[deliverable/linux.git] / net / bluetooth / a2mp.c

/*
   Copyright (c) 2010,2011 Code Aurora Forum.  All rights reserved.
   Copyright (c) 2011,2012 Intel Corp.

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License version 2 and
   only version 2 as published by the Free Software Foundation.

   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.
*/

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>
#include <net/bluetooth/l2cap.h>
#include <net/bluetooth/a2mp.h>

/* A2MP build & send command helper functions */
static struct a2mp_cmd *__a2mp_build(u8 code, u8 ident, u16 len, void *data)
{
	struct a2mp_cmd *cmd;
	int plen;

	plen = sizeof(*cmd) + len;
	cmd = kzalloc(plen, GFP_KERNEL);
	if (!cmd)
		return NULL;

	cmd->code = code;
	cmd->ident = ident;
	cmd->len = cpu_to_le16(len);

	memcpy(cmd->data, data, len);

	return cmd;
}

static void a2mp_send(struct amp_mgr *mgr, u8 code, u8 ident, u16 len,
		      void *data)
{
	struct l2cap_chan *chan = mgr->a2mp_chan;
	struct a2mp_cmd *cmd;
	u16 total_len = len + sizeof(*cmd);
	struct kvec iv;
	struct msghdr msg;

	cmd = __a2mp_build(code, ident, len, data);
	if (!cmd)
		return;

	iv.iov_base = cmd;
	iv.iov_len = total_len;

	memset(&msg, 0, sizeof(msg));

	msg.msg_iov = (struct iovec *) &iv;
	msg.msg_iovlen = 1;

	l2cap_chan_send(chan, &msg, total_len, 0);

	kfree(cmd);
}

static inline void __a2mp_cl_bredr(struct a2mp_cl *cl)
{
	cl->id = 0;
	cl->type = 0;
	cl->status = 1;
}

/* hci_dev_list shall be locked */
static void __a2mp_add_cl(struct amp_mgr *mgr, struct a2mp_cl *cl, u8 num_ctrl)
{
	int i = 0;
	struct hci_dev *hdev;

	__a2mp_cl_bredr(cl);

	list_for_each_entry(hdev, &hci_dev_list, list) {
		/* Iterate through AMP controllers */
		if (hdev->id == HCI_BREDR_ID)
			continue;

		/* Starting from second entry */
		if (++i >= num_ctrl)
			return;

		cl[i].id = hdev->id;
		cl[i].type = hdev->amp_type;
		cl[i].status = hdev->amp_status;
	}
}

/* Processing A2MP messages */
static int a2mp_command_rej(struct amp_mgr *mgr, struct sk_buff *skb,
			    struct a2mp_cmd *hdr)
{
	struct a2mp_cmd_rej *rej = (void *) skb->data;

	if (le16_to_cpu(hdr->len) < sizeof(*rej))
		return -EINVAL;

	BT_DBG("ident %d reason %d", hdr->ident, le16_to_cpu(rej->reason));

	skb_pull(skb, sizeof(*rej));

	return 0;
}

static int a2mp_discover_req(struct amp_mgr *mgr, struct sk_buff *skb,
			     struct a2mp_cmd *hdr)
{
	struct a2mp_discov_req *req = (void *) skb->data;
	u16 len = le16_to_cpu(hdr->len);
	struct a2mp_discov_rsp *rsp;
	u16 ext_feat;
	u8 num_ctrl;

	if (len < sizeof(*req))
		return -EINVAL;

	skb_pull(skb, sizeof(*req));

	ext_feat = le16_to_cpu(req->ext_feat);

	BT_DBG("mtu %d efm 0x%4.4x", le16_to_cpu(req->mtu), ext_feat);

	/* check that packet is not broken for now */
	while (ext_feat & A2MP_FEAT_EXT) {
		if (len < sizeof(ext_feat))
			return -EINVAL;

		ext_feat = get_unaligned_le16(skb->data);
		BT_DBG("efm 0x%4.4x", ext_feat);
		len -= sizeof(ext_feat);
		skb_pull(skb, sizeof(ext_feat));
	}

	read_lock(&hci_dev_list_lock);

	num_ctrl = __hci_num_ctrl();
	len = num_ctrl * sizeof(struct a2mp_cl) + sizeof(*rsp);
	rsp = kmalloc(len, GFP_ATOMIC);
	if (!rsp) {
		read_unlock(&hci_dev_list_lock);
		return -ENOMEM;
	}

	rsp->mtu = __constant_cpu_to_le16(L2CAP_A2MP_DEFAULT_MTU);
	rsp->ext_feat = 0;

	__a2mp_add_cl(mgr, rsp->cl, num_ctrl);

	read_unlock(&hci_dev_list_lock);

	a2mp_send(mgr, A2MP_DISCOVER_RSP, hdr->ident, len, rsp);

	kfree(rsp);
	return 0;
}

static int a2mp_change_notify(struct amp_mgr *mgr, struct sk_buff *skb,
			      struct a2mp_cmd *hdr)
{
	struct a2mp_cl *cl = (void *) skb->data;

	while (skb->len >= sizeof(*cl)) {
		BT_DBG("Controller id %d type %d status %d", cl->id, cl->type,
		       cl->status);
		cl = (struct a2mp_cl *) skb_pull(skb, sizeof(*cl));
	}

	/* TODO send A2MP_CHANGE_RSP */

	return 0;
}

/* Handle A2MP signalling */
static int a2mp_chan_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
{
	struct a2mp_cmd *hdr = (void *) skb->data;
	struct amp_mgr *mgr = chan->data;
	int err = 0;

	amp_mgr_get(mgr);

	while (skb->len >= sizeof(*hdr)) {
		struct a2mp_cmd *hdr = (void *) skb->data;
		u16 len = le16_to_cpu(hdr->len);

		BT_DBG("code 0x%02x id %d len %d", hdr->code, hdr->ident, len);

		skb_pull(skb, sizeof(*hdr));

		if (len > skb->len || !hdr->ident) {
			err = -EINVAL;
			break;
		}

		mgr->ident = hdr->ident;

		switch (hdr->code) {
		case A2MP_COMMAND_REJ:
			a2mp_command_rej(mgr, skb, hdr);
			break;

		case A2MP_DISCOVER_REQ:
			err = a2mp_discover_req(mgr, skb, hdr);
			break;

		case A2MP_CHANGE_NOTIFY:
			err = a2mp_change_notify(mgr, skb, hdr);
			break;

		case A2MP_GETINFO_REQ:
		case A2MP_GETAMPASSOC_REQ:
		case A2MP_CREATEPHYSLINK_REQ:
		case A2MP_DISCONNPHYSLINK_REQ:
		case A2MP_CHANGE_RSP:
		case A2MP_DISCOVER_RSP:
		case A2MP_GETINFO_RSP:
		case A2MP_GETAMPASSOC_RSP:
		case A2MP_CREATEPHYSLINK_RSP:
		case A2MP_DISCONNPHYSLINK_RSP:
		default:
			BT_ERR("Unknown A2MP sig cmd 0x%2.2x", hdr->code);
			err = -EINVAL;
			break;
		}
	}

	if (err) {
		struct a2mp_cmd_rej rej;
		rej.reason = __constant_cpu_to_le16(0);

		BT_DBG("Send A2MP Rej: cmd 0x%2.2x err %d", hdr->code, err);

		a2mp_send(mgr, A2MP_COMMAND_REJ, hdr->ident, sizeof(rej),
			  &rej);
	}

	/* Always free skb and return success error code to prevent
	   from sending L2CAP Disconnect over A2MP channel */
	kfree_skb(skb);

	amp_mgr_put(mgr);

	return 0;
}

static void a2mp_chan_close_cb(struct l2cap_chan *chan)
{
	l2cap_chan_destroy(chan);
}

static void a2mp_chan_state_change_cb(struct l2cap_chan *chan, int state)
{
	struct amp_mgr *mgr = chan->data;

	if (!mgr)
		return;

	BT_DBG("chan %p state %s", chan, state_to_string(state));

	chan->state = state;

	switch (state) {
	case BT_CLOSED:
		if (mgr)
			amp_mgr_put(mgr);
		break;
	}
}

static struct sk_buff *a2mp_chan_alloc_skb_cb(struct l2cap_chan *chan,
					      unsigned long len, int nb)
{
	return bt_skb_alloc(len, GFP_KERNEL);
}

static struct l2cap_chan *a2mp_chan_no_new_conn_cb(struct l2cap_chan *chan)
{
	BT_ERR("new_connection for chan %p not implemented", chan);

	return NULL;
}

static void a2mp_chan_no_teardown_cb(struct l2cap_chan *chan, int err)
{
	BT_ERR("teardown for chan %p not implemented", chan);
}

static void a2mp_chan_no_ready(struct l2cap_chan *chan)
{
	BT_ERR("ready for chan %p not implemented", chan);
}

static struct l2cap_ops a2mp_chan_ops = {
	.name = "L2CAP A2MP channel",
	.recv = a2mp_chan_recv_cb,
	.close = a2mp_chan_close_cb,
	.state_change = a2mp_chan_state_change_cb,
	.alloc_skb = a2mp_chan_alloc_skb_cb,

	/* Not implemented for A2MP */
	.new_connection = a2mp_chan_no_new_conn_cb,
	.teardown = a2mp_chan_no_teardown_cb,
	.ready = a2mp_chan_no_ready,
};

static struct l2cap_chan *a2mp_chan_open(struct l2cap_conn *conn)
{
	struct l2cap_chan *chan;
	int err;

	chan = l2cap_chan_create();
	if (!chan)
		return NULL;

	BT_DBG("chan %p", chan);

	hci_conn_hold(conn->hcon);

	chan->omtu = L2CAP_A2MP_DEFAULT_MTU;
	chan->imtu = L2CAP_A2MP_DEFAULT_MTU;
	chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;

	chan->ops = &a2mp_chan_ops;

	l2cap_chan_set_defaults(chan);
	chan->remote_max_tx = chan->max_tx;
	chan->remote_tx_win = chan->tx_win;

	chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;
	chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;

	skb_queue_head_init(&chan->tx_q);

	chan->mode = L2CAP_MODE_ERTM;

	err = l2cap_ertm_init(chan);
	if (err < 0) {
		l2cap_chan_del(chan, 0);
		return NULL;
	}

	chan->conf_state = 0;

	l2cap_chan_add(conn, chan);

	chan->remote_mps = chan->omtu;
	chan->mps = chan->omtu;

	chan->state = BT_CONNECTED;

	return chan;
}

/* AMP Manager functions */
void amp_mgr_get(struct amp_mgr *mgr)
{
	BT_DBG("mgr %p", mgr);

	kref_get(&mgr->kref);
}

static void amp_mgr_destroy(struct kref *kref)
{
	struct amp_mgr *mgr = container_of(kref, struct amp_mgr, kref);

	BT_DBG("mgr %p", mgr);

	kfree(mgr);
}

int amp_mgr_put(struct amp_mgr *mgr)
{
	BT_DBG("mgr %p", mgr);

	return kref_put(&mgr->kref, &amp_mgr_destroy);
}

static struct amp_mgr *amp_mgr_create(struct l2cap_conn *conn)
{
	struct amp_mgr *mgr;
	struct l2cap_chan *chan;

	mgr = kzalloc(sizeof(*mgr), GFP_KERNEL);
	if (!mgr)
		return NULL;

	BT_DBG("conn %p mgr %p", conn, mgr);

	mgr->l2cap_conn = conn;

	chan = a2mp_chan_open(conn);
	if (!chan) {
		kfree(mgr);
		return NULL;
	}

	mgr->a2mp_chan = chan;
	chan->data = mgr;

	conn->hcon->amp_mgr = mgr;

	kref_init(&mgr->kref);

	return mgr;
}
Commit	Line	Data
466f8004 AE	1	/*
	2	Copyright (c) 2010,2011 Code Aurora Forum. All rights reserved.
	3	Copyright (c) 2011,2012 Intel Corp.
	4
	5	This program is free software; you can redistribute it and/or modify
	6	it under the terms of the GNU General Public License version 2 and
	7	only version 2 as published by the Free Software Foundation.
	8
	9	This program is distributed in the hope that it will be useful,
	10	but WITHOUT ANY WARRANTY; without even the implied warranty of
	11	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	12	GNU General Public License for more details.
	13	*/
	14
	15	#include <net/bluetooth/bluetooth.h>
	16	#include <net/bluetooth/hci_core.h>
	17	#include <net/bluetooth/l2cap.h>
9740e49d	18	#include <net/bluetooth/a2mp.h>
466f8004	19
f6d3c6e7 AE	20	/* A2MP build & send command helper functions */
	21	static struct a2mp_cmd __a2mp_build(u8 code, u8 ident, u16 len, void data)
	22	{
	23	struct a2mp_cmd *cmd;
	24	int plen;
	25
	26	plen = sizeof(*cmd) + len;
	27	cmd = kzalloc(plen, GFP_KERNEL);
	28	if (!cmd)
	29	return NULL;
	30
	31	cmd->code = code;
	32	cmd->ident = ident;
	33	cmd->len = cpu_to_le16(len);
	34
	35	memcpy(cmd->data, data, len);
	36
	37	return cmd;
	38	}
	39
	40	static void a2mp_send(struct amp_mgr *mgr, u8 code, u8 ident, u16 len,
	41	void *data)
	42	{
	43	struct l2cap_chan *chan = mgr->a2mp_chan;
	44	struct a2mp_cmd *cmd;
	45	u16 total_len = len + sizeof(*cmd);
	46	struct kvec iv;
	47	struct msghdr msg;
	48
	49	cmd = __a2mp_build(code, ident, len, data);
	50	if (!cmd)
	51	return;
	52
	53	iv.iov_base = cmd;
	54	iv.iov_len = total_len;
	55
	56	memset(&msg, 0, sizeof(msg));
	57
	58	msg.msg_iov = (struct iovec *) &iv;
	59	msg.msg_iovlen = 1;
	60
	61	l2cap_chan_send(chan, &msg, total_len, 0);
	62
	63	kfree(cmd);
	64	}
	65
8598d064 AE	66	static inline void __a2mp_cl_bredr(struct a2mp_cl *cl)
	67	{
	68	cl->id = 0;
	69	cl->type = 0;
	70	cl->status = 1;
	71	}
	72
	73	/* hci_dev_list shall be locked */
	74	static void __a2mp_add_cl(struct amp_mgr mgr, struct a2mp_cl cl, u8 num_ctrl)
	75	{
	76	int i = 0;
	77	struct hci_dev *hdev;
	78
	79	__a2mp_cl_bredr(cl);
	80
	81	list_for_each_entry(hdev, &hci_dev_list, list) {
	82	/* Iterate through AMP controllers */
	83	if (hdev->id == HCI_BREDR_ID)
	84	continue;
	85
	86	/* Starting from second entry */
	87	if (++i >= num_ctrl)
	88	return;
	89
	90	cl[i].id = hdev->id;
	91	cl[i].type = hdev->amp_type;
	92	cl[i].status = hdev->amp_status;
	93	}
	94	}
	95
21dbd2ce AE	96	/* Processing A2MP messages */
	97	static int a2mp_command_rej(struct amp_mgr mgr, struct sk_buff skb,
	98	struct a2mp_cmd *hdr)
	99	{
	100	struct a2mp_cmd_rej rej = (void ) skb->data;
	101
	102	if (le16_to_cpu(hdr->len) < sizeof(*rej))
	103	return -EINVAL;
	104
	105	BT_DBG("ident %d reason %d", hdr->ident, le16_to_cpu(rej->reason));
	106
	107	skb_pull(skb, sizeof(*rej));
	108
	109	return 0;
	110	}
	111
8598d064 AE	112	static int a2mp_discover_req(struct amp_mgr mgr, struct sk_buff skb,
	113	struct a2mp_cmd *hdr)
	114	{
	115	struct a2mp_discov_req req = (void ) skb->data;
	116	u16 len = le16_to_cpu(hdr->len);
	117	struct a2mp_discov_rsp *rsp;
	118	u16 ext_feat;
	119	u8 num_ctrl;
	120
	121	if (len < sizeof(*req))
	122	return -EINVAL;
	123
	124	skb_pull(skb, sizeof(*req));
	125
	126	ext_feat = le16_to_cpu(req->ext_feat);
	127
	128	BT_DBG("mtu %d efm 0x%4.4x", le16_to_cpu(req->mtu), ext_feat);
	129
	130	/* check that packet is not broken for now */
	131	while (ext_feat & A2MP_FEAT_EXT) {
	132	if (len < sizeof(ext_feat))
	133	return -EINVAL;
	134
	135	ext_feat = get_unaligned_le16(skb->data);
	136	BT_DBG("efm 0x%4.4x", ext_feat);
	137	len -= sizeof(ext_feat);
	138	skb_pull(skb, sizeof(ext_feat));
	139	}
	140
	141	read_lock(&hci_dev_list_lock);
	142
	143	num_ctrl = __hci_num_ctrl();
	144	len = num_ctrl * sizeof(struct a2mp_cl) + sizeof(*rsp);
	145	rsp = kmalloc(len, GFP_ATOMIC);
	146	if (!rsp) {
	147	read_unlock(&hci_dev_list_lock);
	148	return -ENOMEM;
	149	}
	150
	151	rsp->mtu = __constant_cpu_to_le16(L2CAP_A2MP_DEFAULT_MTU);
	152	rsp->ext_feat = 0;
	153
	154	__a2mp_add_cl(mgr, rsp->cl, num_ctrl);
	155
	156	read_unlock(&hci_dev_list_lock);
	157
	158	a2mp_send(mgr, A2MP_DISCOVER_RSP, hdr->ident, len, rsp);
	159
	160	kfree(rsp);
	161	return 0;
	162	}
	163
329d81af AE	164	static int a2mp_change_notify(struct amp_mgr mgr, struct sk_buff skb,
	165	struct a2mp_cmd *hdr)
	166	{
	167	struct a2mp_cl cl = (void ) skb->data;
	168
	169	while (skb->len >= sizeof(*cl)) {
	170	BT_DBG("Controller id %d type %d status %d", cl->id, cl->type,
	171	cl->status);
	172	cl = (struct a2mp_cl ) skb_pull(skb, sizeof(cl));
	173	}
	174
	175	/* TODO send A2MP_CHANGE_RSP */
	176
	177	return 0;
	178	}
	179
6b44d9b8 AE	180	/* Handle A2MP signalling */
	181	static int a2mp_chan_recv_cb(struct l2cap_chan chan, struct sk_buff skb)
	182	{
	183	struct a2mp_cmd hdr = (void ) skb->data;
	184	struct amp_mgr *mgr = chan->data;
	185	int err = 0;
	186
	187	amp_mgr_get(mgr);
	188
	189	while (skb->len >= sizeof(*hdr)) {
	190	struct a2mp_cmd hdr = (void ) skb->data;
	191	u16 len = le16_to_cpu(hdr->len);
	192
	193	BT_DBG("code 0x%02x id %d len %d", hdr->code, hdr->ident, len);
	194
	195	skb_pull(skb, sizeof(*hdr));
	196
	197	if (len > skb->len \|\| !hdr->ident) {
	198	err = -EINVAL;
	199	break;
	200	}
	201
	202	mgr->ident = hdr->ident;
	203
	204	switch (hdr->code) {
	205	case A2MP_COMMAND_REJ:
21dbd2ce AE	206	a2mp_command_rej(mgr, skb, hdr);
	207	break;
	208
6b44d9b8	209	case A2MP_DISCOVER_REQ:
8598d064 AE	210	err = a2mp_discover_req(mgr, skb, hdr);
	211	break;
	212
6b44d9b8	213	case A2MP_CHANGE_NOTIFY:
329d81af AE	214	err = a2mp_change_notify(mgr, skb, hdr);
	215	break;
	216
6b44d9b8 AE	217	case A2MP_GETINFO_REQ:
	218	case A2MP_GETAMPASSOC_REQ:
	219	case A2MP_CREATEPHYSLINK_REQ:
	220	case A2MP_DISCONNPHYSLINK_REQ:
	221	case A2MP_CHANGE_RSP:
	222	case A2MP_DISCOVER_RSP:
	223	case A2MP_GETINFO_RSP:
	224	case A2MP_GETAMPASSOC_RSP:
	225	case A2MP_CREATEPHYSLINK_RSP:
	226	case A2MP_DISCONNPHYSLINK_RSP:
	227	default:
	228	BT_ERR("Unknown A2MP sig cmd 0x%2.2x", hdr->code);
	229	err = -EINVAL;
	230	break;
	231	}
	232	}
	233
	234	if (err) {
	235	struct a2mp_cmd_rej rej;
	236	rej.reason = __constant_cpu_to_le16(0);
	237
	238	BT_DBG("Send A2MP Rej: cmd 0x%2.2x err %d", hdr->code, err);
	239
	240	a2mp_send(mgr, A2MP_COMMAND_REJ, hdr->ident, sizeof(rej),
	241	&rej);
	242	}
	243
	244	/* Always free skb and return success error code to prevent
	245	from sending L2CAP Disconnect over A2MP channel */
	246	kfree_skb(skb);
	247
	248	amp_mgr_put(mgr);
	249
	250	return 0;
	251	}
	252
46d5c908 AE	253	static void a2mp_chan_close_cb(struct l2cap_chan *chan)
	254	{
	255	l2cap_chan_destroy(chan);
	256	}
	257
	258	static void a2mp_chan_state_change_cb(struct l2cap_chan *chan, int state)
	259	{
	260	struct amp_mgr *mgr = chan->data;
	261
	262	if (!mgr)
	263	return;
	264
	265	BT_DBG("chan %p state %s", chan, state_to_string(state));
	266
	267	chan->state = state;
	268
	269	switch (state) {
	270	case BT_CLOSED:
	271	if (mgr)
	272	amp_mgr_put(mgr);
	273	break;
	274	}
	275	}
	276
	277	static struct sk_buff a2mp_chan_alloc_skb_cb(struct l2cap_chan chan,
	278	unsigned long len, int nb)
	279	{
	280	return bt_skb_alloc(len, GFP_KERNEL);
	281	}
	282
	283	static struct l2cap_chan a2mp_chan_no_new_conn_cb(struct l2cap_chan chan)
	284	{
	285	BT_ERR("new_connection for chan %p not implemented", chan);
	286
	287	return NULL;
	288	}
	289
	290	static void a2mp_chan_no_teardown_cb(struct l2cap_chan *chan, int err)
	291	{
	292	BT_ERR("teardown for chan %p not implemented", chan);
	293	}
	294
	295	static void a2mp_chan_no_ready(struct l2cap_chan *chan)
	296	{
	297	BT_ERR("ready for chan %p not implemented", chan);
	298	}
	299
466f8004 AE	300	static struct l2cap_ops a2mp_chan_ops = {
466f8004 AE	301	.name = "L2CAP A2MP channel",
6b44d9b8	302	.recv = a2mp_chan_recv_cb,
46d5c908 AE	303	.close = a2mp_chan_close_cb,
	304	.state_change = a2mp_chan_state_change_cb,
	305	.alloc_skb = a2mp_chan_alloc_skb_cb,
	306
	307	/* Not implemented for A2MP */
	308	.new_connection = a2mp_chan_no_new_conn_cb,
	309	.teardown = a2mp_chan_no_teardown_cb,
	310	.ready = a2mp_chan_no_ready,
466f8004 AE	311	};
	312
	313	static struct l2cap_chan a2mp_chan_open(struct l2cap_conn conn)
	314	{
	315	struct l2cap_chan *chan;
	316	int err;
	317
	318	chan = l2cap_chan_create();
	319	if (!chan)
	320	return NULL;
	321
	322	BT_DBG("chan %p", chan);
	323
	324	hci_conn_hold(conn->hcon);
	325
	326	chan->omtu = L2CAP_A2MP_DEFAULT_MTU;
	327	chan->imtu = L2CAP_A2MP_DEFAULT_MTU;
	328	chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
	329
	330	chan->ops = &a2mp_chan_ops;
	331
	332	l2cap_chan_set_defaults(chan);
	333	chan->remote_max_tx = chan->max_tx;
	334	chan->remote_tx_win = chan->tx_win;
	335
	336	chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;
	337	chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;
	338
	339	skb_queue_head_init(&chan->tx_q);
	340
	341	chan->mode = L2CAP_MODE_ERTM;
	342
	343	err = l2cap_ertm_init(chan);
	344	if (err < 0) {
	345	l2cap_chan_del(chan, 0);
	346	return NULL;
	347	}
	348
	349	chan->conf_state = 0;
	350
	351	l2cap_chan_add(conn, chan);
	352
	353	chan->remote_mps = chan->omtu;
	354	chan->mps = chan->omtu;
	355
	356	chan->state = BT_CONNECTED;
	357
	358	return chan;
	359	}
9740e49d AE	360
	361	/* AMP Manager functions */
	362	void amp_mgr_get(struct amp_mgr *mgr)
	363	{
	364	BT_DBG("mgr %p", mgr);
	365
	366	kref_get(&mgr->kref);
	367	}
	368
	369	static void amp_mgr_destroy(struct kref *kref)
	370	{
	371	struct amp_mgr *mgr = container_of(kref, struct amp_mgr, kref);
	372
	373	BT_DBG("mgr %p", mgr);
	374
	375	kfree(mgr);
	376	}
	377
	378	int amp_mgr_put(struct amp_mgr *mgr)
	379	{
	380	BT_DBG("mgr %p", mgr);
	381
	382	return kref_put(&mgr->kref, &amp_mgr_destroy);
	383	}
	384
	385	static struct amp_mgr amp_mgr_create(struct l2cap_conn conn)
	386	{
	387	struct amp_mgr *mgr;
	388	struct l2cap_chan *chan;
	389
	390	mgr = kzalloc(sizeof(*mgr), GFP_KERNEL);
	391	if (!mgr)
	392	return NULL;
	393
	394	BT_DBG("conn %p mgr %p", conn, mgr);
	395
	396	mgr->l2cap_conn = conn;
	397
	398	chan = a2mp_chan_open(conn);
	399	if (!chan) {
	400	kfree(mgr);
	401	return NULL;
	402	}
	403
	404	mgr->a2mp_chan = chan;
	405	chan->data = mgr;
	406
	407	conn->hcon->amp_mgr = mgr;
	408
	409	kref_init(&mgr->kref);
	410
	411	return mgr;
	412	}