From ab8bc74f92f71d79a3ae81687e0cbc37b681b567 Mon Sep 17 00:00:00 2001 From: Andrzej Kaczmarek Date: Tue, 22 Jan 2019 12:41:29 -0800 Subject: [PATCH] nimble/ll: Fix access address computation Core 5.0, Vol 6, Part B, section 2.1.2: The Access Address shall be a 32-bit value. Each time it needs a new Access Address, the Link Layer shall generate a new random value that meets the following requirements: (...) * It shall have a minimum of two transitions in the most significant six bits. Current implementation of the above only checks if there are no transitions in 6 msb so it can create invalid access address. Transitions can be easily calculated using xor with the same value shifted - the result will have '1' at each position with transition so then it's just a matter of counting them. --- nimble/controller/src/ble_ll_conn.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/nimble/controller/src/ble_ll_conn.c b/nimble/controller/src/ble_ll_conn.c index b6561a7d6..1efcf5678 100644 --- a/nimble/controller/src/ble_ll_conn.c +++ b/nimble/controller/src/ble_ll_conn.c @@ -511,6 +511,7 @@ ble_ll_conn_calc_access_addr(void) uint8_t consecutive; uint8_t transitions; uint8_t ones; + int tmp; /* Calculate a random access address */ aa = 0; @@ -525,8 +526,8 @@ ble_ll_conn_calc_access_addr(void) } /* Upper 6 bits must have 2 transitions */ - temp = aa_high & 0xFC00; - if ((temp == 0) || (temp == 0xFC00)) { + tmp = (int16_t)aa_high >> 10; + if (__builtin_popcount(tmp ^ (tmp >> 1)) < 2) { continue; }