62 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
1018 static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control)  in __unpack_enhanced_control()  argument
1020 	control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;  in __unpack_enhanced_control()
1021 	control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT;  in __unpack_enhanced_control()
1025 		control->sframe = 1;  in __unpack_enhanced_control()
1026 		control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT;  in __unpack_enhanced_control()
1027 		control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;  in __unpack_enhanced_control()
1029 		control->sar = 0;  in __unpack_enhanced_control()
1030 		control->txseq = 0;  in __unpack_enhanced_control()
1033 		control->sframe = 0;  in __unpack_enhanced_control()
1034 		control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;  in __unpack_enhanced_control()
1035 		control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;  in __unpack_enhanced_control()
1037 		control->poll = 0;  in __unpack_enhanced_control()
1038 		control->super = 0;  in __unpack_enhanced_control()
1042 static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control)  in __unpack_extended_control()  argument
1044 	control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT;  in __unpack_extended_control()
1045 	control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT;  in __unpack_extended_control()
1049 		control->sframe = 1;  in __unpack_extended_control()
1050 		control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT;  in __unpack_extended_control()
1051 		control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT;  in __unpack_extended_control()
1053 		control->sar = 0;  in __unpack_extended_control()
1054 		control->txseq = 0;  in __unpack_extended_control()
1057 		control->sframe = 0;  in __unpack_extended_control()
1058 		control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;  in __unpack_extended_control()
1059 		control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT;  in __unpack_extended_control()
1061 		control->poll = 0;  in __unpack_extended_control()
1062 		control->super = 0;  in __unpack_extended_control()
1080 static u32 __pack_extended_control(struct l2cap_ctrl *control)  in __pack_extended_control()  argument
1084 	packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT;  in __pack_extended_control()
1085 	packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT;  in __pack_extended_control()
1087 	if (control->sframe) {  in __pack_extended_control()
1088 		packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT;  in __pack_extended_control()
1089 		packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT;  in __pack_extended_control()
1092 		packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT;  in __pack_extended_control()
1093 		packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT;  in __pack_extended_control()
1099 static u16 __pack_enhanced_control(struct l2cap_ctrl *control)  in __pack_enhanced_control()  argument
1103 	packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT;  in __pack_enhanced_control()
1104 	packed |= control->final << L2CAP_CTRL_FINAL_SHIFT;  in __pack_enhanced_control()
1106 	if (control->sframe) {  in __pack_enhanced_control()
1107 		packed |= control->poll << L2CAP_CTRL_POLL_SHIFT;  in __pack_enhanced_control()
1108 		packed |= control->super << L2CAP_CTRL_SUPER_SHIFT;  in __pack_enhanced_control()
1111 		packed |= control->sar << L2CAP_CTRL_SAR_SHIFT;  in __pack_enhanced_control()
1112 		packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT;  in __pack_enhanced_control()
1119 				  struct l2cap_ctrl *control,  in __pack_control()  argument
1123 		put_unaligned_le32(__pack_extended_control(control),  in __pack_control()
1126 		put_unaligned_le16(__pack_enhanced_control(control),  in __pack_control()
1140 					       u32 control)  in l2cap_create_sframe_pdu()  argument
1159 		put_unaligned_le32(control, skb_put(skb, L2CAP_EXT_CTRL_SIZE));  in l2cap_create_sframe_pdu()
1161 		put_unaligned_le16(control, skb_put(skb, L2CAP_ENH_CTRL_SIZE));  in l2cap_create_sframe_pdu()
1173 			      struct l2cap_ctrl *control)  in l2cap_send_sframe()  argument
1178 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_send_sframe()
1180 	if (!control->sframe)  in l2cap_send_sframe()
1187 	    !control->poll)  in l2cap_send_sframe()
1188 		control->final = 1;  in l2cap_send_sframe()
1190 	if (control->super == L2CAP_SUPER_RR)  in l2cap_send_sframe()
1192 	else if (control->super == L2CAP_SUPER_RNR)  in l2cap_send_sframe()
1195 	if (control->super != L2CAP_SUPER_SREJ) {  in l2cap_send_sframe()
1196 		chan->last_acked_seq = control->reqseq;  in l2cap_send_sframe()
1200 	BT_DBG("reqseq %d, final %d, poll %d, super %d", control->reqseq,  in l2cap_send_sframe()
1201 	       control->final, control->poll, control->super);  in l2cap_send_sframe()
1204 		control_field = __pack_extended_control(control);  in l2cap_send_sframe()
1206 		control_field = __pack_enhanced_control(control);  in l2cap_send_sframe()
1215 	struct l2cap_ctrl control;  in l2cap_send_rr_or_rnr()  local
1219 	memset(&control, 0, sizeof(control));  in l2cap_send_rr_or_rnr()
1220 	control.sframe = 1;  in l2cap_send_rr_or_rnr()
1221 	control.poll = poll;  in l2cap_send_rr_or_rnr()
1224 		control.super = L2CAP_SUPER_RNR;  in l2cap_send_rr_or_rnr()
1226 		control.super = L2CAP_SUPER_RR;  in l2cap_send_rr_or_rnr()
1228 	control.reqseq = chan->buffer_seq;  in l2cap_send_rr_or_rnr()
1229 	l2cap_send_sframe(chan, &control);  in l2cap_send_rr_or_rnr()
2067 	struct l2cap_ctrl *control;  in l2cap_streaming_send()  local
2081 		control = &bt_cb(skb)->l2cap;  in l2cap_streaming_send()
2083 		control->reqseq = 0;  in l2cap_streaming_send()
2084 		control->txseq = chan->next_tx_seq;  in l2cap_streaming_send()
2086 		__pack_control(chan, control, skb);  in l2cap_streaming_send()
2095 		BT_DBG("Sent txseq %u", control->txseq);  in l2cap_streaming_send()
2105 	struct l2cap_ctrl *control;  in l2cap_ertm_send()  local
2126 		control = &bt_cb(skb)->l2cap;  in l2cap_ertm_send()
2129 			control->final = 1;  in l2cap_ertm_send()
2131 		control->reqseq = chan->buffer_seq;  in l2cap_ertm_send()
2133 		control->txseq = chan->next_tx_seq;  in l2cap_ertm_send()
2135 		__pack_control(chan, control, skb);  in l2cap_ertm_send()
2163 		BT_DBG("Sent txseq %u", control->txseq);  in l2cap_ertm_send()
2174 	struct l2cap_ctrl control;  in l2cap_ertm_resend()  local
2198 		control = bt_cb(skb)->l2cap;  in l2cap_ertm_resend()
2208 		control.reqseq = chan->buffer_seq;  in l2cap_ertm_resend()
2210 			control.final = 1;  in l2cap_ertm_resend()
2212 			control.final = 0;  in l2cap_ertm_resend()
2230 			put_unaligned_le32(__pack_extended_control(&control),  in l2cap_ertm_resend()
2233 			put_unaligned_le16(__pack_enhanced_control(&control),  in l2cap_ertm_resend()
2247 		BT_DBG("Resent txseq %d", control.txseq);  in l2cap_ertm_resend()
2254 			     struct l2cap_ctrl *control)  in l2cap_retransmit()  argument
2256 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_retransmit()
2258 	l2cap_seq_list_append(&chan->retrans_list, control->reqseq);  in l2cap_retransmit()
2263 				 struct l2cap_ctrl *control)  in l2cap_retransmit_all()  argument
2267 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_retransmit_all()
2269 	if (control->poll)  in l2cap_retransmit_all()
2279 			if (bt_cb(skb)->l2cap.txseq == control->reqseq ||  in l2cap_retransmit_all()
2298 	struct l2cap_ctrl control;  in l2cap_send_ack()  local
2306 	memset(&control, 0, sizeof(control));  in l2cap_send_ack()
2307 	control.sframe = 1;  in l2cap_send_ack()
2312 		control.super = L2CAP_SUPER_RNR;  in l2cap_send_ack()
2313 		control.reqseq = chan->buffer_seq;  in l2cap_send_ack()
2314 		l2cap_send_sframe(chan, &control);  in l2cap_send_ack()
2335 			control.super = L2CAP_SUPER_RR;  in l2cap_send_ack()
2336 			control.reqseq = chan->buffer_seq;  in l2cap_send_ack()
2337 			l2cap_send_sframe(chan, &control);  in l2cap_send_ack()
2774 	struct l2cap_ctrl control;  in l2cap_send_srej()  local
2779 	memset(&control, 0, sizeof(control));  in l2cap_send_srej()
2780 	control.sframe = 1;  in l2cap_send_srej()
2781 	control.super = L2CAP_SUPER_SREJ;  in l2cap_send_srej()
2786 			control.reqseq = seq;  in l2cap_send_srej()
2787 			l2cap_send_sframe(chan, &control);  in l2cap_send_srej()
2797 	struct l2cap_ctrl control;  in l2cap_send_srej_tail()  local
2804 	memset(&control, 0, sizeof(control));  in l2cap_send_srej_tail()
2805 	control.sframe = 1;  in l2cap_send_srej_tail()
2806 	control.super = L2CAP_SUPER_SREJ;  in l2cap_send_srej_tail()
2807 	control.reqseq = chan->srej_list.tail;  in l2cap_send_srej_tail()
2808 	l2cap_send_sframe(chan, &control);  in l2cap_send_srej_tail()
2813 	struct l2cap_ctrl control;  in l2cap_send_srej_list()  local
2819 	memset(&control, 0, sizeof(control));  in l2cap_send_srej_list()
2820 	control.sframe = 1;  in l2cap_send_srej_list()
2821 	control.super = L2CAP_SUPER_SREJ;  in l2cap_send_srej_list()
2831 		control.reqseq = seq;  in l2cap_send_srej_list()
2832 		l2cap_send_sframe(chan, &control);  in l2cap_send_srej_list()
2880 				struct l2cap_ctrl *control,  in l2cap_tx_state_xmit()  argument
2883 	BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,  in l2cap_tx_state_xmit()
2928 		l2cap_process_reqseq(chan, control->reqseq);  in l2cap_tx_state_xmit()
2952 				  struct l2cap_ctrl *control,  in l2cap_tx_state_wait_f()  argument
2955 	BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,  in l2cap_tx_state_wait_f()
2998 		l2cap_process_reqseq(chan, control->reqseq);  in l2cap_tx_state_wait_f()
3002 		if (control && control->final) {  in l2cap_tx_state_wait_f()
3028 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,  in l2cap_tx()  argument
3032 	       chan, control, skbs, event, chan->tx_state);  in l2cap_tx()
3036 		l2cap_tx_state_xmit(chan, control, skbs, event);  in l2cap_tx()
3039 		l2cap_tx_state_wait_f(chan, control, skbs, event);  in l2cap_tx()
3048 			     struct l2cap_ctrl *control)  in l2cap_pass_to_tx()  argument
3050 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_pass_to_tx()
3051 	l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT);  in l2cap_pass_to_tx()
3055 				  struct l2cap_ctrl *control)  in l2cap_pass_to_tx_fbit()  argument
3057 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_pass_to_tx_fbit()
3058 	l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT);  in l2cap_pass_to_tx_fbit()
6581 	struct l2cap_ctrl control;  in l2cap_send_i_or_rr_or_rnr()  local
6585 	memset(&control, 0, sizeof(control));  in l2cap_send_i_or_rr_or_rnr()
6586 	control.sframe = 1;  in l2cap_send_i_or_rr_or_rnr()
6587 	control.final = 1;  in l2cap_send_i_or_rr_or_rnr()
6588 	control.reqseq = chan->buffer_seq;  in l2cap_send_i_or_rr_or_rnr()
6592 		control.super = L2CAP_SUPER_RNR;  in l2cap_send_i_or_rr_or_rnr()
6593 		l2cap_send_sframe(chan, &control);  in l2cap_send_i_or_rr_or_rnr()
6608 		control.super = L2CAP_SUPER_RR;  in l2cap_send_i_or_rr_or_rnr()
6609 		l2cap_send_sframe(chan, &control);  in l2cap_send_i_or_rr_or_rnr()
6633 				struct l2cap_ctrl *control)  in l2cap_reassemble_sdu()  argument
6637 	switch (control->sar) {  in l2cap_reassemble_sdu()
6769 			      struct l2cap_ctrl *control)  in l2cap_handle_srej()  argument
6773 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_handle_srej()
6775 	if (control->reqseq == chan->next_tx_seq) {  in l2cap_handle_srej()
6776 		BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);  in l2cap_handle_srej()
6781 	skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);  in l2cap_handle_srej()
6785 		       control->reqseq);  in l2cap_handle_srej()
6797 	if (control->poll) {  in l2cap_handle_srej()
6798 		l2cap_pass_to_tx(chan, control);  in l2cap_handle_srej()
6801 		l2cap_retransmit(chan, control);  in l2cap_handle_srej()
6806 			chan->srej_save_reqseq = control->reqseq;  in l2cap_handle_srej()
6809 		l2cap_pass_to_tx_fbit(chan, control);  in l2cap_handle_srej()
6811 		if (control->final) {  in l2cap_handle_srej()
6812 			if (chan->srej_save_reqseq != control->reqseq ||  in l2cap_handle_srej()
6815 				l2cap_retransmit(chan, control);  in l2cap_handle_srej()
6817 			l2cap_retransmit(chan, control);  in l2cap_handle_srej()
6820 				chan->srej_save_reqseq = control->reqseq;  in l2cap_handle_srej()
6827 			     struct l2cap_ctrl *control)  in l2cap_handle_rej()  argument
6831 	BT_DBG("chan %p, control %p", chan, control);  in l2cap_handle_rej()
6833 	if (control->reqseq == chan->next_tx_seq) {  in l2cap_handle_rej()
6834 		BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);  in l2cap_handle_rej()
6839 	skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);  in l2cap_handle_rej()
6850 	l2cap_pass_to_tx(chan, control);  in l2cap_handle_rej()
6852 	if (control->final) {  in l2cap_handle_rej()
6854 			l2cap_retransmit_all(chan, control);  in l2cap_handle_rej()
6856 		l2cap_retransmit_all(chan, control);  in l2cap_handle_rej()
6950 			       struct l2cap_ctrl *control,  in l2cap_rx_state_recv()  argument
6957 	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,  in l2cap_rx_state_recv()
6962 		switch (l2cap_classify_txseq(chan, control->txseq)) {  in l2cap_rx_state_recv()
6964 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
6968 				       control->txseq);  in l2cap_rx_state_recv()
6973 							   control->txseq);  in l2cap_rx_state_recv()
6994 			local_control = *control;  in l2cap_rx_state_recv()
6995 			err = l2cap_reassemble_sdu(chan, skb, control);  in l2cap_rx_state_recv()
7012 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
7020 				       control->txseq);  in l2cap_rx_state_recv()
7035 			l2cap_send_srej(chan, control->txseq);  in l2cap_rx_state_recv()
7040 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
7051 		l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
7052 		if (control->final) {  in l2cap_rx_state_recv()
7057 				control->final = 0;  in l2cap_rx_state_recv()
7058 				l2cap_retransmit_all(chan, control);  in l2cap_rx_state_recv()
7062 		} else if (control->poll) {  in l2cap_rx_state_recv()
7075 		l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_recv()
7076 		if (control && control->poll) {  in l2cap_rx_state_recv()
7084 		l2cap_handle_rej(chan, control);  in l2cap_rx_state_recv()
7087 		l2cap_handle_srej(chan, control);  in l2cap_rx_state_recv()
7102 				    struct l2cap_ctrl *control,  in l2cap_rx_state_srej_sent()  argument
7106 	u16 txseq = control->txseq;  in l2cap_rx_state_srej_sent()
7109 	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,  in l2cap_rx_state_srej_sent()
7117 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
7128 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
7149 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
7150 			l2cap_send_srej(chan, control->txseq);  in l2cap_rx_state_srej_sent()
7163 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
7164 			l2cap_send_srej_list(chan, control->txseq);  in l2cap_rx_state_srej_sent()
7168 			l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
7184 		l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
7185 		if (control->final) {  in l2cap_rx_state_srej_sent()
7190 				control->final = 0;  in l2cap_rx_state_srej_sent()
7191 				l2cap_retransmit_all(chan, control);  in l2cap_rx_state_srej_sent()
7195 		} else if (control->poll) {  in l2cap_rx_state_srej_sent()
7215 		l2cap_pass_to_tx(chan, control);  in l2cap_rx_state_srej_sent()
7216 		if (control->poll) {  in l2cap_rx_state_srej_sent()
7229 		l2cap_handle_rej(chan, control);  in l2cap_rx_state_srej_sent()
7232 		l2cap_handle_srej(chan, control);  in l2cap_rx_state_srej_sent()
7259 				 struct l2cap_ctrl *control,  in l2cap_rx_state_wait_p()  argument
7264 	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,  in l2cap_rx_state_wait_p()
7267 	if (!control->poll)  in l2cap_rx_state_wait_p()
7270 	l2cap_process_reqseq(chan, control->reqseq);  in l2cap_rx_state_wait_p()
7280 	chan->next_tx_seq = control->reqseq;  in l2cap_rx_state_wait_p()
7293 	return l2cap_rx_state_recv(chan, control, NULL, event);  in l2cap_rx_state_wait_p()
7297 				 struct l2cap_ctrl *control,  in l2cap_rx_state_wait_f()  argument
7302 	if (!control->final)  in l2cap_rx_state_wait_f()
7308 	l2cap_process_reqseq(chan, control->reqseq);  in l2cap_rx_state_wait_f()
7318 	chan->next_tx_seq = control->reqseq;  in l2cap_rx_state_wait_f()
7329 		err = l2cap_rx_state_recv(chan, control, skb, event);  in l2cap_rx_state_wait_f()
7343 static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,  in l2cap_rx()  argument
7349 	       control, skb, event, chan->rx_state);  in l2cap_rx()
7351 	if (__valid_reqseq(chan, control->reqseq)) {  in l2cap_rx()
7354 			err = l2cap_rx_state_recv(chan, control, skb, event);  in l2cap_rx()
7357 			err = l2cap_rx_state_srej_sent(chan, control, skb,  in l2cap_rx()
7361 			err = l2cap_rx_state_wait_p(chan, control, skb, event);  in l2cap_rx()
7364 			err = l2cap_rx_state_wait_f(chan, control, skb, event);  in l2cap_rx()
7372 		       control->reqseq, chan->next_tx_seq,  in l2cap_rx()
7380 static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,  in l2cap_stream_rx()  argument
7398 	u16 txseq = control->txseq;  in l2cap_stream_rx()
7400 	BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb,  in l2cap_stream_rx()
7404 		l2cap_pass_to_tx(chan, control);  in l2cap_stream_rx()
7411 		l2cap_reassemble_sdu(chan, skb, control);  in l2cap_stream_rx()
7434 	struct l2cap_ctrl *control = &bt_cb(skb)->l2cap;  in l2cap_data_rcv()  local
7450 	if (!control->sframe && control->sar == L2CAP_SAR_START)  in l2cap_data_rcv()
7466 	if (!control->sframe) {  in l2cap_data_rcv()
7470 		       control->sar, control->reqseq, control->final,  in l2cap_data_rcv()
7471 		       control->txseq);  in l2cap_data_rcv()
7476 		if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F)  in l2cap_data_rcv()
7481 			err = l2cap_rx(chan, control, skb, event);  in l2cap_data_rcv()
7483 			err = l2cap_stream_rx(chan, control, skb);  in l2cap_data_rcv()
7499 		       control->reqseq, control->final, control->poll,  in l2cap_data_rcv()
7500 		       control->super);  in l2cap_data_rcv()
7509 		if (control->final && (control->poll ||  in l2cap_data_rcv()
7513 		event = rx_func_to_event[control->super];  in l2cap_data_rcv()
7514 		if (l2cap_rx(chan, control, skb, event))  in l2cap_data_rcv()