mgmt: hawkbit: remove hb_context.status_buffer_size

remove hb_context.status_buffer_size and replace it with
sizeof(hb_context.status_buffer), because hb_context.status_buffer_size
is never set.

Signed-off-by: Fin Maaß <f.maass@vogl-electronic.com>
(cherry picked from commit 1bea938c9f)

arch/posix/CMakeLists.txt

@@ -3,7 +3,7 @@
 if(EXISTS ${CMAKE_CURRENT_LIST_DIR}/${CMAKE_HOST_SYSTEM_NAME}.${CMAKE_HOST_SYSTEM_PROCESSOR}.cmake)
   # @Intent: Set necessary compiler & linker options for this specific host architecture & OS
   include(${CMAKE_HOST_SYSTEM_NAME}.${CMAKE_HOST_SYSTEM_PROCESSOR}.cmake)
-else()
+else() # Linux.x86_64
   if (CONFIG_64BIT)
     # some gcc versions fail to build without -fPIC
     zephyr_compile_options(-m64 -fPIC)
@@ -11,6 +11,13 @@ else()
   else ()
     zephyr_compile_options(-m32)
     zephyr_link_libraries(-m32)
+
+    # When building for 32bits x86, gcc defaults to using the old 8087 float arithmetic
+    # which causes some issues with literal float comparisons. So we set it
+    # to use the SSE2 float path instead
+    # (clang defaults to use SSE, but, setting this option for it is safe)
+    check_set_compiler_property(APPEND PROPERTY fpsse2 "SHELL:-msse2 -mfpmath=sse")
+    zephyr_compile_options($<TARGET_PROPERTY:compiler,fpsse2>)
   endif ()
 endif()
 

boards/x86/qemu_x86/qemu_x86_tiny.ld

@@ -788,14 +788,9 @@ SECTIONS
 	__kernel_ram_end = KERNEL_BASE_ADDR + KERNEL_RAM_SIZE;
 	__kernel_ram_size = __kernel_ram_end - __kernel_ram_start;
 
-	_image_ram_end = .;
 	_image_ram_all = (KERNEL_BASE_ADDR + KERNEL_RAM_SIZE) - _image_ram_start;
 
-	z_mapped_end = .;
 	z_mapped_size = z_mapped_end - z_mapped_start;
-	_end = .; /* end of image */
-
-	GROUP_END(RAMABLE_REGION)
 
 #ifndef LINKER_ZEPHYR_FINAL
 	/* static interrupts */
@@ -823,6 +818,12 @@ SECTIONS
  */
 #include <snippets-sections.ld>
 
+#define LAST_RAM_ALIGN MMU_PAGE_ALIGN
+
+#include <zephyr/linker/ram-end.ld>
+
+    GROUP_END(RAMABLE_REGION)
+
 #include <zephyr/linker/debug-sections.ld>
 
 	/DISCARD/ : { *(.note.GNU-stack) }

cmake/linker_script/arm/linker.cmake

@@ -135,6 +135,8 @@ if(NOT CONFIG_USERSPACE)
   zephyr_linker_section_configure(SECTION .noinit INPUT ".kernel_noinit.*")
 endif()
 
+include(${COMMON_ZEPHYR_LINKER_DIR}/ram-end.cmake)
+
 zephyr_linker_symbol(OBJECT REGION_RAM SYMBOL __kernel_ram_start EXPR "(@__bss_start@)")
 zephyr_linker_symbol(OBJECT REGION_RAM SYMBOL __kernel_ram_end  EXPR "(${RAM_ADDR} + ${RAM_SIZE})")
 zephyr_linker_symbol(OBJECT REGION_RAM SYMBOL __kernel_ram_size EXPR "(@__kernel_ram_end@ - @__bss_start@)")

cmake/linker_script/common/ram-end.cmake

@@ -0,0 +1,7 @@
+zephyr_linker_section(NAME .last_ram_section VMA RAM LMA RAM_REGION TYPE BSS)
+zephyr_linker_section_configure(
+  SECTION .last_ram_section
+  INPUT ""
+  SYMBOLS _end z_mapped_end
+  KEEP
+  )

cmake/modules/dts.cmake

@@ -134,7 +134,7 @@ set(VENDOR_PREFIXES             dts/bindings/vendor-prefixes.txt)
 set_ifndef(DTS_SOURCE ${BOARD_DIR}/${BOARD}.dts)
 if(EXISTS ${DTS_SOURCE})
   # We found a devicetree. Check for a board revision overlay.
-  if(BOARD_REVISION AND EXISTS ${BOARD_DIR}/${BOARD}_${BOARD_REVISION_STRING}.overlay)
+  if(DEFINED BOARD_REVISION AND EXISTS ${BOARD_DIR}/${BOARD}_${BOARD_REVISION_STRING}.overlay)
     list(APPEND DTS_SOURCE ${BOARD_DIR}/${BOARD}_${BOARD_REVISION_STRING}.overlay)
   endif()
 else()

doc/kernel/services/index.rst

@@ -59,7 +59,7 @@ Object            Bidirectional?      Data structure         Data item size
 FIFO              No                  Queue                  Arbitrary [1]              4 B [2]   Yes [3]            Yes             N/A
 LIFO              No                  Queue                  Arbitrary [1]              4 B [2]   Yes [3]            Yes             N/A
 Stack             No                  Array                  Word                          Word   Yes [3]            Yes             Undefined behavior
-Message queue     No                  Ring buffer            Power of two          Power of two   Yes [3]            Yes             Pend thread or return -errno
+Message queue     No                  Ring buffer            Arbitrary [6]         Power of two   Yes [3]            Yes             Pend thread or return -errno
 Mailbox           Yes                 Queue                  Arbitrary [1]            Arbitrary   No                 No              N/A
 Pipe              No                  Ring buffer [4]        Arbitrary                Arbitrary   Yes [5]            Yes [5]         Pend thread or return -errno
 ===============   ==============      ===================    ==============      ==============   =================  ==============  ===============================
@@ -79,6 +79,8 @@ argument.
 [5] ISRS can send and/or receive only when passing K_NO_WAIT as the
 timeout argument.
 
+[6] Data item size must be a multiple of the data alignment.
+
 .. toctree::
    :maxdepth: 1
 

doc/services/device_mgmt/smp_groups/smp_group_0.rst

@@ -16,7 +16,7 @@ OS management group defines following commands:
     | ``1``             | Console/Terminal echo control;                |
     |                   | unimplemented by Zephyr                       |
     +-------------------+-----------------------------------------------+
-    | ``2``             | Statistics                                    |
+    | ``2``             | Task Statistics                               |
     +-------------------+-----------------------------------------------+
     | ``3``             | Memory pool statistics                        |
     +-------------------+-----------------------------------------------+
@@ -410,7 +410,7 @@ Date-time set response header fields:
     +--------+--------------+----------------+
     | ``OP`` | ``Group ID`` | ``Command ID`` |
     +========+==============+================+
-    | ``1``  | ``0``        |  ``4``         |
+    | ``3``  | ``0``        |  ``4``         |
     +--------+--------------+----------------+
 
 The command sends an empty CBOR map as data if successful. In case of error the
@@ -543,7 +543,7 @@ MCUmgr parameters response header fields
     +--------+--------------+----------------+
     | ``OP`` | ``Group ID`` | ``Command ID`` |
     +========+==============+================+
-    | ``2``  | ``0``        |  ``6``         |
+    | ``1``  | ``0``        |  ``6``         |
     +--------+--------------+----------------+
 
 CBOR data of successful response:
@@ -646,7 +646,7 @@ OS/Application info response header fields
     +--------+--------------+----------------+
     | ``OP`` | ``Group ID`` | ``Command ID`` |
     +========+==============+================+
-    | ``2``  | ``0``        |  ``7``         |
+    | ``1``  | ``0``        |  ``7``         |
     +--------+--------------+----------------+
 
 CBOR data of response:

doc/services/device_mgmt/smp_groups/smp_group_1.rst

@@ -219,7 +219,6 @@ Set state of image request header fields:
 
 CBOR data of request:
 
-
 .. code-block:: none
 
     {

doc/services/portability/posix.rst

@@ -97,7 +97,7 @@ Zephyr.
     _POSIX_THREAD_ATTR_STACKADDR,yes
     _POSIX_THREAD_ATTR_STACKSIZE,yes
     _POSIX_THREAD_CPUTIME,
-    _POSIX_THREAD_PRIO_INHERIT,yes
+    _POSIX_THREAD_PRIO_INHERIT,
     _POSIX_THREAD_PRIO_PROTECT,
     _POSIX_THREAD_PRIORITY_SCHEDULING,yes
     _POSIX_THREAD_SPORADIC_SERVER,
@@ -151,8 +151,8 @@ multiple processes.
     pthread_cond_signal(),yes
     pthread_cond_timedwait(),yes
     pthread_cond_wait(),yes
-    pthread_condattr_destroy(),
-    pthread_condattr_init(),
+    pthread_condattr_destroy(),yes
+    pthread_condattr_init(),yes
     pthread_create(),yes
     pthread_detach(),yes
     pthread_equal(),
@@ -167,8 +167,8 @@ multiple processes.
     pthread_mutex_lock(),yes
     pthread_mutex_trylock(),yes
     pthread_mutex_unlock(),yes
-    pthread_mutexattr_destroy(),
-    pthread_mutexattr_init(),
+    pthread_mutexattr_destroy(),yes
+    pthread_mutexattr_init(),yes
     pthread_once(),yes
     pthread_self(),yes
     pthread_setcancelstate(),yes
@@ -430,7 +430,7 @@ POSIX_DEVICE_IO
     read(),yes
     scanf(),
     setbuf(),
-    etvbuf(),
+    setvbuf(),
     stderr,yes
     stdin,yes
     stdout,yes

drivers/adc/adc_mcux_lpadc.c

@@ -238,8 +238,8 @@ static int mcux_lpadc_start_read(const struct device *dev,
 			} else {
 				/* End of chain */
 				data->cmd_config[channel].chainedNextCommandNumber = 0;
-				last_enabled = channel;
 			}
+			last_enabled = channel;
 			LPADC_SetConvCommandConfig(config->base,
 				channel + 1, &data->cmd_config[channel]);
 		}

drivers/can/can_loopback.c

@@ -211,7 +211,7 @@ static void can_loopback_remove_rx_filter(const struct device *dev, int filter_i
 {
 	struct can_loopback_data *data = dev->data;
 
-	if (filter_id >= ARRAY_SIZE(data->filters)) {
+	if (filter_id < 0 || filter_id >= ARRAY_SIZE(data->filters)) {
 		LOG_ERR("filter ID %d out-of-bounds", filter_id);
 		return;
 	}

drivers/can/can_mcan.c

@@ -477,6 +477,7 @@ static void can_mcan_tx_event_handler(const struct device *dev)
 	struct can_mcan_data *data = dev->data;
 	struct can_mcan_tx_event_fifo tx_event;
 	can_tx_callback_t tx_cb;
+	void *user_data;
 	uint32_t event_idx;
 	uint32_t tx_idx;
 	uint32_t txefs;
@@ -507,12 +508,14 @@ static void can_mcan_tx_event_handler(const struct device *dev)
 			return;
 		}
 
-		k_sem_give(&data->tx_sem);
-
 		__ASSERT_NO_MSG(tx_idx <= cbs->num_tx);
 		tx_cb = cbs->tx[tx_idx].function;
+		user_data = cbs->tx[tx_idx].user_data;
 		cbs->tx[tx_idx].function = NULL;
-		tx_cb(dev, 0, cbs->tx[tx_idx].user_data);
+
+		k_sem_give(&data->tx_sem);
+
+		tx_cb(dev, 0, user_data);
 
 		err = can_mcan_read_reg(dev, CAN_MCAN_TXEFS, &txefs);
 		if (err != 0) {
@@ -822,11 +825,11 @@ int can_mcan_send(const struct device *dev, const struct can_frame *frame, k_tim
 #endif /* !CONFIG_CAN_FD_MODE */
 		.efc = 1U,
 	};
-	uint32_t put_idx;
+	uint32_t put_idx = -1;
 	uint32_t reg;
 	int err;
 
-	LOG_DBG("Sending %d bytes. Id: 0x%x, ID type: %s %s %s %s", data_length, frame->id,
+	LOG_DBG("Sending %zu bytes. Id: 0x%x, ID type: %s %s %s %s", data_length, frame->id,
 		(frame->flags & CAN_FRAME_IDE) != 0U ? "extended" : "standard",
 		(frame->flags & CAN_FRAME_RTR) != 0U ? "RTR" : "",
 		(frame->flags & CAN_FRAME_FDF) != 0U ? "FD frame" : "",
@@ -888,16 +891,16 @@ int can_mcan_send(const struct device *dev, const struct can_frame *frame, k_tim
 		return -EAGAIN;
 	}
 
-	err = can_mcan_read_reg(dev, CAN_MCAN_TXFQS, &reg);
-	if (err != 0) {
-		return err;
-	}
-
-	__ASSERT_NO_MSG((reg & CAN_MCAN_TXFQS_TFQF) != CAN_MCAN_TXFQS_TFQF);
-
 	k_mutex_lock(&data->tx_mtx, K_FOREVER);
 
-	put_idx = FIELD_GET(CAN_MCAN_TXFQS_TFQPI, reg);
+	/* Acquire a free TX buffer */
+	for (int i = 0; i < cbs->num_tx; i++) {
+		if (cbs->tx[i].function == NULL) {
+			put_idx = i;
+			break;
+		}
+	}
+
 	tx_hdr.mm = put_idx;
 
 	if ((frame->flags & CAN_FRAME_IDE) != 0U) {
@@ -912,7 +915,7 @@ int can_mcan_send(const struct device *dev, const struct can_frame *frame, k_tim
 				  &tx_hdr, sizeof(struct can_mcan_tx_buffer_hdr));
 	if (err != 0) {
 		LOG_ERR("failed to write Tx Buffer header (err %d)", err);
-		return err;
+		goto err_unlock;
 	}
 
 	err = can_mcan_write_mram(dev, config->mram_offsets[CAN_MCAN_MRAM_CFG_TX_BUFFER] + put_idx *
@@ -921,20 +924,25 @@ int can_mcan_send(const struct device *dev, const struct can_frame *frame, k_tim
 				  &frame->data_32, ROUND_UP(data_length, sizeof(uint32_t)));
 	if (err != 0) {
 		LOG_ERR("failed to write Tx Buffer data (err %d)", err);
-		return err;
+		goto err_unlock;
 	}
 
-	__ASSERT_NO_MSG(put_idx <= cbs->num_tx);
+	__ASSERT_NO_MSG(put_idx < cbs->num_tx);
 	cbs->tx[put_idx].function = callback;
 	cbs->tx[put_idx].user_data = user_data;
 
 	err = can_mcan_write_reg(dev, CAN_MCAN_TXBAR, BIT(put_idx));
 	if (err != 0) {
-		goto unlock;
+		cbs->tx[put_idx].function = NULL;
+		goto err_unlock;
 	}
 
-unlock:
 	k_mutex_unlock(&data->tx_mtx);
+	return 0;
+
+err_unlock:
+	k_mutex_unlock(&data->tx_mtx);
+	k_sem_give(&data->tx_sem);
 
 	return err;
 }
@@ -1102,12 +1110,17 @@ void can_mcan_remove_rx_filter(const struct device *dev, int filter_id)
 	struct can_mcan_data *data = dev->data;
 	int err;
 
+	if (filter_id < 0) {
+		LOG_ERR("filter ID %d out of bounds", filter_id);
+		return;
+	}
+
 	k_mutex_lock(&data->lock, K_FOREVER);
 
 	if (filter_id >= cbs->num_std) {
 		filter_id -= cbs->num_std;
 		if (filter_id >= cbs->num_ext) {
-			LOG_ERR("Wrong filter id");
+			LOG_ERR("filter ID %d out of bounds", filter_id);
 			k_mutex_unlock(&data->lock);
 			return;
 		}
@@ -1454,7 +1467,7 @@ int can_mcan_init(const struct device *dev)
 		return err;
 	}
 
-	reg = CAN_MCAN_ILS_RF0NL | CAN_MCAN_ILS_RF1NL;
+	reg = CAN_MCAN_ILS_RF0NL | CAN_MCAN_ILS_RF1NL | CAN_MCAN_ILS_RF0LL | CAN_MCAN_ILS_RF1LL;
 	err = can_mcan_write_reg(dev, CAN_MCAN_ILS, reg);
 	if (err != 0) {
 		return err;

drivers/can/can_mcp2515.c

@@ -673,6 +673,11 @@ static void mcp2515_remove_rx_filter(const struct device *dev, int filter_id)
 {
 	struct mcp2515_data *dev_data = dev->data;
 
+	if (filter_id < 0 || filter_id >= CONFIG_CAN_MAX_FILTER) {
+		LOG_ERR("filter ID %d out of bounds", filter_id);
+		return;
+	}
+
 	k_mutex_lock(&dev_data->mutex, K_FOREVER);
 	dev_data->filter_usage &= ~BIT(filter_id);
 	k_mutex_unlock(&dev_data->mutex);

drivers/can/can_mcux_flexcan.c

@@ -426,7 +426,7 @@ static int mcux_flexcan_stop(const struct device *dev)
 
 static int mcux_flexcan_set_mode(const struct device *dev, can_mode_t mode)
 {
-	can_mode_t supported = CAN_MODE_LOOPBACK | CAN_MODE_LISTENONLY;
+	can_mode_t supported = CAN_MODE_LOOPBACK | CAN_MODE_LISTENONLY | CAN_MODE_3_SAMPLES;
 	const struct mcux_flexcan_config *config = dev->config;
 	struct mcux_flexcan_data *data = dev->data;
 	uint32_t ctrl1;
@@ -921,9 +921,8 @@ static void mcux_flexcan_remove_rx_filter(const struct device *dev, int filter_i
 {
 	struct mcux_flexcan_data *data = dev->data;
 
-	if (filter_id >= MCUX_FLEXCAN_MAX_RX) {
-		LOG_ERR("Detach: Filter id >= MAX_RX (%d >= %d)", filter_id,
-			MCUX_FLEXCAN_MAX_RX);
+	if (filter_id < 0 || filter_id >= MCUX_FLEXCAN_MAX_RX) {
+		LOG_ERR("filter ID %d out of bounds", filter_id);
 		return;
 	}
 
@@ -1222,9 +1221,9 @@ static int mcux_flexcan_init(const struct device *dev)
 				data->timing_data.phase_seg2);
 			LOG_DBG("Sample-point err : %d", err);
 		} else {
-			data->timing_data.prop_seg = config->prop_seg;
-			data->timing_data.phase_seg1 = config->phase_seg1;
-			data->timing_data.phase_seg2 = config->phase_seg2;
+			data->timing_data.prop_seg = config->prop_seg_data;
+			data->timing_data.phase_seg1 = config->phase_seg1_data;
+			data->timing_data.phase_seg2 = config->phase_seg2_data;
 			err = can_calc_prescaler(dev, &data->timing_data, config->bitrate_data);
 			if (err) {
 				LOG_WRN("Bitrate error: %d", err);

drivers/can/can_native_posix_linux.c

@@ -239,6 +239,7 @@ static void can_npl_remove_rx_filter(const struct device *dev, int filter_id)
 	struct can_npl_data *data = dev->data;
 
 	if (filter_id < 0 || filter_id >= ARRAY_SIZE(data->filters)) {
+		LOG_ERR("filter ID %d out of bounds");
 		return;
 	}
 

drivers/can/can_nxp_s32_canxl.c

@@ -396,7 +396,10 @@ static void can_nxp_s32_remove_rx_filter(const struct device *dev, int filter_id
 	struct can_nxp_s32_data *data = dev->data;
 	int mb_indx = ALLOC_IDX_TO_RXMB_IDX(filter_id);
 
-	__ASSERT_NO_MSG(filter_id >= 0 && filter_id < CONFIG_CAN_NXP_S32_MAX_RX);
+	if (filter_id < 0 || filter_id >= CONFIG_CAN_NXP_S32_MAX_RX) {
+		LOG_ERR("filter ID %d out of bounds", filter_id);
+		return;
+	}
 
 	k_mutex_lock(&data->rx_mutex, K_FOREVER);
 

drivers/can/can_rcar.c

@@ -973,7 +973,8 @@ static void can_rcar_remove_rx_filter(const struct device *dev, int filter_id)
 {
 	struct can_rcar_data *data = dev->data;
 
-	if (filter_id >= CONFIG_CAN_RCAR_MAX_FILTER) {
+	if (filter_id < 0 || filter_id >= CONFIG_CAN_RCAR_MAX_FILTER) {
+		LOG_ERR("filter ID %d out of bounds", filter_id);
 		return;
 	}
 

drivers/can/can_sja1000.c

@@ -58,6 +58,14 @@ static inline int can_sja1000_enter_reset_mode(const struct device *dev)
 	return 0;
 }
 
+static inline void can_sja1000_leave_reset_mode_nowait(const struct device *dev)
+{
+	uint8_t mod;
+
+	mod = can_sja1000_read_reg(dev, CAN_SJA1000_MOD);
+	can_sja1000_write_reg(dev, CAN_SJA1000_MOD, mod & ~(CAN_SJA1000_MOD_RM));
+}
+
 static inline int can_sja1000_leave_reset_mode(const struct device *dev)
 {
 	int retries = CAN_SJA1000_RESET_MODE_RETRIES;
@@ -609,7 +617,7 @@ static void can_sja1000_handle_error_warning_irq(const struct device *dev)
 		can_sja1000_tx_done(dev, -ENETUNREACH);
 #ifdef CONFIG_CAN_AUTO_BUS_OFF_RECOVERY
 		if (data->started) {
-			(void)can_sja1000_leave_reset_mode(dev);
+			can_sja1000_leave_reset_mode_nowait(dev);
 		}
 #endif /* CONFIG_CAN_AUTO_BUS_OFF_RECOVERY */
 	} else if ((sr & CAN_SJA1000_SR_ES) != 0) {

drivers/can/can_stm32.c

@@ -990,7 +990,10 @@ static void can_stm32_remove_rx_filter(const struct device *dev, int filter_id)
 	int bank_num;
 	bool bank_unused;
 
-	__ASSERT_NO_MSG(filter_id >= 0 && filter_id < CAN_STM32_MAX_FILTER_ID);
+	if (filter_id < 0 || filter_id >= CAN_STM32_MAX_FILTER_ID) {
+		LOG_ERR("filter ID %d out of bounds", filter_id);
+		return;
+	}
 
 	k_mutex_lock(&filter_mutex, K_FOREVER);
 	k_mutex_lock(&data->inst_mutex, K_FOREVER);
@@ -1069,10 +1072,10 @@ static const struct can_driver_api can_api_funcs = {
 		.prescaler = 0x01
 	},
 	.timing_max = {
-		.sjw = 0x07,
+		.sjw = 0x04,
 		.prop_seg = 0x00,
-		.phase_seg1 = 0x0F,
-		.phase_seg2 = 0x07,
+		.phase_seg1 = 0x10,
+		.phase_seg2 = 0x08,
 		.prescaler = 0x400
 	}
 };
@@ -1134,8 +1137,8 @@ static const struct can_stm32_config can_stm32_cfg_##inst = {            \
 	},                                                               \
 	.config_irq = config_can_##inst##_irq,                           \
 	.pcfg = PINCTRL_DT_INST_DEV_CONFIG_GET(inst),	                 \
-	.phy = DEVICE_DT_GET_OR_NULL(DT_INST_PHANDLE(id, phys)),         \
-	.max_bitrate = DT_INST_CAN_TRANSCEIVER_MAX_BITRATE(id, 1000000), \
+	.phy = DEVICE_DT_GET_OR_NULL(DT_INST_PHANDLE(inst, phys)),       \
+	.max_bitrate = DT_INST_CAN_TRANSCEIVER_MAX_BITRATE(inst, 1000000), \
 };
 
 #define CAN_STM32_DATA_INST(inst) \

drivers/can/can_stm32h7.c

@@ -21,6 +21,7 @@ LOG_MODULE_REGISTER(can_stm32h7, CONFIG_CAN_LOG_LEVEL);
 
 struct can_stm32h7_config {
 	mm_reg_t base;
+	mem_addr_t mrba;
 	mem_addr_t mram;
 	void (*config_irq)(void);
 	const struct pinctrl_dev_config *pcfg;
@@ -132,7 +133,7 @@ static int can_stm32h7_init(const struct device *dev)
 		return ret;
 	}
 
-	ret = can_mcan_configure_mram(dev, stm32h7_cfg->mram, stm32h7_cfg->mram);
+	ret = can_mcan_configure_mram(dev, stm32h7_cfg->mrba, stm32h7_cfg->mram);
 	if (ret != 0) {
 		return ret;
 	}
@@ -205,6 +206,7 @@ static const struct can_mcan_ops can_stm32h7_ops = {
 									    \
 	static const struct can_stm32h7_config can_stm32h7_cfg_##n = {	    \
 		.base = CAN_MCAN_DT_INST_MCAN_ADDR(n),			    \
+		.mrba = CAN_MCAN_DT_INST_MRBA(n),			    \
 		.mram = CAN_MCAN_DT_INST_MRAM_ADDR(n),			    \
 		.config_irq = stm32h7_mcan_irq_config_##n,		    \
 		.pcfg = PINCTRL_DT_INST_DEV_CONFIG_GET(n),		    \

drivers/espi/espi_mchp_xec.c

@@ -647,6 +647,11 @@ static int espi_xec_flash_write(const struct device *dev,
 
 	LOG_DBG("%s", __func__);
 
+	if (sizeof(target_mem) < pckt->len) {
+		LOG_ERR("Packet length is too big");
+		return -ENOMEM;
+	}
+
 	if (!(ESPI_FC_REGS->STS & MCHP_ESPI_FC_STS_CHAN_EN)) {
 		LOG_ERR("Flash channel is disabled");
 		return -EIO;

drivers/espi/espi_mchp_xec_v2.c

@@ -524,6 +524,11 @@ static int espi_xec_flash_write(const struct device *dev,
 
 	LOG_DBG("%s", __func__);
 
+	if (sizeof(target_mem) < pckt->len) {
+		LOG_ERR("Packet length is too big");
+		return -ENOMEM;
+	}
+
 	if (!(regs->FCSTS & MCHP_ESPI_FC_STS_CHAN_EN)) {
 		LOG_ERR("Flash channel is disabled");
 		return -EIO;

drivers/flash/spi_nor.c

@@ -774,7 +774,7 @@ static int spi_nor_erase(const struct device *dev, off_t addr, size_t size)
 
 				if ((etp->exp != 0)
 				    && SPI_NOR_IS_ALIGNED(addr, etp->exp)
-				    && SPI_NOR_IS_ALIGNED(size, etp->exp)
+				    && (size >= BIT(etp->exp))
 				    && ((bet == NULL)
 					|| (etp->exp > bet->exp))) {
 					bet = etp;

drivers/fpga/fpga_ice40.c

@@ -18,7 +18,6 @@
 #include <zephyr/drivers/spi.h>
 #include <zephyr/kernel.h>
 #include <zephyr/logging/log.h>
-#include <zephyr/posix/time.h>
 #include <zephyr/sys/crc.h>
 
 /*

drivers/ieee802154/ieee802154_nrf5.c

@@ -150,7 +150,7 @@ static void nrf5_rx_thread(void *arg1, void *arg2, void *arg3)
 		if (IS_ENABLED(CONFIG_IEEE802154_NRF5_FCS_IN_LENGTH)) {
 			pkt_len = rx_frame->psdu[0];
 		} else {
-			pkt_len = rx_frame->psdu[0] -  NRF5_FCS_LENGTH;
+			pkt_len = rx_frame->psdu[0] -  IEEE802154_FCS_LENGTH;
 		}
 
 #if defined(CONFIG_NET_BUF_DATA_SIZE)
@@ -377,7 +377,7 @@ static int handle_ack(struct nrf5_802154_data *nrf5_radio)
 	if (IS_ENABLED(CONFIG_IEEE802154_NRF5_FCS_IN_LENGTH)) {
 		ack_len = nrf5_radio->ack_frame.psdu[0];
 	} else {
-		ack_len = nrf5_radio->ack_frame.psdu[0] - NRF5_FCS_LENGTH;
+		ack_len = nrf5_radio->ack_frame.psdu[0] - IEEE802154_FCS_LENGTH;
 	}
 
 	ack_pkt = net_pkt_rx_alloc_with_buffer(nrf5_radio->iface, ack_len,
@@ -577,9 +577,14 @@ static int nrf5_tx(const struct device *dev,
 	uint8_t *payload = frag->data;
 	bool ret = true;
 
+	if (payload_len > IEEE802154_MTU) {
+		LOG_ERR("Payload too large: %d", payload_len);
+		return -EMSGSIZE;
+	}
+
 	LOG_DBG("%p (%u)", payload, payload_len);
 
-	nrf5_radio->tx_psdu[0] = payload_len + NRF5_FCS_LENGTH;
+	nrf5_radio->tx_psdu[0] = payload_len + IEEE802154_FCS_LENGTH;
 	memcpy(nrf5_radio->tx_psdu + 1, payload, payload_len);
 
 	/* Reset semaphore in case ACK was received after timeout */

drivers/ieee802154/ieee802154_nrf5.h

@@ -10,8 +10,6 @@
 
 #include <zephyr/net/ieee802154_radio.h>
 
-#define NRF5_FCS_LENGTH   (2)
-#define NRF5_PSDU_LENGTH  (125)
 #define NRF5_PHR_LENGTH   (1)
 
 struct nrf5_802154_rx_frame {
@@ -61,7 +59,7 @@ struct nrf5_802154_data {
 	/* TX buffer. First byte is PHR (length), remaining bytes are
 	 * MPDU data.
 	 */
-	uint8_t tx_psdu[NRF5_PHR_LENGTH + NRF5_PSDU_LENGTH + NRF5_FCS_LENGTH];
+	uint8_t tx_psdu[NRF5_PHR_LENGTH + IEEE802154_MAX_PHY_PACKET_SIZE];
 
 	/* TX result, updated in radio transmit callbacks. */
 	uint8_t tx_result;

drivers/ipm/ipm_cavs_host.c

@@ -56,7 +56,7 @@ static int send(const struct device *dev, int wait, uint32_t id,
 		return -EBUSY;
 	}
 
-	if (size > MAX_MSG) {
+	if ((size < 0) || (size > MAX_MSG)) {
 		return -EMSGSIZE;
 	}
 

drivers/ipm/ipm_imx.c

@@ -165,7 +165,7 @@ static int imx_mu_ipm_send(const struct device *dev, int wait, uint32_t id,
 {
 	const struct imx_mu_config *config = dev->config;
 	MU_Type *base = MU(config);
-	uint32_t data32[IMX_IPM_DATA_REGS];
+	uint32_t data32[IMX_IPM_DATA_REGS] = {0};
 #if !IS_ENABLED(CONFIG_IPM_IMX_REV2)
 	mu_status_t status;
 #endif
@@ -175,7 +175,7 @@ static int imx_mu_ipm_send(const struct device *dev, int wait, uint32_t id,
 		return -EINVAL;
 	}
 
-	if (size > CONFIG_IPM_IMX_MAX_DATA_SIZE) {
+	if ((size < 0) || (size > CONFIG_IPM_IMX_MAX_DATA_SIZE)) {
 		return -EMSGSIZE;
 	}
 

drivers/ipm/ipm_mcux.c

@@ -81,9 +81,8 @@ static int mcux_mailbox_ipm_send(const struct device *d, int wait,
 {
 	const struct mcux_mailbox_config *config = d->config;
 	MAILBOX_Type *base = config->base;
-	uint32_t data32[MCUX_IPM_DATA_REGS]; /* Until we change API
-					   * to uint32_t array
-					   */
+	/* Until we change API to uint32_t array */
+	uint32_t data32[MCUX_IPM_DATA_REGS] = {0};
 	unsigned int flags;
 	int i;
 
@@ -93,7 +92,7 @@ static int mcux_mailbox_ipm_send(const struct device *d, int wait,
 		return -EINVAL;
 	}
 
-	if (size > MCUX_IPM_DATA_REGS * sizeof(uint32_t)) {
+	if ((size < 0) || (size > MCUX_IPM_DATA_REGS * sizeof(uint32_t))) {
 		return -EMSGSIZE;
 	}
 

drivers/pwm/pwm_mcux.c

@@ -96,8 +96,8 @@ static int mcux_pwm_set_cycles(const struct device *dev, uint32_t channel,
 		data->channel[channel].level = level;
 
 		status = PWM_SetupPwm(config->base, config->index,
-				      &data->channel[channel], CHANNEL_COUNT,
-				      config->mode, 1, clock_freq);
+				      &data->channel[channel], 1U,
+				      config->mode, 1U, clock_freq);
 		if (status != kStatus_Success) {
 			LOG_ERR("Could not set up pwm");
 			return -ENOTSUP;

drivers/rtc/rtc_mc146818.c

@@ -34,6 +34,9 @@
 #define RTC_MONTH	0x08
 #define RTC_YEAR	0x09
 
+/* Y2K Bugfix */
+#define RTC_CENTURY	0x32
+
 /* Alarm time indices in RTC RAM */
 #define RTC_ALARM_SEC	0x01
 #define RTC_ALARM_MIN	0x03
@@ -106,10 +109,10 @@
 #define MIN_WDAY	1
 #define MAX_MDAY	31
 #define MIN_MDAY	1
-#define MAX_MON		11
-#define MIN_MON		0
+#define MAX_MON		12
+#define MIN_MON		1
 #define MIN_YEAR_DIFF	0 /* YEAR - 1900 */
-#define MAX_YEAR_DIFF	199 /* YEAR - 1900 */
+#define MAX_YEAR_DIFF	99 /* YEAR - 1999 */
 
 struct rtc_mc146818_data {
 	struct k_spinlock lock;
@@ -149,16 +152,16 @@ static bool rtc_mc146818_validate_time(const struct rtc_time *timeptr)
 	if (timeptr->tm_hour < MIN_HOUR || timeptr->tm_hour > MAX_HOUR) {
 		return false;
 	}
-	if (timeptr->tm_wday < MIN_WDAY || timeptr->tm_wday > MAX_WDAY) {
+	if (timeptr->tm_wday + 1 < MIN_WDAY || timeptr->tm_wday + 1 > MAX_WDAY) {
 		return false;
 	}
 	if (timeptr->tm_mday < MIN_MDAY || timeptr->tm_mday > MAX_MDAY) {
 		return false;
 	}
-	if (timeptr->tm_mon < MIN_MON || timeptr->tm_mon > MAX_MON) {
+	if (timeptr->tm_mon + 1 < MIN_MON || timeptr->tm_mon + 1 > MAX_MON) {
 		return false;
 	}
-	if (timeptr->tm_year < MIN_YEAR_DIFF || timeptr->tm_year > MAX_YEAR_DIFF) {
+	if (timeptr->tm_year - 70 < MIN_YEAR_DIFF || timeptr->tm_year - 70 > MAX_YEAR_DIFF) {
 		return false;
 	}
 	return true;
@@ -168,6 +171,8 @@ static int rtc_mc146818_set_time(const struct device *dev, const struct rtc_time
 {
 	struct rtc_mc146818_data * const dev_data = dev->data;
 	uint8_t value;
+	int year;
+	int cent;
 	int ret;
 
 	k_spinlock_key_t key = k_spin_lock(&dev_data->lock);
@@ -186,6 +191,9 @@ static int rtc_mc146818_set_time(const struct device *dev, const struct rtc_time
 	value = rtc_read(RTC_DATA);
 	rtc_write(RTC_DATA, value | RTC_UCI_BIT);
 
+	year = (1970 + timeptr->tm_year) % 100;
+	cent = (1970 + timeptr->tm_year) / 100;
+
 	if (!(rtc_read(RTC_DATA) & RTC_DMODE_BIT)) {
 		rtc_write(RTC_SEC, (uint8_t)bin2bcd(timeptr->tm_sec));
 		rtc_write(RTC_MIN, (uint8_t)bin2bcd(timeptr->tm_min));
@@ -193,7 +201,8 @@ static int rtc_mc146818_set_time(const struct device *dev, const struct rtc_time
 		rtc_write(RTC_WDAY, (uint8_t)bin2bcd(timeptr->tm_wday));
 		rtc_write(RTC_MDAY, (uint8_t)bin2bcd(timeptr->tm_mday));
 		rtc_write(RTC_MONTH, (uint8_t)bin2bcd(timeptr->tm_mon + 1));
-		rtc_write(RTC_YEAR, (uint8_t)bin2bcd(timeptr->tm_year));
+		rtc_write(RTC_YEAR, (uint8_t)bin2bcd(year));
+		rtc_write(RTC_CENTURY, (uint8_t)bin2bcd(cent));
 	} else {
 		rtc_write(RTC_SEC, (uint8_t)timeptr->tm_sec);
 		rtc_write(RTC_MIN, (uint8_t)timeptr->tm_min);
@@ -201,7 +210,8 @@ static int rtc_mc146818_set_time(const struct device *dev, const struct rtc_time
 		rtc_write(RTC_WDAY, (uint8_t)timeptr->tm_wday);
 		rtc_write(RTC_MDAY, (uint8_t)timeptr->tm_mday);
 		rtc_write(RTC_MONTH, (uint8_t)timeptr->tm_mon + 1);
-		rtc_write(RTC_YEAR, (uint8_t)timeptr->tm_year);
+		rtc_write(RTC_YEAR, year);
+		rtc_write(RTC_CENTURY, cent);
 	}
 
 	if (timeptr->tm_isdst == 1) {
@@ -221,6 +231,8 @@ static int rtc_mc146818_get_time(const struct device *dev, struct rtc_time  *tim
 {
 	struct rtc_mc146818_data * const dev_data = dev->data;
 	int ret;
+	uint8_t cent;
+	uint8_t year;
 	uint8_t value;
 
 	k_spinlock_key_t key = k_spin_lock(&dev_data->lock);
@@ -239,16 +251,18 @@ static int rtc_mc146818_get_time(const struct device *dev, struct rtc_time  *tim
 	while (rtc_read(RTC_UIP) & RTC_UIP_BIT) {
 		continue;
 	}
-	timeptr->tm_year = rtc_read(RTC_YEAR);
+	cent = rtc_read(RTC_CENTURY);
+	year = rtc_read(RTC_YEAR);
 	timeptr->tm_mon = rtc_read(RTC_MONTH) - 1;
 	timeptr->tm_mday = rtc_read(RTC_MDAY);
-	timeptr->tm_wday = rtc_read(RTC_WDAY);
+	timeptr->tm_wday = rtc_read(RTC_WDAY) - 1;
 	timeptr->tm_hour = rtc_read(RTC_HOUR);
 	timeptr->tm_min = rtc_read(RTC_MIN);
 	timeptr->tm_sec = rtc_read(RTC_SEC);
 
 	if (!(rtc_read(RTC_DATA) & RTC_DMODE_BIT)) {
-		timeptr->tm_year = bcd2bin(timeptr->tm_year);
+		year = bcd2bin(year);
+		cent = bcd2bin(cent);
 		timeptr->tm_mon = bcd2bin(timeptr->tm_mon);
 		timeptr->tm_mday = bcd2bin(timeptr->tm_mday);
 		timeptr->tm_wday = bcd2bin(timeptr->tm_wday);
@@ -257,6 +271,8 @@ static int rtc_mc146818_get_time(const struct device *dev, struct rtc_time  *tim
 		timeptr->tm_sec = bcd2bin(timeptr->tm_sec);
 	}
 
+	timeptr->tm_year = 100 * (int)cent + year - 1970;
+
 	timeptr->tm_nsec = 0;
 	timeptr->tm_yday = 0;
 	value = rtc_read(RTC_DATA);
@@ -296,7 +312,7 @@ static bool rtc_mc146818_validate_alarm(const struct rtc_time *timeptr, uint32_t
 	}
 
 	if ((mask & RTC_ALARM_TIME_MASK_MONTH) &&
-	    (timeptr->tm_mon < MIN_WDAY || timeptr->tm_mon > MAX_WDAY)) {
+	    (timeptr->tm_mon + 1 < MIN_WDAY || timeptr->tm_mon + 1 > MAX_WDAY)) {
 		return false;
 	}
 
@@ -306,7 +322,7 @@ static bool rtc_mc146818_validate_alarm(const struct rtc_time *timeptr, uint32_t
 	}
 
 	if ((mask & RTC_ALARM_TIME_MASK_YEAR) &&
-	    (timeptr->tm_year < MIN_YEAR_DIFF || timeptr->tm_year > MAX_YEAR_DIFF)) {
+	    (timeptr->tm_year - 70 < MIN_YEAR_DIFF || timeptr->tm_year - 70 > MAX_YEAR_DIFF)) {
 		return false;
 	}
 

drivers/spi/spi_mcux_flexcomm.c

@@ -610,6 +610,10 @@ static int transceive_dma(const struct device *dev,
 
 	while (data->ctx.rx_len > 0 || data->ctx.tx_len > 0) {
 		size_t dma_len;
+
+		/* last is used to deassert chip select if this
+		 * is the last transfer in the set.
+		 */
 		bool last = false;
 
 		if (data->ctx.rx_len == 0) {
@@ -626,6 +630,34 @@ static int transceive_dma(const struct device *dev,
 			last = false;
 		}
 
+		/* at this point, last just means whether or not
+		 * this transfer will completely cover
+		 * the current tx/rx buffer in data->ctx
+		 * or require additional transfers because the
+		 * the two buffers are not the same size.
+		 *
+		 * if it covers the current ctx tx/rx buffers, then
+		 * we'll move to the next pair of buffers (if any)
+		 * after the transfer, but if there are
+		 * no more buffer pairs, then this is the last
+		 * transfer in the set and we need to deassert CS.
+		 */
+		if (last) {
+			/* this dma transfer should cover
+			 * the entire current data->ctx set
+			 * of buffers. if there are more
+			 * buffers in the set, then we don't
+			 * want to deassert CS.
+			 */
+			if ((data->ctx.tx_count > 1) ||
+			    (data->ctx.rx_count > 1)) {
+				/* more buffers to transfer so
+				 * this isn't last
+				 */
+				last = false;
+			}
+		}
+
 		data->status_flags = 0;
 
 		ret = spi_mcux_dma_move_buffers(dev, dma_len, spi_cfg, last);

drivers/spi/spi_mcux_lpspi.c

@@ -222,13 +222,18 @@ static int spi_mcux_configure(const struct device *dev,
 		return -EINVAL;
 	}
 
-	/* Setting the baud rate in LPSPI_MasterInit requires module to be disabled */
-	LPSPI_Enable(base, false);
-	while ((base->CR & LPSPI_CR_MEN_MASK) != 0U) {
-		/* Wait until LPSPI is disabled. Datasheet:
-		 * After writing 0, MEN (Module Enable) remains set until the LPSPI has completed
-		 * the current transfer and is idle.
+	if (data->ctx.config != NULL) {
+		/* Setting the baud rate in LPSPI_MasterInit requires module to be disabled. Only
+		 * disable if already configured, otherwise the clock is not enabled and the
+		 * CR register cannot be written.
 		 */
+		LPSPI_Enable(base, false);
+		while ((base->CR & LPSPI_CR_MEN_MASK) != 0U) {
+			/* Wait until LPSPI is disabled. Datasheet:
+			 * After writing 0, MEN (Module Enable) remains set until the LPSPI has
+			 * completed the current transfer and is idle.
+			 */
+		}
 	}
 
 	LPSPI_MasterInit(base, &master_config, clock_freq);

dts/bindings/vendor-prefixes.txt

@@ -202,7 +202,7 @@ evervision	Evervision Electronics Co. Ltd.
 exar	Exar Corporation
 excito	Excito
 ezchip	EZchip Semiconductor
-facebook	Facebook
+facebook	Facebook (deprecated, use meta)
 fairphone	Fairphone B.V.
 faraday	Faraday Technology Corporation
 fastrax	Fastrax Oy
@@ -371,6 +371,7 @@ menlo	Menlo Systems GmbH
 mentor	Mentor Graphics
 meraki	Cisco Meraki, LLC
 merrii	Merrii Technology Co., Ltd.
+meta	Meta Platforms, Inc.
 micrel	Micrel Inc.
 microbit	Micro:bit Educational Foundation
 microchip	Microchip Technology Inc.

include/zephyr/arch/arc/v2/linker.ld

@@ -246,8 +246,6 @@ SECTIONS {
 
 	MPU_MIN_SIZE_ALIGN
 	/* Define linker symbols */
-	_image_ram_end = .;
-	_end = .; /* end of image */
 
 	__kernel_ram_end = .;
 	__kernel_ram_size = __kernel_ram_end - __kernel_ram_start;
@@ -278,13 +276,15 @@ SECTIONS {
 	} GROUP_DATA_LINK_IN(YCCM, RAMABLE_REGION)
 #endif
 
-	GROUP_END(RAMABLE_REGION)
-
 /* Located in generated directory. This file is populated by the
  * zephyr_linker_sources() Cmake function.
  */
 #include <snippets-sections.ld>
 
+#include <zephyr/linker/ram-end.ld>
+
+    GROUP_END(RAMABLE_REGION)
+
 #include <zephyr/linker/debug-sections.ld>
 
 	SECTION_PROLOGUE(.ARC.attributes, 0,) {

include/zephyr/arch/arm/aarch32/cortex_a_r/scripts/linker.ld

@@ -332,16 +332,9 @@ SECTIONS
 
     /* Define linker symbols */
 
-    . = ALIGN(_region_min_align);
-    _image_ram_end = .;
-    _end = .; /* end of image */
-    z_mapped_end = .;
-
     __kernel_ram_end = RAM_ADDR + RAM_SIZE;
     __kernel_ram_size = __kernel_ram_end - __kernel_ram_start;
 
-    GROUP_END(RAMABLE_REGION)
-
 #if DT_NODE_HAS_STATUS(DT_CHOSEN(zephyr_ocm), okay)
 GROUP_START(OCM)
 
@@ -373,6 +366,12 @@ GROUP_END(OCM)
  */
 #include <snippets-sections.ld>
 
+#define LAST_RAM_ALIGN . = ALIGN(_region_min_align);
+
+#include <zephyr/linker/ram-end.ld>
+
+    GROUP_END(RAMABLE_REGION)
+
 #include <zephyr/linker/debug-sections.ld>
 
     SECTION_PROLOGUE(.ARM.attributes, 0,)

include/zephyr/arch/arm/aarch32/cortex_m/scripts/linker.ld

@@ -361,14 +361,9 @@ SECTIONS
 
     /* Define linker symbols */
 
-    _image_ram_end = .;
-    _end = .; /* end of image */
-
     __kernel_ram_end = RAM_ADDR + RAM_SIZE;
     __kernel_ram_size = __kernel_ram_end - __kernel_ram_start;
 
-    GROUP_END(RAMABLE_REGION)
-
 #if DT_NODE_HAS_STATUS(DT_CHOSEN(zephyr_itcm), okay)
 GROUP_START(ITCM)
 
@@ -426,6 +421,10 @@ GROUP_END(DTCM)
  */
 #include <snippets-sections.ld>
 
+#include <zephyr/linker/ram-end.ld>
+
+    GROUP_END(RAMABLE_REGION)
+
 #include <zephyr/linker/debug-sections.ld>
 
     /DISCARD/ : { *(.note.GNU-stack) }

include/zephyr/arch/arm64/scripts/linker.ld

@@ -295,21 +295,21 @@ SECTIONS
 
     /* Define linker symbols */
 
-    MMU_ALIGN;
-    _image_ram_end = .;
-    _end = .; /* end of image */
-    z_mapped_end = .;
-
     __kernel_ram_end = RAM_ADDR + RAM_SIZE;
     __kernel_ram_size = __kernel_ram_end - __kernel_ram_start;
 
-    GROUP_END(RAMABLE_REGION)
 
 /* Located in generated directory. This file is populated by the
  * zephyr_linker_sources() Cmake function.
  */
 #include <snippets-sections.ld>
 
+#define LAST_RAM_ALIGN MMU_ALIGN;
+
+#include <zephyr/linker/ram-end.ld>
+
+    GROUP_END(RAMABLE_REGION)
+
 #include <zephyr/linker/debug-sections.ld>
 
     SECTION_PROLOGUE(.ARM.attributes, 0,)

include/zephyr/arch/mips/linker.ld

@@ -181,14 +181,15 @@ SECTIONS
 
 #include <zephyr/linker/cplusplus-ram.ld>
 
-     _image_ram_end = .;
-     _end = .; /* end of image */
-
 /* Located in generated directory. This file is populated by the
  * zephyr_linker_sources() Cmake function.
  */
 #include <snippets-sections.ld>
 
+#include <zephyr/linker/ram-end.ld>
+
+    GROUP_END(RAMABLE_REGION)
+
 #include <zephyr/linker/debug-sections.ld>
 
 	.mdebug.abi32 : {

include/zephyr/arch/nios2/linker.ld

@@ -259,17 +259,15 @@ SECTIONS
 
 #include <zephyr/linker/common-noinit.ld>
 
-    /* Define linker symbols */
-    _image_ram_end = .;
-    _end = .; /* end of image */
-
-    GROUP_END(RAMABLE_REGION)
-
 /* Located in generated directory. This file is populated by the
  * zephyr_linker_sources() Cmake function.
  */
 #include <snippets-sections.ld>
 
+#include <zephyr/linker/ram-end.ld>
+
+    GROUP_END(RAMABLE_REGION)
+
 #include <zephyr/linker/debug-sections.ld>
 
     }

include/zephyr/arch/riscv/common/linker.ld

@@ -305,11 +305,6 @@ SECTIONS
 
     __data_region_end = .;
 
-    MPU_MIN_SIZE_ALIGN
-
-     _image_ram_end = .;
-     _end = .; /* end of image */
-
 	__kernel_ram_end = .;
 	__kernel_ram_size = __kernel_ram_end - __kernel_ram_start;
 
@@ -370,7 +365,11 @@ GROUP_END(DTCM)
  */
 #include <snippets-sections.ld>
 
-     GROUP_END(RAMABLE_REGION)
+#define LAST_RAM_ALIGN MPU_MIN_SIZE_ALIGN
+
+#include <zephyr/linker/ram-end.ld>
+
+    GROUP_END(RAMABLE_REGION)
 
 #include <zephyr/linker/debug-sections.ld>
 

include/zephyr/arch/sparc/linker.ld

@@ -154,14 +154,15 @@ SECTIONS
 
 #include <zephyr/linker/cplusplus-ram.ld>
 
-     _image_ram_end = .;
-     _end = .; /* end of image */
-
 /* Located in generated directory. This file is populated by the
  * zephyr_linker_sources() Cmake function.
  */
 #include <snippets-sections.ld>
 
+#include <zephyr/linker/ram-end.ld>
+
+    GROUP_END(RAMABLE_REGION)
+
 #include <zephyr/linker/debug-sections.ld>
 
     /DISCARD/ : { *(.note.GNU-stack) }

include/zephyr/arch/x86/ia32/linker.ld

@@ -503,14 +503,10 @@ SECTIONS
 	__kernel_ram_end = KERNEL_BASE_ADDR + KERNEL_RAM_SIZE;
 	__kernel_ram_size = __kernel_ram_end - __kernel_ram_start;
 
-	_image_ram_end = .;
 	_image_ram_all = (KERNEL_BASE_ADDR + KERNEL_RAM_SIZE) - _image_ram_start;
 
 	z_mapped_end = .;
 	z_mapped_size = z_mapped_end - z_mapped_start;
-	_end = .; /* end of image */
-
-	GROUP_END(RAMABLE_REGION)
 
 #ifndef LINKER_ZEPHYR_FINAL
 	/* static interrupts */
@@ -538,6 +534,10 @@ SECTIONS
  */
 #include <snippets-sections.ld>
 
+#include <zephyr/linker/ram-end.ld>
+
+    GROUP_END(RAMABLE_REGION)
+
 #include <zephyr/linker/debug-sections.ld>
 
 	/DISCARD/ : { *(.note.GNU-stack) }

include/zephyr/arch/x86/intel64/linker.ld

@@ -192,10 +192,12 @@ SECTIONS
 
 /* Must be last in RAM */
 #include <zephyr/linker/kobject-data.ld>
-	MMU_PAGE_ALIGN
-	_image_ram_end = .;
-	z_mapped_end = .;
-	_end = .;
+
+#define LAST_RAM_ALIGN MMU_PAGE_ALIGN
+
+#include <zephyr/linker/ram-end.ld>
+
+    GROUP_END(RAMABLE_REGION)
 
 	/* All unused memory also owned by the kernel for heaps */
 	__kernel_ram_end = KERNEL_BASE_ADDR + KERNEL_RAM_SIZE;

include/zephyr/drivers/can.h

@@ -1360,7 +1360,7 @@ static inline uint8_t can_dlc_to_bytes(uint8_t dlc)
 	static const uint8_t dlc_table[] = {0, 1, 2, 3, 4, 5, 6, 7, 8, 12,
 					    16, 20, 24, 32, 48, 64};
 
-	return dlc > 0x0F ? 64 : dlc_table[dlc];
+	return dlc_table[MIN(dlc, ARRAY_SIZE(dlc_table) - 1)];
 }
 
 /**

include/zephyr/drivers/can/can_mcan.h

@@ -573,13 +573,25 @@
  * @brief Get the Bosch M_CAN Message RAM base address
  *
  * For devicetree nodes with dedicated Message RAM area defined via devicetree, this macro returns
- * the base address of the Message RAM, taking in the Message RAM offset into account.
+ * the base address of the Message RAM.
  *
  * @param node_id node identifier
- * @return the Bosch M_CAN Message RAM base address
+ * @return the Bosch M_CAN Message RAM base address (MRBA)
+ */
+#define CAN_MCAN_DT_MRBA(node_id)                                                                  \
+	(mem_addr_t)DT_REG_ADDR_BY_NAME(node_id, message_ram)
+
+/**
+ * @brief Get the Bosch M_CAN Message RAM address
+ *
+ * For devicetree nodes with dedicated Message RAM area defined via devicetree, this macro returns
+ * the address of the Message RAM, taking in the Message RAM offset into account.
+ *
+ * @param node_id node identifier
+ * @return the Bosch M_CAN Message RAM address
  */
 #define CAN_MCAN_DT_MRAM_ADDR(node_id)                                                             \
-	(mem_addr_t)(DT_REG_ADDR_BY_NAME(node_id, message_ram) + CAN_MCAN_DT_MRAM_OFFSET(node_id))
+	(mem_addr_t)(CAN_MCAN_DT_MRBA(node_id) + CAN_MCAN_DT_MRAM_OFFSET(node_id))
 
 /**
  * @brief Get the Bosch M_CAN Message RAM size
@@ -617,7 +629,7 @@
  */
 #define CAN_MCAN_DT_MRAM_DEFINE(node_id, _name)                                                    \
 	BUILD_ASSERT(CAN_MCAN_DT_MRAM_OFFSET(node_id) == 0, "offset must be 0");                   \
-	static char __noinit __nocache __aligned(4) _name[CAN_MCAN_DT_MRAM_ELEMENTS_SIZE(node_id)];
+	static char __nocache_noinit __aligned(4) _name[CAN_MCAN_DT_MRAM_ELEMENTS_SIZE(node_id)];
 
 /**
  * @brief Assert that the Message RAM configuration meets the Bosch M_CAN IP core restrictions
@@ -782,10 +794,18 @@
  */
 #define CAN_MCAN_DT_INST_MCAN_ADDR(inst) CAN_MCAN_DT_MCAN_ADDR(DT_DRV_INST(inst))
 
+/**
+ * @brief Equivalent to CAN_MCAN_DT_MRBA(DT_DRV_INST(inst))
+ * @param inst DT_DRV_COMPAT instance number
+ * @return the Bosch M_CAN Message RAM Base Address (MRBA)
+ * @see CAN_MCAN_DT_MRBA()
+ */
+#define CAN_MCAN_DT_INST_MRBA(inst) CAN_MCAN_DT_MRBA(DT_DRV_INST(inst))
+
 /**
  * @brief Equivalent to CAN_MCAN_DT_MRAM_ADDR(DT_DRV_INST(inst))
  * @param inst DT_DRV_COMPAT instance number
- * @return the Bosch M_CAN Message RAM base address
+ * @return the Bosch M_CAN Message RAM address
  * @see CAN_MCAN_DT_MRAM_ADDR()
  */
 #define CAN_MCAN_DT_INST_MRAM_ADDR(inst) CAN_MCAN_DT_MRAM_ADDR(DT_DRV_INST(inst))

include/zephyr/linker/ram-end.ld

@@ -0,0 +1,14 @@
+/*
+ * Added after the very last allocation that might land in RAM to define the various
+ * end-of-used-memory symbols
+ */
+
+    SECTION_PROLOGUE(.last_ram_section,,)
+    {
+#ifdef LAST_RAM_ALIGN
+	LAST_RAM_ALIGN
+#endif
+	_image_ram_end = .;
+	_end = .; /* end of image */
+	z_mapped_end = .;
+    } GROUP_NOLOAD_LINK_IN(RAMABLE_REGION, RAMABLE_REGION)

include/zephyr/linker/section_tags.h

@@ -45,8 +45,10 @@
 
 #if defined(CONFIG_NOCACHE_MEMORY)
 #define __nocache __in_section_unique(_NOCACHE_SECTION_NAME)
+#define __nocache_noinit __nocache
 #else
 #define __nocache
+#define __nocache_noinit __noinit
 #endif /* CONFIG_NOCACHE_MEMORY */
 
 #if defined(CONFIG_KERNEL_COHERENCE)

include/zephyr/net/net_if.h

@@ -755,10 +755,8 @@ void net_if_queue_tx(struct net_if *iface, struct net_pkt *pkt);
 static inline bool net_if_is_ip_offloaded(struct net_if *iface)
 {
 #if defined(CONFIG_NET_OFFLOAD)
-	NET_ASSERT(iface);
-	NET_ASSERT(iface->if_dev);
-
-	return (iface->if_dev->offload != NULL);
+	return (iface != NULL && iface->if_dev != NULL &&
+		iface->if_dev->offload != NULL);
 #else
 	ARG_UNUSED(iface);
 

include/zephyr/net/wifi.h

@@ -123,7 +123,9 @@ static inline const char *wifi_band_txt(enum wifi_frequency_bands band)
 }
 
 #define WIFI_SSID_MAX_LEN 32
+#define WIFI_PSK_MIN_LEN 8
 #define WIFI_PSK_MAX_LEN 64
+#define WIFI_SAE_PSWD_MAX_LEN 128
 #define WIFI_MAC_ADDR_LEN 6
 
 #define WIFI_CHANNEL_MAX 233

include/zephyr/posix/posix_types.h

@@ -35,7 +35,6 @@ typedef uint32_t clockid_t;
 typedef unsigned long timer_t;
 #endif
 
-#ifdef CONFIG_PTHREAD_IPC
 /* Thread attributes */
 struct pthread_attr {
 	int priority;
@@ -99,8 +98,6 @@ typedef struct pthread_rwlock_obj {
 	k_tid_t wr_owner;
 } pthread_rwlock_t;
 
-#endif /* CONFIG_PTHREAD_IPC */
-
 #ifdef __cplusplus
 }
 #endif

include/zephyr/posix/signal.h

@@ -24,20 +24,20 @@ extern "C" {
 #define SIGEV_THREAD 3
 #endif
 
-typedef union sigval {
+typedef int	sig_atomic_t;		/* Atomic entity type (ANSI) */
+
+union sigval {
 	int sival_int;
 	void *sival_ptr;
-} sigval;
+};
 
-typedef struct sigevent {
+struct sigevent {
 	int sigev_notify;
 	int sigev_signo;
-	sigval sigev_value;
-	void (*sigev_notify_function)(sigval val);
-	#ifdef CONFIG_PTHREAD_IPC
+	union sigval sigev_value;
+	void (*sigev_notify_function)(union sigval val);
 	pthread_attr_t *sigev_notify_attributes;
-	#endif
-} sigevent;
+};
 
 #ifdef __cplusplus
 }

include/zephyr/sys/hash_function.h

@@ -17,6 +17,12 @@
 extern "C" {
 #endif
 
+/**
+ * @ingroup hashmap_apis
+ * @defgroup hash_functions Hash Functions
+ * @{
+ */
+
 /**
  * @brief 32-bit Hash function interface
  *
@@ -70,7 +76,7 @@ static inline uint32_t sys_hash32_identity(const void *str, size_t n)
 }
 
 /**
- * @brief Daniel J. Bernstein's hash function
+ * @brief Daniel J.\ Bernstein's hash function
  *
  * Some notes:
  * - normally, this hash function is used on NUL-terminated strings
@@ -129,6 +135,10 @@ static inline uint32_t sys_hash32(const void *str, size_t n)
 	return 0;
 }
 
+/**
+ * @}
+ */
+
 #ifdef __cplusplus
 }
 #endif

include/zephyr/sys/hash_map.h

@@ -6,10 +6,8 @@
 
 /**
  * @file
- * @brief Hashmap (Hash Table) API
- *
- * Hashmaps (a.k.a Hash Tables) sacrifice space for speed. All operations
- * on a Hashmap (insert, delete, search) are O(1) complexity (on average).
+ * @addtogroup hashmap_apis
+ * @{
  */
 
 #ifndef ZEPHYR_INCLUDE_SYS_HASH_MAP_H_
@@ -29,11 +27,6 @@
 extern "C" {
 #endif
 
-/**
- * @ingroup hashmap_apis
- * @{
- */
-
 /**
  * @brief Declare a Hashmap (advanced)
  *
@@ -63,9 +56,9 @@ extern "C" {
 	}
 
 /**
- * @brief Declare a Hashmap (advanced)
+ * @brief Declare a Hashmap statically (advanced)
  *
- * Declare a Hashmap with control over advanced parameters.
+ * Declare a Hashmap statically with control over advanced parameters.
  *
  * @note The allocator @p _alloc is used for allocating internal Hashmap
  * entries and does not interact with any user-provided keys or values.
@@ -121,6 +114,7 @@ static inline void *sys_hashmap_default_allocator(void *ptr, size_t size)
 	return realloc(ptr, size);
 }
 
+/** @brief The default Hashmap allocator */
 #define SYS_HASHMAP_DEFAULT_ALLOCATOR sys_hashmap_default_allocator
 
 /** @brief The default Hashmap load factor (in hundredths) */
@@ -128,10 +122,15 @@ static inline void *sys_hashmap_default_allocator(void *ptr, size_t size)
 
 /** @brief Generic Hashmap */
 struct sys_hashmap {
+	/** Hashmap API */
 	const struct sys_hashmap_api *api;
+	/** Hashmap configuration */
 	const struct sys_hashmap_config *config;
+	/** Hashmap data */
 	struct sys_hashmap_data *data;
+	/** Hash function */
 	sys_hash_func32_t hash_func;
+	/** Allocator */
 	sys_hashmap_allocator_t alloc_func;
 };
 

include/zephyr/sys/hash_map_api.h

@@ -4,14 +4,6 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-/**
- * @file
- * @brief Hashmap (Hash Table) API
- *
- * Hashmaps (a.k.a Hash Tables) sacrifice space for speed. All operations
- * on a Hashmap (insert, delete, search) are O(1) complexity (on average).
- */
-
 #ifndef ZEPHYR_INCLUDE_SYS_HASHMAP_API_H_
 #define ZEPHYR_INCLUDE_SYS_HASHMAP_API_H_
 
@@ -27,8 +19,19 @@ extern "C" {
 #endif
 
 /**
+ * @file
  * @defgroup hashmap_apis Hashmap
  * @ingroup datastructure_apis
+ *
+ * @brief Hashmap (Hash Table) API
+ *
+ * Hashmaps (a.k.a Hash Tables) sacrifice space for speed. All operations
+ * on a Hashmap (insert, delete, search) are O(1) complexity (on average).
+ *
+ * @defgroup hashmap_implementations Hashmap Implementations
+ * @ingroup hashmap_apis
+ *
+ * @addtogroup hashmap_apis
  * @{
  */
 

include/zephyr/sys/hash_map_cxx.h

@@ -6,6 +6,7 @@
 
 /**
  * @file
+ * @ingroup hashmap_implementations
  * @brief C++ Hashmap
  *
  * This is a C wrapper around `std::unordered_map`. It is mainly used for

include/zephyr/sys/hash_map_oa_lp.h

@@ -6,6 +6,7 @@
 
 /**
  * @file
+ * @ingroup hashmap_implementations
  * @brief Open-Addressing / Linear Probe Hashmap Implementation
  *
  * @note Enable with @kconfig{CONFIG_SYS_HASH_MAP_OA_LP}

include/zephyr/sys/hash_map_sc.h

@@ -6,6 +6,7 @@
 
 /**
  * @file
+ * @ingroup hashmap_implementations
  * @brief Separate Chaining Hashmap Implementation
  *
  * @note Enable with @kconfig{CONFIG_SYS_HASH_MAP_SC}

kernel/sched.c

@@ -1712,6 +1712,10 @@ static void end_thread(struct k_thread *thread)
 		unpend_all(&thread->join_queue);
 		update_cache(1);
 
+#if defined(CONFIG_FPU) && defined(CONFIG_FPU_SHARING)
+		arch_float_disable(thread);
+#endif
+
 		SYS_PORT_TRACING_FUNC(k_thread, sched_abort, thread);
 
 		z_thread_monitor_exit(thread);

lib/posix/pthread.c

@@ -534,7 +534,6 @@ void pthread_exit(void *retval)
 	self = to_posix_thread(pthread_self());
 	if (self == NULL) {
 		/* not a valid posix_thread */
-		__ASSERT_NO_MSG(self != NULL);
 		k_thread_abort(k_current_get());
 	}
 

lib/posix/timer.c

@@ -7,6 +7,7 @@
 #include <errno.h>
 #include <string.h>
 #include <zephyr/sys/printk.h>
+#include <zephyr/posix/signal.h>
 #include <zephyr/posix/time.h>
 
 #define ACTIVE 1
@@ -16,8 +17,8 @@ static void zephyr_timer_wrapper(struct k_timer *ztimer);
 
 struct timer_obj {
 	struct k_timer ztimer;
-	void (*sigev_notify_function)(sigval val);
-	sigval val;
+	void (*sigev_notify_function)(union sigval val);
+	union sigval val;
 	struct timespec interval;	/* Reload value */
 	uint32_t reload;			/* Reload value in ms */
 	uint32_t status;

modules/canopennode/CO_driver_target.h

@@ -22,6 +22,7 @@ extern "C" {
 #include <zephyr/types.h>
 #include <zephyr/device.h>
 #include <zephyr/toolchain.h>
+#include <zephyr/dsp/types.h> /* float32_t, float64_t */
 
 /* Use static variables instead of calloc() */
 #define CO_USE_GLOBALS
@@ -46,12 +47,13 @@ extern "C" {
 #endif
 
 typedef bool          bool_t;
-typedef float         float32_t;
-typedef long double   float64_t;
 typedef char          char_t;
 typedef unsigned char oChar_t;
 typedef unsigned char domain_t;
 
+BUILD_ASSERT(sizeof(float32_t) >= 4);
+BUILD_ASSERT(sizeof(float64_t) >= 8);
+
 typedef struct canopen_rx_msg {
 	uint8_t data[8];
 	uint16_t ident;

share/sysbuild/cmake/modules/sysbuild_kconfig.cmake

@@ -66,6 +66,9 @@ if(DEFINED BOARD_REVISION)
   set(BOARD_REVISION_CONFIG "${CMAKE_CURRENT_BINARY_DIR}/empty.conf")
 endif()
 
+# Unset shield configuration files if set to prevent including in sysbuild
+set(shield_conf_files)
+
 list(APPEND ZEPHYR_KCONFIG_MODULES_DIR BOARD=${BOARD})
 set(KCONFIG_NAMESPACE SB_CONFIG)
 

soc/arm64/nxp_imx/mimx9/linker.ld

@@ -312,21 +312,20 @@ SECTIONS
 
     /* Define linker symbols */
 
-    MMU_ALIGN;
-    _image_ram_end = .;
-    _end = .; /* end of image */
-    z_mapped_end = .;
-
-    __kernel_ram_end = RAM_ADDR + RAM_SIZE;
-    __kernel_ram_size = __kernel_ram_end - __kernel_ram_start;
-
-    GROUP_END(RAMABLE_REGION)
-
 /* Located in generated directory. This file is populated by the
  * zephyr_linker_sources() Cmake function.
  */
 #include <snippets-sections.ld>
 
+#define LAST_RAM_ALIGN MMU_ALIGN;
+
+#include <zephyr/linker/ram-end.ld>
+
+    GROUP_END(RAMABLE_REGION)
+
+    __kernel_ram_end = RAM_ADDR + RAM_SIZE;
+    __kernel_ram_size = __kernel_ram_end - __kernel_ram_start;
+
 #include <zephyr/linker/debug-sections.ld>
 
     SECTION_PROLOGUE(.ARM.attributes, 0,)

soc/riscv/esp32c3/default.ld

@@ -47,6 +47,11 @@
 #define IROM_SEG_ALIGN 0x10000
 #endif
 
+/* Flash segments (rodata and text) should be mapped in virtual address space by providing VMA.
+ * Executing directly from LMA is not possible. */
+#undef GROUP_ROM_LINK_IN
+#define GROUP_ROM_LINK_IN(vregion, lregion) > RODATA_REGION AT > lregion
+
 /* Global symbols required for espressif hal build */
 MEMORY
 {
@@ -183,11 +188,6 @@ SECTIONS
     . = ALIGN(4);
   } GROUP_DATA_LINK_IN(RODATA_REGION, ROMABLE_REGION)
 
-  /* Flash segments (rodata and text) should be mapped in virtual address space by providing VMA.
-   * Executing directly from LMA is not possible. */
-  #pragma push_macro("GROUP_ROM_LINK_IN")
-  #undef GROUP_ROM_LINK_IN
-  #define GROUP_ROM_LINK_IN(vregion, lregion) > RODATA_REGION AT > lregion
   #include <zephyr/linker/common-rom/common-rom-cpp.ld>
   #include <zephyr/linker/common-rom/common-rom-kernel-devices.ld>
   #include <zephyr/linker/common-rom/common-rom-ztest.ld>
@@ -195,7 +195,6 @@ SECTIONS
   #include <zephyr/linker/common-rom/common-rom-bt.ld>
   #include <zephyr/linker/common-rom/common-rom-debug.ld>
   #include <zephyr/linker/common-rom/common-rom-misc.ld>
-  #pragma pop_macro("GROUP_ROM_LINK_IN")
 
   /* Create an explicit section at the end of all the data that shall be mapped into drom.
    * This is used to calculate the size of the _image_drom_size variable */

soc/riscv/openisa_rv32m1/linker.ld

@@ -233,16 +233,15 @@ SECTIONS
  */
 #include <snippets-ram-sections.ld>
 
-     _image_ram_end = .;
-     _end = .; /* end of image */
-
-     GROUP_END(RAM)
-
 /* Located in generated directory. This file is populated by the
  * zephyr_linker_sources() Cmake function.
  */
 #include <snippets-sections.ld>
 
+#include <zephyr/linker/ram-end.ld>
+
+    GROUP_END(RAMABLE_REGION)
+
 #ifdef CONFIG_GEN_ISR_TABLES
 /* Bogus section, post-processed during the build to initialize interrupts. */
 #include <zephyr/linker/intlist.ld>

soc/riscv/riscv-ite/it8xxx2/linker.ld

@@ -356,11 +356,6 @@ SECTIONS
 
     __data_region_end = .;
 
-    MPU_MIN_SIZE_ALIGN
-
-     _image_ram_end = .;
-     _end = .; /* end of image */
-
 	__kernel_ram_end = .;
 	__kernel_ram_size = __kernel_ram_end - __kernel_ram_start;
 
@@ -369,7 +364,11 @@ SECTIONS
  */
 #include <snippets-sections.ld>
 
-     GROUP_END(RAMABLE_REGION)
+#define LAST_RAM_ALIGN MPU_MIN_SIZE_ALIGN
+
+#include <zephyr/linker/ram-end.ld>
+
+    GROUP_END(RAMABLE_REGION)
 
 #include <zephyr/linker/debug-sections.ld>
 

soc/riscv/riscv-privileged/andes_v5/ae350/linker.ld

@@ -274,11 +274,6 @@ SECTIONS
 
     __data_region_end = .;
 
-    MPU_MIN_SIZE_ALIGN
-
-     _image_ram_end = .;
-     _end = .; /* end of image */
-
 	__kernel_ram_end = .;
 	__kernel_ram_size = __kernel_ram_end - __kernel_ram_start;
 
@@ -339,7 +334,11 @@ GROUP_END(DTCM)
  */
 #include <snippets-sections.ld>
 
-     GROUP_END(RAMABLE_REGION)
+#define LAST_RAM_ALIGN MPU_MIN_SIZE_ALIGN
+
+#include <zephyr/linker/ram-end.ld>
+
+    GROUP_END(RAMABLE_REGION)
 
 #include <zephyr/linker/debug-sections.ld>
 

soc/xtensa/esp32/default.ld

@@ -47,6 +47,11 @@
 #define IRAM_SEG_LEN 0x13000
 #endif
 
+/* Flash segments (rodata and text) should be mapped in virtual address space by providing VMA.
+ * Executing directly from LMA is not possible. */
+#undef GROUP_ROM_LINK_IN
+#define GROUP_ROM_LINK_IN(vregion, lregion) > RODATA_REGION AT > lregion
+
 MEMORY
 {
   mcuboot_hdr (RX): org = 0x0, len = 0x20
@@ -210,11 +215,6 @@ SECTIONS
     . = ALIGN(4);
   } GROUP_DATA_LINK_IN(RODATA_REGION, ROMABLE_REGION)
 
-  /* Flash segments (rodata and text) should be mapped in virtual address space by providing VMA.
-   * Executing directly from LMA is not possible. */
-  #pragma push_macro("GROUP_ROM_LINK_IN")
-  #undef GROUP_ROM_LINK_IN
-  #define GROUP_ROM_LINK_IN(vregion, lregion) > RODATA_REGION AT > lregion
   #include <zephyr/linker/common-rom/common-rom-cpp.ld>
   #include <zephyr/linker/common-rom/common-rom-kernel-devices.ld>
   #include <zephyr/linker/common-rom/common-rom-ztest.ld>
@@ -222,7 +222,6 @@ SECTIONS
   #include <zephyr/linker/common-rom/common-rom-bt.ld>
   #include <zephyr/linker/common-rom/common-rom-debug.ld>
   #include <zephyr/linker/common-rom/common-rom-misc.ld>
-  #pragma pop_macro("GROUP_ROM_LINK_IN")
 
   /* Create an explicit section at the end of all the data that shall be mapped into drom.
    * This is used to calculate the size of the _image_drom_size variable */

soc/xtensa/esp32_net/linker.ld

@@ -26,6 +26,11 @@
 #define ROMABLE_DATA_REGION dram0_1_seg
 #define dram0_0_seg dram0_1_seg
 
+/* Flash segments (rodata and text) should be mapped in virtual address space by providing VMA.
+ * Executing directly from LMA is not possible. */
+#undef GROUP_ROM_LINK_IN
+#define GROUP_ROM_LINK_IN(vregion, lregion) > RODATA_REGION AT > lregion
+
 MEMORY
 {
   iram0_0_seg(RX): org = 0x40080000 + 0x08000, len = 0x18000
@@ -200,11 +205,6 @@ SECTIONS
     . = ALIGN(4);
   } GROUP_DATA_LINK_IN(RODATA_REGION, ROMABLE_DATA_REGION)
 
-  /* Flash segments (rodata and text) should be mapped in virtual address space by providing VMA.
-   * Executing directly from LMA is not possible. */
-  #pragma push_macro("GROUP_ROM_LINK_IN")
-  #undef GROUP_ROM_LINK_IN
-  #define GROUP_ROM_LINK_IN(vregion, lregion) > RODATA_REGION AT > lregion
   #include <zephyr/linker/common-rom/common-rom-cpp.ld>
   #include <zephyr/linker/common-rom/common-rom-kernel-devices.ld>
   #include <zephyr/linker/common-rom/common-rom-ztest.ld>
@@ -212,7 +212,6 @@ SECTIONS
   #include <zephyr/linker/common-rom/common-rom-bt.ld>
   #include <zephyr/linker/common-rom/common-rom-debug.ld>
   #include <zephyr/linker/common-rom/common-rom-misc.ld>
-  #pragma pop_macro("GROUP_ROM_LINK_IN")
 
   /* Create an explicit section at the end of all the data that shall be mapped into drom.
    * This is used to calculate the size of the _image_drom_size variable */

soc/xtensa/esp32s2/default.ld

@@ -51,6 +51,11 @@
 #define IROM_SEG_ALIGN 0x10000
 #endif
 
+/* Flash segments (rodata and text) should be mapped in virtual address space by providing VMA.
+ * Executing directly from LMA is not possible. */
+#undef GROUP_ROM_LINK_IN
+#define GROUP_ROM_LINK_IN(vregion, lregion) > RODATA_REGION AT > lregion
+
 MEMORY
 {
   mcuboot_hdr (RX): org = 0x0, len = 0x20
@@ -179,18 +184,12 @@ SECTIONS
     . = ALIGN(4);
   } GROUP_DATA_LINK_IN(RODATA_REGION, ROMABLE_REGION)
 
-  /* Flash segments (rodata and text) should be mapped in virtual address space by providing VMA.
-   * Executing directly from LMA is not possible. */
-  #pragma push_macro("GROUP_ROM_LINK_IN")
-  #undef GROUP_ROM_LINK_IN
-  #define GROUP_ROM_LINK_IN(vregion, lregion) > RODATA_REGION AT > lregion
   #include <zephyr/linker/common-rom/common-rom-cpp.ld>
   #include <zephyr/linker/common-rom/common-rom-kernel-devices.ld>
   #include <zephyr/linker/common-rom/common-rom-ztest.ld>
   #include <zephyr/linker/common-rom/common-rom-net.ld>
   #include <zephyr/linker/common-rom/common-rom-debug.ld>
   #include <zephyr/linker/common-rom/common-rom-misc.ld>
-  #pragma pop_macro("GROUP_ROM_LINK_IN")
 
   /* Create an explicit section at the end of all the data that shall be mapped into drom.
    * This is used to calculate the size of the _image_drom_size variable */

soc/xtensa/esp32s3/default.ld

@@ -55,6 +55,11 @@
 
 #define IROM_SEG_ALIGN 0x10000
 
+/* Flash segments (rodata and text) should be mapped in virtual address space by providing VMA.
+ * Executing directly from LMA is not possible. */
+#undef GROUP_ROM_LINK_IN
+#define GROUP_ROM_LINK_IN(vregion, lregion) > RODATA_REGION AT > lregion
+
 MEMORY
 {
   mcuboot_hdr (RX): org = 0x0, len = 0x20
@@ -197,11 +202,6 @@ SECTIONS
     . = ALIGN(4);
   } GROUP_DATA_LINK_IN(RODATA_REGION, ROMABLE_REGION)
 
-  /* Flash segments (rodata and text) should be mapped in virtual address space by providing VMA.
-   * Executing directly from LMA is not possible. */
-  #pragma push_macro("GROUP_ROM_LINK_IN")
-  #undef GROUP_ROM_LINK_IN
-  #define GROUP_ROM_LINK_IN(vregion, lregion) > RODATA_REGION AT > lregion
   #include <zephyr/linker/common-rom/common-rom-cpp.ld>
   #include <zephyr/linker/common-rom/common-rom-kernel-devices.ld>
   #include <zephyr/linker/common-rom/common-rom-ztest.ld>
@@ -209,7 +209,6 @@ SECTIONS
   #include <zephyr/linker/common-rom/common-rom-bt.ld>
   #include <zephyr/linker/common-rom/common-rom-debug.ld>
   #include <zephyr/linker/common-rom/common-rom-misc.ld>
-  #pragma pop_macro("GROUP_ROM_LINK_IN")
 
   /* Create an explicit section at the end of all the data that shall be mapped into drom.
    * This is used to calculate the size of the _image_drom_size variable */

soc/xtensa/intel_adsp/ace/ace-link.ld

@@ -403,6 +403,8 @@ SECTIONS {
     _unused_ram_start_marker = .;
     *(.unused_ram_start_marker)
     *(.unused_ram_start_marker.*)
+    _end = .;
+    z_mapped_end = .;
   } >ram
 
   . = L2_SRAM_BASE + L2_SRAM_SIZE;

subsys/bluetooth/audio/shell/mcc.c

@@ -1448,9 +1448,16 @@ static int cmd_mcc_send_search_raw(const struct shell *sh, size_t argc,
 				   char *argv[])
 {
 	int result;
+	size_t len;
 	struct mpl_search search;
 
-	search.len = strlen(argv[1]);
+	len = strlen(argv[1]);
+	if (len > sizeof(search.search)) {
+		shell_print(sh, "Fail: Invalid argument");
+		return -EINVAL;
+	}
+
+	search.len = len;
 	memcpy(search.search, argv[1], search.len);
 	LOG_DBG("Search string: %s", argv[1]);
 

subsys/bluetooth/audio/shell/media_controller.c

@@ -1230,9 +1230,16 @@ static int cmd_media_set_search(const struct shell *sh, size_t argc, char *argv[
 	 */
 
 	struct mpl_search search;
+	size_t len;
 	int err;
 
-	search.len = strlen(argv[1]);
+	len = strlen(argv[1]);
+	if (len > sizeof(search.search)) {
+		shell_print(sh, "Fail: Invalid argument");
+		return -EINVAL;
+	}
+
+	search.len = len;
 	memcpy(search.search, argv[1], search.len);
 	LOG_DBG("Search string: %s", argv[1]);
 

subsys/bluetooth/controller/ll_sw/nordic/lll/lll_scan.c

@@ -921,11 +921,11 @@ static void isr_window(void *param)
 	}
 	lll_chan_set(37 + lll->chan);
 
+#if defined(CONFIG_BT_CENTRAL) || defined(CONFIG_BT_CTLR_ADV_EXT)
 #if defined(CONFIG_BT_CENTRAL)
 	bool is_sched_advanced = IS_ENABLED(CONFIG_BT_CTLR_SCHED_ADVANCED) &&
 				 lll->conn && lll->conn_win_offset_us;
 	uint32_t ticks_anchor_prev;
-	uint32_t ticks_at_start;
 
 	if (is_sched_advanced) {
 		/* Get the ticks_anchor when the offset to free time space for
@@ -938,14 +938,17 @@ static void isr_window(void *param)
 	} else {
 		ticks_anchor_prev = 0U;
 	}
+#endif /* CONFIG_BT_CENTRAL */
+
+	uint32_t ticks_at_start;
 
 	ticks_at_start = ticker_ticks_now_get() +
 			 HAL_TICKER_CNTR_CMP_OFFSET_MIN;
 	remainder_us = radio_tmr_start_tick(0, ticks_at_start);
-#else /* !CONFIG_BT_CENTRAL */
+#else /* !CONFIG_BT_CENTRAL && !CONFIG_BT_CTLR_ADV_EXT */
 
 	remainder_us = radio_tmr_start_now(0);
-#endif /* !CONFIG_BT_CENTRAL */
+#endif /* !CONFIG_BT_CENTRAL && !CONFIG_BT_CTLR_ADV_EXT */
 
 	/* capture end of Rx-ed PDU, for initiator to calculate first
 	 * central event.
@@ -1273,6 +1276,7 @@ static inline int isr_rx_pdu(struct lll_scan *lll, struct pdu_adv *pdu_adv_rx,
 	/* Active scanner */
 	} else if (((pdu_adv_rx->type == PDU_ADV_TYPE_ADV_IND) ||
 		    (pdu_adv_rx->type == PDU_ADV_TYPE_SCAN_IND)) &&
+		   (pdu_adv_rx->len >= offsetof(struct pdu_adv_adv_ind, data)) &&
 		   (pdu_adv_rx->len <= sizeof(struct pdu_adv_adv_ind)) &&
 		   lll->type && !lll->state &&
 #if defined(CONFIG_BT_CENTRAL)
@@ -1365,6 +1369,7 @@ static inline int isr_rx_pdu(struct lll_scan *lll, struct pdu_adv *pdu_adv_rx,
 	else if (((((pdu_adv_rx->type == PDU_ADV_TYPE_ADV_IND) ||
 		    (pdu_adv_rx->type == PDU_ADV_TYPE_NONCONN_IND) ||
 		    (pdu_adv_rx->type == PDU_ADV_TYPE_SCAN_IND)) &&
+		   (pdu_adv_rx->len >= offsetof(struct pdu_adv_adv_ind, data)) &&
 		   (pdu_adv_rx->len <= sizeof(struct pdu_adv_adv_ind))) ||
 		  ((pdu_adv_rx->type == PDU_ADV_TYPE_DIRECT_IND) &&
 		   (pdu_adv_rx->len == sizeof(struct pdu_adv_direct_ind)) &&
@@ -1379,6 +1384,7 @@ static inline int isr_rx_pdu(struct lll_scan *lll, struct pdu_adv *pdu_adv_rx,
 						       &dir_report)) ||
 #endif /* CONFIG_BT_CTLR_ADV_EXT */
 		  ((pdu_adv_rx->type == PDU_ADV_TYPE_SCAN_RSP) &&
+		   (pdu_adv_rx->len >= offsetof(struct pdu_adv_scan_rsp, data)) &&
 		   (pdu_adv_rx->len <= sizeof(struct pdu_adv_scan_rsp)) &&
 		   (lll->state != 0U) &&
 		   isr_scan_rsp_adva_matches(pdu_adv_rx))) &&
@@ -1429,6 +1435,7 @@ static inline bool isr_scan_init_check(const struct lll_scan *lll,
 		lll_scan_adva_check(lll, pdu->tx_addr, pdu->adv_ind.addr,
 				    rl_idx)) &&
 		(((pdu->type == PDU_ADV_TYPE_ADV_IND) &&
+		  (pdu->len >= offsetof(struct pdu_adv_adv_ind, data)) &&
 		  (pdu->len <= sizeof(struct pdu_adv_adv_ind))) ||
 		 ((pdu->type == PDU_ADV_TYPE_DIRECT_IND) &&
 		  (pdu->len == sizeof(struct pdu_adv_direct_ind)) &&

subsys/bluetooth/controller/ticker/ticker.c

@@ -9,6 +9,7 @@
 #include <zephyr/types.h>
 #include <soc.h>
 
+#include "hal/cpu.h"
 #include "hal/cntr.h"
 #include "hal/ticker.h"
 
@@ -3137,6 +3138,7 @@ void ticker_job(void *param)
 	instance->job_guard = 0U;
 
 	/* trigger worker if deferred */
+	cpu_dmb();
 	if (instance->worker_trigger || compare_trigger) {
 		instance->sched_cb(TICKER_CALL_ID_JOB, TICKER_CALL_ID_WORKER, 1,
 				   instance);

subsys/bluetooth/controller/util/mayfly.c

@@ -6,8 +6,13 @@
  */
 
 #include <stddef.h>
+
+#include <soc.h>
 #include <zephyr/types.h>
 #include <zephyr/sys/printk.h>
+
+#include "hal/cpu.h"
+
 #include "memq.h"
 #include "mayfly.h"
 
@@ -154,10 +159,12 @@ static void dequeue(uint8_t callee_id, uint8_t caller_id, memq_link_t *link,
 		m->_link = link;
 
 		/* reset mayfly state to idle */
+		cpu_dmb();
 		ack = m->_ack;
 		m->_ack = req;
 
 		/* re-insert, if re-pended by interrupt */
+		cpu_dmb();
 		if (((m->_req - ack) & 0x03) == 1U) {
 #if defined(MAYFLY_UT)
 			printk("%s: RACE\n", __func__);

subsys/bluetooth/host/conn.c

@@ -2159,6 +2159,10 @@ int bt_conn_le_start_encryption(struct bt_conn *conn, uint8_t rand[8],
 	struct bt_hci_cp_le_start_encryption *cp;
 	struct net_buf *buf;
 
+	if (len > sizeof(cp->ltk)) {
+		return -EINVAL;
+	}
+
 	buf = bt_hci_cmd_create(BT_HCI_OP_LE_START_ENCRYPTION, sizeof(*cp));
 	if (!buf) {
 		return -ENOBUFS;

subsys/bluetooth/host/gatt.c

@@ -2105,9 +2105,12 @@ static struct bt_conn *bt_gatt_ccc_cfg_conn_lookup(const struct bt_gatt_ccc_cfg
 	struct bt_conn *conn;
 
 	conn = bt_conn_lookup_addr_le(cfg->id, &cfg->peer);
+	if (conn) {
+		if (bt_gatt_ccc_cfg_is_matching_conn(conn, cfg)) {
+			return conn;
+		}
 
-	if (bt_gatt_ccc_cfg_is_matching_conn(conn, cfg)) {
-		return conn;
+		bt_conn_unref(conn);
 	}
 
 	return NULL;

subsys/bluetooth/mesh/net.c

@@ -284,6 +284,12 @@ bool bt_mesh_net_iv_update(uint32_t iv_index, bool iv_update)
 		return false;
 	}
 
+	/* Discard [iv, false] --> [iv, true] */
+	if (iv_index == bt_mesh.iv_index && iv_update) {
+		LOG_DBG("Ignore previous IV update procedure");
+		return false;
+	}
+
 	if ((iv_index > bt_mesh.iv_index + 1) ||
 	    (iv_index == bt_mesh.iv_index + 1 &&
 	     (atomic_test_bit(bt_mesh.flags, BT_MESH_IVU_IN_PROGRESS) || !iv_update))) {

subsys/bluetooth/mesh/prov_device.c

@@ -357,6 +357,13 @@ static void prov_pub_key(const uint8_t *data)
 			return;
 		}
 
+		if (!memcmp(bt_mesh_prov->public_key_be,
+			    bt_mesh_prov_link.conf_inputs.pub_key_provisioner, PDU_LEN_PUB_KEY)) {
+			LOG_ERR("Public keys are identical");
+			prov_fail(PROV_ERR_NVAL_FMT);
+			return;
+		}
+
 		/* No swap needed since user provides public key in big-endian */
 		memcpy(bt_mesh_prov_link.conf_inputs.pub_key_device, bt_mesh_prov->public_key_be,
 		       PDU_LEN_PUB_KEY);

subsys/bluetooth/mesh/shell/rpr.c

@@ -38,9 +38,26 @@ static void rpr_scan_report(struct bt_mesh_rpr_cli *cli,
 		uint8_t len, type;
 		uint8_t data[31];
 
-		len = net_buf_simple_pull_u8(adv_data) - 1;
+		len = net_buf_simple_pull_u8(adv_data);
+		if (len == 0) {
+			/* No data in this AD Structure. */
+			continue;
+		}
+
+		if (len > adv_data->len) {
+			/* Malformed AD Structure. */
+			break;
+		}
+
 		type = net_buf_simple_pull_u8(adv_data);
-		memcpy(data, net_buf_simple_pull_mem(adv_data, len), len);
+		if ((--len) > 0) {
+			uint8_t dlen;
+
+			/* Pull all length, but print only what fits into `data` array. */
+			dlen = MIN(len, sizeof(data) - 1);
+			memcpy(data, net_buf_simple_pull_mem(adv_data, len), dlen);
+			len = dlen;
+		}
 		data[len] = '\0';
 
 		if (type == BT_DATA_URI) {

subsys/bluetooth/shell/bt.c

@@ -410,7 +410,7 @@ static void scan_recv(const struct bt_le_scan_recv_info *info,
 	bt_addr_le_copy(&auto_connect.addr, info->addr);
 
 	/* Use the above auto_connect.addr address to automatically connect */
-	if (auto_connect.connect_name) {
+	if ((info->adv_props & BT_GAP_ADV_PROP_CONNECTABLE) != 0U && auto_connect.connect_name) {
 		auto_connect.connect_name = false;
 
 		cmd_scan_off(ctx_shell);

subsys/canbus/isotp/isotp.c

@@ -882,7 +882,11 @@ static inline int send_sf(struct isotp_send_ctx *ctx)
 
 	frame.data[index++] = ISOTP_PCI_TYPE_SF | len;
 
-	__ASSERT_NO_MSG(len <= ISOTP_CAN_DL - index);
+	if (len > ISOTP_CAN_DL - index) {
+		LOG_ERR("SF len does not fit DL");
+		return -ENOSPC;
+	}
+
 	memcpy(&frame.data[index], data, len);
 
 #ifdef CONFIG_ISOTP_ENABLE_TX_PADDING
@@ -1179,6 +1183,7 @@ static int send(struct isotp_send_ctx *ctx, const struct device *can_dev,
 		ret = attach_fc_filter(ctx);
 		if (ret) {
 			LOG_ERR("Can't attach fc filter: %d", ret);
+			free_send_ctx(&ctx);
 			return ret;
 		}
 
@@ -1190,6 +1195,7 @@ static int send(struct isotp_send_ctx *ctx, const struct device *can_dev,
 		ctx->filter_id = -1;
 		ret = send_sf(ctx);
 		if (ret) {
+			free_send_ctx(&ctx);
 			return ret == -EAGAIN ?
 			       ISOTP_N_TIMEOUT_A : ISOTP_N_ERROR;
 		}

subsys/fs/fuse_fs_access.c

@@ -65,8 +65,15 @@ static void release_file_handle(size_t handle)
 static bool is_mount_point(const char *path)
 {
 	char dir_path[PATH_MAX];
+	size_t len;
 
-	sprintf(dir_path, "%s", path);
+	len = strlen(path);
+	if (len >=  sizeof(dir_path)) {
+		return false;
+	}
+
+	memcpy(dir_path, path, len);
+	dir_path[len] = '\0';
 	return strcmp(dirname(dir_path), "/") == 0;
 }
 

subsys/logging/log_core.c

@@ -596,8 +596,11 @@ static struct log_msg *msg_alloc(struct mpsc_pbuf_buffer *buffer, uint32_t wlen)
 		return NULL;
 	}
 
-	return (struct log_msg *)mpsc_pbuf_alloc(buffer, wlen,
-				K_MSEC(CONFIG_LOG_BLOCK_IN_THREAD_TIMEOUT_MS));
+	return (struct log_msg *)mpsc_pbuf_alloc(
+		buffer, wlen,
+		(CONFIG_LOG_BLOCK_IN_THREAD_TIMEOUT_MS == -1)
+			? K_FOREVER
+			: K_MSEC(CONFIG_LOG_BLOCK_IN_THREAD_TIMEOUT_MS));
 }
 
 struct log_msg *z_log_msg_alloc(uint32_t wlen)

subsys/mgmt/hawkbit/hawkbit.c

@@ -81,7 +81,6 @@ static struct hawkbit_context {
 	uint8_t *response_data;
 	int32_t json_action_id;
 	size_t url_buffer_size;
-	size_t status_buffer_size;
 	struct hawkbit_download dl;
 	struct http_request http_req;
 	struct flash_img_context flash_ctx;
@@ -845,7 +844,7 @@ static bool send_request(enum http_method method, enum hawkbit_http_request type
 
 		ret = json_obj_encode_buf(json_cfg_descr, ARRAY_SIZE(json_cfg_descr), &cfg,
 					  hb_context.status_buffer,
-					  hb_context.status_buffer_size - 1);
+					  sizeof(hb_context.status_buffer));
 		if (ret) {
 			LOG_ERR("Can't encode the JSON script (HAWKBIT_CONFIG_DEVICE): %d", ret);
 			return false;
@@ -875,7 +874,7 @@ static bool send_request(enum http_method method, enum hawkbit_http_request type
 
 		ret = json_obj_encode_buf(json_close_descr, ARRAY_SIZE(json_close_descr), &close,
 					  hb_context.status_buffer,
-					  hb_context.status_buffer_size - 1);
+					  sizeof(hb_context.status_buffer));
 		if (ret) {
 			LOG_ERR("Can't encode the JSON script (HAWKBIT_CLOSE): %d", ret);
 			return false;
@@ -922,7 +921,7 @@ static bool send_request(enum http_method method, enum hawkbit_http_request type
 
 		ret = json_obj_encode_buf(json_dep_fbk_descr, ARRAY_SIZE(json_dep_fbk_descr),
 					  &feedback, hb_context.status_buffer,
-					  hb_context.status_buffer_size - 1);
+					  sizeof(hb_context.status_buffer));
 		if (ret) {
 			LOG_ERR("Can't encode the JSON script (HAWKBIT_REPORT): %d", ret);
 			return ret;

subsys/mgmt/mcumgr/grp/fs_mgmt/src/fs_mgmt.c

@@ -280,9 +280,9 @@ static int fs_mgmt_file_download(struct smp_streamer *ctxt)
 		rc = fs_open(&fs_mgmt_ctxt.file, path, FS_O_READ);
 
 		if (rc != 0) {
-			if (rc == EINVAL) {
+			if (rc == -EINVAL) {
 				rc = FS_MGMT_RET_RC_FILE_INVALID_NAME;
-			} else if (ENOENT) {
+			} else if (rc == -ENOENT) {
 				rc = FS_MGMT_RET_RC_FILE_NOT_FOUND;
 			} else {
 				rc = FS_MGMT_RET_RC_UNKNOWN;
@@ -422,9 +422,9 @@ static int fs_mgmt_file_upload(struct smp_streamer *ctxt)
 		rc = fs_open(&fs_mgmt_ctxt.file, file_name, FS_O_CREATE | FS_O_WRITE);
 
 		if (rc != 0) {
-			if (rc == EINVAL) {
+			if (rc == -EINVAL) {
 				rc = FS_MGMT_RET_RC_FILE_INVALID_NAME;
-			} else if (ENOENT) {
+			} else if (rc == -ENOENT) {
 				rc = FS_MGMT_RET_RC_FILE_NOT_FOUND;
 			} else {
 				rc = FS_MGMT_RET_RC_UNKNOWN;
@@ -741,9 +741,9 @@ static int fs_mgmt_file_hash_checksum(struct smp_streamer *ctxt)
 	rc = fs_open(&file, path, FS_O_READ);
 
 	if (rc != 0) {
-		if (rc == EINVAL) {
+		if (rc == -EINVAL) {
 			rc = FS_MGMT_RET_RC_FILE_INVALID_NAME;
-		} else if (ENOENT) {
+		} else if (rc == -ENOENT) {
 			rc = FS_MGMT_RET_RC_FILE_NOT_FOUND;
 		} else {
 			rc = FS_MGMT_RET_RC_UNKNOWN;

subsys/mgmt/mcumgr/grp/img_mgmt/src/img_mgmt.c

@@ -426,8 +426,13 @@ img_mgmt_upload(struct smp_streamer *ctxt)
 	bool data_match = false;
 #endif
 
-#if defined(CONFIG_MCUMGR_GRP_IMG_UPLOAD_CHECK_HOOK) || defined(CONFIG_MCUMGR_GRP_IMG_STATUS_HOOKS)
+#if defined(CONFIG_MCUMGR_GRP_IMG_UPLOAD_CHECK_HOOK)
 	enum mgmt_cb_return status;
+#endif
+
+#if defined(CONFIG_MCUMGR_GRP_IMG_UPLOAD_CHECK_HOOK) ||	\
+defined(CONFIG_MCUMGR_GRP_IMG_STATUS_HOOKS) ||		\
+defined(CONFIG_MCUMGR_SMP_COMMAND_STATUS_HOOKS)
 	int32_t ret_rc;
 	uint16_t ret_group;
 #endif

subsys/mgmt/mcumgr/grp/shell_mgmt/src/shell_mgmt.c

@@ -83,9 +83,6 @@ shell_mgmt_exec(struct smp_streamer *ctxt)
 
 		ok = zcbor_tstr_decode(zsd, &value);
 		if (ok) {
-			/* TODO: This is original error when failed to collect command line
-			 * to buffer, but should be rather MGMT_ERR_ENOMEM.
-			 */
 			if ((len + value.len) >= (ARRAY_SIZE(line) - 1)) {
 				ok = smp_add_cmd_ret(zse, MGMT_GROUP_ID_SHELL,
 						     SHELL_MGMT_RET_RC_COMMAND_TOO_LONG);
@@ -95,7 +92,7 @@ shell_mgmt_exec(struct smp_streamer *ctxt)
 			memcpy(&line[len], value.value, value.len);
 			len += value.len + 1;
 			line[len - 1] = ' ';
-		} else {
+		} else if (len > 0) {
 			line[len - 1] = 0;
 			/* Implicit break by while condition */
 		}

subsys/mgmt/mcumgr/smp/src/smp.c

@@ -225,9 +225,15 @@ static int smp_handle_single_payload(struct smp_streamer *cbuf, const struct smp
 	}
 
 	if (handler_fn) {
+		bool ok;
+
 		*handler_found = true;
-		zcbor_map_start_encode(cbuf->writer->zs,
-				       CONFIG_MCUMGR_SMP_CBOR_MAX_MAIN_MAP_ENTRIES);
+		ok = zcbor_map_start_encode(cbuf->writer->zs,
+					    CONFIG_MCUMGR_SMP_CBOR_MAX_MAIN_MAP_ENTRIES);
+
+		if (!ok) {
+			return MGMT_ERR_EMSGSIZE;
+		}
 
 #if defined(CONFIG_MCUMGR_SMP_COMMAND_STATUS_HOOKS)
 		cmd_recv.group = req_hdr->nh_group;

subsys/mgmt/mcumgr/transport/Kconfig

@@ -48,19 +48,26 @@ config MCUMGR_TRANSPORT_NETBUF_SIZE
 	  In case when MCUMGR_TRANSPORT_SHELL is enabled this value should be set to
 	  at least MCUMGR_GRP_SHELL_BACKEND_DUMMY_BUF_SIZE + 32.
 
-config MCUMGR_TRANSPORT_NETBUF_USER_DATA_SIZE
-	int "Size of mcumgr buffer user data"
-	default 24 if MCUMGR_TRANSPORT_UDP && MCUMGR_TRANSPORT_UDP_IPV6
+config MCUMGR_TRANSPORT_NETBUF_MIN_USER_DATA_SIZE
+	int
+	default 24 if MCUMGR_TRANSPORT_UDP && NET_IPV6
 	default 8 if MCUMGR_TRANSPORT_UDP && MCUMGR_TRANSPORT_UDP_IPV4
 	default 8 if MCUMGR_TRANSPORT_BT
 	default 4
+	help
+	  Hidden option to determine minimum user data size.
+
+config MCUMGR_TRANSPORT_NETBUF_USER_DATA_SIZE
+	int "Size of mcumgr buffer user data"
+	range MCUMGR_TRANSPORT_NETBUF_MIN_USER_DATA_SIZE 128
+	default MCUMGR_TRANSPORT_NETBUF_MIN_USER_DATA_SIZE
 	help
 	  The size, in bytes, of user data to allocate for each mcumgr buffer.
 
 	  Different mcumgr transports impose different requirements for this
 	  setting. A value of 4 is sufficient for UART and shell, a value of 8
 	  is sufficient for Bluetooth. For UDP, the userdata must be large
-	  enough to hold a IPv4/IPv6 address.
+	  enough to hold IPv4/IPv6 addresses.
 
 module = MCUMGR_TRANSPORT
 module-str = mcumgr_transport

subsys/mgmt/mcumgr/transport/src/smp_udp.c

@@ -42,6 +42,9 @@ BUILD_ASSERT(0, "Either IPv4 or IPv6 SMP must be enabled for the MCUmgr UDP SMP
 		"CONFIG_MCUMGR_TRANSPORT_UDP_IPV4 or CONFIG_MCUMGR_TRANSPORT_UDP_IPV6");
 #endif
 
+BUILD_ASSERT(sizeof(struct sockaddr) <= CONFIG_MCUMGR_TRANSPORT_NETBUF_USER_DATA_SIZE,
+	     "CONFIG_MCUMGR_TRANSPORT_NETBUF_USER_DATA_SIZE must be >= sizeof(struct sockaddr)");
+
 #define IS_THREAD_RUNNING(thread)					\
 	(thread.base.thread_state & (_THREAD_PENDING |			\
 				     _THREAD_PRESTART |			\
@@ -87,9 +90,7 @@ static struct configs configs = {
 #endif
 };
 
-#ifdef CONFIG_MCUMGR_TRANSPORT_UDP_AUTOMATIC_INIT
 static struct net_mgmt_event_callback smp_udp_mgmt_cb;
-#endif
 
 static const char *smp_udp_proto_to_name(enum proto_type proto)
 {

subsys/net/ip/ipv4.c

@@ -219,7 +219,7 @@ int net_ipv4_parse_hdr_options(struct net_pkt *pkt,
 }
 #endif
 
-enum net_verdict net_ipv4_input(struct net_pkt *pkt)
+enum net_verdict net_ipv4_input(struct net_pkt *pkt, bool is_loopback)
 {
 	NET_PKT_DATA_ACCESS_CONTIGUOUS_DEFINE(ipv4_access, struct net_ipv4_hdr);
 	NET_PKT_DATA_ACCESS_DEFINE(udp_access, struct net_udp_hdr);
@@ -280,6 +280,19 @@ enum net_verdict net_ipv4_input(struct net_pkt *pkt)
 		net_pkt_update_length(pkt, pkt_len);
 	}
 
+	if (!is_loopback) {
+		if (net_ipv4_is_addr_loopback((struct in_addr *)hdr->dst) ||
+		    net_ipv4_is_addr_loopback((struct in_addr *)hdr->src)) {
+			NET_DBG("DROP: localhost packet");
+			goto drop;
+		}
+
+		if (net_ipv4_is_my_addr((struct in_addr *)hdr->src)) {
+			NET_DBG("DROP: src addr is %s", "mine");
+			goto drop;
+		}
+	}
+
 	if (net_ipv4_is_addr_mcast((struct in_addr *)hdr->src)) {
 		NET_DBG("DROP: src addr is %s", "mcast");
 		goto drop;

subsys/net/ip/ipv6.c

@@ -502,6 +502,11 @@ enum net_verdict net_ipv6_input(struct net_pkt *pkt, bool is_loopback)
 			NET_DBG("DROP: invalid scope multicast packet");
 			goto drop;
 		}
+
+		if (net_ipv6_is_my_addr((struct in6_addr *)hdr->src)) {
+			NET_DBG("DROP: src addr is %s", "mine");
+			goto drop;
+		}
 	}
 
 	/* Reconstruct TC field. */

subsys/net/ip/net_context.c

@@ -337,6 +337,8 @@ int net_context_get(sa_family_t family, enum net_sock_type type, uint16_t proto,
 			*context = NULL;
 			return ret;
 		}
+
+		net_context_set_iface(*context, net_if_get_default());
 	}
 
 	return 0;

subsys/net/ip/net_core.c

@@ -135,7 +135,7 @@ static inline enum net_verdict process_data(struct net_pkt *pkt,
 		if (IS_ENABLED(CONFIG_NET_IPV6) && vtc_vhl == 0x60) {
 			return net_ipv6_input(pkt, is_loopback);
 		} else if (IS_ENABLED(CONFIG_NET_IPV4) && vtc_vhl == 0x40) {
-			return net_ipv4_input(pkt);
+			return net_ipv4_input(pkt, is_loopback);
 		}
 
 		NET_DBG("Unknown IP family packet (0x%x)", NET_IPV6_HDR(pkt)->vtc & 0xf0);

subsys/net/ip/net_private.h

@@ -72,12 +72,14 @@ static inline const char *net_context_state(struct net_context *context)
 #endif
 
 #if defined(CONFIG_NET_NATIVE)
-enum net_verdict net_ipv4_input(struct net_pkt *pkt);
+enum net_verdict net_ipv4_input(struct net_pkt *pkt, bool is_loopback);
 enum net_verdict net_ipv6_input(struct net_pkt *pkt, bool is_loopback);
 #else
-static inline enum net_verdict net_ipv4_input(struct net_pkt *pkt)
+static inline enum net_verdict net_ipv4_input(struct net_pkt *pkt,
+					      bool is_loopback)
 {
 	ARG_UNUSED(pkt);
+	ARG_UNUSED(is_loopback);
 
 	return NET_CONTINUE;
 }

subsys/net/l2/wifi/wifi_shell.c

@@ -326,6 +326,9 @@ static int __wifi_args_to_params(size_t argc, char *argv[],
 	/* SSID */
 	params->ssid = argv[0];
 	params->ssid_length = strlen(params->ssid);
+	if (params->ssid_length > WIFI_SSID_MAX_LEN) {
+		return -EINVAL;
+	}
 
 	/* Channel (optional) */
 	if ((idx < argc) && (strlen(argv[idx]) <= 3)) {
@@ -371,6 +374,14 @@ static int __wifi_args_to_params(size_t argc, char *argv[],
 				idx++;
 			}
 		}
+
+		if (params->psk_length < WIFI_PSK_MIN_LEN ||
+		    (params->security != WIFI_SECURITY_TYPE_SAE &&
+		     params->psk_length > WIFI_PSK_MAX_LEN) ||
+		    (params->security == WIFI_SECURITY_TYPE_SAE &&
+		     params->psk_length > WIFI_SAE_PSWD_MAX_LEN)) {
+			return -EINVAL;
+		}
 	} else {
 		params->security = WIFI_SECURITY_TYPE_NONE;
 	}