net: lib: coap: Return an error on removing a non-existing observer

If we're parsing a CoAP request with an observe option of '1', but there is
no matching observer, return an error instead of returning a zero.

Signed-off-by: Pieter De Gendt <pieter.degendt@basalte.be>
(cherry picked from commit d5931bae93)

.github/workflows/assigner.yml

@@ -22,6 +22,11 @@ jobs:
     runs-on: ubuntu-22.04
 
     steps:
+    - name: Set up Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: 3.12
+
     - name: Install Python dependencies
       run: |
         sudo pip3 install -U setuptools wheel pip

.github/workflows/doc-build.yml

@@ -70,6 +70,11 @@ jobs:
       cancel-in-progress: true
 
     steps:
+    - name: Set up Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: 3.12
+
     - name: install-pkgs
       run: |
         sudo apt-get update
@@ -202,6 +207,11 @@ jobs:
     - name: checkout
       uses: actions/checkout@v4
 
+    - name: Set up Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: 3.12
+
     - name: install-pkgs
       run: |
         apt-get update

doc/_static/css/custom.css

@@ -921,6 +921,10 @@ dark-mode-toggle::part(toggleLabel){
   font-size: unset;
 }
 
+div.graphviz > object {
+    filter: var(--graphviz-filter);
+}
+
 /* Home page grid display */
 .grid {
     list-style-type: none !important;

doc/_static/css/dark.css

@@ -93,4 +93,6 @@
     --btn-neutral-background-color: #404040;
     --btn-neutral-hover-background-color: #505050;
     --footer-color: #aaa;
+
+    --graphviz-filter: invert(0.9) brightness(1.2);
 }

doc/_static/css/light.css

@@ -91,4 +91,6 @@
     --btn-neutral-background-color: #f3f6f6;
     --btn-neutral-hover-background-color: #e5ebeb;
     --footer-color: #808080;
+
+    --graphviz-filter: none;
 }

doc/conf.py

@@ -325,6 +325,9 @@ graphviz_dot_args = [
     "-Ncolor=gray60",
     "-Nfontcolor=gray25",
     "-Ecolor=gray60",
+    "-Gfontname=system-ui,-apple-system,Segoe UI,Roboto,Helvetica Neue,Arial,Noto Sans,sans-serif",
+    "-Nfontname=system-ui,-apple-system,Segoe UI,Roboto,Helvetica Neue,Arial,Noto Sans,sans-serif",
+    "-Efontname=SFMono-Regular,Menlo,Monaco,Consolas,Liberation Mono,Courier New,Courier,monospace",
 ]
 
 # -- Options for sphinx_copybutton ----------------------------------------

doc/releases/release-notes-4.0.rst

@@ -2,6 +2,48 @@
 
 .. _zephyr_4.0:
 
+.. _zephyr_4.0.1:
+
+Zephyr 4.0.1
+############
+
+This is an LTS maintenance release with fixes.
+
+Security Vulnerability Related
+******************************
+
+The following CVEs are addressed by this release:
+
+* :cve:`2025-27809` `TLS clients may unwittingly skip server authentication
+  <https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-03-1/>`_
+* :cve:`2025-27810` `Potential authentication bypass in TLS handshake
+  <https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-03-2/>`_
+
+More detailed information can be found in:
+https://docs.zephyrproject.org/latest/security/vulnerabilities.html
+
+Issues fixed
+************
+
+These GitHub issues were addressed since the previous 4.0.0 tagged release:
+
+Mbed TLS
+********
+
+Mbed TLS was updated to version 3.6.3 (from 3.6.2). The release notes can be found at:
+https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.6.3
+
+Mbed TLS 3.6 is an LTS release that will be supported
+with security and bug fixes until at least March 2027.
+
+Trusted Firmware-M (TF-M)
+*************************
+
+TF-M was updated to version 2.1.2 (from 2.1.1). The release notes can be found at:
+https://trustedfirmware-m.readthedocs.io/en/tf-mv2.1.2/releases/2.1.2.html
+
+.. _zephyr_4.0.0:
+
 Zephyr 4.0.0
 ############
 

drivers/gpio/gpio_adp5585.c

@@ -143,14 +143,14 @@ static int gpio_adp5585_config(const struct device *dev, gpio_pin_t pin, gpio_fl
 			data->output |= BIT(pin);
 		}
 		if (bank == 0) {
-			/* reg_value for ADP5585_GPO_OUT_MODE */
+			/* reg_value for ADP5585_GPO_DATA_OUT */
 			reg_value = (uint8_t)data->output;
 		} else {
-			/* reg_value for ADP5585_GPO_OUT_MODE */
+			/* reg_value for ADP5585_GPO_DATA_OUT */
 			reg_value = (uint8_t)(data->output >> 8);
 		}
 		ret = i2c_reg_write_byte_dt(&parent_cfg->i2c_bus,
-					ADP5585_GPO_OUT_MODE_A + bank,
+					ADP5585_GPO_DATA_OUT_A + bank,
 					reg_value);
 		if (ret != 0) {
 			goto out;

drivers/retained_mem/retained_mem_nrf_ram_ctrl.c

@@ -11,7 +11,7 @@
 
 #define _BUILD_MEM_REGION(node_id)		    \
 	{.dt_addr = DT_REG_ADDR(DT_PARENT(node_id)),\
-	 .dt_size = DT_REG_SIZE(DT_PARENT(node_id))}
+	 .dt_size = DT_REG_SIZE(DT_PARENT(node_id))},
 
 struct ret_mem_region {
 	uintptr_t dt_addr;

drivers/sensor/adi/adxl345/Kconfig

@@ -37,7 +37,6 @@ endchoice
 config ADXL345_STREAM
 	bool "Use FIFO to stream data"
 	select ADXL345_TRIGGER
-	default y
 	depends on SPI_RTIO
 	depends on SENSOR_ASYNC_API
 	help

drivers/sensor/adi/adxl345/adxl345.c

@@ -281,6 +281,7 @@ int adxl345_read_sample(const struct device *dev,
 {
 	int16_t raw_x, raw_y, raw_z;
 	uint8_t axis_data[6], status1;
+	struct adxl345_dev_data *data = dev->data;
 
 	if (!IS_ENABLED(CONFIG_ADXL345_TRIGGER)) {
 		do {
@@ -303,6 +304,9 @@ int adxl345_read_sample(const struct device *dev,
 	sample->y = raw_y;
 	sample->z = raw_z;
 
+	sample->selected_range = data->selected_range;
+	sample->is_full_res = data->is_full_res;
+
 	return 0;
 }
 
@@ -453,11 +457,13 @@ static int adxl345_init(const struct device *dev)
 		return -ENODEV;
 	}
 
+#if CONFIG_ADXL345_STREAM
 	rc = adxl345_reg_write_byte(dev, ADXL345_FIFO_CTL_REG, ADXL345_FIFO_STREAM_MODE);
 	if (rc < 0) {
 		LOG_ERR("FIFO enable failed\n");
 		return -EIO;
 	}
+#endif
 
 	rc = adxl345_reg_write_byte(dev, ADXL345_DATA_FORMAT_REG, ADXL345_RANGE_8G);
 	if (rc < 0) {

drivers/sensor/adi/adxl345/adxl345.h

@@ -202,6 +202,7 @@ struct adxl345_sample {
 	uint8_t res: 7;
 #endif /* CONFIG_ADXL345_STREAM */
 	uint8_t selected_range;
+	bool is_full_res;
 	int16_t x;
 	int16_t y;
 	int16_t z;

drivers/sensor/adi/adxl345/adxl345_decoder.c

@@ -6,17 +6,42 @@
 
 #include "adxl345.h"
 
-#ifdef CONFIG_ADXL345_STREAM
+/** The q-scale factor will always be the same, as the nominal LSB/g
+ * changes at the same rate the selected shift parameter per range:
+ *
+ * - At 2G: 256 LSB/g, 10-bits resolution.
+ * - At 4g: 128 LSB/g, 10-bits resolution.
+ * - At 8g: 64 LSB/g, 10-bits resolution.
+ * - At 16g 32 LSB/g, 10-bits resolution.
+ */
+static const uint32_t qscale_factor_no_full_res[] = {
+	/* (1.0 / Resolution-LSB-per-g * (2^31 / 2^5) * SENSOR_G / 1000000 */
+	[ADXL345_RANGE_2G] = UINT32_C(2570754),
+	/* (1.0 / Resolution-LSB-per-g) * (2^31 / 2^6) * SENSOR_G / 1000000  */
+	[ADXL345_RANGE_4G] = UINT32_C(2570754),
+	/* (1.0 / Resolution-LSB-per-g) * (2^31 / 2^7) ) * SENSOR_G / 1000000 */
+	[ADXL345_RANGE_8G] = UINT32_C(2570754),
+	/* (1.0 / Resolution-LSB-per-g) * (2^31 / 2^8) ) * SENSOR_G / 1000000 */
+	[ADXL345_RANGE_16G] = UINT32_C(2570754),
+};
 
-#define SENSOR_SCALING_FACTOR (SENSOR_G / (16 * 1000 / 100))
 
-static const uint32_t accel_period_ns[] = {
-	[ADXL345_ODR_12HZ] = UINT32_C(1000000000) / 12,
-	[ADXL345_ODR_25HZ] = UINT32_C(1000000000) / 25,
-	[ADXL345_ODR_50HZ] = UINT32_C(1000000000) / 50,
-	[ADXL345_ODR_100HZ] = UINT32_C(1000000000) / 100,
-	[ADXL345_ODR_200HZ] = UINT32_C(1000000000) / 200,
-	[ADXL345_ODR_400HZ] = UINT32_C(1000000000) / 400,
+/** Sensitivities based on Range:
+ *
+ * - At 2G: 256 LSB/g, 10-bits resolution.
+ * - At 4g: 256 LSB/g, 11-bits resolution.
+ * - At 8g: 256 LSB/g, 12-bits resolution.
+ * - At 16g 256 LSB/g, 13-bits resolution.
+ */
+static const uint32_t qscale_factor_full_res[] = {
+	/* (1.0 / Resolution-LSB-per-g) * (2^31 / 2^5) * SENSOR_G / 1000000 */
+	[ADXL345_RANGE_2G] = UINT32_C(2570754),
+	/* (1.0 / Resolution-LSB-per-g) * (2^31 / 2^6) * SENSOR_G / 1000000  */
+	[ADXL345_RANGE_4G] = UINT32_C(1285377),
+	/* (1.0 / Resolution-LSB-per-g) * (2^31 / 2^7) ) * SENSOR_G / 1000000 */
+	[ADXL345_RANGE_8G] = UINT32_C(642688),
+	/* (1.0 / Resolution-LSB-per-g) * (2^31 / 2^8) ) * SENSOR_G / 1000000 */
+	[ADXL345_RANGE_16G] = UINT32_C(321344),
 };
 
 static const uint32_t range_to_shift[] = {
@@ -26,30 +51,6 @@ static const uint32_t range_to_shift[] = {
 	[ADXL345_RANGE_16G] = 8,
 };
 
-/* (1 / sensitivity) * (pow(2,31) / pow(2,shift)) * (unit_scaler) */
-static const uint32_t qscale_factor_no_full_res[] = {
-	/* (1.0 / ADXL362_ACCEL_2G_LSB_PER_G) * (2^31 / 2^5) * SENSOR_G / 1000000 */
-	[ADXL345_RANGE_2G] = UINT32_C(2569011),
-	/* (1.0 / ADXL362_ACCEL_4G_LSB_PER_G) * (2^31 / 2^6) * SENSOR_G / 1000000  */
-	[ADXL345_RANGE_4G] = UINT32_C(642253),
-	/* (1.0 / ADXL362_ACCEL_8G_LSB_PER_G) * (2^31 / 2^7) ) * SENSOR_G / 1000000 */
-	[ADXL345_RANGE_8G] = UINT32_C(160563),
-	/* (1.0 / ADXL362_ACCEL_8G_LSB_PER_G) * (2^31 / 2^8) ) * SENSOR_G / 1000000 */
-	[ADXL345_RANGE_16G] = UINT32_C(40141),
-};
-
-/* (1 / sensitivity) * (pow(2,31) / pow(2,shift)) * (unit_scaler) */
-static const uint32_t qscale_factor_full_res[] = {
-	/* (1.0 / ADXL362_ACCEL_2G_LSB_PER_G) * (2^31 / 2^5) * SENSOR_G / 1000000 */
-	[ADXL345_RANGE_2G] = UINT32_C(2569011),
-	/* (1.0 / ADXL362_ACCEL_4G_LSB_PER_G) * (2^31 / 2^6) * SENSOR_G / 1000000  */
-	[ADXL345_RANGE_4G] = UINT32_C(1284506),
-	/* (1.0 / ADXL362_ACCEL_8G_LSB_PER_G) * (2^31 / 2^7) ) * SENSOR_G / 1000000 */
-	[ADXL345_RANGE_8G] = UINT32_C(642253),
-	/* (1.0 / ADXL362_ACCEL_8G_LSB_PER_G) * (2^31 / 2^8) ) * SENSOR_G / 1000000 */
-	[ADXL345_RANGE_16G] = UINT32_C(321126),
-};
-
 static inline void adxl345_accel_convert_q31(q31_t *out, int16_t sample, int32_t range,
 					uint8_t is_full_res)
 {
@@ -76,15 +77,28 @@ static inline void adxl345_accel_convert_q31(q31_t *out, int16_t sample, int32_t
 			}
 			break;
 		}
+		*out = sample * qscale_factor_full_res[range];
 	} else {
 		if (sample & BIT(9)) {
 			sample |= ADXL345_COMPLEMENT;
 		}
+		*out = sample * qscale_factor_no_full_res[range];
 	}
-
-	*out = sample * qscale_factor_no_full_res[range];
 }
 
+#ifdef CONFIG_ADXL345_STREAM
+
+#define SENSOR_SCALING_FACTOR (SENSOR_G / (16 * 1000 / 100))
+
+static const uint32_t accel_period_ns[] = {
+	[ADXL345_ODR_12HZ] = UINT32_C(1000000000) / 12,
+	[ADXL345_ODR_25HZ] = UINT32_C(1000000000) / 25,
+	[ADXL345_ODR_50HZ] = UINT32_C(1000000000) / 50,
+	[ADXL345_ODR_100HZ] = UINT32_C(1000000000) / 100,
+	[ADXL345_ODR_200HZ] = UINT32_C(1000000000) / 200,
+	[ADXL345_ODR_400HZ] = UINT32_C(1000000000) / 400,
+};
+
 static int adxl345_decode_stream(const uint8_t *buffer, struct sensor_chan_spec chan_spec,
 				 uint32_t *fit, uint16_t max_count, void *data_out)
 {
@@ -208,7 +222,12 @@ static int adxl345_decode_sample(const struct adxl345_sample *data,
 				 struct sensor_chan_spec chan_spec, uint32_t *fit,
 				 uint16_t max_count, void *data_out)
 {
-	struct sensor_value *out = (struct sensor_value *)data_out;
+	struct sensor_three_axis_data *out = (struct sensor_three_axis_data *)data_out;
+
+	memset(out, 0, sizeof(struct sensor_three_axis_data));
+	out->header.base_timestamp_ns = k_ticks_to_ns_floor64(k_uptime_ticks());
+	out->header.reading_count = 1;
+	out->shift = range_to_shift[data->selected_range];
 
 	if (*fit > 0) {
 		return -ENOTSUP;
@@ -216,9 +235,12 @@ static int adxl345_decode_sample(const struct adxl345_sample *data,
 
 	switch (chan_spec.chan_type) {
 	case SENSOR_CHAN_ACCEL_XYZ:
-		adxl345_accel_convert(out++, data->x);
-		adxl345_accel_convert(out++, data->y);
-		adxl345_accel_convert(out, data->z);
+		adxl345_accel_convert_q31(&out->readings->x, data->x, data->selected_range,
+					  data->is_full_res);
+		adxl345_accel_convert_q31(&out->readings->y, data->y, data->selected_range,
+					  data->is_full_res);
+		adxl345_accel_convert_q31(&out->readings->z, data->z, data->selected_range,
+					  data->is_full_res);
 		break;
 	default:
 		return -ENOTSUP;
@@ -226,7 +248,7 @@ static int adxl345_decode_sample(const struct adxl345_sample *data,
 
 	*fit = 1;
 
-	return 0;
+	return 1;
 }
 
 static int adxl345_decoder_decode(const uint8_t *buffer, struct sensor_chan_spec chan_spec,
@@ -259,10 +281,33 @@ static bool adxl345_decoder_has_trigger(const uint8_t *buffer, enum sensor_trigg
 	}
 }
 
+static int adxl345_get_size_info(struct sensor_chan_spec channel, size_t *base_size,
+				 size_t *frame_size)
+{
+	__ASSERT_NO_MSG(base_size != NULL);
+	__ASSERT_NO_MSG(frame_size != NULL);
+
+	if (channel.chan_type >= SENSOR_CHAN_ALL) {
+		return -ENOTSUP;
+	}
+
+	switch (channel.chan_type) {
+	case SENSOR_CHAN_ACCEL_XYZ:
+		*base_size = sizeof(struct sensor_three_axis_data);
+		*frame_size = sizeof(struct sensor_three_axis_sample_data);
+		return 0;
+	default:
+		break;
+	}
+
+	return -ENOTSUP;
+}
+
 SENSOR_DECODER_API_DT_DEFINE() = {
 	.get_frame_count = adxl345_decoder_get_frame_count,
 	.decode = adxl345_decoder_decode,
 	.has_trigger = adxl345_decoder_has_trigger,
+	.get_size_info = adxl345_get_size_info,
 };
 
 int adxl345_get_decoder(const struct device *dev, const struct sensor_decoder_api **decoder)

drivers/serial/uart_nrfx_uarte.c

@@ -2339,6 +2339,18 @@ static int uarte_instance_init(const struct device *dev,
 			     : UART_CFG_FLOW_CTRL_NONE,			       \
 	}
 
+/* Macro determines if PM actions are interrupt safe. They are in case of
+ * asynchronous API (except for instance in fast power domain) and non-asynchronous
+ * API if RX is disabled. Macro must resolve to a literal 1 or 0.
+ */
+#define UARTE_PM_ISR_SAFE(idx)						       \
+	COND_CODE_1(INSTANCE_IS_FAST_PD(_, /*empty*/, idx, _),		       \
+		    (0),						       \
+		    (COND_CODE_1(CONFIG_UART_##idx##_ASYNC,		       \
+				 (PM_DEVICE_ISR_SAFE),			       \
+				 (COND_CODE_1(UARTE_PROP(idx, disable_rx),     \
+					      (PM_DEVICE_ISR_SAFE), (0))))))   \
+
 #define UART_NRF_UARTE_DEVICE(idx)					       \
 	NRF_DT_CHECK_NODE_HAS_PINCTRL_SLEEP(UARTE(idx));		       \
 	UARTE_INT_DRIVEN(idx);						       \
@@ -2405,7 +2417,7 @@ static int uarte_instance_init(const struct device *dev,
 	}								       \
 									       \
 	PM_DEVICE_DT_DEFINE(UARTE(idx), uarte_nrfx_pm_action,		       \
-			    PM_DEVICE_ISR_SAFE);			       \
+			    UARTE_PM_ISR_SAFE(idx));			       \
 									       \
 	DEVICE_DT_DEFINE(UARTE(idx),					       \
 		      uarte_##idx##_init,				       \

drivers/spi/Kconfig

@@ -37,6 +37,24 @@ config SPI_RTIO
 	  This option enables the RTIO API calls. RTIO support is
 	  experimental as the API itself is unstable.
 
+if SPI_RTIO
+
+config SPI_RTIO_FALLBACK_MSGS
+	int "Number of available spi_buf structs for the default handler to use"
+	default 4
+	help
+		When RTIO is used with a driver that does not yet implement the submit API
+		natively the submissions are converted back to struct spi_buf values that
+		are given to spi_transfer. This requires some number of msgs be available to convert
+		the submissions into on the stack. MISRA rules dictate we must know this in
+		advance.
+
+		In all likelihood 4 is going to work for everyone, but in case you do end up with
+		an issue where you are using RTIO, your driver does not implement submit natively,
+		and get an error relating to not enough spi msgs this is the Kconfig to manipulate.
+
+endif # SPI_RTIO
+
 config SPI_SLAVE
 	bool "Slave support [EXPERIMENTAL]"
 	select EXPERIMENTAL

drivers/spi/spi_rtio.c

@@ -22,6 +22,7 @@ static void spi_rtio_iodev_default_submit_sync(struct rtio_iodev_sqe *iodev_sqe)
 {
 	struct spi_dt_spec *dt_spec = iodev_sqe->sqe.iodev->data;
 	const struct device *dev = dt_spec->bus;
+	uint8_t num_msgs = 0;
 	int err = 0;
 
 	LOG_DBG("Sync RTIO work item for: %p", (void *)dev);
@@ -33,67 +34,103 @@ static void spi_rtio_iodev_default_submit_sync(struct rtio_iodev_sqe *iodev_sqe)
 	struct rtio_iodev_sqe *txn_head = iodev_sqe;
 	struct rtio_iodev_sqe *txn_curr = iodev_sqe;
 
+	/* We allocate the spi_buf's on the stack, to do so
+	 * the count of messages needs to be determined to
+	 * ensure we don't go over the statically sized array.
+	 */
 	do {
+		switch (txn_curr->sqe.op) {
+		case RTIO_OP_RX:
+		case RTIO_OP_TX:
+		case RTIO_OP_TINY_TX:
+		case RTIO_OP_TXRX:
+			num_msgs++;
+			break;
+		default:
+			LOG_ERR("Invalid op code %d for submission %p", txn_curr->sqe.op,
+				(void *)&txn_curr->sqe);
+			err = -EIO;
+			break;
+		}
+		txn_curr = rtio_txn_next(txn_curr);
+	} while (err == 0 && txn_curr != NULL);
+
+	if (err != 0) {
+		rtio_iodev_sqe_err(txn_head, err);
+		return;
+	}
+
+	/* Allocate msgs on the stack, MISRA doesn't like VLAs so we need a statically
+	 * sized array here. It's pretty unlikely we have more than 4 spi messages
+	 * in a transaction as we typically would only have 2, one to write a
+	 * register address, and another to read/write the register into an array
+	 */
+	if (num_msgs > CONFIG_SPI_RTIO_FALLBACK_MSGS) {
+		LOG_ERR("At most CONFIG_SPI_RTIO_FALLBACK_MSGS"
+			" submissions in a transaction are"
+			" allowed in the default handler");
+		rtio_iodev_sqe_err(txn_head, -ENOMEM);
+		return;
+	}
+
+	struct spi_buf tx_bufs[CONFIG_SPI_RTIO_FALLBACK_MSGS];
+	struct spi_buf rx_bufs[CONFIG_SPI_RTIO_FALLBACK_MSGS];
+	struct spi_buf_set tx_buf_set = {
+		.buffers = tx_bufs,
+		.count = num_msgs,
+	};
+	struct spi_buf_set rx_buf_set = {
+		.buffers = rx_bufs,
+		.count = num_msgs,
+	};
+
+	txn_curr = txn_head;
+
+	for (size_t i = 0 ; i < num_msgs ; i++) {
 		struct rtio_sqe *sqe = &txn_curr->sqe;
-		struct spi_buf tx_buf = {0};
-		struct spi_buf_set tx_buf_set = {
-			.buffers = &tx_buf,
-		};
-
-		struct spi_buf rx_buf = {0};
-		struct spi_buf_set rx_buf_set = {
-			.buffers = &rx_buf,
-		};
-
-		LOG_DBG("Preparing transfer: %p", txn_curr);
 
 		switch (sqe->op) {
 		case RTIO_OP_RX:
-			rx_buf.buf = sqe->rx.buf;
-			rx_buf.len = sqe->rx.buf_len;
-			rx_buf_set.count = 1;
+			rx_bufs[i].buf = sqe->rx.buf;
+			rx_bufs[i].len = sqe->rx.buf_len;
+			tx_bufs[i].buf = NULL;
+			tx_bufs[i].len = sqe->rx.buf_len;
 			break;
 		case RTIO_OP_TX:
-			tx_buf.buf = (uint8_t *)sqe->tx.buf;
-			tx_buf.len = sqe->tx.buf_len;
-			tx_buf_set.count = 1;
+			rx_bufs[i].buf = NULL;
+			rx_bufs[i].len = sqe->tx.buf_len;
+			tx_bufs[i].buf = (uint8_t *)sqe->tx.buf;
+			tx_bufs[i].len = sqe->tx.buf_len;
 			break;
 		case RTIO_OP_TINY_TX:
-			tx_buf.buf = (uint8_t *)sqe->tiny_tx.buf;
-			tx_buf.len = sqe->tiny_tx.buf_len;
-			tx_buf_set.count = 1;
+			rx_bufs[i].buf = NULL;
+			rx_bufs[i].len = sqe->tiny_tx.buf_len;
+			tx_bufs[i].buf = (uint8_t *)sqe->tiny_tx.buf;
+			tx_bufs[i].len = sqe->tiny_tx.buf_len;
 			break;
 		case RTIO_OP_TXRX:
-			rx_buf.buf = sqe->txrx.rx_buf;
-			rx_buf.len = sqe->txrx.buf_len;
-			tx_buf.buf = (uint8_t *)sqe->txrx.tx_buf;
-			tx_buf.len = sqe->txrx.buf_len;
-			rx_buf_set.count = 1;
-			tx_buf_set.count = 1;
+			rx_bufs[i].buf = sqe->txrx.rx_buf;
+			rx_bufs[i].len = sqe->txrx.buf_len;
+			tx_bufs[i].buf = (uint8_t *)sqe->txrx.tx_buf;
+			tx_bufs[i].len = sqe->txrx.buf_len;
 			break;
 		default:
-			LOG_ERR("Invalid op code %d for submission %p\n", sqe->op, (void *)sqe);
 			err = -EIO;
 			break;
 		}
 
-		if (!err) {
-			struct spi_buf_set *tx_buf_ptr = tx_buf_set.count > 0 ? &tx_buf_set : NULL;
-			struct spi_buf_set *rx_buf_ptr = rx_buf_set.count > 0 ? &rx_buf_set : NULL;
+		txn_curr = rtio_txn_next(txn_curr);
+	}
 
-			err = spi_transceive_dt(dt_spec, tx_buf_ptr, rx_buf_ptr);
+	if (err == 0) {
+		__ASSERT_NO_MSG(num_msgs > 0);
+		err = spi_transceive_dt(dt_spec, &tx_buf_set, &rx_buf_set);
+	}
 
-			/* NULL if this submission is not a transaction */
-			txn_curr = rtio_txn_next(txn_curr);
-		}
-	} while (err >= 0 && txn_curr != NULL);
-
-	if (err < 0) {
-		LOG_ERR("Transfer failed: %d", err);
+	if (err != 0) {
 		rtio_iodev_sqe_err(txn_head, err);
 	} else {
-		LOG_DBG("Transfer OK: %d", err);
-		rtio_iodev_sqe_ok(txn_head, err);
+		rtio_iodev_sqe_ok(txn_head, 0);
 	}
 }
 

dts/arm/st/u5/stm32u5.dtsi

@@ -304,7 +304,7 @@
 			compatible = "zephyr,memory-region", "st,stm32-backup-sram";
 			reg = <0x40036400 DT_SIZE_K(2)>;
 			/* BKPSRAMEN and RAMCFGEN clock enable */
-			clocks = <&rcc STM32_CLOCK(AHB1, 28U)>;
+			clocks = <&rcc STM32_CLOCK_BUS_AHB1 ((1 << 28) | (1 << 17))>;
 			zephyr,memory-region = "BACKUP_SRAM";
 			status = "disabled";
 		};

dts/arm/st/u5/stm32u595.dtsi

@@ -106,7 +106,8 @@
 			num-bidir-endpoints = <9>;
 			ram-size = <4096>;
 			maximum-speed = "high-speed";
-			clocks = <&rcc STM32_CLOCK(AHB2, 15U)>,
+			/* Enable OTG_HS PHY and peripheral clocks (OTGHSPHYEN | OTGEN) */
+			clocks = <&rcc STM32_CLOCK_BUS_AHB2 ((1 << 15) | (1 << 14))>,
 				 <&rcc STM32_SRC_HSI48 ICKLK_SEL(0)>;
 			phys = <&otghs_phy>;
 			status = "disabled";

include/zephyr/logging/log_core.h

@@ -400,12 +400,12 @@ static inline char z_log_minimal_level_to_char(int level)
 #define LOG_FILTER_SLOT_GET(_filters, _id) \
 	((*(_filters) >> LOG_FILTER_SLOT_SHIFT(_id)) & LOG_FILTER_SLOT_MASK)
 
-#define LOG_FILTER_SLOT_SET(_filters, _id, _filter)		     \
-	do {							     \
-		*(_filters) &= ~(LOG_FILTER_SLOT_MASK <<	     \
-				 LOG_FILTER_SLOT_SHIFT(_id));	     \
-		*(_filters) |= ((_filter) & LOG_FILTER_SLOT_MASK) << \
-			       LOG_FILTER_SLOT_SHIFT(_id);	     \
+#define LOG_FILTER_SLOT_SET(_filters, _id, _filter)			      \
+	do {								      \
+		uint32_t others = *(_filters) & ~(LOG_FILTER_SLOT_MASK <<     \
+				 LOG_FILTER_SLOT_SHIFT(_id));		      \
+		*(_filters) = others | (((_filter) & LOG_FILTER_SLOT_MASK) << \
+			       LOG_FILTER_SLOT_SHIFT(_id));		      \
 	} while (false)
 
 #define LOG_FILTER_AGGR_SLOT_IDX 0

include/zephyr/net/net_if.h

@@ -94,6 +94,11 @@ struct net_if_addr {
 		struct {
 			/** Duplicate address detection (DAD) timer */
 			sys_snode_t dad_node;
+
+			/** DAD needed list node */
+			sys_snode_t dad_need_node;
+
+			/** DAD start time */
 			uint32_t dad_start;
 
 			/** How many times we have done DAD */
@@ -104,6 +109,11 @@ struct net_if_addr {
 		struct {
 			/** Address conflict detection (ACD) timer. */
 			sys_snode_t acd_node;
+
+			/** ACD needed list node */
+			sys_snode_t acd_need_node;
+
+			/** ACD timeout value. */
 			k_timepoint_t acd_timeout;
 
 			/** ACD probe/announcement counter. */

submanifests/optional.yaml

@@ -46,7 +46,7 @@ manifest:
       groups:
         - optional
     - name: tf-m-tests
-      revision: 502ea90105ee18f20c78f710e2ba2ded0fc0756e
+      revision: c712761dd5391bf3f38033643d28a736cae89a19
       path: modules/tee/tf-m/tf-m-tests
       remote: upstream
       groups:

subsys/logging/log_core.c

@@ -286,6 +286,14 @@ void log_core_init(void)
 	if (IS_ENABLED(CONFIG_LOG_RUNTIME_FILTERING)) {
 		z_log_runtime_filters_init();
 	}
+
+	STRUCT_SECTION_FOREACH(log_backend, backend) {
+		uint32_t id;
+		/* As first slot in filtering mask is reserved, backend ID has offset.*/
+		id = LOG_FILTER_FIRST_BACKEND_SLOT_IDX;
+		id += backend - log_backend_get(0);
+		log_backend_id_set(backend, id);
+	}
 }
 
 static uint32_t activate_foreach_backend(uint32_t mask)
@@ -329,12 +337,6 @@ static uint32_t z_log_init(bool blocking, bool can_sleep)
 	int backend_index = 0;
 
 	STRUCT_SECTION_FOREACH(log_backend, backend) {
-		uint32_t id;
-		/* As first slot in filtering mask is reserved, backend ID has offset.*/
-		id = LOG_FILTER_FIRST_BACKEND_SLOT_IDX;
-		id += backend - log_backend_get(0);
-		log_backend_id_set(backend, id);
-
 		/* Activate autostart backends */
 		if (backend->autostart) {
 			log_backend_init(backend);

subsys/net/ip/net_if.c

@@ -1324,8 +1324,9 @@ void net_if_ipv6_start_dad(struct net_if *iface,
 
 void net_if_start_dad(struct net_if *iface)
 {
-	struct net_if_addr *ifaddr;
+	struct net_if_addr *ifaddr, *next;
 	struct net_if_ipv6 *ipv6;
+	sys_slist_t dad_needed;
 	struct in6_addr addr = { };
 	int ret;
 
@@ -1357,6 +1358,8 @@ void net_if_start_dad(struct net_if *iface)
 	/* Start DAD for all the addresses that were added earlier when
 	 * the interface was down.
 	 */
+	sys_slist_init(&dad_needed);
+
 	ARRAY_FOR_EACH(ipv6->unicast, i) {
 		if (!ipv6->unicast[i].is_used ||
 		    ipv6->unicast[i].address.family != AF_INET6 ||
@@ -1366,9 +1369,21 @@ void net_if_start_dad(struct net_if *iface)
 			continue;
 		}
 
-		net_if_ipv6_start_dad(iface, &ipv6->unicast[i]);
+		sys_slist_prepend(&dad_needed, &ipv6->unicast[i].dad_need_node);
 	}
 
+	net_if_unlock(iface);
+
+	/* Start DAD for all the addresses without holding the iface lock
+	 * to avoid any possible mutex deadlock issues.
+	 */
+	SYS_SLIST_FOR_EACH_CONTAINER_SAFE(&dad_needed,
+					  ifaddr, next, dad_need_node) {
+		net_if_ipv6_start_dad(iface, ifaddr);
+	}
+
+	return;
+
 out:
 	net_if_unlock(iface);
 }
@@ -1415,7 +1430,10 @@ void net_if_ipv6_dad_failed(struct net_if *iface, const struct in6_addr *addr)
 	net_if_ipv6_addr_rm(iface, addr);
 
 	if (IS_ENABLED(CONFIG_NET_IPV6_PE) && iface->pe_enabled) {
+		net_if_unlock(iface);
+
 		net_ipv6_pe_start(iface, addr, timeout, preferred_lifetime);
+		return;
 	}
 
 out:
@@ -1519,6 +1537,8 @@ void net_if_start_rs(struct net_if *iface)
 		goto out;
 	}
 
+	net_if_unlock(iface);
+
 	NET_DBG("Starting ND/RS for iface %p", iface);
 
 	if (!net_ipv6_start_rs(iface)) {
@@ -1534,6 +1554,7 @@ void net_if_start_rs(struct net_if *iface)
 		}
 	}
 
+	return;
 out:
 	net_if_unlock(iface);
 }
@@ -1941,6 +1962,7 @@ struct net_if_addr *net_if_ipv6_addr_add(struct net_if *iface,
 {
 	struct net_if_addr *ifaddr = NULL;
 	struct net_if_ipv6 *ipv6;
+	bool do_dad = false;
 
 	net_if_lock(iface);
 
@@ -1992,8 +2014,7 @@ struct net_if_addr *net_if_ipv6_addr_add(struct net_if *iface,
 			 */
 			join_mcast_nodes(iface,
 					 &ipv6->unicast[i].address.in6_addr);
-
-			net_if_ipv6_start_dad(iface, &ipv6->unicast[i]);
+			do_dad = true;
 		} else {
 			/* If DAD is not done for point-to-point links, then
 			 * the address is usable immediately.
@@ -2007,9 +2028,17 @@ struct net_if_addr *net_if_ipv6_addr_add(struct net_if *iface,
 			sizeof(struct in6_addr));
 
 		ifaddr = &ipv6->unicast[i];
-		goto out;
+		break;
 	}
 
+	net_if_unlock(iface);
+
+	if (ifaddr != NULL && do_dad) {
+		net_if_ipv6_start_dad(iface, ifaddr);
+	}
+
+	return ifaddr;
+
 out:
 	net_if_unlock(iface);
 
@@ -4179,7 +4208,9 @@ void net_if_ipv4_start_acd(struct net_if *iface, struct net_if_addr *ifaddr)
 
 void net_if_start_acd(struct net_if *iface)
 {
+	struct net_if_addr *ifaddr, *next;
 	struct net_if_ipv4 *ipv4;
+	sys_slist_t acd_needed;
 	int ret;
 
 	net_if_lock(iface);
@@ -4201,6 +4232,11 @@ void net_if_start_acd(struct net_if *iface)
 
 	ipv4->conflict_cnt = 0;
 
+	/* Start ACD for all the addresses that were added earlier when
+	 * the interface was down.
+	 */
+	sys_slist_init(&acd_needed);
+
 	/* Start ACD for all the addresses that were added earlier when
 	 * the interface was down.
 	 */
@@ -4212,9 +4248,21 @@ void net_if_start_acd(struct net_if *iface)
 			continue;
 		}
 
-		net_if_ipv4_start_acd(iface, &ipv4->unicast[i].ipv4);
+		sys_slist_prepend(&acd_needed, &ipv4->unicast[i].ipv4.acd_need_node);
 	}
 
+	net_if_unlock(iface);
+
+	/* Start ACD for all the addresses without holding the iface lock
+	 * to avoid any possible mutex deadlock issues.
+	 */
+	SYS_SLIST_FOR_EACH_CONTAINER_SAFE(&acd_needed,
+					  ifaddr, next, acd_need_node) {
+		net_if_ipv4_start_acd(iface, ifaddr);
+	}
+
+	return;
+
 out:
 	net_if_unlock(iface);
 }
@@ -4306,7 +4354,8 @@ struct net_if_addr *net_if_ipv4_addr_add(struct net_if *iface,
 
 		if (!(l2_flags_get(iface) & NET_L2_POINT_TO_POINT) &&
 		    !net_ipv4_is_addr_loopback(addr)) {
-			net_if_ipv4_start_acd(iface, ifaddr);
+			/* ACD is started after the lock is released. */
+			;
 		} else {
 			ifaddr->addr_state = NET_ADDR_PREFERRED;
 		}
@@ -4314,7 +4363,12 @@ struct net_if_addr *net_if_ipv4_addr_add(struct net_if *iface,
 		net_mgmt_event_notify_with_info(NET_EVENT_IPV4_ADDR_ADD, iface,
 						&ifaddr->address.in_addr,
 						sizeof(struct in_addr));
-		goto out;
+
+		net_if_unlock(iface);
+
+		net_if_ipv4_start_acd(iface, ifaddr);
+
+		return ifaddr;
 	}
 
 out:

subsys/net/lib/coap/coap_server.c

@@ -658,6 +658,12 @@ int coap_resource_parse_observe(struct coap_resource *resource, const struct coa
 		ret = coap_service_remove_observer(service, resource, addr, token, tkl);
 		if (ret < 0) {
 			LOG_WRN("Failed to remove observer (%d)", ret);
+			goto unlock;
+		}
+
+		if (ret == 0) {
+			/* Observer not found */
+			ret = -ENOENT;
 		}
 	}
 

west.yml

@@ -280,7 +280,7 @@ manifest:
       revision: 2b498e6f36d6b82ae1da12c8b7742e318624ecf5
       path: modules/lib/gui/lvgl
     - name: mbedtls
-      revision: a78176c6ff0733ba08018cba4447bd3f20de7978
+      revision: 5f889934359deccf421554c7045a8381ef75298f
       path: modules/crypto/mbedtls
       groups:
         - crypto
@@ -327,7 +327,7 @@ manifest:
       groups:
         - crypto
     - name: trusted-firmware-m
-      revision: 8134106ef9cb3df60e8bd22b172532558e936bd2
+      revision: e2288c13ee0abc16163186523897e7910b03dd31
       path: modules/tee/tf-m/trusted-firmware-m
       groups:
         - tee