55 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data);
56 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err);
58 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
157 int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)  in l2cap_add_psm()  argument
169 		chan->psm = psm;  in l2cap_add_psm()
170 		chan->sport = psm;  in l2cap_add_psm()
178 				chan->psm   = cpu_to_le16(p);  in l2cap_add_psm()
179 				chan->sport = cpu_to_le16(p);  in l2cap_add_psm()
190 int l2cap_add_scid(struct l2cap_chan *chan,  __u16 scid)  in l2cap_add_scid()  argument
194 	chan->scid = scid;  in l2cap_add_scid()
213 static void __l2cap_state_change(struct l2cap_chan *chan, int state)  in __l2cap_state_change()  argument
215 	BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),  in __l2cap_state_change()
218 	chan->state = state;  in __l2cap_state_change()
219 	chan->ops->state_change(chan, state);  in __l2cap_state_change()
222 static void l2cap_state_change(struct l2cap_chan *chan, int state)  in l2cap_state_change()  argument
224 	struct sock *sk = chan->sk;  in l2cap_state_change()
227 	__l2cap_state_change(chan, state);  in l2cap_state_change()
231 static inline void __l2cap_chan_set_err(struct l2cap_chan *chan, int err)  in __l2cap_chan_set_err()  argument
233 	struct sock *sk = chan->sk;  in __l2cap_chan_set_err()
238 static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)  in l2cap_chan_set_err()  argument
240 	struct sock *sk = chan->sk;  in l2cap_chan_set_err()
243 	__l2cap_chan_set_err(chan, err);  in l2cap_chan_set_err()
247 static void __set_retrans_timer(struct l2cap_chan *chan)  in __set_retrans_timer()  argument
249 	if (!delayed_work_pending(&chan->monitor_timer) &&  in __set_retrans_timer()
250 	    chan->retrans_timeout) {  in __set_retrans_timer()
251 		l2cap_set_timer(chan, &chan->retrans_timer,  in __set_retrans_timer()
252 				msecs_to_jiffies(chan->retrans_timeout));  in __set_retrans_timer()
256 static void __set_monitor_timer(struct l2cap_chan *chan)  in __set_monitor_timer()  argument
258 	__clear_retrans_timer(chan);  in __set_monitor_timer()
259 	if (chan->monitor_timeout) {  in __set_monitor_timer()
260 		l2cap_set_timer(chan, &chan->monitor_timer,  in __set_monitor_timer()
261 				msecs_to_jiffies(chan->monitor_timeout));  in __set_monitor_timer()
398 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,  in l2cap_chan_timeout()  local
400 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_timeout()
403 	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));  in l2cap_chan_timeout()
406 	l2cap_chan_lock(chan);  in l2cap_chan_timeout()
408 	if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)  in l2cap_chan_timeout()
410 	else if (chan->state == BT_CONNECT &&  in l2cap_chan_timeout()
411 		 chan->sec_level != BT_SECURITY_SDP)  in l2cap_chan_timeout()
416 	l2cap_chan_close(chan, reason);  in l2cap_chan_timeout()
418 	l2cap_chan_unlock(chan);  in l2cap_chan_timeout()
420 	chan->ops->close(chan);  in l2cap_chan_timeout()
423 	l2cap_chan_put(chan);  in l2cap_chan_timeout()
428 	struct l2cap_chan *chan;  in l2cap_chan_create()  local
430 	chan = kzalloc(sizeof(*chan), GFP_ATOMIC);  in l2cap_chan_create()
431 	if (!chan)  in l2cap_chan_create()
434 	mutex_init(&chan->lock);  in l2cap_chan_create()
437 	list_add(&chan->global_l, &chan_list);  in l2cap_chan_create()
440 	INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);  in l2cap_chan_create()
442 	chan->state = BT_OPEN;  in l2cap_chan_create()
444 	kref_init(&chan->kref);  in l2cap_chan_create()
447 	set_bit(CONF_NOT_COMPLETE, &chan->conf_state);  in l2cap_chan_create()
449 	BT_DBG("chan %p", chan);  in l2cap_chan_create()
451 	return chan;  in l2cap_chan_create()
456 	struct l2cap_chan *chan = container_of(kref, struct l2cap_chan, kref);  in l2cap_chan_destroy()  local
458 	BT_DBG("chan %p", chan);  in l2cap_chan_destroy()
461 	list_del(&chan->global_l);  in l2cap_chan_destroy()
464 	kfree(chan);  in l2cap_chan_destroy()
481 void l2cap_chan_set_defaults(struct l2cap_chan *chan)  in l2cap_chan_set_defaults()  argument
483 	chan->fcs  = L2CAP_FCS_CRC16;  in l2cap_chan_set_defaults()
484 	chan->max_tx = L2CAP_DEFAULT_MAX_TX;  in l2cap_chan_set_defaults()
485 	chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;  in l2cap_chan_set_defaults()
486 	chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;  in l2cap_chan_set_defaults()
487 	chan->ack_win = L2CAP_DEFAULT_TX_WINDOW;  in l2cap_chan_set_defaults()
488 	chan->sec_level = BT_SECURITY_LOW;  in l2cap_chan_set_defaults()
490 	set_bit(FLAG_FORCE_ACTIVE, &chan->flags);  in l2cap_chan_set_defaults()
493 void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)  in __l2cap_chan_add()  argument
496 	       __le16_to_cpu(chan->psm), chan->dcid);  in __l2cap_chan_add()
500 	chan->conn = conn;  in __l2cap_chan_add()
502 	switch (chan->chan_type) {  in __l2cap_chan_add()
506 			chan->omtu = L2CAP_DEFAULT_MTU;  in __l2cap_chan_add()
507 			chan->scid = L2CAP_CID_LE_DATA;  in __l2cap_chan_add()
508 			chan->dcid = L2CAP_CID_LE_DATA;  in __l2cap_chan_add()
511 			chan->scid = l2cap_alloc_cid(conn);  in __l2cap_chan_add()
512 			chan->omtu = L2CAP_DEFAULT_MTU;  in __l2cap_chan_add()
518 		chan->scid = L2CAP_CID_CONN_LESS;  in __l2cap_chan_add()
519 		chan->dcid = L2CAP_CID_CONN_LESS;  in __l2cap_chan_add()
520 		chan->omtu = L2CAP_DEFAULT_MTU;  in __l2cap_chan_add()
524 		chan->scid = L2CAP_CID_A2MP;  in __l2cap_chan_add()
525 		chan->dcid = L2CAP_CID_A2MP;  in __l2cap_chan_add()
526 		chan->omtu = L2CAP_A2MP_DEFAULT_MTU;  in __l2cap_chan_add()
527 		chan->imtu = L2CAP_A2MP_DEFAULT_MTU;  in __l2cap_chan_add()
532 		chan->scid = L2CAP_CID_SIGNALING;  in __l2cap_chan_add()
533 		chan->dcid = L2CAP_CID_SIGNALING;  in __l2cap_chan_add()
534 		chan->omtu = L2CAP_DEFAULT_MTU;  in __l2cap_chan_add()
537 	chan->local_id		= L2CAP_BESTEFFORT_ID;  in __l2cap_chan_add()
538 	chan->local_stype	= L2CAP_SERV_BESTEFFORT;  in __l2cap_chan_add()
539 	chan->local_msdu	= L2CAP_DEFAULT_MAX_SDU_SIZE;  in __l2cap_chan_add()
540 	chan->local_sdu_itime	= L2CAP_DEFAULT_SDU_ITIME;  in __l2cap_chan_add()
541 	chan->local_acc_lat	= L2CAP_DEFAULT_ACC_LAT;  in __l2cap_chan_add()
542 	chan->local_flush_to	= L2CAP_EFS_DEFAULT_FLUSH_TO;  in __l2cap_chan_add()
544 	l2cap_chan_hold(chan);  in __l2cap_chan_add()
546 	list_add(&chan->list, &conn->chan_l);  in __l2cap_chan_add()
549 void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)  in l2cap_chan_add()  argument
552 	__l2cap_chan_add(conn, chan);  in l2cap_chan_add()
556 void l2cap_chan_del(struct l2cap_chan *chan, int err)  in l2cap_chan_del()  argument
558 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_del()
560 	__clear_chan_timer(chan);  in l2cap_chan_del()
562 	BT_DBG("chan %p, conn %p, err %d", chan, conn, err);  in l2cap_chan_del()
567 		list_del(&chan->list);  in l2cap_chan_del()
569 		l2cap_chan_put(chan);  in l2cap_chan_del()
571 		chan->conn = NULL;  in l2cap_chan_del()
573 		if (chan->chan_type != L2CAP_CHAN_CONN_FIX_A2MP)  in l2cap_chan_del()
576 		if (mgr && mgr->bredr_chan == chan)  in l2cap_chan_del()
580 	if (chan->hs_hchan) {  in l2cap_chan_del()
581 		struct hci_chan *hs_hchan = chan->hs_hchan;  in l2cap_chan_del()
583 		BT_DBG("chan %p disconnect hs_hchan %p", chan, hs_hchan);  in l2cap_chan_del()
587 	chan->ops->teardown(chan, err);  in l2cap_chan_del()
589 	if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))  in l2cap_chan_del()
592 	switch(chan->mode) {  in l2cap_chan_del()
597 		__clear_retrans_timer(chan);  in l2cap_chan_del()
598 		__clear_monitor_timer(chan);  in l2cap_chan_del()
599 		__clear_ack_timer(chan);  in l2cap_chan_del()
601 		skb_queue_purge(&chan->srej_q);  in l2cap_chan_del()
603 		l2cap_seq_list_free(&chan->srej_list);  in l2cap_chan_del()
604 		l2cap_seq_list_free(&chan->retrans_list);  in l2cap_chan_del()
609 		skb_queue_purge(&chan->tx_q);  in l2cap_chan_del()
616 void l2cap_chan_close(struct l2cap_chan *chan, int reason)  in l2cap_chan_close()  argument
618 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_close()
619 	struct sock *sk = chan->sk;  in l2cap_chan_close()
621 	BT_DBG("chan %p state %s sk %p", chan, state_to_string(chan->state),  in l2cap_chan_close()
624 	switch (chan->state) {  in l2cap_chan_close()
626 		chan->ops->teardown(chan, 0);  in l2cap_chan_close()
631 		if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&  in l2cap_chan_close()
633 			__set_chan_timer(chan, sk->sk_sndtimeo);  in l2cap_chan_close()
634 			l2cap_send_disconn_req(chan, reason);  in l2cap_chan_close()
636 			l2cap_chan_del(chan, reason);  in l2cap_chan_close()
640 		if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&  in l2cap_chan_close()
649 			l2cap_state_change(chan, BT_DISCONN);  in l2cap_chan_close()
651 			rsp.scid   = cpu_to_le16(chan->dcid);  in l2cap_chan_close()
652 			rsp.dcid   = cpu_to_le16(chan->scid);  in l2cap_chan_close()
655 			l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,  in l2cap_chan_close()
659 		l2cap_chan_del(chan, reason);  in l2cap_chan_close()
664 		l2cap_chan_del(chan, reason);  in l2cap_chan_close()
668 		chan->ops->teardown(chan, 0);  in l2cap_chan_close()
673 static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)  in l2cap_get_auth_type()  argument
675 	if (chan->chan_type == L2CAP_CHAN_RAW) {  in l2cap_get_auth_type()
676 		switch (chan->sec_level) {  in l2cap_get_auth_type()
684 	} else if (chan->psm == __constant_cpu_to_le16(L2CAP_PSM_SDP)) {  in l2cap_get_auth_type()
685 		if (chan->sec_level == BT_SECURITY_LOW)  in l2cap_get_auth_type()
686 			chan->sec_level = BT_SECURITY_SDP;  in l2cap_get_auth_type()
688 		if (chan->sec_level == BT_SECURITY_HIGH)  in l2cap_get_auth_type()
693 		switch (chan->sec_level) {  in l2cap_get_auth_type()
705 int l2cap_chan_check_security(struct l2cap_chan *chan)  in l2cap_chan_check_security()  argument
707 	struct l2cap_conn *conn = chan->conn;  in l2cap_chan_check_security()
710 	auth_type = l2cap_get_auth_type(chan);  in l2cap_chan_check_security()
712 	return hci_conn_security(conn->hcon, chan->sec_level, auth_type);  in l2cap_chan_check_security()
759 static bool __chan_is_moving(struct l2cap_chan *chan)  in __chan_is_moving()  argument
761 	return chan->move_state != L2CAP_MOVE_STABLE &&  in __chan_is_moving()
762 	       chan->move_state != L2CAP_MOVE_WAIT_PREPARE;  in __chan_is_moving()
765 static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)  in l2cap_do_send()  argument
767 	struct hci_conn *hcon = chan->conn->hcon;  in l2cap_do_send()
770 	BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,  in l2cap_do_send()
773 	if (chan->hs_hcon && !__chan_is_moving(chan)) {  in l2cap_do_send()
774 		if (chan->hs_hchan)  in l2cap_do_send()
775 			hci_send_acl(chan->hs_hchan, skb, ACL_COMPLETE);  in l2cap_do_send()
782 	if (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&  in l2cap_do_send()
788 	bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);  in l2cap_do_send()
789 	hci_send_acl(chan->conn->hchan, skb, flags);  in l2cap_do_send()
840 static inline void __unpack_control(struct l2cap_chan *chan,  in __unpack_control()  argument
843 	if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {  in __unpack_control()
892 static inline void __pack_control(struct l2cap_chan *chan,  in __pack_control()  argument
896 	if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {  in __pack_control()
905 static inline unsigned int __ertm_hdr_size(struct l2cap_chan *chan)  in __ertm_hdr_size()  argument
907 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in __ertm_hdr_size()
913 static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan,  in l2cap_create_sframe_pdu()  argument
918 	int hlen = __ertm_hdr_size(chan);  in l2cap_create_sframe_pdu()
920 	if (chan->fcs == L2CAP_FCS_CRC16)  in l2cap_create_sframe_pdu()
930 	lh->cid = cpu_to_le16(chan->dcid);  in l2cap_create_sframe_pdu()
932 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_create_sframe_pdu()
937 	if (chan->fcs == L2CAP_FCS_CRC16) {  in l2cap_create_sframe_pdu()
946 static void l2cap_send_sframe(struct l2cap_chan *chan,  in l2cap_send_sframe()  argument
952 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_send_sframe()
957 	if (__chan_is_moving(chan))  in l2cap_send_sframe()
960 	if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) &&  in l2cap_send_sframe()
965 		clear_bit(CONN_RNR_SENT, &chan->conn_state);  in l2cap_send_sframe()
967 		set_bit(CONN_RNR_SENT, &chan->conn_state);  in l2cap_send_sframe()
970 		chan->last_acked_seq = control->reqseq;  in l2cap_send_sframe()
971 		__clear_ack_timer(chan);  in l2cap_send_sframe()
977 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_send_sframe()
982 	skb = l2cap_create_sframe_pdu(chan, control_field);  in l2cap_send_sframe()
984 		l2cap_do_send(chan, skb);  in l2cap_send_sframe()
987 static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll)  in l2cap_send_rr_or_rnr()  argument
991 	BT_DBG("chan %p, poll %d", chan, poll);  in l2cap_send_rr_or_rnr()
997 	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state))  in l2cap_send_rr_or_rnr()
1002 	control.reqseq = chan->buffer_seq;  in l2cap_send_rr_or_rnr()
1003 	l2cap_send_sframe(chan, &control);  in l2cap_send_rr_or_rnr()
1006 static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)  in __l2cap_no_conn_pending()  argument
1008 	return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);  in __l2cap_no_conn_pending()
1011 static bool __amp_capable(struct l2cap_chan *chan)  in __amp_capable()  argument
1013 	struct l2cap_conn *conn = chan->conn;  in __amp_capable()
1017 	    chan->chan_policy == BT_CHANNEL_POLICY_AMP_PREFERRED &&  in __amp_capable()
1024 static bool l2cap_check_efs(struct l2cap_chan *chan)  in l2cap_check_efs()  argument
1030 void l2cap_send_conn_req(struct l2cap_chan *chan)  in l2cap_send_conn_req()  argument
1032 	struct l2cap_conn *conn = chan->conn;  in l2cap_send_conn_req()
1035 	req.scid = cpu_to_le16(chan->scid);  in l2cap_send_conn_req()
1036 	req.psm  = chan->psm;  in l2cap_send_conn_req()
1038 	chan->ident = l2cap_get_ident(conn);  in l2cap_send_conn_req()
1040 	set_bit(CONF_CONNECT_PEND, &chan->conf_state);  in l2cap_send_conn_req()
1042 	l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);  in l2cap_send_conn_req()
1045 static void l2cap_send_create_chan_req(struct l2cap_chan *chan, u8 amp_id)  in l2cap_send_create_chan_req()  argument
1048 	req.scid = cpu_to_le16(chan->scid);  in l2cap_send_create_chan_req()
1049 	req.psm  = chan->psm;  in l2cap_send_create_chan_req()
1052 	chan->ident = l2cap_get_ident(chan->conn);  in l2cap_send_create_chan_req()
1054 	l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_REQ,  in l2cap_send_create_chan_req()
1058 static void l2cap_move_setup(struct l2cap_chan *chan)  in l2cap_move_setup()  argument
1062 	BT_DBG("chan %p", chan);  in l2cap_move_setup()
1064 	if (chan->mode != L2CAP_MODE_ERTM)  in l2cap_move_setup()
1067 	__clear_retrans_timer(chan);  in l2cap_move_setup()
1068 	__clear_monitor_timer(chan);  in l2cap_move_setup()
1069 	__clear_ack_timer(chan);  in l2cap_move_setup()
1071 	chan->retry_count = 0;  in l2cap_move_setup()
1072 	skb_queue_walk(&chan->tx_q, skb) {  in l2cap_move_setup()
1079 	chan->expected_tx_seq = chan->buffer_seq;  in l2cap_move_setup()
1081 	clear_bit(CONN_REJ_ACT, &chan->conn_state);  in l2cap_move_setup()
1082 	clear_bit(CONN_SREJ_ACT, &chan->conn_state);  in l2cap_move_setup()
1083 	l2cap_seq_list_clear(&chan->retrans_list);  in l2cap_move_setup()
1084 	l2cap_seq_list_clear(&chan->srej_list);  in l2cap_move_setup()
1085 	skb_queue_purge(&chan->srej_q);  in l2cap_move_setup()
1087 	chan->tx_state = L2CAP_TX_STATE_XMIT;  in l2cap_move_setup()
1088 	chan->rx_state = L2CAP_RX_STATE_MOVE;  in l2cap_move_setup()
1090 	set_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_move_setup()
1093 static void l2cap_move_done(struct l2cap_chan *chan)  in l2cap_move_done()  argument
1095 	u8 move_role = chan->move_role;  in l2cap_move_done()
1096 	BT_DBG("chan %p", chan);  in l2cap_move_done()
1098 	chan->move_state = L2CAP_MOVE_STABLE;  in l2cap_move_done()
1099 	chan->move_role = L2CAP_MOVE_ROLE_NONE;  in l2cap_move_done()
1101 	if (chan->mode != L2CAP_MODE_ERTM)  in l2cap_move_done()
1106 		l2cap_tx(chan, NULL, NULL, L2CAP_EV_EXPLICIT_POLL);  in l2cap_move_done()
1107 		chan->rx_state = L2CAP_RX_STATE_WAIT_F;  in l2cap_move_done()
1110 		chan->rx_state = L2CAP_RX_STATE_WAIT_P;  in l2cap_move_done()
1115 static void l2cap_chan_ready(struct l2cap_chan *chan)  in l2cap_chan_ready()  argument
1118 	chan->conf_state = 0;  in l2cap_chan_ready()
1119 	__clear_chan_timer(chan);  in l2cap_chan_ready()
1121 	chan->state = BT_CONNECTED;  in l2cap_chan_ready()
1123 	chan->ops->ready(chan);  in l2cap_chan_ready()
1126 static void l2cap_start_connection(struct l2cap_chan *chan)  in l2cap_start_connection()  argument
1128 	if (__amp_capable(chan)) {  in l2cap_start_connection()
1129 		BT_DBG("chan %p AMP capable: discover AMPs", chan);  in l2cap_start_connection()
1130 		a2mp_discover_amp(chan);  in l2cap_start_connection()
1132 		l2cap_send_conn_req(chan);  in l2cap_start_connection()
1136 static void l2cap_do_start(struct l2cap_chan *chan)  in l2cap_do_start()  argument
1138 	struct l2cap_conn *conn = chan->conn;  in l2cap_do_start()
1141 		l2cap_chan_ready(chan);  in l2cap_do_start()
1149 		if (l2cap_chan_check_security(chan) &&  in l2cap_do_start()
1150 		    __l2cap_no_conn_pending(chan)) {  in l2cap_do_start()
1151 			l2cap_start_connection(chan);  in l2cap_do_start()
1183 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err)  in l2cap_send_disconn_req()  argument
1185 	struct sock *sk = chan->sk;  in l2cap_send_disconn_req()
1186 	struct l2cap_conn *conn = chan->conn;  in l2cap_send_disconn_req()
1192 	if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) {  in l2cap_send_disconn_req()
1193 		__clear_retrans_timer(chan);  in l2cap_send_disconn_req()
1194 		__clear_monitor_timer(chan);  in l2cap_send_disconn_req()
1195 		__clear_ack_timer(chan);  in l2cap_send_disconn_req()
1198 	if (chan->chan_type == L2CAP_CHAN_CONN_FIX_A2MP) {  in l2cap_send_disconn_req()
1199 		l2cap_state_change(chan, BT_DISCONN);  in l2cap_send_disconn_req()
1203 	req.dcid = cpu_to_le16(chan->dcid);  in l2cap_send_disconn_req()
1204 	req.scid = cpu_to_le16(chan->scid);  in l2cap_send_disconn_req()
1209 	__l2cap_state_change(chan, BT_DISCONN);  in l2cap_send_disconn_req()
1210 	__l2cap_chan_set_err(chan, err);  in l2cap_send_disconn_req()
1217 	struct l2cap_chan *chan, *tmp;  in l2cap_conn_start()  local
1223 	list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {  in l2cap_conn_start()
1224 		struct sock *sk = chan->sk;  in l2cap_conn_start()
1226 		l2cap_chan_lock(chan);  in l2cap_conn_start()
1228 		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {  in l2cap_conn_start()
1229 			l2cap_chan_unlock(chan);  in l2cap_conn_start()
1233 		if (chan->state == BT_CONNECT) {  in l2cap_conn_start()
1234 			if (!l2cap_chan_check_security(chan) ||  in l2cap_conn_start()
1235 			    !__l2cap_no_conn_pending(chan)) {  in l2cap_conn_start()
1236 				l2cap_chan_unlock(chan);  in l2cap_conn_start()
1240 			if (!l2cap_mode_supported(chan->mode, conn->feat_mask)  in l2cap_conn_start()
1242 					&chan->conf_state)) {  in l2cap_conn_start()
1243 				l2cap_chan_close(chan, ECONNRESET);  in l2cap_conn_start()
1244 				l2cap_chan_unlock(chan);  in l2cap_conn_start()
1248 			l2cap_start_connection(chan);  in l2cap_conn_start()
1250 		} else if (chan->state == BT_CONNECT2) {  in l2cap_conn_start()
1253 			rsp.scid = cpu_to_le16(chan->dcid);  in l2cap_conn_start()
1254 			rsp.dcid = cpu_to_le16(chan->scid);  in l2cap_conn_start()
1256 			if (l2cap_chan_check_security(chan)) {  in l2cap_conn_start()
1262 					chan->ops->defer(chan);  in l2cap_conn_start()
1265 					__l2cap_state_change(chan, BT_CONFIG);  in l2cap_conn_start()
1275 			l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,  in l2cap_conn_start()
1278 			if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||  in l2cap_conn_start()
1280 				l2cap_chan_unlock(chan);  in l2cap_conn_start()
1284 			set_bit(CONF_REQ_SENT, &chan->conf_state);  in l2cap_conn_start()
1286 				       l2cap_build_conf_req(chan, buf), buf);  in l2cap_conn_start()
1287 			chan->num_conf_req++;  in l2cap_conn_start()
1290 		l2cap_chan_unlock(chan);  in l2cap_conn_start()
1342 	struct l2cap_chan *chan, *pchan;  in l2cap_le_conn_ready()  local
1356 	chan = pchan->ops->new_connection(pchan);  in l2cap_le_conn_ready()
1357 	if (!chan)  in l2cap_le_conn_ready()
1360 	sk = chan->sk;  in l2cap_le_conn_ready()
1368 	l2cap_chan_add(conn, chan);  in l2cap_le_conn_ready()
1370 	l2cap_chan_ready(chan);  in l2cap_le_conn_ready()
1378 	struct l2cap_chan *chan;  in l2cap_conn_ready()  local
1391 	list_for_each_entry(chan, &conn->chan_l, list) {  in l2cap_conn_ready()
1393 		l2cap_chan_lock(chan);  in l2cap_conn_ready()
1395 		if (chan->chan_type == L2CAP_CHAN_CONN_FIX_A2MP) {  in l2cap_conn_ready()
1396 			l2cap_chan_unlock(chan);  in l2cap_conn_ready()
1401 			if (smp_conn_security(hcon, chan->sec_level))  in l2cap_conn_ready()
1402 				l2cap_chan_ready(chan);  in l2cap_conn_ready()
1404 		} else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {  in l2cap_conn_ready()
1405 			struct sock *sk = chan->sk;  in l2cap_conn_ready()
1406 			__clear_chan_timer(chan);  in l2cap_conn_ready()
1408 			__l2cap_state_change(chan, BT_CONNECTED);  in l2cap_conn_ready()
1412 		} else if (chan->state == BT_CONNECT)  in l2cap_conn_ready()
1413 			l2cap_do_start(chan);  in l2cap_conn_ready()
1415 		l2cap_chan_unlock(chan);  in l2cap_conn_ready()
1424 	struct l2cap_chan *chan;  in l2cap_conn_unreliable()  local
1430 	list_for_each_entry(chan, &conn->chan_l, list) {  in l2cap_conn_unreliable()
1431 		if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))  in l2cap_conn_unreliable()
1432 			l2cap_chan_set_err(chan, err);  in l2cap_conn_unreliable()
1535 	struct l2cap_chan *chan, *l;  in l2cap_conn_del()  local
1549 	list_for_each_entry_safe(chan, l, &conn->chan_l, list) {  in l2cap_conn_del()
1550 		l2cap_chan_hold(chan);  in l2cap_conn_del()
1551 		l2cap_chan_lock(chan);  in l2cap_conn_del()
1553 		l2cap_chan_del(chan, err);  in l2cap_conn_del()
1555 		l2cap_chan_unlock(chan);  in l2cap_conn_del()
1557 		chan->ops->close(chan);  in l2cap_conn_del()
1558 		l2cap_chan_put(chan);  in l2cap_conn_del()
1715 int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,  in l2cap_chan_connect()  argument
1718 	struct sock *sk = chan->sk;  in l2cap_chan_connect()
1735 	l2cap_chan_lock(chan);  in l2cap_chan_connect()
1739 	    chan->chan_type != L2CAP_CHAN_RAW) {  in l2cap_chan_connect()
1744 	if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !(psm || cid)) {  in l2cap_chan_connect()
1749 	switch (chan->mode) {  in l2cap_chan_connect()
1762 	switch (chan->state) {  in l2cap_chan_connect()
1790 	chan->psm = psm;  in l2cap_chan_connect()
1791 	chan->dcid = cid;  in l2cap_chan_connect()
1793 	auth_type = l2cap_get_auth_type(chan);  in l2cap_chan_connect()
1795 	if (chan->dcid == L2CAP_CID_LE_DATA)  in l2cap_chan_connect()
1797 				   chan->sec_level, auth_type);  in l2cap_chan_connect()
1800 				   chan->sec_level, auth_type);  in l2cap_chan_connect()
1829 	l2cap_chan_unlock(chan);  in l2cap_chan_connect()
1830 	l2cap_chan_add(conn, chan);  in l2cap_chan_connect()
1831 	l2cap_chan_lock(chan);  in l2cap_chan_connect()
1833 	l2cap_state_change(chan, BT_CONNECT);  in l2cap_chan_connect()
1834 	__set_chan_timer(chan, sk->sk_sndtimeo);  in l2cap_chan_connect()
1837 		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {  in l2cap_chan_connect()
1838 			__clear_chan_timer(chan);  in l2cap_chan_connect()
1839 			if (l2cap_chan_check_security(chan))  in l2cap_chan_connect()
1840 				l2cap_state_change(chan, BT_CONNECTED);  in l2cap_chan_connect()
1842 			l2cap_do_start(chan);  in l2cap_chan_connect()
1848 	l2cap_chan_unlock(chan);  in l2cap_chan_connect()
1856 	struct l2cap_chan *chan = l2cap_pi(sk)->chan;  in __l2cap_wait_ack()  local
1863 	while (chan->unacked_frames > 0 && chan->conn) {  in __l2cap_wait_ack()
1888 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,  in l2cap_monitor_timeout()  local
1891 	BT_DBG("chan %p", chan);  in l2cap_monitor_timeout()
1893 	l2cap_chan_lock(chan);  in l2cap_monitor_timeout()
1895 	if (!chan->conn) {  in l2cap_monitor_timeout()
1896 		l2cap_chan_unlock(chan);  in l2cap_monitor_timeout()
1897 		l2cap_chan_put(chan);  in l2cap_monitor_timeout()
1901 	l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO);  in l2cap_monitor_timeout()
1903 	l2cap_chan_unlock(chan);  in l2cap_monitor_timeout()
1904 	l2cap_chan_put(chan);  in l2cap_monitor_timeout()
1909 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,  in l2cap_retrans_timeout()  local
1912 	BT_DBG("chan %p", chan);  in l2cap_retrans_timeout()
1914 	l2cap_chan_lock(chan);  in l2cap_retrans_timeout()
1916 	if (!chan->conn) {  in l2cap_retrans_timeout()
1917 		l2cap_chan_unlock(chan);  in l2cap_retrans_timeout()
1918 		l2cap_chan_put(chan);  in l2cap_retrans_timeout()
1922 	l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO);  in l2cap_retrans_timeout()
1923 	l2cap_chan_unlock(chan);  in l2cap_retrans_timeout()
1924 	l2cap_chan_put(chan);  in l2cap_retrans_timeout()
1927 static void l2cap_streaming_send(struct l2cap_chan *chan,  in l2cap_streaming_send()  argument
1933 	BT_DBG("chan %p, skbs %p", chan, skbs);  in l2cap_streaming_send()
1935 	if (__chan_is_moving(chan))  in l2cap_streaming_send()
1938 	skb_queue_splice_tail_init(skbs, &chan->tx_q);  in l2cap_streaming_send()
1940 	while (!skb_queue_empty(&chan->tx_q)) {  in l2cap_streaming_send()
1942 		skb = skb_dequeue(&chan->tx_q);  in l2cap_streaming_send()
1948 		control->txseq = chan->next_tx_seq;  in l2cap_streaming_send()
1950 		__pack_control(chan, control, skb);  in l2cap_streaming_send()
1952 		if (chan->fcs == L2CAP_FCS_CRC16) {  in l2cap_streaming_send()
1957 		l2cap_do_send(chan, skb);  in l2cap_streaming_send()
1961 		chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);  in l2cap_streaming_send()
1962 		chan->frames_sent++;  in l2cap_streaming_send()
1966 static int l2cap_ertm_send(struct l2cap_chan *chan)  in l2cap_ertm_send()  argument
1972 	BT_DBG("chan %p", chan);  in l2cap_ertm_send()
1974 	if (chan->state != BT_CONNECTED)  in l2cap_ertm_send()
1977 	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))  in l2cap_ertm_send()
1980 	if (__chan_is_moving(chan))  in l2cap_ertm_send()
1983 	while (chan->tx_send_head &&  in l2cap_ertm_send()
1984 	       chan->unacked_frames < chan->remote_tx_win &&  in l2cap_ertm_send()
1985 	       chan->tx_state == L2CAP_TX_STATE_XMIT) {  in l2cap_ertm_send()
1987 		skb = chan->tx_send_head;  in l2cap_ertm_send()
1992 		if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))  in l2cap_ertm_send()
1995 		control->reqseq = chan->buffer_seq;  in l2cap_ertm_send()
1996 		chan->last_acked_seq = chan->buffer_seq;  in l2cap_ertm_send()
1997 		control->txseq = chan->next_tx_seq;  in l2cap_ertm_send()
1999 		__pack_control(chan, control, skb);  in l2cap_ertm_send()
2001 		if (chan->fcs == L2CAP_FCS_CRC16) {  in l2cap_ertm_send()
2014 		__set_retrans_timer(chan);  in l2cap_ertm_send()
2016 		chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);  in l2cap_ertm_send()
2017 		chan->unacked_frames++;  in l2cap_ertm_send()
2018 		chan->frames_sent++;  in l2cap_ertm_send()
2021 		if (skb_queue_is_last(&chan->tx_q, skb))  in l2cap_ertm_send()
2022 			chan->tx_send_head = NULL;  in l2cap_ertm_send()
2024 			chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);  in l2cap_ertm_send()
2026 		l2cap_do_send(chan, tx_skb);  in l2cap_ertm_send()
2031 	       chan->unacked_frames, skb_queue_len(&chan->tx_q));  in l2cap_ertm_send()
2036 static void l2cap_ertm_resend(struct l2cap_chan *chan)  in l2cap_ertm_resend()  argument
2043 	BT_DBG("chan %p", chan);  in l2cap_ertm_resend()
2045 	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))  in l2cap_ertm_resend()
2048 	if (__chan_is_moving(chan))  in l2cap_ertm_resend()
2051 	while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) {  in l2cap_ertm_resend()
2052 		seq = l2cap_seq_list_pop(&chan->retrans_list);  in l2cap_ertm_resend()
2054 		skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq);  in l2cap_ertm_resend()
2064 		if (chan->max_tx != 0 &&  in l2cap_ertm_resend()
2065 		    bt_cb(skb)->control.retries > chan->max_tx) {  in l2cap_ertm_resend()
2066 			BT_DBG("Retry limit exceeded (%d)", chan->max_tx);  in l2cap_ertm_resend()
2067 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_ertm_resend()
2068 			l2cap_seq_list_clear(&chan->retrans_list);  in l2cap_ertm_resend()
2072 		control.reqseq = chan->buffer_seq;  in l2cap_ertm_resend()
2073 		if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))  in l2cap_ertm_resend()
2088 			l2cap_seq_list_clear(&chan->retrans_list);  in l2cap_ertm_resend()
2093 		if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {  in l2cap_ertm_resend()
2101 		if (chan->fcs == L2CAP_FCS_CRC16) {  in l2cap_ertm_resend()
2107 		l2cap_do_send(chan, tx_skb);  in l2cap_ertm_resend()
2111 		chan->last_acked_seq = chan->buffer_seq;  in l2cap_ertm_resend()
2115 static void l2cap_retransmit(struct l2cap_chan *chan,  in l2cap_retransmit()  argument
2118 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_retransmit()
2120 	l2cap_seq_list_append(&chan->retrans_list, control->reqseq);  in l2cap_retransmit()
2121 	l2cap_ertm_resend(chan);  in l2cap_retransmit()
2124 static void l2cap_retransmit_all(struct l2cap_chan *chan,  in l2cap_retransmit_all()  argument
2129 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_retransmit_all()
2132 		set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_retransmit_all()
2134 	l2cap_seq_list_clear(&chan->retrans_list);  in l2cap_retransmit_all()
2136 	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))  in l2cap_retransmit_all()
2139 	if (chan->unacked_frames) {  in l2cap_retransmit_all()
2140 		skb_queue_walk(&chan->tx_q, skb) {  in l2cap_retransmit_all()
2142 			    skb == chan->tx_send_head)  in l2cap_retransmit_all()
2146 		skb_queue_walk_from(&chan->tx_q, skb) {  in l2cap_retransmit_all()
2147 			if (skb == chan->tx_send_head)  in l2cap_retransmit_all()
2150 			l2cap_seq_list_append(&chan->retrans_list,  in l2cap_retransmit_all()
2154 		l2cap_ertm_resend(chan);  in l2cap_retransmit_all()
2158 static void l2cap_send_ack(struct l2cap_chan *chan)  in l2cap_send_ack()  argument
2161 	u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq,  in l2cap_send_ack()
2162 					 chan->last_acked_seq);  in l2cap_send_ack()
2166 	       chan, chan->last_acked_seq, chan->buffer_seq);  in l2cap_send_ack()
2171 	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&  in l2cap_send_ack()
2172 	    chan->rx_state == L2CAP_RX_STATE_RECV) {  in l2cap_send_ack()
2173 		__clear_ack_timer(chan);  in l2cap_send_ack()
2175 		control.reqseq = chan->buffer_seq;  in l2cap_send_ack()
2176 		l2cap_send_sframe(chan, &control);  in l2cap_send_ack()
2178 		if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) {  in l2cap_send_ack()
2179 			l2cap_ertm_send(chan);  in l2cap_send_ack()
2181 			if (chan->buffer_seq == chan->last_acked_seq)  in l2cap_send_ack()
2188 		threshold = chan->ack_win;  in l2cap_send_ack()
2196 			__clear_ack_timer(chan);  in l2cap_send_ack()
2198 			control.reqseq = chan->buffer_seq;  in l2cap_send_ack()
2199 			l2cap_send_sframe(chan, &control);  in l2cap_send_ack()
2204 			__set_ack_timer(chan);  in l2cap_send_ack()
2208 static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,  in l2cap_skbuff_fromiovec()  argument
2212 	struct l2cap_conn *conn = chan->conn;  in l2cap_skbuff_fromiovec()
2229 		tmp = chan->ops->alloc_skb(chan, count,  in l2cap_skbuff_fromiovec()
2253 static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,  in l2cap_create_connless_pdu()  argument
2257 	struct l2cap_conn *conn = chan->conn;  in l2cap_create_connless_pdu()
2262 	BT_DBG("chan %p len %zu priority %u", chan, len, priority);  in l2cap_create_connless_pdu()
2266 	skb = chan->ops->alloc_skb(chan, count + hlen,  in l2cap_create_connless_pdu()
2275 	lh->cid = cpu_to_le16(chan->dcid);  in l2cap_create_connless_pdu()
2277 	put_unaligned(chan->psm, skb_put(skb, L2CAP_PSMLEN_SIZE));  in l2cap_create_connless_pdu()
2279 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);  in l2cap_create_connless_pdu()
2287 static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,  in l2cap_create_basic_pdu()  argument
2291 	struct l2cap_conn *conn = chan->conn;  in l2cap_create_basic_pdu()
2296 	BT_DBG("chan %p len %zu", chan, len);  in l2cap_create_basic_pdu()
2300 	skb = chan->ops->alloc_skb(chan, count + L2CAP_HDR_SIZE,  in l2cap_create_basic_pdu()
2309 	lh->cid = cpu_to_le16(chan->dcid);  in l2cap_create_basic_pdu()
2312 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);  in l2cap_create_basic_pdu()
2320 static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,  in l2cap_create_iframe_pdu()  argument
2324 	struct l2cap_conn *conn = chan->conn;  in l2cap_create_iframe_pdu()
2329 	BT_DBG("chan %p len %zu", chan, len);  in l2cap_create_iframe_pdu()
2334 	hlen = __ertm_hdr_size(chan);  in l2cap_create_iframe_pdu()
2339 	if (chan->fcs == L2CAP_FCS_CRC16)  in l2cap_create_iframe_pdu()
2344 	skb = chan->ops->alloc_skb(chan, count + hlen,  in l2cap_create_iframe_pdu()
2351 	lh->cid = cpu_to_le16(chan->dcid);  in l2cap_create_iframe_pdu()
2355 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_create_iframe_pdu()
2363 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);  in l2cap_create_iframe_pdu()
2369 	bt_cb(skb)->control.fcs = chan->fcs;  in l2cap_create_iframe_pdu()
2374 static int l2cap_segment_sdu(struct l2cap_chan *chan,  in l2cap_segment_sdu()  argument
2383 	BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);  in l2cap_segment_sdu()
2391 	pdu_len = chan->conn->mtu;  in l2cap_segment_sdu()
2394 	if (!chan->hs_hcon)  in l2cap_segment_sdu()
2398 	if (chan->fcs)  in l2cap_segment_sdu()
2401 	pdu_len -= __ertm_hdr_size(chan);  in l2cap_segment_sdu()
2404 	pdu_len = min_t(size_t, pdu_len, chan->remote_mps);  in l2cap_segment_sdu()
2417 		skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len);  in l2cap_segment_sdu()
2444 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,  in l2cap_chan_send()  argument
2452 	if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {  in l2cap_chan_send()
2453 		skb = l2cap_create_connless_pdu(chan, msg, len, priority);  in l2cap_chan_send()
2457 		l2cap_do_send(chan, skb);  in l2cap_chan_send()
2461 	switch (chan->mode) {  in l2cap_chan_send()
2464 		if (len > chan->omtu)  in l2cap_chan_send()
2468 		skb = l2cap_create_basic_pdu(chan, msg, len, priority);  in l2cap_chan_send()
2472 		l2cap_do_send(chan, skb);  in l2cap_chan_send()
2479 		if (len > chan->omtu) {  in l2cap_chan_send()
2490 		err = l2cap_segment_sdu(chan, &seg_queue, msg, len);  in l2cap_chan_send()
2495 		if (chan->state != BT_CONNECTED) {  in l2cap_chan_send()
2503 		if (chan->mode == L2CAP_MODE_ERTM)  in l2cap_chan_send()
2504 			l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST);  in l2cap_chan_send()
2506 			l2cap_streaming_send(chan, &seg_queue);  in l2cap_chan_send()
2517 		BT_DBG("bad state %1.1x", chan->mode);  in l2cap_chan_send()
2524 static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq)  in l2cap_send_srej()  argument
2529 	BT_DBG("chan %p, txseq %u", chan, txseq);  in l2cap_send_srej()
2535 	for (seq = chan->expected_tx_seq; seq != txseq;  in l2cap_send_srej()
2536 	     seq = __next_seq(chan, seq)) {  in l2cap_send_srej()
2537 		if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) {  in l2cap_send_srej()
2539 			l2cap_send_sframe(chan, &control);  in l2cap_send_srej()
2540 			l2cap_seq_list_append(&chan->srej_list, seq);  in l2cap_send_srej()
2544 	chan->expected_tx_seq = __next_seq(chan, txseq);  in l2cap_send_srej()
2547 static void l2cap_send_srej_tail(struct l2cap_chan *chan)  in l2cap_send_srej_tail()  argument
2551 	BT_DBG("chan %p", chan);  in l2cap_send_srej_tail()
2553 	if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR)  in l2cap_send_srej_tail()
2559 	control.reqseq = chan->srej_list.tail;  in l2cap_send_srej_tail()
2560 	l2cap_send_sframe(chan, &control);  in l2cap_send_srej_tail()
2563 static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq)  in l2cap_send_srej_list()  argument
2569 	BT_DBG("chan %p, txseq %u", chan, txseq);  in l2cap_send_srej_list()
2576 	initial_head = chan->srej_list.head;  in l2cap_send_srej_list()
2579 		seq = l2cap_seq_list_pop(&chan->srej_list);  in l2cap_send_srej_list()
2584 		l2cap_send_sframe(chan, &control);  in l2cap_send_srej_list()
2585 		l2cap_seq_list_append(&chan->srej_list, seq);  in l2cap_send_srej_list()
2586 	} while (chan->srej_list.head != initial_head);  in l2cap_send_srej_list()
2589 static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq)  in l2cap_process_reqseq()  argument
2594 	BT_DBG("chan %p, reqseq %u", chan, reqseq);  in l2cap_process_reqseq()
2596 	if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq)  in l2cap_process_reqseq()
2600 	       chan->expected_ack_seq, chan->unacked_frames);  in l2cap_process_reqseq()
2602 	for (ackseq = chan->expected_ack_seq; ackseq != reqseq;  in l2cap_process_reqseq()
2603 	     ackseq = __next_seq(chan, ackseq)) {  in l2cap_process_reqseq()
2605 		acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq);  in l2cap_process_reqseq()
2607 			skb_unlink(acked_skb, &chan->tx_q);  in l2cap_process_reqseq()
2609 			chan->unacked_frames--;  in l2cap_process_reqseq()
2613 	chan->expected_ack_seq = reqseq;  in l2cap_process_reqseq()
2615 	if (chan->unacked_frames == 0)  in l2cap_process_reqseq()
2616 		__clear_retrans_timer(chan);  in l2cap_process_reqseq()
2618 	BT_DBG("unacked_frames %u", chan->unacked_frames);  in l2cap_process_reqseq()
2621 static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan)  in l2cap_abort_rx_srej_sent()  argument
2623 	BT_DBG("chan %p", chan);  in l2cap_abort_rx_srej_sent()
2625 	chan->expected_tx_seq = chan->buffer_seq;  in l2cap_abort_rx_srej_sent()
2626 	l2cap_seq_list_clear(&chan->srej_list);  in l2cap_abort_rx_srej_sent()
2627 	skb_queue_purge(&chan->srej_q);  in l2cap_abort_rx_srej_sent()
2628 	chan->rx_state = L2CAP_RX_STATE_RECV;  in l2cap_abort_rx_srej_sent()
2631 static void l2cap_tx_state_xmit(struct l2cap_chan *chan,  in l2cap_tx_state_xmit()  argument
2635 	BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,  in l2cap_tx_state_xmit()
2640 		if (chan->tx_send_head == NULL)  in l2cap_tx_state_xmit()
2641 			chan->tx_send_head = skb_peek(skbs);  in l2cap_tx_state_xmit()
2643 		skb_queue_splice_tail_init(skbs, &chan->tx_q);  in l2cap_tx_state_xmit()
2644 		l2cap_ertm_send(chan);  in l2cap_tx_state_xmit()
2648 		set_bit(CONN_LOCAL_BUSY, &chan->conn_state);  in l2cap_tx_state_xmit()
2650 		if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {  in l2cap_tx_state_xmit()
2654 			l2cap_abort_rx_srej_sent(chan);  in l2cap_tx_state_xmit()
2657 		l2cap_send_ack(chan);  in l2cap_tx_state_xmit()
2662 		clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);  in l2cap_tx_state_xmit()
2664 		if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {  in l2cap_tx_state_xmit()
2671 			local_control.reqseq = chan->buffer_seq;  in l2cap_tx_state_xmit()
2672 			l2cap_send_sframe(chan, &local_control);  in l2cap_tx_state_xmit()
2674 			chan->retry_count = 1;  in l2cap_tx_state_xmit()
2675 			__set_monitor_timer(chan);  in l2cap_tx_state_xmit()
2676 			chan->tx_state = L2CAP_TX_STATE_WAIT_F;  in l2cap_tx_state_xmit()
2680 		l2cap_process_reqseq(chan, control->reqseq);  in l2cap_tx_state_xmit()
2683 		l2cap_send_rr_or_rnr(chan, 1);  in l2cap_tx_state_xmit()
2684 		chan->retry_count = 1;  in l2cap_tx_state_xmit()
2685 		__set_monitor_timer(chan);  in l2cap_tx_state_xmit()
2686 		__clear_ack_timer(chan);  in l2cap_tx_state_xmit()
2687 		chan->tx_state = L2CAP_TX_STATE_WAIT_F;  in l2cap_tx_state_xmit()
2690 		l2cap_send_rr_or_rnr(chan, 1);  in l2cap_tx_state_xmit()
2691 		chan->retry_count = 1;  in l2cap_tx_state_xmit()
2692 		__set_monitor_timer(chan);  in l2cap_tx_state_xmit()
2693 		chan->tx_state = L2CAP_TX_STATE_WAIT_F;  in l2cap_tx_state_xmit()
2703 static void l2cap_tx_state_wait_f(struct l2cap_chan *chan,  in l2cap_tx_state_wait_f()  argument
2707 	BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,  in l2cap_tx_state_wait_f()
2712 		if (chan->tx_send_head == NULL)  in l2cap_tx_state_wait_f()
2713 			chan->tx_send_head = skb_peek(skbs);  in l2cap_tx_state_wait_f()
2715 		skb_queue_splice_tail_init(skbs, &chan->tx_q);  in l2cap_tx_state_wait_f()
2719 		set_bit(CONN_LOCAL_BUSY, &chan->conn_state);  in l2cap_tx_state_wait_f()
2721 		if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {  in l2cap_tx_state_wait_f()
2725 			l2cap_abort_rx_srej_sent(chan);  in l2cap_tx_state_wait_f()
2728 		l2cap_send_ack(chan);  in l2cap_tx_state_wait_f()
2733 		clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);  in l2cap_tx_state_wait_f()
2735 		if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {  in l2cap_tx_state_wait_f()
2741 			local_control.reqseq = chan->buffer_seq;  in l2cap_tx_state_wait_f()
2742 			l2cap_send_sframe(chan, &local_control);  in l2cap_tx_state_wait_f()
2744 			chan->retry_count = 1;  in l2cap_tx_state_wait_f()
2745 			__set_monitor_timer(chan);  in l2cap_tx_state_wait_f()
2746 			chan->tx_state = L2CAP_TX_STATE_WAIT_F;  in l2cap_tx_state_wait_f()
2750 		l2cap_process_reqseq(chan, control->reqseq);  in l2cap_tx_state_wait_f()
2756 			__clear_monitor_timer(chan);  in l2cap_tx_state_wait_f()
2757 			if (chan->unacked_frames > 0)  in l2cap_tx_state_wait_f()
2758 				__set_retrans_timer(chan);  in l2cap_tx_state_wait_f()
2759 			chan->retry_count = 0;  in l2cap_tx_state_wait_f()
2760 			chan->tx_state = L2CAP_TX_STATE_XMIT;  in l2cap_tx_state_wait_f()
2761 			BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state);  in l2cap_tx_state_wait_f()
2768 		if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) {  in l2cap_tx_state_wait_f()
2769 			l2cap_send_rr_or_rnr(chan, 1);  in l2cap_tx_state_wait_f()
2770 			__set_monitor_timer(chan);  in l2cap_tx_state_wait_f()
2771 			chan->retry_count++;  in l2cap_tx_state_wait_f()
2773 			l2cap_send_disconn_req(chan, ECONNABORTED);  in l2cap_tx_state_wait_f()
2781 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,  in l2cap_tx()  argument
2785 	       chan, control, skbs, event, chan->tx_state);  in l2cap_tx()
2787 	switch (chan->tx_state) {  in l2cap_tx()
2789 		l2cap_tx_state_xmit(chan, control, skbs, event);  in l2cap_tx()
2792 		l2cap_tx_state_wait_f(chan, control, skbs, event);  in l2cap_tx()
2800 static void l2cap_pass_to_tx(struct l2cap_chan *chan,  in l2cap_pass_to_tx()  argument
2803 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_pass_to_tx()
2804 	l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT);  in l2cap_pass_to_tx()
2807 static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan,  in l2cap_pass_to_tx_fbit()  argument
2810 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_pass_to_tx_fbit()
2811 	l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT);  in l2cap_pass_to_tx_fbit()
2818 	struct l2cap_chan *chan;  in l2cap_raw_recv()  local
2824 	list_for_each_entry(chan, &conn->chan_l, list) {  in l2cap_raw_recv()
2825 		struct sock *sk = chan->sk;  in l2cap_raw_recv()
2826 		if (chan->chan_type != L2CAP_CHAN_RAW)  in l2cap_raw_recv()
2836 		if (chan->ops->recv(chan, nskb))  in l2cap_raw_recv()
2974 static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan)  in l2cap_add_opt_efs()  argument
2978 	switch (chan->mode) {  in l2cap_add_opt_efs()
2980 		efs.id		= chan->local_id;  in l2cap_add_opt_efs()
2981 		efs.stype	= chan->local_stype;  in l2cap_add_opt_efs()
2982 		efs.msdu	= cpu_to_le16(chan->local_msdu);  in l2cap_add_opt_efs()
2983 		efs.sdu_itime	= cpu_to_le32(chan->local_sdu_itime);  in l2cap_add_opt_efs()
2991 		efs.msdu	= cpu_to_le16(chan->local_msdu);  in l2cap_add_opt_efs()
2992 		efs.sdu_itime	= cpu_to_le32(chan->local_sdu_itime);  in l2cap_add_opt_efs()
3007 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,  in l2cap_ack_timeout()  local
3011 	BT_DBG("chan %p", chan);  in l2cap_ack_timeout()
3013 	l2cap_chan_lock(chan);  in l2cap_ack_timeout()
3015 	frames_to_ack = __seq_offset(chan, chan->buffer_seq,  in l2cap_ack_timeout()
3016 				     chan->last_acked_seq);  in l2cap_ack_timeout()
3019 		l2cap_send_rr_or_rnr(chan, 0);  in l2cap_ack_timeout()
3021 	l2cap_chan_unlock(chan);  in l2cap_ack_timeout()
3022 	l2cap_chan_put(chan);  in l2cap_ack_timeout()
3025 int l2cap_ertm_init(struct l2cap_chan *chan)  in l2cap_ertm_init()  argument
3029 	chan->next_tx_seq = 0;  in l2cap_ertm_init()
3030 	chan->expected_tx_seq = 0;  in l2cap_ertm_init()
3031 	chan->expected_ack_seq = 0;  in l2cap_ertm_init()
3032 	chan->unacked_frames = 0;  in l2cap_ertm_init()
3033 	chan->buffer_seq = 0;  in l2cap_ertm_init()
3034 	chan->frames_sent = 0;  in l2cap_ertm_init()
3035 	chan->last_acked_seq = 0;  in l2cap_ertm_init()
3036 	chan->sdu = NULL;  in l2cap_ertm_init()
3037 	chan->sdu_last_frag = NULL;  in l2cap_ertm_init()
3038 	chan->sdu_len = 0;  in l2cap_ertm_init()
3040 	skb_queue_head_init(&chan->tx_q);  in l2cap_ertm_init()
3042 	chan->local_amp_id = 0;  in l2cap_ertm_init()
3043 	chan->move_id = 0;  in l2cap_ertm_init()
3044 	chan->move_state = L2CAP_MOVE_STABLE;  in l2cap_ertm_init()
3045 	chan->move_role = L2CAP_MOVE_ROLE_NONE;  in l2cap_ertm_init()
3047 	if (chan->mode != L2CAP_MODE_ERTM)  in l2cap_ertm_init()
3050 	chan->rx_state = L2CAP_RX_STATE_RECV;  in l2cap_ertm_init()
3051 	chan->tx_state = L2CAP_TX_STATE_XMIT;  in l2cap_ertm_init()
3053 	INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);  in l2cap_ertm_init()
3054 	INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);  in l2cap_ertm_init()
3055 	INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);  in l2cap_ertm_init()
3057 	skb_queue_head_init(&chan->srej_q);  in l2cap_ertm_init()
3059 	err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);  in l2cap_ertm_init()
3063 	err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);  in l2cap_ertm_init()
3065 		l2cap_seq_list_free(&chan->srej_list);  in l2cap_ertm_init()
3083 static inline bool __l2cap_ews_supported(struct l2cap_chan *chan)  in __l2cap_ews_supported()  argument
3085 	return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_WINDOW;  in __l2cap_ews_supported()
3088 static inline bool __l2cap_efs_supported(struct l2cap_chan *chan)  in __l2cap_efs_supported()  argument
3090 	return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_FLOW;  in __l2cap_efs_supported()
3093 static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan,  in __l2cap_set_ertm_timeouts()  argument
3096 	if (chan->local_amp_id && chan->hs_hcon) {  in __l2cap_set_ertm_timeouts()
3097 		u64 ertm_to = chan->hs_hcon->hdev->amp_be_flush_to;  in __l2cap_set_ertm_timeouts()
3131 static inline void l2cap_txwin_setup(struct l2cap_chan *chan)  in l2cap_txwin_setup()  argument
3133 	if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&  in l2cap_txwin_setup()
3134 	    __l2cap_ews_supported(chan)) {  in l2cap_txwin_setup()
3136 		set_bit(FLAG_EXT_CTRL, &chan->flags);  in l2cap_txwin_setup()
3137 		chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;  in l2cap_txwin_setup()
3139 		chan->tx_win = min_t(u16, chan->tx_win,  in l2cap_txwin_setup()
3141 		chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;  in l2cap_txwin_setup()
3143 	chan->ack_win = chan->tx_win;  in l2cap_txwin_setup()
3146 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data)  in l2cap_build_conf_req()  argument
3149 	struct l2cap_conf_rfc rfc = { .mode = chan->mode };  in l2cap_build_conf_req()
3153 	BT_DBG("chan %p", chan);  in l2cap_build_conf_req()
3155 	if (chan->num_conf_req || chan->num_conf_rsp)  in l2cap_build_conf_req()
3158 	switch (chan->mode) {  in l2cap_build_conf_req()
3161 		if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))  in l2cap_build_conf_req()
3164 		if (__l2cap_efs_supported(chan))  in l2cap_build_conf_req()
3165 			set_bit(FLAG_EFS_ENABLE, &chan->flags);  in l2cap_build_conf_req()
3169 		chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);  in l2cap_build_conf_req()
3174 	if (chan->imtu != L2CAP_DEFAULT_MTU)  in l2cap_build_conf_req()
3175 		l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);  in l2cap_build_conf_req()
3177 	switch (chan->mode) {  in l2cap_build_conf_req()
3179 		if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&  in l2cap_build_conf_req()
3180 		    !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))  in l2cap_build_conf_req()
3196 		rfc.max_transmit    = chan->max_tx;  in l2cap_build_conf_req()
3198 		__l2cap_set_ertm_timeouts(chan, &rfc);  in l2cap_build_conf_req()
3200 		size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -  in l2cap_build_conf_req()
3205 		l2cap_txwin_setup(chan);  in l2cap_build_conf_req()
3207 		rfc.txwin_size = min_t(u16, chan->tx_win,  in l2cap_build_conf_req()
3213 		if (test_bit(FLAG_EFS_ENABLE, &chan->flags))  in l2cap_build_conf_req()
3214 			l2cap_add_opt_efs(&ptr, chan);  in l2cap_build_conf_req()
3216 		if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_build_conf_req()
3218 					   chan->tx_win);  in l2cap_build_conf_req()
3220 		if (chan->conn->feat_mask & L2CAP_FEAT_FCS)  in l2cap_build_conf_req()
3221 			if (chan->fcs == L2CAP_FCS_NONE ||  in l2cap_build_conf_req()
3222 			    test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {  in l2cap_build_conf_req()
3223 				chan->fcs = L2CAP_FCS_NONE;  in l2cap_build_conf_req()
3225 						   chan->fcs);  in l2cap_build_conf_req()
3230 		l2cap_txwin_setup(chan);  in l2cap_build_conf_req()
3237 		size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -  in l2cap_build_conf_req()
3245 		if (test_bit(FLAG_EFS_ENABLE, &chan->flags))  in l2cap_build_conf_req()
3246 			l2cap_add_opt_efs(&ptr, chan);  in l2cap_build_conf_req()
3248 		if (chan->conn->feat_mask & L2CAP_FEAT_FCS)  in l2cap_build_conf_req()
3249 			if (chan->fcs == L2CAP_FCS_NONE ||  in l2cap_build_conf_req()
3250 			    test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {  in l2cap_build_conf_req()
3251 				chan->fcs = L2CAP_FCS_NONE;  in l2cap_build_conf_req()
3253 						   chan->fcs);  in l2cap_build_conf_req()
3258 	req->dcid  = cpu_to_le16(chan->dcid);  in l2cap_build_conf_req()
3264 static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)  in l2cap_parse_conf_req()  argument
3268 	void *req = chan->conf_req;  in l2cap_parse_conf_req()
3269 	int len = chan->conf_len;  in l2cap_parse_conf_req()
3279 	BT_DBG("chan %p", chan);  in l2cap_parse_conf_req()
3293 			chan->flush_to = val;  in l2cap_parse_conf_req()
3306 				set_bit(CONF_RECV_NO_FCS, &chan->conf_state);  in l2cap_parse_conf_req()
3319 			set_bit(FLAG_EXT_CTRL, &chan->flags);  in l2cap_parse_conf_req()
3320 			set_bit(CONF_EWS_RECV, &chan->conf_state);  in l2cap_parse_conf_req()
3321 			chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;  in l2cap_parse_conf_req()
3322 			chan->remote_tx_win = val;  in l2cap_parse_conf_req()
3335 	if (chan->num_conf_rsp || chan->num_conf_req > 1)  in l2cap_parse_conf_req()
3338 	switch (chan->mode) {  in l2cap_parse_conf_req()
3341 		if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {  in l2cap_parse_conf_req()
3342 			chan->mode = l2cap_select_mode(rfc.mode,  in l2cap_parse_conf_req()
3343 						       chan->conn->feat_mask);  in l2cap_parse_conf_req()
3348 			if (__l2cap_efs_supported(chan))  in l2cap_parse_conf_req()
3349 				set_bit(FLAG_EFS_ENABLE, &chan->flags);  in l2cap_parse_conf_req()
3354 		if (chan->mode != rfc.mode)  in l2cap_parse_conf_req()
3361 	if (chan->mode != rfc.mode) {  in l2cap_parse_conf_req()
3363 		rfc.mode = chan->mode;  in l2cap_parse_conf_req()
3365 		if (chan->num_conf_rsp == 1)  in l2cap_parse_conf_req()
3379 			chan->omtu = mtu;  in l2cap_parse_conf_req()
3380 			set_bit(CONF_MTU_DONE, &chan->conf_state);  in l2cap_parse_conf_req()
3382 		l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu);  in l2cap_parse_conf_req()
3385 			if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&  in l2cap_parse_conf_req()
3387 			    efs.stype != chan->local_stype) {  in l2cap_parse_conf_req()
3391 				if (chan->num_conf_req >= 1)  in l2cap_parse_conf_req()
3400 				set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);  in l2cap_parse_conf_req()
3406 			chan->fcs = L2CAP_FCS_NONE;  in l2cap_parse_conf_req()
3407 			set_bit(CONF_MODE_DONE, &chan->conf_state);  in l2cap_parse_conf_req()
3411 			if (!test_bit(CONF_EWS_RECV, &chan->conf_state))  in l2cap_parse_conf_req()
3412 				chan->remote_tx_win = rfc.txwin_size;  in l2cap_parse_conf_req()
3416 			chan->remote_max_tx = rfc.max_transmit;  in l2cap_parse_conf_req()
3419 				     chan->conn->mtu - L2CAP_EXT_HDR_SIZE -  in l2cap_parse_conf_req()
3422 			chan->remote_mps = size;  in l2cap_parse_conf_req()
3424 			__l2cap_set_ertm_timeouts(chan, &rfc);  in l2cap_parse_conf_req()
3426 			set_bit(CONF_MODE_DONE, &chan->conf_state);  in l2cap_parse_conf_req()
3431 			if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {  in l2cap_parse_conf_req()
3432 				chan->remote_id = efs.id;  in l2cap_parse_conf_req()
3433 				chan->remote_stype = efs.stype;  in l2cap_parse_conf_req()
3434 				chan->remote_msdu = le16_to_cpu(efs.msdu);  in l2cap_parse_conf_req()
3435 				chan->remote_flush_to =  in l2cap_parse_conf_req()
3437 				chan->remote_acc_lat =  in l2cap_parse_conf_req()
3439 				chan->remote_sdu_itime =  in l2cap_parse_conf_req()
3449 				     chan->conn->mtu - L2CAP_EXT_HDR_SIZE -  in l2cap_parse_conf_req()
3452 			chan->remote_mps = size;  in l2cap_parse_conf_req()
3454 			set_bit(CONF_MODE_DONE, &chan->conf_state);  in l2cap_parse_conf_req()
3465 			rfc.mode = chan->mode;  in l2cap_parse_conf_req()
3469 			set_bit(CONF_OUTPUT_DONE, &chan->conf_state);  in l2cap_parse_conf_req()
3471 	rsp->scid   = cpu_to_le16(chan->dcid);  in l2cap_parse_conf_req()
3478 static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,  in l2cap_parse_conf_rsp()  argument
3488 	BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);  in l2cap_parse_conf_rsp()
3497 				chan->imtu = L2CAP_DEFAULT_MIN_MTU;  in l2cap_parse_conf_rsp()
3499 				chan->imtu = val;  in l2cap_parse_conf_rsp()
3500 			l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);  in l2cap_parse_conf_rsp()
3504 			chan->flush_to = val;  in l2cap_parse_conf_rsp()
3506 					   2, chan->flush_to);  in l2cap_parse_conf_rsp()
3513 			if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&  in l2cap_parse_conf_rsp()
3514 			    rfc.mode != chan->mode)  in l2cap_parse_conf_rsp()
3517 			chan->fcs = 0;  in l2cap_parse_conf_rsp()
3524 			chan->ack_win = min_t(u16, val, chan->ack_win);  in l2cap_parse_conf_rsp()
3526 					   chan->tx_win);  in l2cap_parse_conf_rsp()
3533 			if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&  in l2cap_parse_conf_rsp()
3535 			    efs.stype != chan->local_stype)  in l2cap_parse_conf_rsp()
3546 						&chan->conf_state);  in l2cap_parse_conf_rsp()
3551 	if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)  in l2cap_parse_conf_rsp()
3554 	chan->mode = rfc.mode;  in l2cap_parse_conf_rsp()
3559 			chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);  in l2cap_parse_conf_rsp()
3560 			chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);  in l2cap_parse_conf_rsp()
3561 			chan->mps    = le16_to_cpu(rfc.max_pdu_size);  in l2cap_parse_conf_rsp()
3562 			if (!test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_parse_conf_rsp()
3563 				chan->ack_win = min_t(u16, chan->ack_win,  in l2cap_parse_conf_rsp()
3566 			if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {  in l2cap_parse_conf_rsp()
3567 				chan->local_msdu = le16_to_cpu(efs.msdu);  in l2cap_parse_conf_rsp()
3568 				chan->local_sdu_itime =  in l2cap_parse_conf_rsp()
3570 				chan->local_acc_lat = le32_to_cpu(efs.acc_lat);  in l2cap_parse_conf_rsp()
3571 				chan->local_flush_to =  in l2cap_parse_conf_rsp()
3577 			chan->mps    = le16_to_cpu(rfc.max_pdu_size);  in l2cap_parse_conf_rsp()
3581 	req->dcid   = cpu_to_le16(chan->dcid);  in l2cap_parse_conf_rsp()
3587 static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data,  in l2cap_build_conf_rsp()  argument
3593 	BT_DBG("chan %p", chan);  in l2cap_build_conf_rsp()
3595 	rsp->scid   = cpu_to_le16(chan->dcid);  in l2cap_build_conf_rsp()
3602 void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)  in __l2cap_connect_rsp_defer()  argument
3605 	struct l2cap_conn *conn = chan->conn;  in __l2cap_connect_rsp_defer()
3609 	rsp.scid   = cpu_to_le16(chan->dcid);  in __l2cap_connect_rsp_defer()
3610 	rsp.dcid   = cpu_to_le16(chan->scid);  in __l2cap_connect_rsp_defer()
3614 	if (chan->hs_hcon)  in __l2cap_connect_rsp_defer()
3619 	BT_DBG("chan %p rsp_code %u", chan, rsp_code);  in __l2cap_connect_rsp_defer()
3621 	l2cap_send_cmd(conn, chan->ident, rsp_code, sizeof(rsp), &rsp);  in __l2cap_connect_rsp_defer()
3623 	if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))  in __l2cap_connect_rsp_defer()
3627 		       l2cap_build_conf_req(chan, buf), buf);  in __l2cap_connect_rsp_defer()
3628 	chan->num_conf_req++;  in __l2cap_connect_rsp_defer()
3631 static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)  in l2cap_conf_rfc_get()  argument
3638 	u16 txwin_ext = chan->ack_win;  in l2cap_conf_rfc_get()
3640 		.mode = chan->mode,  in l2cap_conf_rfc_get()
3643 		.max_pdu_size = cpu_to_le16(chan->imtu),  in l2cap_conf_rfc_get()
3644 		.txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW),  in l2cap_conf_rfc_get()
3647 	BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);  in l2cap_conf_rfc_get()
3649 	if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))  in l2cap_conf_rfc_get()
3668 		chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);  in l2cap_conf_rfc_get()
3669 		chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);  in l2cap_conf_rfc_get()
3670 		chan->mps = le16_to_cpu(rfc.max_pdu_size);  in l2cap_conf_rfc_get()
3671 		if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_conf_rfc_get()
3672 			chan->ack_win = min_t(u16, chan->ack_win, txwin_ext);  in l2cap_conf_rfc_get()
3674 			chan->ack_win = min_t(u16, chan->ack_win,  in l2cap_conf_rfc_get()
3678 		chan->mps    = le16_to_cpu(rfc.max_pdu_size);  in l2cap_conf_rfc_get()
3713 	struct l2cap_chan *chan = NULL, *pchan;  in l2cap_connect()  local
3748 	chan = pchan->ops->new_connection(pchan);  in l2cap_connect()
3749 	if (!chan)  in l2cap_connect()
3752 	sk = chan->sk;  in l2cap_connect()
3758 	chan->psm  = psm;  in l2cap_connect()
3759 	chan->dcid = scid;  in l2cap_connect()
3760 	chan->local_amp_id = amp_id;  in l2cap_connect()
3762 	__l2cap_chan_add(conn, chan);  in l2cap_connect()
3764 	dcid = chan->scid;  in l2cap_connect()
3766 	__set_chan_timer(chan, sk->sk_sndtimeo);  in l2cap_connect()
3768 	chan->ident = cmd->ident;  in l2cap_connect()
3771 		if (l2cap_chan_check_security(chan)) {  in l2cap_connect()
3773 				__l2cap_state_change(chan, BT_CONNECT2);  in l2cap_connect()
3776 				chan->ops->defer(chan);  in l2cap_connect()
3783 					__l2cap_state_change(chan, BT_CONNECT2);  in l2cap_connect()
3786 					__l2cap_state_change(chan, BT_CONFIG);  in l2cap_connect()
3792 			__l2cap_state_change(chan, BT_CONNECT2);  in l2cap_connect()
3797 		__l2cap_state_change(chan, BT_CONNECT2);  in l2cap_connect()
3826 	if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&  in l2cap_connect()
3829 		set_bit(CONF_REQ_SENT, &chan->conf_state);  in l2cap_connect()
3831 			       l2cap_build_conf_req(chan, buf), buf);  in l2cap_connect()
3832 		chan->num_conf_req++;  in l2cap_connect()
3835 	return chan;  in l2cap_connect()
3865 	struct l2cap_chan *chan;  in l2cap_connect_create_rsp()  local
3883 		chan = __l2cap_get_chan_by_scid(conn, scid);  in l2cap_connect_create_rsp()
3884 		if (!chan) {  in l2cap_connect_create_rsp()
3889 		chan = __l2cap_get_chan_by_ident(conn, cmd->ident);  in l2cap_connect_create_rsp()
3890 		if (!chan) {  in l2cap_connect_create_rsp()
3898 	l2cap_chan_lock(chan);  in l2cap_connect_create_rsp()
3902 		l2cap_state_change(chan, BT_CONFIG);  in l2cap_connect_create_rsp()
3903 		chan->ident = 0;  in l2cap_connect_create_rsp()
3904 		chan->dcid = dcid;  in l2cap_connect_create_rsp()
3905 		clear_bit(CONF_CONNECT_PEND, &chan->conf_state);  in l2cap_connect_create_rsp()
3907 		if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))  in l2cap_connect_create_rsp()
3911 			       l2cap_build_conf_req(chan, req), req);  in l2cap_connect_create_rsp()
3912 		chan->num_conf_req++;  in l2cap_connect_create_rsp()
3916 		set_bit(CONF_CONNECT_PEND, &chan->conf_state);  in l2cap_connect_create_rsp()
3920 		l2cap_chan_del(chan, ECONNREFUSED);  in l2cap_connect_create_rsp()
3924 	l2cap_chan_unlock(chan);  in l2cap_connect_create_rsp()
3932 static inline void set_default_fcs(struct l2cap_chan *chan)  in set_default_fcs()  argument
3937 	if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)  in set_default_fcs()
3938 		chan->fcs = L2CAP_FCS_NONE;  in set_default_fcs()
3939 	else if (!test_bit(CONF_RECV_NO_FCS, &chan->conf_state))  in set_default_fcs()
3940 		chan->fcs = L2CAP_FCS_CRC16;  in set_default_fcs()
3943 static void l2cap_send_efs_conf_rsp(struct l2cap_chan *chan, void *data,  in l2cap_send_efs_conf_rsp()  argument
3946 	struct l2cap_conn *conn = chan->conn;  in l2cap_send_efs_conf_rsp()
3948 	BT_DBG("conn %p chan %p ident %d flags 0x%4.4x", conn, chan, ident,  in l2cap_send_efs_conf_rsp()
3951 	clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);  in l2cap_send_efs_conf_rsp()
3952 	set_bit(CONF_OUTPUT_DONE, &chan->conf_state);  in l2cap_send_efs_conf_rsp()
3955 		       l2cap_build_conf_rsp(chan, data,  in l2cap_send_efs_conf_rsp()
3966 	struct l2cap_chan *chan;  in l2cap_config_req()  local
3977 	chan = l2cap_get_chan_by_scid(conn, dcid);  in l2cap_config_req()
3978 	if (!chan)  in l2cap_config_req()
3981 	if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) {  in l2cap_config_req()
3985 		rej.scid = cpu_to_le16(chan->scid);  in l2cap_config_req()
3986 		rej.dcid = cpu_to_le16(chan->dcid);  in l2cap_config_req()
3995 	if (chan->conf_len + len > sizeof(chan->conf_req)) {  in l2cap_config_req()
3997 			       l2cap_build_conf_rsp(chan, rsp,  in l2cap_config_req()
4003 	memcpy(chan->conf_req + chan->conf_len, req->data, len);  in l2cap_config_req()
4004 	chan->conf_len += len;  in l2cap_config_req()
4009 			       l2cap_build_conf_rsp(chan, rsp,  in l2cap_config_req()
4015 	len = l2cap_parse_conf_req(chan, rsp);  in l2cap_config_req()
4017 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_config_req()
4021 	chan->ident = cmd->ident;  in l2cap_config_req()
4023 	chan->num_conf_rsp++;  in l2cap_config_req()
4026 	chan->conf_len = 0;  in l2cap_config_req()
4028 	if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))  in l2cap_config_req()
4031 	if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {  in l2cap_config_req()
4032 		set_default_fcs(chan);  in l2cap_config_req()
4034 		if (chan->mode == L2CAP_MODE_ERTM ||  in l2cap_config_req()
4035 		    chan->mode == L2CAP_MODE_STREAMING)  in l2cap_config_req()
4036 			err = l2cap_ertm_init(chan);  in l2cap_config_req()
4039 			l2cap_send_disconn_req(chan, -err);  in l2cap_config_req()
4041 			l2cap_chan_ready(chan);  in l2cap_config_req()
4046 	if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {  in l2cap_config_req()
4049 			       l2cap_build_conf_req(chan, buf), buf);  in l2cap_config_req()
4050 		chan->num_conf_req++;  in l2cap_config_req()
4055 	if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&  in l2cap_config_req()
4056 	    test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {  in l2cap_config_req()
4061 		if (!chan->hs_hcon)  in l2cap_config_req()
4062 			l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags);  in l2cap_config_req()
4064 			chan->ident = cmd->ident;  in l2cap_config_req()
4068 	l2cap_chan_unlock(chan);  in l2cap_config_req()
4078 	struct l2cap_chan *chan;  in l2cap_config_rsp()  local
4092 	chan = l2cap_get_chan_by_scid(conn, scid);  in l2cap_config_rsp()
4093 	if (!chan)  in l2cap_config_rsp()
4098 		l2cap_conf_rfc_get(chan, rsp->data, len);  in l2cap_config_rsp()
4099 		clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);  in l2cap_config_rsp()
4103 		set_bit(CONF_REM_CONF_PEND, &chan->conf_state);  in l2cap_config_rsp()
4105 		if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {  in l2cap_config_rsp()
4108 			len = l2cap_parse_conf_rsp(chan, rsp->data, len,  in l2cap_config_rsp()
4111 				l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_config_rsp()
4115 			if (!chan->hs_hcon) {  in l2cap_config_rsp()
4116 				l2cap_send_efs_conf_rsp(chan, buf, cmd->ident,  in l2cap_config_rsp()
4119 				if (l2cap_check_efs(chan)) {  in l2cap_config_rsp()
4120 					amp_create_logical_link(chan);  in l2cap_config_rsp()
4121 					chan->ident = cmd->ident;  in l2cap_config_rsp()
4128 		if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {  in l2cap_config_rsp()
4132 				l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_config_rsp()
4138 			len = l2cap_parse_conf_rsp(chan, rsp->data, len,  in l2cap_config_rsp()
4141 				l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_config_rsp()
4147 			chan->num_conf_req++;  in l2cap_config_rsp()
4154 		l2cap_chan_set_err(chan, ECONNRESET);  in l2cap_config_rsp()
4156 		__set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);  in l2cap_config_rsp()
4157 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_config_rsp()
4164 	set_bit(CONF_INPUT_DONE, &chan->conf_state);  in l2cap_config_rsp()
4166 	if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {  in l2cap_config_rsp()
4167 		set_default_fcs(chan);  in l2cap_config_rsp()
4169 		if (chan->mode == L2CAP_MODE_ERTM ||  in l2cap_config_rsp()
4170 		    chan->mode == L2CAP_MODE_STREAMING)  in l2cap_config_rsp()
4171 			err = l2cap_ertm_init(chan);  in l2cap_config_rsp()
4174 			l2cap_send_disconn_req(chan, -err);  in l2cap_config_rsp()
4176 			l2cap_chan_ready(chan);  in l2cap_config_rsp()
4180 	l2cap_chan_unlock(chan);  in l2cap_config_rsp()
4191 	struct l2cap_chan *chan;  in l2cap_disconnect_req()  local
4204 	chan = __l2cap_get_chan_by_scid(conn, dcid);  in l2cap_disconnect_req()
4205 	if (!chan) {  in l2cap_disconnect_req()
4210 	l2cap_chan_lock(chan);  in l2cap_disconnect_req()
4212 	sk = chan->sk;  in l2cap_disconnect_req()
4214 	rsp.dcid = cpu_to_le16(chan->scid);  in l2cap_disconnect_req()
4215 	rsp.scid = cpu_to_le16(chan->dcid);  in l2cap_disconnect_req()
4222 	l2cap_chan_hold(chan);  in l2cap_disconnect_req()
4223 	l2cap_chan_del(chan, ECONNRESET);  in l2cap_disconnect_req()
4225 	l2cap_chan_unlock(chan);  in l2cap_disconnect_req()
4227 	chan->ops->close(chan);  in l2cap_disconnect_req()
4228 	l2cap_chan_put(chan);  in l2cap_disconnect_req()
4241 	struct l2cap_chan *chan;  in l2cap_disconnect_rsp()  local
4253 	chan = __l2cap_get_chan_by_scid(conn, scid);  in l2cap_disconnect_rsp()
4254 	if (!chan) {  in l2cap_disconnect_rsp()
4259 	l2cap_chan_lock(chan);  in l2cap_disconnect_rsp()
4261 	l2cap_chan_hold(chan);  in l2cap_disconnect_rsp()
4262 	l2cap_chan_del(chan, 0);  in l2cap_disconnect_rsp()
4264 	l2cap_chan_unlock(chan);  in l2cap_disconnect_rsp()
4266 	chan->ops->close(chan);  in l2cap_disconnect_rsp()
4267 	l2cap_chan_put(chan);  in l2cap_disconnect_rsp()
4398 	struct l2cap_chan *chan;  in l2cap_create_channel_req()  local
4430 	chan = l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,  in l2cap_create_channel_req()
4432 	if (chan) {  in l2cap_create_channel_req()
4442 		BT_DBG("mgr %p bredr_chan %p hs_hcon %p", mgr, chan, hs_hcon);  in l2cap_create_channel_req()
4444 		mgr->bredr_chan = chan;  in l2cap_create_channel_req()
4445 		chan->hs_hcon = hs_hcon;  in l2cap_create_channel_req()
4446 		chan->fcs = L2CAP_FCS_NONE;  in l2cap_create_channel_req()
4466 static void l2cap_send_move_chan_req(struct l2cap_chan *chan, u8 dest_amp_id)  in l2cap_send_move_chan_req()  argument
4471 	BT_DBG("chan %p, dest_amp_id %d", chan, dest_amp_id);  in l2cap_send_move_chan_req()
4473 	ident = l2cap_get_ident(chan->conn);  in l2cap_send_move_chan_req()
4474 	chan->ident = ident;  in l2cap_send_move_chan_req()
4476 	req.icid = cpu_to_le16(chan->scid);  in l2cap_send_move_chan_req()
4479 	l2cap_send_cmd(chan->conn, ident, L2CAP_MOVE_CHAN_REQ, sizeof(req),  in l2cap_send_move_chan_req()
4482 	__set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);  in l2cap_send_move_chan_req()
4485 static void l2cap_send_move_chan_rsp(struct l2cap_chan *chan, u16 result)  in l2cap_send_move_chan_rsp()  argument
4489 	BT_DBG("chan %p, result 0x%4.4x", chan, result);  in l2cap_send_move_chan_rsp()
4491 	rsp.icid = cpu_to_le16(chan->dcid);  in l2cap_send_move_chan_rsp()
4494 	l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_RSP,  in l2cap_send_move_chan_rsp()
4498 static void l2cap_send_move_chan_cfm(struct l2cap_chan *chan, u16 result)  in l2cap_send_move_chan_cfm()  argument
4502 	BT_DBG("chan %p, result 0x%4.4x", chan, result);  in l2cap_send_move_chan_cfm()
4504 	chan->ident = l2cap_get_ident(chan->conn);  in l2cap_send_move_chan_cfm()
4506 	cfm.icid = cpu_to_le16(chan->scid);  in l2cap_send_move_chan_cfm()
4509 	l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_CFM,  in l2cap_send_move_chan_cfm()
4512 	__set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);  in l2cap_send_move_chan_cfm()
4539 static void __release_logical_link(struct l2cap_chan *chan)  in __release_logical_link()  argument
4541 	chan->hs_hchan = NULL;  in __release_logical_link()
4542 	chan->hs_hcon = NULL;  in __release_logical_link()
4547 static void l2cap_logical_fail(struct l2cap_chan *chan)  in l2cap_logical_fail()  argument
4550 	if (chan->state != BT_CONNECTED) {  in l2cap_logical_fail()
4552 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_logical_fail()
4556 	switch (chan->move_role) {  in l2cap_logical_fail()
4558 		l2cap_move_done(chan);  in l2cap_logical_fail()
4559 		l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_SUPP);  in l2cap_logical_fail()
4562 		if (chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_COMP ||  in l2cap_logical_fail()
4563 		    chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_CFM) {  in l2cap_logical_fail()
4567 			l2cap_move_done(chan);  in l2cap_logical_fail()
4573 		l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);  in l2cap_logical_fail()
4578 static void l2cap_logical_finish_create(struct l2cap_chan *chan,  in l2cap_logical_finish_create()  argument
4583 	chan->hs_hchan = hchan;  in l2cap_logical_finish_create()
4584 	chan->hs_hcon->l2cap_data = chan->conn;  in l2cap_logical_finish_create()
4586 	l2cap_send_efs_conf_rsp(chan, &rsp, chan->ident, 0);  in l2cap_logical_finish_create()
4588 	if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {  in l2cap_logical_finish_create()
4591 		set_default_fcs(chan);  in l2cap_logical_finish_create()
4593 		err = l2cap_ertm_init(chan);  in l2cap_logical_finish_create()
4595 			l2cap_send_disconn_req(chan, -err);  in l2cap_logical_finish_create()
4597 			l2cap_chan_ready(chan);  in l2cap_logical_finish_create()
4601 static void l2cap_logical_finish_move(struct l2cap_chan *chan,  in l2cap_logical_finish_move()  argument
4604 	chan->hs_hcon = hchan->conn;  in l2cap_logical_finish_move()
4605 	chan->hs_hcon->l2cap_data = chan->conn;  in l2cap_logical_finish_move()
4607 	BT_DBG("move_state %d", chan->move_state);  in l2cap_logical_finish_move()
4609 	switch (chan->move_state) {  in l2cap_logical_finish_move()
4614 		chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;  in l2cap_logical_finish_move()
4617 		if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_logical_finish_move()
4618 			chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;  in l2cap_logical_finish_move()
4619 		} else if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {  in l2cap_logical_finish_move()
4620 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;  in l2cap_logical_finish_move()
4621 			l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);  in l2cap_logical_finish_move()
4622 		} else if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {  in l2cap_logical_finish_move()
4623 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;  in l2cap_logical_finish_move()
4624 			l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);  in l2cap_logical_finish_move()
4629 		__release_logical_link(chan);  in l2cap_logical_finish_move()
4631 		chan->move_state = L2CAP_MOVE_STABLE;  in l2cap_logical_finish_move()
4636 void l2cap_logical_cfm(struct l2cap_chan *chan, struct hci_chan *hchan,  in l2cap_logical_cfm()  argument
4639 	BT_DBG("chan %p, hchan %p, status %d", chan, hchan, status);  in l2cap_logical_cfm()
4642 		l2cap_logical_fail(chan);  in l2cap_logical_cfm()
4643 		__release_logical_link(chan);  in l2cap_logical_cfm()
4647 	if (chan->state != BT_CONNECTED) {  in l2cap_logical_cfm()
4649 		if (chan->local_amp_id)  in l2cap_logical_cfm()
4650 			l2cap_logical_finish_create(chan, hchan);  in l2cap_logical_cfm()
4652 		l2cap_logical_finish_move(chan, hchan);  in l2cap_logical_cfm()
4656 void l2cap_move_start(struct l2cap_chan *chan)  in l2cap_move_start()  argument
4658 	BT_DBG("chan %p", chan);  in l2cap_move_start()
4660 	if (chan->local_amp_id == HCI_BREDR_ID) {  in l2cap_move_start()
4661 		if (chan->chan_policy != BT_CHANNEL_POLICY_AMP_PREFERRED)  in l2cap_move_start()
4663 		chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;  in l2cap_move_start()
4664 		chan->move_state = L2CAP_MOVE_WAIT_PREPARE;  in l2cap_move_start()
4667 		chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;  in l2cap_move_start()
4668 		chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;  in l2cap_move_start()
4669 		chan->move_id = 0;  in l2cap_move_start()
4670 		l2cap_move_setup(chan);  in l2cap_move_start()
4671 		l2cap_send_move_chan_req(chan, 0);  in l2cap_move_start()
4675 static void l2cap_do_create(struct l2cap_chan *chan, int result,  in l2cap_do_create()  argument
4678 	BT_DBG("chan %p state %s %u -> %u", chan, state_to_string(chan->state),  in l2cap_do_create()
4681 	chan->fcs = L2CAP_FCS_NONE;  in l2cap_do_create()
4684 	if (chan->state == BT_CONNECT) {  in l2cap_do_create()
4686 			chan->local_amp_id = local_amp_id;  in l2cap_do_create()
4687 			l2cap_send_create_chan_req(chan, remote_amp_id);  in l2cap_do_create()
4690 			l2cap_send_conn_req(chan);  in l2cap_do_create()
4697 	if (__l2cap_no_conn_pending(chan)) {  in l2cap_do_create()
4700 		rsp.scid = cpu_to_le16(chan->dcid);  in l2cap_do_create()
4701 		rsp.dcid = cpu_to_le16(chan->scid);  in l2cap_do_create()
4713 		l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_RSP,  in l2cap_do_create()
4717 			__l2cap_state_change(chan, BT_CONFIG);  in l2cap_do_create()
4718 			set_bit(CONF_REQ_SENT, &chan->conf_state);  in l2cap_do_create()
4719 			l2cap_send_cmd(chan->conn, l2cap_get_ident(chan->conn),  in l2cap_do_create()
4721 				       l2cap_build_conf_req(chan, buf), buf);  in l2cap_do_create()
4722 			chan->num_conf_req++;  in l2cap_do_create()
4727 static void l2cap_do_move_initiate(struct l2cap_chan *chan, u8 local_amp_id,  in l2cap_do_move_initiate()  argument
4730 	l2cap_move_setup(chan);  in l2cap_do_move_initiate()
4731 	chan->move_id = local_amp_id;  in l2cap_do_move_initiate()
4732 	chan->move_state = L2CAP_MOVE_WAIT_RSP;  in l2cap_do_move_initiate()
4734 	l2cap_send_move_chan_req(chan, remote_amp_id);  in l2cap_do_move_initiate()
4737 static void l2cap_do_move_respond(struct l2cap_chan *chan, int result)  in l2cap_do_move_respond()  argument
4746 			chan->hs_hcon = hchan->conn;  in l2cap_do_move_respond()
4747 			chan->hs_hcon->l2cap_data = chan->conn;  in l2cap_do_move_respond()
4748 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;  in l2cap_do_move_respond()
4749 			l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);  in l2cap_do_move_respond()
4751 			l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);  in l2cap_do_move_respond()
4754 			chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;  in l2cap_do_move_respond()
4758 		l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_ALLOWED);  in l2cap_do_move_respond()
4762 static void l2cap_do_move_cancel(struct l2cap_chan *chan, int result)  in l2cap_do_move_cancel()  argument
4764 	if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {  in l2cap_do_move_cancel()
4771 		l2cap_send_move_chan_rsp(chan, rsp_result);  in l2cap_do_move_cancel()
4774 	chan->move_role = L2CAP_MOVE_ROLE_NONE;  in l2cap_do_move_cancel()
4775 	chan->move_state = L2CAP_MOVE_STABLE;  in l2cap_do_move_cancel()
4778 	l2cap_ertm_send(chan);  in l2cap_do_move_cancel()
4782 void __l2cap_physical_cfm(struct l2cap_chan *chan, int result)  in __l2cap_physical_cfm()  argument
4784 	u8 local_amp_id = chan->local_amp_id;  in __l2cap_physical_cfm()
4785 	u8 remote_amp_id = chan->remote_amp_id;  in __l2cap_physical_cfm()
4788 	       chan, result, local_amp_id, remote_amp_id);  in __l2cap_physical_cfm()
4790 	if (chan->state == BT_DISCONN || chan->state == BT_CLOSED) {  in __l2cap_physical_cfm()
4791 		l2cap_chan_unlock(chan);  in __l2cap_physical_cfm()
4795 	if (chan->state != BT_CONNECTED) {  in __l2cap_physical_cfm()
4796 		l2cap_do_create(chan, result, local_amp_id, remote_amp_id);  in __l2cap_physical_cfm()
4798 		l2cap_do_move_cancel(chan, result);  in __l2cap_physical_cfm()
4800 		switch (chan->move_role) {  in __l2cap_physical_cfm()
4802 			l2cap_do_move_initiate(chan, local_amp_id,  in __l2cap_physical_cfm()
4806 			l2cap_do_move_respond(chan, result);  in __l2cap_physical_cfm()
4809 			l2cap_do_move_cancel(chan, result);  in __l2cap_physical_cfm()
4821 	struct l2cap_chan *chan;  in l2cap_move_channel_req()  local
4835 	chan = l2cap_get_chan_by_dcid(conn, icid);  in l2cap_move_channel_req()
4836 	if (!chan) {  in l2cap_move_channel_req()
4844 	chan->ident = cmd->ident;  in l2cap_move_channel_req()
4846 	if (chan->scid < L2CAP_CID_DYN_START ||  in l2cap_move_channel_req()
4847 	    chan->chan_policy == BT_CHANNEL_POLICY_BREDR_ONLY ||  in l2cap_move_channel_req()
4848 	    (chan->mode != L2CAP_MODE_ERTM &&  in l2cap_move_channel_req()
4849 	     chan->mode != L2CAP_MODE_STREAMING)) {  in l2cap_move_channel_req()
4854 	if (chan->local_amp_id == req->dest_amp_id) {  in l2cap_move_channel_req()
4877 	if ((__chan_is_moving(chan) ||  in l2cap_move_channel_req()
4878 	     chan->move_role != L2CAP_MOVE_ROLE_NONE) &&  in l2cap_move_channel_req()
4884 	chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;  in l2cap_move_channel_req()
4885 	l2cap_move_setup(chan);  in l2cap_move_channel_req()
4886 	chan->move_id = req->dest_amp_id;  in l2cap_move_channel_req()
4887 	icid = chan->dcid;  in l2cap_move_channel_req()
4891 		if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_move_channel_req()
4892 			chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;  in l2cap_move_channel_req()
4895 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;  in l2cap_move_channel_req()
4899 		chan->move_state = L2CAP_MOVE_WAIT_PREPARE;  in l2cap_move_channel_req()
4906 	l2cap_send_move_chan_rsp(chan, result);  in l2cap_move_channel_req()
4908 	l2cap_chan_unlock(chan);  in l2cap_move_channel_req()
4915 	struct l2cap_chan *chan;  in l2cap_move_continue()  local
4918 	chan = l2cap_get_chan_by_scid(conn, icid);  in l2cap_move_continue()
4919 	if (!chan) {  in l2cap_move_continue()
4924 	__clear_chan_timer(chan);  in l2cap_move_continue()
4926 		__set_chan_timer(chan, L2CAP_MOVE_ERTX_TIMEOUT);  in l2cap_move_continue()
4928 	switch (chan->move_state) {  in l2cap_move_continue()
4933 		chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;  in l2cap_move_continue()
4939 				    &chan->conn_state)) {  in l2cap_move_continue()
4940 			chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;  in l2cap_move_continue()
4945 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;  in l2cap_move_continue()
4946 			l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);  in l2cap_move_continue()
4955 			chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;  in l2cap_move_continue()
4960 			chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_COMP;  in l2cap_move_continue()
4966 			l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);  in l2cap_move_continue()
4978 		chan->hs_hcon = hchan->conn;  in l2cap_move_continue()
4979 		chan->hs_hcon->l2cap_data = chan->conn;  in l2cap_move_continue()
4983 			l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);  in l2cap_move_continue()
4988 			chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;  in l2cap_move_continue()
4991 		l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);  in l2cap_move_continue()
4995 		chan->move_id = chan->local_amp_id;  in l2cap_move_continue()
4996 		l2cap_move_done(chan);  in l2cap_move_continue()
4997 		l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);  in l2cap_move_continue()
5000 	l2cap_chan_unlock(chan);  in l2cap_move_continue()
5006 	struct l2cap_chan *chan;  in l2cap_move_fail()  local
5008 	chan = l2cap_get_chan_by_ident(conn, ident);  in l2cap_move_fail()
5009 	if (!chan) {  in l2cap_move_fail()
5015 	__clear_chan_timer(chan);  in l2cap_move_fail()
5017 	if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {  in l2cap_move_fail()
5019 			chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;  in l2cap_move_fail()
5022 			chan->move_id = chan->local_amp_id;  in l2cap_move_fail()
5023 			l2cap_move_done(chan);  in l2cap_move_fail()
5027 	l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);  in l2cap_move_fail()
5029 	l2cap_chan_unlock(chan);  in l2cap_move_fail()
5060 	struct l2cap_chan *chan;  in l2cap_move_channel_confirm()  local
5071 	chan = l2cap_get_chan_by_dcid(conn, icid);  in l2cap_move_channel_confirm()
5072 	if (!chan) {  in l2cap_move_channel_confirm()
5078 	if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM) {  in l2cap_move_channel_confirm()
5080 			chan->local_amp_id = chan->move_id;  in l2cap_move_channel_confirm()
5081 			if (!chan->local_amp_id)  in l2cap_move_channel_confirm()
5082 				__release_logical_link(chan);  in l2cap_move_channel_confirm()
5084 			chan->move_id = chan->local_amp_id;  in l2cap_move_channel_confirm()
5087 		l2cap_move_done(chan);  in l2cap_move_channel_confirm()
5092 	l2cap_chan_unlock(chan);  in l2cap_move_channel_confirm()
5102 	struct l2cap_chan *chan;  in l2cap_move_channel_confirm_rsp()  local
5112 	chan = l2cap_get_chan_by_scid(conn, icid);  in l2cap_move_channel_confirm_rsp()
5113 	if (!chan)  in l2cap_move_channel_confirm_rsp()
5116 	__clear_chan_timer(chan);  in l2cap_move_channel_confirm_rsp()
5118 	if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM_RSP) {  in l2cap_move_channel_confirm_rsp()
5119 		chan->local_amp_id = chan->move_id;  in l2cap_move_channel_confirm_rsp()
5121 		if (!chan->local_amp_id && chan->hs_hchan)  in l2cap_move_channel_confirm_rsp()
5122 			__release_logical_link(chan);  in l2cap_move_channel_confirm_rsp()
5124 		l2cap_move_done(chan);  in l2cap_move_channel_confirm_rsp()
5127 	l2cap_chan_unlock(chan);  in l2cap_move_channel_confirm_rsp()
5344 static int l2cap_check_fcs(struct l2cap_chan *chan,  struct sk_buff *skb)  in l2cap_check_fcs()  argument
5349 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))  in l2cap_check_fcs()
5354 	if (chan->fcs == L2CAP_FCS_CRC16) {  in l2cap_check_fcs()
5365 static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)  in l2cap_send_i_or_rr_or_rnr()  argument
5369 	BT_DBG("chan %p", chan);  in l2cap_send_i_or_rr_or_rnr()
5374 	control.reqseq = chan->buffer_seq;  in l2cap_send_i_or_rr_or_rnr()
5375 	set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_send_i_or_rr_or_rnr()
5377 	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_send_i_or_rr_or_rnr()
5379 		l2cap_send_sframe(chan, &control);  in l2cap_send_i_or_rr_or_rnr()
5382 	if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&  in l2cap_send_i_or_rr_or_rnr()
5383 	    chan->unacked_frames > 0)  in l2cap_send_i_or_rr_or_rnr()
5384 		__set_retrans_timer(chan);  in l2cap_send_i_or_rr_or_rnr()
5387 	l2cap_ertm_send(chan);  in l2cap_send_i_or_rr_or_rnr()
5389 	if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&  in l2cap_send_i_or_rr_or_rnr()
5390 	    test_bit(CONN_SEND_FBIT, &chan->conn_state)) {  in l2cap_send_i_or_rr_or_rnr()
5395 		l2cap_send_sframe(chan, &control);  in l2cap_send_i_or_rr_or_rnr()
5418 static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,  in l2cap_reassemble_sdu()  argument
5425 		if (chan->sdu)  in l2cap_reassemble_sdu()
5428 		err = chan->ops->recv(chan, skb);  in l2cap_reassemble_sdu()
5432 		if (chan->sdu)  in l2cap_reassemble_sdu()
5435 		chan->sdu_len = get_unaligned_le16(skb->data);  in l2cap_reassemble_sdu()
5438 		if (chan->sdu_len > chan->imtu) {  in l2cap_reassemble_sdu()
5443 		if (skb->len >= chan->sdu_len)  in l2cap_reassemble_sdu()
5446 		chan->sdu = skb;  in l2cap_reassemble_sdu()
5447 		chan->sdu_last_frag = skb;  in l2cap_reassemble_sdu()
5454 		if (!chan->sdu)  in l2cap_reassemble_sdu()
5457 		append_skb_frag(chan->sdu, skb,  in l2cap_reassemble_sdu()
5458 				&chan->sdu_last_frag);  in l2cap_reassemble_sdu()
5461 		if (chan->sdu->len >= chan->sdu_len)  in l2cap_reassemble_sdu()
5468 		if (!chan->sdu)  in l2cap_reassemble_sdu()
5471 		append_skb_frag(chan->sdu, skb,  in l2cap_reassemble_sdu()
5472 				&chan->sdu_last_frag);  in l2cap_reassemble_sdu()
5475 		if (chan->sdu->len != chan->sdu_len)  in l2cap_reassemble_sdu()
5478 		err = chan->ops->recv(chan, chan->sdu);  in l2cap_reassemble_sdu()
5482 			chan->sdu = NULL;  in l2cap_reassemble_sdu()
5483 			chan->sdu_last_frag = NULL;  in l2cap_reassemble_sdu()
5484 			chan->sdu_len = 0;  in l2cap_reassemble_sdu()
5491 		kfree_skb(chan->sdu);  in l2cap_reassemble_sdu()
5492 		chan->sdu = NULL;  in l2cap_reassemble_sdu()
5493 		chan->sdu_last_frag = NULL;  in l2cap_reassemble_sdu()
5494 		chan->sdu_len = 0;  in l2cap_reassemble_sdu()
5500 static int l2cap_resegment(struct l2cap_chan *chan)  in l2cap_resegment()  argument
5506 void l2cap_chan_busy(struct l2cap_chan *chan, int busy)  in l2cap_chan_busy()  argument
5510 	if (chan->mode != L2CAP_MODE_ERTM)  in l2cap_chan_busy()
5514 	l2cap_tx(chan, NULL, NULL, event);  in l2cap_chan_busy()
5517 static int l2cap_rx_queued_iframes(struct l2cap_chan *chan)  in l2cap_rx_queued_iframes()  argument
5524 	BT_DBG("chan %p", chan);  in l2cap_rx_queued_iframes()
5526 	while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_rx_queued_iframes()
5529 		       chan->buffer_seq, skb_queue_len(&chan->srej_q));  in l2cap_rx_queued_iframes()
5531 		skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq);  in l2cap_rx_queued_iframes()
5536 		skb_unlink(skb, &chan->srej_q);  in l2cap_rx_queued_iframes()
5537 		chan->buffer_seq = __next_seq(chan, chan->buffer_seq);  in l2cap_rx_queued_iframes()
5538 		err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->control);  in l2cap_rx_queued_iframes()
5543 	if (skb_queue_empty(&chan->srej_q)) {  in l2cap_rx_queued_iframes()
5544 		chan->rx_state = L2CAP_RX_STATE_RECV;  in l2cap_rx_queued_iframes()
5545 		l2cap_send_ack(chan);  in l2cap_rx_queued_iframes()
5551 static void l2cap_handle_srej(struct l2cap_chan *chan,  in l2cap_handle_srej()  argument
5556 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_handle_srej()
5558 	if (control->reqseq == chan->next_tx_seq) {  in l2cap_handle_srej()
5560 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_handle_srej()
5564 	skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);  in l2cap_handle_srej()
5572 	if (chan->max_tx != 0 && bt_cb(skb)->control.retries >= chan->max_tx) {  in l2cap_handle_srej()
5573 		BT_DBG("Retry limit exceeded (%d)", chan->max_tx);  in l2cap_handle_srej()
5574 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_handle_srej()
5578 	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_handle_srej()
5581 		l2cap_pass_to_tx(chan, control);  in l2cap_handle_srej()
5583 		set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_handle_srej()
5584 		l2cap_retransmit(chan, control);  in l2cap_handle_srej()
5585 		l2cap_ertm_send(chan);  in l2cap_handle_srej()
5587 		if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {  in l2cap_handle_srej()
5588 			set_bit(CONN_SREJ_ACT, &chan->conn_state);  in l2cap_handle_srej()
5589 			chan->srej_save_reqseq = control->reqseq;  in l2cap_handle_srej()
5592 		l2cap_pass_to_tx_fbit(chan, control);  in l2cap_handle_srej()
5595 			if (chan->srej_save_reqseq != control->reqseq ||  in l2cap_handle_srej()
5597 						&chan->conn_state))  in l2cap_handle_srej()
5598 				l2cap_retransmit(chan, control);  in l2cap_handle_srej()
5600 			l2cap_retransmit(chan, control);  in l2cap_handle_srej()
5601 			if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {  in l2cap_handle_srej()
5602 				set_bit(CONN_SREJ_ACT, &chan->conn_state);  in l2cap_handle_srej()
5603 				chan->srej_save_reqseq = control->reqseq;  in l2cap_handle_srej()
5609 static void l2cap_handle_rej(struct l2cap_chan *chan,  in l2cap_handle_rej()  argument
5614 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_handle_rej()
5616 	if (control->reqseq == chan->next_tx_seq) {  in l2cap_handle_rej()
5618 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_handle_rej()
5622 	skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);  in l2cap_handle_rej()
5624 	if (chan->max_tx && skb &&  in l2cap_handle_rej()
5625 	    bt_cb(skb)->control.retries >= chan->max_tx) {  in l2cap_handle_rej()
5626 		BT_DBG("Retry limit exceeded (%d)", chan->max_tx);  in l2cap_handle_rej()
5627 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_handle_rej()
5631 	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_handle_rej()
5633 	l2cap_pass_to_tx(chan, control);  in l2cap_handle_rej()
5636 		if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))  in l2cap_handle_rej()
5637 			l2cap_retransmit_all(chan, control);  in l2cap_handle_rej()
5639 		l2cap_retransmit_all(chan, control);  in l2cap_handle_rej()
5640 		l2cap_ertm_send(chan);  in l2cap_handle_rej()
5641 		if (chan->tx_state == L2CAP_TX_STATE_WAIT_F)  in l2cap_handle_rej()
5642 			set_bit(CONN_REJ_ACT, &chan->conn_state);  in l2cap_handle_rej()
5646 static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq)  in l2cap_classify_txseq()  argument
5648 	BT_DBG("chan %p, txseq %d", chan, txseq);  in l2cap_classify_txseq()
5650 	BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq,  in l2cap_classify_txseq()
5651 	       chan->expected_tx_seq);  in l2cap_classify_txseq()
5653 	if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {  in l2cap_classify_txseq()
5654 		if (__seq_offset(chan, txseq, chan->last_acked_seq) >=  in l2cap_classify_txseq()
5655 		    chan->tx_win) {  in l2cap_classify_txseq()
5659 			if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {  in l2cap_classify_txseq()
5668 		if (chan->srej_list.head == txseq) {  in l2cap_classify_txseq()
5673 		if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) {  in l2cap_classify_txseq()
5678 		if (l2cap_seq_list_contains(&chan->srej_list, txseq)) {  in l2cap_classify_txseq()
5684 	if (chan->expected_tx_seq == txseq) {  in l2cap_classify_txseq()
5685 		if (__seq_offset(chan, txseq, chan->last_acked_seq) >=  in l2cap_classify_txseq()
5686 		    chan->tx_win) {  in l2cap_classify_txseq()
5695 	if (__seq_offset(chan, txseq, chan->last_acked_seq) <  in l2cap_classify_txseq()
5696 	    __seq_offset(chan, chan->expected_tx_seq, chan->last_acked_seq)) {  in l2cap_classify_txseq()
5701 	if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) {  in l2cap_classify_txseq()
5719 		if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {  in l2cap_classify_txseq()
5732 static int l2cap_rx_state_recv(struct l2cap_chan *chan,  in l2cap_rx_state_recv()  argument
5739 	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,  in l2cap_rx_state_recv()
5744 		switch (l2cap_classify_txseq(chan, control->txseq)) {  in l2cap_rx_state_recv()
5746 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
5748 			if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_rx_state_recv()
5754 			chan->expected_tx_seq = __next_seq(chan,  in l2cap_rx_state_recv()
5757 			chan->buffer_seq = chan->expected_tx_seq;  in l2cap_rx_state_recv()
5760 			err = l2cap_reassemble_sdu(chan, skb, control);  in l2cap_rx_state_recv()
5766 							&chan->conn_state)) {  in l2cap_rx_state_recv()
5768 					l2cap_retransmit_all(chan, control);  in l2cap_rx_state_recv()
5769 					l2cap_ertm_send(chan);  in l2cap_rx_state_recv()
5773 			if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state))  in l2cap_rx_state_recv()
5774 				l2cap_send_ack(chan);  in l2cap_rx_state_recv()
5777 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
5783 			if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {  in l2cap_rx_state_recv()
5793 			skb_queue_tail(&chan->srej_q, skb);  in l2cap_rx_state_recv()
5796 			       skb_queue_len(&chan->srej_q));  in l2cap_rx_state_recv()
5798 			clear_bit(CONN_SREJ_ACT, &chan->conn_state);  in l2cap_rx_state_recv()
5799 			l2cap_seq_list_clear(&chan->srej_list);  in l2cap_rx_state_recv()
5800 			l2cap_send_srej(chan, control->txseq);  in l2cap_rx_state_recv()
5802 			chan->rx_state = L2CAP_RX_STATE_SREJ_SENT;  in l2cap_rx_state_recv()
5805 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
5811 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_rx_state_recv()
5816 		l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
5818 			clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_rx_state_recv()
5820 			if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state) &&  in l2cap_rx_state_recv()
5821 			    !__chan_is_moving(chan)) {  in l2cap_rx_state_recv()
5823 				l2cap_retransmit_all(chan, control);  in l2cap_rx_state_recv()
5826 			l2cap_ertm_send(chan);  in l2cap_rx_state_recv()
5828 			l2cap_send_i_or_rr_or_rnr(chan);  in l2cap_rx_state_recv()
5831 					       &chan->conn_state) &&  in l2cap_rx_state_recv()
5832 			    chan->unacked_frames)  in l2cap_rx_state_recv()
5833 				__set_retrans_timer(chan);  in l2cap_rx_state_recv()
5835 			l2cap_ertm_send(chan);  in l2cap_rx_state_recv()
5839 		set_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_rx_state_recv()
5840 		l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
5842 			set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_rx_state_recv()
5843 			l2cap_send_rr_or_rnr(chan, 0);  in l2cap_rx_state_recv()
5845 		__clear_retrans_timer(chan);  in l2cap_rx_state_recv()
5846 		l2cap_seq_list_clear(&chan->retrans_list);  in l2cap_rx_state_recv()
5849 		l2cap_handle_rej(chan, control);  in l2cap_rx_state_recv()
5852 		l2cap_handle_srej(chan, control);  in l2cap_rx_state_recv()
5866 static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,  in l2cap_rx_state_srej_sent()  argument
5874 	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,  in l2cap_rx_state_srej_sent()
5879 		switch (l2cap_classify_txseq(chan, txseq)) {  in l2cap_rx_state_srej_sent()
5882 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
5883 			skb_queue_tail(&chan->srej_q, skb);  in l2cap_rx_state_srej_sent()
5886 			       skb_queue_len(&chan->srej_q));  in l2cap_rx_state_srej_sent()
5888 			chan->expected_tx_seq = __next_seq(chan, txseq);  in l2cap_rx_state_srej_sent()
5891 			l2cap_seq_list_pop(&chan->srej_list);  in l2cap_rx_state_srej_sent()
5893 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
5894 			skb_queue_tail(&chan->srej_q, skb);  in l2cap_rx_state_srej_sent()
5897 			       skb_queue_len(&chan->srej_q));  in l2cap_rx_state_srej_sent()
5899 			err = l2cap_rx_queued_iframes(chan);  in l2cap_rx_state_srej_sent()
5909 			skb_queue_tail(&chan->srej_q, skb);  in l2cap_rx_state_srej_sent()
5912 			       skb_queue_len(&chan->srej_q));  in l2cap_rx_state_srej_sent()
5914 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
5915 			l2cap_send_srej(chan, control->txseq);  in l2cap_rx_state_srej_sent()
5923 			skb_queue_tail(&chan->srej_q, skb);  in l2cap_rx_state_srej_sent()
5926 			       skb_queue_len(&chan->srej_q));  in l2cap_rx_state_srej_sent()
5928 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
5929 			l2cap_send_srej_list(chan, control->txseq);  in l2cap_rx_state_srej_sent()
5933 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
5944 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_rx_state_srej_sent()
5949 		l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
5951 			clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_rx_state_srej_sent()
5954 						&chan->conn_state)) {  in l2cap_rx_state_srej_sent()
5956 				l2cap_retransmit_all(chan, control);  in l2cap_rx_state_srej_sent()
5959 			l2cap_ertm_send(chan);  in l2cap_rx_state_srej_sent()
5962 					       &chan->conn_state) &&  in l2cap_rx_state_srej_sent()
5963 			    chan->unacked_frames) {  in l2cap_rx_state_srej_sent()
5964 				__set_retrans_timer(chan);  in l2cap_rx_state_srej_sent()
5967 			set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_rx_state_srej_sent()
5968 			l2cap_send_srej_tail(chan);  in l2cap_rx_state_srej_sent()
5971 					       &chan->conn_state) &&  in l2cap_rx_state_srej_sent()
5972 			    chan->unacked_frames)  in l2cap_rx_state_srej_sent()
5973 				__set_retrans_timer(chan);  in l2cap_rx_state_srej_sent()
5975 			l2cap_send_ack(chan);  in l2cap_rx_state_srej_sent()
5979 		set_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_rx_state_srej_sent()
5980 		l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
5982 			l2cap_send_srej_tail(chan);  in l2cap_rx_state_srej_sent()
5988 			rr_control.reqseq = chan->buffer_seq;  in l2cap_rx_state_srej_sent()
5989 			l2cap_send_sframe(chan, &rr_control);  in l2cap_rx_state_srej_sent()
5994 		l2cap_handle_rej(chan, control);  in l2cap_rx_state_srej_sent()
5997 		l2cap_handle_srej(chan, control);  in l2cap_rx_state_srej_sent()
6009 static int l2cap_finish_move(struct l2cap_chan *chan)  in l2cap_finish_move()  argument
6011 	BT_DBG("chan %p", chan);  in l2cap_finish_move()
6013 	chan->rx_state = L2CAP_RX_STATE_RECV;  in l2cap_finish_move()
6015 	if (chan->hs_hcon)  in l2cap_finish_move()
6016 		chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;  in l2cap_finish_move()
6018 		chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;  in l2cap_finish_move()
6020 	return l2cap_resegment(chan);  in l2cap_finish_move()
6023 static int l2cap_rx_state_wait_p(struct l2cap_chan *chan,  in l2cap_rx_state_wait_p()  argument
6029 	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,  in l2cap_rx_state_wait_p()
6035 	l2cap_process_reqseq(chan, control->reqseq);  in l2cap_rx_state_wait_p()
6037 	if (!skb_queue_empty(&chan->tx_q))  in l2cap_rx_state_wait_p()
6038 		chan->tx_send_head = skb_peek(&chan->tx_q);  in l2cap_rx_state_wait_p()
6040 		chan->tx_send_head = NULL;  in l2cap_rx_state_wait_p()
6045 	chan->next_tx_seq = control->reqseq;  in l2cap_rx_state_wait_p()
6046 	chan->unacked_frames = 0;  in l2cap_rx_state_wait_p()
6048 	err = l2cap_finish_move(chan);  in l2cap_rx_state_wait_p()
6052 	set_bit(CONN_SEND_FBIT, &chan->conn_state);  in l2cap_rx_state_wait_p()
6053 	l2cap_send_i_or_rr_or_rnr(chan);  in l2cap_rx_state_wait_p()
6058 	return l2cap_rx_state_recv(chan, control, NULL, event);  in l2cap_rx_state_wait_p()
6061 static int l2cap_rx_state_wait_f(struct l2cap_chan *chan,  in l2cap_rx_state_wait_f()  argument
6070 	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);  in l2cap_rx_state_wait_f()
6072 	chan->rx_state = L2CAP_RX_STATE_RECV;  in l2cap_rx_state_wait_f()
6073 	l2cap_process_reqseq(chan, control->reqseq);  in l2cap_rx_state_wait_f()
6075 	if (!skb_queue_empty(&chan->tx_q))  in l2cap_rx_state_wait_f()
6076 		chan->tx_send_head = skb_peek(&chan->tx_q);  in l2cap_rx_state_wait_f()
6078 		chan->tx_send_head = NULL;  in l2cap_rx_state_wait_f()
6083 	chan->next_tx_seq = control->reqseq;  in l2cap_rx_state_wait_f()
6084 	chan->unacked_frames = 0;  in l2cap_rx_state_wait_f()
6086 	if (chan->hs_hcon)  in l2cap_rx_state_wait_f()
6087 		chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;  in l2cap_rx_state_wait_f()
6089 		chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;  in l2cap_rx_state_wait_f()
6091 	err = l2cap_resegment(chan);  in l2cap_rx_state_wait_f()
6094 		err = l2cap_rx_state_recv(chan, control, skb, event);  in l2cap_rx_state_wait_f()
6099 static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq)  in __valid_reqseq()  argument
6104 	unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq);  in __valid_reqseq()
6105 	return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked;  in __valid_reqseq()
6108 static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,  in l2cap_rx()  argument
6113 	BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan,  in l2cap_rx()
6114 	       control, skb, event, chan->rx_state);  in l2cap_rx()
6116 	if (__valid_reqseq(chan, control->reqseq)) {  in l2cap_rx()
6117 		switch (chan->rx_state) {  in l2cap_rx()
6119 			err = l2cap_rx_state_recv(chan, control, skb, event);  in l2cap_rx()
6122 			err = l2cap_rx_state_srej_sent(chan, control, skb,  in l2cap_rx()
6126 			err = l2cap_rx_state_wait_p(chan, control, skb, event);  in l2cap_rx()
6129 			err = l2cap_rx_state_wait_f(chan, control, skb, event);  in l2cap_rx()
6137 		       control->reqseq, chan->next_tx_seq,  in l2cap_rx()
6138 		       chan->expected_ack_seq);  in l2cap_rx()
6139 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_rx()
6145 static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,  in l2cap_stream_rx()  argument
6150 	BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb,  in l2cap_stream_rx()
6151 	       chan->rx_state);  in l2cap_stream_rx()
6153 	if (l2cap_classify_txseq(chan, control->txseq) ==  in l2cap_stream_rx()
6155 		l2cap_pass_to_tx(chan, control);  in l2cap_stream_rx()
6157 		BT_DBG("buffer_seq %d->%d", chan->buffer_seq,  in l2cap_stream_rx()
6158 		       __next_seq(chan, chan->buffer_seq));  in l2cap_stream_rx()
6160 		chan->buffer_seq = __next_seq(chan, chan->buffer_seq);  in l2cap_stream_rx()
6162 		l2cap_reassemble_sdu(chan, skb, control);  in l2cap_stream_rx()
6164 		if (chan->sdu) {  in l2cap_stream_rx()
6165 			kfree_skb(chan->sdu);  in l2cap_stream_rx()
6166 			chan->sdu = NULL;  in l2cap_stream_rx()
6168 		chan->sdu_last_frag = NULL;  in l2cap_stream_rx()
6169 		chan->sdu_len = 0;  in l2cap_stream_rx()
6177 	chan->last_acked_seq = control->txseq;  in l2cap_stream_rx()
6178 	chan->expected_tx_seq = __next_seq(chan, control->txseq);  in l2cap_stream_rx()
6183 static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)  in l2cap_data_rcv()  argument
6189 	__unpack_control(chan, skb);  in l2cap_data_rcv()
6198 	if (l2cap_check_fcs(chan, skb))  in l2cap_data_rcv()
6204 	if (chan->fcs == L2CAP_FCS_CRC16)  in l2cap_data_rcv()
6207 	if (len > chan->mps) {  in l2cap_data_rcv()
6208 		l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_data_rcv()
6222 		if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F)  in l2cap_data_rcv()
6225 		if (chan->mode != L2CAP_MODE_STREAMING) {  in l2cap_data_rcv()
6227 			err = l2cap_rx(chan, control, skb, event);  in l2cap_data_rcv()
6229 			err = l2cap_stream_rx(chan, control, skb);  in l2cap_data_rcv()
6233 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_data_rcv()
6241 		if (chan->mode == L2CAP_MODE_STREAMING)  in l2cap_data_rcv()
6250 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_data_rcv()
6256 				       chan->tx_state != L2CAP_TX_STATE_WAIT_F))  in l2cap_data_rcv()
6260 		if (l2cap_rx(chan, control, skb, event))  in l2cap_data_rcv()
6261 			l2cap_send_disconn_req(chan, ECONNRESET);  in l2cap_data_rcv()
6274 	struct l2cap_chan *chan;  in l2cap_data_channel()  local
6276 	chan = l2cap_get_chan_by_scid(conn, cid);  in l2cap_data_channel()
6277 	if (!chan) {  in l2cap_data_channel()
6279 			chan = a2mp_channel_create(conn, skb);  in l2cap_data_channel()
6280 			if (!chan) {  in l2cap_data_channel()
6285 			l2cap_chan_lock(chan);  in l2cap_data_channel()
6294 	BT_DBG("chan %p, len %d", chan, skb->len);  in l2cap_data_channel()
6296 	if (chan->state != BT_CONNECTED)  in l2cap_data_channel()
6299 	switch (chan->mode) {  in l2cap_data_channel()
6306 		if (chan->imtu < skb->len)  in l2cap_data_channel()
6309 		if (!chan->ops->recv(chan, skb))  in l2cap_data_channel()
6315 		l2cap_data_rcv(chan, skb);  in l2cap_data_channel()
6319 		BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);  in l2cap_data_channel()
6327 	l2cap_chan_unlock(chan);  in l2cap_data_channel()
6333 	struct l2cap_chan *chan;  in l2cap_conless_channel()  local
6335 	chan = l2cap_global_chan_by_psm(0, psm, conn->src, conn->dst);  in l2cap_conless_channel()
6336 	if (!chan)  in l2cap_conless_channel()
6339 	BT_DBG("chan %p, len %d", chan, skb->len);  in l2cap_conless_channel()
6341 	if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)  in l2cap_conless_channel()
6344 	if (chan->imtu < skb->len)  in l2cap_conless_channel()
6347 	if (!chan->ops->recv(chan, skb))  in l2cap_conless_channel()
6357 	struct l2cap_chan *chan;  in l2cap_att_channel()  local
6359 	chan = l2cap_global_chan_by_scid(0, L2CAP_CID_LE_DATA,  in l2cap_att_channel()
6361 	if (!chan)  in l2cap_att_channel()
6364 	BT_DBG("chan %p, len %d", chan, skb->len);  in l2cap_att_channel()
6366 	if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)  in l2cap_att_channel()
6369 	if (chan->imtu < skb->len)  in l2cap_att_channel()
6372 	if (!chan->ops->recv(chan, skb))  in l2cap_att_channel()
6489 static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)  in l2cap_check_encryption()  argument
6491 	if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)  in l2cap_check_encryption()
6495 		if (chan->sec_level == BT_SECURITY_MEDIUM) {  in l2cap_check_encryption()
6496 			__set_chan_timer(chan, L2CAP_ENC_TIMEOUT);  in l2cap_check_encryption()
6497 		} else if (chan->sec_level == BT_SECURITY_HIGH)  in l2cap_check_encryption()
6498 			l2cap_chan_close(chan, ECONNREFUSED);  in l2cap_check_encryption()
6500 		if (chan->sec_level == BT_SECURITY_MEDIUM)  in l2cap_check_encryption()
6501 			__clear_chan_timer(chan);  in l2cap_check_encryption()
6508 	struct l2cap_chan *chan;  in l2cap_security_cfm()  local
6523 	list_for_each_entry(chan, &conn->chan_l, list) {  in l2cap_security_cfm()
6524 		l2cap_chan_lock(chan);  in l2cap_security_cfm()
6526 		BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid,  in l2cap_security_cfm()
6527 		       state_to_string(chan->state));  in l2cap_security_cfm()
6529 		if (chan->chan_type == L2CAP_CHAN_CONN_FIX_A2MP) {  in l2cap_security_cfm()
6530 			l2cap_chan_unlock(chan);  in l2cap_security_cfm()
6534 		if (chan->scid == L2CAP_CID_LE_DATA) {  in l2cap_security_cfm()
6536 				chan->sec_level = hcon->sec_level;  in l2cap_security_cfm()
6537 				l2cap_chan_ready(chan);  in l2cap_security_cfm()
6540 			l2cap_chan_unlock(chan);  in l2cap_security_cfm()
6544 		if (!__l2cap_no_conn_pending(chan)) {  in l2cap_security_cfm()
6545 			l2cap_chan_unlock(chan);  in l2cap_security_cfm()
6549 		if (!status && (chan->state == BT_CONNECTED ||  in l2cap_security_cfm()
6550 				chan->state == BT_CONFIG)) {  in l2cap_security_cfm()
6551 			struct sock *sk = chan->sk;  in l2cap_security_cfm()
6556 			l2cap_check_encryption(chan, encrypt);  in l2cap_security_cfm()
6557 			l2cap_chan_unlock(chan);  in l2cap_security_cfm()
6561 		if (chan->state == BT_CONNECT) {  in l2cap_security_cfm()
6563 				l2cap_start_connection(chan);  in l2cap_security_cfm()
6565 				__set_chan_timer(chan, L2CAP_DISC_TIMEOUT);  in l2cap_security_cfm()
6567 		} else if (chan->state == BT_CONNECT2) {  in l2cap_security_cfm()
6568 			struct sock *sk = chan->sk;  in l2cap_security_cfm()
6579 					chan->ops->defer(chan);  in l2cap_security_cfm()
6581 					__l2cap_state_change(chan, BT_CONFIG);  in l2cap_security_cfm()
6586 				__l2cap_state_change(chan, BT_DISCONN);  in l2cap_security_cfm()
6587 				__set_chan_timer(chan, L2CAP_DISC_TIMEOUT);  in l2cap_security_cfm()
6594 			rsp.scid   = cpu_to_le16(chan->dcid);  in l2cap_security_cfm()
6595 			rsp.dcid   = cpu_to_le16(chan->scid);  in l2cap_security_cfm()
6598 			l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,  in l2cap_security_cfm()
6601 			if (!test_bit(CONF_REQ_SENT, &chan->conf_state) &&  in l2cap_security_cfm()
6604 				set_bit(CONF_REQ_SENT, &chan->conf_state);  in l2cap_security_cfm()
6607 					       l2cap_build_conf_req(chan, buf),  in l2cap_security_cfm()
6609 				chan->num_conf_req++;  in l2cap_security_cfm()
6613 		l2cap_chan_unlock(chan);  in l2cap_security_cfm()