59 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size);
60 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err);
62 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
206 int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)  in l2cap_add_psm()  argument
212 	if (psm && __l2cap_global_chan_by_addr(psm, src, chan->src_type)) {  in l2cap_add_psm()
218 		chan->psm = psm;  in l2cap_add_psm()
219 		chan->sport = psm;  in l2cap_add_psm()
224 		if (chan->src_type == BDADDR_BREDR) {  in l2cap_add_psm()
237 							 chan->src_type)) {  in l2cap_add_psm()
238 				chan->psm   = cpu_to_le16(p);  in l2cap_add_psm()
239 				chan->sport = cpu_to_le16(p);  in l2cap_add_psm()
251 int l2cap_add_scid(struct l2cap_chan *chan,  __u16 scid)  in l2cap_add_scid()  argument
256 	chan->omtu = L2CAP_DEFAULT_MTU;  in l2cap_add_scid()
257 	chan->chan_type = L2CAP_CHAN_FIXED;  in l2cap_add_scid()
259 	chan->scid = scid;  in l2cap_add_scid()
283 static void l2cap_state_change(struct l2cap_chan *chan, int state)  in l2cap_state_change()  argument
285 	BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),  in l2cap_state_change()
288 	chan->state = state;  in l2cap_state_change()
289 	chan->ops->state_change(chan, state, 0);  in l2cap_state_change()
292 static inline void l2cap_state_change_and_error(struct l2cap_chan *chan,  in l2cap_state_change_and_error()  argument
295 	chan->state = state;  in l2cap_state_change_and_error()
296 	chan->ops->state_change(chan, chan->state, err);  in l2cap_state_change_and_error()
299 static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)  in l2cap_chan_set_err()  argument
301 	chan->ops->state_change(chan, chan->state, err);  in l2cap_chan_set_err()
304 static void __set_retrans_timer(struct l2cap_chan *chan)  in __set_retrans_timer()  argument
306 	if (!delayed_work_pending(&chan->monitor_timer) &&  in __set_retrans_timer()
307 	    chan->retrans_timeout) {  in __set_retrans_timer()
308 		l2cap_set_timer(chan, &chan->retrans_timer,  in __set_retrans_timer()
309 				msecs_to_jiffies(chan->retrans_timeout));  in __set_retrans_timer()
313 static void __set_monitor_timer(struct l2cap_chan *chan)  in __set_monitor_timer()  argument
315 	__clear_retrans_timer(chan);  in __set_monitor_timer()
316 	if (chan->monitor_timeout) {  in __set_monitor_timer()
317 		l2cap_set_timer(chan, &chan->monitor_timer,  in __set_monitor_timer()
318 				msecs_to_jiffies(chan->monitor_timeout));  in __set_monitor_timer()
431 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,  in l2cap_chan_timeout()  local
433 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_timeout()
436 	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));  in l2cap_chan_timeout()
442 	l2cap_chan_lock(chan);  in l2cap_chan_timeout()
444 	if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)  in l2cap_chan_timeout()
446 	else if (chan->state == BT_CONNECT &&  in l2cap_chan_timeout()
447 		 chan->sec_level != BT_SECURITY_SDP)  in l2cap_chan_timeout()
452 	l2cap_chan_close(chan, reason);  in l2cap_chan_timeout()
454 	chan->ops->close(chan);  in l2cap_chan_timeout()
456 	l2cap_chan_unlock(chan);  in l2cap_chan_timeout()
457 	l2cap_chan_put(chan);  in l2cap_chan_timeout()
464 	struct l2cap_chan *chan;  in l2cap_chan_create()  local
466 	chan = kzalloc(sizeof(*chan), GFP_ATOMIC);  in l2cap_chan_create()
467 	if (!chan)  in l2cap_chan_create()
470 	skb_queue_head_init(&chan->tx_q);  in l2cap_chan_create()
471 	skb_queue_head_init(&chan->srej_q);  in l2cap_chan_create()
472 	mutex_init(&chan->lock);  in l2cap_chan_create()
475 	atomic_set(&chan->nesting, L2CAP_NESTING_NORMAL);  in l2cap_chan_create()
478 	list_add(&chan->global_l, &chan_list);  in l2cap_chan_create()
481 	INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);  in l2cap_chan_create()
482 	INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);  in l2cap_chan_create()
483 	INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);  in l2cap_chan_create()
484 	INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);  in l2cap_chan_create()
486 	chan->state = BT_OPEN;  in l2cap_chan_create()
488 	kref_init(&chan->kref);  in l2cap_chan_create()
491 	set_bit(CONF_NOT_COMPLETE, &chan->conf_state);  in l2cap_chan_create()
493 	BT_DBG("chan %p", chan);  in l2cap_chan_create()
495 	return chan;  in l2cap_chan_create()
501 	struct l2cap_chan *chan = container_of(kref, struct l2cap_chan, kref);  in l2cap_chan_destroy()  local
503 	BT_DBG("chan %p", chan);  in l2cap_chan_destroy()
506 	list_del(&chan->global_l);  in l2cap_chan_destroy()
509 	kfree(chan);  in l2cap_chan_destroy()
537 void l2cap_chan_set_defaults(struct l2cap_chan *chan)  in l2cap_chan_set_defaults()  argument
539 	chan->fcs  = L2CAP_FCS_CRC16;  in l2cap_chan_set_defaults()
540 	chan->max_tx = L2CAP_DEFAULT_MAX_TX;  in l2cap_chan_set_defaults()
541 	chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;  in l2cap_chan_set_defaults()
542 	chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;  in l2cap_chan_set_defaults()
543 	chan->remote_max_tx = chan->max_tx;  in l2cap_chan_set_defaults()
544 	chan->remote_tx_win = chan->tx_win;  in l2cap_chan_set_defaults()
545 	chan->ack_win = L2CAP_DEFAULT_TX_WINDOW;  in l2cap_chan_set_defaults()
546 	chan->sec_level = BT_SECURITY_LOW;  in l2cap_chan_set_defaults()
547 	chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;  in l2cap_chan_set_defaults()
548 	chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;  in l2cap_chan_set_defaults()
549 	chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;  in l2cap_chan_set_defaults()
551 	chan->conf_state = 0;  in l2cap_chan_set_defaults()
552 	set_bit(CONF_NOT_COMPLETE, &chan->conf_state);  in l2cap_chan_set_defaults()
554 	set_bit(FLAG_FORCE_ACTIVE, &chan->flags);  in l2cap_chan_set_defaults()
558 static void l2cap_le_flowctl_init(struct l2cap_chan *chan, u16 tx_credits)  in l2cap_le_flowctl_init()  argument
560 	chan->sdu = NULL;  in l2cap_le_flowctl_init()
561 	chan->sdu_last_frag = NULL;  in l2cap_le_flowctl_init()
562 	chan->sdu_len = 0;  in l2cap_le_flowctl_init()
563 	chan->tx_credits = tx_credits;  in l2cap_le_flowctl_init()
565 	chan->mps = min_t(u16, chan->imtu, chan->conn->mtu - L2CAP_HDR_SIZE);  in l2cap_le_flowctl_init()
567 	chan->rx_credits = (chan->imtu / chan->mps) + 1;  in l2cap_le_flowctl_init()
569 	skb_queue_head_init(&chan->tx_q);  in l2cap_le_flowctl_init()
572 static void l2cap_ecred_init(struct l2cap_chan *chan, u16 tx_credits)  in l2cap_ecred_init()  argument
574 	l2cap_le_flowctl_init(chan, tx_credits);  in l2cap_ecred_init()
577 	if (chan->mps < L2CAP_ECRED_MIN_MPS) {  in l2cap_ecred_init()
578 		chan->mps = L2CAP_ECRED_MIN_MPS;  in l2cap_ecred_init()
579 		chan->rx_credits = (chan->imtu / chan->mps) + 1;  in l2cap_ecred_init()
583 void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)  in __l2cap_chan_add()  argument
586 	       __le16_to_cpu(chan->psm), chan->dcid);  in __l2cap_chan_add()
590 	chan->conn = conn;  in __l2cap_chan_add()
592 	switch (chan->chan_type) {  in __l2cap_chan_add()
595 		chan->scid = l2cap_alloc_cid(conn);  in __l2cap_chan_add()
597 			chan->omtu = L2CAP_DEFAULT_MTU;  in __l2cap_chan_add()
602 		chan->scid = L2CAP_CID_CONN_LESS;  in __l2cap_chan_add()
603 		chan->dcid = L2CAP_CID_CONN_LESS;  in __l2cap_chan_add()
604 		chan->omtu = L2CAP_DEFAULT_MTU;  in __l2cap_chan_add()
613 		chan->scid = L2CAP_CID_SIGNALING;  in __l2cap_chan_add()
614 		chan->dcid = L2CAP_CID_SIGNALING;  in __l2cap_chan_add()
615 		chan->omtu = L2CAP_DEFAULT_MTU;  in __l2cap_chan_add()
618 	chan->local_id		= L2CAP_BESTEFFORT_ID;  in __l2cap_chan_add()
619 	chan->local_stype	= L2CAP_SERV_BESTEFFORT;  in __l2cap_chan_add()
620 	chan->local_msdu	= L2CAP_DEFAULT_MAX_SDU_SIZE;  in __l2cap_chan_add()
621 	chan->local_sdu_itime	= L2CAP_DEFAULT_SDU_ITIME;  in __l2cap_chan_add()
622 	chan->local_acc_lat	= L2CAP_DEFAULT_ACC_LAT;  in __l2cap_chan_add()
623 	chan->local_flush_to	= L2CAP_EFS_DEFAULT_FLUSH_TO;  in __l2cap_chan_add()
625 	l2cap_chan_hold(chan);  in __l2cap_chan_add()
628 	if (chan->chan_type != L2CAP_CHAN_FIXED ||  in __l2cap_chan_add()
629 	    test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))  in __l2cap_chan_add()
632 	list_add(&chan->list, &conn->chan_l);  in __l2cap_chan_add()
635 void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)  in l2cap_chan_add()  argument
638 	__l2cap_chan_add(conn, chan);  in l2cap_chan_add()
642 void l2cap_chan_del(struct l2cap_chan *chan, int err)  in l2cap_chan_del()  argument
644 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_del()
646 	__clear_chan_timer(chan);  in l2cap_chan_del()
648 	BT_DBG("chan %p, conn %p, err %d, state %s", chan, conn, err,  in l2cap_chan_del()
649 	       state_to_string(chan->state));  in l2cap_chan_del()
651 	chan->ops->teardown(chan, err);  in l2cap_chan_del()
656 		list_del(&chan->list);  in l2cap_chan_del()
658 		l2cap_chan_put(chan);  in l2cap_chan_del()
660 		chan->conn = NULL;  in l2cap_chan_del()
666 		if (chan->chan_type != L2CAP_CHAN_FIXED ||  in l2cap_chan_del()
667 		    test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))  in l2cap_chan_del()
670 		if (mgr && mgr->bredr_chan == chan)  in l2cap_chan_del()
674 	if (chan->hs_hchan) {  in l2cap_chan_del()
675 		struct hci_chan *hs_hchan = chan->hs_hchan;  in l2cap_chan_del()
677 		BT_DBG("chan %p disconnect hs_hchan %p", chan, hs_hchan);  in l2cap_chan_del()
681 	if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))  in l2cap_chan_del()
684 	switch (chan->mode) {  in l2cap_chan_del()
690 		skb_queue_purge(&chan->tx_q);  in l2cap_chan_del()
694 		__clear_retrans_timer(chan);  in l2cap_chan_del()
695 		__clear_monitor_timer(chan);  in l2cap_chan_del()
696 		__clear_ack_timer(chan);  in l2cap_chan_del()
698 		skb_queue_purge(&chan->srej_q);  in l2cap_chan_del()
700 		l2cap_seq_list_free(&chan->srej_list);  in l2cap_chan_del()
701 		l2cap_seq_list_free(&chan->retrans_list);  in l2cap_chan_del()
705 		skb_queue_purge(&chan->tx_q);  in l2cap_chan_del()
714 	struct l2cap_chan *chan;  in __l2cap_chan_list()  local
716 	list_for_each_entry(chan, &conn->chan_l, list) {  in __l2cap_chan_list()
717 		func(chan, data);  in __l2cap_chan_list()
739 	struct l2cap_chan *chan;  in l2cap_conn_update_id_addr()  local
743 	list_for_each_entry(chan, &conn->chan_l, list) {  in l2cap_conn_update_id_addr()
744 		l2cap_chan_lock(chan);  in l2cap_conn_update_id_addr()
745 		bacpy(&chan->dst, &hcon->dst);  in l2cap_conn_update_id_addr()
746 		chan->dst_type = bdaddr_dst_type(hcon);  in l2cap_conn_update_id_addr()
747 		l2cap_chan_unlock(chan);  in l2cap_conn_update_id_addr()
753 static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan)  in l2cap_chan_le_connect_reject()  argument
755 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_le_connect_reject()
759 	if (test_bit(FLAG_DEFER_SETUP, &chan->flags))  in l2cap_chan_le_connect_reject()
764 	l2cap_state_change(chan, BT_DISCONN);  in l2cap_chan_le_connect_reject()
766 	rsp.dcid    = cpu_to_le16(chan->scid);  in l2cap_chan_le_connect_reject()
767 	rsp.mtu     = cpu_to_le16(chan->imtu);  in l2cap_chan_le_connect_reject()
768 	rsp.mps     = cpu_to_le16(chan->mps);  in l2cap_chan_le_connect_reject()
769 	rsp.credits = cpu_to_le16(chan->rx_credits);  in l2cap_chan_le_connect_reject()
772 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),  in l2cap_chan_le_connect_reject()
776 static void l2cap_chan_ecred_connect_reject(struct l2cap_chan *chan)  in l2cap_chan_ecred_connect_reject()  argument
778 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_ecred_connect_reject()
782 	if (test_bit(FLAG_DEFER_SETUP, &chan->flags))  in l2cap_chan_ecred_connect_reject()
787 	l2cap_state_change(chan, BT_DISCONN);  in l2cap_chan_ecred_connect_reject()
793 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),  in l2cap_chan_ecred_connect_reject()
797 static void l2cap_chan_connect_reject(struct l2cap_chan *chan)  in l2cap_chan_connect_reject()  argument
799 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_connect_reject()
803 	if (test_bit(FLAG_DEFER_SETUP, &chan->flags))  in l2cap_chan_connect_reject()
808 	l2cap_state_change(chan, BT_DISCONN);  in l2cap_chan_connect_reject()
810 	rsp.scid   = cpu_to_le16(chan->dcid);  in l2cap_chan_connect_reject()
811 	rsp.dcid   = cpu_to_le16(chan->scid);  in l2cap_chan_connect_reject()
815 	l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);  in l2cap_chan_connect_reject()
818 void l2cap_chan_close(struct l2cap_chan *chan, int reason)  in l2cap_chan_close()  argument
820 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_close()
822 	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));  in l2cap_chan_close()
824 	switch (chan->state) {  in l2cap_chan_close()
826 		chan->ops->teardown(chan, 0);  in l2cap_chan_close()
831 		if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {  in l2cap_chan_close()
832 			__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));  in l2cap_chan_close()
833 			l2cap_send_disconn_req(chan, reason);  in l2cap_chan_close()
835 			l2cap_chan_del(chan, reason);  in l2cap_chan_close()
839 		if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {  in l2cap_chan_close()
841 				l2cap_chan_connect_reject(chan);  in l2cap_chan_close()
843 				switch (chan->mode) {  in l2cap_chan_close()
845 					l2cap_chan_le_connect_reject(chan);  in l2cap_chan_close()
848 					l2cap_chan_ecred_connect_reject(chan);  in l2cap_chan_close()
854 		l2cap_chan_del(chan, reason);  in l2cap_chan_close()
859 		l2cap_chan_del(chan, reason);  in l2cap_chan_close()
863 		chan->ops->teardown(chan, 0);  in l2cap_chan_close()
869 static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)  in l2cap_get_auth_type()  argument
871 	switch (chan->chan_type) {  in l2cap_get_auth_type()
873 		switch (chan->sec_level) {  in l2cap_get_auth_type()
884 		if (chan->psm == cpu_to_le16(L2CAP_PSM_3DSP)) {  in l2cap_get_auth_type()
885 			if (chan->sec_level == BT_SECURITY_LOW)  in l2cap_get_auth_type()
886 				chan->sec_level = BT_SECURITY_SDP;  in l2cap_get_auth_type()
888 		if (chan->sec_level == BT_SECURITY_HIGH ||  in l2cap_get_auth_type()
889 		    chan->sec_level == BT_SECURITY_FIPS)  in l2cap_get_auth_type()
895 		if (chan->psm == cpu_to_le16(L2CAP_PSM_SDP)) {  in l2cap_get_auth_type()
896 			if (chan->sec_level == BT_SECURITY_LOW)  in l2cap_get_auth_type()
897 				chan->sec_level = BT_SECURITY_SDP;  in l2cap_get_auth_type()
899 			if (chan->sec_level == BT_SECURITY_HIGH ||  in l2cap_get_auth_type()
900 			    chan->sec_level == BT_SECURITY_FIPS)  in l2cap_get_auth_type()
908 		switch (chan->sec_level) {  in l2cap_get_auth_type()
922 int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator)  in l2cap_chan_check_security()  argument
924 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_check_security()
928 		return smp_conn_security(conn->hcon, chan->sec_level);  in l2cap_chan_check_security()
930 	auth_type = l2cap_get_auth_type(chan);  in l2cap_chan_check_security()
932 	return hci_conn_security(conn->hcon, chan->sec_level, auth_type,  in l2cap_chan_check_security()
983 static bool __chan_is_moving(struct l2cap_chan *chan)  in __chan_is_moving()  argument
985 	return chan->move_state != L2CAP_MOVE_STABLE &&  in __chan_is_moving()
986 	       chan->move_state != L2CAP_MOVE_WAIT_PREPARE;  in __chan_is_moving()
989 static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)  in l2cap_do_send()  argument
991 	struct hci_conn *hcon = chan->conn->hcon;  in l2cap_do_send()
994 	BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,  in l2cap_do_send()
997 	if (chan->hs_hcon && !__chan_is_moving(chan)) {  in l2cap_do_send()
998 		if (chan->hs_hchan)  in l2cap_do_send()
999 			hci_send_acl(chan->hs_hchan, skb, ACL_COMPLETE);  in l2cap_do_send()
1011 	    (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&  in l2cap_do_send()
1017 	bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);  in l2cap_do_send()
1018 	hci_send_acl(chan->conn->hchan, skb, flags);  in l2cap_do_send()
1069 static inline void __unpack_control(struct l2cap_chan *chan,  in __unpack_control()  argument
1072 	if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {  in __unpack_control()
1121 static inline void __pack_control(struct l2cap_chan *chan,  in __pack_control()  argument
1125 	if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {  in __pack_control()
1134 static inline unsigned int __ertm_hdr_size(struct l2cap_chan *chan)  in __ertm_hdr_size()  argument
1136 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in __ertm_hdr_size()
1142 static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan,  in l2cap_create_sframe_pdu()  argument
1147 	int hlen = __ertm_hdr_size(chan);  in l2cap_create_sframe_pdu()
1149 	if (chan->fcs == L2CAP_FCS_CRC16)  in l2cap_create_sframe_pdu()
1159 	lh->cid = cpu_to_le16(chan->dcid);  in l2cap_create_sframe_pdu()
1161 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_create_sframe_pdu()
1166 	if (chan->fcs == L2CAP_FCS_CRC16) {  in l2cap_create_sframe_pdu()
1175 static void l2cap_send_sframe(struct l2cap_chan *chan,  in l2cap_send_sframe()  argument
1181 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_send_sframe()
1186 	if (__chan_is_moving(chan))  in l2cap_send_sframe()
1189 	if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) &&  in l2cap_send_sframe()
1194 		clear_bit(CONN_RNR_SENT, &chan->conn_state);  in l2cap_send_sframe()
1196 		set_bit(CONN_RNR_SENT, &chan->conn_state);  in l2cap_send_sframe()
1199 		chan->last_acked_seq = control->reqseq;  in l2cap_send_sframe()
1200 		__clear_ack_timer(chan);  in l2cap_send_sframe()
1206 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_send_sframe()
1211 	skb = l2cap_create_sframe_pdu(chan, control_field);  in l2cap_send_sframe()
1213 		l2cap_do_send(chan, skb);  in l2cap_send_sframe()
1216 static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll)  in l2cap_send_rr_or_rnr()  argument
1220 	BT_DBG("chan %p, poll %d", chan, poll);  in l2cap_send_rr_or_rnr()
1226 	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state))  in l2cap_send_rr_or_rnr()
1231 	control.reqseq = chan->buffer_seq;  in l2cap_send_rr_or_rnr()
1232 	l2cap_send_sframe(chan, &control);  in l2cap_send_rr_or_rnr()
1235 static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)  in __l2cap_no_conn_pending()  argument
1237 	if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)  in __l2cap_no_conn_pending()
1240 	return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);  in __l2cap_no_conn_pending()
1243 static bool __amp_capable(struct l2cap_chan *chan)  in __amp_capable()  argument
1245 	struct l2cap_conn *conn = chan->conn;  in __amp_capable()
1265 	if (chan->chan_policy == BT_CHANNEL_POLICY_AMP_PREFERRED)  in __amp_capable()
1271 static bool l2cap_check_efs(struct l2cap_chan *chan)  in l2cap_check_efs()  argument
1277 void l2cap_send_conn_req(struct l2cap_chan *chan)  in l2cap_send_conn_req()  argument
1279 	struct l2cap_conn *conn = chan->conn;  in l2cap_send_conn_req()
1282 	req.scid = cpu_to_le16(chan->scid);  in l2cap_send_conn_req()
1283 	req.psm  = chan->psm;  in l2cap_send_conn_req()
1285 	chan->ident = l2cap_get_ident(conn);  in l2cap_send_conn_req()
1287 	set_bit(CONF_CONNECT_PEND, &chan->conf_state);  in l2cap_send_conn_req()
1289 	l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);  in l2cap_send_conn_req()
1292 static void l2cap_send_create_chan_req(struct l2cap_chan *chan, u8 amp_id)  in l2cap_send_create_chan_req()  argument
1295 	req.scid = cpu_to_le16(chan->scid);  in l2cap_send_create_chan_req()
1296 	req.psm  = chan->psm;  in l2cap_send_create_chan_req()
1299 	chan->ident = l2cap_get_ident(chan->conn);  in l2cap_send_create_chan_req()
1301 	l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_REQ,  in l2cap_send_create_chan_req()
1305 static void l2cap_move_setup(struct l2cap_chan *chan)  in l2cap_move_setup()  argument
1309 	BT_DBG("chan %p", chan);  in l2cap_move_setup()
1311 	if (chan->mode != L2CAP_MODE_ERTM)  in l2cap_move_setup()
1314 	__clear_retrans_timer(chan);  in l2cap_move_setup()
1315 	__clear_monitor_timer(chan);  in l2cap_move_setup()
1316 	__clear_ack_timer(chan);  in l2cap_move_setup()
1318 	chan->retry_count = 0;  in l2cap_move_setup()
1319 	skb_queue_walk(&chan->tx_q, skb) {  in l2cap_move_setup()
1326 	chan->expected_tx_seq = chan->buffer_seq;  in l2cap_move_setup()
1328 	clear_bit(CONN_REJ_ACT, &chan->conn_state);  in l2cap_move_setup()
1329 	clear_bit(CONN_SREJ_ACT, &chan->conn_state);  in l2cap_move_setup()
1330 	l2cap_seq_list_clear(&chan->retrans_list);  in l2cap_move_setup()
1331 	l2cap_seq_list_clear(&chan->srej_list);  in l2cap_move_setup()
1332 	skb_queue_purge(&chan->srej_q);  in l2cap_move_setup()
1334 	chan->tx_state = L2CAP_TX_STATE_XMIT;  in l2cap_move_setup()
1335 	chan->rx_state = L2CAP_RX_STATE_MOVE;  in l2cap_move_setup()
1337 	set_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_move_setup()
1340 static void l2cap_move_done(struct l2cap_chan *chan)  in l2cap_move_done()  argument
1342 	u8 move_role = chan->move_role;  in l2cap_move_done()
1343 	BT_DBG("chan %p", chan);  in l2cap_move_done()
1345 	chan->move_state = L2CAP_MOVE_STABLE;  in l2cap_move_done()
1346 	chan->move_role = L2CAP_MOVE_ROLE_NONE;  in l2cap_move_done()
1348 	if (chan->mode != L2CAP_MODE_ERTM)  in l2cap_move_done()
1353 		l2cap_tx(chan, NULL, NULL, L2CAP_EV_EXPLICIT_POLL);  in l2cap_move_done()
1354 		chan->rx_state = L2CAP_RX_STATE_WAIT_F;  in l2cap_move_done()
1357 		chan->rx_state = L2CAP_RX_STATE_WAIT_P;  in l2cap_move_done()
1362 static void l2cap_chan_ready(struct l2cap_chan *chan)  in l2cap_chan_ready()  argument
1368 	if (chan->state == BT_CONNECTED)  in l2cap_chan_ready()
1372 	chan->conf_state = 0;  in l2cap_chan_ready()
1373 	__clear_chan_timer(chan);  in l2cap_chan_ready()
1375 	switch (chan->mode) {  in l2cap_chan_ready()
1378 		if (!chan->tx_credits)  in l2cap_chan_ready()
1379 			chan->ops->suspend(chan);  in l2cap_chan_ready()
1383 	chan->state = BT_CONNECTED;  in l2cap_chan_ready()
1385 	chan->ops->ready(chan);  in l2cap_chan_ready()
1388 static void l2cap_le_connect(struct l2cap_chan *chan)  in l2cap_le_connect()  argument
1390 	struct l2cap_conn *conn = chan->conn;  in l2cap_le_connect()
1393 	if (test_and_set_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags))  in l2cap_le_connect()
1396 	if (!chan->imtu)  in l2cap_le_connect()
1397 		chan->imtu = chan->conn->mtu;  in l2cap_le_connect()
1399 	l2cap_le_flowctl_init(chan, 0);  in l2cap_le_connect()
1402 	req.psm     = chan->psm;  in l2cap_le_connect()
1403 	req.scid    = cpu_to_le16(chan->scid);  in l2cap_le_connect()
1404 	req.mtu     = cpu_to_le16(chan->imtu);  in l2cap_le_connect()
1405 	req.mps     = cpu_to_le16(chan->mps);  in l2cap_le_connect()
1406 	req.credits = cpu_to_le16(chan->rx_credits);  in l2cap_le_connect()
1408 	chan->ident = l2cap_get_ident(conn);  in l2cap_le_connect()
1410 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_REQ,  in l2cap_le_connect()
1419 	struct l2cap_chan *chan;  member
1424 static void l2cap_ecred_defer_connect(struct l2cap_chan *chan, void *data)  in l2cap_ecred_defer_connect()  argument
1429 	if (chan == conn->chan)  in l2cap_ecred_defer_connect()
1432 	if (!test_and_clear_bit(FLAG_DEFER_SETUP, &chan->flags))  in l2cap_ecred_defer_connect()
1435 	pid = chan->ops->get_peer_pid(chan);  in l2cap_ecred_defer_connect()
1438 	if (conn->pid != pid || chan->psm != conn->chan->psm || chan->ident ||  in l2cap_ecred_defer_connect()
1439 	    chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT)  in l2cap_ecred_defer_connect()
1442 	if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))  in l2cap_ecred_defer_connect()
1445 	l2cap_ecred_init(chan, 0);  in l2cap_ecred_defer_connect()
1448 	chan->ident = conn->chan->ident;  in l2cap_ecred_defer_connect()
1451 	conn->pdu.scid[conn->count] = cpu_to_le16(chan->scid);  in l2cap_ecred_defer_connect()
1456 static void l2cap_ecred_connect(struct l2cap_chan *chan)  in l2cap_ecred_connect()  argument
1458 	struct l2cap_conn *conn = chan->conn;  in l2cap_ecred_connect()
1461 	if (test_bit(FLAG_DEFER_SETUP, &chan->flags))  in l2cap_ecred_connect()
1464 	if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))  in l2cap_ecred_connect()
1467 	l2cap_ecred_init(chan, 0);  in l2cap_ecred_connect()
1470 	data.pdu.req.psm     = chan->psm;  in l2cap_ecred_connect()
1471 	data.pdu.req.mtu     = cpu_to_le16(chan->imtu);  in l2cap_ecred_connect()
1472 	data.pdu.req.mps     = cpu_to_le16(chan->mps);  in l2cap_ecred_connect()
1473 	data.pdu.req.credits = cpu_to_le16(chan->rx_credits);  in l2cap_ecred_connect()
1474 	data.pdu.scid[0]     = cpu_to_le16(chan->scid);  in l2cap_ecred_connect()
1476 	chan->ident = l2cap_get_ident(conn);  in l2cap_ecred_connect()
1479 	data.chan = chan;  in l2cap_ecred_connect()
1480 	data.pid = chan->ops->get_peer_pid(chan);  in l2cap_ecred_connect()
1484 	l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_CONN_REQ,  in l2cap_ecred_connect()
1489 static void l2cap_le_start(struct l2cap_chan *chan)  in l2cap_le_start()  argument
1491 	struct l2cap_conn *conn = chan->conn;  in l2cap_le_start()
1493 	if (!smp_conn_security(conn->hcon, chan->sec_level))  in l2cap_le_start()
1496 	if (!chan->psm) {  in l2cap_le_start()
1497 		l2cap_chan_ready(chan);  in l2cap_le_start()
1501 	if (chan->state == BT_CONNECT) {  in l2cap_le_start()
1502 		if (chan->mode == L2CAP_MODE_EXT_FLOWCTL)  in l2cap_le_start()
1503 			l2cap_ecred_connect(chan);  in l2cap_le_start()
1505 			l2cap_le_connect(chan);  in l2cap_le_start()
1509 static void l2cap_start_connection(struct l2cap_chan *chan)  in l2cap_start_connection()  argument
1511 	if (__amp_capable(chan)) {  in l2cap_start_connection()
1512 		BT_DBG("chan %p AMP capable: discover AMPs", chan);  in l2cap_start_connection()
1513 		a2mp_discover_amp(chan);  in l2cap_start_connection()
1514 	} else if (chan->conn->hcon->type == LE_LINK) {  in l2cap_start_connection()
1515 		l2cap_le_start(chan);  in l2cap_start_connection()
1517 		l2cap_send_conn_req(chan);  in l2cap_start_connection()
1560 static void l2cap_do_start(struct l2cap_chan *chan)  in l2cap_do_start()  argument
1562 	struct l2cap_conn *conn = chan->conn;  in l2cap_do_start()
1565 		l2cap_le_start(chan);  in l2cap_do_start()
1577 	if (!l2cap_chan_check_security(chan, true) ||  in l2cap_do_start()
1578 	    !__l2cap_no_conn_pending(chan))  in l2cap_do_start()
1582 		l2cap_start_connection(chan);  in l2cap_do_start()
1584 		__set_chan_timer(chan, L2CAP_DISC_TIMEOUT);  in l2cap_do_start()
1603 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err)  in l2cap_send_disconn_req()  argument
1605 	struct l2cap_conn *conn = chan->conn;  in l2cap_send_disconn_req()
1611 	if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) {  in l2cap_send_disconn_req()
1612 		__clear_retrans_timer(chan);  in l2cap_send_disconn_req()
1613 		__clear_monitor_timer(chan);  in l2cap_send_disconn_req()
1614 		__clear_ack_timer(chan);  in l2cap_send_disconn_req()
1617 	if (chan->scid == L2CAP_CID_A2MP) {  in l2cap_send_disconn_req()
1618 		l2cap_state_change(chan, BT_DISCONN);  in l2cap_send_disconn_req()
1622 	req.dcid = cpu_to_le16(chan->dcid);  in l2cap_send_disconn_req()
1623 	req.scid = cpu_to_le16(chan->scid);  in l2cap_send_disconn_req()
1627 	l2cap_state_change_and_error(chan, BT_DISCONN, err);  in l2cap_send_disconn_req()
1633 	struct l2cap_chan *chan, *tmp;  in l2cap_conn_start()  local
1639 	list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {  in l2cap_conn_start()
1640 		l2cap_chan_lock(chan);  in l2cap_conn_start()
1642 		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {  in l2cap_conn_start()
1643 			l2cap_chan_ready(chan);  in l2cap_conn_start()
1644 			l2cap_chan_unlock(chan);  in l2cap_conn_start()
1648 		if (chan->state == BT_CONNECT) {  in l2cap_conn_start()
1649 			if (!l2cap_chan_check_security(chan, true) ||  in l2cap_conn_start()
1650 			    !__l2cap_no_conn_pending(chan)) {  in l2cap_conn_start()
1651 				l2cap_chan_unlock(chan);  in l2cap_conn_start()
1655 			if (!l2cap_mode_supported(chan->mode, conn->feat_mask)  in l2cap_conn_start()
1657 					&chan->conf_state)) {  in l2cap_conn_start()
1658 				l2cap_chan_close(chan, ECONNRESET);  in l2cap_conn_start()
1659 				l2cap_chan_unlock(chan);  in l2cap_conn_start()
1664 				l2cap_start_connection(chan);  in l2cap_conn_start()
1666 				l2cap_chan_close(chan, ECONNREFUSED);  in l2cap_conn_start()
1668 		} else if (chan->state == BT_CONNECT2) {  in l2cap_conn_start()
1671 			rsp.scid = cpu_to_le16(chan->dcid);  in l2cap_conn_start()
1672 			rsp.dcid = cpu_to_le16(chan->scid);  in l2cap_conn_start()
1674 			if (l2cap_chan_check_security(chan, false)) {  in l2cap_conn_start()
1675 				if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {  in l2cap_conn_start()
1678 					chan->ops->defer(chan);  in l2cap_conn_start()
1681 					l2cap_state_change(chan, BT_CONFIG);  in l2cap_conn_start()
1690 			l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,  in l2cap_conn_start()
1693 			if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||  in l2cap_conn_start()
1695 				l2cap_chan_unlock(chan);  in l2cap_conn_start()
1699 			set_bit(CONF_REQ_SENT, &chan->conf_state);  in l2cap_conn_start()
1701 				       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);  in l2cap_conn_start()
1702 			chan->num_conf_req++;  in l2cap_conn_start()
1705 		l2cap_chan_unlock(chan);  in l2cap_conn_start()
1746 	struct l2cap_chan *chan;  in l2cap_conn_ready()  local
1756 	list_for_each_entry(chan, &conn->chan_l, list) {  in l2cap_conn_ready()
1758 		l2cap_chan_lock(chan);  in l2cap_conn_ready()
1760 		if (chan->scid == L2CAP_CID_A2MP) {  in l2cap_conn_ready()
1761 			l2cap_chan_unlock(chan);  in l2cap_conn_ready()
1766 			l2cap_le_start(chan);  in l2cap_conn_ready()
1767 		} else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {  in l2cap_conn_ready()
1769 				l2cap_chan_ready(chan);  in l2cap_conn_ready()
1770 		} else if (chan->state == BT_CONNECT) {  in l2cap_conn_ready()
1771 			l2cap_do_start(chan);  in l2cap_conn_ready()
1774 		l2cap_chan_unlock(chan);  in l2cap_conn_ready()
1788 	struct l2cap_chan *chan;  in l2cap_conn_unreliable()  local
1794 	list_for_each_entry(chan, &conn->chan_l, list) {  in l2cap_conn_unreliable()
1795 		if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))  in l2cap_conn_unreliable()
1796 			l2cap_chan_set_err(chan, err);  in l2cap_conn_unreliable()
1895 	struct l2cap_chan *chan, *l;  in l2cap_conn_del()  local
1924 	list_for_each_entry_safe(chan, l, &conn->chan_l, list) {  in l2cap_conn_del()
1925 		l2cap_chan_hold(chan);  in l2cap_conn_del()
1926 		l2cap_chan_lock(chan);  in l2cap_conn_del()
1928 		l2cap_chan_del(chan, err);  in l2cap_conn_del()
1930 		chan->ops->close(chan);  in l2cap_conn_del()
1932 		l2cap_chan_unlock(chan);  in l2cap_conn_del()
1933 		l2cap_chan_put(chan);  in l2cap_conn_del()
2027 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,  in l2cap_monitor_timeout()  local
2030 	BT_DBG("chan %p", chan);  in l2cap_monitor_timeout()
2032 	l2cap_chan_lock(chan);  in l2cap_monitor_timeout()
2034 	if (!chan->conn) {  in l2cap_monitor_timeout()
2035 		l2cap_chan_unlock(chan);  in l2cap_monitor_timeout()
2036 		l2cap_chan_put(chan);  in l2cap_monitor_timeout()
2040 	l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO);  in l2cap_monitor_timeout()
2042 	l2cap_chan_unlock(chan);  in l2cap_monitor_timeout()
2043 	l2cap_chan_put(chan);  in l2cap_monitor_timeout()
2048 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,  in l2cap_retrans_timeout()  local
2051 	BT_DBG("chan %p", chan);  in l2cap_retrans_timeout()
2053 	l2cap_chan_lock(chan);  in l2cap_retrans_timeout()
2055 	if (!chan->conn) {  in l2cap_retrans_timeout()
2056 		l2cap_chan_unlock(chan);  in l2cap_retrans_timeout()
2057 		l2cap_chan_put(chan);  in l2cap_retrans_timeout()
2061 	l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO);  in l2cap_retrans_timeout()
2062 	l2cap_chan_unlock(chan);  in l2cap_retrans_timeout()
2063 	l2cap_chan_put(chan);  in l2cap_retrans_timeout()
2066 static void l2cap_streaming_send(struct l2cap_chan *chan,  in l2cap_streaming_send()  argument
2072 	BT_DBG("chan %p, skbs %p", chan, skbs);  in l2cap_streaming_send()
2074 	if (__chan_is_moving(chan))  in l2cap_streaming_send()
2077 	skb_queue_splice_tail_init(skbs, &chan->tx_q);  in l2cap_streaming_send()
2079 	while (!skb_queue_empty(&chan->tx_q)) {  in l2cap_streaming_send()
2081 		skb = skb_dequeue(&chan->tx_q);  in l2cap_streaming_send()
2087 		control->txseq = chan->next_tx_seq;  in l2cap_streaming_send()
2089 		__pack_control(chan, control, skb);  in l2cap_streaming_send()
2091 		if (chan->fcs == L2CAP_FCS_CRC16) {  in l2cap_streaming_send()
2096 		l2cap_do_send(chan, skb);  in l2cap_streaming_send()
2100 		chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);  in l2cap_streaming_send()
2101 		chan->frames_sent++;  in l2cap_streaming_send()
2105 static int l2cap_ertm_send(struct l2cap_chan *chan)  in l2cap_ertm_send()  argument
2111 	BT_DBG("chan %p", chan);  in l2cap_ertm_send()
2113 	if (chan->state != BT_CONNECTED)  in l2cap_ertm_send()
2116 	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))  in l2cap_ertm_send()
2119 	if (__chan_is_moving(chan))  in l2cap_ertm_send()
2122 	while (chan->tx_send_head &&  in l2cap_ertm_send()
2123 	       chan->unacked_frames < chan->remote_tx_win &&  in l2cap_ertm_send()
2124 	       chan->tx_state == L2CAP_TX_STATE_XMIT) {  in l2cap_ertm_send()
2126 		skb = chan->tx_send_head;  in l2cap_ertm_send()
2131 		if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))  in l2cap_ertm_send()
2134 		control->reqseq = chan->buffer_seq;  in l2cap_ertm_send()
2135 		chan->last_acked_seq = chan->buffer_seq;  in l2cap_ertm_send()
2136 		control->txseq = chan->next_tx_seq;  in l2cap_ertm_send()
2138 		__pack_control(chan, control, skb);  in l2cap_ertm_send()
2140 		if (chan->fcs == L2CAP_FCS_CRC16) {  in l2cap_ertm_send()
2153 		__set_retrans_timer(chan);  in l2cap_ertm_send()
2155 		chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);  in l2cap_ertm_send()
2156 		chan->unacked_frames++;  in l2cap_ertm_send()
2157 		chan->frames_sent++;  in l2cap_ertm_send()
2160 		if (skb_queue_is_last(&chan->tx_q, skb))  in l2cap_ertm_send()
2161 			chan->tx_send_head = NULL;  in l2cap_ertm_send()
2163 			chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);  in l2cap_ertm_send()
2165 		l2cap_do_send(chan, tx_skb);  in l2cap_ertm_send()
2170 	       chan->unacked_frames, skb_queue_len(&chan->tx_q));  in l2cap_ertm_send()
2175 static void l2cap_ertm_resend(struct l2cap_chan *chan)  in l2cap_ertm_resend()  argument
2182 	BT_DBG("chan %p", chan);  in l2cap_ertm_resend()
2184 	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))  in l2cap_ertm_resend()
2187 	if (__chan_is_moving(chan))  in l2cap_ertm_resend()
2190 	while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) {  in l2cap_ertm_resend()
2191 		seq = l2cap_seq_list_pop(&chan->retrans_list);  in l2cap_ertm_resend()
2193 		skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq);  in l2cap_ertm_resend()
2203 		if (chan->max_tx != 0 &&  in l2cap_ertm_resend()
2204 		    bt_cb(skb)->l2cap.retries > chan->max_tx) {  in l2cap_ertm_resend()
2205 			BT_DBG("Retry limit exceeded (%d)", chan->max_tx);  in l2cap_ertm_resend()
2206 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_ertm_resend()
2207 			l2cap_seq_list_clear(&chan->retrans_list);  in l2cap_ertm_resend()
2211 		control.reqseq = chan->buffer_seq;  in l2cap_ertm_resend()
2212 		if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))  in l2cap_ertm_resend()
2227 			l2cap_seq_list_clear(&chan->retrans_list);  in l2cap_ertm_resend()
2232 		if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {  in l2cap_ertm_resend()
2241 		if (chan->fcs == L2CAP_FCS_CRC16) {  in l2cap_ertm_resend()
2248 		l2cap_do_send(chan, tx_skb);  in l2cap_ertm_resend()
2252 		chan->last_acked_seq = chan->buffer_seq;  in l2cap_ertm_resend()
2256 static void l2cap_retransmit(struct l2cap_chan *chan,  in l2cap_retransmit()  argument
2259 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_retransmit()
2261 	l2cap_seq_list_append(&chan->retrans_list, control->reqseq);  in l2cap_retransmit()
2262 	l2cap_ertm_resend(chan);  in l2cap_retransmit()
2265 static void l2cap_retransmit_all(struct l2cap_chan *chan,  in l2cap_retransmit_all()  argument
2270 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_retransmit_all()
2273 		set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_retransmit_all()
2275 	l2cap_seq_list_clear(&chan->retrans_list);  in l2cap_retransmit_all()
2277 	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))  in l2cap_retransmit_all()
2280 	if (chan->unacked_frames) {  in l2cap_retransmit_all()
2281 		skb_queue_walk(&chan->tx_q, skb) {  in l2cap_retransmit_all()
2283 			    skb == chan->tx_send_head)  in l2cap_retransmit_all()
2287 		skb_queue_walk_from(&chan->tx_q, skb) {  in l2cap_retransmit_all()
2288 			if (skb == chan->tx_send_head)  in l2cap_retransmit_all()
2291 			l2cap_seq_list_append(&chan->retrans_list,  in l2cap_retransmit_all()
2295 		l2cap_ertm_resend(chan);  in l2cap_retransmit_all()
2299 static void l2cap_send_ack(struct l2cap_chan *chan)  in l2cap_send_ack()  argument
2302 	u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq,  in l2cap_send_ack()
2303 					 chan->last_acked_seq);  in l2cap_send_ack()
2307 	       chan, chan->last_acked_seq, chan->buffer_seq);  in l2cap_send_ack()
2312 	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&  in l2cap_send_ack()
2313 	    chan->rx_state == L2CAP_RX_STATE_RECV) {  in l2cap_send_ack()
2314 		__clear_ack_timer(chan);  in l2cap_send_ack()
2316 		control.reqseq = chan->buffer_seq;  in l2cap_send_ack()
2317 		l2cap_send_sframe(chan, &control);  in l2cap_send_ack()
2319 		if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) {  in l2cap_send_ack()
2320 			l2cap_ertm_send(chan);  in l2cap_send_ack()
2322 			if (chan->buffer_seq == chan->last_acked_seq)  in l2cap_send_ack()
2329 		threshold = chan->ack_win;  in l2cap_send_ack()
2337 			__clear_ack_timer(chan);  in l2cap_send_ack()
2339 			control.reqseq = chan->buffer_seq;  in l2cap_send_ack()
2340 			l2cap_send_sframe(chan, &control);  in l2cap_send_ack()
2345 			__set_ack_timer(chan);  in l2cap_send_ack()
2349 static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,  in l2cap_skbuff_fromiovec()  argument
2353 	struct l2cap_conn *conn = chan->conn;  in l2cap_skbuff_fromiovec()
2370 		tmp = chan->ops->alloc_skb(chan, 0, count,  in l2cap_skbuff_fromiovec()
2393 static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,  in l2cap_create_connless_pdu()  argument
2396 	struct l2cap_conn *conn = chan->conn;  in l2cap_create_connless_pdu()
2401 	BT_DBG("chan %p psm 0x%2.2x len %zu", chan,  in l2cap_create_connless_pdu()
2402 	       __le16_to_cpu(chan->psm), len);  in l2cap_create_connless_pdu()
2406 	skb = chan->ops->alloc_skb(chan, hlen, count,  in l2cap_create_connless_pdu()
2413 	lh->cid = cpu_to_le16(chan->dcid);  in l2cap_create_connless_pdu()
2415 	put_unaligned(chan->psm, (__le16 *) skb_put(skb, L2CAP_PSMLEN_SIZE));  in l2cap_create_connless_pdu()
2417 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);  in l2cap_create_connless_pdu()
2425 static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,  in l2cap_create_basic_pdu()  argument
2428 	struct l2cap_conn *conn = chan->conn;  in l2cap_create_basic_pdu()
2433 	BT_DBG("chan %p len %zu", chan, len);  in l2cap_create_basic_pdu()
2437 	skb = chan->ops->alloc_skb(chan, L2CAP_HDR_SIZE, count,  in l2cap_create_basic_pdu()
2444 	lh->cid = cpu_to_le16(chan->dcid);  in l2cap_create_basic_pdu()
2447 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);  in l2cap_create_basic_pdu()
2455 static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,  in l2cap_create_iframe_pdu()  argument
2459 	struct l2cap_conn *conn = chan->conn;  in l2cap_create_iframe_pdu()
2464 	BT_DBG("chan %p len %zu", chan, len);  in l2cap_create_iframe_pdu()
2469 	hlen = __ertm_hdr_size(chan);  in l2cap_create_iframe_pdu()
2474 	if (chan->fcs == L2CAP_FCS_CRC16)  in l2cap_create_iframe_pdu()
2479 	skb = chan->ops->alloc_skb(chan, hlen, count,  in l2cap_create_iframe_pdu()
2486 	lh->cid = cpu_to_le16(chan->dcid);  in l2cap_create_iframe_pdu()
2490 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_create_iframe_pdu()
2498 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);  in l2cap_create_iframe_pdu()
2504 	bt_cb(skb)->l2cap.fcs = chan->fcs;  in l2cap_create_iframe_pdu()
2509 static int l2cap_segment_sdu(struct l2cap_chan *chan,  in l2cap_segment_sdu()  argument
2518 	BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);  in l2cap_segment_sdu()
2526 	pdu_len = chan->conn->mtu;  in l2cap_segment_sdu()
2529 	if (!chan->hs_hcon)  in l2cap_segment_sdu()
2533 	if (chan->fcs)  in l2cap_segment_sdu()
2536 	pdu_len -= __ertm_hdr_size(chan);  in l2cap_segment_sdu()
2539 	pdu_len = min_t(size_t, pdu_len, chan->remote_mps);  in l2cap_segment_sdu()
2551 		skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len);  in l2cap_segment_sdu()
2576 static struct sk_buff *l2cap_create_le_flowctl_pdu(struct l2cap_chan *chan,  in l2cap_create_le_flowctl_pdu()  argument
2580 	struct l2cap_conn *conn = chan->conn;  in l2cap_create_le_flowctl_pdu()
2585 	BT_DBG("chan %p len %zu", chan, len);  in l2cap_create_le_flowctl_pdu()
2597 	skb = chan->ops->alloc_skb(chan, hlen, count,  in l2cap_create_le_flowctl_pdu()
2604 	lh->cid = cpu_to_le16(chan->dcid);  in l2cap_create_le_flowctl_pdu()
2610 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);  in l2cap_create_le_flowctl_pdu()
2619 static int l2cap_segment_le_sdu(struct l2cap_chan *chan,  in l2cap_segment_le_sdu()  argument
2627 	BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);  in l2cap_segment_le_sdu()
2630 	pdu_len = chan->remote_mps - L2CAP_SDULEN_SIZE;  in l2cap_segment_le_sdu()
2636 		skb = l2cap_create_le_flowctl_pdu(chan, msg, pdu_len, sdu_len);  in l2cap_segment_le_sdu()
2655 static void l2cap_le_flowctl_send(struct l2cap_chan *chan)  in l2cap_le_flowctl_send()  argument
2659 	BT_DBG("chan %p", chan);  in l2cap_le_flowctl_send()
2661 	while (chan->tx_credits && !skb_queue_empty(&chan->tx_q)) {  in l2cap_le_flowctl_send()
2662 		l2cap_do_send(chan, skb_dequeue(&chan->tx_q));  in l2cap_le_flowctl_send()
2663 		chan->tx_credits--;  in l2cap_le_flowctl_send()
2667 	BT_DBG("Sent %d credits %u queued %u", sent, chan->tx_credits,  in l2cap_le_flowctl_send()
2668 	       skb_queue_len(&chan->tx_q));  in l2cap_le_flowctl_send()
2671 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)  in l2cap_chan_send()  argument
2677 	if (!chan->conn)  in l2cap_chan_send()
2681 	if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {  in l2cap_chan_send()
2682 		skb = l2cap_create_connless_pdu(chan, msg, len);  in l2cap_chan_send()
2689 		if (chan->state != BT_CONNECTED) {  in l2cap_chan_send()
2694 		l2cap_do_send(chan, skb);  in l2cap_chan_send()
2698 	switch (chan->mode) {  in l2cap_chan_send()
2702 		if (len > chan->omtu)  in l2cap_chan_send()
2707 		err = l2cap_segment_le_sdu(chan, &seg_queue, msg, len);  in l2cap_chan_send()
2709 		if (chan->state != BT_CONNECTED) {  in l2cap_chan_send()
2717 		skb_queue_splice_tail_init(&seg_queue, &chan->tx_q);  in l2cap_chan_send()
2719 		l2cap_le_flowctl_send(chan);  in l2cap_chan_send()
2721 		if (!chan->tx_credits)  in l2cap_chan_send()
2722 			chan->ops->suspend(chan);  in l2cap_chan_send()
2730 		if (len > chan->omtu)  in l2cap_chan_send()
2734 		skb = l2cap_create_basic_pdu(chan, msg, len);  in l2cap_chan_send()
2741 		if (chan->state != BT_CONNECTED) {  in l2cap_chan_send()
2746 		l2cap_do_send(chan, skb);  in l2cap_chan_send()
2753 		if (len > chan->omtu) {  in l2cap_chan_send()
2764 		err = l2cap_segment_sdu(chan, &seg_queue, msg, len);  in l2cap_chan_send()
2769 		if (chan->state != BT_CONNECTED) {  in l2cap_chan_send()
2777 		if (chan->mode == L2CAP_MODE_ERTM)  in l2cap_chan_send()
2778 			l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST);  in l2cap_chan_send()
2780 			l2cap_streaming_send(chan, &seg_queue);  in l2cap_chan_send()
2791 		BT_DBG("bad state %1.1x", chan->mode);  in l2cap_chan_send()
2799 static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq)  in l2cap_send_srej()  argument
2804 	BT_DBG("chan %p, txseq %u", chan, txseq);  in l2cap_send_srej()
2810 	for (seq = chan->expected_tx_seq; seq != txseq;  in l2cap_send_srej()
2811 	     seq = __next_seq(chan, seq)) {  in l2cap_send_srej()
2812 		if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) {  in l2cap_send_srej()
2814 			l2cap_send_sframe(chan, &control);  in l2cap_send_srej()
2815 			l2cap_seq_list_append(&chan->srej_list, seq);  in l2cap_send_srej()
2819 	chan->expected_tx_seq = __next_seq(chan, txseq);  in l2cap_send_srej()
2822 static void l2cap_send_srej_tail(struct l2cap_chan *chan)  in l2cap_send_srej_tail()  argument
2826 	BT_DBG("chan %p", chan);  in l2cap_send_srej_tail()
2828 	if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR)  in l2cap_send_srej_tail()
2834 	control.reqseq = chan->srej_list.tail;  in l2cap_send_srej_tail()
2835 	l2cap_send_sframe(chan, &control);  in l2cap_send_srej_tail()
2838 static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq)  in l2cap_send_srej_list()  argument
2844 	BT_DBG("chan %p, txseq %u", chan, txseq);  in l2cap_send_srej_list()
2851 	initial_head = chan->srej_list.head;  in l2cap_send_srej_list()
2854 		seq = l2cap_seq_list_pop(&chan->srej_list);  in l2cap_send_srej_list()
2859 		l2cap_send_sframe(chan, &control);  in l2cap_send_srej_list()
2860 		l2cap_seq_list_append(&chan->srej_list, seq);  in l2cap_send_srej_list()
2861 	} while (chan->srej_list.head != initial_head);  in l2cap_send_srej_list()
2864 static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq)  in l2cap_process_reqseq()  argument
2869 	BT_DBG("chan %p, reqseq %u", chan, reqseq);  in l2cap_process_reqseq()
2871 	if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq)  in l2cap_process_reqseq()
2875 	       chan->expected_ack_seq, chan->unacked_frames);  in l2cap_process_reqseq()
2877 	for (ackseq = chan->expected_ack_seq; ackseq != reqseq;  in l2cap_process_reqseq()
2878 	     ackseq = __next_seq(chan, ackseq)) {  in l2cap_process_reqseq()
2880 		acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq);  in l2cap_process_reqseq()
2882 			skb_unlink(acked_skb, &chan->tx_q);  in l2cap_process_reqseq()
2884 			chan->unacked_frames--;  in l2cap_process_reqseq()
2888 	chan->expected_ack_seq = reqseq;  in l2cap_process_reqseq()
2890 	if (chan->unacked_frames == 0)  in l2cap_process_reqseq()
2891 		__clear_retrans_timer(chan);  in l2cap_process_reqseq()
2893 	BT_DBG("unacked_frames %u", chan->unacked_frames);  in l2cap_process_reqseq()
2896 static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan)  in l2cap_abort_rx_srej_sent()  argument
2898 	BT_DBG("chan %p", chan);  in l2cap_abort_rx_srej_sent()
2900 	chan->expected_tx_seq = chan->buffer_seq;  in l2cap_abort_rx_srej_sent()
2901 	l2cap_seq_list_clear(&chan->srej_list);  in l2cap_abort_rx_srej_sent()
2902 	skb_queue_purge(&chan->srej_q);  in l2cap_abort_rx_srej_sent()
2903 	chan->rx_state = L2CAP_RX_STATE_RECV;  in l2cap_abort_rx_srej_sent()
2906 static void l2cap_tx_state_xmit(struct l2cap_chan *chan,  in l2cap_tx_state_xmit()  argument
2910 	BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,  in l2cap_tx_state_xmit()
2915 		if (chan->tx_send_head == NULL)  in l2cap_tx_state_xmit()
2916 			chan->tx_send_head = skb_peek(skbs);  in l2cap_tx_state_xmit()
2918 		skb_queue_splice_tail_init(skbs, &chan->tx_q);  in l2cap_tx_state_xmit()
2919 		l2cap_ertm_send(chan);  in l2cap_tx_state_xmit()
2923 		set_bit(CONN_LOCAL_BUSY, &chan->conn_state);  in l2cap_tx_state_xmit()
2925 		if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {  in l2cap_tx_state_xmit()
2929 			l2cap_abort_rx_srej_sent(chan);  in l2cap_tx_state_xmit()
2932 		l2cap_send_ack(chan);  in l2cap_tx_state_xmit()
2937 		clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);  in l2cap_tx_state_xmit()
2939 		if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {  in l2cap_tx_state_xmit()
2946 			local_control.reqseq = chan->buffer_seq;  in l2cap_tx_state_xmit()
2947 			l2cap_send_sframe(chan, &local_control);  in l2cap_tx_state_xmit()
2949 			chan->retry_count = 1;  in l2cap_tx_state_xmit()
2950 			__set_monitor_timer(chan);  in l2cap_tx_state_xmit()
2951 			chan->tx_state = L2CAP_TX_STATE_WAIT_F;  in l2cap_tx_state_xmit()
2955 		l2cap_process_reqseq(chan, control->reqseq);  in l2cap_tx_state_xmit()
2958 		l2cap_send_rr_or_rnr(chan, 1);  in l2cap_tx_state_xmit()
2959 		chan->retry_count = 1;  in l2cap_tx_state_xmit()
2960 		__set_monitor_timer(chan);  in l2cap_tx_state_xmit()
2961 		__clear_ack_timer(chan);  in l2cap_tx_state_xmit()
2962 		chan->tx_state = L2CAP_TX_STATE_WAIT_F;  in l2cap_tx_state_xmit()
2965 		l2cap_send_rr_or_rnr(chan, 1);  in l2cap_tx_state_xmit()
2966 		chan->retry_count = 1;  in l2cap_tx_state_xmit()
2967 		__set_monitor_timer(chan);  in l2cap_tx_state_xmit()
2968 		chan->tx_state = L2CAP_TX_STATE_WAIT_F;  in l2cap_tx_state_xmit()
2978 static void l2cap_tx_state_wait_f(struct l2cap_chan *chan,  in l2cap_tx_state_wait_f()  argument
2982 	BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,  in l2cap_tx_state_wait_f()
2987 		if (chan->tx_send_head == NULL)  in l2cap_tx_state_wait_f()
2988 			chan->tx_send_head = skb_peek(skbs);  in l2cap_tx_state_wait_f()
2990 		skb_queue_splice_tail_init(skbs, &chan->tx_q);  in l2cap_tx_state_wait_f()
2994 		set_bit(CONN_LOCAL_BUSY, &chan->conn_state);  in l2cap_tx_state_wait_f()
2996 		if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {  in l2cap_tx_state_wait_f()
3000 			l2cap_abort_rx_srej_sent(chan);  in l2cap_tx_state_wait_f()
3003 		l2cap_send_ack(chan);  in l2cap_tx_state_wait_f()
3008 		clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);  in l2cap_tx_state_wait_f()
3010 		if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {  in l2cap_tx_state_wait_f()
3016 			local_control.reqseq = chan->buffer_seq;  in l2cap_tx_state_wait_f()
3017 			l2cap_send_sframe(chan, &local_control);  in l2cap_tx_state_wait_f()
3019 			chan->retry_count = 1;  in l2cap_tx_state_wait_f()
3020 			__set_monitor_timer(chan);  in l2cap_tx_state_wait_f()
3021 			chan->tx_state = L2CAP_TX_STATE_WAIT_F;  in l2cap_tx_state_wait_f()
3025 		l2cap_process_reqseq(chan, control->reqseq);  in l2cap_tx_state_wait_f()
3030 			__clear_monitor_timer(chan);  in l2cap_tx_state_wait_f()
3031 			if (chan->unacked_frames > 0)  in l2cap_tx_state_wait_f()
3032 				__set_retrans_timer(chan);  in l2cap_tx_state_wait_f()
3033 			chan->retry_count = 0;  in l2cap_tx_state_wait_f()
3034 			chan->tx_state = L2CAP_TX_STATE_XMIT;  in l2cap_tx_state_wait_f()
3035 			BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state);  in l2cap_tx_state_wait_f()
3042 		if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) {  in l2cap_tx_state_wait_f()
3043 			l2cap_send_rr_or_rnr(chan, 1);  in l2cap_tx_state_wait_f()
3044 			__set_monitor_timer(chan);  in l2cap_tx_state_wait_f()
3045 			chan->retry_count++;  in l2cap_tx_state_wait_f()
3047 			l2cap_send_disconn_req(chan, ECONNABORTED);  in l2cap_tx_state_wait_f()
3055 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,  in l2cap_tx()  argument
3059 	       chan, control, skbs, event, chan->tx_state);  in l2cap_tx()
3061 	switch (chan->tx_state) {  in l2cap_tx()
3063 		l2cap_tx_state_xmit(chan, control, skbs, event);  in l2cap_tx()
3066 		l2cap_tx_state_wait_f(chan, control, skbs, event);  in l2cap_tx()
3074 static void l2cap_pass_to_tx(struct l2cap_chan *chan,  in l2cap_pass_to_tx()  argument
3077 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_pass_to_tx()
3078 	l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT);  in l2cap_pass_to_tx()
3081 static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan,  in l2cap_pass_to_tx_fbit()  argument
3084 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_pass_to_tx_fbit()
3085 	l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT);  in l2cap_pass_to_tx_fbit()
3092 	struct l2cap_chan *chan;  in l2cap_raw_recv()  local
3098 	list_for_each_entry(chan, &conn->chan_l, list) {  in l2cap_raw_recv()
3099 		if (chan->chan_type != L2CAP_CHAN_RAW)  in l2cap_raw_recv()
3103 		if (bt_cb(skb)->l2cap.chan == chan)  in l2cap_raw_recv()
3109 		if (chan->ops->recv(chan, nskb))  in l2cap_raw_recv()
3250 static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan, size_t size)  in l2cap_add_opt_efs()  argument
3254 	switch (chan->mode) {  in l2cap_add_opt_efs()
3256 		efs.id		= chan->local_id;  in l2cap_add_opt_efs()
3257 		efs.stype	= chan->local_stype;  in l2cap_add_opt_efs()
3258 		efs.msdu	= cpu_to_le16(chan->local_msdu);  in l2cap_add_opt_efs()
3259 		efs.sdu_itime	= cpu_to_le32(chan->local_sdu_itime);  in l2cap_add_opt_efs()
3267 		efs.msdu	= cpu_to_le16(chan->local_msdu);  in l2cap_add_opt_efs()
3268 		efs.sdu_itime	= cpu_to_le32(chan->local_sdu_itime);  in l2cap_add_opt_efs()
3283 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,  in l2cap_ack_timeout()  local
3287 	BT_DBG("chan %p", chan);  in l2cap_ack_timeout()
3289 	l2cap_chan_lock(chan);  in l2cap_ack_timeout()
3291 	frames_to_ack = __seq_offset(chan, chan->buffer_seq,  in l2cap_ack_timeout()
3292 				     chan->last_acked_seq);  in l2cap_ack_timeout()
3295 		l2cap_send_rr_or_rnr(chan, 0);  in l2cap_ack_timeout()
3297 	l2cap_chan_unlock(chan);  in l2cap_ack_timeout()
3298 	l2cap_chan_put(chan);  in l2cap_ack_timeout()
3301 int l2cap_ertm_init(struct l2cap_chan *chan)  in l2cap_ertm_init()  argument
3305 	chan->next_tx_seq = 0;  in l2cap_ertm_init()
3306 	chan->expected_tx_seq = 0;  in l2cap_ertm_init()
3307 	chan->expected_ack_seq = 0;  in l2cap_ertm_init()
3308 	chan->unacked_frames = 0;  in l2cap_ertm_init()
3309 	chan->buffer_seq = 0;  in l2cap_ertm_init()
3310 	chan->frames_sent = 0;  in l2cap_ertm_init()
3311 	chan->last_acked_seq = 0;  in l2cap_ertm_init()
3312 	chan->sdu = NULL;  in l2cap_ertm_init()
3313 	chan->sdu_last_frag = NULL;  in l2cap_ertm_init()
3314 	chan->sdu_len = 0;  in l2cap_ertm_init()
3316 	skb_queue_head_init(&chan->tx_q);  in l2cap_ertm_init()
3318 	chan->local_amp_id = AMP_ID_BREDR;  in l2cap_ertm_init()
3319 	chan->move_id = AMP_ID_BREDR;  in l2cap_ertm_init()
3320 	chan->move_state = L2CAP_MOVE_STABLE;  in l2cap_ertm_init()
3321 	chan->move_role = L2CAP_MOVE_ROLE_NONE;  in l2cap_ertm_init()
3323 	if (chan->mode != L2CAP_MODE_ERTM)  in l2cap_ertm_init()
3326 	chan->rx_state = L2CAP_RX_STATE_RECV;  in l2cap_ertm_init()
3327 	chan->tx_state = L2CAP_TX_STATE_XMIT;  in l2cap_ertm_init()
3329 	skb_queue_head_init(&chan->srej_q);  in l2cap_ertm_init()
3331 	err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);  in l2cap_ertm_init()
3335 	err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);  in l2cap_ertm_init()
3337 		l2cap_seq_list_free(&chan->srej_list);  in l2cap_ertm_init()
3367 static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan,  in __l2cap_set_ertm_timeouts()  argument
3370 	if (chan->local_amp_id != AMP_ID_BREDR && chan->hs_hcon) {  in __l2cap_set_ertm_timeouts()
3371 		u64 ertm_to = chan->hs_hcon->hdev->amp_be_flush_to;  in __l2cap_set_ertm_timeouts()
3405 static inline void l2cap_txwin_setup(struct l2cap_chan *chan)  in l2cap_txwin_setup()  argument
3407 	if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&  in l2cap_txwin_setup()
3408 	    __l2cap_ews_supported(chan->conn)) {  in l2cap_txwin_setup()
3410 		set_bit(FLAG_EXT_CTRL, &chan->flags);  in l2cap_txwin_setup()
3411 		chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;  in l2cap_txwin_setup()
3413 		chan->tx_win = min_t(u16, chan->tx_win,  in l2cap_txwin_setup()
3415 		chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;  in l2cap_txwin_setup()
3417 	chan->ack_win = chan->tx_win;  in l2cap_txwin_setup()
3420 static void l2cap_mtu_auto(struct l2cap_chan *chan)  in l2cap_mtu_auto()  argument
3422 	struct hci_conn *conn = chan->conn->hcon;  in l2cap_mtu_auto()
3424 	chan->imtu = L2CAP_DEFAULT_MIN_MTU;  in l2cap_mtu_auto()
3430 		chan->imtu = 54;  in l2cap_mtu_auto()
3436 		chan->imtu = 83;  in l2cap_mtu_auto()
3442 		chan->imtu = 367;  in l2cap_mtu_auto()
3448 		chan->imtu = 552;  in l2cap_mtu_auto()
3454 		chan->imtu = 679;  in l2cap_mtu_auto()
3460 		chan->imtu = 1021;  in l2cap_mtu_auto()
3463 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)  in l2cap_build_conf_req()  argument
3466 	struct l2cap_conf_rfc rfc = { .mode = chan->mode };  in l2cap_build_conf_req()
3471 	BT_DBG("chan %p", chan);  in l2cap_build_conf_req()
3473 	if (chan->num_conf_req || chan->num_conf_rsp)  in l2cap_build_conf_req()
3476 	switch (chan->mode) {  in l2cap_build_conf_req()
3479 		if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))  in l2cap_build_conf_req()
3482 		if (__l2cap_efs_supported(chan->conn))  in l2cap_build_conf_req()
3483 			set_bit(FLAG_EFS_ENABLE, &chan->flags);  in l2cap_build_conf_req()
3487 		chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);  in l2cap_build_conf_req()
3492 	if (chan->imtu != L2CAP_DEFAULT_MTU) {  in l2cap_build_conf_req()
3493 		if (!chan->imtu)  in l2cap_build_conf_req()
3494 			l2cap_mtu_auto(chan);  in l2cap_build_conf_req()
3495 		l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu,  in l2cap_build_conf_req()
3499 	switch (chan->mode) {  in l2cap_build_conf_req()
3504 		if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&  in l2cap_build_conf_req()
3505 		    !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))  in l2cap_build_conf_req()
3521 		rfc.max_transmit    = chan->max_tx;  in l2cap_build_conf_req()
3523 		__l2cap_set_ertm_timeouts(chan, &rfc);  in l2cap_build_conf_req()
3525 		size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -  in l2cap_build_conf_req()
3530 		l2cap_txwin_setup(chan);  in l2cap_build_conf_req()
3532 		rfc.txwin_size = min_t(u16, chan->tx_win,  in l2cap_build_conf_req()
3538 		if (test_bit(FLAG_EFS_ENABLE, &chan->flags))  in l2cap_build_conf_req()
3539 			l2cap_add_opt_efs(&ptr, chan, endptr - ptr);  in l2cap_build_conf_req()
3541 		if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_build_conf_req()
3543 					   chan->tx_win, endptr - ptr);  in l2cap_build_conf_req()
3545 		if (chan->conn->feat_mask & L2CAP_FEAT_FCS)  in l2cap_build_conf_req()
3546 			if (chan->fcs == L2CAP_FCS_NONE ||  in l2cap_build_conf_req()
3547 			    test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {  in l2cap_build_conf_req()
3548 				chan->fcs = L2CAP_FCS_NONE;  in l2cap_build_conf_req()
3550 						   chan->fcs, endptr - ptr);  in l2cap_build_conf_req()
3555 		l2cap_txwin_setup(chan);  in l2cap_build_conf_req()
3562 		size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -  in l2cap_build_conf_req()
3570 		if (test_bit(FLAG_EFS_ENABLE, &chan->flags))  in l2cap_build_conf_req()
3571 			l2cap_add_opt_efs(&ptr, chan, endptr - ptr);  in l2cap_build_conf_req()
3573 		if (chan->conn->feat_mask & L2CAP_FEAT_FCS)  in l2cap_build_conf_req()
3574 			if (chan->fcs == L2CAP_FCS_NONE ||  in l2cap_build_conf_req()
3575 			    test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {  in l2cap_build_conf_req()
3576 				chan->fcs = L2CAP_FCS_NONE;  in l2cap_build_conf_req()
3578 						   chan->fcs, endptr - ptr);  in l2cap_build_conf_req()
3583 	req->dcid  = cpu_to_le16(chan->dcid);  in l2cap_build_conf_req()
3589 static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)  in l2cap_parse_conf_req()  argument
3594 	void *req = chan->conf_req;  in l2cap_parse_conf_req()
3595 	int len = chan->conf_len;  in l2cap_parse_conf_req()
3605 	BT_DBG("chan %p", chan);  in l2cap_parse_conf_req()
3625 			chan->flush_to = val;  in l2cap_parse_conf_req()
3641 				set_bit(CONF_RECV_NO_FCS, &chan->conf_state);  in l2cap_parse_conf_req()
3654 			if (!(chan->conn->local_fixed_chan & L2CAP_FC_A2MP))  in l2cap_parse_conf_req()
3656 			set_bit(FLAG_EXT_CTRL, &chan->flags);  in l2cap_parse_conf_req()
3657 			set_bit(CONF_EWS_RECV, &chan->conf_state);  in l2cap_parse_conf_req()
3658 			chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;  in l2cap_parse_conf_req()
3659 			chan->remote_tx_win = val;  in l2cap_parse_conf_req()
3671 	if (chan->num_conf_rsp || chan->num_conf_req > 1)  in l2cap_parse_conf_req()
3674 	switch (chan->mode) {  in l2cap_parse_conf_req()
3677 		if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {  in l2cap_parse_conf_req()
3678 			chan->mode = l2cap_select_mode(rfc.mode,  in l2cap_parse_conf_req()
3679 						       chan->conn->feat_mask);  in l2cap_parse_conf_req()
3684 			if (__l2cap_efs_supported(chan->conn))  in l2cap_parse_conf_req()
3685 				set_bit(FLAG_EFS_ENABLE, &chan->flags);  in l2cap_parse_conf_req()
3690 		if (chan->mode != rfc.mode)  in l2cap_parse_conf_req()
3697 	if (chan->mode != rfc.mode) {  in l2cap_parse_conf_req()
3699 		rfc.mode = chan->mode;  in l2cap_parse_conf_req()
3701 		if (chan->num_conf_rsp == 1)  in l2cap_parse_conf_req()
3715 			chan->omtu = mtu;  in l2cap_parse_conf_req()
3716 			set_bit(CONF_MTU_DONE, &chan->conf_state);  in l2cap_parse_conf_req()
3718 		l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu, endptr - ptr);  in l2cap_parse_conf_req()
3721 			if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&  in l2cap_parse_conf_req()
3723 			    efs.stype != chan->local_stype) {  in l2cap_parse_conf_req()
3727 				if (chan->num_conf_req >= 1)  in l2cap_parse_conf_req()
3736 				set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);  in l2cap_parse_conf_req()
3742 			chan->fcs = L2CAP_FCS_NONE;  in l2cap_parse_conf_req()
3743 			set_bit(CONF_MODE_DONE, &chan->conf_state);  in l2cap_parse_conf_req()
3747 			if (!test_bit(CONF_EWS_RECV, &chan->conf_state))  in l2cap_parse_conf_req()
3748 				chan->remote_tx_win = rfc.txwin_size;  in l2cap_parse_conf_req()
3752 			chan->remote_max_tx = rfc.max_transmit;  in l2cap_parse_conf_req()
3755 				     chan->conn->mtu - L2CAP_EXT_HDR_SIZE -  in l2cap_parse_conf_req()
3758 			chan->remote_mps = size;  in l2cap_parse_conf_req()
3760 			__l2cap_set_ertm_timeouts(chan, &rfc);  in l2cap_parse_conf_req()
3762 			set_bit(CONF_MODE_DONE, &chan->conf_state);  in l2cap_parse_conf_req()
3768 			    test_bit(FLAG_EFS_ENABLE, &chan->flags)) {  in l2cap_parse_conf_req()
3769 				chan->remote_id = efs.id;  in l2cap_parse_conf_req()
3770 				chan->remote_stype = efs.stype;  in l2cap_parse_conf_req()
3771 				chan->remote_msdu = le16_to_cpu(efs.msdu);  in l2cap_parse_conf_req()
3772 				chan->remote_flush_to =  in l2cap_parse_conf_req()
3774 				chan->remote_acc_lat =  in l2cap_parse_conf_req()
3776 				chan->remote_sdu_itime =  in l2cap_parse_conf_req()
3786 				     chan->conn->mtu - L2CAP_EXT_HDR_SIZE -  in l2cap_parse_conf_req()
3789 			chan->remote_mps = size;  in l2cap_parse_conf_req()
3791 			set_bit(CONF_MODE_DONE, &chan->conf_state);  in l2cap_parse_conf_req()
3802 			rfc.mode = chan->mode;  in l2cap_parse_conf_req()
3806 			set_bit(CONF_OUTPUT_DONE, &chan->conf_state);  in l2cap_parse_conf_req()
3808 	rsp->scid   = cpu_to_le16(chan->dcid);  in l2cap_parse_conf_req()
3815 static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,  in l2cap_parse_conf_rsp()  argument
3826 	BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);  in l2cap_parse_conf_rsp()
3839 				chan->imtu = L2CAP_DEFAULT_MIN_MTU;  in l2cap_parse_conf_rsp()
3841 				chan->imtu = val;  in l2cap_parse_conf_rsp()
3842 			l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu,  in l2cap_parse_conf_rsp()
3849 			chan->flush_to = val;  in l2cap_parse_conf_rsp()
3851 					   chan->flush_to, endptr - ptr);  in l2cap_parse_conf_rsp()
3858 			if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&  in l2cap_parse_conf_rsp()
3859 			    rfc.mode != chan->mode)  in l2cap_parse_conf_rsp()
3861 			chan->fcs = 0;  in l2cap_parse_conf_rsp()
3869 			chan->ack_win = min_t(u16, val, chan->ack_win);  in l2cap_parse_conf_rsp()
3871 					   chan->tx_win, endptr - ptr);  in l2cap_parse_conf_rsp()
3878 			if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&  in l2cap_parse_conf_rsp()
3880 			    efs.stype != chan->local_stype)  in l2cap_parse_conf_rsp()
3892 						&chan->conf_state);  in l2cap_parse_conf_rsp()
3897 	if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)  in l2cap_parse_conf_rsp()
3900 	chan->mode = rfc.mode;  in l2cap_parse_conf_rsp()
3905 			chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);  in l2cap_parse_conf_rsp()
3906 			chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);  in l2cap_parse_conf_rsp()
3907 			chan->mps    = le16_to_cpu(rfc.max_pdu_size);  in l2cap_parse_conf_rsp()
3908 			if (!test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_parse_conf_rsp()
3909 				chan->ack_win = min_t(u16, chan->ack_win,  in l2cap_parse_conf_rsp()
3912 			if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {  in l2cap_parse_conf_rsp()
3913 				chan->local_msdu = le16_to_cpu(efs.msdu);  in l2cap_parse_conf_rsp()
3914 				chan->local_sdu_itime =  in l2cap_parse_conf_rsp()
3916 				chan->local_acc_lat = le32_to_cpu(efs.acc_lat);  in l2cap_parse_conf_rsp()
3917 				chan->local_flush_to =  in l2cap_parse_conf_rsp()
3923 			chan->mps    = le16_to_cpu(rfc.max_pdu_size);  in l2cap_parse_conf_rsp()
3927 	req->dcid   = cpu_to_le16(chan->dcid);  in l2cap_parse_conf_rsp()
3933 static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data,  in l2cap_build_conf_rsp()  argument
3939 	BT_DBG("chan %p", chan);  in l2cap_build_conf_rsp()
3941 	rsp->scid   = cpu_to_le16(chan->dcid);  in l2cap_build_conf_rsp()
3948 void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan)  in __l2cap_le_connect_rsp_defer()  argument
3951 	struct l2cap_conn *conn = chan->conn;  in __l2cap_le_connect_rsp_defer()
3953 	BT_DBG("chan %p", chan);  in __l2cap_le_connect_rsp_defer()
3955 	rsp.dcid    = cpu_to_le16(chan->scid);  in __l2cap_le_connect_rsp_defer()
3956 	rsp.mtu     = cpu_to_le16(chan->imtu);  in __l2cap_le_connect_rsp_defer()
3957 	rsp.mps     = cpu_to_le16(chan->mps);  in __l2cap_le_connect_rsp_defer()
3958 	rsp.credits = cpu_to_le16(chan->rx_credits);  in __l2cap_le_connect_rsp_defer()
3961 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),  in __l2cap_le_connect_rsp_defer()
3965 void __l2cap_ecred_conn_rsp_defer(struct l2cap_chan *chan)  in __l2cap_ecred_conn_rsp_defer()  argument
3971 	struct l2cap_conn *conn = chan->conn;  in __l2cap_ecred_conn_rsp_defer()
3972 	u16 ident = chan->ident;  in __l2cap_ecred_conn_rsp_defer()
3978 	BT_DBG("chan %p ident %d", chan, ident);  in __l2cap_ecred_conn_rsp_defer()
3980 	pdu.rsp.mtu     = cpu_to_le16(chan->imtu);  in __l2cap_ecred_conn_rsp_defer()
3981 	pdu.rsp.mps     = cpu_to_le16(chan->mps);  in __l2cap_ecred_conn_rsp_defer()
3982 	pdu.rsp.credits = cpu_to_le16(chan->rx_credits);  in __l2cap_ecred_conn_rsp_defer()
3987 	list_for_each_entry(chan, &conn->chan_l, list) {  in __l2cap_ecred_conn_rsp_defer()
3988 		if (chan->ident != ident)  in __l2cap_ecred_conn_rsp_defer()
3992 		chan->ident = 0;  in __l2cap_ecred_conn_rsp_defer()
3995 		pdu.dcid[i++] = cpu_to_le16(chan->scid);  in __l2cap_ecred_conn_rsp_defer()
4004 void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)  in __l2cap_connect_rsp_defer()  argument
4007 	struct l2cap_conn *conn = chan->conn;  in __l2cap_connect_rsp_defer()
4011 	rsp.scid   = cpu_to_le16(chan->dcid);  in __l2cap_connect_rsp_defer()
4012 	rsp.dcid   = cpu_to_le16(chan->scid);  in __l2cap_connect_rsp_defer()
4016 	if (chan->hs_hcon)  in __l2cap_connect_rsp_defer()
4021 	BT_DBG("chan %p rsp_code %u", chan, rsp_code);  in __l2cap_connect_rsp_defer()
4023 	l2cap_send_cmd(conn, chan->ident, rsp_code, sizeof(rsp), &rsp);  in __l2cap_connect_rsp_defer()
4025 	if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))  in __l2cap_connect_rsp_defer()
4029 		       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);  in __l2cap_connect_rsp_defer()
4030 	chan->num_conf_req++;  in __l2cap_connect_rsp_defer()
4033 static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)  in l2cap_conf_rfc_get()  argument
4040 	u16 txwin_ext = chan->ack_win;  in l2cap_conf_rfc_get()
4042 		.mode = chan->mode,  in l2cap_conf_rfc_get()
4045 		.max_pdu_size = cpu_to_le16(chan->imtu),  in l2cap_conf_rfc_get()
4046 		.txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW),  in l2cap_conf_rfc_get()
4049 	BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);  in l2cap_conf_rfc_get()
4051 	if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))  in l2cap_conf_rfc_get()
4075 		chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);  in l2cap_conf_rfc_get()
4076 		chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);  in l2cap_conf_rfc_get()
4077 		chan->mps = le16_to_cpu(rfc.max_pdu_size);  in l2cap_conf_rfc_get()
4078 		if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_conf_rfc_get()
4079 			chan->ack_win = min_t(u16, chan->ack_win, txwin_ext);  in l2cap_conf_rfc_get()
4081 			chan->ack_win = min_t(u16, chan->ack_win,  in l2cap_conf_rfc_get()
4085 		chan->mps    = le16_to_cpu(rfc.max_pdu_size);  in l2cap_conf_rfc_get()
4120 	struct l2cap_chan *chan = NULL, *pchan;  in l2cap_connect()  local
4161 	chan = pchan->ops->new_connection(pchan);  in l2cap_connect()
4162 	if (!chan)  in l2cap_connect()
4172 	bacpy(&chan->src, &conn->hcon->src);  in l2cap_connect()
4173 	bacpy(&chan->dst, &conn->hcon->dst);  in l2cap_connect()
4174 	chan->src_type = bdaddr_src_type(conn->hcon);  in l2cap_connect()
4175 	chan->dst_type = bdaddr_dst_type(conn->hcon);  in l2cap_connect()
4176 	chan->psm  = psm;  in l2cap_connect()
4177 	chan->dcid = scid;  in l2cap_connect()
4178 	chan->local_amp_id = amp_id;  in l2cap_connect()
4180 	__l2cap_chan_add(conn, chan);  in l2cap_connect()
4182 	dcid = chan->scid;  in l2cap_connect()
4184 	__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));  in l2cap_connect()
4186 	chan->ident = cmd->ident;  in l2cap_connect()
4189 		if (l2cap_chan_check_security(chan, false)) {  in l2cap_connect()
4190 			if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {  in l2cap_connect()
4191 				l2cap_state_change(chan, BT_CONNECT2);  in l2cap_connect()
4194 				chan->ops->defer(chan);  in l2cap_connect()
4201 					l2cap_state_change(chan, BT_CONFIG);  in l2cap_connect()
4204 					l2cap_state_change(chan, BT_CONNECT2);  in l2cap_connect()
4210 			l2cap_state_change(chan, BT_CONNECT2);  in l2cap_connect()
4215 		l2cap_state_change(chan, BT_CONNECT2);  in l2cap_connect()
4245 	if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&  in l2cap_connect()
4248 		set_bit(CONF_REQ_SENT, &chan->conf_state);  in l2cap_connect()
4250 			       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);  in l2cap_connect()
4251 		chan->num_conf_req++;  in l2cap_connect()
4254 	return chan;  in l2cap_connect()
4282 	struct l2cap_chan *chan;  in l2cap_connect_create_rsp()  local
4300 		chan = __l2cap_get_chan_by_scid(conn, scid);  in l2cap_connect_create_rsp()
4301 		if (!chan) {  in l2cap_connect_create_rsp()
4306 		chan = __l2cap_get_chan_by_ident(conn, cmd->ident);  in l2cap_connect_create_rsp()
4307 		if (!chan) {  in l2cap_connect_create_rsp()
4313 	chan = l2cap_chan_hold_unless_zero(chan);  in l2cap_connect_create_rsp()
4314 	if (!chan) {  in l2cap_connect_create_rsp()
4321 	l2cap_chan_lock(chan);  in l2cap_connect_create_rsp()
4325 		l2cap_state_change(chan, BT_CONFIG);  in l2cap_connect_create_rsp()
4326 		chan->ident = 0;  in l2cap_connect_create_rsp()
4327 		chan->dcid = dcid;  in l2cap_connect_create_rsp()
4328 		clear_bit(CONF_CONNECT_PEND, &chan->conf_state);  in l2cap_connect_create_rsp()
4330 		if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))  in l2cap_connect_create_rsp()
4334 			       l2cap_build_conf_req(chan, req, sizeof(req)), req);  in l2cap_connect_create_rsp()
4335 		chan->num_conf_req++;  in l2cap_connect_create_rsp()
4339 		set_bit(CONF_CONNECT_PEND, &chan->conf_state);  in l2cap_connect_create_rsp()
4343 		l2cap_chan_del(chan, ECONNREFUSED);  in l2cap_connect_create_rsp()
4347 	l2cap_chan_unlock(chan);  in l2cap_connect_create_rsp()
4348 	l2cap_chan_put(chan);  in l2cap_connect_create_rsp()
4356 static inline void set_default_fcs(struct l2cap_chan *chan)  in set_default_fcs()  argument
4361 	if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)  in set_default_fcs()
4362 		chan->fcs = L2CAP_FCS_NONE;  in set_default_fcs()
4363 	else if (!test_bit(CONF_RECV_NO_FCS, &chan->conf_state))  in set_default_fcs()
4364 		chan->fcs = L2CAP_FCS_CRC16;  in set_default_fcs()
4367 static void l2cap_send_efs_conf_rsp(struct l2cap_chan *chan, void *data,  in l2cap_send_efs_conf_rsp()  argument
4370 	struct l2cap_conn *conn = chan->conn;  in l2cap_send_efs_conf_rsp()
4372 	BT_DBG("conn %p chan %p ident %d flags 0x%4.4x", conn, chan, ident,  in l2cap_send_efs_conf_rsp()
4375 	clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);  in l2cap_send_efs_conf_rsp()
4376 	set_bit(CONF_OUTPUT_DONE, &chan->conf_state);  in l2cap_send_efs_conf_rsp()
4379 		       l2cap_build_conf_rsp(chan, data,  in l2cap_send_efs_conf_rsp()
4402 	struct l2cap_chan *chan;  in l2cap_config_req()  local
4413 	chan = l2cap_get_chan_by_scid(conn, dcid);  in l2cap_config_req()
4414 	if (!chan) {  in l2cap_config_req()
4419 	if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2 &&  in l2cap_config_req()
4420 	    chan->state != BT_CONNECTED) {  in l2cap_config_req()
4421 		cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,  in l2cap_config_req()
4422 				       chan->dcid);  in l2cap_config_req()
4428 	if (chan->conf_len + len > sizeof(chan->conf_req)) {  in l2cap_config_req()
4430 			       l2cap_build_conf_rsp(chan, rsp,  in l2cap_config_req()
4436 	memcpy(chan->conf_req + chan->conf_len, req->data, len);  in l2cap_config_req()
4437 	chan->conf_len += len;  in l2cap_config_req()
4442 			       l2cap_build_conf_rsp(chan, rsp,  in l2cap_config_req()
4448 	len = l2cap_parse_conf_req(chan, rsp, sizeof(rsp));  in l2cap_config_req()
4450 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_config_req()
4454 	chan->ident = cmd->ident;  in l2cap_config_req()
4456 	if (chan->num_conf_rsp < L2CAP_CONF_MAX_CONF_RSP)  in l2cap_config_req()
4457 		chan->num_conf_rsp++;  in l2cap_config_req()
4460 	chan->conf_len = 0;  in l2cap_config_req()
4462 	if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))  in l2cap_config_req()
4465 	if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {  in l2cap_config_req()
4466 		set_default_fcs(chan);  in l2cap_config_req()
4468 		if (chan->mode == L2CAP_MODE_ERTM ||  in l2cap_config_req()
4469 		    chan->mode == L2CAP_MODE_STREAMING)  in l2cap_config_req()
4470 			err = l2cap_ertm_init(chan);  in l2cap_config_req()
4473 			l2cap_send_disconn_req(chan, -err);  in l2cap_config_req()
4475 			l2cap_chan_ready(chan);  in l2cap_config_req()
4480 	if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {  in l2cap_config_req()
4483 			       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);  in l2cap_config_req()
4484 		chan->num_conf_req++;  in l2cap_config_req()
4489 	if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&  in l2cap_config_req()
4490 	    test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {  in l2cap_config_req()
4495 		if (!chan->hs_hcon)  in l2cap_config_req()
4496 			l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags);  in l2cap_config_req()
4498 			chan->ident = cmd->ident;  in l2cap_config_req()
4502 	l2cap_chan_unlock(chan);  in l2cap_config_req()
4503 	l2cap_chan_put(chan);  in l2cap_config_req()
4513 	struct l2cap_chan *chan;  in l2cap_config_rsp()  local
4527 	chan = l2cap_get_chan_by_scid(conn, scid);  in l2cap_config_rsp()
4528 	if (!chan)  in l2cap_config_rsp()
4533 		l2cap_conf_rfc_get(chan, rsp->data, len);  in l2cap_config_rsp()
4534 		clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);  in l2cap_config_rsp()
4538 		set_bit(CONF_REM_CONF_PEND, &chan->conf_state);  in l2cap_config_rsp()
4540 		if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {  in l2cap_config_rsp()
4543 			len = l2cap_parse_conf_rsp(chan, rsp->data, len,  in l2cap_config_rsp()
4546 				l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_config_rsp()
4550 			if (!chan->hs_hcon) {  in l2cap_config_rsp()
4551 				l2cap_send_efs_conf_rsp(chan, buf, cmd->ident,  in l2cap_config_rsp()
4554 				if (l2cap_check_efs(chan)) {  in l2cap_config_rsp()
4555 					amp_create_logical_link(chan);  in l2cap_config_rsp()
4556 					chan->ident = cmd->ident;  in l2cap_config_rsp()
4564 		if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {  in l2cap_config_rsp()
4568 				l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_config_rsp()
4574 			len = l2cap_parse_conf_rsp(chan, rsp->data, len,  in l2cap_config_rsp()
4577 				l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_config_rsp()
4583 			chan->num_conf_req++;  in l2cap_config_rsp()
4591 		l2cap_chan_set_err(chan, ECONNRESET);  in l2cap_config_rsp()
4593 		__set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);  in l2cap_config_rsp()
4594 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_config_rsp()
4601 	set_bit(CONF_INPUT_DONE, &chan->conf_state);  in l2cap_config_rsp()
4603 	if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {  in l2cap_config_rsp()
4604 		set_default_fcs(chan);  in l2cap_config_rsp()
4606 		if (chan->mode == L2CAP_MODE_ERTM ||  in l2cap_config_rsp()
4607 		    chan->mode == L2CAP_MODE_STREAMING)  in l2cap_config_rsp()
4608 			err = l2cap_ertm_init(chan);  in l2cap_config_rsp()
4611 			l2cap_send_disconn_req(chan, -err);  in l2cap_config_rsp()
4613 			l2cap_chan_ready(chan);  in l2cap_config_rsp()
4617 	l2cap_chan_unlock(chan);  in l2cap_config_rsp()
4618 	l2cap_chan_put(chan);  in l2cap_config_rsp()
4629 	struct l2cap_chan *chan;  in l2cap_disconnect_req()  local
4641 	chan = __l2cap_get_chan_by_scid(conn, dcid);  in l2cap_disconnect_req()
4642 	if (!chan) {  in l2cap_disconnect_req()
4648 	l2cap_chan_hold(chan);  in l2cap_disconnect_req()
4649 	l2cap_chan_lock(chan);  in l2cap_disconnect_req()
4651 	rsp.dcid = cpu_to_le16(chan->scid);  in l2cap_disconnect_req()
4652 	rsp.scid = cpu_to_le16(chan->dcid);  in l2cap_disconnect_req()
4655 	chan->ops->set_shutdown(chan);  in l2cap_disconnect_req()
4657 	l2cap_chan_del(chan, ECONNRESET);  in l2cap_disconnect_req()
4659 	chan->ops->close(chan);  in l2cap_disconnect_req()
4661 	l2cap_chan_unlock(chan);  in l2cap_disconnect_req()
4662 	l2cap_chan_put(chan);  in l2cap_disconnect_req()
4675 	struct l2cap_chan *chan;  in l2cap_disconnect_rsp()  local
4687 	chan = __l2cap_get_chan_by_scid(conn, scid);  in l2cap_disconnect_rsp()
4688 	if (!chan) {  in l2cap_disconnect_rsp()
4693 	l2cap_chan_hold(chan);  in l2cap_disconnect_rsp()
4694 	l2cap_chan_lock(chan);  in l2cap_disconnect_rsp()
4696 	if (chan->state != BT_DISCONN) {  in l2cap_disconnect_rsp()
4697 		l2cap_chan_unlock(chan);  in l2cap_disconnect_rsp()
4698 		l2cap_chan_put(chan);  in l2cap_disconnect_rsp()
4703 	l2cap_chan_del(chan, 0);  in l2cap_disconnect_rsp()
4705 	chan->ops->close(chan);  in l2cap_disconnect_rsp()
4707 	l2cap_chan_unlock(chan);  in l2cap_disconnect_rsp()
4708 	l2cap_chan_put(chan);  in l2cap_disconnect_rsp()
4835 	struct l2cap_chan *chan;  in l2cap_create_channel_req()  local
4867 	chan = l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,  in l2cap_create_channel_req()
4869 	if (chan) {  in l2cap_create_channel_req()
4877 			cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,  in l2cap_create_channel_req()
4878 					       chan->dcid);  in l2cap_create_channel_req()
4882 		BT_DBG("mgr %p bredr_chan %p hs_hcon %p", mgr, chan, hs_hcon);  in l2cap_create_channel_req()
4884 		mgr->bredr_chan = chan;  in l2cap_create_channel_req()
4885 		chan->hs_hcon = hs_hcon;  in l2cap_create_channel_req()
4886 		chan->fcs = L2CAP_FCS_NONE;  in l2cap_create_channel_req()
4906 static void l2cap_send_move_chan_req(struct l2cap_chan *chan, u8 dest_amp_id)  in l2cap_send_move_chan_req()  argument
4911 	BT_DBG("chan %p, dest_amp_id %d", chan, dest_amp_id);  in l2cap_send_move_chan_req()
4913 	ident = l2cap_get_ident(chan->conn);  in l2cap_send_move_chan_req()
4914 	chan->ident = ident;  in l2cap_send_move_chan_req()
4916 	req.icid = cpu_to_le16(chan->scid);  in l2cap_send_move_chan_req()
4919 	l2cap_send_cmd(chan->conn, ident, L2CAP_MOVE_CHAN_REQ, sizeof(req),  in l2cap_send_move_chan_req()
4922 	__set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);  in l2cap_send_move_chan_req()
4925 static void l2cap_send_move_chan_rsp(struct l2cap_chan *chan, u16 result)  in l2cap_send_move_chan_rsp()  argument
4929 	BT_DBG("chan %p, result 0x%4.4x", chan, result);  in l2cap_send_move_chan_rsp()
4931 	rsp.icid = cpu_to_le16(chan->dcid);  in l2cap_send_move_chan_rsp()
4934 	l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_RSP,  in l2cap_send_move_chan_rsp()
4938 static void l2cap_send_move_chan_cfm(struct l2cap_chan *chan, u16 result)  in l2cap_send_move_chan_cfm()  argument
4942 	BT_DBG("chan %p, result 0x%4.4x", chan, result);  in l2cap_send_move_chan_cfm()
4944 	chan->ident = l2cap_get_ident(chan->conn);  in l2cap_send_move_chan_cfm()
4946 	cfm.icid = cpu_to_le16(chan->scid);  in l2cap_send_move_chan_cfm()
4949 	l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_CFM,  in l2cap_send_move_chan_cfm()
4952 	__set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);  in l2cap_send_move_chan_cfm()
4979 static void __release_logical_link(struct l2cap_chan *chan)  in __release_logical_link()  argument
4981 	chan->hs_hchan = NULL;  in __release_logical_link()
4982 	chan->hs_hcon = NULL;  in __release_logical_link()
4987 static void l2cap_logical_fail(struct l2cap_chan *chan)  in l2cap_logical_fail()  argument
4990 	if (chan->state != BT_CONNECTED) {  in l2cap_logical_fail()
4992 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_logical_fail()
4996 	switch (chan->move_role) {  in l2cap_logical_fail()
4998 		l2cap_move_done(chan);  in l2cap_logical_fail()
4999 		l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_SUPP);  in l2cap_logical_fail()
5002 		if (chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_COMP ||  in l2cap_logical_fail()
5003 		    chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_CFM) {  in l2cap_logical_fail()
5007 			l2cap_move_done(chan);  in l2cap_logical_fail()
5013 		l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);  in l2cap_logical_fail()
5018 static void l2cap_logical_finish_create(struct l2cap_chan *chan,  in l2cap_logical_finish_create()  argument
5023 	chan->hs_hchan = hchan;  in l2cap_logical_finish_create()
5024 	chan->hs_hcon->l2cap_data = chan->conn;  in l2cap_logical_finish_create()
5026 	l2cap_send_efs_conf_rsp(chan, &rsp, chan->ident, 0);  in l2cap_logical_finish_create()
5028 	if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {  in l2cap_logical_finish_create()
5031 		set_default_fcs(chan);  in l2cap_logical_finish_create()
5033 		err = l2cap_ertm_init(chan);  in l2cap_logical_finish_create()
5035 			l2cap_send_disconn_req(chan, -err);  in l2cap_logical_finish_create()
5037 			l2cap_chan_ready(chan);  in l2cap_logical_finish_create()
5041 static void l2cap_logical_finish_move(struct l2cap_chan *chan,  in l2cap_logical_finish_move()  argument
5044 	chan->hs_hcon = hchan->conn;  in l2cap_logical_finish_move()
5045 	chan->hs_hcon->l2cap_data = chan->conn;  in l2cap_logical_finish_move()
5047 	BT_DBG("move_state %d", chan->move_state);  in l2cap_logical_finish_move()
5049 	switch (chan->move_state) {  in l2cap_logical_finish_move()
5054 		chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;  in l2cap_logical_finish_move()
5057 		if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_logical_finish_move()
5058 			chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;  in l2cap_logical_finish_move()
5059 		} else if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {  in l2cap_logical_finish_move()
5060 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;  in l2cap_logical_finish_move()
5061 			l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);  in l2cap_logical_finish_move()
5062 		} else if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {  in l2cap_logical_finish_move()
5063 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;  in l2cap_logical_finish_move()
5064 			l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);  in l2cap_logical_finish_move()
5069 		__release_logical_link(chan);  in l2cap_logical_finish_move()
5071 		chan->move_state = L2CAP_MOVE_STABLE;  in l2cap_logical_finish_move()
5076 void l2cap_logical_cfm(struct l2cap_chan *chan, struct hci_chan *hchan,  in l2cap_logical_cfm()  argument
5079 	BT_DBG("chan %p, hchan %p, status %d", chan, hchan, status);  in l2cap_logical_cfm()
5082 		l2cap_logical_fail(chan);  in l2cap_logical_cfm()
5083 		__release_logical_link(chan);  in l2cap_logical_cfm()
5087 	if (chan->state != BT_CONNECTED) {  in l2cap_logical_cfm()
5089 		if (chan->local_amp_id != AMP_ID_BREDR)  in l2cap_logical_cfm()
5090 			l2cap_logical_finish_create(chan, hchan);  in l2cap_logical_cfm()
5092 		l2cap_logical_finish_move(chan, hchan);  in l2cap_logical_cfm()
5096 void l2cap_move_start(struct l2cap_chan *chan)  in l2cap_move_start()  argument
5098 	BT_DBG("chan %p", chan);  in l2cap_move_start()
5100 	if (chan->local_amp_id == AMP_ID_BREDR) {  in l2cap_move_start()
5101 		if (chan->chan_policy != BT_CHANNEL_POLICY_AMP_PREFERRED)  in l2cap_move_start()
5103 		chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;  in l2cap_move_start()
5104 		chan->move_state = L2CAP_MOVE_WAIT_PREPARE;  in l2cap_move_start()
5107 		chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;  in l2cap_move_start()
5108 		chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;  in l2cap_move_start()
5109 		chan->move_id = 0;  in l2cap_move_start()
5110 		l2cap_move_setup(chan);  in l2cap_move_start()
5111 		l2cap_send_move_chan_req(chan, 0);  in l2cap_move_start()
5115 static void l2cap_do_create(struct l2cap_chan *chan, int result,  in l2cap_do_create()  argument
5118 	BT_DBG("chan %p state %s %u -> %u", chan, state_to_string(chan->state),  in l2cap_do_create()
5121 	chan->fcs = L2CAP_FCS_NONE;  in l2cap_do_create()
5124 	if (chan->state == BT_CONNECT) {  in l2cap_do_create()
5126 			chan->local_amp_id = local_amp_id;  in l2cap_do_create()
5127 			l2cap_send_create_chan_req(chan, remote_amp_id);  in l2cap_do_create()
5130 			l2cap_send_conn_req(chan);  in l2cap_do_create()
5137 	if (__l2cap_no_conn_pending(chan)) {  in l2cap_do_create()
5140 		rsp.scid = cpu_to_le16(chan->dcid);  in l2cap_do_create()
5141 		rsp.dcid = cpu_to_le16(chan->scid);  in l2cap_do_create()
5153 		l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_RSP,  in l2cap_do_create()
5157 			l2cap_state_change(chan, BT_CONFIG);  in l2cap_do_create()
5158 			set_bit(CONF_REQ_SENT, &chan->conf_state);  in l2cap_do_create()
5159 			l2cap_send_cmd(chan->conn, l2cap_get_ident(chan->conn),  in l2cap_do_create()
5161 				       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);  in l2cap_do_create()
5162 			chan->num_conf_req++;  in l2cap_do_create()
5167 static void l2cap_do_move_initiate(struct l2cap_chan *chan, u8 local_amp_id,  in l2cap_do_move_initiate()  argument
5170 	l2cap_move_setup(chan);  in l2cap_do_move_initiate()
5171 	chan->move_id = local_amp_id;  in l2cap_do_move_initiate()
5172 	chan->move_state = L2CAP_MOVE_WAIT_RSP;  in l2cap_do_move_initiate()
5174 	l2cap_send_move_chan_req(chan, remote_amp_id);  in l2cap_do_move_initiate()
5177 static void l2cap_do_move_respond(struct l2cap_chan *chan, int result)  in l2cap_do_move_respond()  argument
5186 			chan->hs_hcon = hchan->conn;  in l2cap_do_move_respond()
5187 			chan->hs_hcon->l2cap_data = chan->conn;  in l2cap_do_move_respond()
5188 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;  in l2cap_do_move_respond()
5189 			l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);  in l2cap_do_move_respond()
5191 			l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);  in l2cap_do_move_respond()
5194 			chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;  in l2cap_do_move_respond()
5198 		l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_ALLOWED);  in l2cap_do_move_respond()
5202 static void l2cap_do_move_cancel(struct l2cap_chan *chan, int result)  in l2cap_do_move_cancel()  argument
5204 	if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {  in l2cap_do_move_cancel()
5211 		l2cap_send_move_chan_rsp(chan, rsp_result);  in l2cap_do_move_cancel()
5214 	chan->move_role = L2CAP_MOVE_ROLE_NONE;  in l2cap_do_move_cancel()
5215 	chan->move_state = L2CAP_MOVE_STABLE;  in l2cap_do_move_cancel()
5218 	l2cap_ertm_send(chan);  in l2cap_do_move_cancel()
5222 void __l2cap_physical_cfm(struct l2cap_chan *chan, int result)  in __l2cap_physical_cfm()  argument
5224 	u8 local_amp_id = chan->local_amp_id;  in __l2cap_physical_cfm()
5225 	u8 remote_amp_id = chan->remote_amp_id;  in __l2cap_physical_cfm()
5228 	       chan, result, local_amp_id, remote_amp_id);  in __l2cap_physical_cfm()
5230 	if (chan->state == BT_DISCONN || chan->state == BT_CLOSED)  in __l2cap_physical_cfm()
5233 	if (chan->state != BT_CONNECTED) {  in __l2cap_physical_cfm()
5234 		l2cap_do_create(chan, result, local_amp_id, remote_amp_id);  in __l2cap_physical_cfm()
5236 		l2cap_do_move_cancel(chan, result);  in __l2cap_physical_cfm()
5238 		switch (chan->move_role) {  in __l2cap_physical_cfm()
5240 			l2cap_do_move_initiate(chan, local_amp_id,  in __l2cap_physical_cfm()
5244 			l2cap_do_move_respond(chan, result);  in __l2cap_physical_cfm()
5247 			l2cap_do_move_cancel(chan, result);  in __l2cap_physical_cfm()
5259 	struct l2cap_chan *chan;  in l2cap_move_channel_req()  local
5273 	chan = l2cap_get_chan_by_dcid(conn, icid);  in l2cap_move_channel_req()
5274 	if (!chan) {  in l2cap_move_channel_req()
5282 	chan->ident = cmd->ident;  in l2cap_move_channel_req()
5284 	if (chan->scid < L2CAP_CID_DYN_START ||  in l2cap_move_channel_req()
5285 	    chan->chan_policy == BT_CHANNEL_POLICY_BREDR_ONLY ||  in l2cap_move_channel_req()
5286 	    (chan->mode != L2CAP_MODE_ERTM &&  in l2cap_move_channel_req()
5287 	     chan->mode != L2CAP_MODE_STREAMING)) {  in l2cap_move_channel_req()
5292 	if (chan->local_amp_id == req->dest_amp_id) {  in l2cap_move_channel_req()
5315 	if ((__chan_is_moving(chan) ||  in l2cap_move_channel_req()
5316 	     chan->move_role != L2CAP_MOVE_ROLE_NONE) &&  in l2cap_move_channel_req()
5322 	chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;  in l2cap_move_channel_req()
5323 	l2cap_move_setup(chan);  in l2cap_move_channel_req()
5324 	chan->move_id = req->dest_amp_id;  in l2cap_move_channel_req()
5328 		if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_move_channel_req()
5329 			chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;  in l2cap_move_channel_req()
5332 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;  in l2cap_move_channel_req()
5336 		chan->move_state = L2CAP_MOVE_WAIT_PREPARE;  in l2cap_move_channel_req()
5343 	l2cap_send_move_chan_rsp(chan, result);  in l2cap_move_channel_req()
5345 	l2cap_chan_unlock(chan);  in l2cap_move_channel_req()
5346 	l2cap_chan_put(chan);  in l2cap_move_channel_req()
5353 	struct l2cap_chan *chan;  in l2cap_move_continue()  local
5356 	chan = l2cap_get_chan_by_scid(conn, icid);  in l2cap_move_continue()
5357 	if (!chan) {  in l2cap_move_continue()
5362 	__clear_chan_timer(chan);  in l2cap_move_continue()
5364 		__set_chan_timer(chan, L2CAP_MOVE_ERTX_TIMEOUT);  in l2cap_move_continue()
5366 	switch (chan->move_state) {  in l2cap_move_continue()
5371 		chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;  in l2cap_move_continue()
5377 				    &chan->conn_state)) {  in l2cap_move_continue()
5378 			chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;  in l2cap_move_continue()
5383 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;  in l2cap_move_continue()
5384 			l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);  in l2cap_move_continue()
5393 			chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;  in l2cap_move_continue()
5398 			chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_COMP;  in l2cap_move_continue()
5404 			l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);  in l2cap_move_continue()
5416 		chan->hs_hcon = hchan->conn;  in l2cap_move_continue()
5417 		chan->hs_hcon->l2cap_data = chan->conn;  in l2cap_move_continue()
5421 			l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);  in l2cap_move_continue()
5426 			chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;  in l2cap_move_continue()
5429 		l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);  in l2cap_move_continue()
5433 		chan->move_id = chan->local_amp_id;  in l2cap_move_continue()
5434 		l2cap_move_done(chan);  in l2cap_move_continue()
5435 		l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);  in l2cap_move_continue()
5438 	l2cap_chan_unlock(chan);  in l2cap_move_continue()
5439 	l2cap_chan_put(chan);  in l2cap_move_continue()
5445 	struct l2cap_chan *chan;  in l2cap_move_fail()  local
5447 	chan = l2cap_get_chan_by_ident(conn, ident);  in l2cap_move_fail()
5448 	if (!chan) {  in l2cap_move_fail()
5454 	__clear_chan_timer(chan);  in l2cap_move_fail()
5456 	if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {  in l2cap_move_fail()
5458 			chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;  in l2cap_move_fail()
5461 			chan->move_id = chan->local_amp_id;  in l2cap_move_fail()
5462 			l2cap_move_done(chan);  in l2cap_move_fail()
5466 	l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);  in l2cap_move_fail()
5468 	l2cap_chan_unlock(chan);  in l2cap_move_fail()
5469 	l2cap_chan_put(chan);  in l2cap_move_fail()
5500 	struct l2cap_chan *chan;  in l2cap_move_channel_confirm()  local
5511 	chan = l2cap_get_chan_by_dcid(conn, icid);  in l2cap_move_channel_confirm()
5512 	if (!chan) {  in l2cap_move_channel_confirm()
5518 	if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM) {  in l2cap_move_channel_confirm()
5520 			chan->local_amp_id = chan->move_id;  in l2cap_move_channel_confirm()
5521 			if (chan->local_amp_id == AMP_ID_BREDR)  in l2cap_move_channel_confirm()
5522 				__release_logical_link(chan);  in l2cap_move_channel_confirm()
5524 			chan->move_id = chan->local_amp_id;  in l2cap_move_channel_confirm()
5527 		l2cap_move_done(chan);  in l2cap_move_channel_confirm()
5532 	l2cap_chan_unlock(chan);  in l2cap_move_channel_confirm()
5533 	l2cap_chan_put(chan);  in l2cap_move_channel_confirm()
5543 	struct l2cap_chan *chan;  in l2cap_move_channel_confirm_rsp()  local
5553 	chan = l2cap_get_chan_by_scid(conn, icid);  in l2cap_move_channel_confirm_rsp()
5554 	if (!chan)  in l2cap_move_channel_confirm_rsp()
5557 	__clear_chan_timer(chan);  in l2cap_move_channel_confirm_rsp()
5559 	if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM_RSP) {  in l2cap_move_channel_confirm_rsp()
5560 		chan->local_amp_id = chan->move_id;  in l2cap_move_channel_confirm_rsp()
5562 		if (chan->local_amp_id == AMP_ID_BREDR && chan->hs_hchan)  in l2cap_move_channel_confirm_rsp()
5563 			__release_logical_link(chan);  in l2cap_move_channel_confirm_rsp()
5565 		l2cap_move_done(chan);  in l2cap_move_channel_confirm_rsp()
5568 	l2cap_chan_unlock(chan);  in l2cap_move_channel_confirm_rsp()
5569 	l2cap_chan_put(chan);  in l2cap_move_channel_confirm_rsp()
5631 	struct l2cap_chan *chan;  in l2cap_le_connect_rsp()  local
5653 	chan = __l2cap_get_chan_by_ident(conn, cmd->ident);  in l2cap_le_connect_rsp()
5654 	if (!chan) {  in l2cap_le_connect_rsp()
5661 	l2cap_chan_lock(chan);  in l2cap_le_connect_rsp()
5670 		chan->ident = 0;  in l2cap_le_connect_rsp()
5671 		chan->dcid = dcid;  in l2cap_le_connect_rsp()
5672 		chan->omtu = mtu;  in l2cap_le_connect_rsp()
5673 		chan->remote_mps = mps;  in l2cap_le_connect_rsp()
5674 		chan->tx_credits = credits;  in l2cap_le_connect_rsp()
5675 		l2cap_chan_ready(chan);  in l2cap_le_connect_rsp()
5684 			l2cap_chan_del(chan, ECONNREFUSED);  in l2cap_le_connect_rsp()
5689 		if (chan->sec_level < sec_level)  in l2cap_le_connect_rsp()
5690 			chan->sec_level = sec_level;  in l2cap_le_connect_rsp()
5693 		clear_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags);  in l2cap_le_connect_rsp()
5695 		smp_conn_security(hcon, chan->sec_level);  in l2cap_le_connect_rsp()
5699 		l2cap_chan_del(chan, ECONNREFUSED);  in l2cap_le_connect_rsp()
5703 	l2cap_chan_unlock(chan);  in l2cap_le_connect_rsp()
5797 	struct l2cap_chan *chan, *pchan;  in l2cap_le_connect_req()  local
5827 		chan = NULL;  in l2cap_le_connect_req()
5836 		chan = NULL;  in l2cap_le_connect_req()
5846 		chan = NULL;  in l2cap_le_connect_req()
5853 		chan = NULL;  in l2cap_le_connect_req()
5860 		chan = NULL;  in l2cap_le_connect_req()
5864 	chan = pchan->ops->new_connection(pchan);  in l2cap_le_connect_req()
5865 	if (!chan) {  in l2cap_le_connect_req()
5870 	bacpy(&chan->src, &conn->hcon->src);  in l2cap_le_connect_req()
5871 	bacpy(&chan->dst, &conn->hcon->dst);  in l2cap_le_connect_req()
5872 	chan->src_type = bdaddr_src_type(conn->hcon);  in l2cap_le_connect_req()
5873 	chan->dst_type = bdaddr_dst_type(conn->hcon);  in l2cap_le_connect_req()
5874 	chan->psm  = psm;  in l2cap_le_connect_req()
5875 	chan->dcid = scid;  in l2cap_le_connect_req()
5876 	chan->omtu = mtu;  in l2cap_le_connect_req()
5877 	chan->remote_mps = mps;  in l2cap_le_connect_req()
5879 	__l2cap_chan_add(conn, chan);  in l2cap_le_connect_req()
5881 	l2cap_le_flowctl_init(chan, __le16_to_cpu(req->credits));  in l2cap_le_connect_req()
5883 	dcid = chan->scid;  in l2cap_le_connect_req()
5884 	credits = chan->rx_credits;  in l2cap_le_connect_req()
5886 	__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));  in l2cap_le_connect_req()
5888 	chan->ident = cmd->ident;  in l2cap_le_connect_req()
5890 	if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {  in l2cap_le_connect_req()
5891 		l2cap_state_change(chan, BT_CONNECT2);  in l2cap_le_connect_req()
5898 		chan->ops->defer(chan);  in l2cap_le_connect_req()
5900 		l2cap_chan_ready(chan);  in l2cap_le_connect_req()
5913 	if (chan) {  in l2cap_le_connect_req()
5914 		rsp.mtu = cpu_to_le16(chan->imtu);  in l2cap_le_connect_req()
5915 		rsp.mps = cpu_to_le16(chan->mps);  in l2cap_le_connect_req()
5935 	struct l2cap_chan *chan;  in l2cap_le_credits()  local
5947 	chan = l2cap_get_chan_by_dcid(conn, cid);  in l2cap_le_credits()
5948 	if (!chan)  in l2cap_le_credits()
5951 	max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;  in l2cap_le_credits()
5954 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_le_credits()
5962 	chan->tx_credits += credits;  in l2cap_le_credits()
5965 	l2cap_le_flowctl_send(chan);  in l2cap_le_credits()
5967 	if (chan->tx_credits)  in l2cap_le_credits()
5968 		chan->ops->resume(chan);  in l2cap_le_credits()
5971 	l2cap_chan_unlock(chan);  in l2cap_le_credits()
5972 	l2cap_chan_put(chan);  in l2cap_le_credits()
5986 	struct l2cap_chan *chan, *pchan;  in l2cap_ecred_conn_req()  local
6074 		chan = pchan->ops->new_connection(pchan);  in l2cap_ecred_conn_req()
6075 		if (!chan) {  in l2cap_ecred_conn_req()
6080 		bacpy(&chan->src, &conn->hcon->src);  in l2cap_ecred_conn_req()
6081 		bacpy(&chan->dst, &conn->hcon->dst);  in l2cap_ecred_conn_req()
6082 		chan->src_type = bdaddr_src_type(conn->hcon);  in l2cap_ecred_conn_req()
6083 		chan->dst_type = bdaddr_dst_type(conn->hcon);  in l2cap_ecred_conn_req()
6084 		chan->psm  = psm;  in l2cap_ecred_conn_req()
6085 		chan->dcid = scid;  in l2cap_ecred_conn_req()
6086 		chan->omtu = mtu;  in l2cap_ecred_conn_req()
6087 		chan->remote_mps = mps;  in l2cap_ecred_conn_req()
6089 		__l2cap_chan_add(conn, chan);  in l2cap_ecred_conn_req()
6091 		l2cap_ecred_init(chan, __le16_to_cpu(req->credits));  in l2cap_ecred_conn_req()
6095 			pdu.rsp.mtu = cpu_to_le16(chan->imtu);  in l2cap_ecred_conn_req()
6096 			pdu.rsp.mps = cpu_to_le16(chan->mps);  in l2cap_ecred_conn_req()
6097 			pdu.rsp.credits = cpu_to_le16(chan->rx_credits);  in l2cap_ecred_conn_req()
6100 		pdu.dcid[i] = cpu_to_le16(chan->scid);  in l2cap_ecred_conn_req()
6102 		__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));  in l2cap_ecred_conn_req()
6104 		chan->ident = cmd->ident;  in l2cap_ecred_conn_req()
6106 		if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {  in l2cap_ecred_conn_req()
6107 			l2cap_state_change(chan, BT_CONNECT2);  in l2cap_ecred_conn_req()
6109 			chan->ops->defer(chan);  in l2cap_ecred_conn_req()
6111 			l2cap_chan_ready(chan);  in l2cap_ecred_conn_req()
6139 	struct l2cap_chan *chan, *tmp;  in l2cap_ecred_conn_rsp()  local
6158 	list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {  in l2cap_ecred_conn_rsp()
6161 		if (chan->ident != cmd->ident ||  in l2cap_ecred_conn_rsp()
6162 		    chan->mode != L2CAP_MODE_EXT_FLOWCTL ||  in l2cap_ecred_conn_rsp()
6163 		    chan->state == BT_CONNECTED)  in l2cap_ecred_conn_rsp()
6166 		l2cap_chan_lock(chan);  in l2cap_ecred_conn_rsp()
6170 			l2cap_chan_del(chan, ECONNREFUSED);  in l2cap_ecred_conn_rsp()
6171 			l2cap_chan_unlock(chan);  in l2cap_ecred_conn_rsp()
6188 			l2cap_chan_del(chan, ECONNREFUSED);  in l2cap_ecred_conn_rsp()
6189 			l2cap_chan_unlock(chan);  in l2cap_ecred_conn_rsp()
6190 			chan = __l2cap_get_chan_by_dcid(conn, dcid);  in l2cap_ecred_conn_rsp()
6191 			l2cap_chan_lock(chan);  in l2cap_ecred_conn_rsp()
6192 			l2cap_chan_del(chan, ECONNRESET);  in l2cap_ecred_conn_rsp()
6193 			l2cap_chan_unlock(chan);  in l2cap_ecred_conn_rsp()
6204 				l2cap_chan_del(chan, ECONNREFUSED);  in l2cap_ecred_conn_rsp()
6209 			if (chan->sec_level < sec_level)  in l2cap_ecred_conn_rsp()
6210 				chan->sec_level = sec_level;  in l2cap_ecred_conn_rsp()
6213 			clear_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags);  in l2cap_ecred_conn_rsp()
6215 			smp_conn_security(hcon, chan->sec_level);  in l2cap_ecred_conn_rsp()
6219 			l2cap_chan_del(chan, ECONNREFUSED);  in l2cap_ecred_conn_rsp()
6225 				l2cap_chan_del(chan, ECONNREFUSED);  in l2cap_ecred_conn_rsp()
6229 			chan->ident = 0;  in l2cap_ecred_conn_rsp()
6230 			chan->dcid = dcid;  in l2cap_ecred_conn_rsp()
6231 			chan->omtu = mtu;  in l2cap_ecred_conn_rsp()
6232 			chan->remote_mps = mps;  in l2cap_ecred_conn_rsp()
6233 			chan->tx_credits = credits;  in l2cap_ecred_conn_rsp()
6234 			l2cap_chan_ready(chan);  in l2cap_ecred_conn_rsp()
6238 		l2cap_chan_unlock(chan);  in l2cap_ecred_conn_rsp()
6253 	struct l2cap_chan *chan;  in l2cap_ecred_reconf_req()  local
6290 		chan = __l2cap_get_chan_by_dcid(conn, scid);  in l2cap_ecred_reconf_req()
6291 		if (!chan)  in l2cap_ecred_reconf_req()
6298 		if (chan->omtu > mtu) {  in l2cap_ecred_reconf_req()
6299 			BT_ERR("chan %p decreased MTU %u -> %u", chan,  in l2cap_ecred_reconf_req()
6300 			       chan->omtu, mtu);  in l2cap_ecred_reconf_req()
6304 		chan->omtu = mtu;  in l2cap_ecred_reconf_req()
6305 		chan->remote_mps = mps;  in l2cap_ecred_reconf_req()
6321 	struct l2cap_chan *chan, *tmp;  in l2cap_ecred_reconf_rsp()  local
6335 	list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {  in l2cap_ecred_reconf_rsp()
6336 		if (chan->ident != cmd->ident)  in l2cap_ecred_reconf_rsp()
6339 		l2cap_chan_del(chan, ECONNRESET);  in l2cap_ecred_reconf_rsp()
6350 	struct l2cap_chan *chan;  in l2cap_le_command_rej()  local
6357 	chan = __l2cap_get_chan_by_ident(conn, cmd->ident);  in l2cap_le_command_rej()
6358 	if (!chan)  in l2cap_le_command_rej()
6361 	l2cap_chan_lock(chan);  in l2cap_le_command_rej()
6362 	l2cap_chan_del(chan, ECONNREFUSED);  in l2cap_le_command_rej()
6363 	l2cap_chan_unlock(chan);  in l2cap_le_command_rej()
6520 static int l2cap_check_fcs(struct l2cap_chan *chan,  struct sk_buff *skb)  in l2cap_check_fcs()  argument
6525 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_check_fcs()
6530 	if (chan->fcs == L2CAP_FCS_CRC16) {  in l2cap_check_fcs()
6541 static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)  in l2cap_send_i_or_rr_or_rnr()  argument
6545 	BT_DBG("chan %p", chan);  in l2cap_send_i_or_rr_or_rnr()
6550 	control.reqseq = chan->buffer_seq;  in l2cap_send_i_or_rr_or_rnr()
6551 	set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_send_i_or_rr_or_rnr()
6553 	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_send_i_or_rr_or_rnr()
6555 		l2cap_send_sframe(chan, &control);  in l2cap_send_i_or_rr_or_rnr()
6558 	if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&  in l2cap_send_i_or_rr_or_rnr()
6559 	    chan->unacked_frames > 0)  in l2cap_send_i_or_rr_or_rnr()
6560 		__set_retrans_timer(chan);  in l2cap_send_i_or_rr_or_rnr()
6563 	l2cap_ertm_send(chan);  in l2cap_send_i_or_rr_or_rnr()
6565 	if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&  in l2cap_send_i_or_rr_or_rnr()
6566 	    test_bit(CONN_SEND_FBIT, &chan->conn_state)) {  in l2cap_send_i_or_rr_or_rnr()
6571 		l2cap_send_sframe(chan, &control);  in l2cap_send_i_or_rr_or_rnr()
6594 static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,  in l2cap_reassemble_sdu()  argument
6601 		if (chan->sdu)  in l2cap_reassemble_sdu()
6604 		err = chan->ops->recv(chan, skb);  in l2cap_reassemble_sdu()
6608 		if (chan->sdu)  in l2cap_reassemble_sdu()
6614 		chan->sdu_len = get_unaligned_le16(skb->data);  in l2cap_reassemble_sdu()
6617 		if (chan->sdu_len > chan->imtu) {  in l2cap_reassemble_sdu()
6622 		if (skb->len >= chan->sdu_len)  in l2cap_reassemble_sdu()
6625 		chan->sdu = skb;  in l2cap_reassemble_sdu()
6626 		chan->sdu_last_frag = skb;  in l2cap_reassemble_sdu()
6633 		if (!chan->sdu)  in l2cap_reassemble_sdu()
6636 		append_skb_frag(chan->sdu, skb,  in l2cap_reassemble_sdu()
6637 				&chan->sdu_last_frag);  in l2cap_reassemble_sdu()
6640 		if (chan->sdu->len >= chan->sdu_len)  in l2cap_reassemble_sdu()
6647 		if (!chan->sdu)  in l2cap_reassemble_sdu()
6650 		append_skb_frag(chan->sdu, skb,  in l2cap_reassemble_sdu()
6651 				&chan->sdu_last_frag);  in l2cap_reassemble_sdu()
6654 		if (chan->sdu->len != chan->sdu_len)  in l2cap_reassemble_sdu()
6657 		err = chan->ops->recv(chan, chan->sdu);  in l2cap_reassemble_sdu()
6661 			chan->sdu = NULL;  in l2cap_reassemble_sdu()
6662 			chan->sdu_last_frag = NULL;  in l2cap_reassemble_sdu()
6663 			chan->sdu_len = 0;  in l2cap_reassemble_sdu()
6670 		kfree_skb(chan->sdu);  in l2cap_reassemble_sdu()
6671 		chan->sdu = NULL;  in l2cap_reassemble_sdu()
6672 		chan->sdu_last_frag = NULL;  in l2cap_reassemble_sdu()
6673 		chan->sdu_len = 0;  in l2cap_reassemble_sdu()
6679 static int l2cap_resegment(struct l2cap_chan *chan)  in l2cap_resegment()  argument
6685 void l2cap_chan_busy(struct l2cap_chan *chan, int busy)  in l2cap_chan_busy()  argument
6689 	if (chan->mode != L2CAP_MODE_ERTM)  in l2cap_chan_busy()
6693 	l2cap_tx(chan, NULL, NULL, event);  in l2cap_chan_busy()
6696 static int l2cap_rx_queued_iframes(struct l2cap_chan *chan)  in l2cap_rx_queued_iframes()  argument
6703 	BT_DBG("chan %p", chan);  in l2cap_rx_queued_iframes()
6705 	while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_rx_queued_iframes()
6708 		       chan->buffer_seq, skb_queue_len(&chan->srej_q));  in l2cap_rx_queued_iframes()
6710 		skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq);  in l2cap_rx_queued_iframes()
6715 		skb_unlink(skb, &chan->srej_q);  in l2cap_rx_queued_iframes()
6716 		chan->buffer_seq = __next_seq(chan, chan->buffer_seq);  in l2cap_rx_queued_iframes()
6717 		err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->l2cap);  in l2cap_rx_queued_iframes()
6722 	if (skb_queue_empty(&chan->srej_q)) {  in l2cap_rx_queued_iframes()
6723 		chan->rx_state = L2CAP_RX_STATE_RECV;  in l2cap_rx_queued_iframes()
6724 		l2cap_send_ack(chan);  in l2cap_rx_queued_iframes()
6730 static void l2cap_handle_srej(struct l2cap_chan *chan,  in l2cap_handle_srej()  argument
6735 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_handle_srej()
6737 	if (control->reqseq == chan->next_tx_seq) {  in l2cap_handle_srej()
6739 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_handle_srej()
6743 	skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);  in l2cap_handle_srej()
6751 	if (chan->max_tx != 0 && bt_cb(skb)->l2cap.retries >= chan->max_tx) {  in l2cap_handle_srej()
6752 		BT_DBG("Retry limit exceeded (%d)", chan->max_tx);  in l2cap_handle_srej()
6753 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_handle_srej()
6757 	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_handle_srej()
6760 		l2cap_pass_to_tx(chan, control);  in l2cap_handle_srej()
6762 		set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_handle_srej()
6763 		l2cap_retransmit(chan, control);  in l2cap_handle_srej()
6764 		l2cap_ertm_send(chan);  in l2cap_handle_srej()
6766 		if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {  in l2cap_handle_srej()
6767 			set_bit(CONN_SREJ_ACT, &chan->conn_state);  in l2cap_handle_srej()
6768 			chan->srej_save_reqseq = control->reqseq;  in l2cap_handle_srej()
6771 		l2cap_pass_to_tx_fbit(chan, control);  in l2cap_handle_srej()
6774 			if (chan->srej_save_reqseq != control->reqseq ||  in l2cap_handle_srej()
6776 						&chan->conn_state))  in l2cap_handle_srej()
6777 				l2cap_retransmit(chan, control);  in l2cap_handle_srej()
6779 			l2cap_retransmit(chan, control);  in l2cap_handle_srej()
6780 			if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {  in l2cap_handle_srej()
6781 				set_bit(CONN_SREJ_ACT, &chan->conn_state);  in l2cap_handle_srej()
6782 				chan->srej_save_reqseq = control->reqseq;  in l2cap_handle_srej()
6788 static void l2cap_handle_rej(struct l2cap_chan *chan,  in l2cap_handle_rej()  argument
6793 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_handle_rej()
6795 	if (control->reqseq == chan->next_tx_seq) {  in l2cap_handle_rej()
6797 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_handle_rej()
6801 	skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);  in l2cap_handle_rej()
6803 	if (chan->max_tx && skb &&  in l2cap_handle_rej()
6804 	    bt_cb(skb)->l2cap.retries >= chan->max_tx) {  in l2cap_handle_rej()
6805 		BT_DBG("Retry limit exceeded (%d)", chan->max_tx);  in l2cap_handle_rej()
6806 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_handle_rej()
6810 	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_handle_rej()
6812 	l2cap_pass_to_tx(chan, control);  in l2cap_handle_rej()
6815 		if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))  in l2cap_handle_rej()
6816 			l2cap_retransmit_all(chan, control);  in l2cap_handle_rej()
6818 		l2cap_retransmit_all(chan, control);  in l2cap_handle_rej()
6819 		l2cap_ertm_send(chan);  in l2cap_handle_rej()
6820 		if (chan->tx_state == L2CAP_TX_STATE_WAIT_F)  in l2cap_handle_rej()
6821 			set_bit(CONN_REJ_ACT, &chan->conn_state);  in l2cap_handle_rej()
6825 static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq)  in l2cap_classify_txseq()  argument
6827 	BT_DBG("chan %p, txseq %d", chan, txseq);  in l2cap_classify_txseq()
6829 	BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq,  in l2cap_classify_txseq()
6830 	       chan->expected_tx_seq);  in l2cap_classify_txseq()
6832 	if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {  in l2cap_classify_txseq()
6833 		if (__seq_offset(chan, txseq, chan->last_acked_seq) >=  in l2cap_classify_txseq()
6834 		    chan->tx_win) {  in l2cap_classify_txseq()
6838 			if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {  in l2cap_classify_txseq()
6847 		if (chan->srej_list.head == txseq) {  in l2cap_classify_txseq()
6852 		if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) {  in l2cap_classify_txseq()
6857 		if (l2cap_seq_list_contains(&chan->srej_list, txseq)) {  in l2cap_classify_txseq()
6863 	if (chan->expected_tx_seq == txseq) {  in l2cap_classify_txseq()
6864 		if (__seq_offset(chan, txseq, chan->last_acked_seq) >=  in l2cap_classify_txseq()
6865 		    chan->tx_win) {  in l2cap_classify_txseq()
6874 	if (__seq_offset(chan, txseq, chan->last_acked_seq) <  in l2cap_classify_txseq()
6875 	    __seq_offset(chan, chan->expected_tx_seq, chan->last_acked_seq)) {  in l2cap_classify_txseq()
6880 	if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) {  in l2cap_classify_txseq()
6898 		if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {  in l2cap_classify_txseq()
6911 static int l2cap_rx_state_recv(struct l2cap_chan *chan,  in l2cap_rx_state_recv()  argument
6919 	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,  in l2cap_rx_state_recv()
6924 		switch (l2cap_classify_txseq(chan, control->txseq)) {  in l2cap_rx_state_recv()
6926 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
6928 			if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_rx_state_recv()
6934 			chan->expected_tx_seq = __next_seq(chan,  in l2cap_rx_state_recv()
6937 			chan->buffer_seq = chan->expected_tx_seq;  in l2cap_rx_state_recv()
6957 			err = l2cap_reassemble_sdu(chan, skb, control);  in l2cap_rx_state_recv()
6963 							&chan->conn_state)) {  in l2cap_rx_state_recv()
6965 					l2cap_retransmit_all(chan, &local_control);  in l2cap_rx_state_recv()
6966 					l2cap_ertm_send(chan);  in l2cap_rx_state_recv()
6970 			if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state))  in l2cap_rx_state_recv()
6971 				l2cap_send_ack(chan);  in l2cap_rx_state_recv()
6974 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
6980 			if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_rx_state_recv()
6990 			skb_queue_tail(&chan->srej_q, skb);  in l2cap_rx_state_recv()
6993 			       skb_queue_len(&chan->srej_q));  in l2cap_rx_state_recv()
6995 			clear_bit(CONN_SREJ_ACT, &chan->conn_state);  in l2cap_rx_state_recv()
6996 			l2cap_seq_list_clear(&chan->srej_list);  in l2cap_rx_state_recv()
6997 			l2cap_send_srej(chan, control->txseq);  in l2cap_rx_state_recv()
6999 			chan->rx_state = L2CAP_RX_STATE_SREJ_SENT;  in l2cap_rx_state_recv()
7002 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
7008 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_rx_state_recv()
7013 		l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
7015 			clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_rx_state_recv()
7017 			if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state) &&  in l2cap_rx_state_recv()
7018 			    !__chan_is_moving(chan)) {  in l2cap_rx_state_recv()
7020 				l2cap_retransmit_all(chan, control);  in l2cap_rx_state_recv()
7023 			l2cap_ertm_send(chan);  in l2cap_rx_state_recv()
7025 			l2cap_send_i_or_rr_or_rnr(chan);  in l2cap_rx_state_recv()
7028 					       &chan->conn_state) &&  in l2cap_rx_state_recv()
7029 			    chan->unacked_frames)  in l2cap_rx_state_recv()
7030 				__set_retrans_timer(chan);  in l2cap_rx_state_recv()
7032 			l2cap_ertm_send(chan);  in l2cap_rx_state_recv()
7036 		set_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_rx_state_recv()
7037 		l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
7039 			set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_rx_state_recv()
7040 			l2cap_send_rr_or_rnr(chan, 0);  in l2cap_rx_state_recv()
7042 		__clear_retrans_timer(chan);  in l2cap_rx_state_recv()
7043 		l2cap_seq_list_clear(&chan->retrans_list);  in l2cap_rx_state_recv()
7046 		l2cap_handle_rej(chan, control);  in l2cap_rx_state_recv()
7049 		l2cap_handle_srej(chan, control);  in l2cap_rx_state_recv()
7063 static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,  in l2cap_rx_state_srej_sent()  argument
7071 	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,  in l2cap_rx_state_srej_sent()
7076 		switch (l2cap_classify_txseq(chan, txseq)) {  in l2cap_rx_state_srej_sent()
7079 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
7080 			skb_queue_tail(&chan->srej_q, skb);  in l2cap_rx_state_srej_sent()
7083 			       skb_queue_len(&chan->srej_q));  in l2cap_rx_state_srej_sent()
7085 			chan->expected_tx_seq = __next_seq(chan, txseq);  in l2cap_rx_state_srej_sent()
7088 			l2cap_seq_list_pop(&chan->srej_list);  in l2cap_rx_state_srej_sent()
7090 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
7091 			skb_queue_tail(&chan->srej_q, skb);  in l2cap_rx_state_srej_sent()
7094 			       skb_queue_len(&chan->srej_q));  in l2cap_rx_state_srej_sent()
7096 			err = l2cap_rx_queued_iframes(chan);  in l2cap_rx_state_srej_sent()
7106 			skb_queue_tail(&chan->srej_q, skb);  in l2cap_rx_state_srej_sent()
7109 			       skb_queue_len(&chan->srej_q));  in l2cap_rx_state_srej_sent()
7111 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
7112 			l2cap_send_srej(chan, control->txseq);  in l2cap_rx_state_srej_sent()
7120 			skb_queue_tail(&chan->srej_q, skb);  in l2cap_rx_state_srej_sent()
7123 			       skb_queue_len(&chan->srej_q));  in l2cap_rx_state_srej_sent()
7125 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
7126 			l2cap_send_srej_list(chan, control->txseq);  in l2cap_rx_state_srej_sent()
7130 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
7141 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_rx_state_srej_sent()
7146 		l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
7148 			clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_rx_state_srej_sent()
7151 						&chan->conn_state)) {  in l2cap_rx_state_srej_sent()
7153 				l2cap_retransmit_all(chan, control);  in l2cap_rx_state_srej_sent()
7156 			l2cap_ertm_send(chan);  in l2cap_rx_state_srej_sent()
7159 					       &chan->conn_state) &&  in l2cap_rx_state_srej_sent()
7160 			    chan->unacked_frames) {  in l2cap_rx_state_srej_sent()
7161 				__set_retrans_timer(chan);  in l2cap_rx_state_srej_sent()
7164 			set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_rx_state_srej_sent()
7165 			l2cap_send_srej_tail(chan);  in l2cap_rx_state_srej_sent()
7168 					       &chan->conn_state) &&  in l2cap_rx_state_srej_sent()
7169 			    chan->unacked_frames)  in l2cap_rx_state_srej_sent()
7170 				__set_retrans_timer(chan);  in l2cap_rx_state_srej_sent()
7172 			l2cap_send_ack(chan);  in l2cap_rx_state_srej_sent()
7176 		set_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_rx_state_srej_sent()
7177 		l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
7179 			l2cap_send_srej_tail(chan);  in l2cap_rx_state_srej_sent()
7185 			rr_control.reqseq = chan->buffer_seq;  in l2cap_rx_state_srej_sent()
7186 			l2cap_send_sframe(chan, &rr_control);  in l2cap_rx_state_srej_sent()
7191 		l2cap_handle_rej(chan, control);  in l2cap_rx_state_srej_sent()
7194 		l2cap_handle_srej(chan, control);  in l2cap_rx_state_srej_sent()
7206 static int l2cap_finish_move(struct l2cap_chan *chan)  in l2cap_finish_move()  argument
7208 	BT_DBG("chan %p", chan);  in l2cap_finish_move()
7210 	chan->rx_state = L2CAP_RX_STATE_RECV;  in l2cap_finish_move()
7212 	if (chan->hs_hcon)  in l2cap_finish_move()
7213 		chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;  in l2cap_finish_move()
7215 		chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;  in l2cap_finish_move()
7217 	return l2cap_resegment(chan);  in l2cap_finish_move()
7220 static int l2cap_rx_state_wait_p(struct l2cap_chan *chan,  in l2cap_rx_state_wait_p()  argument
7226 	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,  in l2cap_rx_state_wait_p()
7232 	l2cap_process_reqseq(chan, control->reqseq);  in l2cap_rx_state_wait_p()
7234 	if (!skb_queue_empty(&chan->tx_q))  in l2cap_rx_state_wait_p()
7235 		chan->tx_send_head = skb_peek(&chan->tx_q);  in l2cap_rx_state_wait_p()
7237 		chan->tx_send_head = NULL;  in l2cap_rx_state_wait_p()
7242 	chan->next_tx_seq = control->reqseq;  in l2cap_rx_state_wait_p()
7243 	chan->unacked_frames = 0;  in l2cap_rx_state_wait_p()
7245 	err = l2cap_finish_move(chan);  in l2cap_rx_state_wait_p()
7249 	set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_rx_state_wait_p()
7250 	l2cap_send_i_or_rr_or_rnr(chan);  in l2cap_rx_state_wait_p()
7255 	return l2cap_rx_state_recv(chan, control, NULL, event);  in l2cap_rx_state_wait_p()
7258 static int l2cap_rx_state_wait_f(struct l2cap_chan *chan,  in l2cap_rx_state_wait_f()  argument
7267 	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_rx_state_wait_f()
7269 	chan->rx_state = L2CAP_RX_STATE_RECV;  in l2cap_rx_state_wait_f()
7270 	l2cap_process_reqseq(chan, control->reqseq);  in l2cap_rx_state_wait_f()
7272 	if (!skb_queue_empty(&chan->tx_q))  in l2cap_rx_state_wait_f()
7273 		chan->tx_send_head = skb_peek(&chan->tx_q);  in l2cap_rx_state_wait_f()
7275 		chan->tx_send_head = NULL;  in l2cap_rx_state_wait_f()
7280 	chan->next_tx_seq = control->reqseq;  in l2cap_rx_state_wait_f()
7281 	chan->unacked_frames = 0;  in l2cap_rx_state_wait_f()
7283 	if (chan->hs_hcon)  in l2cap_rx_state_wait_f()
7284 		chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;  in l2cap_rx_state_wait_f()
7286 		chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;  in l2cap_rx_state_wait_f()
7288 	err = l2cap_resegment(chan);  in l2cap_rx_state_wait_f()
7291 		err = l2cap_rx_state_recv(chan, control, skb, event);  in l2cap_rx_state_wait_f()
7296 static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq)  in __valid_reqseq()  argument
7301 	unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq);  in __valid_reqseq()
7302 	return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked;  in __valid_reqseq()
7305 static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,  in l2cap_rx()  argument
7310 	BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan,  in l2cap_rx()
7311 	       control, skb, event, chan->rx_state);  in l2cap_rx()
7313 	if (__valid_reqseq(chan, control->reqseq)) {  in l2cap_rx()
7314 		switch (chan->rx_state) {  in l2cap_rx()
7316 			err = l2cap_rx_state_recv(chan, control, skb, event);  in l2cap_rx()
7319 			err = l2cap_rx_state_srej_sent(chan, control, skb,  in l2cap_rx()
7323 			err = l2cap_rx_state_wait_p(chan, control, skb, event);  in l2cap_rx()
7326 			err = l2cap_rx_state_wait_f(chan, control, skb, event);  in l2cap_rx()
7334 		       control->reqseq, chan->next_tx_seq,  in l2cap_rx()
7335 		       chan->expected_ack_seq);  in l2cap_rx()
7336 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_rx()
7342 static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,  in l2cap_stream_rx()  argument
7362 	BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb,  in l2cap_stream_rx()
7363 	       chan->rx_state);  in l2cap_stream_rx()
7365 	if (l2cap_classify_txseq(chan, txseq) == L2CAP_TXSEQ_EXPECTED) {  in l2cap_stream_rx()
7366 		l2cap_pass_to_tx(chan, control);  in l2cap_stream_rx()
7368 		BT_DBG("buffer_seq %u->%u", chan->buffer_seq,  in l2cap_stream_rx()
7369 		       __next_seq(chan, chan->buffer_seq));  in l2cap_stream_rx()
7371 		chan->buffer_seq = __next_seq(chan, chan->buffer_seq);  in l2cap_stream_rx()
7373 		l2cap_reassemble_sdu(chan, skb, control);  in l2cap_stream_rx()
7375 		if (chan->sdu) {  in l2cap_stream_rx()
7376 			kfree_skb(chan->sdu);  in l2cap_stream_rx()
7377 			chan->sdu = NULL;  in l2cap_stream_rx()
7379 		chan->sdu_last_frag = NULL;  in l2cap_stream_rx()
7380 		chan->sdu_len = 0;  in l2cap_stream_rx()
7388 	chan->last_acked_seq = txseq;  in l2cap_stream_rx()
7389 	chan->expected_tx_seq = __next_seq(chan, txseq);  in l2cap_stream_rx()
7394 static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)  in l2cap_data_rcv()  argument
7400 	__unpack_control(chan, skb);  in l2cap_data_rcv()
7409 	if (l2cap_check_fcs(chan, skb))  in l2cap_data_rcv()
7415 	if (chan->fcs == L2CAP_FCS_CRC16)  in l2cap_data_rcv()
7418 	if (len > chan->mps) {  in l2cap_data_rcv()
7419 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_data_rcv()
7423 	if (chan->ops->filter) {  in l2cap_data_rcv()
7424 		if (chan->ops->filter(chan, skb))  in l2cap_data_rcv()
7438 		if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F)  in l2cap_data_rcv()
7441 		if (chan->mode != L2CAP_MODE_STREAMING) {  in l2cap_data_rcv()
7443 			err = l2cap_rx(chan, control, skb, event);  in l2cap_data_rcv()
7445 			err = l2cap_stream_rx(chan, control, skb);  in l2cap_data_rcv()
7449 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_data_rcv()
7457 		if (chan->mode == L2CAP_MODE_STREAMING)  in l2cap_data_rcv()
7466 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_data_rcv()
7472 				       chan->tx_state != L2CAP_TX_STATE_WAIT_F))  in l2cap_data_rcv()
7476 		if (l2cap_rx(chan, control, skb, event))  in l2cap_data_rcv()
7477 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_data_rcv()
7487 static void l2cap_chan_le_send_credits(struct l2cap_chan *chan)  in l2cap_chan_le_send_credits()  argument
7489 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_le_send_credits()
7493 	return_credits = (chan->imtu / chan->mps) + 1;  in l2cap_chan_le_send_credits()
7495 	if (chan->rx_credits >= return_credits)  in l2cap_chan_le_send_credits()
7498 	return_credits -= chan->rx_credits;  in l2cap_chan_le_send_credits()
7500 	BT_DBG("chan %p returning %u credits to sender", chan, return_credits);  in l2cap_chan_le_send_credits()
7502 	chan->rx_credits += return_credits;  in l2cap_chan_le_send_credits()
7504 	pkt.cid     = cpu_to_le16(chan->scid);  in l2cap_chan_le_send_credits()
7507 	chan->ident = l2cap_get_ident(conn);  in l2cap_chan_le_send_credits()
7509 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CREDITS, sizeof(pkt), &pkt);  in l2cap_chan_le_send_credits()
7512 static int l2cap_ecred_recv(struct l2cap_chan *chan, struct sk_buff *skb)  in l2cap_ecred_recv()  argument
7516 	BT_DBG("SDU reassemble complete: chan %p skb->len %u", chan, skb->len);  in l2cap_ecred_recv()
7519 	err = chan->ops->recv(chan, skb);  in l2cap_ecred_recv()
7522 	l2cap_chan_le_send_credits(chan);  in l2cap_ecred_recv()
7527 static int l2cap_ecred_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)  in l2cap_ecred_data_rcv()  argument
7531 	if (!chan->rx_credits) {  in l2cap_ecred_data_rcv()
7533 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_ecred_data_rcv()
7537 	if (chan->imtu < skb->len) {  in l2cap_ecred_data_rcv()
7542 	chan->rx_credits--;  in l2cap_ecred_data_rcv()
7543 	BT_DBG("rx_credits %u -> %u", chan->rx_credits + 1, chan->rx_credits);  in l2cap_ecred_data_rcv()
7548 	if (!chan->rx_credits)  in l2cap_ecred_data_rcv()
7549 		l2cap_chan_le_send_credits(chan);  in l2cap_ecred_data_rcv()
7553 	if (!chan->sdu) {  in l2cap_ecred_data_rcv()
7560 		       sdu_len, skb->len, chan->imtu);  in l2cap_ecred_data_rcv()
7562 		if (sdu_len > chan->imtu) {  in l2cap_ecred_data_rcv()
7575 			return l2cap_ecred_recv(chan, skb);  in l2cap_ecred_data_rcv()
7577 		chan->sdu = skb;  in l2cap_ecred_data_rcv()
7578 		chan->sdu_len = sdu_len;  in l2cap_ecred_data_rcv()
7579 		chan->sdu_last_frag = skb;  in l2cap_ecred_data_rcv()
7582 		if (skb->len + L2CAP_SDULEN_SIZE < chan->mps) {  in l2cap_ecred_data_rcv()
7586 			BT_DBG("chan->mps %u -> %u", chan->mps, mps_len);  in l2cap_ecred_data_rcv()
7587 			chan->mps = mps_len;  in l2cap_ecred_data_rcv()
7588 			l2cap_chan_le_send_credits(chan);  in l2cap_ecred_data_rcv()
7595 	       chan->sdu->len, skb->len, chan->sdu_len);  in l2cap_ecred_data_rcv()
7597 	if (chan->sdu->len + skb->len > chan->sdu_len) {  in l2cap_ecred_data_rcv()
7603 	append_skb_frag(chan->sdu, skb, &chan->sdu_last_frag);  in l2cap_ecred_data_rcv()
7606 	if (chan->sdu->len == chan->sdu_len) {  in l2cap_ecred_data_rcv()
7607 		err = l2cap_ecred_recv(chan, chan->sdu);  in l2cap_ecred_data_rcv()
7609 			chan->sdu = NULL;  in l2cap_ecred_data_rcv()
7610 			chan->sdu_last_frag = NULL;  in l2cap_ecred_data_rcv()
7611 			chan->sdu_len = 0;  in l2cap_ecred_data_rcv()
7618 		kfree_skb(chan->sdu);  in l2cap_ecred_data_rcv()
7619 		chan->sdu = NULL;  in l2cap_ecred_data_rcv()
7620 		chan->sdu_last_frag = NULL;  in l2cap_ecred_data_rcv()
7621 		chan->sdu_len = 0;  in l2cap_ecred_data_rcv()
7634 	struct l2cap_chan *chan;  in l2cap_data_channel()  local
7636 	chan = l2cap_get_chan_by_scid(conn, cid);  in l2cap_data_channel()
7637 	if (!chan) {  in l2cap_data_channel()
7639 			chan = a2mp_channel_create(conn, skb);  in l2cap_data_channel()
7640 			if (!chan) {  in l2cap_data_channel()
7645 			l2cap_chan_hold(chan);  in l2cap_data_channel()
7646 			l2cap_chan_lock(chan);  in l2cap_data_channel()
7655 	BT_DBG("chan %p, len %d", chan, skb->len);  in l2cap_data_channel()
7661 	if (chan->chan_type == L2CAP_CHAN_FIXED)  in l2cap_data_channel()
7662 		l2cap_chan_ready(chan);  in l2cap_data_channel()
7664 	if (chan->state != BT_CONNECTED)  in l2cap_data_channel()
7667 	switch (chan->mode) {  in l2cap_data_channel()
7670 		if (l2cap_ecred_data_rcv(chan, skb) < 0)  in l2cap_data_channel()
7681 		if (chan->imtu < skb->len) {  in l2cap_data_channel()
7686 		if (!chan->ops->recv(chan, skb))  in l2cap_data_channel()
7692 		l2cap_data_rcv(chan, skb);  in l2cap_data_channel()
7696 		BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);  in l2cap_data_channel()
7704 	l2cap_chan_unlock(chan);  in l2cap_data_channel()
7705 	l2cap_chan_put(chan);  in l2cap_data_channel()
7712 	struct l2cap_chan *chan;  in l2cap_conless_channel()  local
7717 	chan = l2cap_global_chan_by_psm(0, psm, &hcon->src, &hcon->dst,  in l2cap_conless_channel()
7719 	if (!chan)  in l2cap_conless_channel()
7722 	BT_DBG("chan %p, len %d", chan, skb->len);  in l2cap_conless_channel()
7724 	if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)  in l2cap_conless_channel()
7727 	if (chan->imtu < skb->len)  in l2cap_conless_channel()
7734 	if (!chan->ops->recv(chan, skb)) {  in l2cap_conless_channel()
7735 		l2cap_chan_put(chan);  in l2cap_conless_channel()
7740 	l2cap_chan_put(chan);  in l2cap_conless_channel()
7892 	struct l2cap_chan *chan;  member
7897 static void l2cap_chan_by_pid(struct l2cap_chan *chan, void *data)  in l2cap_chan_by_pid()  argument
7902 	if (chan == d->chan)  in l2cap_chan_by_pid()
7905 	if (!test_bit(FLAG_DEFER_SETUP, &chan->flags))  in l2cap_chan_by_pid()
7908 	pid = chan->ops->get_peer_pid(chan);  in l2cap_chan_by_pid()
7911 	if (d->pid != pid || chan->psm != d->chan->psm || chan->ident ||  in l2cap_chan_by_pid()
7912 	    chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT)  in l2cap_chan_by_pid()
7918 int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,  in l2cap_chan_connect()  argument
7926 	BT_DBG("%pMR -> %pMR (type %u) psm 0x%4.4x mode 0x%2.2x", &chan->src,  in l2cap_chan_connect()
7927 	       dst, dst_type, __le16_to_cpu(psm), chan->mode);  in l2cap_chan_connect()
7929 	hdev = hci_get_route(dst, &chan->src, chan->src_type);  in l2cap_chan_connect()
7936 	    chan->chan_type != L2CAP_CHAN_RAW) {  in l2cap_chan_connect()
7941 	if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !psm) {  in l2cap_chan_connect()
7946 	if (chan->chan_type == L2CAP_CHAN_FIXED && !cid) {  in l2cap_chan_connect()
7951 	switch (chan->mode) {  in l2cap_chan_connect()
7972 	switch (chan->state) {  in l2cap_chan_connect()
7996 	bacpy(&chan->dst, dst);  in l2cap_chan_connect()
7997 	chan->dst_type = dst_type;  in l2cap_chan_connect()
7999 	chan->psm = psm;  in l2cap_chan_connect()
8000 	chan->dcid = cid;  in l2cap_chan_connect()
8012 					      chan->sec_level,  in l2cap_chan_connect()
8017 						   chan->sec_level,  in l2cap_chan_connect()
8022 		u8 auth_type = l2cap_get_auth_type(chan);  in l2cap_chan_connect()
8023 		hcon = hci_connect_acl(hdev, dst, chan->sec_level, auth_type,  in l2cap_chan_connect()
8039 	if (chan->mode == L2CAP_MODE_EXT_FLOWCTL) {  in l2cap_chan_connect()
8042 		data.chan = chan;  in l2cap_chan_connect()
8043 		data.pid = chan->ops->get_peer_pid(chan);  in l2cap_chan_connect()
8057 	l2cap_chan_lock(chan);  in l2cap_chan_connect()
8066 	bacpy(&chan->src, &hcon->src);  in l2cap_chan_connect()
8067 	chan->src_type = bdaddr_src_type(hcon);  in l2cap_chan_connect()
8069 	__l2cap_chan_add(conn, chan);  in l2cap_chan_connect()
8074 	l2cap_state_change(chan, BT_CONNECT);  in l2cap_chan_connect()
8075 	__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));  in l2cap_chan_connect()
8081 	chan->sport = 0;  in l2cap_chan_connect()
8085 		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {  in l2cap_chan_connect()
8086 			__clear_chan_timer(chan);  in l2cap_chan_connect()
8087 			if (l2cap_chan_check_security(chan, true))  in l2cap_chan_connect()
8088 				l2cap_state_change(chan, BT_CONNECTED);  in l2cap_chan_connect()
8090 			l2cap_do_start(chan);  in l2cap_chan_connect()
8096 	l2cap_chan_unlock(chan);  in l2cap_chan_connect()
8105 static void l2cap_ecred_reconfigure(struct l2cap_chan *chan)  in l2cap_ecred_reconfigure()  argument
8107 	struct l2cap_conn *conn = chan->conn;  in l2cap_ecred_reconfigure()
8113 	pdu.req.mtu = cpu_to_le16(chan->imtu);  in l2cap_ecred_reconfigure()
8114 	pdu.req.mps = cpu_to_le16(chan->mps);  in l2cap_ecred_reconfigure()
8115 	pdu.scid    = cpu_to_le16(chan->scid);  in l2cap_ecred_reconfigure()
8117 	chan->ident = l2cap_get_ident(conn);  in l2cap_ecred_reconfigure()
8119 	l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_RECONF_REQ,  in l2cap_ecred_reconfigure()
8123 int l2cap_chan_reconfigure(struct l2cap_chan *chan, __u16 mtu)  in l2cap_chan_reconfigure()  argument
8125 	if (chan->imtu > mtu)  in l2cap_chan_reconfigure()
8128 	BT_DBG("chan %p mtu 0x%4.4x", chan, mtu);  in l2cap_chan_reconfigure()
8130 	chan->imtu = mtu;  in l2cap_chan_reconfigure()
8132 	l2cap_ecred_reconfigure(chan);  in l2cap_chan_reconfigure()
8238 		struct l2cap_chan *chan, *next;  in l2cap_connect_cfm()  local
8245 		chan = pchan->ops->new_connection(pchan);  in l2cap_connect_cfm()
8246 		if (chan) {  in l2cap_connect_cfm()
8247 			bacpy(&chan->src, &hcon->src);  in l2cap_connect_cfm()
8248 			bacpy(&chan->dst, &hcon->dst);  in l2cap_connect_cfm()
8249 			chan->src_type = bdaddr_src_type(hcon);  in l2cap_connect_cfm()
8250 			chan->dst_type = dst_type;  in l2cap_connect_cfm()
8252 			__l2cap_chan_add(conn, chan);  in l2cap_connect_cfm()
8286 static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)  in l2cap_check_encryption()  argument
8288 	if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)  in l2cap_check_encryption()
8292 		if (chan->sec_level == BT_SECURITY_MEDIUM) {  in l2cap_check_encryption()
8293 			__set_chan_timer(chan, L2CAP_ENC_TIMEOUT);  in l2cap_check_encryption()
8294 		} else if (chan->sec_level == BT_SECURITY_HIGH ||  in l2cap_check_encryption()
8295 			   chan->sec_level == BT_SECURITY_FIPS)  in l2cap_check_encryption()
8296 			l2cap_chan_close(chan, ECONNREFUSED);  in l2cap_check_encryption()
8298 		if (chan->sec_level == BT_SECURITY_MEDIUM)  in l2cap_check_encryption()
8299 			__clear_chan_timer(chan);  in l2cap_check_encryption()
8306 	struct l2cap_chan *chan;  in l2cap_security_cfm()  local
8315 	list_for_each_entry(chan, &conn->chan_l, list) {  in l2cap_security_cfm()
8316 		l2cap_chan_lock(chan);  in l2cap_security_cfm()
8318 		BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid,  in l2cap_security_cfm()
8319 		       state_to_string(chan->state));  in l2cap_security_cfm()
8321 		if (chan->scid == L2CAP_CID_A2MP) {  in l2cap_security_cfm()
8322 			l2cap_chan_unlock(chan);  in l2cap_security_cfm()
8327 			chan->sec_level = hcon->sec_level;  in l2cap_security_cfm()
8329 		if (!__l2cap_no_conn_pending(chan)) {  in l2cap_security_cfm()
8330 			l2cap_chan_unlock(chan);  in l2cap_security_cfm()
8334 		if (!status && (chan->state == BT_CONNECTED ||  in l2cap_security_cfm()
8335 				chan->state == BT_CONFIG)) {  in l2cap_security_cfm()
8336 			chan->ops->resume(chan);  in l2cap_security_cfm()
8337 			l2cap_check_encryption(chan, encrypt);  in l2cap_security_cfm()
8338 			l2cap_chan_unlock(chan);  in l2cap_security_cfm()
8342 		if (chan->state == BT_CONNECT) {  in l2cap_security_cfm()
8344 				l2cap_start_connection(chan);  in l2cap_security_cfm()
8346 				__set_chan_timer(chan, L2CAP_DISC_TIMEOUT);  in l2cap_security_cfm()
8347 		} else if (chan->state == BT_CONNECT2 &&  in l2cap_security_cfm()
8348 			   !(chan->mode == L2CAP_MODE_EXT_FLOWCTL ||  in l2cap_security_cfm()
8349 			     chan->mode == L2CAP_MODE_LE_FLOWCTL)) {  in l2cap_security_cfm()
8354 				if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {  in l2cap_security_cfm()
8357 					chan->ops->defer(chan);  in l2cap_security_cfm()
8359 					l2cap_state_change(chan, BT_CONFIG);  in l2cap_security_cfm()
8364 				l2cap_state_change(chan, BT_DISCONN);  in l2cap_security_cfm()
8365 				__set_chan_timer(chan, L2CAP_DISC_TIMEOUT);  in l2cap_security_cfm()
8370 			rsp.scid   = cpu_to_le16(chan->dcid);  in l2cap_security_cfm()
8371 			rsp.dcid   = cpu_to_le16(chan->scid);  in l2cap_security_cfm()
8374 			l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,  in l2cap_security_cfm()
8377 			if (!test_bit(CONF_REQ_SENT, &chan->conf_state) &&  in l2cap_security_cfm()
8380 				set_bit(CONF_REQ_SENT, &chan->conf_state);  in l2cap_security_cfm()
8383 					       l2cap_build_conf_req(chan, buf, sizeof(buf)),  in l2cap_security_cfm()
8385 				chan->num_conf_req++;  in l2cap_security_cfm()
8389 		l2cap_chan_unlock(chan);  in l2cap_security_cfm()