Replace direct NVIC pending-state calls with k_irq_set_pending()/
k_irq_is_pending()/k_irq_clear_pending().
Assisted-by: Claude:claude-opus-5
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
Channel restore was only performed for failed CSL receptions
(gPlmeTimeoutInd_c in plme_mac_sap_handler). Successful CSL
receptions (gPdDataInd_c in pd_mac_sap_handler) were missing
the rf_restore_main_channel() call, leaving the PHY on the
temporary CSL channel after a successful reception.
Add rf_restore_main_channel() call in pd_mac_sap_handler so
that the main network channel is always restored after any
CSL RX slot, regardless of the outcome.
Signed-off-by: Baptiste Coffin <baptiste.coffin_1@nxp.com>
Two bugs are fixed:
1. IEEE802154_HW_SELECTIVE_TXCHANNEL capability was always advertised
regardless of CONFIG_IEEE802154_SELECTIVE_TXCHANNEL. Guard it behind
the Kconfig option as required by the driver API documentation.
2. The selective TX channel feature was not implemented. When
CONFIG_IEEE802154_SELECTIVE_TXCHANNEL is enabled, use the per-packet
TX channel (set by the upper layer for CSL timed transmissions) for
TXTIME and TXTIME_CCA modes. The txchannel field is only valid for
timed TX modes as it shares storage with the lqi/rssi fields.
Fixes: https://github.com/zephyrproject-rtos/zephyr/issues/111211
Signed-off-by: Baptiste Coffin <baptiste.coffin_1@nxp.com>
drv_rx_done() took the length byte from the start of the RF core's receive
entry and immediately used it as an index twice:
len = drv_data->rx_data[i][0];
status = drv_data->rx_data[i][len--];
rssi = drv_data->rx_data[i][len--];
That byte is the over-the-air SUN-FSK PHR and is not validated. len == 0
makes the first read index rx_data[i][0], wrapping len to 255, so the
second read lands at rx_data[i][255] - 125 bytes past the 130-byte
(IEEE802154_MAX_PHY_PACKET_SIZE + 3) receive row - and leaves len at 254,
which is then used as the length for net_pkt_rx_alloc_with_buffer() and
net_pkt_write(), copying ~124 bytes of adjacent memory into a packet
delivered to the network stack.
With CONFIG_IEEE802154_L2_PKT_INCL_FCS the same wrap is an out-of-bounds
write: the CRC append does sdu[len++] twice, storing two bytes past the
row for a sufficiently large len.
Reject a length that would underflow the post-decrements or exceed the
receive buffer, and recycle the entry, mirroring the guard added to the 2.4
GHz sibling driver in "drivers: ieee802154: cc13xx_cc26xx: fix short-frame
path reaching net_recv_data".
Assisted-by: Claude:claude-opus-5
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
Commit "drivers: ieee802154: cc13xx_cc26xx: reject short RX frames
before len--" rejected RX frames with len < 4 before the two
post-decrements that would otherwise underflow uint8_t, but jumped to a
label placed after the packet allocation and before the packet is handed
to the network stack:
next_entry:
drv_data->rx_entry[i].status = DATA_ENTRY_PENDING;
net_pkt_set_ieee802154_lqi(pkt, lqi);
...
net_recv_data(drv_data->iface, pkt);
Taking the goto therefore reached net_pkt_set_ieee802154_lqi() and
net_recv_data() with pkt uninitialised on the first loop iteration, or
stale on later ones - in which case the packet had already been passed
to the net stack and unreferenced, making this a use-after-free that a
short frame could trigger remotely.
Recycle the RX entry and continue the loop instead, matching how the
DATA_ENTRY_UNFINISHED branch below already handles a discarded entry,
and drop the label.
Assisted-by: Claude:claude-opus-5
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
The RX done handler post-decremented len twice then subtracted 2 for FCS.
With len < 4 the uint8_t underflows, producing a huge length passed to
net_pkt_rx_alloc_with_buffer. Reject frames with len < 4 before the
post-decrement operations.
Assisted-by: Claude:claude-sonnet-4-6
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
The CC1200 radio can supply a pkt_len of 0-255 but IEEE 802.15.4 limits
PHY packets to 127 bytes. verify_rxfifo_validity() only checked the lower
bound; values above 127 reached net_pkt_rx_alloc_with_buffer() unclamped.
Add the upper bound check against IEEE802154_MAX_PHY_PACKET_SIZE.
Assisted-by: Claude:claude-sonnet-4-6
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
The PHR is used to compute len = raw[0] - IEEE802154_FCS_LENGTH, bounded
only by __ASSERT_NO_MSG, which compiles out at CONFIG_ASSERT=n. Add the
lower bound before the subtraction and a runtime length check.
Note the ESP-IDF HAL drops frames whose FCS does not validate, and a frame
declaring fewer than two PHR bytes has no room for an FCS, so the wrap may
not be reachable in practice; the bound costs one comparison and does not
depend on that argument holding.
Assisted-by: Claude:claude-opus-5
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
The driver subtracts the FCS length from the radio-reported length and then
bounds the result with __ASSERT_NO_MSG alone, which compiles out at
CONFIG_ASSERT=n - the production default. A length below the FCS size
wrapped to ~254 and drove the packet allocation and copy.
Add the lower bound before the subtraction and a runtime length check,
matching what the nrf5 driver already does.
Assisted-by: Claude:claude-opus-5
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
The ACK length reported by the NBU was memcpy'd into a fixed
rx_ack_data[IEEE802154_MAX_PHY_PACKET_SIZE] buffer with no bound.
Drop an ACK that does not fit rather than copying past the end of the
buffer; a zero length tells mcxw_tx() that no ACK was received.
Assisted-by: Claude:claude-opus-5
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
The frame-length register was used raw. MCR20A_RX_FRM_LENGTH_MASK is
defined but was never applied, and there was no lower bound, so len - 2
wrapped to ~254 and drove read_rxfifo_content(), which reads into the first
net_buf fragment only - overflowing that fragment.
Apply the mask, reject a length below the FCS size, and check the fragment
tailroom before the FIFO read.
Assisted-by: Claude:claude-opus-5
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
The call site only checked that the radio-reported length was non-zero, so
a length below KW41Z_FCS_LENGTH underflowed pkt_len = len - FCS_LENGTH and
drove an oversized packet allocation and copy.
Reject such a length, and check the tailroom of the first net_buf fragment
before the copy loops, which write into that fragment only.
Assisted-by: Claude:claude-opus-5
Signed-off-by: Anas Nashif <anas.nashif@intel.com>
Currently, it is possible to link a IEEE802.15.4 build with
stale blobs. Add blobs verify directive to enforce blobs version
check while building.
Signed-off-by: Raffael Rostagno <raffael.rostagno@espressif.com>
The esp_ieee802154_energy_detect_done() runs from the radio ISR.
Defer the energy_scan_done callback to a workqueue so it is invoked
from thread context instead of ISR context.
Signed-off-by: Marek Matej <marek.matej@espressif.com>
This macro eliminates manual size/alignment management and prevents
namespace collisions by moving internal queues to file-private scope.
Signed-off-by: Cesar Vandevelde <cesar.vandevelde@gmail.com>
The MCXW IEEE 802.15.4 driver is now compiled only when CONFIG_NET_L2
is enabled. This allows a vendor-specific radio.c implementation to be
used without requiring networking stack support.
Signed-off-by: Cristian Bulacu <cristian.bulacu@nxp.com>
esp_ieee802154_transmit_failed() received the transmission error and
discarded it, unlocking tx_wait exactly like the success path does. As a
result k_sem_take() in esp32_tx() returned 0 for a frame that lost channel
access or was never acknowledged, and the driver reported a successful
transmission to the upper layer. OpenThread was told the frame had been
sent and therefore never retransmitted it, so the frame was dropped
silently with no error reported anywhere.
Store the error reported by the callback and translate it into the return
values documented for the tx() operation in ieee802154_radio.h: -EBUSY for
a busy medium and -ENOMSG for a missing or invalid ACK. The OpenThread
platform layer maps these to OT_ERROR_CHANNEL_ACCESS_FAILURE and
OT_ERROR_NO_ACK respectively, both of which trigger a retransmission.
Clear ack_frame and ack_frame_info at the start of every transmission.
A transmission that fails produces no ACK, and one that times out never
reaches handle_ack(), so in both cases the pointers from the previous
transmission stayed live and handle_ack() released a frame that had
already been released. Clear ack_frame_info alongside ack_frame in
handle_ack() as well, so the pair is never left half valid.
Measured on an ESP32-C6 joined to a live Thread network sharing a channel
with three other nodes: a test sending five UDP datagrams and requiring all
five to be reflected failed on roughly half of all boots before this change
and passed 30 consecutive boots afterwards. The errors reported by the
callback were CCA_BUSY and NO_ACK.
Signed-off-by: David Girle <davidgirle@gmail.com>
Fix formatting issues in the driver class' listfile which caused CI
compliance checks failures.
Signed-off-by: Mathieu Choplain <mathieu.choplain-ext@st.com>
Compatible existence should indeed be checked using the autogenerated
Kconfig option DT_HAS_ST_STM32WBA_IEEE802154_ENABLED as intended by the
code in the listfile; however, in CMake, Kconfig options have the
`CONFIG_` prefix as in C!
Update the listfile to check for compatible existence using the proper
variable (i.e., with the `CONFIG_` prefix).
Signed-off-by: Mathieu Choplain <mathieu.choplain-ext@st.com>
Modify existing Silicon Labs EFR32 driver and defconfigs
in order to support Coordinated Sampled Listening.
Signed-off-by: David Boullie <David.Boullie@silabs.com>
Add steps to remove stale metadata from Enhanced ACK path,
along with correctly using key identifier context.
Signed-off-by: David Boullie <David.Boullie@silabs.com>
Add blobs presence dependency to the KConfig IEEE802154_STM32WBA
Add zephyr_blobs_verify() CMake function for STM32 HAL
Signed-off-by: Vincent Tardy <vincent.tardy@st.com>
Hello, it's great that this driver has finally been released,
and I'm very impressed with the sheer amount of code. I'm reading
it and can't understand everything, but I have a few questions.
- `silabs_efr32_filter`: I see that the Zephyr API requires setting
and unsetting filters, and the Silabs platform also supports unsetting
filters, but why do we return ENOTSUP when the set variable is false?
- `silabs_efr32_cca` isn't implemented and returns ENOTSUP, but
I see a function called `unslotted_csma_ca_channel_access`
in the upper layer that retrieves the return value of
`ieee802154_radio_cca` (this function wraps the cca API).
If it returns an error other than EBUSY, it will be considered
a fatal error and abort the transmission.
I wonder if it's advisable to return 0 (no errror) so it means
that the CCA software doesn't do anything because the CCA
hardware has already performed the task?
- I've added a variable `testing`
if the `CONFIG_IEEE802154_CARRIER_FUNCTIONS`
configuration is enabled.
Signed-off-by: Phuc Hoang <donp172748@gmail.com>
Add STM32WBAx suspend-to-RAM support and hook the SoC-specific
implementation into the build when CONFIG_PM_S2RAM is enabled.
Select the custom S2RAM marking capability and add the STM32WBAx S2RAM
support source file.
Update the suspend-to-RAM path to clear the hardware standby flag as early
as possible after resume. Use standby_entered as a software indicator to
track whether standby was effectively entered and cleared, so resume
handling only restores radio state when needed.
Signed-off-by: Romain Jayles <romain.jayles@st.com>
If the TX FIFO is too small, these calls can fail. While this usually
doesn't happen, I ran into this issue while porting this driver to
efr32mg13p and was wondering why sending data doesn't work properly.
Signed-off-by: Michael Zimmermann <michael.zimmermann@sevenlab.de>
Sleep End Devices (SED) use data poll packets to check if the coordinator
has data to send. These packets use the type
IEEE802154_FRAME_TYPE_MAC_COMMAND, which as an additional field inside the
part of the header thats supposed to be part of the authenticated data
rather than the encrypted payload.
sl_802154_get_mhr_length has to detect this situation and adjust the
returned header size accordingly. The check is modeled after what the
function FindPayloadIndex does inside of the openthread source code. That
code is used, if the device doesn't support IEEE802154_HW_TX_SEC.
Before this fix, neither Wireshark nor the receiver of the message were
able to decrypt the message. This caused sleepy devices to be unable to
communicate.
Signed-off-by: Michael Zimmermann <michael.zimmermann@sevenlab.de>
- tx_errno was set before giving the semaphore in several places. This can
cause the tx function to use the old value.
- The code tried to wait for an ACK even if the tx has failed. This caused
a dead lock. To solve this without relying on the order in which the ack
and the TX result are received, a new variable `ack_errno` is introduced,
so the success of the ack can be tracked and waited for separately.
Signed-off-by: Michael Zimmermann <michael.zimmermann@sevenlab.de>
- Added `phy_channel` to track actual PHY hardware state
- Created `rf_change_channel()` as single entry point for all changes
- Implemented `rf_restore_main_channel()` for automatic restoration
- Added `rf_restart_rx_if_enabled()` helper to avoid code duplication
- Restored `rf_set_channel()` as low-level PHY configuration helper
Signed-off-by: Baptiste Coffin <baptiste.coffin_1@nxp.com>
Add frame buffering before delivering packets to speed up HAL frame
release.
Update IEEE802154 hw capabilities.
Signed-off-by: Marek Matej <marek.matej@espressif.com>
Add compilation of sl_openthread library to silabs 15.4 radio
driver to enable RAIL operations for OpenThread.
Co-Authored-by: David Boullie <David.Boullie@silabs.com>
Co-Authored-by: Sree Sreerajatha <sree.sreerajatha@silabs.com>
Signed-off-by: David Boullie <David.Boullie@silabs.com>
Add the driver itself and Kconfig/CMakeLists/dts/bindings related to it.
Other files and libraries needed are in Silabs' dedicated folder
hal_silabs (modules/hal/silabs).
Co-Authored-by: David Boullie <David.Boullie@silabs.com>
Co-Authored-by: Sree Sreerajatha <sree.sreerajatha@silabs.com>
Signed-off-by: David Boullie <David.Boullie@silabs.com>
The IEEE 802.15.4 address is moved from flash hw_params_partition
to internal IFR0.
Abstraction layer is done by using CONFIG_NVMEM.
Signed-off-by: Guillaume Legoupil <guillaume.legoupil@nxp.com>
Copy the information filled in the Tx packet by the link layer
during IEEE 802.15.4 transmission before exiting the
stm32wba_802154_tx() function.
Drop the packet from the Tx_done callback issued by the
link layer after a radio reset.
Signed-off-by: Vincent Tardy <vincent.tardy@st.com>
update the ieee802154 driver to be compliant
with LL update integrating 802.15.4 error code
unification change
Signed-off-by: Vincent Tardy <vincent.tardy@st.com>
Utilize a code spell-checking tool to scan for and correct spelling errors
in all files within:
- `drivers/i2s`
- `drivers/i3c`
- `drivers/ieee802154`
- `drivers/input`
Signed-off-by: Pisit Sawangvonganan <pisit@ndrsolution.com>
pd_mac_sap_handler gPdDataInd_c case shouldn't free msg
as it is already freed by the rx_thread. The msg is put
in rx_msgq queue through k_msgq_put which does a shallow
copy.
Signed-off-by: Andrei Menzopol <andrei.menzopol@nxp.com>
Start/stop functions should return -EALREADY is the setup is already set.
If start/stop functions are called multiple times they trigger an assert.
Signed-off-by: Andrei Menzopol <andrei.menzopol@nxp.com>
Ble host and link layer threads initialization is no more done
during the system initialization.
Add stm32wba_ble_ctlr_thread_init() and
stm32wba_ll_ctlr_thread_init() functions calls
during ble and ieee802.15.4 driver initialization
Signed-off-by: Vincent Tardy <vincent.tardy@st.com>
When lptmr0 is reserved as the system timer, the MCXW IEEE 802.15.4
radio cannot rely on a separate counter device being instantiated for it.
The fallback to the kernel cycle counter is also not a valid replacement
for hardware timestamping in all timer configurations.
Add a counter phandle to the MCXW binding, wire the MCXW7x boards in scope
to use lptmr1 as a dedicated non-system-timer counter, and make the driver
consume that devicetree-provided counter directly.
This keeps the fix narrow to the boards enabled in this PR while removing
the fragile hard-coded lptmr0/lptmr1 selection logic.
Signed-off-by: Holt Sun <holt.sun@nxp.com>
Rx packet notified from low layer with an
error status are skipped and the rx failure
is notified to upper layer through
the IEEE802154_EVENT_RX_FAILED event
Signed-off-by: Vincent Tardy <vincent.tardy@st.com>
Replaces usage of these deprecated macros with ones that support
fixed and mapped partition compatibles. Also includes an update to
hal_espressif which also (rightly or wrongly) has zephyr specific
code in it
Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
