From 0b0fa392fa7e9226ff6eef7e0c2ab6cbd5e11bd5 Mon Sep 17 00:00:00 2001 From: Andrzej Kaczmarek Date: Tue, 16 Jan 2018 11:35:48 +0100 Subject: [PATCH] nimble/ll: Fix helpers to calculate aux adv and scan rsp length Helper functions to calculate length of aux packets return PDU length instead of payload length. This makes TX time calculation incorrect and can also overflow return value since PDU length is up to 257 bytes (outside uint8_t range), X-Original-Commit: 2a98773ed5c0cef9df77b7029807c7f232c1bb43 --- nimble/controller/include/controller/ble_ll.h | 4 +++ nimble/controller/src/ble_ll_adv.c | 32 ++++++++++--------- 2 files changed, 21 insertions(+), 15 deletions(-) diff --git a/nimble/controller/include/controller/ble_ll.h b/nimble/controller/include/controller/ble_ll.h index 53e14e91e..3e3d2e517 100644 --- a/nimble/controller/include/controller/ble_ll.h +++ b/nimble/controller/include/controller/ble_ll.h @@ -286,6 +286,9 @@ struct ble_dev_addr #define BLE_ADV_PDU_TYPE_AUX_CHAIN_IND BLE_ADV_PDU_TYPE_ADV_EXT_IND #define BLE_ADV_PDU_TYPE_AUX_CONNECT_RSP (8) +/* Extended Header Length (6b) + AdvMode (2b) */ +#define BLE_LL_EXT_ADV_HDR_LEN (1) + #define BLE_LL_EXT_ADV_ADVA_BIT (0) #define BLE_LL_EXT_ADV_TARGETA_BIT (1) #define BLE_LL_EXT_ADV_RFU_BIT (2) @@ -294,6 +297,7 @@ struct ble_dev_addr #define BLE_LL_EXT_ADV_SYNC_INFO_BIT (5) #define BLE_LL_EXT_ADV_TX_POWER_BIT (6) +#define BLE_LL_EXT_ADV_FLAGS_SIZE (1) #define BLE_LL_EXT_ADV_ADVA_SIZE (6) #define BLE_LL_EXT_ADV_TARGETA_SIZE (6) #define BLE_LL_EXT_ADV_DATA_INFO_SIZE (2) diff --git a/nimble/controller/src/ble_ll_adv.c b/nimble/controller/src/ble_ll_adv.c index 5ab08996f..754be3404 100644 --- a/nimble/controller/src/ble_ll_adv.c +++ b/nimble/controller/src/ble_ll_adv.c @@ -349,43 +349,45 @@ ble_ll_adv_legacy_pdu_make(struct ble_ll_adv_sm *advsm, struct os_mbuf *m) * */ static uint8_t -ble_ll_adv_secondary_pdu_len(struct ble_ll_adv_sm *advsm) +ble_ll_adv_secondary_pdu_payload_len(struct ble_ll_adv_sm *advsm) { - uint8_t pdulen; + uint8_t len; - pdulen = 2 + BLE_LL_PDU_HDR_LEN + BLE_LL_EXT_ADV_DATA_INFO_SIZE; + len = BLE_LL_EXT_ADV_HDR_LEN + BLE_LL_EXT_ADV_FLAGS_SIZE + + BLE_LL_EXT_ADV_DATA_INFO_SIZE; if (!(advsm->props & BLE_HCI_LE_SET_EXT_ADV_PROP_SCANNABLE) && advsm->adv_len) { - pdulen += advsm->adv_len; + len += advsm->adv_len; } if (advsm->props & BLE_HCI_LE_SET_EXT_ADV_PROP_INC_TX_PWR) { - pdulen += BLE_LL_EXT_ADV_TX_POWER_SIZE; + len += BLE_LL_EXT_ADV_TX_POWER_SIZE; } if ((advsm->props & BLE_HCI_LE_SET_EXT_ADV_PROP_DIRECTED) || (advsm->props & BLE_HCI_LE_SET_EXT_ADV_PROP_CONNECTABLE)) { - pdulen += BLE_LL_EXT_ADV_TARGETA_SIZE; + len += BLE_LL_EXT_ADV_TARGETA_SIZE; } - return pdulen; + return len; } static uint8_t -ble_ll_adv_aux_scan_rsp_len(struct ble_ll_adv_sm *advsm) +ble_ll_adv_aux_scan_rsp_payload_len(struct ble_ll_adv_sm *advsm) { - uint8_t pdulen; + uint8_t len; - pdulen = 2 + BLE_LL_PDU_HDR_LEN + BLE_LL_EXT_ADV_ADVA_SIZE; + len = BLE_LL_EXT_ADV_HDR_LEN + BLE_LL_EXT_ADV_FLAGS_SIZE + + BLE_LL_EXT_ADV_ADVA_SIZE; if (advsm->props & BLE_HCI_LE_SET_EXT_ADV_PROP_INC_TX_PWR) { - pdulen += BLE_LL_EXT_ADV_TX_POWER_SIZE; + len += BLE_LL_EXT_ADV_TX_POWER_SIZE; } - pdulen += advsm->scan_rsp_len; + len += advsm->scan_rsp_len; - return pdulen; + return len; } /** @@ -1090,7 +1092,7 @@ ble_ll_adv_secondary_set_sched(struct ble_ll_adv_sm *advsm) advsm->adv_secondary_chan = rand() % BLE_PHY_NUM_DATA_CHANS; /* Set end time to maximum time this schedule item may take */ - max_usecs = ble_ll_pdu_tx_time_get(ble_ll_adv_secondary_pdu_len(advsm), + max_usecs = ble_ll_pdu_tx_time_get(ble_ll_adv_secondary_pdu_payload_len(advsm), advsm->sec_phy); if (advsm->props & BLE_HCI_LE_SET_EXT_ADV_PROP_CONNECTABLE) { @@ -1106,7 +1108,7 @@ ble_ll_adv_secondary_set_sched(struct ble_ll_adv_sm *advsm) ble_ll_pdu_tx_time_get(12, advsm->sec_phy) + BLE_LL_IFS + /* AUX_SCAN_RSP */ - ble_ll_pdu_tx_time_get(ble_ll_adv_aux_scan_rsp_len(advsm), + ble_ll_pdu_tx_time_get(ble_ll_adv_aux_scan_rsp_payload_len(advsm), advsm->sec_phy); }