Bt mesh and bt host fixes from upstream

doc/connectivity/bluetooth/api/mesh/dfu.rst

@@ -212,9 +212,10 @@ re-provisioned. The complete list of available options is defined in :c:enum:`bt
    provisioning. In this case, the device stays provisioned and the new composition data takes place
    after re-provisioning using the Remote Provisioning models.
 :c:enumerator:`BT_MESH_DFU_EFFECT_UNPROV`
-  This effect is chosen if the composition data in the new firmware changes, the device doesn't
+  This effect is chosen if the composition data in the new firmware changes, the device does not
   support the remote provisioning, and the new composition data takes effect after applying the
-  firmware.
+  firmware. The effect can also be chosen, if it is necessary to unprovision the device for
+  application-specific reasons.
 
 When the Target node receives the Firmware Update Firmware Metadata Check message, the Firmware
 Update Server model calls the :c:member:`bt_mesh_dfu_srv_cb.check` callback, the application can

doc/releases/migration-guide-4.1.rst

@@ -305,6 +305,21 @@ Bluetooth Mesh
   set as deprecated. Default option for platforms that do not support TF-M
   is :kconfig:option:`CONFIG_BT_MESH_USES_MBEDTLS_PSA`.
 
+* Mesh key representations are not backward compatible if images are built with TinyCrypt and
+  crypto libraries based on the PSA API. Mesh no longer stores the key values for those crypto
+  libraries. The crypto library stores the keys in the internal trusted storage.
+  If a provisioned device is going to update its image that was built with
+  the :kconfig:option:`CONFIG_BT_MESH_USES_TINYCRYPT` Kconfig option set on an image
+  that was built with :kconfig:option:`CONFIG_BT_MESH_USES_MBEDTLS_PSA` or
+  :kconfig:option:`CONFIG_BT_MESH_USES_TFM_PSA` without erasing the persistent area,
+  it should be unprovisioned first and reprovisioned after update again.
+  If the image is changed over Mesh DFU, use :c:enumerator:`BT_MESH_DFU_EFFECT_UNPROV`.
+
+* Mesh explicitly depends on the Secure Storage subsystem if storing into
+  non-volatile memory (:kconfig:option:`CONFIG_BT_SETTINGS`) is enabled and
+  Mbed TLS library (:kconfig:option:`CONFIG_BT_MESH_USES_MBEDTLS_PSA`) is used.
+  Applications should be built with :kconfig:option:`CONFIG_SECURE_STORAGE` enabled.
+
 Bluetooth Audio
 ===============
 

include/zephyr/bluetooth/bluetooth.h

@@ -268,7 +268,7 @@ bool bt_is_ready(void);
  *
  * @sa @kconfig{CONFIG_BT_DEVICE_NAME_MAX}.
  *
- * @param name New name
+ * @param name New name, must be null terminated
  *
  * @return Zero on success or (negative) error code otherwise.
  */

include/zephyr/bluetooth/mesh/access.h

@@ -628,7 +628,7 @@ struct bt_mesh_model_op {
  *  @return Mesh transmit value that can be used e.g. for the default
  *          values of the configuration model data.
  */
-#define BT_MESH_TRANSMIT(count, int_ms) ((count) | (((int_ms / 10) - 1) << 3))
+#define BT_MESH_TRANSMIT(count, int_ms) ((uint8_t)((count) | (((int_ms / 10) - 1) << 3)))
 
 /**
  *  @brief Decode transmit count from a transmit value.

modules/mbedtls/configs/config-tls-generic.h

@@ -482,12 +482,6 @@
 #define MBEDTLS_PSA_P256M_DRIVER_ENABLED
 #endif
 
-#if defined(CONFIG_ARCH_POSIX) && !defined(CONFIG_PICOLIBC) && !defined(CONFIG_SECURE_STORAGE)
-#define MBEDTLS_PSA_ITS_FILE_C
-#define MBEDTLS_PSA_CRYPTO_STORAGE_C
-#define MBEDTLS_FS_IO
-#endif
-
 #if defined(CONFIG_SECURE_STORAGE)
 #define MBEDTLS_PSA_CRYPTO_STORAGE_C
 #endif

samples/bluetooth/mesh/boards/nrf5340dk_nrf5340_cpuapp_ns.conf

@@ -0,0 +1 @@
+CONFIG_SECURE_STORAGE=n

samples/bluetooth/mesh/boards/qemu_x86.conf

@@ -0,0 +1,6 @@
+# nrf_security only supports Cortex-M via PSA crypto libraries.
+# Enforcing usage of built-in Mbed TLS for native simulator.
+CONFIG_NRF_SECURITY=n
+CONFIG_MBEDTLS_ENABLE_HEAP=n
+CONFIG_TRUSTED_STORAGE=n
+CONFIG_SECURE_STORAGE=y

samples/bluetooth/mesh/prj.conf

@@ -5,6 +5,7 @@ CONFIG_FLASH=y
 CONFIG_FLASH_MAP=y
 CONFIG_NVS=y
 CONFIG_SETTINGS=y
+# CONFIG_SECURE_STORAGE=y
 CONFIG_HWINFO=y
 
 CONFIG_BT=y

samples/bluetooth/mesh_demo/boards/nrf5340dk_nrf5340_cpuapp_ns.conf

@@ -0,0 +1 @@
+CONFIG_SECURE_STORAGE=n

samples/bluetooth/mesh_demo/boards/qemu_x86.conf

@@ -0,0 +1,6 @@
+# nrf_security only supports Cortex-M via PSA crypto libraries.
+# Enforcing usage of built-in Mbed TLS for native simulator.
+CONFIG_NRF_SECURITY=n
+CONFIG_MBEDTLS_ENABLE_HEAP=n
+CONFIG_TRUSTED_STORAGE=n
+CONFIG_SECURE_STORAGE=y

samples/bluetooth/mesh_demo/prj.conf

@@ -31,6 +31,7 @@ CONFIG_FLASH_MAP=y
 CONFIG_NVS=y
 CONFIG_SETTINGS=y
 CONFIG_BT_MESH_RPL_STORE_TIMEOUT=600
+# CONFIG_SECURE_STORAGE=y
 
 # Limit the number of key slots in PSA Crypto core to reduce
 # RAM footprint

samples/bluetooth/mesh_provisioner/boards/nrf5340dk_nrf5340_cpuapp_ns.conf

@@ -0,0 +1 @@
+CONFIG_SECURE_STORAGE=n

samples/bluetooth/mesh_provisioner/boards/qemu_x86.conf

@@ -0,0 +1,6 @@
+# nrf_security only supports Cortex-M via PSA crypto libraries.
+# Enforcing usage of built-in Mbed TLS for native simulator.
+CONFIG_NRF_SECURITY=n
+CONFIG_MBEDTLS_ENABLE_HEAP=n
+CONFIG_TRUSTED_STORAGE=n
+CONFIG_SECURE_STORAGE=y

samples/bluetooth/mesh_provisioner/prj.conf

@@ -45,6 +45,7 @@ CONFIG_FLASH_MAP=y
 CONFIG_NVS=y
 CONFIG_SETTINGS=y
 CONFIG_BT_MESH_RPL_STORE_TIMEOUT=600
+# CONFIG_SECURE_STORAGE=y
 
 #CONFIG_BT_MESH_LOG_LEVEL_DBG=y
 #CONFIG_BT_MESH_SETTINGS_LOG_LEVEL_DBG=y

samples/boards/nordic/mesh/onoff-app/prj.conf

@@ -9,6 +9,8 @@ CONFIG_FLASH=y
 CONFIG_FLASH_MAP=y
 CONFIG_NVS=y
 CONFIG_SETTINGS=y
+# CONFIG_SECURE_STORAGE=y
+
 CONFIG_BT_MESH_RPL_STORE_TIMEOUT=600
 
 CONFIG_BOOT_BANNER=y

samples/boards/nordic/mesh/onoff_level_lighting_vnd_app/prj.conf

@@ -7,6 +7,7 @@ CONFIG_FLASH=y
 CONFIG_FLASH_MAP=y
 CONFIG_NVS=y
 CONFIG_SETTINGS=y
+# CONFIG_SECURE_STORAGE=y
 
 CONFIG_BT_OBSERVER=y
 CONFIG_BT_BROADCASTER=y

samples/boards/phytec/reel_board/mesh_badge/prj.conf

@@ -66,4 +66,5 @@ CONFIG_FLASH=y
 CONFIG_FLASH_MAP=y
 CONFIG_NVS=y
 CONFIG_SETTINGS=y
+CONFIG_SECURE_STORAGE=y
 CONFIG_CBPRINTF_FP_SUPPORT=y

subsys/bluetooth/common/bt_settings_commit.h

@@ -0,0 +1,19 @@
+/* Copyright (c) 2024 Nordic Semiconductor ASA
+ * SPDX-License-Identifier: Apache-2.0
+ */
+#ifndef BT_SETTINGS_COMMIT_H_
+#define BT_SETTINGS_COMMIT_H_
+
+/**
+ * @brief Bluetooth Settings Commit Priorities
+ *
+ * Enum of commit priorities for Bluetooth settings handlers.
+ * Lower values indicate higher priority.
+ */
+enum bt_settings_commit_priority {
+	BT_SETTINGS_CPRIO_0,
+	BT_SETTINGS_CPRIO_1,
+	BT_SETTINGS_CPRIO_2,
+};
+
+#endif /* BT_SETTINGS_COMMIT_H_ */

subsys/bluetooth/host/Kconfig

@@ -90,8 +90,12 @@ config BT_RECV_WORKQ_SYS
 	  High priority HCI packets will processed in the context of the caller of bt_recv().
 	  The application needs to ensure the system workqueue stack size (SYSTEM_WORKQUEUE_STACK_SIZE)
 	  is large enough, refer to BT_RX_STACK_SIZE for the recommended minimum.
-	  Note: When this option is used, other users of the system work queue will influence the
-	  latency of incoming Bluetooth events.
+	  Warning: Enabling this option will cause the latency of incoming Bluetooth events to be
+	  affected by other tasks using the system work queue. When this option is active, the Host
+	  will process Bluetooth events in a blocking manner. This can lead to deadlocks if the
+	  application waits for the system work queue while handling Bluetooth events. This feature
+	  is intended for advanced users to allow aggressive memory optimization for devices with
+	  very limited memory. It is strongly advised not to use this option.
 
 config BT_RECV_WORKQ_BT
 	bool "Process low priority HCI packets in the bluetooth-specific work queue"

subsys/bluetooth/host/conn.c

@@ -864,10 +864,18 @@ void bt_conn_data_ready(struct bt_conn *conn)
 		 *
 		 * This reference will be consumed when the conn is popped off
 		 * the list (in `get_conn_ready`).
+		 *
+		 * The `bt_dev.le.conn_ready` list is accessed by the tx_processor
+		 * which runs in a workqueue, but `bt_conn_data_ready` can be called
+		 * from different threads so we need to make sure that nothing will
+		 * trigger a thread switch while we are manipulating the list since
+		 * sys_slist_*() functions are not thread safe.
 		 */
 		bt_conn_ref(conn);
+		k_sched_lock();
 		sys_slist_append(&bt_dev.le.conn_ready,
 				 &conn->_conn_ready);
+		k_sched_unlock();
 		LOG_DBG("raised");
 	} else {
 		LOG_DBG("already in list");
@@ -910,22 +918,8 @@ __maybe_unused static bool dont_have_methods(struct bt_conn *conn)
 
 struct bt_conn *get_conn_ready(void)
 {
-	/* Here we only peek: we pop the conn (and insert it at the back if it
-	 * still has data) after the QoS function returns false.
-	 */
-	sys_snode_t *node  = sys_slist_peek_head(&bt_dev.le.conn_ready);
-
-	if (node == NULL) {
-		return NULL;
-	}
-
-	/* `conn` borrows from the list node. That node is _not_ popped yet.
-	 *
-	 * If we end up not popping that conn off the list, we have to make sure
-	 * to increase the refcount before returning a pointer to that
-	 * connection out of this function.
-	 */
-	struct bt_conn *conn = CONTAINER_OF(node, struct bt_conn, _conn_ready);
+	struct bt_conn *conn, *tmp;
+	sys_snode_t *prev = NULL;
 
 	if (dont_have_viewbufs()) {
 		/* We will get scheduled again when the (view) buffers are freed. If you
@@ -935,42 +929,54 @@ struct bt_conn *get_conn_ready(void)
 		return NULL;
 	}
 
-	if (cannot_send_to_controller(conn)) {
-		/* We will get scheduled again when the buffers are freed. */
-		LOG_DBG("no LL bufs for %p", conn);
-		return NULL;
-	}
+	SYS_SLIST_FOR_EACH_CONTAINER_SAFE(&bt_dev.le.conn_ready, conn, tmp, _conn_ready) {
+		__ASSERT_NO_MSG(tmp != conn);
 
-	if (dont_have_tx_context(conn)) {
-		/* We will get scheduled again when TX contexts are available. */
-		LOG_DBG("no TX contexts");
-		return NULL;
-	}
+		/* Iterate over the list of connections that have data to send
+		 * and return the first one that can be sent.
+		 */
 
-	CHECKIF(dont_have_methods(conn)) {
-		LOG_DBG("conn %p (type %d) is missing mandatory methods",
-			conn, conn->type);
+		if (cannot_send_to_controller(conn)) {
+			/* When buffers are full, try next connection. */
+			LOG_DBG("no LL bufs for %p", conn);
+			prev = &conn->_conn_ready;
+			continue;
+		}
 
-		return NULL;
-	}
+		if (dont_have_tx_context(conn)) {
+			/* When TX contexts are not available, try next connection. */
+			LOG_DBG("no TX contexts for %p", conn);
+			prev = &conn->_conn_ready;
+			continue;
+		}
 
-	if (should_stop_tx(conn)) {
-		/* Move reference off the list and into the `conn` variable. */
-		__maybe_unused sys_snode_t *s = sys_slist_get(&bt_dev.le.conn_ready);
+		CHECKIF(dont_have_methods(conn)) {
+			/* When a connection is missing mandatory methods, try next connection. */
+			LOG_DBG("conn %p (type %d) is missing mandatory methods", conn, conn->type);
+			prev = &conn->_conn_ready;
+			continue;
+		}
+
+		if (should_stop_tx(conn)) {
+			/* Move reference off the list */
+			__ASSERT_NO_MSG(prev != &conn->_conn_ready);
+			sys_slist_remove(&bt_dev.le.conn_ready, prev, &conn->_conn_ready);
+			(void)atomic_set(&conn->_conn_ready_lock, 0);
 
-		__ASSERT_NO_MSG(s == node);
-		(void)atomic_set(&conn->_conn_ready_lock, 0);
+			/* Append connection to list if it still has data */
+			if (conn->has_data(conn)) {
+				LOG_DBG("appending %p to back of TX queue", conn);
+				bt_conn_data_ready(conn);
+			}
 
-		/* Append connection to list if it still has data */
-		if (conn->has_data(conn)) {
-			LOG_DBG("appending %p to back of TX queue", conn);
-			bt_conn_data_ready(conn);
+			return conn;
 		}
 
-		return conn;
+		return bt_conn_ref(conn);
 	}
 
-	return bt_conn_ref(conn);
+	/* No connection has data to send */
+	return NULL;
 }
 
 /* Crazy that this file is compiled even if this is not true, but here we are. */

subsys/bluetooth/host/crypto.h

@@ -5,4 +5,4 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-int prng_init(void);
+int bt_crypto_init(void);

subsys/bluetooth/host/crypto_psa.c

@@ -27,7 +27,7 @@
 #include <zephyr/logging/log.h>
 LOG_MODULE_REGISTER(bt_host_crypto);
 
-int prng_init(void)
+int bt_crypto_init(void)
 {
 	psa_status_t status = psa_crypto_init();
 

subsys/bluetooth/host/ecc.c

@@ -220,6 +220,7 @@ static void generate_dh_key(struct k_work *work)
 	if (ret != PSA_SUCCESS) {
 		LOG_ERR("Failed to destroy the key %d", ret);
 		err = -EIO;
+		goto exit;
 	}
 
 	err = 0;
@@ -252,14 +253,10 @@ int bt_pub_key_gen(struct bt_pub_key_cb *new_cb)
 	struct bt_pub_key_cb *cb;
 
 	if (IS_ENABLED(CONFIG_BT_USE_DEBUG_KEYS)) {
-		if (!BT_CMD_TEST(bt_dev.supported_commands, 41, 2)) {
-			LOG_WRN("ECC Debug keys HCI command not available");
-		} else {
-			atomic_set_bit(bt_dev.flags, BT_DEV_HAS_PUB_KEY);
-			__ASSERT_NO_MSG(new_cb->func != NULL);
-			new_cb->func(debug_public_key);
-			return 0;
-		}
+		atomic_set_bit(bt_dev.flags, BT_DEV_HAS_PUB_KEY);
+		__ASSERT_NO_MSG(new_cb->func != NULL);
+		new_cb->func(debug_public_key);
+		return 0;
 	}
 
 	if (!new_cb) {
@@ -312,8 +309,7 @@ void bt_pub_key_hci_disrupted(void)
 
 const uint8_t *bt_pub_key_get(void)
 {
-	if (IS_ENABLED(CONFIG_BT_USE_DEBUG_KEYS) &&
-	    BT_CMD_TEST(bt_dev.supported_commands, 41, 2)) {
+	if (IS_ENABLED(CONFIG_BT_USE_DEBUG_KEYS)) {
 		return debug_public_key;
 	}
 

subsys/bluetooth/host/gatt.c

@@ -101,22 +101,24 @@ static ssize_t read_name(struct bt_conn *conn, const struct bt_gatt_attr *attr,
 
 #if defined(CONFIG_BT_DEVICE_NAME_GATT_WRITABLE)
 
-static ssize_t write_name(struct bt_conn *conn, const struct bt_gatt_attr *attr,
-			 const void *buf, uint16_t len, uint16_t offset,
-			 uint8_t flags)
+static ssize_t write_name(struct bt_conn *conn, const struct bt_gatt_attr *attr, const void *buf,
+			  uint16_t len, uint16_t offset, uint8_t flags)
 {
-	char value[CONFIG_BT_DEVICE_NAME_MAX] = {};
+	/* adding one to fit the terminating null character */
+	char value[CONFIG_BT_DEVICE_NAME_MAX + 1] = {};
 
-	if (offset >= sizeof(value)) {
+	if (offset >= CONFIG_BT_DEVICE_NAME_MAX) {
 		return BT_GATT_ERR(BT_ATT_ERR_INVALID_OFFSET);
 	}
 
-	if (offset + len >= sizeof(value)) {
+	if (offset + len > CONFIG_BT_DEVICE_NAME_MAX) {
 		return BT_GATT_ERR(BT_ATT_ERR_INVALID_ATTRIBUTE_LEN);
 	}
 
 	memcpy(value, buf, len);
 
+	value[len] = '\0';
+
 	bt_set_name(value);
 
 	return len;