = l2cap_create_sframe_pdu(chan, control_field);  in l2cap_send_sframe()
1114 		l2cap_do_send(chan, skb);  in l2cap_send_sframe()
1117 static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll)  in l2cap_send_rr_or_rnr()  argument
1121 	BT_DBG("chan %p, poll %d", chan, poll);  in l2cap_send_rr_or_rnr()
1127 	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state))  in l2cap_send_rr_or_rnr()
1132 	control.reqseq = chan->buffer_seq;  in l2cap_send_rr_or_rnr()
1133 	l2cap_send_sframe(chan, &control);  in l2cap_send_rr_or_rnr()
1136 static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)  in __l2cap_no_conn_pending()  argument
1138 	if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)  in __l2cap_no_conn_pending()
1141 	return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);  in __l2cap_no_conn_pending()
1144 static bool __amp_capable(struct l2cap_chan *chan)  in __amp_capable()  argument
1146 	struct l2cap_conn *conn = chan->conn;  in __amp_capable()
1166 	if (chan->chan_policy == BT_CHANNEL_POLICY_AMP_PREFERRED)  in __amp_capable()
1172 static bool l2cap_check_efs(struct l2cap_chan *chan)  in l2cap_check_efs()  argument
1178 void l2cap_send_conn_req(struct l2cap_chan *chan)  in l2cap_send_conn_req()  argument
1180 	struct l2cap_conn *conn = chan->conn;  in l2cap_send_conn_req()
1183 	req.scid = cpu_to_le16(chan->scid);  in l2cap_send_conn_req()
1184 	req.psm  = chan->psm;  in l2cap_send_conn_req()
1186 	chan->ident = l2cap_get_ident(conn);  in l2cap_send_conn_req()
1188 	set_bit(CONF_CONNECT_PEND, &chan->conf_state);  in l2cap_send_conn_req()
1190 	l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);  in l2cap_send_conn_req()
1193 static void l2cap_send_create_chan_req(struct l2cap_chan *chan, u8 amp_id)  in l2cap_send_create_chan_req()  argument
1196 	req.scid = cpu_to_le16(chan->scid);  in l2cap_send_create_chan_req()
1197 	req.psm  = chan->psm;  in l2cap_send_create_chan_req()
1200 	chan->ident = l2cap_get_ident(chan->conn);  in l2cap_send_create_chan_req()
1202 	l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_REQ,  in l2cap_send_create_chan_req()
1206 static void l2cap_move_setup(struct l2cap_chan *chan)  in l2cap_move_setup()  argument
1210 	BT_DBG("chan %p", chan);  in l2cap_move_setup()
1212 	if (chan->mode != L2CAP_MODE_ERTM)  in l2cap_move_setup()
1215 	__clear_retrans_timer(chan);  in l2cap_move_setup()
1216 	__clear_monitor_timer(chan);  in l2cap_move_setup()
1217 	__clear_ack_timer(chan);  in l2cap_move_setup()
1219 	chan->retry_count = 0;  in l2cap_move_setup()
1220 	skb_queue_walk(&chan->tx_q, skb) {  in l2cap_move_setup()
1227 	chan->expected_tx_seq = chan->buffer_seq;  in l2cap_move_setup()
1229 	clear_bit(CONN_REJ_ACT, &chan->conn_state);  in l2cap_move_setup()
1230 	clear_bit(CONN_SREJ_ACT, &chan->conn_state);  in l2cap_move_setup()
1231 	l2cap_seq_list_clear(&chan->retrans_list);  in l2cap_move_setup()
1232 	l2cap_seq_list_clear(&chan->srej_list);  in l2cap_move_setup()
1233 	skb_queue_purge(&chan->srej_q);  in l2cap_move_setup()
1235 	chan->tx_state = L2CAP_TX_STATE_XMIT;  in l2cap_move_setup()
1236 	chan->rx_state = L2CAP_RX_STATE_MOVE;  in l2cap_move_setup()
1238 	set_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_move_setup()
1241 static void l2cap_move_done(struct l2cap_chan *chan)  in l2cap_move_done()  argument
1243 	u8 move_role = chan->move_role;  in l2cap_move_done()
1244 	BT_DBG("chan %p", chan);  in l2cap_move_done()
1246 	chan->move_state = L2CAP_MOVE_STABLE;  in l2cap_move_done()
1247 	chan->move_role = L2CAP_MOVE_ROLE_NONE;  in l2cap_move_done()
1249 	if (chan->mode != L2CAP_MODE_ERTM)  in l2cap_move_done()
1254 		l2cap_tx(chan, NULL, NULL, L2CAP_EV_EXPLICIT_POLL);  in l2cap_move_done()
1255 		chan->rx_state = L2CAP_RX_STATE_WAIT_F;  in l2cap_move_done()
1258 		chan->rx_state = L2CAP_RX_STATE_WAIT_P;  in l2cap_move_done()
1263 static void l2cap_chan_ready(struct l2cap_chan *chan)  in l2cap_chan_ready()  argument
1269 	if (chan->state == BT_CONNECTED)  in l2cap_chan_ready()
1273 	chan->conf_state = 0;  in l2cap_chan_ready()
1274 	__clear_chan_timer(chan);  in l2cap_chan_ready()
1276 	if (chan->mode == L2CAP_MODE_LE_FLOWCTL && !chan->tx_credits)  in l2cap_chan_ready()
1277 		chan->ops->suspend(chan);  in l2cap_chan_ready()
1279 	chan->state = BT_CONNECTED;  in l2cap_chan_ready()
1281 	chan->ops->ready(chan);  in l2cap_chan_ready()
1284 static void l2cap_le_connect(struct l2cap_chan *chan)  in l2cap_le_connect()  argument
1286 	struct l2cap_conn *conn = chan->conn;  in l2cap_le_connect()
1289 	if (test_and_set_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags))  in l2cap_le_connect()
1292 	l2cap_le_flowctl_init(chan, 0);  in l2cap_le_connect()
1294 	req.psm     = chan->psm;  in l2cap_le_connect()
1295 	req.scid    = cpu_to_le16(chan->scid);  in l2cap_le_connect()
1296 	req.mtu     = cpu_to_le16(chan->imtu);  in l2cap_le_connect()
1297 	req.mps     = cpu_to_le16(chan->mps);  in l2cap_le_connect()
1298 	req.credits = cpu_to_le16(chan->rx_credits);  in l2cap_le_connect()
1300 	chan->ident = l2cap_get_ident(conn);  in l2cap_le_connect()
1302 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_REQ,  in l2cap_le_connect()
1306 static void l2cap_le_start(struct l2cap_chan *chan)  in l2cap_le_start()  argument
1308 	struct l2cap_conn *conn = chan->conn;  in l2cap_le_start()
1310 	if (!smp_conn_security(conn->hcon, chan->sec_level))  in l2cap_le_start()
1313 	if (!chan->psm) {  in l2cap_le_start()
1314 		l2cap_chan_ready(chan);  in l2cap_le_start()
1318 	if (chan->state == BT_CONNECT)  in l2cap_le_start()
1319 		l2cap_le_connect(chan);  in l2cap_le_start()
1322 static void l2cap_start_connection(struct l2cap_chan *chan)  in l2cap_start_connection()  argument
1324 	if (__amp_capable(chan)) {  in l2cap_start_connection()
1325 		BT_DBG("chan %p AMP capable: discover AMPs", chan);  in l2cap_start_connection()
1326 		a2mp_discover_amp(chan);  in l2cap_start_connection()
1327 	} else if (chan->conn->hcon->type == LE_LINK) {  in l2cap_start_connection()
1328 		l2cap_le_start(chan);  in l2cap_start_connection()
1330 		l2cap_send_conn_req(chan);  in l2cap_start_connection()
1367 static void l2cap_do_start(struct l2cap_chan *chan)  in l2cap_do_start()  argument
1369 	struct l2cap_conn *conn = chan->conn;  in l2cap_do_start()
1372 		l2cap_le_start(chan);  in l2cap_do_start()
1384 	if (!l2cap_chan_check_security(chan, true) ||  in l2cap_do_start()
1385 	    !__l2cap_no_conn_pending(chan))  in l2cap_do_start()
1389 		l2cap_start_connection(chan);  in l2cap_do_start()
1391 		__set_chan_timer(chan, L2CAP_DISC_TIMEOUT);  in l2cap_do_start()
1410 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err)  in l2cap_send_disconn_req()  argument
1412 	struct l2cap_conn *conn = chan->conn;  in l2cap_send_disconn_req()
1418 	if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) {  in l2cap_send_disconn_req()
1419 		__clear_retrans_timer(chan);  in l2cap_send_disconn_req()
1420 		__clear_monitor_timer(chan);  in l2cap_send_disconn_req()
1421 		__clear_ack_timer(chan);  in l2cap_send_disconn_req()
1424 	if (chan->scid == L2CAP_CID_A2MP) {  in l2cap_send_disconn_req()
1425 		l2cap_state_change(chan, BT_DISCONN);  in l2cap_send_disconn_req()
1429 	req.dcid = cpu_to_le16(chan->dcid);  in l2cap_send_disconn_req()
1430 	req.scid = cpu_to_le16(chan->scid);  in l2cap_send_disconn_req()
1434 	l2cap_state_change_and_error(chan, BT_DISCONN, err);  in l2cap_send_disconn_req()
1440 	struct l2cap_chan *chan, *tmp;  in l2cap_conn_start()  local
1446 	list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {  in l2cap_conn_start()
1447 		l2cap_chan_lock(chan);  in l2cap_conn_start()
1449 		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {  in l2cap_conn_start()
1450 			l2cap_chan_ready(chan);  in l2cap_conn_start()
1451 			l2cap_chan_unlock(chan);  in l2cap_conn_start()
1455 		if (chan->state == BT_CONNECT) {  in l2cap_conn_start()
1456 			if (!l2cap_chan_check_security(chan, true) ||  in l2cap_conn_start()
1457 			    !__l2cap_no_conn_pending(chan)) {  in l2cap_conn_start()
1458 				l2cap_chan_unlock(chan);  in l2cap_conn_start()
1462 			if (!l2cap_mode_supported(chan->mode, conn->feat_mask)  in l2cap_conn_start()
1464 					&chan->conf_state)) {  in l2cap_conn_start()
1465 				l2cap_chan_close(chan, ECONNRESET);  in l2cap_conn_start()
1466 				l2cap_chan_unlock(chan);  in l2cap_conn_start()
1471 				l2cap_start_connection(chan);  in l2cap_conn_start()
1473 				l2cap_chan_close(chan, ECONNREFUSED);  in l2cap_conn_start()
1475 		} else if (chan->state == BT_CONNECT2) {  in l2cap_conn_start()
1478 			rsp.scid = cpu_to_le16(chan->dcid);  in l2cap_conn_start()
1479 			rsp.dcid = cpu_to_le16(chan->scid);  in l2cap_conn_start()
1481 			if (l2cap_chan_check_security(chan, false)) {  in l2cap_conn_start()
1482 				if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {  in l2cap_conn_start()
1485 					chan->ops->defer(chan);  in l2cap_conn_start()
1488 					l2cap_state_change(chan, BT_CONFIG);  in l2cap_conn_start()
1497 			l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,  in l2cap_conn_start()
1500 			if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||  in l2cap_conn_start()
1502 				l2cap_chan_unlock(chan);  in l2cap_conn_start()
1506 			set_bit(CONF_REQ_SENT, &chan->conf_state);  in l2cap_conn_start()
1508 				       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);  in l2cap_conn_start()
1509 			chan->num_conf_req++;  in l2cap_conn_start()
1512 		l2cap_chan_unlock(chan);  in l2cap_conn_start()
1553 	struct l2cap_chan *chan;  in l2cap_conn_ready()  local
1563 	list_for_each_entry(chan, &conn->chan_l, list) {  in l2cap_conn_ready()
1565 		l2cap_chan_lock(chan);  in l2cap_conn_ready()
1567 		if (chan->scid == L2CAP_CID_A2MP) {  in l2cap_conn_ready()
1568 			l2cap_chan_unlock(chan);  in l2cap_conn_ready()
1573 			l2cap_le_start(chan);  in l2cap_conn_ready()
1574 		} else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {  in l2cap_conn_ready()
1576 				l2cap_chan_ready(chan);  in l2cap_conn_ready()
1577 		} else if (chan->state == BT_CONNECT) {  in l2cap_conn_ready()
1578 			l2cap_do_start(chan);  in l2cap_conn_ready()
1581 		l2cap_chan_unlock(chan);  in l2cap_conn_ready()
1595 	struct l2cap_chan *chan;  in l2cap_conn_unreliable()  local
1601 	list_for_each_entry(chan, &conn->chan_l, list) {  in l2cap_conn_unreliable()
1602 		if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))  in l2cap_conn_unreliable()
1603 			l2cap_chan_set_err(chan, err);  in l2cap_conn_unreliable()
1702 	struct l2cap_chan *chan, *l;  in l2cap_conn_del()  local
1731 	list_for_each_entry_safe(chan, l, &conn->chan_l, list) {  in l2cap_conn_del()
1732 		l2cap_chan_hold(chan);  in l2cap_conn_del()
1733 		l2cap_chan_lock(chan);  in l2cap_conn_del()
1735 		l2cap_chan_del(chan, err);  in l2cap_conn_del()
1737 		l2cap_chan_unlock(chan);  in l2cap_conn_del()
1739 		chan->ops->close(chan);  in l2cap_conn_del()
1740 		l2cap_chan_put(chan);  in l2cap_conn_del()
1832 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,  in l2cap_monitor_timeout()  local
1835 	BT_DBG("chan %p", chan);  in l2cap_monitor_timeout()
1837 	l2cap_chan_lock(chan);  in l2cap_monitor_timeout()
1839 	if (!chan->conn) {  in l2cap_monitor_timeout()
1840 		l2cap_chan_unlock(chan);  in l2cap_monitor_timeout()
1841 		l2cap_chan_put(chan);  in l2cap_monitor_timeout()
1845 	l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO);  in l2cap_monitor_timeout()
1847 	l2cap_chan_unlock(chan);  in l2cap_monitor_timeout()
1848 	l2cap_chan_put(chan);  in l2cap_monitor_timeout()
1853 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,  in l2cap_retrans_timeout()  local
1856 	BT_DBG("chan %p", chan);  in l2cap_retrans_timeout()
1858 	l2cap_chan_lock(chan);  in l2cap_retrans_timeout()
1860 	if (!chan->conn) {  in l2cap_retrans_timeout()
1861 		l2cap_chan_unlock(chan);  in l2cap_retrans_timeout()
1862 		l2cap_chan_put(chan);  in l2cap_retrans_timeout()
1866 	l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO);  in l2cap_retrans_timeout()
1867 	l2cap_chan_unlock(chan);  in l2cap_retrans_timeout()
1868 	l2cap_chan_put(chan);  in l2cap_retrans_timeout()
1871 static void l2cap_streaming_send(struct l2cap_chan *chan,  in l2cap_streaming_send()  argument
1877 	BT_DBG("chan %p, skbs %p", chan, skbs);  in l2cap_streaming_send()
1879 	if (__chan_is_moving(chan))  in l2cap_streaming_send()
1882 	skb_queue_splice_tail_init(skbs, &chan->tx_q);  in l2cap_streaming_send()
1884 	while (!skb_queue_empty(&chan->tx_q)) {  in l2cap_streaming_send()
1886 		skb = skb_dequeue(&chan->tx_q);  in l2cap_streaming_send()
1892 		control->txseq = chan->next_tx_seq;  in l2cap_streaming_send()
1894 		__pack_control(chan, control, skb);  in l2cap_streaming_send()
1896 		if (chan->fcs == L2CAP_FCS_CRC16) {  in l2cap_streaming_send()
1901 		l2cap_do_send(chan, skb);  in l2cap_streaming_send()
1905 		chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);  in l2cap_streaming_send()
1906 		chan->frames_sent++;  in l2cap_streaming_send()
1910 static int l2cap_ertm_send(struct l2cap_chan *chan)  in l2cap_ertm_send()  argument
1916 	BT_DBG("chan %p", chan);  in l2cap_ertm_send()
1918 	if (chan->state != BT_CONNECTED)  in l2cap_ertm_send()
1921 	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))  in l2cap_ertm_send()
1924 	if (__chan_is_moving(chan))  in l2cap_ertm_send()
1927 	while (chan->tx_send_head &&  in l2cap_ertm_send()
1928 	       chan->unacked_frames < chan->remote_tx_win &&  in l2cap_ertm_send()
1929 	       chan->tx_state == L2CAP_TX_STATE_XMIT) {  in l2cap_ertm_send()
1931 		skb = chan->tx_send_head;  in l2cap_ertm_send()
1936 		if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))  in l2cap_ertm_send()
1939 		control->reqseq = chan->buffer_seq;  in l2cap_ertm_send()
1940 		chan->last_acked_seq = chan->buffer_seq;  in l2cap_ertm_send()
1941 		control->txseq = chan->next_tx_seq;  in l2cap_ertm_send()
1943 		__pack_control(chan, control, skb);  in l2cap_ertm_send()
1945 		if (chan->fcs == L2CAP_FCS_CRC16) {  in l2cap_ertm_send()
1958 		__set_retrans_timer(chan);  in l2cap_ertm_send()
1960 		chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);  in l2cap_ertm_send()
1961 		chan->unacked_frames++;  in l2cap_ertm_send()
1962 		chan->frames_sent++;  in l2cap_ertm_send()
1965 		if (skb_queue_is_last(&chan->tx_q, skb))  in l2cap_ertm_send()
1966 			chan->tx_send_head = NULL;  in l2cap_ertm_send()
1968 			chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);  in l2cap_ertm_send()
1970 		l2cap_do_send(chan, tx_skb);  in l2cap_ertm_send()
1975 	       chan->unacked_frames, skb_queue_len(&chan->tx_q));  in l2cap_ertm_send()
1980 static void l2cap_ertm_resend(struct l2cap_chan *chan)  in l2cap_ertm_resend()  argument
1987 	BT_DBG("chan %p", chan);  in l2cap_ertm_resend()
1989 	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))  in l2cap_ertm_resend()
1992 	if (__chan_is_moving(chan))  in l2cap_ertm_resend()
1995 	while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) {  in l2cap_ertm_resend()
1996 		seq = l2cap_seq_list_pop(&chan->retrans_list);  in l2cap_ertm_resend()
1998 		skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq);  in l2cap_ertm_resend()
2008 		if (chan->max_tx != 0 &&  in l2cap_ertm_resend()
2009 		    bt_cb(skb)->l2cap.retries > chan->max_tx) {  in l2cap_ertm_resend()
2010 			BT_DBG("Retry limit exceeded (%d)", chan->max_tx);  in l2cap_ertm_resend()
2011 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_ertm_resend()
2012 			l2cap_seq_list_clear(&chan->retrans_list);  in l2cap_ertm_resend()
2016 		control.reqseq = chan->buffer_seq;  in l2cap_ertm_resend()
2017 		if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))  in l2cap_ertm_resend()
2032 			l2cap_seq_list_clear(&chan->retrans_list);  in l2cap_ertm_resend()
2037 		if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {  in l2cap_ertm_resend()
2046 		if (chan->fcs == L2CAP_FCS_CRC16) {  in l2cap_ertm_resend()
2053 		l2cap_do_send(chan, tx_skb);  in l2cap_ertm_resend()
2057 		chan->last_acked_seq = chan->buffer_seq;  in l2cap_ertm_resend()
2061 static void l2cap_retransmit(struct l2cap_chan *chan,  in l2cap_retransmit()  argument
2064 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_retransmit()
2066 	l2cap_seq_list_append(&chan->retrans_list, control->reqseq);  in l2cap_retransmit()
2067 	l2cap_ertm_resend(chan);  in l2cap_retransmit()
2070 static void l2cap_retransmit_all(struct l2cap_chan *chan,  in l2cap_retransmit_all()  argument
2075 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_retransmit_all()
2078 		set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_retransmit_all()
2080 	l2cap_seq_list_clear(&chan->retrans_list);  in l2cap_retransmit_all()
2082 	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))  in l2cap_retransmit_all()
2085 	if (chan->unacked_frames) {  in l2cap_retransmit_all()
2086 		skb_queue_walk(&chan->tx_q, skb) {  in l2cap_retransmit_all()
2088 			    skb == chan->tx_send_head)  in l2cap_retransmit_all()
2092 		skb_queue_walk_from(&chan->tx_q, skb) {  in l2cap_retransmit_all()
2093 			if (skb == chan->tx_send_head)  in l2cap_retransmit_all()
2096 			l2cap_seq_list_append(&chan->retrans_list,  in l2cap_retransmit_all()
2100 		l2cap_ertm_resend(chan);  in l2cap_retransmit_all()
2104 static void l2cap_send_ack(struct l2cap_chan *chan)  in l2cap_send_ack()  argument
2107 	u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq,  in l2cap_send_ack()
2108 					 chan->last_acked_seq);  in l2cap_send_ack()
2112 	       chan, chan->last_acked_seq, chan->buffer_seq);  in l2cap_send_ack()
2117 	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&  in l2cap_send_ack()
2118 	    chan->rx_state == L2CAP_RX_STATE_RECV) {  in l2cap_send_ack()
2119 		__clear_ack_timer(chan);  in l2cap_send_ack()
2121 		control.reqseq = chan->buffer_seq;  in l2cap_send_ack()
2122 		l2cap_send_sframe(chan, &control);  in l2cap_send_ack()
2124 		if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) {  in l2cap_send_ack()
2125 			l2cap_ertm_send(chan);  in l2cap_send_ack()
2127 			if (chan->buffer_seq == chan->last_acked_seq)  in l2cap_send_ack()
2134 		threshold = chan->ack_win;  in l2cap_send_ack()
2142 			__clear_ack_timer(chan);  in l2cap_send_ack()
2144 			control.reqseq = chan->buffer_seq;  in l2cap_send_ack()
2145 			l2cap_send_sframe(chan, &control);  in l2cap_send_ack()
2150 			__set_ack_timer(chan);  in l2cap_send_ack()
2154 static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,  in l2cap_skbuff_fromiovec()  argument
2158 	struct l2cap_conn *conn = chan->conn;  in l2cap_skbuff_fromiovec()
2175 		tmp = chan->ops->alloc_skb(chan, 0, count,  in l2cap_skbuff_fromiovec()
2198 static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,  in l2cap_create_connless_pdu()  argument
2201 	struct l2cap_conn *conn = chan->conn;  in l2cap_create_connless_pdu()
2206 	BT_DBG("chan %p psm 0x%2.2x len %zu", chan,  in l2cap_create_connless_pdu()
2207 	       __le16_to_cpu(chan->psm), len);  in l2cap_create_connless_pdu()
2211 	skb = chan->ops->alloc_skb(chan, hlen, count,  in l2cap_create_connless_pdu()
2218 	lh->cid = cpu_to_le16(chan->dcid);  in l2cap_create_connless_pdu()
2220 	put_unaligned(chan->psm, (__le16 *) skb_put(skb, L2CAP_PSMLEN_SIZE));  in l2cap_create_connless_pdu()
2222 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);  in l2cap_create_connless_pdu()
2230 static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,  in l2cap_create_basic_pdu()  argument
2233 	struct l2cap_conn *conn = chan->conn;  in l2cap_create_basic_pdu()
2238 	BT_DBG("chan %p len %zu", chan, len);  in l2cap_create_basic_pdu()
2242 	skb = chan->ops->alloc_skb(chan, L2CAP_HDR_SIZE, count,  in l2cap_create_basic_pdu()
2249 	lh->cid = cpu_to_le16(chan->dcid);  in l2cap_create_basic_pdu()
2252 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);  in l2cap_create_basic_pdu()
2260 static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,  in l2cap_create_iframe_pdu()  argument
2264 	struct l2cap_conn *conn = chan->conn;  in l2cap_create_iframe_pdu()
2269 	BT_DBG("chan %p len %zu", chan, len);  in l2cap_create_iframe_pdu()
2274 	hlen = __ertm_hdr_size(chan);  in l2cap_create_iframe_pdu()
2279 	if (chan->fcs == L2CAP_FCS_CRC16)  in l2cap_create_iframe_pdu()
2284 	skb = chan->ops->alloc_skb(chan, hlen, count,  in l2cap_create_iframe_pdu()
2291 	lh->cid = cpu_to_le16(chan->dcid);  in l2cap_create_iframe_pdu()
2295 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_create_iframe_pdu()
2303 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);  in l2cap_create_iframe_pdu()
2309 	bt_cb(skb)->l2cap.fcs = chan->fcs;  in l2cap_create_iframe_pdu()
2314 static int l2cap_segment_sdu(struct l2cap_chan *chan,  in l2cap_segment_sdu()  argument
2323 	BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);  in l2cap_segment_sdu()
2331 	pdu_len = chan->conn->mtu;  in l2cap_segment_sdu()
2334 	if (!chan->hs_hcon)  in l2cap_segment_sdu()
2338 	if (chan->fcs)  in l2cap_segment_sdu()
2341 	pdu_len -= __ertm_hdr_size(chan);  in l2cap_segment_sdu()
2344 	pdu_len = min_t(size_t, pdu_len, chan->remote_mps);  in l2cap_segment_sdu()
2356 		skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len);  in l2cap_segment_sdu()
2381 static struct sk_buff *l2cap_create_le_flowctl_pdu(struct l2cap_chan *chan,  in l2cap_create_le_flowctl_pdu()  argument
2385 	struct l2cap_conn *conn = chan->conn;  in l2cap_create_le_flowctl_pdu()
2390 	BT_DBG("chan %p len %zu", chan, len);  in l2cap_create_le_flowctl_pdu()
2402 	skb = chan->ops->alloc_skb(chan, hlen, count,  in l2cap_create_le_flowctl_pdu()
2409 	lh->cid = cpu_to_le16(chan->dcid);  in l2cap_create_le_flowctl_pdu()
2415 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);  in l2cap_create_le_flowctl_pdu()
2424 static int l2cap_segment_le_sdu(struct l2cap_chan *chan,  in l2cap_segment_le_sdu()  argument
2432 	BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);  in l2cap_segment_le_sdu()
2435 	pdu_len = chan->remote_mps - L2CAP_SDULEN_SIZE;  in l2cap_segment_le_sdu()
2441 		skb = l2cap_create_le_flowctl_pdu(chan, msg, pdu_len, sdu_len);  in l2cap_segment_le_sdu()
2460 static void l2cap_le_flowctl_send(struct l2cap_chan *chan)  in l2cap_le_flowctl_send()  argument
2464 	BT_DBG("chan %p", chan);  in l2cap_le_flowctl_send()
2466 	while (chan->tx_credits && !skb_queue_empty(&chan->tx_q)) {  in l2cap_le_flowctl_send()
2467 		l2cap_do_send(chan, skb_dequeue(&chan->tx_q));  in l2cap_le_flowctl_send()
2468 		chan->tx_credits--;  in l2cap_le_flowctl_send()
2472 	BT_DBG("Sent %d credits %u queued %u", sent, chan->tx_credits,  in l2cap_le_flowctl_send()
2473 	       skb_queue_len(&chan->tx_q));  in l2cap_le_flowctl_send()
2476 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)  in l2cap_chan_send()  argument
2482 	if (!chan->conn)  in l2cap_chan_send()
2486 	if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {  in l2cap_chan_send()
2487 		skb = l2cap_create_connless_pdu(chan, msg, len);  in l2cap_chan_send()
2494 		if (chan->state != BT_CONNECTED) {  in l2cap_chan_send()
2499 		l2cap_do_send(chan, skb);  in l2cap_chan_send()
2503 	switch (chan->mode) {  in l2cap_chan_send()
2506 		if (len > chan->omtu)  in l2cap_chan_send()
2511 		err = l2cap_segment_le_sdu(chan, &seg_queue, msg, len);  in l2cap_chan_send()
2513 		if (chan->state != BT_CONNECTED) {  in l2cap_chan_send()
2521 		skb_queue_splice_tail_init(&seg_queue, &chan->tx_q);  in l2cap_chan_send()
2523 		l2cap_le_flowctl_send(chan);  in l2cap_chan_send()
2525 		if (!chan->tx_credits)  in l2cap_chan_send()
2526 			chan->ops->suspend(chan);  in l2cap_chan_send()
2534 		if (len > chan->omtu)  in l2cap_chan_send()
2538 		skb = l2cap_create_basic_pdu(chan, msg, len);  in l2cap_chan_send()
2545 		if (chan->state != BT_CONNECTED) {  in l2cap_chan_send()
2550 		l2cap_do_send(chan, skb);  in l2cap_chan_send()
2557 		if (len > chan->omtu) {  in l2cap_chan_send()
2568 		err = l2cap_segment_sdu(chan, &seg_queue, msg, len);  in l2cap_chan_send()
2573 		if (chan->state != BT_CONNECTED) {  in l2cap_chan_send()
2581 		if (chan->mode == L2CAP_MODE_ERTM)  in l2cap_chan_send()
2582 			l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST);  in l2cap_chan_send()
2584 			l2cap_streaming_send(chan, &seg_queue);  in l2cap_chan_send()
2595 		BT_DBG("bad state %1.1x", chan->mode);  in l2cap_chan_send()
2603 static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq)  in l2cap_send_srej()  argument
2608 	BT_DBG("chan %p, txseq %u", chan, txseq);  in l2cap_send_srej()
2614 	for (seq = chan->expected_tx_seq; seq != txseq;  in l2cap_send_srej()
2615 	     seq = __next_seq(chan, seq)) {  in l2cap_send_srej()
2616 		if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) {  in l2cap_send_srej()
2618 			l2cap_send_sframe(chan, &control);  in l2cap_send_srej()
2619 			l2cap_seq_list_append(&chan->srej_list, seq);  in l2cap_send_srej()
2623 	chan->expected_tx_seq = __next_seq(chan, txseq);  in l2cap_send_srej()
2626 static void l2cap_send_srej_tail(struct l2cap_chan *chan)  in l2cap_send_srej_tail()  argument
2630 	BT_DBG("chan %p", chan);  in l2cap_send_srej_tail()
2632 	if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR)  in l2cap_send_srej_tail()
2638 	control.reqseq = chan->srej_list.tail;  in l2cap_send_srej_tail()
2639 	l2cap_send_sframe(chan, &control);  in l2cap_send_srej_tail()
2642 static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq)  in l2cap_send_srej_list()  argument
2648 	BT_DBG("chan %p, txseq %u", chan, txseq);  in l2cap_send_srej_list()
2655 	initial_head = chan->srej_list.head;  in l2cap_send_srej_list()
2658 		seq = l2cap_seq_list_pop(&chan->srej_list);  in l2cap_send_srej_list()
2663 		l2cap_send_sframe(chan, &control);  in l2cap_send_srej_list()
2664 		l2cap_seq_list_append(&chan->srej_list, seq);  in l2cap_send_srej_list()
2665 	} while (chan->srej_list.head != initial_head);  in l2cap_send_srej_list()
2668 static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq)  in l2cap_process_reqseq()  argument
2673 	BT_DBG("chan %p, reqseq %u", chan, reqseq);  in l2cap_process_reqseq()
2675 	if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq)  in l2cap_process_reqseq()
2679 	       chan->expected_ack_seq, chan->unacked_frames);  in l2cap_process_reqseq()
2681 	for (ackseq = chan->expected_ack_seq; ackseq != reqseq;  in l2cap_process_reqseq()
2682 	     ackseq = __next_seq(chan, ackseq)) {  in l2cap_process_reqseq()
2684 		acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq);  in l2cap_process_reqseq()
2686 			skb_unlink(acked_skb, &chan->tx_q);  in l2cap_process_reqseq()
2688 			chan->unacked_frames--;  in l2cap_process_reqseq()
2692 	chan->expected_ack_seq = reqseq;  in l2cap_process_reqseq()
2694 	if (chan->unacked_frames == 0)  in l2cap_process_reqseq()
2695 		__clear_retrans_timer(chan);  in l2cap_process_reqseq()
2697 	BT_DBG("unacked_frames %u", chan->unacked_frames);  in l2cap_process_reqseq()
2700 static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan)  in l2cap_abort_rx_srej_sent()  argument
2702 	BT_DBG("chan %p", chan);  in l2cap_abort_rx_srej_sent()
2704 	chan->expected_tx_seq = chan->buffer_seq;  in l2cap_abort_rx_srej_sent()
2705 	l2cap_seq_list_clear(&chan->srej_list);  in l2cap_abort_rx_srej_sent()
2706 	skb_queue_purge(&chan->srej_q);  in l2cap_abort_rx_srej_sent()
2707 	chan->rx_state = L2CAP_RX_STATE_RECV;  in l2cap_abort_rx_srej_sent()
2710 static void l2cap_tx_state_xmit(struct l2cap_chan *chan,  in l2cap_tx_state_xmit()  argument
2714 	BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,  in l2cap_tx_state_xmit()
2719 		if (chan->tx_send_head == NULL)  in l2cap_tx_state_xmit()
2720 			chan->tx_send_head = skb_peek(skbs);  in l2cap_tx_state_xmit()
2722 		skb_queue_splice_tail_init(skbs, &chan->tx_q);  in l2cap_tx_state_xmit()
2723 		l2cap_ertm_send(chan);  in l2cap_tx_state_xmit()
2727 		set_bit(CONN_LOCAL_BUSY, &chan->conn_state);  in l2cap_tx_state_xmit()
2729 		if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {  in l2cap_tx_state_xmit()
2733 			l2cap_abort_rx_srej_sent(chan);  in l2cap_tx_state_xmit()
2736 		l2cap_send_ack(chan);  in l2cap_tx_state_xmit()
2741 		clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);  in l2cap_tx_state_xmit()
2743 		if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {  in l2cap_tx_state_xmit()
2750 			local_control.reqseq = chan->buffer_seq;  in l2cap_tx_state_xmit()
2751 			l2cap_send_sframe(chan, &local_control);  in l2cap_tx_state_xmit()
2753 			chan->retry_count = 1;  in l2cap_tx_state_xmit()
2754 			__set_monitor_timer(chan);  in l2cap_tx_state_xmit()
2755 			chan->tx_state = L2CAP_TX_STATE_WAIT_F;  in l2cap_tx_state_xmit()
2759 		l2cap_process_reqseq(chan, control->reqseq);  in l2cap_tx_state_xmit()
2762 		l2cap_send_rr_or_rnr(chan, 1);  in l2cap_tx_state_xmit()
2763 		chan->retry_count = 1;  in l2cap_tx_state_xmit()
2764 		__set_monitor_timer(chan);  in l2cap_tx_state_xmit()
2765 		__clear_ack_timer(chan);  in l2cap_tx_state_xmit()
2766 		chan->tx_state = L2CAP_TX_STATE_WAIT_F;  in l2cap_tx_state_xmit()
2769 		l2cap_send_rr_or_rnr(chan, 1);  in l2cap_tx_state_xmit()
2770 		chan->retry_count = 1;  in l2cap_tx_state_xmit()
2771 		__set_monitor_timer(chan);  in l2cap_tx_state_xmit()
2772 		chan->tx_state = L2CAP_TX_STATE_WAIT_F;  in l2cap_tx_state_xmit()
2782 static void l2cap_tx_state_wait_f(struct l2cap_chan *chan,  in l2cap_tx_state_wait_f()  argument
2786 	BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,  in l2cap_tx_state_wait_f()
2791 		if (chan->tx_send_head == NULL)  in l2cap_tx_state_wait_f()
2792 			chan->tx_send_head = skb_peek(skbs);  in l2cap_tx_state_wait_f()
2794 		skb_queue_splice_tail_init(skbs, &chan->tx_q);  in l2cap_tx_state_wait_f()
2798 		set_bit(CONN_LOCAL_BUSY, &chan->conn_state);  in l2cap_tx_state_wait_f()
2800 		if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {  in l2cap_tx_state_wait_f()
2804 			l2cap_abort_rx_srej_sent(chan);  in l2cap_tx_state_wait_f()
2807 		l2cap_send_ack(chan);  in l2cap_tx_state_wait_f()
2812 		clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);  in l2cap_tx_state_wait_f()
2814 		if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {  in l2cap_tx_state_wait_f()
2820 			local_control.reqseq = chan->buffer_seq;  in l2cap_tx_state_wait_f()
2821 			l2cap_send_sframe(chan, &local_control);  in l2cap_tx_state_wait_f()
2823 			chan->retry_count = 1;  in l2cap_tx_state_wait_f()
2824 			__set_monitor_timer(chan);  in l2cap_tx_state_wait_f()
2825 			chan->tx_state = L2CAP_TX_STATE_WAIT_F;  in l2cap_tx_state_wait_f()
2829 		l2cap_process_reqseq(chan, control->reqseq);  in l2cap_tx_state_wait_f()
2835 			__clear_monitor_timer(chan);  in l2cap_tx_state_wait_f()
2836 			if (chan->unacked_frames > 0)  in l2cap_tx_state_wait_f()
2837 				__set_retrans_timer(chan);  in l2cap_tx_state_wait_f()
2838 			chan->retry_count = 0;  in l2cap_tx_state_wait_f()
2839 			chan->tx_state = L2CAP_TX_STATE_XMIT;  in l2cap_tx_state_wait_f()
2840 			BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state);  in l2cap_tx_state_wait_f()
2847 		if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) {  in l2cap_tx_state_wait_f()
2848 			l2cap_send_rr_or_rnr(chan, 1);  in l2cap_tx_state_wait_f()
2849 			__set_monitor_timer(chan);  in l2cap_tx_state_wait_f()
2850 			chan->retry_count++;  in l2cap_tx_state_wait_f()
2852 			l2cap_send_disconn_req(chan, ECONNABORTED);  in l2cap_tx_state_wait_f()
2860 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,  in l2cap_tx()  argument
2864 	       chan, control, skbs, event, chan->tx_state);  in l2cap_tx()
2866 	switch (chan->tx_state) {  in l2cap_tx()
2868 		l2cap_tx_state_xmit(chan, control, skbs, event);  in l2cap_tx()
2871 		l2cap_tx_state_wait_f(chan, control, skbs, event);  in l2cap_tx()
2879 static void l2cap_pass_to_tx(struct l2cap_chan *chan,  in l2cap_pass_to_tx()  argument
2882 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_pass_to_tx()
2883 	l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT);  in l2cap_pass_to_tx()
2886 static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan,  in l2cap_pass_to_tx_fbit()  argument
2889 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_pass_to_tx_fbit()
2890 	l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT);  in l2cap_pass_to_tx_fbit()
2897 	struct l2cap_chan *chan;  in l2cap_raw_recv()  local
2903 	list_for_each_entry(chan, &conn->chan_l, list) {  in l2cap_raw_recv()
2904 		if (chan->chan_type != L2CAP_CHAN_RAW)  in l2cap_raw_recv()
2908 		if (bt_cb(skb)->l2cap.chan == chan)  in l2cap_raw_recv()
2914 		if (chan->ops->recv(chan, nskb))  in l2cap_raw_recv()
3055 static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan, size_t size)  in l2cap_add_opt_efs()  argument
3059 	switch (chan->mode) {  in l2cap_add_opt_efs()
3061 		efs.id		= chan->local_id;  in l2cap_add_opt_efs()
3062 		efs.stype	= chan->local_stype;  in l2cap_add_opt_efs()
3063 		efs.msdu	= cpu_to_le16(chan->local_msdu);  in l2cap_add_opt_efs()
3064 		efs.sdu_itime	= cpu_to_le32(chan->local_sdu_itime);  in l2cap_add_opt_efs()
3072 		efs.msdu	= cpu_to_le16(chan->local_msdu);  in l2cap_add_opt_efs()
3073 		efs.sdu_itime	= cpu_to_le32(chan->local_sdu_itime);  in l2cap_add_opt_efs()
3088 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,  in l2cap_ack_timeout()  local
3092 	BT_DBG("chan %p", chan);  in l2cap_ack_timeout()
3094 	l2cap_chan_lock(chan);  in l2cap_ack_timeout()
3096 	frames_to_ack = __seq_offset(chan, chan->buffer_seq,  in l2cap_ack_timeout()
3097 				     chan->last_acked_seq);  in l2cap_ack_timeout()
3100 		l2cap_send_rr_or_rnr(chan, 0);  in l2cap_ack_timeout()
3102 	l2cap_chan_unlock(chan);  in l2cap_ack_timeout()
3103 	l2cap_chan_put(chan);  in l2cap_ack_timeout()
3106 int l2cap_ertm_init(struct l2cap_chan *chan)  in l2cap_ertm_init()  argument
3110 	chan->next_tx_seq = 0;  in l2cap_ertm_init()
3111 	chan->expected_tx_seq = 0;  in l2cap_ertm_init()
3112 	chan->expected_ack_seq = 0;  in l2cap_ertm_init()
3113 	chan->unacked_frames = 0;  in l2cap_ertm_init()
3114 	chan->buffer_seq = 0;  in l2cap_ertm_init()
3115 	chan->frames_sent = 0;  in l2cap_ertm_init()
3116 	chan->last_acked_seq = 0;  in l2cap_ertm_init()
3117 	chan->sdu = NULL;  in l2cap_ertm_init()
3118 	chan->sdu_last_frag = NULL;  in l2cap_ertm_init()
3119 	chan->sdu_len = 0;  in l2cap_ertm_init()
3121 	skb_queue_head_init(&chan->tx_q);  in l2cap_ertm_init()
3123 	chan->local_amp_id = AMP_ID_BREDR;  in l2cap_ertm_init()
3124 	chan->move_id = AMP_ID_BREDR;  in l2cap_ertm_init()
3125 	chan->move_state = L2CAP_MOVE_STABLE;  in l2cap_ertm_init()
3126 	chan->move_role = L2CAP_MOVE_ROLE_NONE;  in l2cap_ertm_init()
3128 	if (chan->mode != L2CAP_MODE_ERTM)  in l2cap_ertm_init()
3131 	chan->rx_state = L2CAP_RX_STATE_RECV;  in l2cap_ertm_init()
3132 	chan->tx_state = L2CAP_TX_STATE_XMIT;  in l2cap_ertm_init()
3134 	INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);  in l2cap_ertm_init()
3135 	INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);  in l2cap_ertm_init()
3136 	INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);  in l2cap_ertm_init()
3138 	skb_queue_head_init(&chan->srej_q);  in l2cap_ertm_init()
3140 	err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);  in l2cap_ertm_init()
3144 	err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);  in l2cap_ertm_init()
3146 		l2cap_seq_list_free(&chan->srej_list);  in l2cap_ertm_init()
3176 static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan,  in __l2cap_set_ertm_timeouts()  argument
3179 	if (chan->local_amp_id != AMP_ID_BREDR && chan->hs_hcon) {  in __l2cap_set_ertm_timeouts()
3180 		u64 ertm_to = chan->hs_hcon->hdev->amp_be_flush_to;  in __l2cap_set_ertm_timeouts()
3214 static inline void l2cap_txwin_setup(struct l2cap_chan *chan)  in l2cap_txwin_setup()  argument
3216 	if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&  in l2cap_txwin_setup()
3217 	    __l2cap_ews_supported(chan->conn)) {  in l2cap_txwin_setup()
3219 		set_bit(FLAG_EXT_CTRL, &chan->flags);  in l2cap_txwin_setup()
3220 		chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;  in l2cap_txwin_setup()
3222 		chan->tx_win = min_t(u16, chan->tx_win,  in l2cap_txwin_setup()
3224 		chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;  in l2cap_txwin_setup()
3226 	chan->ack_win = chan->tx_win;  in l2cap_txwin_setup()
3229 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)  in l2cap_build_conf_req()  argument
3232 	struct l2cap_conf_rfc rfc = { .mode = chan->mode };  in l2cap_build_conf_req()
3237 	BT_DBG("chan %p", chan);  in l2cap_build_conf_req()
3239 	if (chan->num_conf_req || chan->num_conf_rsp)  in l2cap_build_conf_req()
3242 	switch (chan->mode) {  in l2cap_build_conf_req()
3245 		if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))  in l2cap_build_conf_req()
3248 		if (__l2cap_efs_supported(chan->conn))  in l2cap_build_conf_req()
3249 			set_bit(FLAG_EFS_ENABLE, &chan->flags);  in l2cap_build_conf_req()
3253 		chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);  in l2cap_build_conf_req()
3258 	if (chan->imtu != L2CAP_DEFAULT_MTU)  in l2cap_build_conf_req()
3259 		l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, endptr - ptr);  in l2cap_build_conf_req()
3261 	switch (chan->mode) {  in l2cap_build_conf_req()
3266 		if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&  in l2cap_build_conf_req()
3267 		    !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))  in l2cap_build_conf_req()
3283 		rfc.max_transmit    = chan->max_tx;  in l2cap_build_conf_req()
3285 		__l2cap_set_ertm_timeouts(chan, &rfc);  in l2cap_build_conf_req()
3287 		size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -  in l2cap_build_conf_req()
3292 		l2cap_txwin_setup(chan);  in l2cap_build_conf_req()
3294 		rfc.txwin_size = min_t(u16, chan->tx_win,  in l2cap_build_conf_req()
3300 		if (test_bit(FLAG_EFS_ENABLE, &chan->flags))  in l2cap_build_conf_req()
3301 			l2cap_add_opt_efs(&ptr, chan, endptr - ptr);  in l2cap_build_conf_req()
3303 		if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_build_conf_req()
3305 					   chan->tx_win, endptr - ptr);  in l2cap_build_conf_req()
3307 		if (chan->conn->feat_mask & L2CAP_FEAT_FCS)  in l2cap_build_conf_req()
3308 			if (chan->fcs == L2CAP_FCS_NONE ||  in l2cap_build_conf_req()
3309 			    test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {  in l2cap_build_conf_req()
3310 				chan->fcs = L2CAP_FCS_NONE;  in l2cap_build_conf_req()
3312 						   chan->fcs, endptr - ptr);  in l2cap_build_conf_req()
3317 		l2cap_txwin_setup(chan);  in l2cap_build_conf_req()
3324 		size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -  in l2cap_build_conf_req()
3332 		if (test_bit(FLAG_EFS_ENABLE, &chan->flags))  in l2cap_build_conf_req()
3333 			l2cap_add_opt_efs(&ptr, chan, endptr - ptr);  in l2cap_build_conf_req()
3335 		if (chan->conn->feat_mask & L2CAP_FEAT_FCS)  in l2cap_build_conf_req()
3336 			if (chan->fcs == L2CAP_FCS_NONE ||  in l2cap_build_conf_req()
3337 			    test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {  in l2cap_build_conf_req()
3338 				chan->fcs = L2CAP_FCS_NONE;  in l2cap_build_conf_req()
3340 						   chan->fcs, endptr - ptr);  in l2cap_build_conf_req()
3345 	req->dcid  = cpu_to_le16(chan->dcid);  in l2cap_build_conf_req()
3351 static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)  in l2cap_parse_conf_req()  argument
3356 	void *req = chan->conf_req;  in l2cap_parse_conf_req()
3357 	int len = chan->conf_len;  in l2cap_parse_conf_req()
3367 	BT_DBG("chan %p", chan);  in l2cap_parse_conf_req()
3387 			chan->flush_to = val;  in l2cap_parse_conf_req()
3403 				set_bit(CONF_RECV_NO_FCS, &chan->conf_state);  in l2cap_parse_conf_req()
3416 			if (!(chan->conn->local_fixed_chan & L2CAP_FC_A2MP))  in l2cap_parse_conf_req()
3418 			set_bit(FLAG_EXT_CTRL, &chan->flags);  in l2cap_parse_conf_req()
3419 			set_bit(CONF_EWS_RECV, &chan->conf_state);  in l2cap_parse_conf_req()
3420 			chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;  in l2cap_parse_conf_req()
3421 			chan->remote_tx_win = val;  in l2cap_parse_conf_req()
3433 	if (chan->num_conf_rsp || chan->num_conf_req > 1)  in l2cap_parse_conf_req()
3436 	switch (chan->mode) {  in l2cap_parse_conf_req()
3439 		if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {  in l2cap_parse_conf_req()
3440 			chan->mode = l2cap_select_mode(rfc.mode,  in l2cap_parse_conf_req()
3441 						       chan->conn->feat_mask);  in l2cap_parse_conf_req()
3446 			if (__l2cap_efs_supported(chan->conn))  in l2cap_parse_conf_req()
3447 				set_bit(FLAG_EFS_ENABLE, &chan->flags);  in l2cap_parse_conf_req()
3452 		if (chan->mode != rfc.mode)  in l2cap_parse_conf_req()
3459 	if (chan->mode != rfc.mode) {  in l2cap_parse_conf_req()
3461 		rfc.mode = chan->mode;  in l2cap_parse_conf_req()
3463 		if (chan->num_conf_rsp == 1)  in l2cap_parse_conf_req()
3477 			chan->omtu = mtu;  in l2cap_parse_conf_req()
3478 			set_bit(CONF_MTU_DONE, &chan->conf_state);  in l2cap_parse_conf_req()
3480 		l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu, endptr - ptr);  in l2cap_parse_conf_req()
3483 			if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&  in l2cap_parse_conf_req()
3485 			    efs.stype != chan->local_stype) {  in l2cap_parse_conf_req()
3489 				if (chan->num_conf_req >= 1)  in l2cap_parse_conf_req()
3498 				set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);  in l2cap_parse_conf_req()
3504 			chan->fcs = L2CAP_FCS_NONE;  in l2cap_parse_conf_req()
3505 			set_bit(CONF_MODE_DONE, &chan->conf_state);  in l2cap_parse_conf_req()
3509 			if (!test_bit(CONF_EWS_RECV, &chan->conf_state))  in l2cap_parse_conf_req()
3510 				chan->remote_tx_win = rfc.txwin_size;  in l2cap_parse_conf_req()
3514 			chan->remote_max_tx = rfc.max_transmit;  in l2cap_parse_conf_req()
3517 				     chan->conn->mtu - L2CAP_EXT_HDR_SIZE -  in l2cap_parse_conf_req()
3520 			chan->remote_mps = size;  in l2cap_parse_conf_req()
3522 			__l2cap_set_ertm_timeouts(chan, &rfc);  in l2cap_parse_conf_req()
3524 			set_bit(CONF_MODE_DONE, &chan->conf_state);  in l2cap_parse_conf_req()
3529 			if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {  in l2cap_parse_conf_req()
3530 				chan->remote_id = efs.id;  in l2cap_parse_conf_req()
3531 				chan->remote_stype = efs.stype;  in l2cap_parse_conf_req()
3532 				chan->remote_msdu = le16_to_cpu(efs.msdu);  in l2cap_parse_conf_req()
3533 				chan->remote_flush_to =  in l2cap_parse_conf_req()
3535 				chan->remote_acc_lat =  in l2cap_parse_conf_req()
3537 				chan->remote_sdu_itime =  in l2cap_parse_conf_req()
3547 				     chan->conn->mtu - L2CAP_EXT_HDR_SIZE -  in l2cap_parse_conf_req()
3550 			chan->remote_mps = size;  in l2cap_parse_conf_req()
3552 			set_bit(CONF_MODE_DONE, &chan->conf_state);  in l2cap_parse_conf_req()
3563 			rfc.mode = chan->mode;  in l2cap_parse_conf_req()
3567 			set_bit(CONF_OUTPUT_DONE, &chan->conf_state);  in l2cap_parse_conf_req()
3569 	rsp->scid   = cpu_to_le16(chan->dcid);  in l2cap_parse_conf_req()
3576 static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,  in l2cap_parse_conf_rsp()  argument
3587 	BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);  in l2cap_parse_conf_rsp()
3600 				chan->imtu = L2CAP_DEFAULT_MIN_MTU;  in l2cap_parse_conf_rsp()
3602 				chan->imtu = val;  in l2cap_parse_conf_rsp()
3603 			l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu,  in l2cap_parse_conf_rsp()
3610 			chan->flush_to = val;  in l2cap_parse_conf_rsp()
3612 					   chan->flush_to, endptr - ptr);  in l2cap_parse_conf_rsp()
3619 			if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&  in l2cap_parse_conf_rsp()
3620 			    rfc.mode != chan->mode)  in l2cap_parse_conf_rsp()
3622 			chan->fcs = 0;  in l2cap_parse_conf_rsp()
3630 			chan->ack_win = min_t(u16, val, chan->ack_win);  in l2cap_parse_conf_rsp()
3632 					   chan->tx_win, endptr - ptr);  in l2cap_parse_conf_rsp()
3639 			if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&  in l2cap_parse_conf_rsp()
3641 			    efs.stype != chan->local_stype)  in l2cap_parse_conf_rsp()
3653 						&chan->conf_state);  in l2cap_parse_conf_rsp()
3658 	if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)  in l2cap_parse_conf_rsp()
3661 	chan->mode = rfc.mode;  in l2cap_parse_conf_rsp()
3666 			chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);  in l2cap_parse_conf_rsp()
3667 			chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);  in l2cap_parse_conf_rsp()
3668 			chan->mps    = le16_to_cpu(rfc.max_pdu_size);  in l2cap_parse_conf_rsp()
3669 			if (!test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_parse_conf_rsp()
3670 				chan->ack_win = min_t(u16, chan->ack_win,  in l2cap_parse_conf_rsp()
3673 			if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {  in l2cap_parse_conf_rsp()
3674 				chan->local_msdu = le16_to_cpu(efs.msdu);  in l2cap_parse_conf_rsp()
3675 				chan->local_sdu_itime =  in l2cap_parse_conf_rsp()
3677 				chan->local_acc_lat = le32_to_cpu(efs.acc_lat);  in l2cap_parse_conf_rsp()
3678 				chan->local_flush_to =  in l2cap_parse_conf_rsp()
3684 			chan->mps    = le16_to_cpu(rfc.max_pdu_size);  in l2cap_parse_conf_rsp()
3688 	req->dcid   = cpu_to_le16(chan->dcid);  in l2cap_parse_conf_rsp()
3694 static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data,  in l2cap_build_conf_rsp()  argument
3700 	BT_DBG("chan %p", chan);  in l2cap_build_conf_rsp()
3702 	rsp->scid   = cpu_to_le16(chan->dcid);  in l2cap_build_conf_rsp()
3709 void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan)  in __l2cap_le_connect_rsp_defer()  argument
3712 	struct l2cap_conn *conn = chan->conn;  in __l2cap_le_connect_rsp_defer()
3714 	BT_DBG("chan %p", chan);  in __l2cap_le_connect_rsp_defer()
3716 	rsp.dcid    = cpu_to_le16(chan->scid);  in __l2cap_le_connect_rsp_defer()
3717 	rsp.mtu     = cpu_to_le16(chan->imtu);  in __l2cap_le_connect_rsp_defer()
3718 	rsp.mps     = cpu_to_le16(chan->mps);  in __l2cap_le_connect_rsp_defer()
3719 	rsp.credits = cpu_to_le16(chan->rx_credits);  in __l2cap_le_connect_rsp_defer()
3722 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),  in __l2cap_le_connect_rsp_defer()
3726 void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)  in __l2cap_connect_rsp_defer()  argument
3729 	struct l2cap_conn *conn = chan->conn;  in __l2cap_connect_rsp_defer()
3733 	rsp.scid   = cpu_to_le16(chan->dcid);  in __l2cap_connect_rsp_defer()
3734 	rsp.dcid   = cpu_to_le16(chan->scid);  in __l2cap_connect_rsp_defer()
3738 	if (chan->hs_hcon)  in __l2cap_connect_rsp_defer()
3743 	BT_DBG("chan %p rsp_code %u", chan, rsp_code);  in __l2cap_connect_rsp_defer()
3745 	l2cap_send_cmd(conn, chan->ident, rsp_code, sizeof(rsp), &rsp);  in __l2cap_connect_rsp_defer()
3747 	if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))  in __l2cap_connect_rsp_defer()
3751 		       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);  in __l2cap_connect_rsp_defer()
3752 	chan->num_conf_req++;  in __l2cap_connect_rsp_defer()
3755 static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)  in l2cap_conf_rfc_get()  argument
3762 	u16 txwin_ext = chan->ack_win;  in l2cap_conf_rfc_get()
3764 		.mode = chan->mode,  in l2cap_conf_rfc_get()
3767 		.max_pdu_size = cpu_to_le16(chan->imtu),  in l2cap_conf_rfc_get()
3768 		.txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW),  in l2cap_conf_rfc_get()
3771 	BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);  in l2cap_conf_rfc_get()
3773 	if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))  in l2cap_conf_rfc_get()
3797 		chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);  in l2cap_conf_rfc_get()
3798 		chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);  in l2cap_conf_rfc_get()
3799 		chan->mps = le16_to_cpu(rfc.max_pdu_size);  in l2cap_conf_rfc_get()
3800 		if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_conf_rfc_get()
3801 			chan->ack_win = min_t(u16, chan->ack_win, txwin_ext);  in l2cap_conf_rfc_get()
3803 			chan->ack_win = min_t(u16, chan->ack_win,  in l2cap_conf_rfc_get()
3807 		chan->mps    = le16_to_cpu(rfc.max_pdu_size);  in l2cap_conf_rfc_get()
3842 	struct l2cap_chan *chan = NULL, *pchan;  in l2cap_connect()  local
3883 	chan = pchan->ops->new_connection(pchan);  in l2cap_connect()
3884 	if (!chan)  in l2cap_connect()
3894 	bacpy(&chan->src, &conn->hcon->src);  in l2cap_connect()
3895 	bacpy(&chan->dst, &conn->hcon->dst);  in l2cap_connect()
3896 	chan->src_type = bdaddr_src_type(conn->hcon);  in l2cap_connect()
3897 	chan->dst_type = bdaddr_dst_type(conn->hcon);  in l2cap_connect()
3898 	chan->psm  = psm;  in l2cap_connect()
3899 	chan->dcid = scid;  in l2cap_connect()
3900 	chan->local_amp_id = amp_id;  in l2cap_connect()
3902 	__l2cap_chan_add(conn, chan);  in l2cap_connect()
3904 	dcid = chan->scid;  in l2cap_connect()
3906 	__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));  in l2cap_connect()
3908 	chan->ident = cmd->ident;  in l2cap_connect()
3911 		if (l2cap_chan_check_security(chan, false)) {  in l2cap_connect()
3912 			if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {  in l2cap_connect()
3913 				l2cap_state_change(chan, BT_CONNECT2);  in l2cap_connect()
3916 				chan->ops->defer(chan);  in l2cap_connect()
3923 					l2cap_state_change(chan, BT_CONFIG);  in l2cap_connect()
3926 					l2cap_state_change(chan, BT_CONNECT2);  in l2cap_connect()
3932 			l2cap_state_change(chan, BT_CONNECT2);  in l2cap_connect()
3937 		l2cap_state_change(chan, BT_CONNECT2);  in l2cap_connect()
3967 	if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&  in l2cap_connect()
3970 		set_bit(CONF_REQ_SENT, &chan->conf_state);  in l2cap_connect()
3972 			       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);  in l2cap_connect()
3973 		chan->num_conf_req++;  in l2cap_connect()
3976 	return chan;  in l2cap_connect()
4004 	struct l2cap_chan *chan;  in l2cap_connect_create_rsp()  local
4022 		chan = __l2cap_get_chan_by_scid(conn, scid);  in l2cap_connect_create_rsp()
4023 		if (!chan) {  in l2cap_connect_create_rsp()
4028 		chan = __l2cap_get_chan_by_ident(conn, cmd->ident);  in l2cap_connect_create_rsp()
4029 		if (!chan) {  in l2cap_connect_create_rsp()
4037 	l2cap_chan_lock(chan);  in l2cap_connect_create_rsp()
4041 		l2cap_state_change(chan, BT_CONFIG);  in l2cap_connect_create_rsp()
4042 		chan->ident = 0;  in l2cap_connect_create_rsp()
4043 		chan->dcid = dcid;  in l2cap_connect_create_rsp()
4044 		clear_bit(CONF_CONNECT_PEND, &chan->conf_state);  in l2cap_connect_create_rsp()
4046 		if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))  in l2cap_connect_create_rsp()
4050 			       l2cap_build_conf_req(chan, req, sizeof(req)), req);  in l2cap_connect_create_rsp()
4051 		chan->num_conf_req++;  in l2cap_connect_create_rsp()
4055 		set_bit(CONF_CONNECT_PEND, &chan->conf_state);  in l2cap_connect_create_rsp()
4059 		l2cap_chan_del(chan, ECONNREFUSED);  in l2cap_connect_create_rsp()
4063 	l2cap_chan_unlock(chan);  in l2cap_connect_create_rsp()
4071 static inline void set_default_fcs(struct l2cap_chan *chan)  in set_default_fcs()  argument
4076 	if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)  in set_default_fcs()
4077 		chan->fcs = L2CAP_FCS_NONE;  in set_default_fcs()
4078 	else if (!test_bit(CONF_RECV_NO_FCS, &chan->conf_state))  in set_default_fcs()
4079 		chan->fcs = L2CAP_FCS_CRC16;  in set_default_fcs()
4082 static void l2cap_send_efs_conf_rsp(struct l2cap_chan *chan, void *data,  in l2cap_send_efs_conf_rsp()  argument
4085 	struct l2cap_conn *conn = chan->conn;  in l2cap_send_efs_conf_rsp()
4087 	BT_DBG("conn %p chan %p ident %d flags 0x%4.4x", conn, chan, ident,  in l2cap_send_efs_conf_rsp()
4090 	clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);  in l2cap_send_efs_conf_rsp()
4091 	set_bit(CONF_OUTPUT_DONE, &chan->conf_state);  in l2cap_send_efs_conf_rsp()
4094 		       l2cap_build_conf_rsp(chan, data,  in l2cap_send_efs_conf_rsp()
4117 	struct l2cap_chan *chan;  in l2cap_config_req()  local
4128 	chan = l2cap_get_chan_by_scid(conn, dcid);  in l2cap_config_req()
4129 	if (!chan) {  in l2cap_config_req()
4134 	if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) {  in l2cap_config_req()
4135 		cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,  in l2cap_config_req()
4136 				       chan->dcid);  in l2cap_config_req()
4142 	if (chan->conf_len + len > sizeof(chan->conf_req)) {  in l2cap_config_req()
4144 			       l2cap_build_conf_rsp(chan, rsp,  in l2cap_config_req()
4150 	memcpy(chan->conf_req + chan->conf_len, req->data, len);  in l2cap_config_req()
4151 	chan->conf_len += len;  in l2cap_config_req()
4156 			       l2cap_build_conf_rsp(chan, rsp,  in l2cap_config_req()
4162 	len = l2cap_parse_conf_req(chan, rsp, sizeof(rsp));  in l2cap_config_req()
4164 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_config_req()
4168 	chan->ident = cmd->ident;  in l2cap_config_req()
4170 	chan->num_conf_rsp++;  in l2cap_config_req()
4173 	chan->conf_len = 0;  in l2cap_config_req()
4175 	if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))  in l2cap_config_req()
4178 	if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {  in l2cap_config_req()
4179 		set_default_fcs(chan);  in l2cap_config_req()
4181 		if (chan->mode == L2CAP_MODE_ERTM ||  in l2cap_config_req()
4182 		    chan->mode == L2CAP_MODE_STREAMING)  in l2cap_config_req()
4183 			err = l2cap_ertm_init(chan);  in l2cap_config_req()
4186 			l2cap_send_disconn_req(chan, -err);  in l2cap_config_req()
4188 			l2cap_chan_ready(chan);  in l2cap_config_req()
4193 	if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {  in l2cap_config_req()
4196 			       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);  in l2cap_config_req()
4197 		chan->num_conf_req++;  in l2cap_config_req()
4202 	if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&  in l2cap_config_req()
4203 	    test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {  in l2cap_config_req()
4208 		if (!chan->hs_hcon)  in l2cap_config_req()
4209 			l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags);  in l2cap_config_req()
4211 			chan->ident = cmd->ident;  in l2cap_config_req()
4215 	l2cap_chan_unlock(chan);  in l2cap_config_req()
4225 	struct l2cap_chan *chan;  in l2cap_config_rsp()  local
4239 	chan = l2cap_get_chan_by_scid(conn, scid);  in l2cap_config_rsp()
4240 	if (!chan)  in l2cap_config_rsp()
4245 		l2cap_conf_rfc_get(chan, rsp->data, len);  in l2cap_config_rsp()
4246 		clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);  in l2cap_config_rsp()
4250 		set_bit(CONF_REM_CONF_PEND, &chan->conf_state);  in l2cap_config_rsp()
4252 		if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {  in l2cap_config_rsp()
4255 			len = l2cap_parse_conf_rsp(chan, rsp->data, len,  in l2cap_config_rsp()
4258 				l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_config_rsp()
4262 			if (!chan->hs_hcon) {  in l2cap_config_rsp()
4263 				l2cap_send_efs_conf_rsp(chan, buf, cmd->ident,  in l2cap_config_rsp()
4266 				if (l2cap_check_efs(chan)) {  in l2cap_config_rsp()
4267 					amp_create_logical_link(chan);  in l2cap_config_rsp()
4268 					chan->ident = cmd->ident;  in l2cap_config_rsp()
4275 		if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {  in l2cap_config_rsp()
4279 				l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_config_rsp()
4285 			len = l2cap_parse_conf_rsp(chan, rsp->data, len,  in l2cap_config_rsp()
4288 				l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_config_rsp()
4294 			chan->num_conf_req++;  in l2cap_config_rsp()
4302 		l2cap_chan_set_err(chan, ECONNRESET);  in l2cap_config_rsp()
4304 		__set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);  in l2cap_config_rsp()
4305 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_config_rsp()
4312 	set_bit(CONF_INPUT_DONE, &chan->conf_state);  in l2cap_config_rsp()
4314 	if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {  in l2cap_config_rsp()
4315 		set_default_fcs(chan);  in l2cap_config_rsp()
4317 		if (chan->mode == L2CAP_MODE_ERTM ||  in l2cap_config_rsp()
4318 		    chan->mode == L2CAP_MODE_STREAMING)  in l2cap_config_rsp()
4319 			err = l2cap_ertm_init(chan);  in l2cap_config_rsp()
4322 			l2cap_send_disconn_req(chan, -err);  in l2cap_config_rsp()
4324 			l2cap_chan_ready(chan);  in l2cap_config_rsp()
4328 	l2cap_chan_unlock(chan);  in l2cap_config_rsp()
4339 	struct l2cap_chan *chan;  in l2cap_disconnect_req()  local
4351 	chan = __l2cap_get_chan_by_scid(conn, dcid);  in l2cap_disconnect_req()
4352 	if (!chan) {  in l2cap_disconnect_req()
4358 	l2cap_chan_lock(chan);  in l2cap_disconnect_req()
4360 	rsp.dcid = cpu_to_le16(chan->scid);  in l2cap_disconnect_req()
4361 	rsp.scid = cpu_to_le16(chan->dcid);  in l2cap_disconnect_req()
4364 	chan->ops->set_shutdown(chan);  in l2cap_disconnect_req()
4366 	l2cap_chan_hold(chan);  in l2cap_disconnect_req()
4367 	l2cap_chan_del(chan, ECONNRESET);  in l2cap_disconnect_req()
4369 	l2cap_chan_unlock(chan);  in l2cap_disconnect_req()
4371 	chan->ops->close(chan);  in l2cap_disconnect_req()
4372 	l2cap_chan_put(chan);  in l2cap_disconnect_req()
4385 	struct l2cap_chan *chan;  in l2cap_disconnect_rsp()  local
4397 	chan = __l2cap_get_chan_by_scid(conn, scid);  in l2cap_disconnect_rsp()
4398 	if (!chan) {  in l2cap_disconnect_rsp()
4403 	l2cap_chan_lock(chan);  in l2cap_disconnect_rsp()
4405 	if (chan->state != BT_DISCONN) {  in l2cap_disconnect_rsp()
4406 		l2cap_chan_unlock(chan);  in l2cap_disconnect_rsp()
4411 	l2cap_chan_hold(chan);  in l2cap_disconnect_rsp()
4412 	l2cap_chan_del(chan, 0);  in l2cap_disconnect_rsp()
4414 	l2cap_chan_unlock(chan);  in l2cap_disconnect_rsp()
4416 	chan->ops->close(chan);  in l2cap_disconnect_rsp()
4417 	l2cap_chan_put(chan);  in l2cap_disconnect_rsp()
4544 	struct l2cap_chan *chan;  in l2cap_create_channel_req()  local
4576 	chan = l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,  in l2cap_create_channel_req()
4578 	if (chan) {  in l2cap_create_channel_req()
4586 			cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,  in l2cap_create_channel_req()
4587 					       chan->dcid);  in l2cap_create_channel_req()
4591 		BT_DBG("mgr %p bredr_chan %p hs_hcon %p", mgr, chan, hs_hcon);  in l2cap_create_channel_req()
4593 		mgr->bredr_chan = chan;  in l2cap_create_channel_req()
4594 		chan->hs_hcon = hs_hcon;  in l2cap_create_channel_req()
4595 		chan->fcs = L2CAP_FCS_NONE;  in l2cap_create_channel_req()
4615 static void l2cap_send_move_chan_req(struct l2cap_chan *chan, u8 dest_amp_id)  in l2cap_send_move_chan_req()  argument
4620 	BT_DBG("chan %p, dest_amp_id %d", chan, dest_amp_id);  in l2cap_send_move_chan_req()
4622 	ident = l2cap_get_ident(chan->conn);  in l2cap_send_move_chan_req()
4623 	chan->ident = ident;  in l2cap_send_move_chan_req()
4625 	req.icid = cpu_to_le16(chan->scid);  in l2cap_send_move_chan_req()
4628 	l2cap_send_cmd(chan->conn, ident, L2CAP_MOVE_CHAN_REQ, sizeof(req),  in l2cap_send_move_chan_req()
4631 	__set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);  in l2cap_send_move_chan_req()
4634 static void l2cap_send_move_chan_rsp(struct l2cap_chan *chan, u16 result)  in l2cap_send_move_chan_rsp()  argument
4638 	BT_DBG("chan %p, result 0x%4.4x", chan, result);  in l2cap_send_move_chan_rsp()
4640 	rsp.icid = cpu_to_le16(chan->dcid);  in l2cap_send_move_chan_rsp()
4643 	l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_RSP,  in l2cap_send_move_chan_rsp()
4647 static void l2cap_send_move_chan_cfm(struct l2cap_chan *chan, u16 result)  in l2cap_send_move_chan_cfm()  argument
4651 	BT_DBG("chan %p, result 0x%4.4x", chan, result);  in l2cap_send_move_chan_cfm()
4653 	chan->ident = l2cap_get_ident(chan->conn);  in l2cap_send_move_chan_cfm()
4655 	cfm.icid = cpu_to_le16(chan->scid);  in l2cap_send_move_chan_cfm()
4658 	l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_CFM,  in l2cap_send_move_chan_cfm()
4661 	__set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);  in l2cap_send_move_chan_cfm()
4688 static void __release_logical_link(struct l2cap_chan *chan)  in __release_logical_link()  argument
4690 	chan->hs_hchan = NULL;  in __release_logical_link()
4691 	chan->hs_hcon = NULL;  in __release_logical_link()
4696 static void l2cap_logical_fail(struct l2cap_chan *chan)  in l2cap_logical_fail()  argument
4699 	if (chan->state != BT_CONNECTED) {  in l2cap_logical_fail()
4701 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_logical_fail()
4705 	switch (chan->move_role) {  in l2cap_logical_fail()
4707 		l2cap_move_done(chan);  in l2cap_logical_fail()
4708 		l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_SUPP);  in l2cap_logical_fail()
4711 		if (chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_COMP ||  in l2cap_logical_fail()
4712 		    chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_CFM) {  in l2cap_logical_fail()
4716 			l2cap_move_done(chan);  in l2cap_logical_fail()
4722 		l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);  in l2cap_logical_fail()
4727 static void l2cap_logical_finish_create(struct l2cap_chan *chan,  in l2cap_logical_finish_create()  argument
4732 	chan->hs_hchan = hchan;  in l2cap_logical_finish_create()
4733 	chan->hs_hcon->l2cap_data = chan->conn;  in l2cap_logical_finish_create()
4735 	l2cap_send_efs_conf_rsp(chan, &rsp, chan->ident, 0);  in l2cap_logical_finish_create()
4737 	if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {  in l2cap_logical_finish_create()
4740 		set_default_fcs(chan);  in l2cap_logical_finish_create()
4742 		err = l2cap_ertm_init(chan);  in l2cap_logical_finish_create()
4744 			l2cap_send_disconn_req(chan, -err);  in l2cap_logical_finish_create()
4746 			l2cap_chan_ready(chan);  in l2cap_logical_finish_create()
4750 static void l2cap_logical_finish_move(struct l2cap_chan *chan,  in l2cap_logical_finish_move()  argument
4753 	chan->hs_hcon = hchan->conn;  in l2cap_logical_finish_move()
4754 	chan->hs_hcon->l2cap_data = chan->conn;  in l2cap_logical_finish_move()
4756 	BT_DBG("move_state %d", chan->move_state);  in l2cap_logical_finish_move()
4758 	switch (chan->move_state) {  in l2cap_logical_finish_move()
4763 		chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;  in l2cap_logical_finish_move()
4766 		if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_logical_finish_move()
4767 			chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;  in l2cap_logical_finish_move()
4768 		} else if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {  in l2cap_logical_finish_move()
4769 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;  in l2cap_logical_finish_move()
4770 			l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);  in l2cap_logical_finish_move()
4771 		} else if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {  in l2cap_logical_finish_move()
4772 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;  in l2cap_logical_finish_move()
4773 			l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);  in l2cap_logical_finish_move()
4778 		__release_logical_link(chan);  in l2cap_logical_finish_move()
4780 		chan->move_state = L2CAP_MOVE_STABLE;  in l2cap_logical_finish_move()
4785 void l2cap_logical_cfm(struct l2cap_chan *chan, struct hci_chan *hchan,  in l2cap_logical_cfm()  argument
4788 	BT_DBG("chan %p, hchan %p, status %d", chan, hchan, status);  in l2cap_logical_cfm()
4791 		l2cap_logical_fail(chan);  in l2cap_logical_cfm()
4792 		__release_logical_link(chan);  in l2cap_logical_cfm()
4796 	if (chan->state != BT_CONNECTED) {  in l2cap_logical_cfm()
4798 		if (chan->local_amp_id != AMP_ID_BREDR)  in l2cap_logical_cfm()
4799 			l2cap_logical_finish_create(chan, hchan);  in l2cap_logical_cfm()
4801 		l2cap_logical_finish_move(chan, hchan);  in l2cap_logical_cfm()
4805 void l2cap_move_start(struct l2cap_chan *chan)  in l2cap_move_start()  argument
4807 	BT_DBG("chan %p", chan);  in l2cap_move_start()
4809 	if (chan->local_amp_id == AMP_ID_BREDR) {  in l2cap_move_start()
4810 		if (chan->chan_policy != BT_CHANNEL_POLICY_AMP_PREFERRED)  in l2cap_move_start()
4812 		chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;  in l2cap_move_start()
4813 		chan->move_state = L2CAP_MOVE_WAIT_PREPARE;  in l2cap_move_start()
4816 		chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;  in l2cap_move_start()
4817 		chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;  in l2cap_move_start()
4818 		chan->move_id = 0;  in l2cap_move_start()
4819 		l2cap_move_setup(chan);  in l2cap_move_start()
4820 		l2cap_send_move_chan_req(chan, 0);  in l2cap_move_start()
4824 static void l2cap_do_create(struct l2cap_chan *chan, int result,  in l2cap_do_create()  argument
4827 	BT_DBG("chan %p state %s %u -> %u", chan, state_to_string(chan->state),  in l2cap_do_create()
4830 	chan->fcs = L2CAP_FCS_NONE;  in l2cap_do_create()
4833 	if (chan->state == BT_CONNECT) {  in l2cap_do_create()
4835 			chan->local_amp_id = local_amp_id;  in l2cap_do_create()
4836 			l2cap_send_create_chan_req(chan, remote_amp_id);  in l2cap_do_create()
4839 			l2cap_send_conn_req(chan);  in l2cap_do_create()
4846 	if (__l2cap_no_conn_pending(chan)) {  in l2cap_do_create()
4849 		rsp.scid = cpu_to_le16(chan->dcid);  in l2cap_do_create()
4850 		rsp.dcid = cpu_to_le16(chan->scid);  in l2cap_do_create()
4862 		l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_RSP,  in l2cap_do_create()
4866 			l2cap_state_change(chan, BT_CONFIG);  in l2cap_do_create()
4867 			set_bit(CONF_REQ_SENT, &chan->conf_state);  in l2cap_do_create()
4868 			l2cap_send_cmd(chan->conn, l2cap_get_ident(chan->conn),  in l2cap_do_create()
4870 				       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);  in l2cap_do_create()
4871 			chan->num_conf_req++;  in l2cap_do_create()
4876 static void l2cap_do_move_initiate(struct l2cap_chan *chan, u8 local_amp_id,  in l2cap_do_move_initiate()  argument
4879 	l2cap_move_setup(chan);  in l2cap_do_move_initiate()
4880 	chan->move_id = local_amp_id;  in l2cap_do_move_initiate()
4881 	chan->move_state = L2CAP_MOVE_WAIT_RSP;  in l2cap_do_move_initiate()
4883 	l2cap_send_move_chan_req(chan, remote_amp_id);  in l2cap_do_move_initiate()
4886 static void l2cap_do_move_respond(struct l2cap_chan *chan, int result)  in l2cap_do_move_respond()  argument
4895 			chan->hs_hcon = hchan->conn;  in l2cap_do_move_respond()
4896 			chan->hs_hcon->l2cap_data = chan->conn;  in l2cap_do_move_respond()
4897 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;  in l2cap_do_move_respond()
4898 			l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);  in l2cap_do_move_respond()
4900 			l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);  in l2cap_do_move_respond()
4903 			chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;  in l2cap_do_move_respond()
4907 		l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_ALLOWED);  in l2cap_do_move_respond()
4911 static void l2cap_do_move_cancel(struct l2cap_chan *chan, int result)  in l2cap_do_move_cancel()  argument
4913 	if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {  in l2cap_do_move_cancel()
4920 		l2cap_send_move_chan_rsp(chan, rsp_result);  in l2cap_do_move_cancel()
4923 	chan->move_role = L2CAP_MOVE_ROLE_NONE;  in l2cap_do_move_cancel()
4924 	chan->move_state = L2CAP_MOVE_STABLE;  in l2cap_do_move_cancel()
4927 	l2cap_ertm_send(chan);  in l2cap_do_move_cancel()
4931 void __l2cap_physical_cfm(struct l2cap_chan *chan, int result)  in __l2cap_physical_cfm()  argument
4933 	u8 local_amp_id = chan->local_amp_id;  in __l2cap_physical_cfm()
4934 	u8 remote_amp_id = chan->remote_amp_id;  in __l2cap_physical_cfm()
4937 	       chan, result, local_amp_id, remote_amp_id);  in __l2cap_physical_cfm()
4939 	if (chan->state == BT_DISCONN || chan->state == BT_CLOSED) {  in __l2cap_physical_cfm()
4940 		l2cap_chan_unlock(chan);  in __l2cap_physical_cfm()
4944 	if (chan->state != BT_CONNECTED) {  in __l2cap_physical_cfm()
4945 		l2cap_do_create(chan, result, local_amp_id, remote_amp_id);  in __l2cap_physical_cfm()
4947 		l2cap_do_move_cancel(chan, result);  in __l2cap_physical_cfm()
4949 		switch (chan->move_role) {  in __l2cap_physical_cfm()
4951 			l2cap_do_move_initiate(chan, local_amp_id,  in __l2cap_physical_cfm()
4955 			l2cap_do_move_respond(chan, result);  in __l2cap_physical_cfm()
4958 			l2cap_do_move_cancel(chan, result);  in __l2cap_physical_cfm()
4970 	struct l2cap_chan *chan;  in l2cap_move_channel_req()  local
4984 	chan = l2cap_get_chan_by_dcid(conn, icid);  in l2cap_move_channel_req()
4985 	if (!chan) {  in l2cap_move_channel_req()
4993 	chan->ident = cmd->ident;  in l2cap_move_channel_req()
4995 	if (chan->scid < L2CAP_CID_DYN_START ||  in l2cap_move_channel_req()
4996 	    chan->chan_policy == BT_CHANNEL_POLICY_BREDR_ONLY ||  in l2cap_move_channel_req()
4997 	    (chan->mode != L2CAP_MODE_ERTM &&  in l2cap_move_channel_req()
4998 	     chan->mode != L2CAP_MODE_STREAMING)) {  in l2cap_move_channel_req()
5003 	if (chan->local_amp_id == req->dest_amp_id) {  in l2cap_move_channel_req()
5026 	if ((__chan_is_moving(chan) ||  in l2cap_move_channel_req()
5027 	     chan->move_role != L2CAP_MOVE_ROLE_NONE) &&  in l2cap_move_channel_req()
5033 	chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;  in l2cap_move_channel_req()
5034 	l2cap_move_setup(chan);  in l2cap_move_channel_req()
5035 	chan->move_id = req->dest_amp_id;  in l2cap_move_channel_req()
5036 	icid = chan->dcid;  in l2cap_move_channel_req()
5040 		if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_move_channel_req()
5041 			chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;  in l2cap_move_channel_req()
5044 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;  in l2cap_move_channel_req()
5048 		chan->move_state = L2CAP_MOVE_WAIT_PREPARE;  in l2cap_move_channel_req()
5055 	l2cap_send_move_chan_rsp(chan, result);  in l2cap_move_channel_req()
5057 	l2cap_chan_unlock(chan);  in l2cap_move_channel_req()
5064 	struct l2cap_chan *chan;  in l2cap_move_continue()  local
5067 	chan = l2cap_get_chan_by_scid(conn, icid);  in l2cap_move_continue()
5068 	if (!chan) {  in l2cap_move_continue()
5073 	__clear_chan_timer(chan);  in l2cap_move_continue()
5075 		__set_chan_timer(chan, L2CAP_MOVE_ERTX_TIMEOUT);  in l2cap_move_continue()
5077 	switch (chan->move_state) {  in l2cap_move_continue()
5082 		chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;  in l2cap_move_continue()
5088 				    &chan->conn_state)) {  in l2cap_move_continue()
5089 			chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;  in l2cap_move_continue()
5094 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;  in l2cap_move_continue()
5095 			l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);  in l2cap_move_continue()
5104 			chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;  in l2cap_move_continue()
5109 			chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_COMP;  in l2cap_move_continue()
5115 			l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);  in l2cap_move_continue()
5127 		chan->hs_hcon = hchan->conn;  in l2cap_move_continue()
5128 		chan->hs_hcon->l2cap_data = chan->conn;  in l2cap_move_continue()
5132 			l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);  in l2cap_move_continue()
5137 			chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;  in l2cap_move_continue()
5140 		l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);  in l2cap_move_continue()
5144 		chan->move_id = chan->local_amp_id;  in l2cap_move_continue()
5145 		l2cap_move_done(chan);  in l2cap_move_continue()
5146 		l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);  in l2cap_move_continue()
5149 	l2cap_chan_unlock(chan);  in l2cap_move_continue()
5155 	struct l2cap_chan *chan;  in l2cap_move_fail()  local
5157 	chan = l2cap_get_chan_by_ident(conn, ident);  in l2cap_move_fail()
5158 	if (!chan) {  in l2cap_move_fail()
5164 	__clear_chan_timer(chan);  in l2cap_move_fail()
5166 	if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {  in l2cap_move_fail()
5168 			chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;  in l2cap_move_fail()
5171 			chan->move_id = chan->local_amp_id;  in l2cap_move_fail()
5172 			l2cap_move_done(chan);  in l2cap_move_fail()
5176 	l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);  in l2cap_move_fail()
5178 	l2cap_chan_unlock(chan);  in l2cap_move_fail()
5209 	struct l2cap_chan *chan;  in l2cap_move_channel_confirm()  local
5220 	chan = l2cap_get_chan_by_dcid(conn, icid);  in l2cap_move_channel_confirm()
5221 	if (!chan) {  in l2cap_move_channel_confirm()
5227 	if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM) {  in l2cap_move_channel_confirm()
5229 			chan->local_amp_id = chan->move_id;  in l2cap_move_channel_confirm()
5230 			if (chan->local_amp_id == AMP_ID_BREDR)  in l2cap_move_channel_confirm()
5231 				__release_logical_link(chan);  in l2cap_move_channel_confirm()
5233 			chan->move_id = chan->local_amp_id;  in l2cap_move_channel_confirm()
5236 		l2cap_move_done(chan);  in l2cap_move_channel_confirm()
5241 	l2cap_chan_unlock(chan);  in l2cap_move_channel_confirm()
5251 	struct l2cap_chan *chan;  in l2cap_move_channel_confirm_rsp()  local
5261 	chan = l2cap_get_chan_by_scid(conn, icid);  in l2cap_move_channel_confirm_rsp()
5262 	if (!chan)  in l2cap_move_channel_confirm_rsp()
5265 	__clear_chan_timer(chan);  in l2cap_move_channel_confirm_rsp()
5267 	if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM_RSP) {  in l2cap_move_channel_confirm_rsp()
5268 		chan->local_amp_id = chan->move_id;  in l2cap_move_channel_confirm_rsp()
5270 		if (chan->local_amp_id == AMP_ID_BREDR && chan->hs_hchan)  in l2cap_move_channel_confirm_rsp()
5271 			__release_logical_link(chan);  in l2cap_move_channel_confirm_rsp()
5273 		l2cap_move_done(chan);  in l2cap_move_channel_confirm_rsp()
5276 	l2cap_chan_unlock(chan);  in l2cap_move_channel_confirm_rsp()
5338 	struct l2cap_chan *chan;  in l2cap_le_connect_rsp()  local
5360 	chan = __l2cap_get_chan_by_ident(conn, cmd->ident);  in l2cap_le_connect_rsp()
5361 	if (!chan) {  in l2cap_le_connect_rsp()
5368 	l2cap_chan_lock(chan);  in l2cap_le_connect_rsp()
5377 		chan->ident = 0;  in l2cap_le_connect_rsp()
5378 		chan->dcid = dcid;  in l2cap_le_connect_rsp()
5379 		chan->omtu = mtu;  in l2cap_le_connect_rsp()
5380 		chan->remote_mps = mps;  in l2cap_le_connect_rsp()
5381 		chan->tx_credits = credits;  in l2cap_le_connect_rsp()
5382 		l2cap_chan_ready(chan);  in l2cap_le_connect_rsp()
5391 			l2cap_chan_del(chan, ECONNREFUSED);  in l2cap_le_connect_rsp()
5396 		if (chan->sec_level < sec_level)  in l2cap_le_connect_rsp()
5397 			chan->sec_level = sec_level;  in l2cap_le_connect_rsp()
5400 		clear_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags);  in l2cap_le_connect_rsp()
5402 		smp_conn_security(hcon, chan->sec_level);  in l2cap_le_connect_rsp()
5406 		l2cap_chan_del(chan, ECONNREFUSED);  in l2cap_le_connect_rsp()
5410 	l2cap_chan_unlock(chan);  in l2cap_le_connect_rsp()
5504 	struct l2cap_chan *chan, *pchan;  in l2cap_le_connect_req()  local
5530 		chan = NULL;  in l2cap_le_connect_req()
5540 		chan = NULL;  in l2cap_le_connect_req()
5547 		chan = NULL;  in l2cap_le_connect_req()
5554 		chan = NULL;  in l2cap_le_connect_req()
5558 	chan = pchan->ops->new_connection(pchan);  in l2cap_le_connect_req()
5559 	if (!chan) {  in l2cap_le_connect_req()
5564 	bacpy(&chan->src, &conn->hcon->src);  in l2cap_le_connect_req()
5565 	bacpy(&chan->dst, &conn->hcon->dst);  in l2cap_le_connect_req()
5566 	chan->src_type = bdaddr_src_type(conn->hcon);  in l2cap_le_connect_req()
5567 	chan->dst_type = bdaddr_dst_type(conn->hcon);  in l2cap_le_connect_req()
5568 	chan->psm  = psm;  in l2cap_le_connect_req()
5569 	chan->dcid = scid;  in l2cap_le_connect_req()
5570 	chan->omtu = mtu;  in l2cap_le_connect_req()
5571 	chan->remote_mps = mps;  in l2cap_le_connect_req()
5573 	__l2cap_chan_add(conn, chan);  in l2cap_le_connect_req()
5575 	l2cap_le_flowctl_init(chan, __le16_to_cpu(req->credits));  in l2cap_le_connect_req()
5577 	dcid = chan->scid;  in l2cap_le_connect_req()
5578 	credits = chan->rx_credits;  in l2cap_le_connect_req()
5580 	__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));  in l2cap_le_connect_req()
5582 	chan->ident = cmd->ident;  in l2cap_le_connect_req()
5584 	if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {  in l2cap_le_connect_req()
5585 		l2cap_state_change(chan, BT_CONNECT2);  in l2cap_le_connect_req()
5592 		chan->ops->defer(chan);  in l2cap_le_connect_req()
5594 		l2cap_chan_ready(chan);  in l2cap_le_connect_req()
5607 	if (chan) {  in l2cap_le_connect_req()
5608 		rsp.mtu = cpu_to_le16(chan->imtu);  in l2cap_le_connect_req()
5609 		rsp.mps = cpu_to_le16(chan->mps);  in l2cap_le_connect_req()
5629 	struct l2cap_chan *chan;  in l2cap_le_credits()  local
5641 	chan = l2cap_get_chan_by_dcid(conn, cid);  in l2cap_le_credits()
5642 	if (!chan)  in l2cap_le_credits()
5645 	max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;  in l2cap_le_credits()
5648 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_le_credits()
5649 		l2cap_chan_unlock(chan);  in l2cap_le_credits()
5657 	chan->tx_credits += credits;  in l2cap_le_credits()
5660 	l2cap_le_flowctl_send(chan);  in l2cap_le_credits()
5662 	if (chan->tx_credits)  in l2cap_le_credits()
5663 		chan->ops->resume(chan);  in l2cap_le_credits()
5665 	l2cap_chan_unlock(chan);  in l2cap_le_credits()
5675 	struct l2cap_chan *chan;  in l2cap_le_command_rej()  local
5682 	chan = __l2cap_get_chan_by_ident(conn, cmd->ident);  in l2cap_le_command_rej()
5683 	if (!chan)  in l2cap_le_command_rej()
5686 	l2cap_chan_lock(chan);  in l2cap_le_command_rej()
5687 	l2cap_chan_del(chan, ECONNREFUSED);  in l2cap_le_command_rej()
5688 	l2cap_chan_unlock(chan);  in l2cap_le_command_rej()
5832 static int l2cap_check_fcs(struct l2cap_chan *chan,  struct sk_buff *skb)  in l2cap_check_fcs()  argument
5837 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_check_fcs()
5842 	if (chan->fcs == L2CAP_FCS_CRC16) {  in l2cap_check_fcs()
5853 static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)  in l2cap_send_i_or_rr_or_rnr()  argument
5857 	BT_DBG("chan %p", chan);  in l2cap_send_i_or_rr_or_rnr()
5862 	control.reqseq = chan->buffer_seq;  in l2cap_send_i_or_rr_or_rnr()
5863 	set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_send_i_or_rr_or_rnr()
5865 	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_send_i_or_rr_or_rnr()
5867 		l2cap_send_sframe(chan, &control);  in l2cap_send_i_or_rr_or_rnr()
5870 	if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&  in l2cap_send_i_or_rr_or_rnr()
5871 	    chan->unacked_frames > 0)  in l2cap_send_i_or_rr_or_rnr()
5872 		__set_retrans_timer(chan);  in l2cap_send_i_or_rr_or_rnr()
5875 	l2cap_ertm_send(chan);  in l2cap_send_i_or_rr_or_rnr()
5877 	if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&  in l2cap_send_i_or_rr_or_rnr()
5878 	    test_bit(CONN_SEND_FBIT, &chan->conn_state)) {  in l2cap_send_i_or_rr_or_rnr()
5883 		l2cap_send_sframe(chan, &control);  in l2cap_send_i_or_rr_or_rnr()
5906 static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,  in l2cap_reassemble_sdu()  argument
5913 		if (chan->sdu)  in l2cap_reassemble_sdu()
5916 		err = chan->ops->recv(chan, skb);  in l2cap_reassemble_sdu()
5920 		if (chan->sdu)  in l2cap_reassemble_sdu()
5926 		chan->sdu_len = get_unaligned_le16(skb->data);  in l2cap_reassemble_sdu()
5929 		if (chan->sdu_len > chan->imtu) {  in l2cap_reassemble_sdu()
5934 		if (skb->len >= chan->sdu_len)  in l2cap_reassemble_sdu()
5937 		chan->sdu = skb;  in l2cap_reassemble_sdu()
5938 		chan->sdu_last_frag = skb;  in l2cap_reassemble_sdu()
5945 		if (!chan->sdu)  in l2cap_reassemble_sdu()
5948 		append_skb_frag(chan->sdu, skb,  in l2cap_reassemble_sdu()
5949 				&chan->sdu_last_frag);  in l2cap_reassemble_sdu()
5952 		if (chan->sdu->len >= chan->sdu_len)  in l2cap_reassemble_sdu()
5959 		if (!chan->sdu)  in l2cap_reassemble_sdu()
5962 		append_skb_frag(chan->sdu, skb,  in l2cap_reassemble_sdu()
5963 				&chan->sdu_last_frag);  in l2cap_reassemble_sdu()
5966 		if (chan->sdu->len != chan->sdu_len)  in l2cap_reassemble_sdu()
5969 		err = chan->ops->recv(chan, chan->sdu);  in l2cap_reassemble_sdu()
5973 			chan->sdu = NULL;  in l2cap_reassemble_sdu()
5974 			chan->sdu_last_frag = NULL;  in l2cap_reassemble_sdu()
5975 			chan->sdu_len = 0;  in l2cap_reassemble_sdu()
5982 		kfree_skb(chan->sdu);  in l2cap_reassemble_sdu()
5983 		chan->sdu = NULL;  in l2cap_reassemble_sdu()
5984 		chan->sdu_last_frag = NULL;  in l2cap_reassemble_sdu()
5985 		chan->sdu_len = 0;  in l2cap_reassemble_sdu()
5991 static int l2cap_resegment(struct l2cap_chan *chan)  in l2cap_resegment()  argument
5997 void l2cap_chan_busy(struct l2cap_chan *chan, int busy)  in l2cap_chan_busy()  argument
6001 	if (chan->mode != L2CAP_MODE_ERTM)  in l2cap_chan_busy()
6005 	l2cap_tx(chan, NULL, NULL, event);  in l2cap_chan_busy()
6008 static int l2cap_rx_queued_iframes(struct l2cap_chan *chan)  in l2cap_rx_queued_iframes()  argument
6015 	BT_DBG("chan %p", chan);  in l2cap_rx_queued_iframes()
6017 	while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_rx_queued_iframes()
6020 		       chan->buffer_seq, skb_queue_len(&chan->srej_q));  in l2cap_rx_queued_iframes()
6022 		skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq);  in l2cap_rx_queued_iframes()
6027 		skb_unlink(skb, &chan->srej_q);  in l2cap_rx_queued_iframes()
6028 		chan->buffer_seq = __next_seq(chan, chan->buffer_seq);  in l2cap_rx_queued_iframes()
6029 		err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->l2cap);  in l2cap_rx_queued_iframes()
6034 	if (skb_queue_empty(&chan->srej_q)) {  in l2cap_rx_queued_iframes()
6035 		chan->rx_state = L2CAP_RX_STATE_RECV;  in l2cap_rx_queued_iframes()
6036 		l2cap_send_ack(chan);  in l2cap_rx_queued_iframes()
6042 static void l2cap_handle_srej(struct l2cap_chan *chan,  in l2cap_handle_srej()  argument
6047 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_handle_srej()
6049 	if (control->reqseq == chan->next_tx_seq) {  in l2cap_handle_srej()
6051 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_handle_srej()
6055 	skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);  in l2cap_handle_srej()
6063 	if (chan->max_tx != 0 && bt_cb(skb)->l2cap.retries >= chan->max_tx) {  in l2cap_handle_srej()
6064 		BT_DBG("Retry limit exceeded (%d)", chan->max_tx);  in l2cap_handle_srej()
6065 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_handle_srej()
6069 	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_handle_srej()
6072 		l2cap_pass_to_tx(chan, control);  in l2cap_handle_srej()
6074 		set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_handle_srej()
6075 		l2cap_retransmit(chan, control);  in l2cap_handle_srej()
6076 		l2cap_ertm_send(chan);  in l2cap_handle_srej()
6078 		if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {  in l2cap_handle_srej()
6079 			set_bit(CONN_SREJ_ACT, &chan->conn_state);  in l2cap_handle_srej()
6080 			chan->srej_save_reqseq = control->reqseq;  in l2cap_handle_srej()
6083 		l2cap_pass_to_tx_fbit(chan, control);  in l2cap_handle_srej()
6086 			if (chan->srej_save_reqseq != control->reqseq ||  in l2cap_handle_srej()
6088 						&chan->conn_state))  in l2cap_handle_srej()
6089 				l2cap_retransmit(chan, control);  in l2cap_handle_srej()
6091 			l2cap_retransmit(chan, control);  in l2cap_handle_srej()
6092 			if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {  in l2cap_handle_srej()
6093 				set_bit(CONN_SREJ_ACT, &chan->conn_state);  in l2cap_handle_srej()
6094 				chan->srej_save_reqseq = control->reqseq;  in l2cap_handle_srej()
6100 static void l2cap_handle_rej(struct l2cap_chan *chan,  in l2cap_handle_rej()  argument
6105 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_handle_rej()
6107 	if (control->reqseq == chan->next_tx_seq) {  in l2cap_handle_rej()
6109 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_handle_rej()
6113 	skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);  in l2cap_handle_rej()
6115 	if (chan->max_tx && skb &&  in l2cap_handle_rej()
6116 	    bt_cb(skb)->l2cap.retries >= chan->max_tx) {  in l2cap_handle_rej()
6117 		BT_DBG("Retry limit exceeded (%d)", chan->max_tx);  in l2cap_handle_rej()
6118 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_handle_rej()
6122 	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_handle_rej()
6124 	l2cap_pass_to_tx(chan, control);  in l2cap_handle_rej()
6127 		if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))  in l2cap_handle_rej()
6128 			l2cap_retransmit_all(chan, control);  in l2cap_handle_rej()
6130 		l2cap_retransmit_all(chan, control);  in l2cap_handle_rej()
6131 		l2cap_ertm_send(chan);  in l2cap_handle_rej()
6132 		if (chan->tx_state == L2CAP_TX_STATE_WAIT_F)  in l2cap_handle_rej()
6133 			set_bit(CONN_REJ_ACT, &chan->conn_state);  in l2cap_handle_rej()
6137 static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq)  in l2cap_classify_txseq()  argument
6139 	BT_DBG("chan %p, txseq %d", chan, txseq);  in l2cap_classify_txseq()
6141 	BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq,  in l2cap_classify_txseq()
6142 	       chan->expected_tx_seq);  in l2cap_classify_txseq()
6144 	if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {  in l2cap_classify_txseq()
6145 		if (__seq_offset(chan, txseq, chan->last_acked_seq) >=  in l2cap_classify_txseq()
6146 		    chan->tx_win) {  in l2cap_classify_txseq()
6150 			if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {  in l2cap_classify_txseq()
6159 		if (chan->srej_list.head == txseq) {  in l2cap_classify_txseq()
6164 		if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) {  in l2cap_classify_txseq()
6169 		if (l2cap_seq_list_contains(&chan->srej_list, txseq)) {  in l2cap_classify_txseq()
6175 	if (chan->expected_tx_seq == txseq) {  in l2cap_classify_txseq()
6176 		if (__seq_offset(chan, txseq, chan->last_acked_seq) >=  in l2cap_classify_txseq()
6177 		    chan->tx_win) {  in l2cap_classify_txseq()
6186 	if (__seq_offset(chan, txseq, chan->last_acked_seq) <  in l2cap_classify_txseq()
6187 	    __seq_offset(chan, chan->expected_tx_seq, chan->last_acked_seq)) {  in l2cap_classify_txseq()
6192 	if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) {  in l2cap_classify_txseq()
6210 		if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {  in l2cap_classify_txseq()
6223 static int l2cap_rx_state_recv(struct l2cap_chan *chan,  in l2cap_rx_state_recv()  argument
6230 	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,  in l2cap_rx_state_recv()
6235 		switch (l2cap_classify_txseq(chan, control->txseq)) {  in l2cap_rx_state_recv()
6237 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
6239 			if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_rx_state_recv()
6245 			chan->expected_tx_seq = __next_seq(chan,  in l2cap_rx_state_recv()
6248 			chan->buffer_seq = chan->expected_tx_seq;  in l2cap_rx_state_recv()
6251 			err = l2cap_reassemble_sdu(chan, skb, control);  in l2cap_rx_state_recv()
6257 							&chan->conn_state)) {  in l2cap_rx_state_recv()
6259 					l2cap_retransmit_all(chan, control);  in l2cap_rx_state_recv()
6260 					l2cap_ertm_send(chan);  in l2cap_rx_state_recv()
6264 			if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state))  in l2cap_rx_state_recv()
6265 				l2cap_send_ack(chan);  in l2cap_rx_state_recv()
6268 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
6274 			if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_rx_state_recv()
6284 			skb_queue_tail(&chan->srej_q, skb);  in l2cap_rx_state_recv()
6287 			       skb_queue_len(&chan->srej_q));  in l2cap_rx_state_recv()
6289 			clear_bit(CONN_SREJ_ACT, &chan->conn_state);  in l2cap_rx_state_recv()
6290 			l2cap_seq_list_clear(&chan->srej_list);  in l2cap_rx_state_recv()
6291 			l2cap_send_srej(chan, control->txseq);  in l2cap_rx_state_recv()
6293 			chan->rx_state = L2CAP_RX_STATE_SREJ_SENT;  in l2cap_rx_state_recv()
6296 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
6302 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_rx_state_recv()
6307 		l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
6309 			clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_rx_state_recv()
6311 			if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state) &&  in l2cap_rx_state_recv()
6312 			    !__chan_is_moving(chan)) {  in l2cap_rx_state_recv()
6314 				l2cap_retransmit_all(chan, control);  in l2cap_rx_state_recv()
6317 			l2cap_ertm_send(chan);  in l2cap_rx_state_recv()
6319 			l2cap_send_i_or_rr_or_rnr(chan);  in l2cap_rx_state_recv()
6322 					       &chan->conn_state) &&  in l2cap_rx_state_recv()
6323 			    chan->unacked_frames)  in l2cap_rx_state_recv()
6324 				__set_retrans_timer(chan);  in l2cap_rx_state_recv()
6326 			l2cap_ertm_send(chan);  in l2cap_rx_state_recv()
6330 		set_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_rx_state_recv()
6331 		l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
6333 			set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_rx_state_recv()
6334 			l2cap_send_rr_or_rnr(chan, 0);  in l2cap_rx_state_recv()
6336 		__clear_retrans_timer(chan);  in l2cap_rx_state_recv()
6337 		l2cap_seq_list_clear(&chan->retrans_list);  in l2cap_rx_state_recv()
6340 		l2cap_handle_rej(chan, control);  in l2cap_rx_state_recv()
6343 		l2cap_handle_srej(chan, control);  in l2cap_rx_state_recv()
6357 static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,  in l2cap_rx_state_srej_sent()  argument
6365 	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,  in l2cap_rx_state_srej_sent()
6370 		switch (l2cap_classify_txseq(chan, txseq)) {  in l2cap_rx_state_srej_sent()
6373 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
6374 			skb_queue_tail(&chan->srej_q, skb);  in l2cap_rx_state_srej_sent()
6377 			       skb_queue_len(&chan->srej_q));  in l2cap_rx_state_srej_sent()
6379 			chan->expected_tx_seq = __next_seq(chan, txseq);  in l2cap_rx_state_srej_sent()
6382 			l2cap_seq_list_pop(&chan->srej_list);  in l2cap_rx_state_srej_sent()
6384 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
6385 			skb_queue_tail(&chan->srej_q, skb);  in l2cap_rx_state_srej_sent()
6388 			       skb_queue_len(&chan->srej_q));  in l2cap_rx_state_srej_sent()
6390 			err = l2cap_rx_queued_iframes(chan);  in l2cap_rx_state_srej_sent()
6400 			skb_queue_tail(&chan->srej_q, skb);  in l2cap_rx_state_srej_sent()
6403 			       skb_queue_len(&chan->srej_q));  in l2cap_rx_state_srej_sent()
6405 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
6406 			l2cap_send_srej(chan, control->txseq);  in l2cap_rx_state_srej_sent()
6414 			skb_queue_tail(&chan->srej_q, skb);  in l2cap_rx_state_srej_sent()
6417 			       skb_queue_len(&chan->srej_q));  in l2cap_rx_state_srej_sent()
6419 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
6420 			l2cap_send_srej_list(chan, control->txseq);  in l2cap_rx_state_srej_sent()
6424 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
6435 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_rx_state_srej_sent()
6440 		l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
6442 			clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_rx_state_srej_sent()
6445 						&chan->conn_state)) {  in l2cap_rx_state_srej_sent()
6447 				l2cap_retransmit_all(chan, control);  in l2cap_rx_state_srej_sent()
6450 			l2cap_ertm_send(chan);  in l2cap_rx_state_srej_sent()
6453 					       &chan->conn_state) &&  in l2cap_rx_state_srej_sent()
6454 			    chan->unacked_frames) {  in l2cap_rx_state_srej_sent()
6455 				__set_retrans_timer(chan);  in l2cap_rx_state_srej_sent()
6458 			set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_rx_state_srej_sent()
6459 			l2cap_send_srej_tail(chan);  in l2cap_rx_state_srej_sent()
6462 					       &chan->conn_state) &&  in l2cap_rx_state_srej_sent()
6463 			    chan->unacked_frames)  in l2cap_rx_state_srej_sent()
6464 				__set_retrans_timer(chan);  in l2cap_rx_state_srej_sent()
6466 			l2cap_send_ack(chan);  in l2cap_rx_state_srej_sent()
6470 		set_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_rx_state_srej_sent()
6471 		l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
6473 			l2cap_send_srej_tail(chan);  in l2cap_rx_state_srej_sent()
6479 			rr_control.reqseq = chan->buffer_seq;  in l2cap_rx_state_srej_sent()
6480 			l2cap_send_sframe(chan, &rr_control);  in l2cap_rx_state_srej_sent()
6485 		l2cap_handle_rej(chan, control);  in l2cap_rx_state_srej_sent()
6488 		l2cap_handle_srej(chan, control);  in l2cap_rx_state_srej_sent()
6500 static int l2cap_finish_move(struct l2cap_chan *chan)  in l2cap_finish_move()  argument
6502 	BT_DBG("chan %p", chan);  in l2cap_finish_move()
6504 	chan->rx_state = L2CAP_RX_STATE_RECV;  in l2cap_finish_move()
6506 	if (chan->hs_hcon)  in l2cap_finish_move()
6507 		chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;  in l2cap_finish_move()
6509 		chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;  in l2cap_finish_move()
6511 	return l2cap_resegment(chan);  in l2cap_finish_move()
6514 static int l2cap_rx_state_wait_p(struct l2cap_chan *chan,  in l2cap_rx_state_wait_p()  argument
6520 	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,  in l2cap_rx_state_wait_p()
6526 	l2cap_process_reqseq(chan, control->reqseq);  in l2cap_rx_state_wait_p()
6528 	if (!skb_queue_empty(&chan->tx_q))  in l2cap_rx_state_wait_p()
6529 		chan->tx_send_head = skb_peek(&chan->tx_q);  in l2cap_rx_state_wait_p()
6531 		chan->tx_send_head = NULL;  in l2cap_rx_state_wait_p()
6536 	chan->next_tx_seq = control->reqseq;  in l2cap_rx_state_wait_p()
6537 	chan->unacked_frames = 0;  in l2cap_rx_state_wait_p()
6539 	err = l2cap_finish_move(chan);  in l2cap_rx_state_wait_p()
6543 	set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_rx_state_wait_p()
6544 	l2cap_send_i_or_rr_or_rnr(chan);  in l2cap_rx_state_wait_p()
6549 	return l2cap_rx_state_recv(chan, control, NULL, event);  in l2cap_rx_state_wait_p()
6552 static int l2cap_rx_state_wait_f(struct l2cap_chan *chan,  in l2cap_rx_state_wait_f()  argument
6561 	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_rx_state_wait_f()
6563 	chan->rx_state = L2CAP_RX_STATE_RECV;  in l2cap_rx_state_wait_f()
6564 	l2cap_process_reqseq(chan, control->reqseq);  in l2cap_rx_state_wait_f()
6566 	if (!skb_queue_empty(&chan->tx_q))  in l2cap_rx_state_wait_f()
6567 		chan->tx_send_head = skb_peek(&chan->tx_q);  in l2cap_rx_state_wait_f()
6569 		chan->tx_send_head = NULL;  in l2cap_rx_state_wait_f()
6574 	chan->next_tx_seq = control->reqseq;  in l2cap_rx_state_wait_f()
6575 	chan->unacked_frames = 0;  in l2cap_rx_state_wait_f()
6577 	if (chan->hs_hcon)  in l2cap_rx_state_wait_f()
6578 		chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;  in l2cap_rx_state_wait_f()
6580 		chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;  in l2cap_rx_state_wait_f()
6582 	err = l2cap_resegment(chan);  in l2cap_rx_state_wait_f()
6585 		err = l2cap_rx_state_recv(chan, control, skb, event);  in l2cap_rx_state_wait_f()
6590 static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq)  in __valid_reqseq()  argument
6595 	unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq);  in __valid_reqseq()
6596 	return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked;  in __valid_reqseq()
6599 static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,  in l2cap_rx()  argument
6604 	BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan,  in l2cap_rx()
6605 	       control, skb, event, chan->rx_state);  in l2cap_rx()
6607 	if (__valid_reqseq(chan, control->reqseq)) {  in l2cap_rx()
6608 		switch (chan->rx_state) {  in l2cap_rx()
6610 			err = l2cap_rx_state_recv(chan, control, skb, event);  in l2cap_rx()
6613 			err = l2cap_rx_state_srej_sent(chan, control, skb,  in l2cap_rx()
6617 			err = l2cap_rx_state_wait_p(chan, control, skb, event);  in l2cap_rx()
6620 			err = l2cap_rx_state_wait_f(chan, control, skb, event);  in l2cap_rx()
6628 		       control->reqseq, chan->next_tx_seq,  in l2cap_rx()
6629 		       chan->expected_ack_seq);  in l2cap_rx()
6630 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_rx()
6636 static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,  in l2cap_stream_rx()  argument
6639 	BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb,  in l2cap_stream_rx()
6640 	       chan->rx_state);  in l2cap_stream_rx()
6642 	if (l2cap_classify_txseq(chan, control->txseq) ==  in l2cap_stream_rx()
6644 		l2cap_pass_to_tx(chan, control);  in l2cap_stream_rx()
6646 		BT_DBG("buffer_seq %d->%d", chan->buffer_seq,  in l2cap_stream_rx()
6647 		       __next_seq(chan, chan->buffer_seq));  in l2cap_stream_rx()
6649 		chan->buffer_seq = __next_seq(chan, chan->buffer_seq);  in l2cap_stream_rx()
6651 		l2cap_reassemble_sdu(chan, skb, control);  in l2cap_stream_rx()
6653 		if (chan->sdu) {  in l2cap_stream_rx()
6654 			kfree_skb(chan->sdu);  in l2cap_stream_rx()
6655 			chan->sdu = NULL;  in l2cap_stream_rx()
6657 		chan->sdu_last_frag = NULL;  in l2cap_stream_rx()
6658 		chan->sdu_len = 0;  in l2cap_stream_rx()
6666 	chan->last_acked_seq = control->txseq;  in l2cap_stream_rx()
6667 	chan->expected_tx_seq = __next_seq(chan, control->txseq);  in l2cap_stream_rx()
6672 static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)  in l2cap_data_rcv()  argument
6678 	__unpack_control(chan, skb);  in l2cap_data_rcv()
6687 	if (l2cap_check_fcs(chan, skb))  in l2cap_data_rcv()
6693 	if (chan->fcs == L2CAP_FCS_CRC16)  in l2cap_data_rcv()
6696 	if (len > chan->mps) {  in l2cap_data_rcv()
6697 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_data_rcv()
6701 	if ((chan->mode == L2CAP_MODE_ERTM ||  in l2cap_data_rcv()
6702 	     chan->mode == L2CAP_MODE_STREAMING) && sk_filter(chan->data, skb))  in l2cap_data_rcv()
6715 		if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F)  in l2cap_data_rcv()
6718 		if (chan->mode != L2CAP_MODE_STREAMING) {  in l2cap_data_rcv()
6720 			err = l2cap_rx(chan, control, skb, event);  in l2cap_data_rcv()
6722 			err = l2cap_stream_rx(chan, control, skb);  in l2cap_data_rcv()
6726 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_data_rcv()
6734 		if (chan->mode == L2CAP_MODE_STREAMING)  in l2cap_data_rcv()
6743 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_data_rcv()
6749 				       chan->tx_state != L2CAP_TX_STATE_WAIT_F))  in l2cap_data_rcv()
6753 		if (l2cap_rx(chan, control, skb, event))  in l2cap_data_rcv()
6754 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_data_rcv()
6764 static void l2cap_chan_le_send_credits(struct l2cap_chan *chan)  in l2cap_chan_le_send_credits()  argument
6766 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_le_send_credits()
6770 	return_credits = ((chan->imtu / chan->mps) + 1) - chan->rx_credits;  in l2cap_chan_le_send_credits()
6775 	BT_DBG("chan %p returning %u credits to sender", chan, return_credits);  in l2cap_chan_le_send_credits()
6777 	chan->rx_credits += return_credits;  in l2cap_chan_le_send_credits()
6779 	pkt.cid     = cpu_to_le16(chan->scid);  in l2cap_chan_le_send_credits()
6782 	chan->ident = l2cap_get_ident(conn);  in l2cap_chan_le_send_credits()
6784 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CREDITS, sizeof(pkt), &pkt);  in l2cap_chan_le_send_credits()
6787 static int l2cap_le_recv(struct l2cap_chan *chan, struct sk_buff *skb)  in l2cap_le_recv()  argument
6791 	BT_DBG("SDU reassemble complete: chan %p skb->len %u", chan, skb->len);  in l2cap_le_recv()
6794 	err = chan->ops->recv(chan, skb);  in l2cap_le_recv()
6797 	l2cap_chan_le_send_credits(chan);  in l2cap_le_recv()
6802 static int l2cap_le_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)  in l2cap_le_data_rcv()  argument
6806 	if (!chan->rx_credits) {  in l2cap_le_data_rcv()
6808 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_le_data_rcv()
6812 	if (chan->imtu < skb->len) {  in l2cap_le_data_rcv()
6817 	chan->rx_credits--;  in l2cap_le_data_rcv()
6818 	BT_DBG("rx_credits %u -> %u", chan->rx_credits + 1, chan->rx_credits);  in l2cap_le_data_rcv()
6823 	if (!chan->rx_credits)  in l2cap_le_data_rcv()
6824 		l2cap_chan_le_send_credits(chan);  in l2cap_le_data_rcv()
6828 	if (!chan->sdu) {  in l2cap_le_data_rcv()
6835 		       sdu_len, skb->len, chan->imtu);  in l2cap_le_data_rcv()
6837 		if (sdu_len > chan->imtu) {  in l2cap_le_data_rcv()
6850 			return l2cap_le_recv(chan, skb);  in l2cap_le_data_rcv()
6852 		chan->sdu = skb;  in l2cap_le_data_rcv()
6853 		chan->sdu_len = sdu_len;  in l2cap_le_data_rcv()
6854 		chan->sdu_last_frag = skb;  in l2cap_le_data_rcv()
6857 		if (skb->len + L2CAP_SDULEN_SIZE < chan->mps) {  in l2cap_le_data_rcv()
6861 			BT_DBG("chan->mps %u -> %u", chan->mps, mps_len);  in l2cap_le_data_rcv()
6862 			chan->mps = mps_len;  in l2cap_le_data_rcv()
6863 			l2cap_chan_le_send_credits(chan);  in l2cap_le_data_rcv()
6870 	       chan->sdu->len, skb->len, chan->sdu_len);  in l2cap_le_data_rcv()
6872 	if (chan->sdu->len + skb->len > chan->sdu_len) {  in l2cap_le_data_rcv()
6878 	append_skb_frag(chan->sdu, skb, &chan->sdu_last_frag);  in l2cap_le_data_rcv()
6881 	if (chan->sdu->len == chan->sdu_len) {  in l2cap_le_data_rcv()
6882 		err = l2cap_le_recv(chan, chan->sdu);  in l2cap_le_data_rcv()
6884 			chan->sdu = NULL;  in l2cap_le_data_rcv()
6885 			chan->sdu_last_frag = NULL;  in l2cap_le_data_rcv()
6886 			chan->sdu_len = 0;  in l2cap_le_data_rcv()
6893 		kfree_skb(chan->sdu);  in l2cap_le_data_rcv()
6894 		chan->sdu = NULL;  in l2cap_le_data_rcv()
6895 		chan->sdu_last_frag = NULL;  in l2cap_le_data_rcv()
6896 		chan->sdu_len = 0;  in l2cap_le_data_rcv()
6909 	struct l2cap_chan *chan;  in l2cap_data_channel()  local
6911 	chan = l2cap_get_chan_by_scid(conn, cid);  in l2cap_data_channel()
6912 	if (!chan) {  in l2cap_data_channel()
6914 			chan = a2mp_channel_create(conn, skb);  in l2cap_data_channel()
6915 			if (!chan) {  in l2cap_data_channel()
6920 			l2cap_chan_lock(chan);  in l2cap_data_channel()
6929 	BT_DBG("chan %p, len %d", chan, skb->len);  in l2cap_data_channel()
6935 	if (chan->chan_type == L2CAP_CHAN_FIXED)  in l2cap_data_channel()
6936 		l2cap_chan_ready(chan);  in l2cap_data_channel()
6938 	if (chan->state != BT_CONNECTED)  in l2cap_data_channel()
6941 	switch (chan->mode) {  in l2cap_data_channel()
6943 		if (l2cap_le_data_rcv(chan, skb) < 0)  in l2cap_data_channel()
6954 		if (chan->imtu < skb->len) {  in l2cap_data_channel()
6959 		if (!chan->ops->recv(chan, skb))  in l2cap_data_channel()
6965 		l2cap_data_rcv(chan, skb);  in l2cap_data_channel()
6969 		BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);  in l2cap_data_channel()
6977 	l2cap_chan_unlock(chan);  in l2cap_data_channel()
6984 	struct l2cap_chan *chan;  in l2cap_conless_channel()  local
6989 	chan = l2cap_global_chan_by_psm(0, psm, &hcon->src, &hcon->dst,  in l2cap_conless_channel()
6991 	if (!chan)  in l2cap_conless_channel()
6994 	BT_DBG("chan %p, len %d", chan, skb->len);  in l2cap_conless_channel()
6996 	if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)  in l2cap_conless_channel()
6999 	if (chan->imtu < skb->len)  in l2cap_conless_channel()
7006 	if (!chan->ops->recv(chan, skb)) {  in l2cap_conless_channel()
7007 		l2cap_chan_put(chan);  in l2cap_conless_channel()
7012 	l2cap_chan_put(chan);  in l2cap_conless_channel()
7162 int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,  in l2cap_chan_connect()  argument
7170 	BT_DBG("%pMR -> %pMR (type %u) psm 0x%2.2x", &chan->src, dst,  in l2cap_chan_connect()
7173 	hdev = hci_get_route(dst, &chan->src, chan->src_type);  in l2cap_chan_connect()
7180 	    chan->chan_type != L2CAP_CHAN_RAW) {  in l2cap_chan_connect()
7185 	if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !psm) {  in l2cap_chan_connect()
7190 	if (chan->chan_type == L2CAP_CHAN_FIXED && !cid) {  in l2cap_chan_connect()
7195 	switch (chan->mode) {  in l2cap_chan_connect()
7210 	switch (chan->state) {  in l2cap_chan_connect()
7234 	bacpy(&chan->dst, dst);  in l2cap_chan_connect()
7235 	chan->dst_type = dst_type;  in l2cap_chan_connect()
7237 	chan->psm = psm;  in l2cap_chan_connect()
7238 	chan->dcid = cid;  in l2cap_chan_connect()
7250 					      chan->sec_level,  in l2cap_chan_connect()
7255 						   chan->sec_level,  in l2cap_chan_connect()
7259 		u8 auth_type = l2cap_get_auth_type(chan);  in l2cap_chan_connect()
7260 		hcon = hci_connect_acl(hdev, dst, chan->sec_level, auth_type);  in l2cap_chan_connect()
7276 	l2cap_chan_lock(chan);  in l2cap_chan_connect()
7285 	bacpy(&chan->src, &hcon->src);  in l2cap_chan_connect()
7286 	chan->src_type = bdaddr_src_type(hcon);  in l2cap_chan_connect()
7288 	__l2cap_chan_add(conn, chan);  in l2cap_chan_connect()
7293 	l2cap_state_change(chan, BT_CONNECT);  in l2cap_chan_connect()
7294 	__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));  in l2cap_chan_connect()
7300 	chan->sport = 0;  in l2cap_chan_connect()
7304 		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {  in l2cap_chan_connect()
7305 			__clear_chan_timer(chan);  in l2cap_chan_connect()
7306 			if (l2cap_chan_check_security(chan, true))  in l2cap_chan_connect()
7307 				l2cap_state_change(chan, BT_CONNECTED);  in l2cap_chan_connect()
7309 			l2cap_do_start(chan);  in l2cap_chan_connect()
7315 	l2cap_chan_unlock(chan);  in l2cap_chan_connect()
7425 		struct l2cap_chan *chan, *next;  in l2cap_connect_cfm()  local
7432 		chan = pchan->ops->new_connection(pchan);  in l2cap_connect_cfm()
7433 		if (chan) {  in l2cap_connect_cfm()
7434 			bacpy(&chan->src, &hcon->src);  in l2cap_connect_cfm()
7435 			bacpy(&chan->dst, &hcon->dst);  in l2cap_connect_cfm()
7436 			chan->src_type = bdaddr_src_type(hcon);  in l2cap_connect_cfm()
7437 			chan->dst_type = dst_type;  in l2cap_connect_cfm()
7439 			__l2cap_chan_add(conn, chan);  in l2cap_connect_cfm()
7473 static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)  in l2cap_check_encryption()  argument
7475 	if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)  in l2cap_check_encryption()
7479 		if (chan->sec_level == BT_SECURITY_MEDIUM) {  in l2cap_check_encryption()
7480 			__set_chan_timer(chan, L2CAP_ENC_TIMEOUT);  in l2cap_check_encryption()
7481 		} else if (chan->sec_level == BT_SECURITY_HIGH ||  in l2cap_check_encryption()
7482 			   chan->sec_level == BT_SECURITY_FIPS)  in l2cap_check_encryption()
7483 			l2cap_chan_close(chan, ECONNREFUSED);  in l2cap_check_encryption()
7485 		if (chan->sec_level == BT_SECURITY_MEDIUM)  in l2cap_check_encryption()
7486 			__clear_chan_timer(chan);  in l2cap_check_encryption()
7493 	struct l2cap_chan *chan;  in l2cap_security_cfm()  local
7502 	list_for_each_entry(chan, &conn->chan_l, list) {  in l2cap_security_cfm()
7503 		l2cap_chan_lock(chan);  in l2cap_security_cfm()
7505 		BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid,  in l2cap_security_cfm()
7506 		       state_to_string(chan->state));  in l2cap_security_cfm()
7508 		if (chan->scid == L2CAP_CID_A2MP) {  in l2cap_security_cfm()
7509 			l2cap_chan_unlock(chan);  in l2cap_security_cfm()
7514 			chan->sec_level = hcon->sec_level;  in l2cap_security_cfm()
7516 		if (!__l2cap_no_conn_pending(chan)) {  in l2cap_security_cfm()
7517 			l2cap_chan_unlock(chan);  in l2cap_security_cfm()
7521 		if (!status && (chan->state == BT_CONNECTED ||  in l2cap_security_cfm()
7522 				chan->state == BT_CONFIG)) {  in l2cap_security_cfm()
7523 			chan->ops->resume(chan);  in l2cap_security_cfm()
7524 			l2cap_check_encryption(chan, encrypt);  in l2cap_security_cfm()
7525 			l2cap_chan_unlock(chan);  in l2cap_security_cfm()
7529 		if (chan->state == BT_CONNECT) {  in l2cap_security_cfm()
7531 				l2cap_start_connection(chan);  in l2cap_security_cfm()
7533 				__set_chan_timer(chan, L2CAP_DISC_TIMEOUT);  in l2cap_security_cfm()
7534 		} else if (chan->state == BT_CONNECT2 &&  in l2cap_security_cfm()
7535 			   chan->mode != L2CAP_MODE_LE_FLOWCTL) {  in l2cap_security_cfm()
7540 				if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {  in l2cap_security_cfm()
7543 					chan->ops->defer(chan);  in l2cap_security_cfm()
7545 					l2cap_state_change(chan, BT_CONFIG);  in l2cap_security_cfm()
7550 				l2cap_state_change(chan, BT_DISCONN);  in l2cap_security_cfm()
7551 				__set_chan_timer(chan, L2CAP_DISC_TIMEOUT);  in l2cap_security_cfm()
7556 			rsp.scid   = cpu_to_le16(chan->dcid);  in l2cap_security_cfm()
7557 			rsp.dcid   = cpu_to_le16(chan->scid);  in l2cap_security_cfm()
7560 			l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,  in l2cap_security_cfm()
7563 			if (!test_bit(CONF_REQ_SENT, &chan->conf_state) &&  in l2cap_security_cfm()
7566 				set_bit(CONF_REQ_SENT, &chan->conf_state);  in l2cap_security_cfm()
7569 					       l2cap_build_conf_req(chan, buf, sizeof(buf)),  in l2cap_security_cfm()
7571 				chan->num_conf_req++;  in l2cap_security_cfm()
7575 		l2cap_chan_unlock(chan);  in l2cap_security_cfm()